Merge m-c to s-c.

2013-01-09 12:48:01 -08:00 · 2013-01-09 12:48:01 -08:00 · c631a7ef40
--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@ -92,8 +92,8 @@ MustBeAccessible(nsIContent* aContent, DocAccessible* aDocument)
  if (aContent->GetPrimaryFrame()->IsFocusable())
    return true;

-  PRUint32 attrCount = aContent->GetAttrCount();
-  for (PRUint32 attrIdx = 0; attrIdx < attrCount; attrIdx++) {
+  uint32_t attrCount = aContent->GetAttrCount();
+  for (uint32_t attrIdx = 0; attrIdx < attrCount; attrIdx++) {
    const nsAttrName* attr = aContent->GetAttrNameAt(attrIdx);
    if (attr->NamespaceEquals(kNameSpaceID_None)) {
      nsIAtom* attrAtom = attr->Atom();
--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@ -328,9 +328,6 @@ pref("urlclassifier.alternate_error_page", "blocked");
 // The number of random entries to send with a gethash request.
 pref("urlclassifier.gethashnoise", 4);

-// Randomize all UrlClassifier data with a per-client key.
-pref("urlclassifier.randomizeclient", false);
-
 // The list of tables that use the gethash request to confirm partial results.
 pref("urlclassifier.gethashtables", "goog-phish-shavar,goog-malware-shavar");

--- a/b2g/chrome/content/shell.js
+++ b/b2g/chrome/content/shell.js
@ -974,15 +974,6 @@ window.addEventListener('ContentStart', function update_onContentStart() {
 }, "audio-channel-changed", false);
 })();

-(function audioChannelChangedTracker() {
-  Services.obs.addObserver(function(aSubject, aTopic, aData) {
-    shell.sendChromeEvent({
-      type: 'audio-channel-changed',
-      channel: aData
-    });
-}, "audio-channel-changed", false);
-})();
-
 (function recordingStatusTracker() {
  let gRecordingActiveCount = 0;

--- a/b2g/components/ActivitiesGlue.js
+++ b/b2g/components/ActivitiesGlue.js
@ -24,7 +24,7 @@ ActivitiesDialog.prototype = {

    let choices = [];
    activity.list.forEach(function(item) {
-      choices.push({ title: item.title, icon: item.icon });
+      choices.push({ manifest: item.manifest, icon: item.icon });
    });


--- a/b2g/components/ContentPermissionPrompt.js
+++ b/b2g/components/ContentPermissionPrompt.js
@ -18,7 +18,7 @@ const Cr = Components.results;
 const Cu = Components.utils;
 const Cc = Components.classes;

-const PROMPT_FOR_UNKNOWN = ['geolocation'];
+const PROMPT_FOR_UNKNOWN = ['geolocation', 'desktop-notification'];

 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
@ -88,12 +88,32 @@ ContentPermissionPrompt.prototype = {
    return false;
  },

-  _id: 0,
  prompt: function(request) {
    // returns true if the request was handled
    if (this.handleExistingPermission(request))
       return;

+    // If the request was initiated from a hidden iframe
+    // we don't forward it to content and cancel it right away
+    let frame = request.element;
+
+    if (!frame) {
+      this.delegatePrompt(request);
+    }
+
+    var self = this;
+    frame.wrappedJSObject.getVisible().onsuccess = function gv_success(evt) {
+      if (!evt.target.result) {
+        request.cancel();
+        return;
+      }
+
+      self.delegatePrompt(request);
+    };
+  },
+
+  _id: 0,
+  delegatePrompt: function(request) {
    let browser = Services.wm.getMostRecentWindow("navigator:browser");
    let content = browser.getContentWindow();
    if (!content)
--- a/b2g/components/UpdatePrompt.js
+++ b/b2g/components/UpdatePrompt.js
@ -460,11 +460,20 @@ UpdatePrompt.prototype = {

  // nsIRequestObserver

+  _startedSent: false,
+
  onStartRequest: function UP_onStartRequest(aRequest, aContext) {
-    this.sendChromeEvent("update-downloading");
+    // Wait until onProgress to send the update-download-started event, in case
+    // this request turns out to fail for some reason
+    this._startedSent = false;
  },

  onStopRequest: function UP_onStopRequest(aRequest, aContext, aStatusCode) {
+    let paused = !Components.isSuccessCode(aStatusCode);
+    this.sendChromeEvent("update-download-stopped", {
+        paused: paused
+    });
+
    Services.aus.removeDownloadListener(this);
  },

@ -472,7 +481,14 @@ UpdatePrompt.prototype = {

  onProgress: function UP_onProgress(aRequest, aContext, aProgress,
                                     aProgressMax) {
-    this.sendChromeEvent("update-progress", {
+    if (!this._startedSent) {
+      this.sendChromeEvent("update-download-started", {
+        total: aProgressMax
+      });
+      this._startedSent = true;
+    }
+
+    this.sendChromeEvent("update-download-progress", {
      progress: aProgress,
      total: aProgressMax
    });
--- a/b2g/components/YoutubeProtocolHandler.js
+++ b/b2g/components/YoutubeProtocolHandler.js
@ -31,155 +31,27 @@ YoutubeProtocolHandler.prototype = {

  // Sample URL:
  // vnd.youtube:iNuKL2Gy_QM?vndapp=youtube_mobile&vndclient=mv-google&vndel=watch&vnddnc=1
+  // Note that there is no hostname, so we use URLTYPE_NO_AUTHORITY
  newURI: function yt_phNewURI(aSpec, aOriginCharset, aBaseURI) {
    let uri = Cc["@mozilla.org/network/standard-url;1"]
              .createInstance(Ci.nsIStandardURL);
-    let id = aSpec.substring(this.scheme.length + 1);
-    id = id.substring(0, id.indexOf('?'));
-    uri.init(Ci.nsIStandardURL.URLTYPE_STANDARD, -1, this.scheme + "://dummy_host/" + id, aOriginCharset,
-             aBaseURI);
+    uri.init(Ci.nsIStandardURL.URLTYPE_NO_AUTHORITY, this.defaultPort,
+             aSpec, aOriginCharset, aBaseURI);
    return uri.QueryInterface(Ci.nsIURI);
  },

  newChannel: function yt_phNewChannel(aURI) {
-    // Get a list of streams for this video id.
-    let infoURI = "http://www.youtube.com/get_video_info?&video_id=" +
-                  aURI.path.substring(1);
-
-    let xhr = Cc["@mozilla.org/xmlextras/xmlhttprequest;1"]
-                .createInstance(Ci.nsIXMLHttpRequest);
-    xhr.open("GET", infoURI, true);
-    xhr.addEventListener("load", function() {
-      try {
-        let info = parseYoutubeVideoInfo(xhr.responseText);
-        cpmm.sendAsyncMessage("content-handler", info);
-      }
-      catch(e) {
-        // If parseYoutubeVideoInfo() can't find a video URL, it
-        // throws an Error. We report the error message here and do
-        // nothing. This shouldn't happen often. But if it does, the user
-        // will find that clicking on a video doesn't do anything.
-        log(e.message);
-      }
+    /*
+     * This isn't a real protocol handler. Instead of creating a channel
+     * we just send a message and throw an exception. This 'content-handler'
+     * message is handled in b2g/chrome/content/shell.js where it starts
+     * an activity request that will open the Video app. The video app
+     * includes code to handle this fake 'video/youtube' mime type
+     */
+    cpmm.sendAsyncMessage("content-handler", {
+      type: 'video/youtube', // A fake MIME type for the activity handler
+      url: aURI.spec         // The path component of this URL is the video id
    });
-    xhr.send(null);
-
-    function log(msg) {
-      msg = "YoutubeProtocolHandler.js: " + (msg.join ? msg.join(" ") : msg);
-      Cc["@mozilla.org/consoleservice;1"]
-        .getService(Ci.nsIConsoleService)
-        .logStringMessage(msg);
-    }
-
-    // 
-    // Parse the response from a youtube get_video_info query.
-    // 
-    // If youtube's response is a failure, this function returns an object
-    // with status, errorcode, type and reason properties. Otherwise, it returns
-    // an object with status, url, and type properties, and optional
-    // title, poster, and duration properties.
-    // 
-    function parseYoutubeVideoInfo(response) {
-      // Splits parameters in a query string.
-      function extractParameters(q) {
-        let params = q.split("&");
-        let result = {};
-        for(let i = 0, n = params.length; i < n; i++) {
-          let param = params[i];
-          let pos = param.indexOf('=');
-          if (pos === -1) 
-            continue;
-          let name = param.substring(0, pos);
-          let value = param.substring(pos+1);
-          result[name] = decodeURIComponent(value);
-        }
-        return result;
-      }
-
-      let params = extractParameters(response);
-      
-      // If the request failed, return an object with an error code
-      // and an error message
-      if (params.status === 'fail') {
-        // 
-        // Hopefully this error message will be properly localized.
-        // Do we need to add any parameters to the XMLHttpRequest to 
-        // specify the language we want?
-        // 
-        // Note that we include fake type and url properties in the returned
-        // object. This is because we still need to trigger the video app's
-        // view activity handler to display the error message from youtube,
-        // and those parameters are required.
-        //
-        return {
-          status: params.status,
-          errorcode: params.errorcode,
-          reason:  (params.reason || '').replace(/\+/g, ' '),
-          type: 'video/3gpp',
-          url: 'https://m.youtube.com'
-        }
-      }
-
-      // Otherwise, the query was successful
-      let result = {
-        status: params.status,
-      };
-
-      // Now parse the available streams
-      let streamsText = params.url_encoded_fmt_stream_map;
-      if (!streamsText)
-        throw Error("No url_encoded_fmt_stream_map parameter");
-      let streams = streamsText.split(',');
-      for(let i = 0, n = streams.length; i < n; i++) {
-        streams[i] = extractParameters(streams[i]);
-      }
-
-      // This is the list of youtube video formats, ordered from worst
-      // (but playable) to best.  These numbers are values used as the
-      // itag parameter of each stream description. See
-      // https://en.wikipedia.org/wiki/YouTube#Quality_and_codecs
-      let formats = [
-        "17", // 144p 3GP
-        "36", // 240p 3GP
-        "43", // 360p WebM
-#ifdef MOZ_WIDGET_GONK
-        "18", // 360p H.264
-#endif
-      ];
-
-      // Sort the array of stream descriptions in order of format
-      // preference, so that the first item is the most preferred one
-      streams.sort(function(a, b) {
-        let x = a.itag ? formats.indexOf(a.itag) : -1;
-        let y = b.itag ? formats.indexOf(b.itag) : -1;
-        return y - x;
-      });
-
-      let bestStream = streams[0];
-
-      // If the best stream is a format we don't support just return
-      if (formats.indexOf(bestStream.itag) === -1) 
-        throw Error("No supported video formats");
-
-      result.url = bestStream.url + '&signature=' + (bestStream.sig || '');
-      result.type = bestStream.type;
-      // Strip codec information off of the mime type
-      if (result.type && result.type.indexOf(';') !== -1) {
-        result.type = result.type.split(';',1)[0];
-      }
-
-      if (params.title) {
-        result.title = params.title.replace(/\+/g, ' ');
-      }
-      if (params.length_seconds) {
-        result.duration = params.length_seconds;
-      }
-      if (params.thumbnail_url) {
-        result.poster = params.thumbnail_url;
-      }
-
-      return result;
-    }

    throw Components.results.NS_ERROR_ILLEGAL_VALUE;
  },
--- a/browser/app/profile/extensions/Makefile.in
+++ b/browser/app/profile/extensions/Makefile.in
@ -27,14 +27,6 @@ all_xpis = $(foreach dir,$(EXTENSIONS),$(DISTROEXT)/$(dir).xpi)
 libs:: $(all_xpis)
 GARBAGE += $(all_xpis)

-$(all_xpis): $(DISTROEXT)/%.xpi: $(call mkdir_deps,$(DISTROEXT)) libs-%
-	cd $* && \
-	$(ZIP) -r9XD $@ * -x \*.in -x \*.mkdir.done
-	cd $(call core_abspath,$(srcdir)/$*) && \
-	$(ZIP) -r9XD $@ * -x \*.in -x \*.mkdir.done
-
-.PHONY: $(all_xpis:.xpi=)
-
 define pp_one
 $(2) := $(2)
 $(2)_PATH := $(dir $(2))
@ -50,3 +42,11 @@ $(foreach d,$(EXTENSIONS), \
 endif

 include $(topsrcdir)/config/rules.mk
+
+$(all_xpis): $(DISTROEXT)/%.xpi: $(call mkdir_deps,$(DISTROEXT)) libs-%
+	cd $* && \
+	$(ZIP) -r9XD $@ * -x \*.in -x \*.mkdir.done
+	cd $(call core_abspath,$(srcdir)/$*) && \
+	$(ZIP) -r9XD $@ * -x \*.in -x \*.mkdir.done
+
+.PHONY: $(all_xpis:.xpi=)
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@ -736,9 +736,6 @@ pref("urlclassifier.alternate_error_page", "blocked");
 // The number of random entries to send with a gethash request.
 pref("urlclassifier.gethashnoise", 4);

-// Randomize all UrlClassifier data with a per-client key.
-pref("urlclassifier.randomizeclient", false);
-
 // The list of tables that use the gethash request to confirm partial results.
 pref("urlclassifier.gethashtables", "goog-phish-shavar,goog-malware-shavar");

--- a/browser/base/content/browser-plugins.js
+++ b/browser/base/content/browser-plugins.js
@ -280,8 +280,7 @@ var gPluginHandler = {

    let notification = PopupNotifications.getNotification("click-to-play-plugins", aBrowser);
    if (notification && plugins.length > 0 && !haveVisibleCTPPlugin && !this._notificationDisplayedOnce) {
-      notification.dismissed = false;
-      PopupNotifications._update(notification.anchorElement);
+      notification.reshow();
      this._notificationDisplayedOnce = true;
    }

--- a/browser/base/content/browser-social.js
+++ b/browser/base/content/browser-social.js
@ -132,7 +132,7 @@ let SocialUI = {
          break;
      }
    } catch (e) {
-      Components.utils.reportError(e + e.stack);
+      Components.utils.reportError(e + "\n" + e.stack);
      throw e;
    }
  },
@ -719,6 +719,8 @@ var SocialToolbar = {
    if (!Social.provider)
      return;
    this.button.style.listStyleImage = "url(" + Social.provider.iconURL + ")";
+    this.button.setAttribute("label", Social.provider.name);
+    this.button.setAttribute("tooltiptext", Social.provider.name);
    this.updateButton();
    this.updateProfile();
    this.populateProviderMenus();
@ -779,7 +781,6 @@ var SocialToolbar = {
    let provider = Social.provider;
    let icons = provider.ambientNotificationIcons;
    let iconNames = Object.keys(icons);
-    let iconBox = document.getElementById("social-toolbar-item");
    let panel = document.getElementById("social-notification-panel");
    panel.hidden = false;

@ -824,7 +825,7 @@ var SocialToolbar = {
                                     str);
    }

-    let iconContainers = document.createDocumentFragment();
+    let toolbarButtons = document.createDocumentFragment();

    let createdFrames = [];

@ -835,7 +836,6 @@ var SocialToolbar = {
      let notificationFrame = document.getElementById(notificationFrameId);

      if (!notificationFrame) {
-
        notificationFrame = SharedFrame.createFrame(
          notificationFrameId, /* frame name */
          panel, /* parent */
@ -860,56 +860,41 @@ var SocialToolbar = {
        SharedFrame.updateURL(notificationFrameId, icon.contentPanel);
      }

-      let iconId = "social-notification-icon-" + icon.name;
-      let imageId = iconId + "-image";
-      let labelId = iconId + "-label";
-      let stackId = iconId + "-stack";
-      let stack = document.getElementById(stackId);
-      let image, label;
-      if (stack) {
-        image = document.getElementById(imageId);
-        label = document.getElementById(labelId);
-      } else {
-        let box = document.createElement("box");
-        box.classList.add("toolbarbutton-1");
-        box.setAttribute("id", iconId);
-        // Use the accessibility menuitem label as tooltiptext.
-        if (icon.label)
-          box.setAttribute("tooltiptext", icon.label);
-        box.addEventListener("mousedown", function (e) {
-          if (e.button == 0)
-            SocialToolbar.showAmbientPopup(box);
-        }, false);
-        box.setAttribute("notificationFrameId", notificationFrameId);
-        stack = document.createElement("stack");
-        stack.setAttribute("id", stackId);
-        stack.classList.add("social-notification-icon-stack");
-        stack.classList.add("toolbarbutton-icon");
-        image = document.createElement("image");
-        image.setAttribute("id", imageId);
-        image.classList.add("social-notification-icon-image");
-        image = stack.appendChild(image);
-        label = document.createElement("label");
-        label.setAttribute("id", labelId);
-        label.classList.add("social-notification-icon-label");
-        let hbox = document.createElement("hbox");
-        hbox.classList.add("social-notification-icon-hbox");
-        hbox.setAttribute("align", "start");
-        hbox.setAttribute("pack", "end");
-        label = hbox.appendChild(label);
-        stack.appendChild(hbox);
-        box.appendChild(stack);
-        iconContainers.appendChild(box);
+      let toolbarButtonContainerId = "social-notification-container-" + icon.name;
+      let toolbarButtonId = "social-notification-icon-" + icon.name;
+      let toolbarButtonContainer = document.getElementById(toolbarButtonContainerId);
+      let toolbarButton = document.getElementById(toolbarButtonId);
+      if (!toolbarButtonContainer) {
+        // The container is used to fix an issue with position:absolute on
+        // generated content not being constrained to the bounding box of a
+        // parent toolbarbutton that has position:relative.
+        toolbarButtonContainer = document.createElement("toolbaritem");
+        toolbarButtonContainer.classList.add("social-notification-container");
+        toolbarButtonContainer.setAttribute("id", toolbarButtonContainerId);
+
+        toolbarButton = document.createElement("toolbarbutton");
+        toolbarButton.classList.add("toolbarbutton-1");
+        toolbarButton.setAttribute("id", toolbarButtonId);
+        toolbarButton.setAttribute("notificationFrameId", notificationFrameId);
+        toolbarButton.addEventListener("mousedown", function (event) {
+          if (event.button == 0)
+            SocialToolbar.showAmbientPopup(toolbarButton);
+        });
+
+        toolbarButtonContainer.appendChild(toolbarButton);
+        toolbarButtons.appendChild(toolbarButtonContainer);
      }

-      let labelValue = icon.counter || "";
-      // Only update the value attribute if it has changed to reduce layout changes.
-      if (!label.hasAttribute("value") || label.getAttribute("value") != labelValue)
-        label.setAttribute("value", labelValue);
+      toolbarButton.style.listStyleImage = "url(" + icon.iconURL + ")";
+      toolbarButton.setAttribute("label", icon.label);
+      toolbarButton.setAttribute("tooltiptext", icon.label);

-      image.style.listStyleImage = "url(" + icon.iconURL + ")";
+      let badge = icon.counter || "";
+      if (toolbarButton.getAttribute("badge") != badge)
+        toolbarButton.setAttribute("badge", badge);
    }
-    iconBox.appendChild(iconContainers);
+    let socialToolbarItem = document.getElementById("social-toolbar-item");
+    socialToolbarItem.appendChild(toolbarButtons);

    for (let frame of createdFrames) {
      if (frame.docShell) {
@ -923,12 +908,12 @@ var SocialToolbar = {
    }
  },

-  showAmbientPopup: function SocialToolbar_showAmbientPopup(aToolbarButtonBox) {
+  showAmbientPopup: function SocialToolbar_showAmbientPopup(aToolbarButton) {
    // Hide any other social panels that may be open.
    SocialFlyout.panel.hidePopup();

    let panel = document.getElementById("social-notification-panel");
-    let notificationFrameId = aToolbarButtonBox.getAttribute("notificationFrameId");
+    let notificationFrameId = aToolbarButton.getAttribute("notificationFrameId");
    let notificationFrame = document.getElementById(notificationFrameId);

    let wasAlive = SharedFrame.isGroupAlive(notificationFrameId);
@ -951,7 +936,8 @@ var SocialToolbar = {
    let dynamicResizer = this._dynamicResizer;
    panel.addEventListener("popuphidden", function onpopuphiding() {
      panel.removeEventListener("popuphidden", onpopuphiding);
-      aToolbarButtonBox.removeAttribute("open");
+      aToolbarButton.removeAttribute("open");
+      aToolbarButton.parentNode.removeAttribute("open");
      dynamicResizer.stop();
      notificationFrame.docShell.isActive = false;
      dispatchPanelEvent("socialFrameHide");
@ -959,7 +945,13 @@ var SocialToolbar = {

    panel.addEventListener("popupshown", function onpopupshown() {
      panel.removeEventListener("popupshown", onpopupshown);
-      aToolbarButtonBox.setAttribute("open", "true");
+      // This attribute is needed on both the button and the
+      // containing toolbaritem since the buttons on OS X have
+      // moz-appearance:none, while their container gets
+      // moz-appearance:toolbarbutton due to the way that toolbar buttons
+      // get combined on OS X.
+      aToolbarButton.setAttribute("open", "true");
+      aToolbarButton.parentNode.setAttribute("open", "true");
      notificationFrame.docShell.isActive = true;
      notificationFrame.docShell.isAppTab = true;
      if (notificationFrame.contentDocument.readyState == "complete" && wasAlive) {
@ -977,9 +969,8 @@ var SocialToolbar = {
      }
    });

-    let imageId = aToolbarButtonBox.getAttribute("id") + "-image";
-    let toolbarButtonImage = document.getElementById(imageId);
-    panel.openPopup(toolbarButtonImage, "bottomcenter topright", 0, 0, false, false);
+    let toolbarButtonIcon = document.getAnonymousElementByAttribute(aToolbarButton, "class", "toolbarbutton-icon");
+    panel.openPopup(toolbarButtonIcon, "bottomcenter topright", 0, 0, false, false);
  },

  setPanelErrorMessage: function SocialToolbar_setPanelErrorMessage(aNotificationFrame) {
--- a/browser/base/content/browser.css
+++ b/browser/base/content/browser.css
@ -618,6 +618,10 @@ html|*#gcli-output-frame,
  transition: none;
 }

+.social-notification-container > .toolbarbutton-1[badge]:not([badge=""])::after {
+  content: attr(badge);
+}
+
 chatbox {
  -moz-binding: url("chrome://browser/content/socialchat.xml#chatbox");
 }
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@ -6925,6 +6925,12 @@ let gPrivateBrowsingUI = {
      return;
    }

+#ifdef XP_MACOSX
+    if (!PrivateBrowsingUtils.permanentPrivateBrowsing) {
+      document.documentElement.setAttribute("drawintitlebar", true);
+    }
+#endif
+
    // Disable the Clear Recent History... menu item when in PB mode
    // temporary fix until bug 463607 is fixed
    document.getElementById("Tools:Sanitize").setAttribute("disabled", "true");
@ -6936,7 +6942,8 @@ let gPrivateBrowsingUI = {
        docElement.getAttribute("title_privatebrowsing"));
      docElement.setAttribute("titlemodifier",
        docElement.getAttribute("titlemodifier_privatebrowsing"));
-      docElement.setAttribute("privatebrowsingmode", "temporary");
+      docElement.setAttribute("privatebrowsingmode",
+        PrivateBrowsingUtils.permanentPrivateBrowsing ? "permanent" : "temporary");
      gBrowser.updateTitlebar();
    }

--- a/browser/base/content/test/browser_pluginnotification.js
+++ b/browser/base/content/test/browser_pluginnotification.js
@ -827,9 +827,8 @@ function test21a() {
  }

  // we have to actually show the panel to get the bindings to instantiate
-  notification.options.dismissed = false;
  notification.options.eventCallback = test21b;
-  PopupNotifications._showPanel([notification], notification.anchorElement);
+  notification.reshow();
 }

 function test21b() {
@ -887,9 +886,8 @@ function test21c() {
  }

  // we have to actually show the panel to get the bindings to instantiate
-  notification.options.dismissed = false;
  notification.options.eventCallback = test21d;
-  PopupNotifications._showPanel([notification], notification.anchorElement);
+  notification.reshow();
 }

 function test21d() {
--- a/browser/base/content/test/social/browser_social_mozSocial_API.js
+++ b/browser/base/content/test/social/browser_social_mozSocial_API.js
@ -28,10 +28,10 @@ var tests = {
    }

    function triggerIconPanel() {
-      let statusIcon = document.querySelector("#social-toolbar-item > box");
+      let statusIcon = document.querySelector("#social-toolbar-item > .social-notification-container > .toolbarbutton-1");
      info("status icon is " + statusIcon);
      waitForCondition(function() {
-        statusIcon = document.querySelector("#social-toolbar-item > box");
+        statusIcon = document.querySelector("#social-toolbar-item > .social-notification-container > .toolbarbutton-1");
        info("status icon is " + statusIcon);
        return !!statusIcon;
      }, function() {
--- a/browser/base/content/test/social/browser_social_toolbar.js
+++ b/browser/base/content/test/social/browser_social_toolbar.js
@ -103,17 +103,18 @@ var tests = {
    Social.provider.setAmbientNotification(ambience2);
    Social.provider.setAmbientNotification(ambience3);

-    let statusIcon = document.querySelector("#social-toolbar-item > box");
+    let statusIcon = document.querySelector("#social-toolbar-item > .social-notification-container > .toolbarbutton-1");
    waitForCondition(function() {
-      statusIcon = document.querySelector("#social-toolbar-item > box");
+      statusIcon = document.querySelector("#social-toolbar-item > .social-notification-container > .toolbarbutton-1");
      return !!statusIcon;
    }, function () {
-      let statusIconLabel = statusIcon.querySelector("label");
-      is(statusIconLabel.value, "42", "status value is correct");
+      let badge = statusIcon.getAttribute("badge");
+      is(badge, "42", "status value is correct");

      ambience.counter = 0;
      Social.provider.setAmbientNotification(ambience);
-      is(statusIconLabel.value, "", "status value is correct");
+      badge = statusIcon.getAttribute("badge");
+      is(badge, "", "status value is correct");

      // The menu bar isn't as easy to instrument on Mac.
      if (navigator.platform.contains("Mac"))
--- a/browser/components/Makefile.in
+++ b/browser/components/Makefile.in
@ -17,8 +17,11 @@ XPIDLSRCS = \
  nsIBrowserHandler.idl \
  $(NULL)

-EXTRA_PP_COMPONENTS = \
+EXTRA_COMPONENTS = \
  BrowserComponents.manifest \
+  $(NULL)
+
+EXTRA_PP_COMPONENTS = \
  nsBrowserContentHandler.js \
  nsBrowserGlue.js \
  $(NULL)
--- a/browser/components/downloads/content/allDownloadsViewOverlay.css
+++ b/browser/components/downloads/content/allDownloadsViewOverlay.css
@ -1,8 +1,8 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this file,
 * You can obtain one at http://mozilla.org/MPL/2.0/. */
- 
-richlistitem.download {
+
+richlistitem.download[active] {
  -moz-binding: url('chrome://browser/content/downloads/download.xml#download-full-ui');
 }

@ -13,12 +13,12 @@ richlistitem.download {
 .download-state:not(:-moz-any([state="2"], /* Failed             */
                              [state="4"]) /* Paused             */)
                                           .downloadCancelMenuItem,
-.download-state:not(:-moz-any([state="1"], /* Finished           */
-                              [state="2"], /* Failed             */
-                              [state="3"], /* Canceled           */
-                              [state="6"], /* Blocked (parental) */
-                              [state="8"], /* Blocked (dirty)    */
-                              [state="9"]) /* Blocked (policy)   */)
+.download-state[state]:not(:-moz-any([state="1"], /* Finished           */
+                                     [state="2"], /* Failed             */
+                                     [state="3"], /* Canceled           */
+                                     [state="6"], /* Blocked (parental) */
+                                     [state="8"], /* Blocked (dirty)    */
+                                     [state="9"]) /* Blocked (policy)   */)
                                           .downloadRemoveFromHistoryMenuItem,
 .download-state:not(:-moz-any([state="-1"],/* Starting (initial) */
                              [state="0"], /* Downloading        */
@ -26,8 +26,7 @@ richlistitem.download {
                              [state="4"], /* Paused             */
                              [state="5"]) /* Starting (queued)  */)
                                           .downloadShowMenuItem,
-.download-state[state="7"]                 .downloadCommandsSeparator,
-.download-state:not([state])                 .downloadCommandsSeparator
+.download-state[state="7"]                 .downloadCommandsSeparator
 {
  display: none;
 }
--- a/browser/components/downloads/content/allDownloadsViewOverlay.js
+++ b/browser/components/downloads/content/allDownloadsViewOverlay.js
@ -78,7 +78,7 @@ function DownloadElementShell(aDataItem, aPlacesNode, aAnnotations) {
  this._element.classList.add("download");
  this._element.classList.add("download-state");

- if (aAnnotations)
+  if (aAnnotations)
    this._annotations = aAnnotations;
  if (aDataItem)
    this.dataItem = aDataItem;
@ -90,12 +90,30 @@ DownloadElementShell.prototype = {
  // The richlistitem for the download
  get element() this._element,

+  /**
+   * Manages the "active" state of the shell.  By default all the shells
+   * without a dataItem are inactive, thus their UI is not updated.  They must
+   * be activated when entering the visible area.  Session downloads are
+   * always active since they always have a dataItem.
+   */
+  ensureActive: function DES_ensureActive() {
+    if (this._active)
+      return;
+    this._active = true;
+    this._element.setAttribute("active", true);
+    this._updateStatusUI();
+    this._fetchTargetFileInfo();
+  },
+  get active() !!this._active,
+
  // The data item for the download
  _dataItem: null,
  get dataItem() this._dataItem,

  set dataItem(aValue) {
-    if ((this._dataItem = aValue)) {
+    this._dataItem = aValue;
+    if (this._dataItem) {
+      this._active = true;
      this._wasDone = this._dataItem.done;
      this._wasInProgress = this._dataItem.inProgress;
      this._targetFileInfoFetched = false;
@ -105,10 +123,12 @@ DownloadElementShell.prototype = {
      this._wasInProgress = false;
      this._wasDone = this.getDownloadState(true) == nsIDM.DOWNLOAD_FINISHED;
      this._targetFileInfoFetched = false;
-      this._fetchTargetFileInfo();
+      if (this.active)
+        this._fetchTargetFileInfo();
    }

-    this._updateStatusUI();
+    it (this.active)
+      this._updateStatusUI();
    return aValue;
  },

@ -129,8 +149,10 @@ DownloadElementShell.prototype = {
        this._wasInProgress = false;
        this._wasDone = this.getDownloadState(true) == nsIDM.DOWNLOAD_FINISHED;
        this._targetFileInfoFetched = false;
-        this._updateStatusUI();
-        this._fetchTargetFileInfo();
+        if (this.active) {
+          this._updateStatusUI();
+          this._fetchTargetFileInfo();
+        }
      }
    }
    return aNode;
@ -154,8 +176,13 @@ DownloadElementShell.prototype = {
  get _icon() {
    if (this._targetFileURI)
      return "moz-icon://" + this._targetFileURI + "?size=32";
-    if (this._placesNode)
-      return this.placesNode.icon;
+    if (this._placesNode) {
+      // Try to extract an extension from the uri.
+      let ext = this._downloadURIObj.QueryInterface(Ci.nsIURL).fileExtension;
+      if (ext)
+        return "moz-icon://." + ext + "?size=32";
+      return this._placesNode.icon || "moz-icon://.unknown?size=32";
+    }
    if (this._dataItem)
      throw new Error("Session-download items should always have a target file uri");
    throw new Error("Unexpected download element state");
@ -223,6 +250,8 @@ DownloadElementShell.prototype = {
  _fetchTargetFileInfo: function DES__fetchTargetFileInfo() {
    if (this._targetFileInfoFetched)
      throw new Error("_fetchTargetFileInfo should not be called if the information was already fetched");
+    if (!this.active)
+      throw new Error("Trying to _fetchTargetFileInfo on an inactive download shell");

    let path = this._targetFilePath;

@ -406,6 +435,8 @@ DownloadElementShell.prototype = {
  },

  _updateStatusUI: function DES__updateStatusUI() {
+    if (!this.active)
+      throw new Error("Trying to _updateStatusUI on an inactive download shell");
    this._element.setAttribute("displayName", this._displayName);
    this._element.setAttribute("image", this._icon);
    this._updateDownloadStatusUI();
@ -446,7 +477,8 @@ DownloadElementShell.prototype = {
      this._element.setAttribute("image", this._icon + "&state=normal");

      this._targetFileInfoFetched = false;
-      this._fetchTargetFileInfo();
+      if (this.active)
+        this._fetchTargetFileInfo();
    }

    this._wasDone = this._dataItem.done;
@ -471,6 +503,9 @@ DownloadElementShell.prototype = {

  /* nsIController */
  isCommandEnabled: function DES_isCommandEnabled(aCommand) {
+    // The only valid command for inactive elements is cmd_delete.
+    if (!this.active && aCommand != "cmd_delete")
+      return false;
    switch (aCommand) {
      case "downloadsCmd_open": {
        // We cannot open a session dowload file unless it's done ("openable").
@ -574,7 +609,8 @@ DownloadElementShell.prototype = {
  // show up in the search results for the given term.  Both the display
  // name for the download and the url are searched.
  matchesSearchTerm: function DES_matchesSearchTerm(aTerm) {
-    // Stub implemention until we figure out something better
+    if (!aTerm)
+      return true;
    aTerm = aTerm.toLowerCase();
    return this._displayName.toLowerCase().indexOf(aTerm) != -1 ||
           this.downloadURI.toLowerCase().indexOf(aTerm) != -1;
@ -623,7 +659,7 @@ DownloadElementShell.prototype = {
 * as they exist they "collapses" their history "counterpart" (So we don't show two
 * items for every download).
 */
-function DownloadsPlacesView(aRichListBox) {
+function DownloadsPlacesView(aRichListBox, aActive = true) {
  this._richlistbox = aRichListBox;
  this._richlistbox._placesView = this;
  this._richlistbox.controllers.appendController(this);
@ -640,6 +676,8 @@ function DownloadsPlacesView(aRichListBox) {

  this._searchTerm = "";

+  this._active = aActive;
+
  // Register as a downloads view. The places data will be initialized by
  // the places setter.
  let downloadsData = DownloadsCommon.getData(window.opener || window);
@ -651,11 +689,23 @@ function DownloadsPlacesView(aRichListBox) {
    downloadsData.removeView(this);
    this.result = null;
  }.bind(this), true);
+  // Resizing the window may change items visibility.
+  window.addEventListener("resize", function() {
+    this._ensureVisibleElementsAreActive();
+  }.bind(this), true);
 }

 DownloadsPlacesView.prototype = {
  get associatedElement() this._richlistbox,

+  get active() this._active,
+  set active(val) {
+    this._active = val;
+    if (this._active)
+      this._ensureVisibleElementsAreActive();
+    return this._active;
+  },
+
  _forEachDownloadElementShellForURI:
  function DPV__forEachDownloadElementShellForURI(aURI, aCallback) {
    if (this._downloadElementsShellsForURI.has(aURI)) {
@ -811,6 +861,11 @@ DownloadsPlacesView.prototype = {
          !newOrUpdatedShell.element._shell.matchesSearchTerm(this.searchTerm);
      }
    }
+
+    // If aDocumentFragment is defined this is a batch change, so it's up to
+    // the caller to append the fragment and activate the visible shells.
+    if (!aDocumentFragment)
+      this._ensureVisibleElementsAreActive();
  },

  _removeElement: function DPV__removeElement(aElement) {
@ -823,6 +878,7 @@ DownloadsPlacesView.prototype = {
      this._richlistbox.selectItem(aElement.nextSibling);
    }
    this._richlistbox.removeChild(aElement);
+    this._ensureVisibleElementsAreActive();
  },

  _removeHistoryDownloadFromView:
@ -879,6 +935,38 @@ DownloadsPlacesView.prototype = {
    }
  },

+  _ensureVisibleElementsAreActive:
+  function DPV__ensureVisibleElementsAreActive() {
+    if (!this.active || this._ensureVisibleTimer || !this._richlistbox.firstChild)
+      return;
+
+    this._ensureVisibleTimer = setTimeout(function() {
+      delete this._ensureVisibleTimer;
+
+      let rlRect = this._richlistbox.getBoundingClientRect();
+      let fcRect = this._richlistbox.firstChild.getBoundingClientRect();
+      // For simplicity assume border and padding are the same across all sides.
+      // This works as far as there isn't an horizontal scrollbar since fcRect
+      // is relative to the scrolled area.
+      let offset = fcRect.left - rlRect.left + 1;
+
+      let firstVisible = document.elementFromPoint(fcRect.left, rlRect.top + offset);
+      if (!firstVisible || firstVisible.localName != "richlistitem")
+        throw new Error("_ensureVisibleElementsAreActive invoked on the wrong view");
+
+      let lastVisible = document.elementFromPoint(fcRect.left, rlRect.bottom - offset);
+      // If the last visible child found is not a richlistitem, then there are
+      // less items than the available space, thus just proceed to the last child.
+      if (!lastVisible || lastVisible.localName != "richlistitem")
+        lastVisible = this._richlistbox.lastChild;
+
+      for (let elt = firstVisible; elt != lastVisible.nextSibling; elt = elt.nextSibling) {
+        if (elt._shell)
+          elt._shell.ensureActive();
+      }
+    }.bind(this), 10);
+  },
+
  _place: "",
  get place() this._place,
  set place(val) {
@ -975,6 +1063,7 @@ DownloadsPlacesView.prototype = {
    }

    this._richlistbox.appendChild(elementsToAppendFragment);
+    this._ensureVisibleElementsAreActive();
  },

  nodeInserted: function DPV_nodeInserted(aParent, aPlacesNode) {
@ -1022,6 +1111,7 @@ DownloadsPlacesView.prototype = {
      for (let element of this._richlistbox.childNodes) {
        element.hidden = !element._shell.matchesSearchTerm(aValue);
      }
+      this._ensureVisibleElementsAreActive();
    }
    return this._searchTerm = aValue;
  },
@ -1198,6 +1288,10 @@ DownloadsPlacesView.prototype = {
    let element = selectedElements[0];
    if (element._shell)
      element._shell.doDefaultCommand();
+  },
+
+  onScroll: function DPV_onScroll() {
+    this._ensureVisibleElementsAreActive();
  }
 };

--- a/browser/components/downloads/content/allDownloadsViewOverlay.xul
+++ b/browser/components/downloads/content/allDownloadsViewOverlay.xul
@ -42,6 +42,7 @@
  <richlistbox flex="1"
               seltype="multiple"
               id="downloadsRichListBox" context="downloadsContextMenu"
+               onscroll="return this._placesView.onScroll();"
               onkeypress="return this._placesView.onKeyPress(event);"
               ondblclick="return this._placesView.onDoubleClick(event);"
               oncontextmenu="return this._placesView.onContextMenu(event);"
--- a/browser/components/downloads/src/DownloadsCommon.jsm
+++ b/browser/components/downloads/src/DownloadsCommon.jsm
@ -437,7 +437,7 @@ this.DownloadsCommon = {
      }

      if (showAlert) {
-        let name = this.dataItem.target;
+        let name = aFile.leafName;
        let message =
          DownloadsCommon.strings.fileExecutableSecurityWarning(name, name);
        let title =
@ -773,6 +773,11 @@ DownloadsDataCtor.prototype = {
  ensurePersistentDataLoaded:
  function DD_ensurePersistentDataLoaded(aActiveOnly)
  {
+    if (this == PrivateDownloadsData) {
+      Cu.reportError("ensurePersistentDataLoaded should not be called on PrivateDownloadsData");
+      return;
+    }
+
    if (this._pendingStatement) {
      // We are already in the process of reloading all downloads.
      return;
@ -787,9 +792,7 @@ DownloadsDataCtor.prototype = {

        // Reload the list using the Download Manager service.  The list is
        // returned in no particular order.
-        let downloads = this._isPrivate ?
-                          Services.downloads.activePrivateDownloads :
-                          Services.downloads.activeDownloads;
+        let downloads = Services.downloads.activeDownloads;
        while (downloads.hasMoreElements()) {
          let download = downloads.getNext().QueryInterface(Ci.nsIDownload);
          this._getOrAddDataItem(download, true);
@ -807,9 +810,7 @@ DownloadsDataCtor.prototype = {
        // columns are read in the _initFromDataRow method of DownloadsDataItem.
        // Order by descending download identifier so that the most recent
        // downloads are notified first to the listening views.
-        let dbConnection = this._isPrivate ?
-                             Services.downloads.privateDBConnection :
-                             Services.downloads.DBConnection;
+        let dbConnection = Services.downloads.DBConnection;
        let statement = dbConnection.createAsyncStatement(
          "SELECT guid, target, name, source, referrer, state, "
        +        "startTime, endTime, currBytes, maxBytes "
--- a/browser/components/places/content/downloadsViewOverlay.xul
+++ b/browser/components/places/content/downloadsViewOverlay.xul
@ -19,7 +19,7 @@
      Components.interfaces.nsINavHistoryQueryOptions.SORT_BY_DATE_DESCENDING;

    ContentArea.setContentViewForQueryString(DOWNLOADS_QUERY,
-      function() new DownloadsPlacesView(document.getElementById("downloadsRichListBox")),
+      function() new DownloadsPlacesView(document.getElementById("downloadsRichListBox"), false),
      { showDetailsPane: false,
        toolbarSet: "back-button, forward-button, organizeButton, clearDownloadsButton, libraryToolbarSpacer, searchFilter" });
  ]]></script>
--- a/browser/components/places/content/places.js
+++ b/browser/components/places/content/places.js
@ -274,13 +274,8 @@ var PlacesOrganizer = {
   * Handle focus changes on the places list and the current content view.
   */
  updateDetailsPane: function PO_updateDetailsPane() {
-    let detailsDeck = document.getElementById("detailsDeck");
-    let detailsPaneDisabled = detailsDeck.hidden =
-      !ContentArea.currentViewOptions.showDetailsPane;
-    if (detailsPaneDisabled) {
+    if (!ContentArea.currentViewOptions.showDetailsPane)
      return;
-    }
-
    let view = PlacesUIUtils.getViewForNode(document.activeElement);
    if (view) {
      let selectedNodes = view.selectedNode ?
@ -1278,7 +1273,7 @@ let ContentArea = {
      }
    }
    catch(ex) {
-      Cu.reportError(ex);
+      Components.utils.reportError(ex);
    }
    return ContentTree.view;
  },
@ -1314,23 +1309,38 @@ let ContentArea = {

  get currentPlace() this.currentView.place,
  set currentPlace(aQueryString) {
-    this.currentView = this.getContentViewForQueryString(aQueryString);
-    this.currentView.place = aQueryString;
-    this._updateToolbarSet();
+    let oldView = this.currentView;
+    let newView = this.getContentViewForQueryString(aQueryString);
+    newView.place = aQueryString;
+    if (oldView != newView) {
+      oldView.active = false;
+      this.currentView = newView;
+      this._setupView();
+      newView.active = true;
+    }
    return aQueryString;
  },

-  _updateToolbarSet: function CA__updateToolbarSet() {
-    let toolbarSet = this.currentViewOptions.toolbarSet;
+  /**
+   * Applies view options.
+   */
+  _setupView: function CA__setupView() {
+    let options = this.currentViewOptions;
+
+    // showDetailsPane.
+    let detailsDeck = document.getElementById("detailsDeck");
+    detailsDeck.hidden = !options.showDetailsPane;
+
+    // toolbarSet.
    for (let elt of this._toolbar.childNodes) {
      // On Windows and Linux the menu buttons are menus wrapped in a menubar.
      if (elt.id == "placesMenu") {
        for (let menuElt of elt.childNodes) {
-          menuElt.hidden = toolbarSet.indexOf(menuElt.id) == -1;
+          menuElt.hidden = options.toolbarSet.indexOf(menuElt.id) == -1;
        }
      }
      else {
-        elt.hidden = toolbarSet.indexOf(elt.id) == -1;
+        elt.hidden = options.toolbarSet.indexOf(elt.id) == -1;
      }
    }
  },
--- a/browser/components/places/content/tree.xml
+++ b/browser/components/places/content/tree.xml
@ -674,6 +674,12 @@
      <property name="ownerWindow"
                readonly="true"
                onget="return window;"/>
+
+      <field name="_active">true</field>
+      <property name="active"
+                onget="return this._active"
+                onset="return this._active = val"/>
+
    </implementation>
    <handlers>
      <handler event="focus"><![CDATA[
--- a/browser/config/mozconfigs/win64/debug
+++ b/browser/config/mozconfigs/win64/debug
@ -13,9 +13,6 @@ if test -z "${_PYMAKE}"; then
  mk_add_options MOZ_MAKE_FLAGS=-j1
 fi

-# Treat warnings as errors in directories with FAIL_ON_WARNINGS.
-ac_add_options --enable-warnings-as-errors
-
 # Package js shell.
 export MOZ_PACKAGE_JSSHELL=1

--- a/browser/config/mozconfigs/win64/nightly
+++ b/browser/config/mozconfigs/win64/nightly
@ -22,9 +22,6 @@ if test -z "${_PYMAKE}"; then
  mk_add_options MOZ_MAKE_FLAGS=-j1
 fi

-# Treat warnings as errors in directories with FAIL_ON_WARNINGS.
-ac_add_options --enable-warnings-as-errors
-
 # Package js shell.
 export MOZ_PACKAGE_JSSHELL=1

--- a/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js
+++ b/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js
@ -219,7 +219,6 @@ function test()
      info("switch to the second script");

      gScripts._container.selectedIndex = 0;
-      gDebugger.DebuggerController.SourceScripts.onChange({ target: gScripts._container });
    });
  }

--- a/browser/devtools/debugger/test/browser_dbg_scripts-searching-01.js
+++ b/browser/devtools/debugger/test/browser_dbg_scripts-searching-01.js
@ -20,6 +20,8 @@ function test()
  let scriptShown = false;
  let framesAdded = false;

+  requestLongerTimeout(2);
+
  debug_tab_pane(STACK_URL, function(aTab, aDebuggee, aPane) {
    gTab = aTab;
    gDebuggee = aDebuggee;
--- a/browser/devtools/jar.mn
+++ b/browser/devtools/jar.mn
@ -27,7 +27,7 @@ browser.jar:
    content/browser/debugger-view.js              (debugger/debugger-view.js)
    content/browser/debugger-toolbar.js           (debugger/debugger-toolbar.js)
    content/browser/debugger-panes.js             (debugger/debugger-panes.js)
-*   content/browser/profiler.xul                  (profiler/profiler.xul)
+    content/browser/profiler.xul                  (profiler/profiler.xul)
    content/browser/profiler.css                  (profiler/profiler.css)
    content/browser/devtools/cleopatra.html       (profiler/cleopatra/cleopatra.html)
    content/browser/devtools/profiler/cleopatra/css/ui.css              (profiler/cleopatra/css/ui.css)
--- a/browser/themes/gnomestripe/browser.css
+++ b/browser/themes/gnomestripe/browser.css
@ -2344,29 +2344,8 @@ html|*#gcli-output-frame {
  -moz-margin-end: 2px;
 }

-#social-toolbar-item {
-  -moz-box-orient: horizontal;
-}
-
-#social-toolbar-item > .toolbarbutton-1 {
-  margin: 0;
-  padding: 0;
-  -moz-appearance: toolbarbutton;
-}
-
-.social-notification-icon-hbox {
-  pointer-events: none;
-}
-
-.social-status-button {
-  list-style-image: none;
-}
-
-#social-provider-button {
-  -moz-image-region: rect(0, 16px, 16px, 0);
-}
-
-#social-provider-button > image {
+#social-toolbar-item > .toolbarbutton-1 > .toolbarbutton-icon,
+.social-notification-container > .toolbarbutton-1 > .toolbarbutton-icon {
  margin: 5px 3px;
 }

@ -2374,33 +2353,32 @@ html|*#gcli-output-frame {
  display: none;
 }

-.social-notification-icon-stack {
-  padding: 0;
+.social-notification-container {
+  /* position:relative on .toolbarbutton-1 does not get position:absolute
+     to work as expected on .toolbarbutton-1 generated content. Placing a
+     simple container outside of .toolbarbutton-1 and setting position:relative
+     on the simple container however will work. */
+  position: relative;
 }

-.social-notification-icon-image {
-  margin: 5px 3px;
-  -moz-image-region: rect(0, 16px, 16px, 0);
-}
-
-.social-notification-icon-hbox {
-  padding: 0;
-}
-
-.social-notification-icon-label {
-  background-color: rgb(240,61,37);
-  border: 1px solid rgb(216,55,34);
-  box-shadow: 0px 1px 0px rgba(0,39,121,0.77);
-  padding-right: 1px;
-  padding-left: 1px;
-  color: white;
+.social-notification-container > .toolbarbutton-1[badge]:not([badge=""])::after {
+  /* The |content| property is set in the content stylesheet. */
  font-size: 9px;
  font-weight: bold;
-  margin: 0;
+  padding: 0 1px;
+  color: #fff;
+  background-color: rgb(240,61,37);
+  border: 1px solid rgb(216,55,34);
+  border-radius: 2px;
+  box-shadow: 0 1px 0 rgba(0,39,121,0.77);
+  position: absolute;
+  top: 2px;
+  right: 2px;
 }

-.social-notification-icon-label[value=""] {
-  display: none;
+.social-notification-container > .toolbarbutton-1[badge]:not([badge=""]):-moz-locale-dir(rtl)::after {
+  left: 2px;
+  right: auto;
 }

 /* social toolbar provider menu */
--- a/browser/themes/gnomestripe/preferences/preferences.css
+++ b/browser/themes/gnomestripe/preferences/preferences.css
@ -60,11 +60,11 @@ radio[pane=paneSync] {
 /* styles for the link elements copied from .text-link in global.css */
 .inline-link {
  color: -moz-nativehyperlinktext;
-  text-decoration: underline;
+  text-decoration: none;
 }
-  
-.inline-link:not(:focus) {
-  outline: 1px dotted transparent;
+
+.inline-link:hover {
+  text-decoration: underline;
 }

 /* Modeless Window Dialogs */
--- a/browser/themes/pinstripe/browser.css
+++ b/browser/themes/pinstripe/browser.css
@ -2392,7 +2392,7 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {
  text-shadow: inherit;
 }

-#navigator-toolbox[tabsontop="true"]:not(:-moz-lwtheme)::before {
+#main-window:not([privatebrowsingmode=temporary]) #navigator-toolbox[tabsontop="true"]:not(:-moz-lwtheme)::before {
  /* We want the titlebar to be unified, but we still want to be able
   * to give #TabsToolbar a background. So we can't set -moz-appearance:
   * toolbar on #TabsToolbar itself. Instead, we set it on a box of the
@ -3002,11 +3002,6 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {
  }
 }

-#notification-popup .text-link, .panel-arrowcontent .text-link {
-  color: #0073e6;
-  text-decoration: none;
-}
-
 #geolocation-learnmore-link {
  -moz-margin-start: 0; /* override default label margin to match description margin */
 }
@ -3100,7 +3095,6 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {
 .popup-notification-icon[popupid="geolocation"] {
  list-style-image: url(chrome://browser/skin/Geolocation-64.png);
 }
-
@media (min-resolution: 2dppx) {
  .popup-notification-icon[popupid="geolocation"] {
    list-style-image: url(chrome://browser/skin/Geolocation-64@2x.png);
@ -3171,6 +3165,12 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {
 .popup-notification-icon[popupid="webRTC-shareDevices"] {
  list-style-image: url(chrome://browser/skin/webRTC-shareDevice-64.png);
 }
+@media (min-resolution: 2dppx) {
+  .popup-notification-icon[popupid="webRTC-sharingDevices"],
+  .popup-notification-icon[popupid="webRTC-shareDevices"] {
+    list-style-image: url(chrome://browser/skin/webRTC-shareDevice-64@2x.png);
+  }
+}

 /* Popup Buttons */
 #identity-popup-more-info-button {
@ -3803,30 +3803,16 @@ html|*#gcli-output-frame {

 /* === social toolbar button === */

-/* button icon for the service */
+toolbar[mode="icons"] > *|* > .social-notification-container {
+  -moz-appearance: toolbarbutton;
+}
+
+.social-notification-container > .toolbarbutton-1 {
+  -moz-appearance: none;
+}
+
 #social-toolbar-item {
-  -moz-box-orient: horizontal;
-}
-
-#social-toolbar-item > .toolbarbutton-1:not(:first-child):not(:last-child) {
-  margin-left: 0;
-  margin-right: 0;
-}
-
-#social-toolbar-item > .toolbarbutton-1:first-child {
-  -moz-margin-end: 0;
-}
-
-#social-toolbar-item > .toolbarbutton-1:last-child {
-  -moz-margin-start: 0;
-}
-
-.social-notification-icon-hbox {
-  pointer-events: none;
-}
-
-.social-status-button {
-  list-style-image: none;
+  margin: 0 4px;
 }

 #social-provider-button {
@ -3837,39 +3823,40 @@ html|*#gcli-output-frame {
  display: none;
 }

-.social-notification-icon-stack {
-  padding: 0;
+.social-notification-container {
+  /* position:relative on .toolbarbutton-1 does not get position:absolute
+     to work as expected on .toolbarbutton-1 generated content. Placing a
+     simple container outside of .toolbarbutton-1 and setting position:relative
+     on the simple container however will work. */
+  position: relative;
 }

-.social-notification-icon-hbox {
-  padding: 0;
-}
-.social-notification-icon-label {
-  text-align: end;
+.social-notification-container > .toolbarbutton-1[badge]:not([badge=""])::after {
+  /* The |content| property is set in the content stylesheet. */
  font-size: 9px;
  font-weight: bold;
  padding: 0 1px;
-  color: white;
-  margin: 0;
+  color: #fff;
  background-color: rgb(240,61,37);
  border: 1px solid rgb(216,55,34);
+  border-radius: 2px;
  box-shadow: 0 1px 0 rgba(0,39,121,0.77);
-  -moz-margin-end: -4px;
-  margin-top: -4px;
+  position: absolute;
+  top: 2px;
+  right: 0;
 }

-.social-notification-icon-label[value=""] {
-  display: none;
+.social-notification-container > .toolbarbutton-1[badge]:not([badge=""]):-moz-locale-dir(rtl)::after {
+  left: 0;
+  right: auto;
 }

-@media (-moz-mac-lion-theme) {
-  .social-notification-icon-stack > image:-moz-window-inactive {
-    opacity: .5;
-  }
+toolbar[mode="icons"] > *|* > .social-notification-container > .toolbarbutton-1[badge]:not([badge=""])::after {
+  right: -2px;
 }

-.social-notification-icon-image {
-  -moz-image-region: rect(0, 16px, 16px, 0);
+toolbar[mode="icons"] > *|* > .social-notification-container > .toolbarbutton-1[badge]:not([badge=""]):-moz-locale-dir(rtl)::after {
+  left: -2px;
 }

 /* === end of social toolbar button === */
@ -4161,3 +4148,27 @@ panel[type="arrow"][popupid="click-to-play-plugins"] > .panel-arrowcontainer > .
 .center-item-button {
  min-width: 0;
 }
+
+%ifdef MOZ_PER_WINDOW_PRIVATE_BROWSING
+#main-window[privatebrowsingmode=temporary] {
+  background-image: url("chrome://browser/skin/privatebrowsing-mask.png");
+  background-position: top right;
+  background-repeat: no-repeat;
+  background-color: -moz-mac-chrome-active;
+}
+
+@media (-moz-mac-lion-theme) {
+  #main-window[privatebrowsingmode=temporary] {
+    background-position: top right 40px;
+  }
+
+  #main-window[privatebrowsingmode=temporary]:-moz-locale-dir(rtl) {
+    background-position: top left 70px;
+  }
+}
+
+#main-window[privatebrowsingmode=temporary]:-moz-window-inactive {
+  background-color: -moz-mac-chrome-inactive;
+}
+%endif
+
--- a/browser/themes/pinstripe/jar.mn
+++ b/browser/themes/pinstripe/jar.mn
@ -48,6 +48,7 @@ browser.jar:
  skin/classic/browser/pageInfo.css
  skin/classic/browser/Privacy-16.png
  skin/classic/browser/Privacy-48.png
+  skin/classic/browser/privatebrowsing-mask.png
  skin/classic/browser/reload-stop-go.png
  skin/classic/browser/reload-stop-go@2x.png
  skin/classic/browser/searchbar-dropmarker.png
@ -70,6 +71,7 @@ browser.jar:
  skin/classic/browser/webRTC-shareDevice-16.png
  skin/classic/browser/webRTC-shareDevice-16@2x.png
  skin/classic/browser/webRTC-shareDevice-64.png
+  skin/classic/browser/webRTC-shareDevice-64@2x.png
  skin/classic/browser/downloads/buttons.png                (downloads/buttons.png)
  skin/classic/browser/downloads/download-glow.png          (downloads/download-glow.png)
  skin/classic/browser/downloads/download-glow@2x.png       (downloads/download-glow@2x.png)
--- a/browser/themes/pinstripe/preferences/preferences.css
+++ b/browser/themes/pinstripe/preferences/preferences.css
@ -163,11 +163,11 @@ caption {
 /* styles for the link elements copied from .text-link in global.css */
 .inline-link {
  color: -moz-nativehyperlinktext;
-  text-decoration: underline;
+  text-decoration: none;
 }
-  
-.inline-link:not(:focus) {
-  outline: 1px dotted transparent;
+
+.inline-link:hover {
+  text-decoration: underline;
 }

 /**
--- a/browser/themes/pinstripe/privatebrowsing-mask.png
+++ b/browser/themes/pinstripe/privatebrowsing-mask.png
--- a/browser/themes/pinstripe/webRTC-shareDevice-64@2x.png
+++ b/browser/themes/pinstripe/webRTC-shareDevice-64@2x.png
--- a/browser/themes/winstripe/browser.css
+++ b/browser/themes/winstripe/browser.css
@ -727,7 +727,8 @@ toolbar[mode=full] .toolbarbutton-1 > .toolbarbutton-menubutton-button {
 }

@navbarLargeIcons@ .toolbarbutton-1:not(:hover):not(:active):not([open]) > .toolbarbutton-menubutton-dropmarker::before,
-@navbarLargeIcons@ > #social-toolbar-item > .toolbarbutton-1:not(:hover) + .toolbarbutton-1:not(:hover)::before {
+@navbarLargeIcons@ > #social-toolbar-item > .toolbarbutton-1:not(:hover) + .social-notification-container:not(:hover) > .toolbarbutton-1::before,
+@navbarLargeIcons@ > #social-toolbar-item > .social-notification-container:not(:hover) + .social-notification-container:not(:hover) > .toolbarbutton-1::before {
  content: "";
  display: -moz-box;
  width: 1px;
@ -3028,6 +3029,7 @@ html|*#gcli-output-frame {
 }

 /* Social toolbar item */
+
 #social-provider-button {
  -moz-image-region: rect(0, 16px, 16px, 0);
 }
@ -3036,47 +3038,47 @@ html|*#gcli-output-frame {
  display: none;
 }

-#social-toolbar-item > .toolbarbutton-1 {
-  padding: 5px;
-  -moz-appearance: toolbarbutton;
+@navbarLargeIcons@ > #social-toolbar-item > .toolbarbutton-1,
+@navbarLargeIcons@ > #social-toolbar-item > .social-notification-container > .toolbarbutton-1 {
+  padding-left: 0;
+  padding-right: 0;
 }

-@navbarLargeIcons@ > #social-toolbar-item > .toolbarbutton-1 {
-  padding: 6px 0;
+@navbarLargeIcons@ > #social-toolbar-item {
+  margin-left: 5px;
+  margin-right: 5px;
 }

-@navbarLargeIcons@ > #social-toolbar-item > .toolbarbutton-1:first-child {
-  -moz-padding-start: 5px;
+.social-notification-container {
+  /* position:relative on .toolbarbutton-1 does not get position:absolute
+     to work as expected on .toolbarbutton-1 generated content. Placing a
+     simple container outside of .toolbarbutton-1 and setting position:relative
+     on the simple container however will work. */
+  position: relative;
 }

-@navbarLargeIcons@ > #social-toolbar-item > .toolbarbutton-1:last-child {
-  -moz-padding-end: 5px;
-}
-
-.social-notification-icon-hbox {
-  pointer-events: none;
-  margin-top: -5px;
-  -moz-margin-end: -12px;
-}
-
-.social-notification-icon-label {
-  text-align: end;
+.social-notification-container > .toolbarbutton-1[badge]:not([badge=""])::after {
+  /* The |content| property is set in the content stylesheet. */
  font-size: 9px;
  font-weight: bold;
  padding: 0 1px;
-  color: white;
+  color: #fff;
  background-color: rgb(240,61,37);
  border: 1px solid rgb(216,55,34);
  border-radius: 2px;
  box-shadow: 0 1px 0 rgba(0,39,121,0.77);
+  position: absolute;
+  top: 2px;
+  right: 2px;
 }

-.social-notification-icon-label[value=""] {
-  display: none;
+@navbarLargeIcons@ > *|* > .social-notification-container > .toolbarbutton-1[badge]:not([badge=""])::after {
+  top: 7px;
 }

-.social-notification-icon-image {
-  -moz-image-region: rect(0, 16px, 16px, 0);
+.social-notification-container > .toolbarbutton-1[badge]:not([badge=""]):-moz-locale-dir(rtl)::after {
+  left: 2px;
+  right: auto;
 }

 /* social toolbar provider menu */
@ -3377,3 +3379,20 @@ chatbox[minimized="true"] {
 .center-item-button {
  min-width: 0;
 }
+
+%ifdef MOZ_PER_WINDOW_PRIVATE_BROWSING
+#main-window[privatebrowsingmode=temporary] #toolbar-menubar {
+  background-image: url("chrome://browser/skin/privatebrowsing-dark.png");
+  background-position: top right;
+  background-repeat: no-repeat;
+}
+
+#main-window[privatebrowsingmode=temporary] #toolbar-menubar:-moz-locale-dir(rtl) {
+  background-position: top left;
+}
+
+#main-window[privatebrowsingmode=temporary] #appmenu-button {
+  list-style-image: url("chrome://browser/skin/privatebrowsing-light.png");
+}
+%endif
+
--- a/browser/themes/winstripe/jar.mn
+++ b/browser/themes/winstripe/jar.mn
@ -44,6 +44,8 @@ browser.jar:
        skin/classic/browser/page-livemarks.png                      (feeds/feedIcon16.png)
        skin/classic/browser/Privacy-16.png
        skin/classic/browser/Privacy-48.png
+        skin/classic/browser/privatebrowsing-light.png
+        skin/classic/browser/privatebrowsing-dark.png
        skin/classic/browser/reload-stop-go.png
        skin/classic/browser/searchbar.css
        skin/classic/browser/searchbar-dropdown-arrow.png
@ -266,6 +268,8 @@ browser.jar:
        skin/classic/aero/browser/page-livemarks.png                 (feeds/feedIcon16-aero.png)
        skin/classic/aero/browser/Privacy-16.png                     (Privacy-16-aero.png)
        skin/classic/aero/browser/Privacy-48.png                     (Privacy-48-aero.png)
+        skin/classic/aero/browser/privatebrowsing-light.png
+        skin/classic/aero/browser/privatebrowsing-dark.png
        skin/classic/aero/browser/reload-stop-go.png
        skin/classic/aero/browser/searchbar.css
        skin/classic/aero/browser/searchbar-dropdown-arrow.png       (searchbar-dropdown-arrow-aero.png)
--- a/browser/themes/winstripe/preferences/preferences.css
+++ b/browser/themes/winstripe/preferences/preferences.css
@ -59,11 +59,11 @@ radio[pane=paneSync] {
 /* styles for the link elements copied from .text-link in global.css */
 .inline-link {
  color: -moz-nativehyperlinktext;
-  text-decoration: underline;
+  text-decoration: none;
 }

-.inline-link:not(:focus) {
-  outline: 1px dotted transparent;
+.inline-link:hover {
+  text-decoration: underline;
 }

 /* Modeless Window Dialogs */
--- a/browser/themes/winstripe/privatebrowsing-dark.png
+++ b/browser/themes/winstripe/privatebrowsing-dark.png
--- a/browser/themes/winstripe/privatebrowsing-light.png
+++ b/browser/themes/winstripe/privatebrowsing-light.png
--- a/build/mobile/sutagent/android/DoCommand.java
+++ b/build/mobile/sutagent/android/DoCommand.java
@ -107,7 +107,7 @@ public class DoCommand {
    String ffxProvider = "org.mozilla.ffxcp";
    String fenProvider = "org.mozilla.fencp";

-    private final String prgVersion = "SUTAgentAndroid Version 1.15";
+    private final String prgVersion = "SUTAgentAndroid Version 1.16";

    public enum Command
        {
@ -3414,7 +3414,7 @@ private void CancelNotification()
            else
                prgIntent.setAction(Intent.ACTION_MAIN);

-            if (sArgs[0].contains("fennec"))
+            if (sArgs[0].contains("fennec") || sArgs[0].contains("firefox"))
                {
                sArgList = "";
                sUrl = "";
--- a/build/win32/mozconfig.vs2010-win64
+++ b/build/win32/mozconfig.vs2010-win64
@ -1,9 +1,18 @@
-export INCLUDE=/c/tools/msvs10/vc/include:/c/tools/msvs10/vc/atlmfc/include:/c/tools/sdks/v7.0/include:/c/tools/sdks/v7.0/include/atl:/c/tools/sdks/dx10/include
-export LIBPATH=/c/tools/msvs10/vc/lib:/c/tools/msvs10/vc/atlmfc/lib
-export LIB=/c/tools/msvs10/vc/lib:/c/tools/msvs10/vc/atlmfc/lib:/c/tools/sdks/v7.0/lib:/c/tools/sdks/dx10/lib
+## SDK redist ##
 export WIN32_REDIST_DIR=/c/tools/msvs10/VC/redist/x86/Microsoft.VC100.CRT
+
+## moz tools location for 64-bit builders ##
 export MOZ_TOOLS=C:/mozilla-build/moztools
-export PATH="/c/tools/msvs10/Common7/IDE:/c/tools/msvs10/VC/BIN:/c/tools/msvs10/Common7/Tools:/c/tools/msvs10/VC/VCPackages:/c/mozilla-build/moztools:/c/Tools/sdks/v7.0/bin:${PATH}"
+
+## includes: win8 sdk includes, winrt headers for metro, msvc 10 std library, directx sdk for d3d9 ##
+export INCLUDE=/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/include/shared:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/include/um:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/include/winrt:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/include/winrt/wrl:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/include/winrt/wrl/wrappers:/c/tools/msvs10/vc/include:/c/tools/msvs10/vc/atlmfc/include:/c/tools/sdks/dx10/include
+
+## libs: win8 sdk x86 (32-bit) libs, msvc 10 (32-bit) std library, msvc 10 atl libs, directx sdk (32-bit) for d3d9  ##
+export LIBPATH=/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/Lib/win8/um/x86:/c/tools/msvs10/vc/lib:/c/tools/msvs10/vc/atlmfc/lib:/c/tools/sdks/dx10/lib
+export LIB=/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/Lib/win8/um/x86:/c/tools/msvs10/vc/lib:/c/tools/msvs10/vc/atlmfc/lib:/c/tools/sdks/dx10/lib
+
+## paths: win8 sdk x86 (32-bit) tools, msvc 10 (32-bit) build toolchain, moz tools  ##
+export PATH="/c/Program Files (x86)/Windows Kits/8.0/bin/x86:/c/tools/msvs10/Common7/IDE:/c/tools/msvs10/VC/BIN:/c/tools/msvs10/Common7/Tools:/c/tools/msvs10/VC/VCPackages:/c/mozilla-build/moztools:${PATH}"

 . $topsrcdir/build/mozconfig.vs2010-common

--- a/build/win64/mozconfig.vs2010
+++ b/build/win64/mozconfig.vs2010
@ -1,9 +1,16 @@
-export INCLUDE=/c/tools/msvs10/vc/include:/c/tools/msvs10/vc/atlmfc/include:/c/tools/sdks/v7.0/include:/c/tools/sdks/v7.0/include/atl:/c/tools/sdks/dx10/include
-export LIBPATH=/c/tools/msvs10/vc/lib/amd64:/c/tools/msvs10/vc/atlmfc/lib/amd64
-export LIB=/c/tools/msvs10/vc/lib/amd64:/c/tools/msvs10/vc/atlmfc/lib/amd64:/c/tools/sdks/v7.0/lib/x64:/c/tools/sdks/dx10/lib/x64
-export PATH="/c/tools/msvs10/Common7/IDE:/c/tools/msvs10/VC/BIN/amd64:/c/tools/msvs10/VC/BIN/x86_amd64:/c/tools/msvs10/VC/BIN:/c/tools/msvs10/Common7/Tools:/c/tools/msvs10/VC/VCPackages:${PATH}"
+## SDK redist ##
 export WIN32_REDIST_DIR=/c/tools/msvs10/VC/redist/x64/Microsoft.VC100.CRT

+## includes: win8 sdk includes, winrt headers for metro, msvc 10 std library, directx sdk for d3d9 ##
+export INCLUDE=/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/include/shared:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/include/um:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/include/winrt:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/include/winrt/wrl:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/include/winrt/wrl/wrappers:/c/tools/msvs10/vc/include:/c/tools/msvs10/vc/atlmfc/include:/c/tools/sdks/dx10/include
+
+## libs: win8 sdk x64 (64-bit) libs, msvc 10 (64-bit) std library, msvc 10 atl libs, directx sdk (64-bit) for d3d9  ##
+export LIBPATH=/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/Lib/win8/um/x64:/c/tools/msvs10/vc/lib/amd64:/c/tools/msvs10/vc/atlmfc/lib/amd64:/c/tools/sdks/dx10/lib/x64
+export LIB=/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/Lib/win8/um/x64:/c/tools/msvs10/vc/lib/amd64:/c/tools/msvs10/vc/atlmfc/lib/amd64:/c/tools/sdks/dx10/lib/x64
+
+## paths: win8 sdk x64 (64-bit) tools, msvc 10 (64-bit) build toolchain, moz tools  ##
+export PATH="/c/Program Files (x86)/Windows Kits/8.0/bin/x64:/c/tools/msvs10/Common7/IDE:/c/tools/msvs10/VC/BIN/amd64:/c/tools/msvs10/VC/BIN/x86_amd64:/c/tools/msvs10/VC/BIN:/c/tools/msvs10/Common7/Tools:/c/tools/msvs10/VC/VCPackages:${PATH}"
+
 # Use 32bit linker for PGO crash bug.
 # https://connect.microsoft.com/VisualStudio/feedback/details/686117/
 export LD=c:/tools/msvs10/VC/BIN/x86_amd64/link.exe
--- a/caps/idl/nsIPrincipal.idl
+++ b/caps/idl/nsIPrincipal.idl
@ -21,7 +21,7 @@ interface nsIContentSecurityPolicy;
 [ptr] native JSPrincipals(JSPrincipals);
 [ptr] native PrincipalArray(nsTArray<nsCOMPtr<nsIPrincipal> >);

-[scriptable, builtinclass, uuid(011966C0-8564-438D-B37A-08D7E1195E5A)]
+[scriptable, builtinclass, uuid(dbda8bb0-3023-4aec-ad98-8e9931a29d70)]
 interface nsIPrincipal : nsISerializable
 {
    /**
@ -153,6 +153,13 @@ interface nsIPrincipal : nsISerializable
     */
    readonly attribute AUTF8String extendedOrigin;

+    /**
+     * The base domain of the codebase URI to which this principal pertains
+     * (generally the document URI), handling null principals and
+     * non-hierarchical schemes correctly.
+     */
+    readonly attribute ACString baseDomain;
+    
    const short APP_STATUS_NOT_INSTALLED = 0;
    const short APP_STATUS_INSTALLED     = 1;
    const short APP_STATUS_PRIVILEGED    = 2;
--- a/caps/include/nsPrincipal.h
+++ b/caps/include/nsPrincipal.h
@ -72,6 +72,7 @@ public:
  NS_IMETHOD GetIsInBrowserElement(bool* aIsInBrowserElement);
  NS_IMETHOD GetUnknownAppId(bool* aUnknownAppId);
  NS_IMETHOD GetIsNullPrincipal(bool* aIsNullPrincipal);
+  NS_IMETHOD GetBaseDomain(nsACString& aBaseDomain);
 #ifdef DEBUG
  virtual void dumpImpl();
 #endif
@ -154,6 +155,7 @@ public:
  NS_IMETHOD GetIsInBrowserElement(bool* aIsInBrowserElement);
  NS_IMETHOD GetUnknownAppId(bool* aUnknownAppId);
  NS_IMETHOD GetIsNullPrincipal(bool* aIsNullPrincipal);
+  NS_IMETHOD GetBaseDomain(nsACString& aBaseDomain);
 #ifdef DEBUG
  virtual void dumpImpl();
 #endif
--- a/caps/src/nsNullPrincipal.cpp
+++ b/caps/src/nsNullPrincipal.cpp
@ -298,6 +298,13 @@ nsNullPrincipal::GetIsNullPrincipal(bool* aIsNullPrincipal)
  return NS_OK;
 }

+NS_IMETHODIMP
+nsNullPrincipal::GetBaseDomain(nsACString& aBaseDomain)
+{
+  // For a null principal, we use our unique uuid as the base domain.
+  return mURI->GetPath(aBaseDomain);
+}
+
 /**
 * nsISerializable implementation
 */
--- a/caps/src/nsPrincipal.cpp
+++ b/caps/src/nsPrincipal.cpp
@ -4,6 +4,7 @@
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

+#include "mozIThirdPartyUtil.h"
 #include "nscore.h"
 #include "nsScriptSecurityManager.h"
 #include "nsString.h"
@ -441,7 +442,7 @@ nsPrincipal::CheckMayLoad(nsIURI* aURI, bool aReport, bool aAllowIfInheritsPrinc
      nsScriptSecurityManager::ReportError(
        nullptr, NS_LITERAL_STRING("CheckSameOriginError"), mCodebase, aURI);
    }
-    
+
    return NS_ERROR_DOM_BAD_URI;
  }

@ -485,7 +486,7 @@ nsPrincipal::SetDomain(nsIURI* aDomain)
 {
  mDomain = NS_TryToMakeImmutable(aDomain);
  mDomainImmutable = URIIsImmutable(mDomain);
-  
+
  // Domain has changed, forget cached security policy
  SetSecurityPolicy(nullptr);

@ -556,6 +557,29 @@ nsPrincipal::GetIsNullPrincipal(bool* aIsNullPrincipal)
  return NS_OK;
 }

+NS_IMETHODIMP
+nsPrincipal::GetBaseDomain(nsACString& aBaseDomain)
+{
+  // For a file URI, we return the file path.
+  if (URIIsLocalFile(mCodebase)) {
+    nsCOMPtr<nsIURL> url = do_QueryInterface(mCodebase);
+
+    if (url) {
+      return url->GetFilePath(aBaseDomain);
+    }
+  }
+
+  // For everything else, we ask the TLD service via
+  // the ThirdPartyUtil.
+  nsCOMPtr<mozIThirdPartyUtil> thirdPartyUtil =
+    do_GetService(THIRDPARTYUTIL_CONTRACTID);
+  if (thirdPartyUtil) {
+    return thirdPartyUtil->GetBaseDomain(mCodebase, aBaseDomain);
+  }
+
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsPrincipal::Read(nsIObjectInputStream* aStream)
 {
@ -688,20 +712,20 @@ nsExpandedPrincipal::nsExpandedPrincipal(nsTArray<nsCOMPtr <nsIPrincipal> > &aWh
 nsExpandedPrincipal::~nsExpandedPrincipal()
 { }

-NS_IMETHODIMP 
+NS_IMETHODIMP
 nsExpandedPrincipal::GetDomain(nsIURI** aDomain)
 {
  *aDomain = nullptr;
  return NS_OK;
 }

-NS_IMETHODIMP 
+NS_IMETHODIMP
 nsExpandedPrincipal::SetDomain(nsIURI* aDomain)
 {
  return NS_OK;
 }

-NS_IMETHODIMP 
+NS_IMETHODIMP
 nsExpandedPrincipal::GetOrigin(char** aOrigin)
 {
  *aOrigin = ToNewCString(NS_LITERAL_CSTRING(EXPANDED_PRINCIPAL_SPEC));
@ -713,10 +737,10 @@ typedef nsresult (NS_STDCALL nsIPrincipal::*nsIPrincipalMemFn)(nsIPrincipal* aOt
 #define CALL_MEMBER_FUNCTION(THIS,MEM_FN)  ((THIS)->*(MEM_FN))

 // nsExpandedPrincipal::Equals and nsExpandedPrincipal::EqualsIgnoringDomain
-// shares the same logic. The difference only that Equals requires 'this' 
-// and 'aOther' to Subsume each other while EqualsIgnoringDomain requires 
+// shares the same logic. The difference only that Equals requires 'this'
+// and 'aOther' to Subsume each other while EqualsIgnoringDomain requires
 // bidirectional SubsumesIgnoringDomain.
-static nsresult 
+static nsresult
 Equals(nsExpandedPrincipal* aThis, nsIPrincipalMemFn aFn, nsIPrincipal* aOther,
       bool* aResult)
 {
@ -750,14 +774,14 @@ nsExpandedPrincipal::EqualsIgnoringDomain(nsIPrincipal* aOther, bool* aResult)
 // nsExpandedPrincipal::Subsumes and nsExpandedPrincipal::SubsumesIgnoringDomain
 // shares the same logic. The difference only that Subsumes calls are replaced
 //with SubsumesIgnoringDomain calls in the second case.
-static nsresult 
-Subsumes(nsExpandedPrincipal* aThis, nsIPrincipalMemFn aFn, nsIPrincipal* aOther, 
+static nsresult
+Subsumes(nsExpandedPrincipal* aThis, nsIPrincipalMemFn aFn, nsIPrincipal* aOther,
         bool* aResult)
 {
  nsresult rv;
-  nsCOMPtr<nsIExpandedPrincipal> expanded = do_QueryInterface(aOther);  
+  nsCOMPtr<nsIExpandedPrincipal> expanded = do_QueryInterface(aOther);
  if (expanded) {
-    // If aOther is an ExpandedPrincipal too, check if all of its 
+    // If aOther is an ExpandedPrincipal too, check if all of its
    // principals are subsumed.
    nsTArray< nsCOMPtr<nsIPrincipal> >* otherList;
    expanded->GetWhiteList(&otherList);
@ -766,7 +790,7 @@ Subsumes(nsExpandedPrincipal* aThis, nsIPrincipalMemFn aFn, nsIPrincipal* aOther
      NS_ENSURE_SUCCESS(rv, rv);
      if (!*aResult) {
        // If we don't subsume at least one principal of aOther, return false.
-        return NS_OK;    
+        return NS_OK;
      }
    }
  } else {
@ -826,7 +850,7 @@ nsExpandedPrincipal::GetURI(nsIURI** aURI)
  return NS_OK;
 }

-NS_IMETHODIMP 
+NS_IMETHODIMP
 nsExpandedPrincipal::GetWhiteList(nsTArray<nsCOMPtr<nsIPrincipal> >** aWhiteList)
 {
  *aWhiteList = &mPrincipals;
@ -874,6 +898,12 @@ nsExpandedPrincipal::GetIsNullPrincipal(bool* aIsNullPrincipal)
  return NS_OK;
 }

+NS_IMETHODIMP
+nsExpandedPrincipal::GetBaseDomain(nsACString& aBaseDomain)
+{
+  return NS_ERROR_NOT_AVAILABLE;
+}
+
 void
 nsExpandedPrincipal::GetScriptLocation(nsACString& aStr)
 {
--- a/caps/src/nsSystemPrincipal.cpp
+++ b/caps/src/nsSystemPrincipal.cpp
@ -205,6 +205,13 @@ nsSystemPrincipal::GetIsNullPrincipal(bool* aIsNullPrincipal)
  return NS_OK;
 }

+NS_IMETHODIMP
+nsSystemPrincipal::GetBaseDomain(nsACString& aBaseDomain)
+{
+  // No base domain for chrome.
+  return NS_OK;
+}
+
 //////////////////////////////////////////
 // Methods implementing nsISerializable //
 //////////////////////////////////////////
--- a/configure.in
+++ b/configure.in
@ -7296,7 +7296,7 @@ dnl our own linker.
 if test "$OS_TARGET" = Android; then
    WRAP_LDFLAGS="${WRAP_LDFLAGS} -L$_objdir/dist/lib -lmozglue"
    WRAP_LDFLAGS="${WRAP_LDFLAGS} -Wl,--wrap=getaddrinfo,--wrap=freeaddrinfo,--wrap=gai_strerror"
-    WRAP_LDFLAGS="${WRAP_LDFLAGS} -Wl--wrap=PR_GetEnv,--wrap=PR_SetEnv"
+    WRAP_LDFLAGS="${WRAP_LDFLAGS} -Wl,--wrap=PR_GetEnv,--wrap=PR_SetEnv"
    if test -z "$gonkdir"; then
        WRAP_LDFLAGS="${WRAP_LDFLAGS} -Wl,--wrap=fork,--wrap=pthread_atfork,--wrap=raise"
        WRAP_LDFLAGS="${WRAP_LDFLAGS} -Wl,--wrap=memccpy,--wrap=memchr,--wrap=memrchr,--wrap=memcmp,--wrap=memcpy,--wrap=memmove,--wrap=memset,--wrap=memmem,--wrap=memswap,--wrap=index,--wrap=strchr,--wrap=strrchr,--wrap=strlen,--wrap=strcmp,--wrap=strcpy,--wrap=strcat,--wrap=strcasecmp,--wrap=strncasecmp,--wrap=strstr,--wrap=strcasestr,--wrap=strtok,--wrap=strtok_r,--wrap=strerror,--wrap=strerror_r,--wrap=strnlen,--wrap=strncat,--wrap=strncmp,--wrap=strncpy,--wrap=strlcat,--wrap=strlcpy,--wrap=strcspn,--wrap=strpbrk,--wrap=strsep,--wrap=strspn,--wrap=strcoll,--wrap=strxfrm"
--- a/content/base/crashtests/824719.html
+++ b/content/base/crashtests/824719.html
@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<div id='console'></div>
+<div id='parentDiv'>
+<div id='right-to-left1' dir=auto class=testElement>
+<input type=text value="a">a
+</div>
+<div id='right-to-left2' dir=auto class=testElement>
+</div>
+</div>
+
+<script type="text/javascript"> 
+
+document.getElementById("right-to-left2").appendChild(document.createElement("p"))
+var test5=document.getElementById("right-to-left1")
+var test6=document.getElementById("console").appendChild(document.createElement("dl"))
+
+test6.appendChild(document.createElement("img"))
+
+test5.parentNode.removeChild(test5)
+test5.innerHTML=''
+test5.appendChild(test6.cloneNode(true))
+</script>
+
+</body>
+</html>
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@ -123,3 +123,4 @@ load 815500.html
 load 816253.html
 load 822691.html
 load 822723.html
+load 824719.html
--- a/content/base/public/Element.h
+++ b/content/base/public/Element.h
@ -873,6 +873,29 @@ public:
   */
  nsIEditor* GetEditorInternal();

+  /**
+   * Helper method for NS_IMPL_BOOL_ATTR macro.
+   * Gets value of boolean attribute. Only works for attributes in null
+   * namespace.
+   *
+   * @param aAttr    name of attribute.
+   * @param aValue   Boolean value of attribute.
+   */
+  NS_HIDDEN_(bool) GetBoolAttr(nsIAtom* aAttr) const
+  {
+    return HasAttr(kNameSpaceID_None, aAttr);
+  }
+
+  /**
+   * Helper method for NS_IMPL_BOOL_ATTR macro.
+   * Sets value of boolean attribute by removing attribute or setting it to
+   * the empty string. Only works for attributes in null namespace.
+   *
+   * @param aAttr    name of attribute.
+   * @param aValue   Boolean value of attribute.
+   */
+  NS_HIDDEN_(nsresult) SetBoolAttr(nsIAtom* aAttr, bool aValue);
+
 protected:
  /*
   * Named-bools for use with SetAttrAndNotify to make call sites easier to
@ -1215,6 +1238,24 @@ _elementName::Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const        \
    return SetAttr(kNameSpaceID_None, nsGkAtoms::_atom, nullptr, aValue, true); \
  }

+/**
+ * A macro to implement the getter and setter for a given boolean
+ * valued content property. The method uses the GetBoolAttr and
+ * SetBoolAttr methods.
+ */
+#define NS_IMPL_BOOL_ATTR(_class, _method, _atom)                     \
+  NS_IMETHODIMP                                                       \
+  _class::Get##_method(bool* aValue)                                  \
+  {                                                                   \
+    *aValue = GetBoolAttr(nsGkAtoms::_atom);                          \
+    return NS_OK;                                                     \
+  }                                                                   \
+  NS_IMETHODIMP                                                       \
+  _class::Set##_method(bool aValue)                                   \
+  {                                                                   \
+    return SetBoolAttr(nsGkAtoms::_atom, aValue);                     \
+  }
+
 #define NS_FORWARD_NSIDOMELEMENT_TO_GENERIC                                   \
 typedef mozilla::dom::Element Element;                                        \
 NS_IMETHOD GetTagName(nsAString& aTagName) MOZ_FINAL                          \
--- a/content/base/public/nsContentPolicyUtils.h
+++ b/content/base/public/nsContentPolicyUtils.h
@ -144,7 +144,7 @@ NS_CP_ContentTypeName(uint32_t contentType)
 *
 * Note: requestOrigin is scoped outside the PR_BEGIN_MACRO/PR_END_MACRO on
 * purpose */
-#define CHECK_PRINCIPAL                                                       \
+#define CHECK_PRINCIPAL_AND_DATA(action)                                      \
  nsCOMPtr<nsIURI> requestOrigin;                                             \
  PR_BEGIN_MACRO                                                              \
  if (originPrincipal) {                                                      \
@ -153,12 +153,32 @@ NS_CP_ContentTypeName(uint32_t contentType)
          secMan = do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID);        \
      }                                                                       \
      if (secMan) {                                                           \
-          bool isSystem;                                                    \
+          bool isSystem;                                                      \
          nsresult rv = secMan->IsSystemPrincipal(originPrincipal,            \
                                                  &isSystem);                 \
          NS_ENSURE_SUCCESS(rv, rv);                                          \
          if (isSystem) {                                                     \
              *decision = nsIContentPolicy::ACCEPT;                           \
+              nsCOMPtr<nsINode> n = do_QueryInterface(context);               \
+              if (!n) {                                                       \
+                  nsCOMPtr<nsPIDOMWindow> win = do_QueryInterface(context);   \
+                  n = win ? win->GetExtantDoc() : nullptr;                    \
+              }                                                               \
+              if (n) {                                                        \
+                  nsIDocument* d = n->OwnerDoc();                             \
+                  if (d->IsLoadedAsData() || d->IsBeingUsedAsImage() ||       \
+                      d->IsResourceDoc()) {                                   \
+                      nsCOMPtr<nsIContentPolicy> dataPolicy =                 \
+                          do_GetService(                                      \
+                              "@mozilla.org/data-document-content-policy;1"); \
+                      if (dataPolicy) {                                       \
+                          dataPolicy-> action (contentType, contentLocation,  \
+                                               requestOrigin, context,        \
+                                               mimeType, extra,               \
+                                               originPrincipal, decision);    \
+                      }                                                       \
+                  }                                                           \
+              }                                                               \
              return NS_OK;                                                   \
          }                                                                   \
      }                                                                       \
@ -187,7 +207,7 @@ NS_CheckContentLoadPolicy(uint32_t          contentType,
                          nsIContentPolicy *policyService = nullptr,
                          nsIScriptSecurityManager* aSecMan = nullptr)
 {
-    CHECK_PRINCIPAL;
+    CHECK_PRINCIPAL_AND_DATA(ShouldLoad);
    if (policyService) {
        CHECK_CONTENT_POLICY_WITH_SERVICE(ShouldLoad, policyService);
    }
@ -214,7 +234,7 @@ NS_CheckContentProcessPolicy(uint32_t          contentType,
                             nsIContentPolicy *policyService = nullptr,
                             nsIScriptSecurityManager* aSecMan = nullptr)
 {
-    CHECK_PRINCIPAL;
+    CHECK_PRINCIPAL_AND_DATA(ShouldProcess);
    if (policyService) {
        CHECK_CONTENT_POLICY_WITH_SERVICE(ShouldProcess, policyService);
    }
--- a/content/base/public/nsIDocument.h
+++ b/content/base/public/nsIDocument.h
@ -46,7 +46,6 @@ class nsIDocumentObserver;
 class nsIDOMDocument;
 class nsIDOMDocumentFragment;
 class nsIDOMDocumentType;
-class nsXMLProcessingInstruction;
 class nsIDOMElement;
 class nsIDOMEventTarget;
 class nsIDOMNodeList;
@ -74,6 +73,7 @@ class nsStyleSet;
 class nsTextNode;
 class nsWindowSizes;
 class nsSmallVoidArray;
+class nsDOMCaretPosition;

 namespace mozilla {
 class ErrorResult;
@ -84,12 +84,14 @@ class ImageLoader;
 } // namespace css

 namespace dom {
+class CDATASection;
 class Comment;
 class DocumentFragment;
 class DocumentType;
 class DOMImplementation;
 class Element;
 class Link;
+class ProcessingInstruction;
 class UndoManager;
 template<typename> class Sequence;
 } // namespace dom
@ -1825,7 +1827,7 @@ public:
                                              mozilla::ErrorResult& rv) const;
  already_AddRefed<mozilla::dom::Comment>
    CreateComment(const nsAString& aData, mozilla::ErrorResult& rv) const;
-  already_AddRefed<nsXMLProcessingInstruction>
+  already_AddRefed<mozilla::dom::ProcessingInstruction>
    CreateProcessingInstruction(const nsAString& target, const nsAString& data,
                                mozilla::ErrorResult& rv) const;
  already_AddRefed<nsINode>
@ -1842,7 +1844,7 @@ public:
                     nsIDOMNodeFilter* aFilter, mozilla::ErrorResult& rv) const;

  // Deprecated WebIDL bits
-  already_AddRefed<nsIDOMCDATASection>
+  already_AddRefed<mozilla::dom::CDATASection>
    CreateCDATASection(const nsAString& aData, mozilla::ErrorResult& rv);
  already_AddRefed<nsIDOMAttr>
    CreateAttribute(const nsAString& aName, mozilla::ErrorResult& rv);
@ -1916,6 +1918,19 @@ public:
  virtual nsIDOMDOMStringList* StyleSheetSets() = 0;
  virtual void EnableStyleSheetsForSet(const nsAString& aSheetSet) = 0;
  Element* ElementFromPoint(float aX, float aY);
+
+  /**
+   * Retrieve the location of the caret position (DOM node and character
+   * offset within that node), given a point.
+   *
+   * @param aX Horizontal point at which to determine the caret position, in
+   *           page coordinates.
+   * @param aY Vertical point at which to determine the caret position, in
+   *           page coordinates.
+   */
+  already_AddRefed<nsDOMCaretPosition>
+    CaretPositionFromPoint(float aX, float aY);
+
  // QuerySelector and QuerySelectorAll already defined on nsINode
  nsINodeList* GetAnonymousNodes(Element& aElement);
  Element* GetAnonymousElementByAttribute(Element& aElement,
--- a/content/base/public/nsIMessageManager.idl
+++ b/content/base/public/nsIMessageManager.idl
@ -336,8 +336,8 @@ interface nsIFrameScriptLoader : nsISupports
  void removeDelayedFrameScript(in AString aURL);
 };

-[scriptable, builtinclass, uuid(5f552699-01a2-4f17-833b-ddb3fa0d98b2)]
-interface nsIPermissionChecker : nsISupports
+[scriptable, builtinclass, uuid(e2ccdade-4c16-11e2-9ae0-23151c6d6e1d)]
+interface nsIProcessChecker : nsISupports
 {

  /**
@ -361,4 +361,25 @@ interface nsIPermissionChecker : nsISupports
   */
  boolean assertPermission(in DOMString aPermission);

+  /**
+   * Return true iff the "remote" process has |aManifestURL|.  This is
+   * intended to be used by JS implementations of cross-process DOM
+   * APIs, like so
+   *
+   *   recvFooRequest: function(message) {
+   *     if (!message.target.assertContainApp("foo")) {
+   *       return false;
+   *     }
+   *     // service foo request
+   *
+   * This interface only returns meaningful data when our content is
+   * in a separate process.  If it shares the same OS process as us,
+   * then applying this manifest URL check doesn't add any security,
+   * though it doesn't hurt anything either.
+   *
+   * Note: If the remote content process does *not* contain |aManifestURL|,
+   * it will be killed as a precaution.
+   */
+  boolean assertContainApp(in DOMString aManifestURL);
+
 };
--- a/content/base/public/nsINode.h
+++ b/content/base/public/nsINode.h
@ -1319,6 +1319,11 @@ private:
    NodeHasDirAuto,
    // Set if a node in the node's parent chain has dir=auto.
    NodeAncestorHasDirAuto,
+    // Set if the element is in the scope of a scoped style sheet; this flag is
+    // only accurate for elements bounds to a document
+    ElementIsInStyleScope,
+    // Set if the element is a scoped style sheet root
+    ElementIsScopedStyleRoot,
    // Guard value
    BooleanFlagCount
  };
@ -1435,6 +1440,24 @@ public:

  bool NodeOrAncestorHasDirAuto() const
    { return HasDirAuto() || AncestorHasDirAuto(); }
+
+  void SetIsElementInStyleScope(bool aValue) {
+    MOZ_ASSERT(IsElement(), "SetIsInStyleScope on a non-Element node");
+    SetBoolFlag(ElementIsInStyleScope, aValue);
+  }
+  void SetIsElementInStyleScope() {
+    MOZ_ASSERT(IsElement(), "SetIsInStyleScope on a non-Element node");
+    SetBoolFlag(ElementIsInStyleScope);
+  }
+  void ClearIsElementInStyleScope() {
+    MOZ_ASSERT(IsElement(), "ClearIsInStyleScope on a non-Element node");
+    ClearBoolFlag(ElementIsInStyleScope);
+  }
+  bool IsElementInStyleScope() const { return GetBoolFlag(ElementIsInStyleScope); }
+
+  void SetIsScopedStyleRoot() { SetBoolFlag(ElementIsScopedStyleRoot); }
+  void ClearIsScopedStyleRoot() { ClearBoolFlag(ElementIsScopedStyleRoot); }
+  bool IsScopedStyleRoot() { return GetBoolFlag(ElementIsScopedStyleRoot); }
 protected:
  void SetParentIsContent(bool aValue) { SetBoolFlag(ParentIsContent, aValue); }
  void SetInDocument() { SetBoolFlag(IsInDocument); }
@ -1455,7 +1478,7 @@ protected:
  bool HasLockedStyleStates() const
    { return GetBoolFlag(ElementHasLockedStyleStates); }

-    void SetSubtreeRootPointer(nsINode* aSubtreeRoot)
+  void SetSubtreeRootPointer(nsINode* aSubtreeRoot)
  {
    NS_ASSERTION(aSubtreeRoot, "aSubtreeRoot can never be null!");
    NS_ASSERTION(!(IsNodeOfType(eCONTENT) && IsInDoc()), "Shouldn't be here!");
--- a/content/base/src/Element.cpp
+++ b/content/base/src/Element.cpp
@ -1155,6 +1155,9 @@ Element::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
               NODE_NEEDS_FRAME | NODE_DESCENDANTS_NEED_FRAMES |
               // And the restyle bits
               ELEMENT_ALL_RESTYLE_FLAGS);
+
+    // Propagate scoped style sheet tracking bit.
+    SetIsElementInStyleScope(mParent->IsElementInStyleScope());
  } else {
    // If we're not in the doc, update our subtree pointer.
    SetSubtreeRootPointer(aParent->SubtreeRoot());
@ -3595,3 +3598,13 @@ Element::GetEditorInternal()
  nsCOMPtr<nsITextControlElement> textCtrl = do_QueryInterface(this);
  return textCtrl ? textCtrl->GetTextEditor() : nullptr;
 }
+
+nsresult
+Element::SetBoolAttr(nsIAtom* aAttr, bool aValue)
+{
+  if (aValue) {
+    return SetAttr(kNameSpaceID_None, aAttr, EmptyString(), true);
+  }
+
+  return UnsetAttr(kNameSpaceID_None, aAttr, true);
+}
--- a/content/base/src/nsCCUncollectableMarker.cpp
+++ b/content/base/src/nsCCUncollectableMarker.cpp
@ -368,12 +368,16 @@ nsCCUncollectableMarker::Observe(nsISupports* aSubject, const char* aTopic,
      MarkDocShell(shellTreeNode, cleanupJS, prepareForCC);
    }
 #ifdef MOZ_PER_WINDOW_PRIVATE_BROWSING
-    appShell->GetHiddenPrivateWindow(getter_AddRefs(hw));
-    if (hw) {
-      nsCOMPtr<nsIDocShell> shell;
-      hw->GetDocShell(getter_AddRefs(shell));
-      nsCOMPtr<nsIDocShellTreeNode> shellTreeNode = do_QueryInterface(shell);
-      MarkDocShell(shellTreeNode, cleanupJS, prepareForCC);
+    bool hasHiddenPrivateWindow = false;
+    appShell->GetHasHiddenPrivateWindow(&hasHiddenPrivateWindow);
+    if (hasHiddenPrivateWindow) {
+      appShell->GetHiddenPrivateWindow(getter_AddRefs(hw));
+      if (hw) {
+        nsCOMPtr<nsIDocShell> shell;
+        hw->GetDocShell(getter_AddRefs(shell));
+        nsCOMPtr<nsIDocShellTreeNode> shellTreeNode = do_QueryInterface(shell);
+        MarkDocShell(shellTreeNode, cleanupJS, prepareForCC);
+      }
    }
 #endif
  }
--- a/content/base/src/nsDataDocumentContentPolicy.cpp
+++ b/content/base/src/nsDataDocumentContentPolicy.cpp
@ -30,6 +30,9 @@ HasFlags(nsIURI* aURI, uint32_t aURIFlags)
  return NS_SUCCEEDED(rv) && hasFlags;
 }

+// If you change DataDocumentContentPolicy, make sure to check that
+// CHECK_PRINCIPAL_AND_DATA in nsContentPolicyUtils is still valid.
+// nsContentPolicyUtils may not pass all the parameters to ShouldLoad.
 NS_IMETHODIMP
 nsDataDocumentContentPolicy::ShouldLoad(uint32_t aContentType,
                                        nsIURI *aContentLocation,
@ -123,6 +126,10 @@ nsDataDocumentContentPolicy::ShouldLoad(uint32_t aContentType,
    *aDecision = nsIContentPolicy::REJECT_TYPE;
  }

+  // If you add more restrictions here, make sure to check that
+  // CHECK_PRINCIPAL_AND_DATA in nsContentPolicyUtils is still valid.
+  // nsContentPolicyUtils may not pass all the parameters to ShouldLoad
+
  return NS_OK;
 }

--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@ -45,8 +45,8 @@
 #include "nsIDOMDocumentXBL.h"
 #include "mozilla/dom/Element.h"
 #include "nsGenericHTMLElement.h"
-#include "nsIDOMCDATASection.h"
-#include "nsIDOMProcessingInstruction.h"
+#include "mozilla/dom/CDATASection.h"
+#include "mozilla/dom/ProcessingInstruction.h"
 #include "nsDOMString.h"
 #include "nsNodeUtils.h"
 #include "nsLayoutUtils.h" // for GetFrameForPoint
@ -170,7 +170,6 @@
 #include "mozilla/dom/DOMImplementation.h"
 #include "mozilla/dom/Comment.h"
 #include "nsTextNode.h"
-#include "nsXMLProcessingInstruction.h"
 #include "mozilla/dom/Link.h"
 #include "nsXULAppAPI.h"
 #include "nsDOMTouchEvent.h"
@ -2027,6 +2026,25 @@ nsDocument::ResetToURI(nsIURI *aURI, nsILoadGroup *aLoadGroup,
  }
 }

+void
+nsDocument::RemoveDocStyleSheetsFromStyleSets()
+{
+  // The stylesheets should forget us
+  int32_t indx = mStyleSheets.Count();
+  while (--indx >= 0) {
+    nsIStyleSheet* sheet = mStyleSheets[indx];
+    sheet->SetOwningDocument(nullptr);
+
+    if (sheet->IsApplicable()) {
+      nsCOMPtr<nsIPresShell> shell = GetShell();
+      if (shell) {
+        shell->StyleSet()->RemoveDocStyleSheet(sheet);
+      }
+    }
+    // XXX Tell observers?
+  }
+}
+
 void
 nsDocument::RemoveStyleSheetsFromStyleSets(nsCOMArray<nsIStyleSheet>& aSheets, nsStyleSet::sheetType aType)
 {
@ -2054,7 +2072,7 @@ nsDocument::ResetStylesheetsToURI(nsIURI* aURI)
  NS_PRECONDITION(aURI, "Null URI passed to ResetStylesheetsToURI");

  mozAutoDocUpdate upd(this, UPDATE_STYLE, true);
-  RemoveStyleSheetsFromStyleSets(mStyleSheets, nsStyleSet::eDocSheet);
+  RemoveDocStyleSheetsFromStyleSets();
  RemoveStyleSheetsFromStyleSets(mCatalogSheets, nsStyleSet::eAgentSheet);
  RemoveStyleSheetsFromStyleSets(mAdditionalSheets[eAgentSheet], nsStyleSet::eAgentSheet);
  RemoveStyleSheetsFromStyleSets(mAdditionalSheets[eUserSheet], nsStyleSet::eUserSheet);
@ -3503,7 +3521,7 @@ nsDocument::RemoveStyleSheetFromStyleSets(nsIStyleSheet* aSheet)
 {
  nsCOMPtr<nsIPresShell> shell = GetShell();
  if (shell) {
-    shell->StyleSet()->RemoveStyleSheet(nsStyleSet::eDocSheet, aSheet);
+    shell->StyleSet()->RemoveDocStyleSheet(aSheet);
  }
 }

@ -4610,7 +4628,7 @@ nsDocument::CreateCDATASection(const nsAString& aData,
  return rv.ErrorCode();
 }

-already_AddRefed<nsIDOMCDATASection>
+already_AddRefed<CDATASection>
 nsIDocument::CreateCDATASection(const nsAString& aData,
                                ErrorResult& rv)
 {
@ -4635,8 +4653,7 @@ nsIDocument::CreateCDATASection(const nsAString& aData,
  // Don't notify; this node is still being created.
  content->SetText(aData, false);

-  nsCOMPtr<nsIDOMCDATASection> section = do_QueryInterface(content);
-  return section.forget();
+  return static_cast<CDATASection*>(content.forget().get());
 }

 NS_IMETHODIMP
@ -4649,7 +4666,7 @@ nsDocument::CreateProcessingInstruction(const nsAString& aTarget,
  return rv.ErrorCode();
 }

-already_AddRefed<nsXMLProcessingInstruction>
+already_AddRefed<ProcessingInstruction>
 nsIDocument::CreateProcessingInstruction(const nsAString& aTarget,
                                         const nsAString& aData,
                                         mozilla::ErrorResult& rv) const
@ -4673,7 +4690,7 @@ nsIDocument::CreateProcessingInstruction(const nsAString& aTarget,
    return nullptr;
  }

-  return static_cast<nsXMLProcessingInstruction*>(content.forget().get());
+  return static_cast<ProcessingInstruction*>(content.forget().get());
 }

 NS_IMETHODIMP
@ -8853,32 +8870,29 @@ ResetFullScreen(nsIDocument* aDocument, void* aData)
  return true;
 }

-NS_IMETHODIMP
-nsDocument::CaretPositionFromPoint(float aX, float aY, nsISupports** aCaretPos)
+already_AddRefed<nsDOMCaretPosition>
+nsIDocument::CaretPositionFromPoint(float aX, float aY)
 {
-  NS_ENSURE_ARG_POINTER(aCaretPos);
-  *aCaretPos = nullptr;
-
  nscoord x = nsPresContext::CSSPixelsToAppUnits(aX);
  nscoord y = nsPresContext::CSSPixelsToAppUnits(aY);
  nsPoint pt(x, y);

  nsIPresShell *ps = GetShell();
  if (!ps) {
-    return NS_OK;
+    return nullptr;
  }

  nsIFrame *rootFrame = ps->GetRootFrame();

  // XUL docs, unlike HTML, have no frame tree until everything's done loading
  if (!rootFrame) {
-    return NS_OK; // return null to premature XUL callers as a reminder to wait
+    return nullptr;
  }

  nsIFrame *ptFrame = nsLayoutUtils::GetFrameForPoint(rootFrame, pt, true,
                                                      false);
  if (!ptFrame) {
-    return NS_OK;
+    return nullptr;
  }

  // GetContentOffsetsFromPoint requires frame-relative coordinates, so we need
@ -8906,8 +8920,15 @@ nsDocument::CaretPositionFromPoint(float aX, float aY, nsISupports** aCaretPos)
    }
  }

-  *aCaretPos = new nsDOMCaretPosition(node, offset);
-  NS_ADDREF(*aCaretPos);
+  nsRefPtr<nsDOMCaretPosition> aCaretPos = new nsDOMCaretPosition(node, offset);
+  return aCaretPos.forget();
+}
+
+NS_IMETHODIMP
+nsDocument::CaretPositionFromPoint(float aX, float aY, nsISupports** aCaretPos)
+{
+  NS_ENSURE_ARG_POINTER(aCaretPos);
+  *aCaretPos = nsIDocument::CaretPositionFromPoint(aX, aY).get();
  return NS_OK;
 }

--- a/content/base/src/nsDocument.h
+++ b/content/base/src/nsDocument.h
@ -1080,6 +1080,7 @@ protected:
                         nsCompatibility aCompatMode,
                         nsIPresShell** aInstancePtrResult);

+  void RemoveDocStyleSheetsFromStyleSets();
  void RemoveStyleSheetsFromStyleSets(nsCOMArray<nsIStyleSheet>& aSheets, 
                                      nsStyleSet::sheetType aType);
  nsresult ResetStylesheetsToURI(nsIURI* aURI);
--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@ -77,7 +77,7 @@

 #include "Layers.h"

-#include "AppProcessPermissions.h"
+#include "AppProcessChecker.h"
 #include "ContentParent.h"
 #include "TabParent.h"
 #include "mozilla/GuardObjects.h"
@ -2314,6 +2314,13 @@ nsFrameLoader::CheckPermission(const nsAString& aPermission)
                                    NS_ConvertUTF16toUTF8(aPermission).get());
 }

+bool
+nsFrameLoader::CheckManifestURL(const nsAString& aManifestURL)
+{
+  return AssertAppProcessManifestURL(GetRemoteBrowser(),
+                                     NS_ConvertUTF16toUTF8(aManifestURL).get());
+}
+
 NS_IMETHODIMP
 nsFrameLoader::GetMessageManager(nsIMessageSender** aManager)
 {
@ -2550,6 +2557,12 @@ nsFrameLoader::AttributeChanged(nsIDocument* aDocument,
 void
 nsFrameLoader::ResetPermissionManagerStatus()
 {
+  // The resetting of the permissions status can run only
+  // in the main process.
+  if (XRE_GetProcessType() == GeckoProcessType_Content) {
+    return;
+  }
+
  // Finding the new app Id:
  // . first we check if the owner is an app frame
  // . second, we check if the owner is a browser frame
--- a/content/base/src/nsFrameLoader.h
+++ b/content/base/src/nsFrameLoader.h
@ -189,7 +189,7 @@ public:
  virtual bool DoSendAsyncMessage(const nsAString& aMessage,
                                  const mozilla::dom::StructuredCloneData& aData);
  virtual bool CheckPermission(const nsAString& aPermission);
-
+  virtual bool CheckManifestURL(const nsAString& aManifestURL);

  /**
   * Called from the layout frame associated with this frame loader;
--- a/content/base/src/nsFrameMessageManager.cpp
+++ b/content/base/src/nsFrameMessageManager.cpp
@ -7,7 +7,7 @@

 #include "nsFrameMessageManager.h"

-#include "AppProcessPermissions.h"
+#include "AppProcessChecker.h"
 #include "ContentChild.h"
 #include "ContentParent.h"
 #include "nsContentUtils.h"
@ -107,8 +107,8 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsFrameMessageManager)
  NS_INTERFACE_MAP_ENTRY_CONDITIONAL(nsIFrameScriptLoader,
                                     mChrome && !mIsProcessManager)

-  /* Message senders in the chrome process support nsIPermissionChecker. */
-  NS_INTERFACE_MAP_ENTRY_CONDITIONAL(nsIPermissionChecker,
+  /* Message senders in the chrome process support nsIProcessChecker. */
+  NS_INTERFACE_MAP_ENTRY_CONDITIONAL(nsIProcessChecker,
                                     mChrome && !mIsBroadcaster)

  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO_CONDITIONAL(ChromeMessageBroadcaster,
@ -423,12 +423,14 @@ nsFrameMessageManager::Atob(const nsAString& aAsciiString,
  return NS_OK;
 }

-// nsIPermissionChecker
+// nsIProcessChecker

-NS_IMETHODIMP
-nsFrameMessageManager::AssertPermission(const nsAString& aPermission, bool* aHasPermission)
+nsresult
+nsFrameMessageManager::AssertProcessInternal(ProcessCheckerType aType,
+                                             const nsAString& aCapability,
+                                             bool* aValid)
 {
-  *aHasPermission = false;
+  *aValid = false;

  // This API is only supported for message senders in the chrome process.
  if (!mChrome || mIsBroadcaster) {
@ -437,10 +439,37 @@ nsFrameMessageManager::AssertPermission(const nsAString& aPermission, bool* aHas
  if (!mCallback) {
    return NS_ERROR_NOT_AVAILABLE;
  }
-  *aHasPermission = mCallback->CheckPermission(aPermission);
+  switch (aType) {
+    case PROCESS_CHECKER_PERMISSION:
+      *aValid = mCallback->CheckPermission(aCapability);
+      break;
+    case PROCESS_CHECKER_MANIFEST_URL:
+      *aValid = mCallback->CheckManifestURL(aCapability);
+      break;
+    default:
+      break;
+  }
  return NS_OK;
 }

+NS_IMETHODIMP
+nsFrameMessageManager::AssertPermission(const nsAString& aPermission,
+                                        bool* aHasPermission)
+{
+  return AssertProcessInternal(PROCESS_CHECKER_PERMISSION,
+                               aPermission,
+                               aHasPermission);
+}
+
+NS_IMETHODIMP
+nsFrameMessageManager::AssertContainApp(const nsAString& aManifestURL,
+                                        bool* aHasManifestURL)
+{
+  return AssertProcessInternal(PROCESS_CHECKER_MANIFEST_URL,
+                               aManifestURL,
+                               aHasManifestURL);
+}
+
 class MMListenerRemover
 {
 public:
@ -1100,6 +1129,11 @@ public:
    return true;
  }

+  bool CheckManifestURL(const nsAString& aManifestURL)
+  {
+    // In a single-process scenario, the child always has all capabilities.
+    return true;
+  }
 };


--- a/content/base/src/nsFrameMessageManager.h
+++ b/content/base/src/nsFrameMessageManager.h
@ -66,6 +66,11 @@ public:
  {
    return false;
  }
+
+  virtual bool CheckManifestURL(const nsAString& aManifestURL)
+  {
+    return false;
+  }
 };

 } // namespace ipc
@ -86,7 +91,7 @@ struct nsMessageListenerInfo
 class nsFrameMessageManager MOZ_FINAL : public nsIContentFrameMessageManager,
                                        public nsIMessageBroadcaster,
                                        public nsIFrameScriptLoader,
-                                        public nsIPermissionChecker
+                                        public nsIProcessChecker
 {
  typedef mozilla::dom::StructuredCloneData StructuredCloneData;
 public:
@ -152,7 +157,7 @@ public:
  NS_DECL_NSISYNCMESSAGESENDER
  NS_DECL_NSICONTENTFRAMEMESSAGEMANAGER
  NS_DECL_NSIFRAMESCRIPTLOADER
-  NS_DECL_NSIPERMISSIONCHECKER
+  NS_DECL_NSIPROCESSCHECKER

  static nsFrameMessageManager*
  NewProcessMessageManager(mozilla::dom::ContentParent* aProcess);
@ -226,6 +231,14 @@ public:
  static nsFrameMessageManager* sChildProcessManager;
  static nsFrameMessageManager* sSameProcessParentManager;
  static nsTArray<nsCOMPtr<nsIRunnable> >* sPendingSameProcessAsyncMessages;
+private:
+  enum ProcessCheckerType {
+    PROCESS_CHECKER_PERMISSION,
+    PROCESS_CHECKER_MANIFEST_URL
+  };
+  nsresult AssertProcessInternal(ProcessCheckerType aType,
+                                 const nsAString& aCapability,
+                                 bool* aValid);
 };

 void
--- a/content/base/src/nsStyleLinkElement.cpp
+++ b/content/base/src/nsStyleLinkElement.cpp
@ -12,9 +12,10 @@

 #include "nsStyleLinkElement.h"

-#include "nsIContent.h"
 #include "mozilla/css/Loader.h"
+#include "mozilla/dom/Element.h"
 #include "nsCSSStyleSheet.h"
+#include "nsIContent.h"
 #include "nsIDocument.h"
 #include "nsIDOMComment.h"
 #include "nsIDOMNode.h"
@ -26,6 +27,9 @@
 #include "nsUnicharInputStream.h"
 #include "nsContentUtils.h"

+using namespace mozilla;
+using namespace mozilla::dom;
+
 nsStyleLinkElement::nsStyleLinkElement()
  : mDontLoadStyle(false)
  , mUpdatesEnabled(true)
@ -203,6 +207,87 @@ nsStyleLinkElement::UpdateStyleSheetInternal(nsIDocument *aOldDocument,
                            aForceUpdate);
 }

+static bool
+IsScopedStyleElement(nsIContent* aContent)
+{
+  // This is quicker than, say, QIing aContent to nsStyleLinkElement
+  // and then calling its virtual GetStyleSheetInfo method to find out
+  // if it is scoped.
+  return aContent->IsHTML(nsGkAtoms::style) &&
+         aContent->HasAttr(kNameSpaceID_None, nsGkAtoms::scoped);
+}
+
+static void
+SetIsElementInStyleScopeFlagOnSubtree(Element* aElement)
+{
+  if (aElement->IsElementInStyleScope()) {
+    return;
+  }
+
+  aElement->SetIsElementInStyleScope();
+
+  nsIContent* n = aElement->GetNextNode(aElement);
+  while (n) {
+    if (n->IsElementInStyleScope()) {
+      n = n->GetNextNonChildNode(aElement);
+    } else {
+      if (n->IsElement()) {
+        n->SetIsElementInStyleScope();
+      }
+      n = n->GetNextNode(aElement);
+    }
+  }
+}
+
+static bool
+HasScopedStyleSheetChild(nsIContent* aContent)
+{
+  for (nsIContent* n = aContent->GetFirstChild(); n; n = n->GetNextSibling()) {
+    if (IsScopedStyleElement(n)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+// Called when aElement has had a <style scoped> child removed.
+static void
+UpdateIsElementInStyleScopeFlagOnSubtree(Element* aElement)
+{
+  NS_ASSERTION(aElement->IsElementInStyleScope(),
+               "only call UpdateIsElementInStyleScopeFlagOnSubtree on a "
+               "subtree that has IsElementInStyleScope boolean flag set");
+
+  if (HasScopedStyleSheetChild(aElement)) {
+    return;
+  }
+
+  aElement->ClearIsElementInStyleScope();
+
+  nsIContent* n = aElement->GetNextNode(aElement);
+  while (n) {
+    if (HasScopedStyleSheetChild(n)) {
+      n = n->GetNextNonChildNode(aElement);
+    } else {
+      if (n->IsElement()) {
+        n->ClearIsElementInStyleScope();
+      }
+      n = n->GetNextNode(aElement);
+    }
+  }
+}
+
+static Element*
+GetScopeElement(nsIStyleSheet* aSheet)
+{
+  nsRefPtr<nsCSSStyleSheet> cssStyleSheet = do_QueryObject(aSheet);
+  if (!cssStyleSheet) {
+    return nullptr;
+  }
+
+  return cssStyleSheet->GetScopeElement();
+}
+
 nsresult
 nsStyleLinkElement::DoUpdateStyleSheet(nsIDocument *aOldDocument,
                                       nsICSSLoaderObserver* aObserver,
@ -212,6 +297,11 @@ nsStyleLinkElement::DoUpdateStyleSheet(nsIDocument *aOldDocument,
 {
  *aWillNotify = false;

+  nsCOMPtr<nsIContent> thisContent;
+  CallQueryInterface(this, getter_AddRefs(thisContent));
+
+  Element* oldScopeElement = GetScopeElement(mStyleSheet);
+
  if (mStyleSheet && aOldDocument) {
    // We're removing the link element from the document, unload the
    // stylesheet.  We want to do this even if updates are disabled, since
@ -221,15 +311,15 @@ nsStyleLinkElement::DoUpdateStyleSheet(nsIDocument *aOldDocument,
    aOldDocument->RemoveStyleSheet(mStyleSheet);
    aOldDocument->EndUpdate(UPDATE_STYLE);
    nsStyleLinkElement::SetStyleSheet(nullptr);
+    if (oldScopeElement) {
+      UpdateIsElementInStyleScopeFlagOnSubtree(oldScopeElement);
+    }
  }

  if (mDontLoadStyle || !mUpdatesEnabled) {
    return NS_OK;
  }

-  nsCOMPtr<nsIContent> thisContent;
-  QueryInterface(NS_GET_IID(nsIContent), getter_AddRefs(thisContent));
-
  NS_ENSURE_TRUE(thisContent, NS_ERROR_FAILURE);

  nsCOMPtr<nsIDocument> doc = thisContent->GetDocument();
@ -264,14 +354,21 @@ nsStyleLinkElement::DoUpdateStyleSheet(nsIDocument *aOldDocument,
  }

  nsAutoString title, type, media;
+  bool isScoped;
  bool isAlternate;

-  GetStyleSheetInfo(title, type, media, &isAlternate);
+  GetStyleSheetInfo(title, type, media, &isScoped, &isAlternate);

  if (!type.LowerCaseEqualsLiteral("text/css")) {
    return NS_OK;
  }

+  Element* scopeElement = isScoped ? thisContent->GetParentElement() : nullptr;
+  if (scopeElement) {
+    NS_ASSERTION(isInline, "non-inline style must not have scope element");
+    SetIsElementInStyleScopeFlagOnSubtree(scopeElement);
+  }
+
  bool doneLoading = false;
  nsresult rv = NS_OK;
  if (isInline) {
@ -281,7 +378,7 @@ nsStyleLinkElement::DoUpdateStyleSheet(nsIDocument *aOldDocument,
    // Parse the style sheet.
    rv = doc->CSSLoader()->
      LoadInlineStyle(thisContent, text, mLineNumber, title, media,
-                      aObserver, &doneLoading, &isAlternate);
+                      scopeElement, aObserver, &doneLoading, &isAlternate);
  }
  else {
    // XXXbz clone the URI here to work around content policies modifying URIs.
@ -308,3 +405,44 @@ nsStyleLinkElement::DoUpdateStyleSheet(nsIDocument *aOldDocument,

  return NS_OK;
 }
+
+void
+nsStyleLinkElement::UpdateStyleSheetScopedness(bool aIsNowScoped)
+{
+  if (!mStyleSheet) {
+    return;
+  }
+
+  nsRefPtr<nsCSSStyleSheet> cssStyleSheet = do_QueryObject(mStyleSheet);
+  NS_ASSERTION(cssStyleSheet, "should only call UpdateStyleSheetScope for "
+                              "an nsCSSStyleSheet");
+
+  nsCOMPtr<nsIContent> thisContent;
+  CallQueryInterface(this, getter_AddRefs(thisContent));
+
+  Element* oldScopeElement = cssStyleSheet->GetScopeElement();
+  Element* newScopeElement = aIsNowScoped ?
+                               thisContent->GetParentElement() :
+                               nullptr;
+
+  if (oldScopeElement == newScopeElement) {
+    return;
+  }
+
+  nsIDocument* document = thisContent->GetOwnerDocument();
+
+  document->BeginUpdate(UPDATE_STYLE);
+  document->RemoveStyleSheet(mStyleSheet);
+
+  cssStyleSheet->SetScopeElement(newScopeElement);
+
+  document->AddStyleSheet(mStyleSheet);
+  document->EndUpdate(UPDATE_STYLE);
+
+  if (oldScopeElement) {
+    UpdateIsElementInStyleScopeFlagOnSubtree(oldScopeElement);
+  }
+  if (newScopeElement) {
+    SetIsElementInStyleScopeFlagOnSubtree(newScopeElement);
+  }
+}
--- a/content/base/src/nsStyleLinkElement.h
+++ b/content/base/src/nsStyleLinkElement.h
@ -69,10 +69,13 @@ protected:
  nsresult UpdateStyleSheetInternal(nsIDocument *aOldDocument,
                                    bool aForceUpdate = false);

+  void UpdateStyleSheetScopedness(bool aIsNowScoped);
+
  virtual already_AddRefed<nsIURI> GetStyleSheetURL(bool* aIsInline) = 0;
  virtual void GetStyleSheetInfo(nsAString& aTitle,
                                 nsAString& aType,
                                 nsAString& aMedia,
+                                 bool* aIsScoped,
                                 bool* aIsAlternate) = 0;

  nsIStyleSheet* GetStyleSheet() { return mStyleSheet; }
--- a/content/base/test/Makefile.in
+++ b/content/base/test/Makefile.in
@ -506,8 +506,8 @@ MOCHITEST_FILES_B = \
 		file_html_in_xhr3.html \
 		file_html_in_xhr.sjs \
 		test_bug647518.html \
-		test_bug654352.html \
-                Ahem.ttf \
+		test_caretPositionFromPoint.html \
+		Ahem.ttf \
 		test_bug664916.html \
 		test_bug666604.html \
 		test_bug675121.html \
--- a/content/base/test/test_caretPositionFromPoint.html
+++ b/content/base/test/test_caretPositionFromPoint.html
@ -64,6 +64,16 @@
    checkOffsetsFromPoint(test4Rect.left + 1, test4Rect.top + 1, 0);
    checkOffsetsFromPoint(Math.round(test4Rect.left + convertEmToPx(3)), Math.round(test4Rect.top + 10), 3);

+    // Check to make sure that x or y outside the viewport returns null.
+    var nullCp1 = document.caretPositionFromPoint(-10, 0);
+    ok(!nullCp1, "caret position with negative x should be null");
+    var nullCp2 = document.caretPositionFromPoint(0, -10);
+    ok(!nullCp2, "caret position with negative y should be null");
+    var nullCp3 = document.caretPositionFromPoint(9000, 0);
+    ok(!nullCp3, "caret position with x > viewport width should be null");
+    var nullCp4 = document.caretPositionFromPoint(0, 9000);
+    ok(!nullCp4, "caret position with x > viewport height should be null");
+
    // Check the first and last characters of the marquee.
    SimpleTest.finish();
  }
--- a/content/base/test/test_messagemanager_assertpermission.html
+++ b/content/base/test/test_messagemanager_assertpermission.html
@ -2,7 +2,7 @@
 <html>
 <head>
  <meta charset="utf-8">
-  <title>Test for the nsIPermissionChecker part of Message Managers</title>
+  <title>Test for the nsIProcessChecker part of Message Managers</title>
  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>        
  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 </head>
--- a/content/canvas/src/WebGLContextGL.cpp
+++ b/content/canvas/src/WebGLContextGL.cpp
@ -3166,9 +3166,6 @@ WebGLContext::ReadPixels(WebGLint x, WebGLint y, WebGLsizei width,
    WebGLsizei framebufferWidth = framebufferRect ? framebufferRect->Width() : 0;
    WebGLsizei framebufferHeight = framebufferRect ? framebufferRect->Height() : 0;

-    uint32_t dataByteLen = JS_GetTypedArrayByteLength(pixels->Obj());
-    int dataType = JS_GetTypedArrayType(pixels->Obj());
-
    uint32_t channels = 0;

    // Check the format param
@ -3205,6 +3202,8 @@ WebGLContext::ReadPixels(WebGLint x, WebGLint y, WebGLsizei width,
            return ErrorInvalidEnum("readPixels: Bad type");
    }

+    int dataType = JS_GetArrayBufferViewType(pixels->Obj());
+
    // Check the pixels param type
    if (dataType != requiredDataType)
        return ErrorInvalidOperation("readPixels: Mismatched type/pixels types");
@ -3221,6 +3220,7 @@ WebGLContext::ReadPixels(WebGLint x, WebGLint y, WebGLsizei width,
    if (!checked_neededByteLength.isValid())
        return ErrorInvalidOperation("readPixels: integer overflow computing the needed buffer size");

+    uint32_t dataByteLen = JS_GetTypedArrayByteLength(pixels->Obj());
    if (checked_neededByteLength.value() > dataByteLen)
        return ErrorInvalidOperation("readPixels: buffer too small");

@ -4890,7 +4890,7 @@ WebGLContext::TexImage2D(WebGLenum target, WebGLint level,
    return TexImage2D_base(target, level, internalformat, width, height, 0, border, format, type,
                           pixels ? pixels->Data() : 0,
                           pixels ? pixels->Length() : 0,
-                           pixels ? (int)JS_GetTypedArrayType(pixels->Obj()) : -1,
+                           pixels ? (int)JS_GetArrayBufferViewType(pixels->Obj()) : -1,
                           WebGLTexelConversions::Auto, false);
 }

@ -5044,7 +5044,7 @@ WebGLContext::TexSubImage2D(WebGLenum target, WebGLint level,
    return TexSubImage2D_base(target, level, xoffset, yoffset,
                              width, height, 0, format, type,
                              pixels->Data(), pixels->Length(),
-                              JS_GetTypedArrayType(pixels->Obj()),
+                              JS_GetArrayBufferViewType(pixels->Obj()),
                              WebGLTexelConversions::Auto, false);
 }

--- a/content/events/test/test_eventctors.html
+++ b/content/events/test/test_eventctors.html
@ -426,6 +426,10 @@ is(e.min, 0, "min should be 0");
 is(e.max, 2, "max should be 2");
 document.dispatchEvent(e);
 is(receivedEvent, e, "Wrong event!");
+e = new DeviceProximityEvent("hello");
+is(e.value, Infinity, "Uninitialized value should be infinity");
+is(e.min, -Infinity, "Uninitialized min should be -infinity");
+is(e.max, Infinity, "Uninitialized max should be infinity");

 // UserProximityEvent
 e = new UserProximityEvent("hello", {near: true});
--- a/content/html/content/src/HTMLSharedListElement.cpp
+++ b/content/html/content/src/HTMLSharedListElement.cpp
@ -16,7 +16,9 @@
 #include "nsMappedAttributes.h"
 #include "nsRuleData.h"

-NS_IMPL_NS_NEW_HTML_ELEMENT(SharedList)
+NS_IMPL_NS_NEW_HTML_ELEMENT(OList)
+NS_IMPL_NS_NEW_HTML_ELEMENT(DList)
+NS_IMPL_NS_NEW_HTML_ELEMENT(UList)
 DOMCI_DATA(HTMLOListElement, mozilla::dom::HTMLSharedListElement)
 DOMCI_DATA(HTMLDListElement, mozilla::dom::HTMLSharedListElement)
 DOMCI_DATA(HTMLUListElement, mozilla::dom::HTMLSharedListElement)
@ -62,7 +64,9 @@ NS_INTERFACE_TABLE_HEAD(HTMLSharedListElement)
 NS_HTML_CONTENT_INTERFACE_MAP_END


-NS_IMPL_ELEMENT_CLONE(HTMLSharedListElement)
+NS_IMPL_ELEMENT_CLONE(HTMLOListElement)
+NS_IMPL_ELEMENT_CLONE(HTMLDListElement)
+NS_IMPL_ELEMENT_CLONE(HTMLUListElement)


 NS_IMPL_BOOL_ATTR(HTMLSharedListElement, Compact, compact)
--- a/content/html/content/src/HTMLSharedListElement.h
+++ b/content/html/content/src/HTMLSharedListElement.h
@ -55,7 +55,6 @@ public:
                                nsAttrValue& aResult);
  virtual nsMapRuleToAttributesFunc GetAttributeMappingFunction() const;
  NS_IMETHOD_(bool) IsAttributeMapped(const nsIAtom* aAttribute) const;
-  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
  virtual nsXPCClassInfo* GetClassInfo()
  {
    return static_cast<nsXPCClassInfo*>(GetClassInfoInternal());
@ -99,10 +98,20 @@ public:
  {
    SetHTMLBoolAttr(nsGkAtoms::compact, aCompact, rv);
  }
+
+protected:
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
+                             bool *aTriedToWrap) MOZ_OVERRIDE = 0;
 };

 class HTMLDListElement MOZ_FINAL : public HTMLSharedListElement
 {
+public:
+  HTMLDListElement(already_AddRefed<nsINodeInfo> aNodeInfo)
+    : HTMLSharedListElement(aNodeInfo)
+  {
+  }
+  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
 protected:
  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
                             bool *aTriedToWrap) MOZ_OVERRIDE;
@ -110,6 +119,12 @@ protected:

 class HTMLOListElement MOZ_FINAL : public HTMLSharedListElement
 {
+public:
+  HTMLOListElement(already_AddRefed<nsINodeInfo> aNodeInfo)
+    : HTMLSharedListElement(aNodeInfo)
+  {
+  }
+  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
 protected:
  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
                             bool *aTriedToWrap) MOZ_OVERRIDE;
@ -117,6 +132,12 @@ protected:

 class HTMLUListElement MOZ_FINAL : public HTMLSharedListElement
 {
+public:
+  HTMLUListElement(already_AddRefed<nsINodeInfo> aNodeInfo)
+    : HTMLSharedListElement(aNodeInfo)
+  {
+  }
+  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
 protected:
  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
                             bool *aTriedToWrap) MOZ_OVERRIDE;
--- a/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/content/html/content/src/nsGenericHTMLElement.cpp
@ -1870,16 +1870,6 @@ nsGenericHTMLElement::SetAttrHelper(nsIAtom* aAttr, const nsAString& aValue)
  return SetAttr(kNameSpaceID_None, aAttr, aValue, true);
 }

-nsresult
-nsGenericHTMLElement::SetBoolAttr(nsIAtom* aAttr, bool aValue)
-{
-  if (aValue) {
-    return SetAttr(kNameSpaceID_None, aAttr, EmptyString(), true);
-  }
-
-  return UnsetAttr(kNameSpaceID_None, aAttr, true);
-}
-
 int32_t
 nsGenericHTMLElement::GetIntAttr(nsIAtom* aAttr, int32_t aDefault) const
 {
--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@ -37,7 +37,6 @@ class nsHTMLFormElement;
 class nsIDOMHTMLMenuElement;
 class nsIDOMHTMLCollection;
 class nsDOMSettableTokenList;
-class nsIDOMDOMStringMap;

 namespace mozilla {
 namespace dom{
@ -240,6 +239,11 @@ public:
    return style;
  }

+  /**
+   * Determine whether an attribute is an event (onclick, etc.)
+   * @param aName the attribute
+   * @return whether the name is an event handler name
+   */
  virtual bool IsEventAttributeName(nsIAtom* aName) MOZ_OVERRIDE;

 #define EVENT(name_, id_, type_, struct_) /* nothing; handled by nsINode */
@ -773,13 +777,6 @@ private:
  void RegUnRegAccessKey(bool aDoReg);

 protected:
-  /**
-   * Determine whether an attribute is an event (onclick, etc.)
-   * @param aName the attribute
-   * @return whether the name is an event handler name
-   */
-  bool IsEventName(nsIAtom* aName);
-
  virtual nsresult BeforeSetAttr(int32_t aNamespaceID, nsIAtom* aName,
                                 const nsAttrValueOrString* aValue,
                                 bool aNotify);
@ -851,29 +848,6 @@ protected:
   */
  NS_HIDDEN_(nsresult) SetAttrHelper(nsIAtom* aAttr, const nsAString& aValue);

-  /**
-   * Helper method for NS_IMPL_BOOL_ATTR macro.
-   * Gets value of boolean attribute. Only works for attributes in null
-   * namespace.
-   *
-   * @param aAttr    name of attribute.
-   * @param aValue   Boolean value of attribute.
-   */
-  NS_HIDDEN_(bool) GetBoolAttr(nsIAtom* aAttr) const
-  {
-    return HasAttr(kNameSpaceID_None, aAttr);
-  }
-
-  /**
-   * Helper method for NS_IMPL_BOOL_ATTR macro.
-   * Sets value of boolean attribute by removing attribute or setting it to
-   * the empty string. Only works for attributes in null namespace.
-   *
-   * @param aAttr    name of attribute.
-   * @param aValue   Boolean value of attribute.
-   */
-  NS_HIDDEN_(nsresult) SetBoolAttr(nsIAtom* aAttr, bool aValue);
-
  /**
   * Helper method for NS_IMPL_INT_ATTR macro.
   * Gets the integer-value of an attribute, returns specified default value
@ -1236,24 +1210,6 @@ protected:
    return SetAttrHelper(nsGkAtoms::_atom, aValue);                          \
  }

-/**
- * A macro to implement the getter and setter for a given boolean
- * valued content property. The method uses the generic GetAttr and
- * SetAttr methods.
- */
-#define NS_IMPL_BOOL_ATTR(_class, _method, _atom)                     \
-  NS_IMETHODIMP                                                       \
-  _class::Get##_method(bool* aValue)                                \
-  {                                                                   \
-    *aValue = GetBoolAttr(nsGkAtoms::_atom);                          \
-    return NS_OK;                                                     \
-  }                                                                   \
-  NS_IMETHODIMP                                                       \
-  _class::Set##_method(bool aValue)                                 \
-  {                                                                   \
-    return SetBoolAttr(nsGkAtoms::_atom, aValue);                   \
-  }
-
 /**
 * A macro to implement the getter and setter for a given integer
 * valued content property. The method uses the generic GetAttr and
@ -1910,7 +1866,6 @@ NS_NewHTMLElement(already_AddRefed<nsINodeInfo> aNodeInfo,
                  mozilla::dom::FromParser aFromParser = mozilla::dom::NOT_FROM_PARSER);

 NS_DECLARE_NS_NEW_HTML_ELEMENT(Shared)
-NS_DECLARE_NS_NEW_HTML_ELEMENT(SharedList)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(SharedObject)

 NS_DECLARE_NS_NEW_HTML_ELEMENT(Anchor)
@ -1925,6 +1880,7 @@ NS_DECLARE_NS_NEW_HTML_ELEMENT(Canvas)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Mod)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(DataList)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Div)
+NS_DECLARE_NS_NEW_HTML_ELEMENT(DList)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(FieldSet)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Font)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Form)
@ -1947,6 +1903,7 @@ NS_DECLARE_NS_NEW_HTML_ELEMENT(MenuItem)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Meta)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Meter)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Object)
+NS_DECLARE_NS_NEW_HTML_ELEMENT(OList)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(OptGroup)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Option)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Output)
@ -1971,6 +1928,7 @@ NS_DECLARE_NS_NEW_HTML_ELEMENT(TextArea)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Tfoot)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Thead)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Title)
+NS_DECLARE_NS_NEW_HTML_ELEMENT(UList)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Unknown)
 #if defined(MOZ_MEDIA)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Video)
--- a/content/html/content/src/nsHTMLInputElement.cpp
+++ b/content/html/content/src/nsHTMLInputElement.cpp
@ -1076,7 +1076,7 @@ nsHTMLInputElement::ConvertStringToNumber(nsAString& aValue,
          return false;
        }

-        break;
+        return true;
      }
    case NS_FORM_INPUT_DATE:
      {
@ -1091,32 +1091,40 @@ nsHTMLInputElement::ConvertStringToNumber(nsAString& aValue,
        }

        JSObject* date = JS_NewDateObjectMsec(ctx, 0);
+        if (!date) {
+          JS_ClearPendingException(ctx);
+          return false;
+        }
+
        jsval rval;
        jsval fullYear[3];
        fullYear[0].setInt32(year);
        fullYear[1].setInt32(month-1);
        fullYear[2].setInt32(day);
        if (!JS::Call(ctx, date, "setUTCFullYear", 3, fullYear, &rval)) {
+          JS_ClearPendingException(ctx);
          return false;
        }

        jsval timestamp;
        if (!JS::Call(ctx, date, "getTime", 0, nullptr, &timestamp)) {
+          JS_ClearPendingException(ctx);
          return false;
        }

-        if (!timestamp.isNumber()) {
+        if (!timestamp.isNumber() || MOZ_DOUBLE_IS_NaN(timestamp.toNumber())) {
          return false;
        }

        aResultValue = timestamp.toNumber();
+        return true;
      }
-      break;
    default:
      return false;
  }

-  return true;
+  MOZ_NOT_REACHED();
+  return false;
 }

 double
@ -1242,6 +1250,7 @@ nsHTMLInputElement::ConvertNumberToString(double aValue,

        JSObject* date = JS_NewDateObjectMsec(ctx, aValue);
        if (!date) {
+          JS_ClearPendingException(ctx);
          return false;
        }

@ -1249,6 +1258,14 @@ nsHTMLInputElement::ConvertNumberToString(double aValue,
        if (!JS::Call(ctx, date, "getUTCFullYear", 0, nullptr, &year) ||
            !JS::Call(ctx, date, "getUTCMonth", 0, nullptr, &month) ||
            !JS::Call(ctx, date, "getUTCDate", 0, nullptr, &day)) {
+          JS_ClearPendingException(ctx);
+          return false;
+        }
+
+        if (!year.isNumber() || !month.isNumber() || !day.isNumber() ||
+            MOZ_DOUBLE_IS_NaN(year.toNumber()) ||
+            MOZ_DOUBLE_IS_NaN(month.toNumber()) ||
+            MOZ_DOUBLE_IS_NaN(day.toNumber())) {
          return false;
        }

@ -1280,12 +1297,19 @@ nsHTMLInputElement::GetValueAsDate(JSContext* aCtx, jsval* aDate)
  }

  JSObject* date = JS_NewDateObjectMsec(aCtx, 0);
+  if (!date) {
+    JS_ClearPendingException(aCtx);
+    aDate->setNull();
+    return NS_OK;
+  }
+
  jsval rval;
  jsval fullYear[3];
  fullYear[0].setInt32(year);
  fullYear[1].setInt32(month-1);
  fullYear[2].setInt32(day);
  if(!JS::Call(aCtx, date, "setUTCFullYear", 3, fullYear, &rval)) {
+    JS_ClearPendingException(aCtx);
    aDate->setNull();
    return NS_OK;
  }
@ -1301,15 +1325,22 @@ nsHTMLInputElement::SetValueAsDate(JSContext* aCtx, const jsval& aDate)
    return NS_ERROR_DOM_INVALID_STATE_ERR;
  }

+  if (aDate.isNullOrUndefined()) {
+    return SetValue(EmptyString());
+  }
+
+  // TODO: return TypeError when HTMLInputElement is converted to WebIDL, see
+  // bug 826302.
  if (!aDate.isObject() || !JS_ObjectIsDate(aCtx, &aDate.toObject())) {
    SetValue(EmptyString());
-    return NS_OK;
+    return NS_ERROR_INVALID_ARG;
  }

  JSObject& date = aDate.toObject();
  jsval timestamp;
-  bool ret = JS::Call(aCtx, &date, "getTime", 0, nullptr, &timestamp);
-  if (!ret || !timestamp.isNumber() || MOZ_DOUBLE_IS_NaN(timestamp.toNumber())) {
+  if (!JS::Call(aCtx, &date, "getTime", 0, nullptr, &timestamp) ||
+      !timestamp.isNumber() || MOZ_DOUBLE_IS_NaN(timestamp.toNumber())) {
+    JS_ClearPendingException(aCtx);
    SetValue(EmptyString());
    return NS_OK;
  }
--- a/content/html/content/src/nsHTMLLinkElement.cpp
+++ b/content/html/content/src/nsHTMLLinkElement.cpp
@ -103,6 +103,7 @@ protected:
  virtual void GetStyleSheetInfo(nsAString& aTitle,
                                 nsAString& aType,
                                 nsAString& aMedia,
+                                 bool* aIsScoped,
                                 bool* aIsAlternate);
  virtual CORSMode GetCORSMode() const;
 protected:
@ -431,11 +432,13 @@ void
 nsHTMLLinkElement::GetStyleSheetInfo(nsAString& aTitle,
                                     nsAString& aType,
                                     nsAString& aMedia,
+                                     bool* aIsScoped,
                                     bool* aIsAlternate)
 {
  aTitle.Truncate();
  aType.Truncate();
  aMedia.Truncate();
+  *aIsScoped = false;
  *aIsAlternate = false;

  nsAutoString rel;
--- a/content/html/content/src/nsHTMLMediaElement.cpp
+++ b/content/html/content/src/nsHTMLMediaElement.cpp
@ -3570,9 +3570,10 @@ void nsHTMLMediaElement::UpdateAudioChannelPlayingState()
  // The nsHTMLMediaElement is registered to the AudioChannelService only on B2G.
 #ifdef MOZ_B2G
  bool playingThroughTheAudioChannel =
-     (mReadyState >= nsIDOMHTMLMediaElement::HAVE_CURRENT_DATA &&
-      !mPaused &&
-      !IsPlaybackEnded());
+     (!mPaused &&
+      (HasAttr(kNameSpaceID_None, nsGkAtoms::loop) ||
+       (mReadyState >= nsIDOMHTMLMediaElement::HAVE_CURRENT_DATA &&
+        !IsPlaybackEnded())));
  if (playingThroughTheAudioChannel != mPlayingThroughTheAudioChannel) {
    mPlayingThroughTheAudioChannel = playingThroughTheAudioChannel;

--- a/content/html/content/src/nsHTMLStyleElement.cpp
+++ b/content/html/content/src/nsHTMLStyleElement.cpp
@ -86,6 +86,7 @@ protected:
  void GetStyleSheetInfo(nsAString& aTitle,
                         nsAString& aType,
                         nsAString& aMedia,
+                         bool* aIsScoped,
                         bool* aIsAlternate);
  /**
   * Common method to call from the various mutation observer methods.
@ -164,6 +165,7 @@ nsHTMLStyleElement::SetDisabled(bool aDisabled)
 }

 NS_IMPL_STRING_ATTR(nsHTMLStyleElement, Media, media)
+NS_IMPL_BOOL_ATTR(nsHTMLStyleElement, Scoped, scoped)
 NS_IMPL_STRING_ATTR(nsHTMLStyleElement, Type, type)

 void
@ -242,11 +244,14 @@ nsHTMLStyleElement::SetAttr(int32_t aNameSpaceID, nsIAtom* aName,
 {
  nsresult rv = nsGenericHTMLElement::SetAttr(aNameSpaceID, aName, aPrefix,
                                              aValue, aNotify);
-  if (NS_SUCCEEDED(rv) && aNameSpaceID == kNameSpaceID_None &&
-      (aName == nsGkAtoms::title ||
-       aName == nsGkAtoms::media ||
-       aName == nsGkAtoms::type)) {
-    UpdateStyleSheetInternal(nullptr, true);
+  if (NS_SUCCEEDED(rv) && aNameSpaceID == kNameSpaceID_None) {
+    if (aName == nsGkAtoms::title ||
+        aName == nsGkAtoms::media ||
+        aName == nsGkAtoms::type) {
+      UpdateStyleSheetInternal(nullptr, true);
+    } else if (aName == nsGkAtoms::scoped) {
+      UpdateStyleSheetScopedness(true);
+    }
  }

  return rv;
@ -258,11 +263,14 @@ nsHTMLStyleElement::UnsetAttr(int32_t aNameSpaceID, nsIAtom* aAttribute,
 {
  nsresult rv = nsGenericHTMLElement::UnsetAttr(aNameSpaceID, aAttribute,
                                                aNotify);
-  if (NS_SUCCEEDED(rv) && aNameSpaceID == kNameSpaceID_None &&
-      (aAttribute == nsGkAtoms::title ||
-       aAttribute == nsGkAtoms::media ||
-       aAttribute == nsGkAtoms::type)) {
-    UpdateStyleSheetInternal(nullptr, true);
+  if (NS_SUCCEEDED(rv) && aNameSpaceID == kNameSpaceID_None) {
+    if (aAttribute == nsGkAtoms::title ||
+        aAttribute == nsGkAtoms::media ||
+        aAttribute == nsGkAtoms::type) {
+      UpdateStyleSheetInternal(nullptr, true);
+    } else if (aAttribute == nsGkAtoms::scoped) {
+      UpdateStyleSheetScopedness(false);
+    }
  }

  return rv;
@ -298,6 +306,7 @@ void
 nsHTMLStyleElement::GetStyleSheetInfo(nsAString& aTitle,
                                      nsAString& aType,
                                      nsAString& aMedia,
+                                      bool* aIsScoped,
                                      bool* aIsAlternate)
 {
  aTitle.Truncate();
@ -317,6 +326,8 @@ nsHTMLStyleElement::GetStyleSheetInfo(nsAString& aTitle,

  GetAttr(kNameSpaceID_None, nsGkAtoms::type, aType);

+  *aIsScoped = HasAttr(kNameSpaceID_None, nsGkAtoms::scoped);
+
  nsAutoString mimeType;
  nsAutoString notUsed;
  nsContentUtils::SplitMimeType(aType, mimeType, notUsed);
--- a/content/html/content/test/Makefile.in
+++ b/content/html/content/test/Makefile.in
@ -337,6 +337,7 @@ MOCHITEST_FILES = \
 		test_formelements.html \
 		test_rowscollection.html \
 		test_mozaudiochannel.html \
+		test_style_attributes_reflection.html \
 		$(NULL)


--- a/content/html/content/test/forms/test_valueasdate_attribute.html
+++ b/content/html/content/test/forms/test_valueasdate_attribute.html
@ -176,6 +176,9 @@ function checkSet()
    // the corresponding date string is the empty string
    [ -62135596800001,   "" ],
    // Invalid dates.
+    // We set the value to something different than the empty string because
+    // NaN should set the value to the empty string.
+    [ 86400000,          "1970-01-02" ],
    [ NaN,               "" ],
  ];

@ -186,9 +189,61 @@ function checkSet()
                                + data[1]);
  }

+  element.value = "test";
  element.valueAsDate = null;
  is(element.value, "", "valueAsDate should set the value to the empty string");

+  element.value = "test";
+  element.valueAsDate = undefined;
+  is(element.value, "", "valueAsDate should set the value to the empty string");
+
+  var illegalValues = [
+    "foobar", 42, {}, function() { return 42; }, function() { return Date(); }
+  ];
+
+  for (value of illegalValues) {
+    try {
+      var caught = false;
+      element.valueAsDate = value;
+    } catch(e) {
+      caught = true;
+    }
+    ok(caught, "Assigning " + value + " to .valueAsDate should throw");
+  }
+}
+
+function checkWithBustedPrototype()
+{
+  var element = document.createElement('input');
+  element.type = 'date';
+
+  var witnessDate = new Date();
+
+  Date.prototype.getUTCFullYear = function() { return {}; };
+  Date.prototype.getUTCMonth = function() { return {}; };
+  Date.prototype.getUTCDate = function() { return {}; };
+  Date.prototype.getTime = function() { return {}; };
+  Date.prototype.setUTCFullYear = function(y,m,d) { };
+
+  element.valueAsDate = new Date();
+
+  todo_isnot(element.valueAsDate, null, ".valueAsDate should not return null");
+  // TODO: check the Date object value (UTCFullYear, UTCMonth and UTCDate)
+  // when .valueAsDate will stop returning null.
+
+  // Same test as above but using NaN instead of {}.
+
+  Date.prototype.getUTCFullYear = function() { return NaN; };
+  Date.prototype.getUTCMonth = function() { return NaN; };
+  Date.prototype.getUTCDate = function() { return NaN; };
+  Date.prototype.getTime = function() { return NaN; };
+  Date.prototype.setUTCFullYear = function(y,m,d) { };
+
+  element.valueAsDate = new Date();
+
+  todo_isnot(element.valueAsDate, null, ".valueAsDate should not return null");
+  // TODO: check the Date object value (UTCFullYear, UTCMonth and UTCDate)
+  // when .valueAsDate will stop returning null.
 }

 SimpleTest.waitForExplicitFinish();
@ -196,6 +251,7 @@ SpecialPowers.pushPrefEnv({'set': [["dom.experimental_forms", true]]}, function(
 checkAvailability();
 checkGet();
 checkSet();
+checkWithBustedPrototype();

 SimpleTest.finish();
 });
--- a/content/html/content/test/reflect.js
+++ b/content/html/content/test/reflect.js
@ -62,6 +62,7 @@ function reflectString(aParameters)
    link: [ "crossOrigin" ],
    source: [ "media" ],
    textarea: [ "name", "placeholder" ],
+    style: [ "media", "type" ]
  };
  if (!(element.localName in todoAttrs) || todoAttrs[element.localName].indexOf(idlAttr) == -1) {
    is(element.getAttribute(contentAttr), "null",
--- a/content/html/content/test/test_style_attributes_reflection.html
+++ b/content/html/content/test/test_style_attributes_reflection.html
@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Test for HTMLStyleElement attributes reflection</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="reflect.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<p id="display"></p>
+<div id="content" style="display: none">
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for HTMLStyleElement attributes reflection **/
+
+var e = document.createElement("style");
+
+// .media
+reflectString({
+  element: e,
+  attribute: "media"
+});
+
+// .type
+reflectString({
+  element: e,
+  attribute: "type"
+});
+
+// .scoped
+reflectBoolean({
+  element: e,
+  attribute: "scoped"
+});
+
+</script>
+</pre>
+</body>
+</html>
--- a/content/media/MediaDecoder.cpp
+++ b/content/media/MediaDecoder.cpp
@ -821,8 +821,8 @@ void MediaDecoder::PlaybackEnded()
  PlaybackPositionChanged();
  ChangeState(PLAY_STATE_ENDED);

+  UpdateReadyStateForData();
  if (mOwner)  {
-    UpdateReadyStateForData();
    mOwner->PlaybackEnded();
  }

--- a/content/media/MediaResource.cpp
+++ b/content/media/MediaResource.cpp
@ -1293,25 +1293,20 @@ public:
  }
  virtual int64_t GetLength() {
    MutexAutoLock lock(mLock);
-    if (mInput) {
-      EnsureSizeInitialized();
-    }
+
+    EnsureSizeInitialized();
    return mSizeInitialized ? mSize : 0;
  }
  virtual int64_t GetNextCachedData(int64_t aOffset)
  {
    MutexAutoLock lock(mLock);
-    if (!mInput) {
-      return -1;
-    }
+
    EnsureSizeInitialized();
    return (aOffset < mSize) ? aOffset : -1;
  }
  virtual int64_t GetCachedDataEnd(int64_t aOffset) {
    MutexAutoLock lock(mLock);
-    if (!mInput) {
-      return aOffset;
-    }
+
    EnsureSizeInitialized();
    return NS_MAX(aOffset, mSize);
  }
@ -1348,9 +1343,7 @@ private:
  nsCOMPtr<nsISeekableStream> mSeekable;

  // Input stream for the media data. This can be used from any
-  // thread. This is annulled when the decoder is being shutdown.
-  // The decoder can be shut down while we're calculating buffered
-  // ranges or seeking, so this must be null-checked before it's used.
+  // thread.
  nsCOMPtr<nsIInputStream>  mInput;

  // Whether we've attempted to initialize mSize. Note that mSize can be -1
@ -1402,9 +1395,7 @@ void FileMediaResource::EnsureSizeInitialized()
 nsresult FileMediaResource::GetCachedRanges(nsTArray<MediaByteRange>& aRanges)
 {
  MutexAutoLock lock(mLock);
-  if (!mInput) {
-    return NS_ERROR_FAILURE;
-  }
+
  EnsureSizeInitialized();
  if (mSize == -1) {
    return NS_ERROR_FAILURE;
@ -1470,12 +1461,11 @@ nsresult FileMediaResource::Close()
 {
  NS_ASSERTION(NS_IsMainThread(), "Only call on main thread");

-  MutexAutoLock lock(mLock);
+  // Since mChennel is only accessed by main thread, there is no necessary to
+  // take the lock.
  if (mChannel) {
    mChannel->Cancel(NS_ERROR_PARSED_DATA_CACHED);
    mChannel = nullptr;
-    mInput = nullptr;
-    mSeekable = nullptr;
  }

  return NS_OK;
@ -1527,8 +1517,7 @@ MediaResource* FileMediaResource::CloneData(MediaDecoder* aDecoder)
 nsresult FileMediaResource::ReadFromCache(char* aBuffer, int64_t aOffset, uint32_t aCount)
 {
  MutexAutoLock lock(mLock);
-  if (!mInput || !mSeekable)
-    return NS_ERROR_FAILURE;
+
  EnsureSizeInitialized();
  int64_t offset = 0;
  nsresult res = mSeekable->Tell(&offset);
@ -1557,8 +1546,7 @@ nsresult FileMediaResource::ReadFromCache(char* aBuffer, int64_t aOffset, uint32
 nsresult FileMediaResource::Read(char* aBuffer, uint32_t aCount, uint32_t* aBytes)
 {
  MutexAutoLock lock(mLock);
-  if (!mInput)
-    return NS_ERROR_FAILURE;
+
  EnsureSizeInitialized();
  return mInput->Read(aBuffer, aCount, aBytes);
 }
--- a/content/media/omx/OmxDecoder.cpp
+++ b/content/media/omx/OmxDecoder.cpp
@ -573,10 +573,6 @@ bool OmxDecoder::ReadAudio(AudioFrame *aFrame, int64_t aSeekTimeUs)
 {
  status_t err;

-  if (!mAudioBuffer) {
-    return false;
-  }
-
  if (mAudioMetadataRead && aSeekTimeUs == -1) {
    // Use the data read into the buffer during metadata time
    err = OK;
@ -595,7 +591,7 @@ bool OmxDecoder::ReadAudio(AudioFrame *aFrame, int64_t aSeekTimeUs)

  aSeekTimeUs = -1;

-  if (err == OK && mAudioBuffer->range_length() != 0) {
+  if (err == OK && mAudioBuffer && mAudioBuffer->range_length() != 0) {
    int64_t timeUs;
    if (!mAudioBuffer->meta_data()->findInt64(kKeyTime, &timeUs))
      return false;
--- a/content/svg/content/src/Makefile.in
+++ b/content/svg/content/src/Makefile.in
@ -68,7 +68,6 @@ CPPSRCS		= \
 		nsSVGUnknownElement.cpp \
 		nsSVGUseElement.cpp \
 		nsSVGViewBox.cpp \
-		nsSVGViewElement.cpp \
 		SVGAltGlyphElement.cpp \
 		SVGAngle.cpp \
 		SVGAnimatedAngle.cpp \
@ -137,6 +136,7 @@ CPPSRCS		= \
 		SVGTransformListSMILType.cpp \
 		SVGTSpanElement.cpp \
 		SVGViewBoxSMILType.cpp \
+		SVGViewElement.cpp \
 		$(NULL)

 include $(topsrcdir)/config/config.mk
@ -188,6 +188,7 @@ EXPORTS_mozilla/dom = \
 	SVGTitleElement.h \
 	SVGTransformableElement.h \
 	SVGTSpanElement.h \
+	SVGViewElement.h \
 	$(NULL)

 include $(topsrcdir)/config/rules.mk
--- a/content/svg/content/src/SVGFragmentIdentifier.cpp
+++ b/content/svg/content/src/SVGFragmentIdentifier.cpp
@ -6,7 +6,7 @@
 #include "SVGFragmentIdentifier.h"
 #include "nsIDOMSVGDocument.h"
 #include "nsSVGSVGElement.h"
-#include "nsSVGViewElement.h"
+#include "mozilla/dom/SVGViewElement.h"
 #include "SVGAnimatedTransformList.h"

 using namespace mozilla;
@ -27,12 +27,12 @@ IgnoreWhitespace(PRUnichar aChar)
  return false;
 }

-static nsSVGViewElement*
+static dom::SVGViewElement*
 GetViewElement(nsIDocument *aDocument, const nsAString &aId)
 {
  dom::Element* element = aDocument->GetElementById(aId);
  return (element && element->IsSVG(nsGkAtoms::view)) ?
-            static_cast<nsSVGViewElement*>(element) : nullptr;
+            static_cast<dom::SVGViewElement*>(element) : nullptr;
 }

 void 
@ -236,7 +236,7 @@ SVGFragmentIdentifier::ProcessFragmentIdentifier(nsIDocument *aDocument,
    SaveOldZoomAndPan(rootElement);
  }

-  const nsSVGViewElement *viewElement = GetViewElement(aDocument, aAnchorName);
+  const dom::SVGViewElement *viewElement = GetViewElement(aDocument, aAnchorName);

  if (viewElement) {
    if (!rootElement->mCurrentViewID) {
--- a/content/svg/content/src/SVGStyleElement.cpp
+++ b/content/svg/content/src/SVGStyleElement.cpp
@ -3,6 +3,7 @@
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

+#include "mozilla/dom/Element.h"
 #include "mozilla/dom/SVGStyleElement.h"
 #include "nsContentUtils.h"
 #include "nsStubMutationObserver.h"
@ -98,12 +99,14 @@ SVGStyleElement::SetAttr(int32_t aNameSpaceID, nsIAtom* aName,
 {
  nsresult rv = SVGStyleElementBase::SetAttr(aNameSpaceID, aName, aPrefix,
                                             aValue, aNotify);
-  if (NS_SUCCEEDED(rv)) {
-    UpdateStyleSheetInternal(nullptr,
-                             aNameSpaceID == kNameSpaceID_None &&
-                             (aName == nsGkAtoms::title ||
-                              aName == nsGkAtoms::media ||
-                              aName == nsGkAtoms::type));
+  if (NS_SUCCEEDED(rv) && aNameSpaceID == kNameSpaceID_None) {
+    if (aName == nsGkAtoms::title ||
+        aName == nsGkAtoms::media ||
+        aName == nsGkAtoms::type) {
+      UpdateStyleSheetInternal(nullptr, true);
+    } else if (aName == nsGkAtoms::scoped) {
+      UpdateStyleSheetScopedness(true);
+    }
  }

  return rv;
@ -115,12 +118,14 @@ SVGStyleElement::UnsetAttr(int32_t aNameSpaceID, nsIAtom* aAttribute,
 {
  nsresult rv = SVGStyleElementBase::UnsetAttr(aNameSpaceID, aAttribute,
                                               aNotify);
-  if (NS_SUCCEEDED(rv)) {
-    UpdateStyleSheetInternal(nullptr,
-                             aNameSpaceID == kNameSpaceID_None &&
-                             (aAttribute == nsGkAtoms::title ||
-                              aAttribute == nsGkAtoms::media ||
-                              aAttribute == nsGkAtoms::type));
+  if (NS_SUCCEEDED(rv) && aNameSpaceID == kNameSpaceID_None) {
+    if (aAttribute == nsGkAtoms::title ||
+        aAttribute == nsGkAtoms::media ||
+        aAttribute == nsGkAtoms::type) {
+      UpdateStyleSheetInternal(nullptr, true);
+    } else if (aAttribute == nsGkAtoms::scoped) {
+      UpdateStyleSheetScopedness(false);
+    }
  }

  return rv;
@ -209,53 +214,39 @@ SVGStyleElement::SetXmlspace(const nsAString & aXmlspace, ErrorResult& rv)
  rv = SetAttr(kNameSpaceID_XML, nsGkAtoms::space, aXmlspace, true);
 }

-/* attribute DOMString type; */
-NS_IMETHODIMP SVGStyleElement::GetType(nsAString & aType)
-{
-  GetAttr(kNameSpaceID_None, nsGkAtoms::type, aType);
-
-  return NS_OK;
-}
-NS_IMETHODIMP SVGStyleElement::SetType(const nsAString & aType)
-{
-  return SetAttr(kNameSpaceID_None, nsGkAtoms::type, aType, true);
-}
-void
-SVGStyleElement::SetType(const nsAString & aType, ErrorResult& rv)
-{
-  rv = SetAttr(kNameSpaceID_None, nsGkAtoms::type, aType, true);
-}
-
 /* attribute DOMString media; */
-NS_IMETHODIMP SVGStyleElement::GetMedia(nsAString & aMedia)
-{
-  GetAttr(kNameSpaceID_None, nsGkAtoms::media, aMedia);
-
-  return NS_OK;
-}
-NS_IMETHODIMP SVGStyleElement::SetMedia(const nsAString & aMedia)
-{
-  return SetAttr(kNameSpaceID_None, nsGkAtoms::media, aMedia, true);
-}
+NS_IMPL_STRING_ATTR(SVGStyleElement, Media, media)
 void
-SVGStyleElement::SetMedia(const nsAString & aMedia, ErrorResult& rv)
+SVGStyleElement::SetMedia(const nsAString& aMedia, ErrorResult& rv)
 {
  rv = SetAttr(kNameSpaceID_None, nsGkAtoms::media, aMedia, true);
 }

-/* attribute DOMString title; */
-NS_IMETHODIMP SVGStyleElement::GetTitle(nsAString & aTitle)
+/* attribute boolean scoped; */
+NS_IMPL_BOOL_ATTR(SVGStyleElement, Scoped, scoped)
+bool
+SVGStyleElement::Scoped() const
 {
-  GetAttr(kNameSpaceID_None, nsGkAtoms::title, aTitle);
-
-  return NS_OK;
-}
-NS_IMETHODIMP SVGStyleElement::SetTitle(const nsAString & aTitle)
-{
-  return SetAttr(kNameSpaceID_None, nsGkAtoms::title, aTitle, true);
+  return GetBoolAttr(nsGkAtoms::scoped);
 }
 void
-SVGStyleElement::SetTitle(const nsAString & aTitle, ErrorResult& rv)
+SVGStyleElement::SetScoped(bool aScoped, ErrorResult& rv)
+{
+  rv = SetBoolAttr(nsGkAtoms::scoped, aScoped);
+}
+
+/* attribute DOMString type; */
+NS_IMPL_STRING_ATTR(SVGStyleElement, Type, type)
+void
+SVGStyleElement::SetType(const nsAString& aType, ErrorResult& rv)
+{
+  rv = SetAttr(kNameSpaceID_None, nsGkAtoms::type, aType, true);
+}
+
+/* attribute DOMString title; */
+NS_IMPL_STRING_ATTR(SVGStyleElement, Title, title)
+void
+SVGStyleElement::SetTitle(const nsAString& aTitle, ErrorResult& rv)
 {
  rv = SetAttr(kNameSpaceID_None, nsGkAtoms::title, aTitle, true);
 }
@ -274,6 +265,7 @@ void
 SVGStyleElement::GetStyleSheetInfo(nsAString& aTitle,
                                   nsAString& aType,
                                   nsAString& aMedia,
+                                   bool* aIsScoped,
                                   bool* aIsAlternate)
 {
  *aIsAlternate = false;
@ -293,6 +285,8 @@ SVGStyleElement::GetStyleSheetInfo(nsAString& aTitle,
    aType.AssignLiteral("text/css");
  }

+  *aIsScoped = HasAttr(kNameSpaceID_None, nsGkAtoms::scoped);
+
  return;
 }

--- a/content/svg/content/src/SVGStyleElement.h
+++ b/content/svg/content/src/SVGStyleElement.h
@ -81,6 +81,8 @@ public:
  void SetType(const nsAString & aType, ErrorResult& rv);
  void SetMedia(const nsAString & aMedia, ErrorResult& rv);
  void SetTitle(const nsAString & aTitle, ErrorResult& rv);
+  bool Scoped() const;
+  void SetScoped(bool aScoped, ErrorResult& rv);

 protected:
  // Dummy init method to make the NS_IMPL_NS_NEW_SVG_ELEMENT and
@ -97,6 +99,7 @@ protected:
  void GetStyleSheetInfo(nsAString& aTitle,
                         nsAString& aType,
                         nsAString& aMedia,
+                         bool* aIsScoped,
                         bool* aIsAlternate);
  virtual CORSMode GetCORSMode() const;

--- a/content/svg/content/src/nsSVGViewElement.cpp
+++ b/content/svg/content/src/nsSVGViewElement.cpp
@ -3,24 +3,35 @@
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

-#include "nsSVGViewElement.h"
+#include "mozilla/dom/SVGViewElement.h"
+#include "mozilla/dom/SVGViewElementBinding.h"
 #include "DOMSVGStringList.h"

-using namespace mozilla;
-using namespace mozilla::dom;
+DOMCI_NODE_DATA(SVGViewElement, mozilla::dom::SVGViewElement)

-nsSVGElement::StringListInfo nsSVGViewElement::sStringListInfo[1] =
+NS_IMPL_NS_NEW_NAMESPACED_SVG_ELEMENT(View)
+
+namespace mozilla {
+namespace dom {
+
+JSObject*
+SVGViewElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+{
+  return SVGViewElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+}
+
+nsSVGElement::StringListInfo SVGViewElement::sStringListInfo[1] =
 {
  { &nsGkAtoms::viewTarget }
 };

-nsSVGEnumMapping nsSVGViewElement::sZoomAndPanMap[] = {
+nsSVGEnumMapping SVGViewElement::sZoomAndPanMap[] = {
  {&nsGkAtoms::disable, nsIDOMSVGZoomAndPan::SVG_ZOOMANDPAN_DISABLE},
  {&nsGkAtoms::magnify, nsIDOMSVGZoomAndPan::SVG_ZOOMANDPAN_MAGNIFY},
  {nullptr, 0}
 };

-nsSVGElement::EnumInfo nsSVGViewElement::sEnumInfo[1] =
+nsSVGElement::EnumInfo SVGViewElement::sEnumInfo[1] =
 {
  { &nsGkAtoms::zoomAndPan,
    sZoomAndPanMap,
@ -28,58 +39,62 @@ nsSVGElement::EnumInfo nsSVGViewElement::sEnumInfo[1] =
  }
 };

-NS_IMPL_NS_NEW_SVG_ELEMENT(View)
-
 //----------------------------------------------------------------------
 // nsISupports methods

-NS_IMPL_ADDREF_INHERITED(nsSVGViewElement,nsSVGViewElementBase)
-NS_IMPL_RELEASE_INHERITED(nsSVGViewElement,nsSVGViewElementBase)
+NS_IMPL_ADDREF_INHERITED(SVGViewElement,SVGViewElementBase)
+NS_IMPL_RELEASE_INHERITED(SVGViewElement,SVGViewElementBase)

-DOMCI_NODE_DATA(SVGViewElement, nsSVGViewElement)
-
-NS_INTERFACE_TABLE_HEAD(nsSVGViewElement)
-  NS_NODE_INTERFACE_TABLE6(nsSVGViewElement, nsIDOMNode, nsIDOMElement,
+NS_INTERFACE_TABLE_HEAD(SVGViewElement)
+  NS_NODE_INTERFACE_TABLE6(SVGViewElement, nsIDOMNode, nsIDOMElement,
                           nsIDOMSVGElement, nsIDOMSVGViewElement,
                           nsIDOMSVGFitToViewBox,
                           nsIDOMSVGZoomAndPan)
  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(SVGViewElement)
-NS_INTERFACE_MAP_END_INHERITING(nsSVGViewElementBase)
+NS_INTERFACE_MAP_END_INHERITING(SVGViewElementBase)

 //----------------------------------------------------------------------
 // Implementation

-nsSVGViewElement::nsSVGViewElement(already_AddRefed<nsINodeInfo> aNodeInfo)
-  : nsSVGViewElementBase(aNodeInfo)
+SVGViewElement::SVGViewElement(already_AddRefed<nsINodeInfo> aNodeInfo)
+  : SVGViewElementBase(aNodeInfo)
 {
 }

 //----------------------------------------------------------------------
 // nsIDOMNode methods

-NS_IMPL_ELEMENT_CLONE_WITH_INIT(nsSVGViewElement)
+NS_IMPL_ELEMENT_CLONE_WITH_INIT(SVGViewElement)

 //----------------------------------------------------------------------
 // nsIDOMSVGZoomAndPan methods

 /* attribute unsigned short zoomAndPan; */
 NS_IMETHODIMP
-nsSVGViewElement::GetZoomAndPan(uint16_t *aZoomAndPan)
+SVGViewElement::GetZoomAndPan(uint16_t *aZoomAndPan)
 {
-  *aZoomAndPan = mEnumAttributes[ZOOMANDPAN].GetAnimValue();
+  *aZoomAndPan = ZoomAndPan();
  return NS_OK;
 }

 NS_IMETHODIMP
-nsSVGViewElement::SetZoomAndPan(uint16_t aZoomAndPan)
+SVGViewElement::SetZoomAndPan(uint16_t aZoomAndPan)
+{
+  ErrorResult rv;
+  SetZoomAndPan(aZoomAndPan, rv);
+  return rv.ErrorCode();
+}
+
+void
+SVGViewElement::SetZoomAndPan(uint16_t aZoomAndPan, ErrorResult& rv)
 {
  if (aZoomAndPan == nsIDOMSVGZoomAndPan::SVG_ZOOMANDPAN_DISABLE ||
      aZoomAndPan == nsIDOMSVGZoomAndPan::SVG_ZOOMANDPAN_MAGNIFY) {
    mEnumAttributes[ZOOMANDPAN].SetBaseValue(aZoomAndPan, this);
-    return NS_OK;
+    return;
  }

-  return NS_ERROR_RANGE_ERR;
+  rv.Throw(NS_ERROR_RANGE_ERR);
 }

 //----------------------------------------------------------------------
@ -87,58 +102,82 @@ nsSVGViewElement::SetZoomAndPan(uint16_t aZoomAndPan)

 /* readonly attribute nsIDOMSVGAnimatedRect viewBox; */
 NS_IMETHODIMP
-nsSVGViewElement::GetViewBox(nsIDOMSVGAnimatedRect * *aViewBox)
+SVGViewElement::GetViewBox(nsIDOMSVGAnimatedRect * *aViewBox)
 {
-  return mViewBox.ToDOMAnimatedRect(aViewBox, this);
+  *aViewBox = ViewBox().get();
+  return NS_OK;
+}
+
+already_AddRefed<nsIDOMSVGAnimatedRect>
+SVGViewElement::ViewBox()
+{
+  nsCOMPtr<nsIDOMSVGAnimatedRect> box;
+  mViewBox.ToDOMAnimatedRect(getter_AddRefs(box), this);
+  return box.forget();
 }

 /* readonly attribute SVGPreserveAspectRatio preserveAspectRatio; */
 NS_IMETHODIMP
-nsSVGViewElement::GetPreserveAspectRatio(nsISupports
-                                         **aPreserveAspectRatio)
+SVGViewElement::GetPreserveAspectRatio(nsISupports
+                                       **aPreserveAspectRatio)
+{
+  *aPreserveAspectRatio = PreserveAspectRatio().get();
+  return NS_OK;
+}
+
+already_AddRefed<DOMSVGAnimatedPreserveAspectRatio>
+SVGViewElement::PreserveAspectRatio()
 {
  nsRefPtr<DOMSVGAnimatedPreserveAspectRatio> ratio;
  mPreserveAspectRatio.ToDOMAnimatedPreserveAspectRatio(getter_AddRefs(ratio), this);
-  ratio.forget(aPreserveAspectRatio);
-  return NS_OK;
+  return ratio.forget();
 }

 //----------------------------------------------------------------------
 // nsIDOMSVGViewElement methods

 /* readonly attribute nsIDOMSVGStringList viewTarget; */
-NS_IMETHODIMP nsSVGViewElement::GetViewTarget(nsIDOMSVGStringList * *aViewTarget)
+NS_IMETHODIMP SVGViewElement::GetViewTarget(nsIDOMSVGStringList * *aViewTarget)
 {
-  *aViewTarget = DOMSVGStringList::GetDOMWrapper(
-                   &mStringListAttributes[VIEW_TARGET], this, false, VIEW_TARGET).get();
+  *aViewTarget = ViewTarget().get();
  return NS_OK;
 }

+already_AddRefed<nsIDOMSVGStringList>
+SVGViewElement::ViewTarget()
+{
+  return DOMSVGStringList::GetDOMWrapper(
+           &mStringListAttributes[VIEW_TARGET], this, false, VIEW_TARGET);
+}
+
 //----------------------------------------------------------------------
 // nsSVGElement methods

 nsSVGElement::EnumAttributesInfo
-nsSVGViewElement::GetEnumInfo()
+SVGViewElement::GetEnumInfo()
 {
  return EnumAttributesInfo(mEnumAttributes, sEnumInfo,
                            ArrayLength(sEnumInfo));
 }

 nsSVGViewBox *
-nsSVGViewElement::GetViewBox()
+SVGViewElement::GetViewBox()
 {
  return &mViewBox;
 }

 SVGAnimatedPreserveAspectRatio *
-nsSVGViewElement::GetPreserveAspectRatio()
+SVGViewElement::GetPreserveAspectRatio()
 {
  return &mPreserveAspectRatio;
 }

 nsSVGElement::StringListAttributesInfo
-nsSVGViewElement::GetStringListInfo()
+SVGViewElement::GetStringListInfo()
 {
  return StringListAttributesInfo(mStringListAttributes, sStringListInfo,
                                  ArrayLength(sStringListInfo));
 }
+
+} // namespace dom
+} // namespace mozilla
--- a/content/svg/content/src/nsSVGViewElement.h
+++ b/content/svg/content/src/nsSVGViewElement.h
@ -3,8 +3,8 @@
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

-#ifndef __NS_SVGVIEWELEMENT_H__
-#define __NS_SVGVIEWELEMENT_H__
+#ifndef mozilla_dom_SVGViewElement_h
+#define mozilla_dom_SVGViewElement_h

 #include "nsIDOMSVGViewElement.h"
 #include "nsIDOMSVGFitToViewBox.h"
@ -15,27 +15,36 @@
 #include "SVGAnimatedPreserveAspectRatio.h"
 #include "SVGStringList.h"

+typedef nsSVGElement SVGViewElementBase;
+
+class nsSVGSVGElement;
+class nsSVGOuterSVGFrame;
+
+nsresult NS_NewSVGViewElement(nsIContent **aResult,
+                              already_AddRefed<nsINodeInfo> aNodeInfo);
+
 namespace mozilla {
-  class SVGFragmentIdentifier;
-}
+class SVGFragmentIdentifier;

-typedef nsSVGElement nsSVGViewElementBase;
+namespace dom {

-class nsSVGViewElement : public nsSVGViewElementBase,
-                         public nsIDOMSVGViewElement,
-                         public nsIDOMSVGFitToViewBox,
-                         public nsIDOMSVGZoomAndPan
+class SVGViewElement : public SVGViewElementBase,
+                       public nsIDOMSVGViewElement,
+                       public nsIDOMSVGFitToViewBox,
+                       public nsIDOMSVGZoomAndPan
 {
+protected:
  friend class mozilla::SVGFragmentIdentifier;
-  friend class nsSVGSVGElement;
-  friend class nsSVGOuterSVGFrame;
-  friend nsresult NS_NewSVGViewElement(nsIContent **aResult,
-                                       already_AddRefed<nsINodeInfo> aNodeInfo);
-  nsSVGViewElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  
+  friend class ::nsSVGSVGElement;
+  friend class ::nsSVGOuterSVGFrame;
+  SVGViewElement(already_AddRefed<nsINodeInfo> aNodeInfo);
+  friend nsresult (::NS_NewSVGViewElement(nsIContent **aResult,
+                                          already_AddRefed<nsINodeInfo> aNodeInfo));
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+
 public:
  // interfaces:
-  
+
  NS_DECL_ISUPPORTS_INHERITED
  NS_DECL_NSIDOMSVGVIEWELEMENT
  NS_DECL_NSIDOMSVGFITTOVIEWBOX
@ -45,13 +54,21 @@ public:
  // forward here :-(
  NS_FORWARD_NSIDOMNODE_TO_NSINODE
  NS_FORWARD_NSIDOMELEMENT_TO_GENERIC
-  NS_FORWARD_NSIDOMSVGELEMENT(nsSVGViewElementBase::)
+  NS_FORWARD_NSIDOMSVGELEMENT(SVGViewElementBase::)

  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;

  virtual nsXPCClassInfo* GetClassInfo();

  virtual nsIDOMNode* AsDOMNode() { return this; }
+
+  // WebIDL
+  uint16_t ZoomAndPan() { return mEnumAttributes[ZOOMANDPAN].GetAnimValue(); }
+  void SetZoomAndPan(uint16_t aZoomAndPan, ErrorResult& rv);
+  already_AddRefed<nsIDOMSVGAnimatedRect> ViewBox();
+  already_AddRefed<DOMSVGAnimatedPreserveAspectRatio> PreserveAspectRatio();
+  already_AddRefed<nsIDOMSVGStringList> ViewTarget();
+
 private:

  // nsSVGElement overrides
@ -76,4 +93,7 @@ private:
  static StringListInfo sStringListInfo[1];
 };

-#endif
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_SVGViewElement_h
--- a/content/svg/content/src/nsDOMSVGZoomEvent.cpp
+++ b/content/svg/content/src/nsDOMSVGZoomEvent.cpp
@ -7,7 +7,6 @@
 #include "nsSVGRect.h"
 #include "DOMSVGPoint.h"
 #include "nsSVGSVGElement.h"
-#include "nsIDOMSVGSVGElement.h"
 #include "nsIPresShell.h"
 #include "nsIDocument.h"
 #include "mozilla/dom/Element.h"
@ -44,15 +43,14 @@ nsDOMSVGZoomEvent::nsDOMSVGZoomEvent(nsPresContext* aPresContext,
    if (doc) {
      Element *rootElement = doc->GetRootElement();
      if (rootElement) {
-        // If the root element isn't an SVG 'svg' element this QI will fail
+        // If the root element isn't an SVG 'svg' element
        // (e.g. if this event was created by calling createEvent on a
-        // non-SVGDocument). In these circumstances the "New" and "Previous"
+        // non-SVGDocument), then the "New" and "Previous"
        // properties will be left null which is probably what we want.
-        nsCOMPtr<nsIDOMSVGSVGElement> svgElement = do_QueryInterface(rootElement);
-        if (svgElement) {
+        if (rootElement->IsSVG(nsGkAtoms::svg)) {
          nsSVGSVGElement *SVGSVGElement =
            static_cast<nsSVGSVGElement*>(rootElement);
-  
+
          mNewScale = SVGSVGElement->GetCurrentScale();
          mPreviousScale = SVGSVGElement->GetPreviousScale();

--- a/content/svg/content/src/nsSVGGradientElement.cpp
+++ b/content/svg/content/src/nsSVGGradientElement.cpp
@ -150,9 +150,8 @@ NS_IMPL_RELEASE_INHERITED(nsSVGLinearGradientElement,nsSVGLinearGradientElementB
 DOMCI_NODE_DATA(SVGLinearGradientElement, nsSVGLinearGradientElement)

 NS_INTERFACE_TABLE_HEAD(nsSVGLinearGradientElement)
-  NS_NODE_INTERFACE_TABLE6(nsSVGLinearGradientElement, nsIDOMNode,
+  NS_NODE_INTERFACE_TABLE5(nsSVGLinearGradientElement, nsIDOMNode,
                           nsIDOMElement, nsIDOMSVGElement,
-                           nsIDOMSVGTests,
                           nsIDOMSVGGradientElement,
                           nsIDOMSVGLinearGradientElement)
  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(SVGLinearGradientElement)
@ -240,9 +239,8 @@ NS_IMPL_RELEASE_INHERITED(nsSVGRadialGradientElement,nsSVGRadialGradientElementB
 DOMCI_NODE_DATA(SVGRadialGradientElement, nsSVGRadialGradientElement)

 NS_INTERFACE_TABLE_HEAD(nsSVGRadialGradientElement)
-  NS_NODE_INTERFACE_TABLE6(nsSVGRadialGradientElement, nsIDOMNode,
+  NS_NODE_INTERFACE_TABLE5(nsSVGRadialGradientElement, nsIDOMNode,
                           nsIDOMElement, nsIDOMSVGElement,
-                           nsIDOMSVGTests,
                           nsIDOMSVGGradientElement,
                           nsIDOMSVGRadialGradientElement)
  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(SVGRadialGradientElement)
--- a/content/svg/content/src/nsSVGGradientElement.h
+++ b/content/svg/content/src/nsSVGGradientElement.h
@ -8,7 +8,6 @@

 #include "nsIDOMSVGURIReference.h"
 #include "nsIDOMSVGGradientElement.h"
-#include "DOMSVGTests.h"
 #include "nsIDOMSVGUnitTypes.h"
 #include "nsSVGElement.h"
 #include "nsSVGLength2.h"
@ -21,7 +20,6 @@
 typedef nsSVGElement nsSVGGradientElementBase;

 class nsSVGGradientElement : public nsSVGGradientElementBase,
-                             public DOMSVGTests,
                             public nsIDOMSVGURIReference,
                             public nsIDOMSVGUnitTypes
 {
--- a/content/svg/content/src/nsSVGSVGElement.cpp
+++ b/content/svg/content/src/nsSVGSVGElement.cpp
@ -28,7 +28,7 @@
 #include "nsGUIEvent.h"
 #include "nsSVGSVGElement.h"
 #include "nsSVGUtils.h"
-#include "nsSVGViewElement.h"
+#include "mozilla/dom/SVGViewElement.h"
 #include "nsStyleUtil.h"
 #include "SVGContentUtils.h"

@ -608,11 +608,11 @@ nsSVGSVGElement::GetPreserveAspectRatio(nsISupports
 NS_IMETHODIMP
 nsSVGSVGElement::GetZoomAndPan(uint16_t *aZoomAndPan)
 {
-  nsSVGViewElement* viewElement = GetCurrentViewElement();
+  SVGViewElement* viewElement = GetCurrentViewElement();
  if (viewElement && viewElement->mEnumAttributes[
-                       nsSVGViewElement::ZOOMANDPAN].IsExplicitlySet()) {
+                       SVGViewElement::ZOOMANDPAN].IsExplicitlySet()) {
    *aZoomAndPan = viewElement->mEnumAttributes[
-                     nsSVGViewElement::ZOOMANDPAN].GetAnimValue();
+                     SVGViewElement::ZOOMANDPAN].GetAnimValue();
  } else {
    *aZoomAndPan = mEnumAttributes[ZOOMANDPAN].GetAnimValue();
  }
@ -974,7 +974,7 @@ nsSVGSVGElement::HasPreserveAspectRatio()
    mPreserveAspectRatio.IsAnimated();
 }

-nsSVGViewElement*
+SVGViewElement*
 nsSVGSVGElement::GetCurrentViewElement() const
 {
  if (mCurrentViewID) {
@ -982,7 +982,7 @@ nsSVGSVGElement::GetCurrentViewElement() const
    if (doc) {
      Element *element = doc->GetElementById(*mCurrentViewID);
      if (element && element->IsSVG(nsGkAtoms::view)) {
-        return static_cast<nsSVGViewElement*>(element);
+        return static_cast<SVGViewElement*>(element);
      }
    }
  }
@ -994,7 +994,7 @@ nsSVGSVGElement::GetViewBoxWithSynthesis(
  float aViewportWidth, float aViewportHeight) const
 {
  // The logic here should match HasViewBox().
-  nsSVGViewElement* viewElement = GetCurrentViewElement();
+  SVGViewElement* viewElement = GetCurrentViewElement();
  if (viewElement && viewElement->mViewBox.IsExplicitlySet()) {
    return viewElement->mViewBox.GetAnimValue();
  }
@ -1029,7 +1029,7 @@ nsSVGSVGElement::GetPreserveAspectRatioWithOverride() const
    }
  }

-  nsSVGViewElement* viewElement = GetCurrentViewElement();
+  SVGViewElement* viewElement = GetCurrentViewElement();

  // This check is equivalent to "!HasViewBox() && ShouldSynthesizeViewBox()".
  // We're just holding onto the viewElement that HasViewBox() would look up,
@ -1055,7 +1055,7 @@ nsSVGSVGElement::GetLength(uint8_t aCtxType)
 {
  float h, w;

-  nsSVGViewElement* viewElement = GetCurrentViewElement();
+  SVGViewElement* viewElement = GetCurrentViewElement();
  const nsSVGViewBoxRect* viewbox = nullptr;

  // The logic here should match HasViewBox().
@ -1177,7 +1177,7 @@ nsSVGSVGElement::GetPreserveAspectRatio()
 bool
 nsSVGSVGElement::HasViewBox() const
 {
-  nsSVGViewElement* viewElement = GetCurrentViewElement();
+  SVGViewElement* viewElement = GetCurrentViewElement();
  if (viewElement && viewElement->mViewBox.IsExplicitlySet()) {
    return true;
  }
--- a/content/svg/content/src/nsSVGSVGElement.h
+++ b/content/svg/content/src/nsSVGSVGElement.h
@ -21,10 +21,13 @@
 #include "mozilla/Attributes.h"

 class nsSMILTimeContainer;
-class nsSVGViewElement;
 namespace mozilla {
  class DOMSVGMatrix;
  class SVGFragmentIdentifier;
+
+  namespace dom {
+    class SVGViewElement;
+  }
 }

 typedef mozilla::dom::SVGGraphicsElement nsSVGSVGElementBase;
@ -261,7 +264,7 @@ private:

  // implementation helpers:

-  nsSVGViewElement* GetCurrentViewElement() const;
+  mozilla::dom::SVGViewElement* GetCurrentViewElement() const;

  // Methods for <image> elements to override my "PreserveAspectRatio" value.
  // These are private so that only our friends (nsSVGImageFrame in
--- a/content/svg/content/test/Makefile.in
+++ b/content/svg/content/test/Makefile.in
@ -51,6 +51,7 @@ MOCHITEST_FILES = \
 		test_pointer-events.xhtml \
 		test_pointer-events-2.xhtml \
 		test_pointer-events-3.xhtml \
+		test_pointer-events-4.xhtml \
 		test_scientific.html \
 		scientific-helper.svg \
 		test_SVGAnimatedImageSMILDisabled.html \
--- a/Показать больше
+++ b/Показать больше