diff --git a/accessible/src/base/AccIterator.cpp b/accessible/src/base/AccIterator.cpp
index 1629f20d9a56..23ace181c87e 100644
--- a/accessible/src/base/AccIterator.cpp
+++ b/accessible/src/base/AccIterator.cpp
@@ -37,10 +37,12 @@
 
 #include "AccIterator.h"
 
+#include "nsAccessibilityService.h"
 #include "nsAccessible.h"
 
 ////////////////////////////////////////////////////////////////////////////////
-// nsAccIterator
+// AccIterator
+////////////////////////////////////////////////////////////////////////////////
 
 AccIterator::AccIterator(nsAccessible *aAccessible,
                          filters::FilterFuncPtr aFilterFunc,
@@ -93,3 +95,45 @@ AccIterator::IteratorState::IteratorState(nsAccessible *aParent,
   mParent(aParent), mIndex(0), mParentState(mParentState)
 {
 }
+
+
+////////////////////////////////////////////////////////////////////////////////
+// RelatedAccIterator
+////////////////////////////////////////////////////////////////////////////////
+
+RelatedAccIterator::
+  RelatedAccIterator(nsDocAccessible* aDocument, nsIContent* aDependentContent,
+                     nsIAtom* aRelAttr) :
+  mRelAttr(aRelAttr), mProviders(nsnull), mBindingParent(nsnull), mIndex(0)
+{
+  mBindingParent = aDependentContent->GetBindingParent();
+  nsIAtom* IDAttr = mBindingParent ?
+    nsAccessibilityAtoms::anonid : aDependentContent->GetIDAttributeName();
+
+  nsAutoString id;
+  if (aDependentContent->GetAttr(kNameSpaceID_None, IDAttr, id))
+    mProviders = aDocument->mDependentIDsHash.Get(id);
+}
+
+nsAccessible*
+RelatedAccIterator::Next()
+{
+  if (!mProviders)
+    return nsnull;
+
+  while (mIndex < mProviders->Length()) {
+    nsDocAccessible::AttrRelProvider* provider = (*mProviders)[mIndex++];
+
+    // Return related accessible for the given attribute and if the provider
+    // content is in the same binding in the case of XBL usage.
+    if (provider->mRelAttr == mRelAttr &&
+        (!mBindingParent ||
+         mBindingParent == provider->mContent->GetBindingParent())) {
+      nsAccessible* related = GetAccService()->GetAccessible(provider->mContent);
+      if (related)
+        return related;
+    }
+  }
+
+  return nsnull;
+}
diff --git a/accessible/src/base/AccIterator.h b/accessible/src/base/AccIterator.h
index 6c07b62f7e67..a78aefd7da92 100644
--- a/accessible/src/base/AccIterator.h
+++ b/accessible/src/base/AccIterator.h
@@ -40,6 +40,7 @@
 
 #include "filters.h"
 #include "nscore.h"
+#include "nsDocAccessible.h"
 
 /**
  * Allows to iterate through accessible children or subtree complying with
@@ -93,4 +94,41 @@ private:
   IteratorState *mState;
 };
 
+
+/**
+ * Allows to traverse through related accessibles that are pointing to the given
+ * dependent accessible by relation attribute.
+ */
+class RelatedAccIterator
+{
+public:
+  /**
+   * Constructor.
+   *
+   * @param aDocument         [in] the document accessible the related
+   * &                         accessibles belong to.
+   * @param aDependentContent [in] the content of dependent accessible that
+   *                           relations were requested for
+   * @param aRelAttr          [in] relation attribute that relations are
+   *                           pointed by
+   */
+  RelatedAccIterator(nsDocAccessible* aDocument, nsIContent* aDependentContent,
+                     nsIAtom* aRelAttr);
+
+  /**
+   * Return next related accessible for the given dependent accessible.
+   */
+  nsAccessible* Next();
+
+private:
+  RelatedAccIterator();
+  RelatedAccIterator(const RelatedAccIterator&);
+  RelatedAccIterator& operator = (const RelatedAccIterator&);
+
+  nsIAtom* mRelAttr;
+  nsDocAccessible::AttrRelProviderArray* mProviders;
+  nsIContent* mBindingParent;
+  PRUint32 mIndex;
+};
+
 #endif
diff --git a/accessible/src/base/nsAccessibilityService.cpp b/accessible/src/base/nsAccessibilityService.cpp
index 1cc59b595dbd..65b9a62e2474 100644
--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -844,15 +844,11 @@ static PRBool HasRelatedContent(nsIContent *aContent)
     return PR_FALSE;
   }
 
-  nsIAtom *relationAttrs[] = {nsAccessibilityAtoms::aria_labelledby,
-                              nsAccessibilityAtoms::aria_describedby,
-                              nsAccessibilityAtoms::aria_owns,
-                              nsAccessibilityAtoms::aria_controls,
-                              nsAccessibilityAtoms::aria_flowto};
-  if (nsCoreUtils::FindNeighbourPointingToNode(aContent, relationAttrs,
-                                               NS_ARRAY_LENGTH(relationAttrs))) {
+  // If the given ID is referred by relation attribute then create an accessible
+  // for it. Take care of HTML elements only for now.
+  if (aContent->IsHTML() &&
+      nsAccUtils::GetDocAccessibleFor(aContent)->IsDependentID(id))
     return PR_TRUE;
-  }
 
   nsIContent *ancestorContent = aContent;
   while ((ancestorContent = ancestorContent->GetParent()) != nsnull) {
diff --git a/accessible/src/base/nsAccessible.cpp b/accessible/src/base/nsAccessible.cpp
index e0e0753bdb2f..37c6b25d8007 100644
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@@ -2037,25 +2037,28 @@ nsAccessible::GetRelationByType(PRUint32 aRelationType,
 
   // Relationships are defined on the same content node that the role would be
   // defined on.
-  nsresult rv;
+  nsresult rv = NS_OK_NO_RELATION_TARGET;
   switch (aRelationType)
   {
   case nsIAccessibleRelation::RELATION_LABEL_FOR:
     {
+      RelatedAccIterator iter(GetDocAccessible(), mContent,
+                              nsAccessibilityAtoms::aria_labelledby);
+
+      nsAccessible* related = nsnull;
+      while ((related = iter.Next())) {
+        rv = nsRelUtils::AddTarget(aRelationType, aRelation, related);
+        NS_ENSURE_SUCCESS(rv, rv);
+      }
+
       if (mContent->Tag() == nsAccessibilityAtoms::label) {
         nsIAtom *IDAttr = mContent->IsHTML() ?
           nsAccessibilityAtoms::_for : nsAccessibilityAtoms::control;
         rv = nsRelUtils::
           AddTargetFromIDRefAttr(aRelationType, aRelation, mContent, IDAttr);
         NS_ENSURE_SUCCESS(rv, rv);
-
-        if (rv != NS_OK_NO_RELATION_TARGET)
-          return NS_OK; // XXX bug 381599, avoid performance problems
       }
-
-      return nsRelUtils::
-        AddTargetFromNeighbour(aRelationType, aRelation, mContent,
-                               nsAccessibilityAtoms::aria_labelledby);
+      return rv;
     }
 
   case nsIAccessibleRelation::RELATION_LABELLED_BY:
@@ -2091,13 +2094,14 @@ nsAccessible::GetRelationByType(PRUint32 aRelationType,
 
   case nsIAccessibleRelation::RELATION_DESCRIPTION_FOR:
     {
-      rv = nsRelUtils::
-        AddTargetFromNeighbour(aRelationType, aRelation, mContent,
-                               nsAccessibilityAtoms::aria_describedby);
-      NS_ENSURE_SUCCESS(rv, rv);
+      RelatedAccIterator iter(GetDocAccessible(), mContent,
+                              nsAccessibilityAtoms::aria_describedby);
 
-      if (rv != NS_OK_NO_RELATION_TARGET)
-        return NS_OK; // XXX bug 381599, avoid performance problems
+      nsAccessible* related = nsnull;
+      while ((related = iter.Next())) {
+        rv = nsRelUtils::AddTarget(aRelationType, aRelation, related);
+        NS_ENSURE_SUCCESS(rv, rv);
+      }
 
       if (mContent->Tag() == nsAccessibilityAtoms::description &&
           mContent->IsXUL()) {
@@ -2109,18 +2113,23 @@ nsAccessible::GetRelationByType(PRUint32 aRelationType,
                                  nsAccessibilityAtoms::control);
       }
 
-      return NS_OK;
+      return rv;
     }
 
   case nsIAccessibleRelation::RELATION_NODE_CHILD_OF:
     {
-      rv = nsRelUtils::
-        AddTargetFromNeighbour(aRelationType, aRelation, mContent,
-                               nsAccessibilityAtoms::aria_owns);
-      NS_ENSURE_SUCCESS(rv, rv);
+      RelatedAccIterator iter(GetDocAccessible(), mContent,
+                              nsAccessibilityAtoms::aria_owns);
 
+      nsAccessible* related = nsnull;
+      while ((related = iter.Next())) {
+        rv = nsRelUtils::AddTarget(aRelationType, aRelation, related);
+        NS_ENSURE_SUCCESS(rv, rv);
+      }
+
+      // Got relation from aria-owns, don't calculate it from native markup.
       if (rv != NS_OK_NO_RELATION_TARGET)
-        return NS_OK; // XXX bug 381599, avoid performance problems
+        return NS_OK;
 
       // This is an ARIA tree or treegrid that doesn't use owns, so we need to
       // get the parent the hard way.
@@ -2153,14 +2162,20 @@ nsAccessible::GetRelationByType(PRUint32 aRelationType,
         }
       }
 
-      return NS_OK;
+      return rv;
     }
 
   case nsIAccessibleRelation::RELATION_CONTROLLED_BY:
     {
-      return nsRelUtils::
-        AddTargetFromNeighbour(aRelationType, aRelation, mContent,
-                               nsAccessibilityAtoms::aria_controls);
+      RelatedAccIterator iter(GetDocAccessible(), mContent,
+                              nsAccessibilityAtoms::aria_controls);
+
+      nsAccessible* related = nsnull;
+      while ((related = iter.Next())) {
+        rv = nsRelUtils::AddTarget(aRelationType, aRelation, related);
+        NS_ENSURE_SUCCESS(rv, rv);
+      }
+      return rv;
     }
 
   case nsIAccessibleRelation::RELATION_CONTROLLER_FOR:
@@ -2188,9 +2203,15 @@ nsAccessible::GetRelationByType(PRUint32 aRelationType,
 
   case nsIAccessibleRelation::RELATION_FLOWS_FROM:
     {
-      return nsRelUtils::
-        AddTargetFromNeighbour(aRelationType, aRelation, mContent,
-                               nsAccessibilityAtoms::aria_flowto);
+      RelatedAccIterator iter(GetDocAccessible(), mContent,
+                              nsAccessibilityAtoms::aria_flowto);
+
+      nsAccessible* related = nsnull;
+      while ((related = iter.Next())) {
+        rv = nsRelUtils::AddTarget(aRelationType, aRelation, related);
+        NS_ENSURE_SUCCESS(rv, rv);
+      }
+      return rv;
     }
 
   case nsIAccessibleRelation::RELATION_DEFAULT_BUTTON:
@@ -3169,8 +3190,17 @@ nsAccessible::EnsureChildren()
 
   // State is embedded children until text leaf accessible is appended.
   mChildrenFlags = eEmbeddedChildren; // Prevent reentry
+
+  // Notify the document about caching status.
+  nsDocAccessible* document = GetDocAccessible();
+  if (document)
+    document->NotifyOfCachingStart(this);
+
   CacheChildren();
 
+  if (document)
+    document->NotifyOfCachingEnd(this);
+
   return PR_FALSE;
 }
 
diff --git a/accessible/src/base/nsAccessible.h b/accessible/src/base/nsAccessible.h
index a01fbe3b7ef0..bd4b0b0bb2f4 100644
--- a/accessible/src/base/nsAccessible.h
+++ b/accessible/src/base/nsAccessible.h
@@ -51,7 +51,6 @@
 #include "nsStringGlue.h"
 #include "nsTArray.h"
 #include "nsRefPtrHashtable.h"
-#include "nsDataHashtable.h"
 
 class AccGroupInfo;
 class EmbeddedObjCollector;
@@ -67,8 +66,6 @@ class nsIView;
 
 typedef nsRefPtrHashtable<nsVoidPtrHashKey, nsAccessible>
   nsAccessibleHashtable;
-typedef nsDataHashtable<nsPtrHashKey<const nsINode>, nsAccessible*>
-  NodeToAccessibleMap;
 
 // see nsAccessible::GetAttrValue
 #define NS_OK_NO_ARIA_VALUE \
diff --git a/accessible/src/base/nsCoreUtils.cpp b/accessible/src/base/nsCoreUtils.cpp
index dfe601b56ba3..50c0142f8277 100644
--- a/accessible/src/base/nsCoreUtils.cpp
+++ b/accessible/src/base/nsCoreUtils.cpp
@@ -47,7 +47,6 @@
 #include "nsIDOM3Node.h"
 #include "nsIDOMDocument.h"
 #include "nsIDOMDocumentView.h"
-#include "nsIDOMDocumentXBL.h"
 #include "nsIDOMHTMLDocument.h"
 #include "nsIDOMHTMLElement.h"
 #include "nsIDOMNodeList.h"
@@ -805,67 +804,6 @@ nsCoreUtils::GetLanguageFor(nsIContent *aContent, nsIContent *aRootContent,
     walkUp = walkUp->GetParent();
 }
 
-void
-nsCoreUtils::GetElementsByIDRefsAttr(nsIContent *aContent, nsIAtom *aAttr,
-                                     nsIArray **aRefElements)
-{
-  *aRefElements = nsnull;
-
-  nsAutoString ids;
-  if (!aContent->GetAttr(kNameSpaceID_None, aAttr, ids))
-    return;
-
-  ids.CompressWhitespace(PR_TRUE, PR_TRUE);
-
-  nsCOMPtr<nsIDOMDocument> document = do_QueryInterface(aContent->GetOwnerDoc());
-  NS_ASSERTION(document, "The given node is not in document!");
-  if (!document)
-    return;
-
-  nsCOMPtr<nsIDOMDocumentXBL> xblDocument;
-  if (aContent->IsInAnonymousSubtree())
-    xblDocument = do_QueryInterface(document);
-
-  nsCOMPtr<nsIMutableArray> refElms = do_CreateInstance(NS_ARRAY_CONTRACTID);
-
-  while (!ids.IsEmpty()) {
-    nsAutoString id;
-    PRInt32 idLength = ids.FindChar(' ');
-    NS_ASSERTION(idLength != 0,
-                 "Should not be 0 because of CompressWhitespace() call above");
-
-    if (idLength == kNotFound) {
-      id = ids;
-      ids.Truncate();
-    } else {
-      id = Substring(ids, 0, idLength);
-      ids.Cut(0, idLength + 1);
-    }
-
-    // If content is anonymous subtree then use "anonid" attribute to get
-    // elements, otherwise search elements in DOM by ID attribute.
-    nsCOMPtr<nsIDOMElement> refElement;
-    if (xblDocument) {
-      nsCOMPtr<nsIDOMElement> elm =
-        do_QueryInterface(aContent->GetBindingParent());
-      xblDocument->GetAnonymousElementByAttribute(elm,
-                                                  NS_LITERAL_STRING("anonid"),
-                                                  id,
-                                                  getter_AddRefs(refElement));
-    } else {
-      document->GetElementById(id, getter_AddRefs(refElement));
-    }
-
-    if (!refElement)
-      continue;
-
-    refElms->AppendElement(refElement, PR_FALSE);
-  }
-
-  NS_ADDREF(*aRefElements = refElms);
-  return;
-}
-
 void
 nsCoreUtils::GetElementsHavingIDRefsAttr(nsIContent *aRootContent,
                                          nsIContent *aContent,
@@ -1165,3 +1103,78 @@ nsAccessibleDOMStringList::Contains(const nsAString& aString, PRBool *aResult)
 
   return NS_OK;
 }
+
+
+////////////////////////////////////////////////////////////////////////////////
+// IDRefsIterator
+////////////////////////////////////////////////////////////////////////////////
+
+IDRefsIterator::IDRefsIterator(nsIContent* aContent, nsIAtom* aIDRefsAttr) :
+  mCurrIdx(0)
+{
+  if (!aContent->IsInDoc() ||
+      !aContent->GetAttr(kNameSpaceID_None, aIDRefsAttr, mIDs))
+    return;
+
+  if (aContent->IsInAnonymousSubtree()) {
+    mXBLDocument = do_QueryInterface(aContent->GetOwnerDoc());
+    mBindingParent = do_QueryInterface(aContent->GetBindingParent());
+  } else {
+    mDocument = aContent->GetOwnerDoc();
+  }
+}
+
+const nsDependentSubstring
+IDRefsIterator::NextID()
+{
+  for (; mCurrIdx < mIDs.Length(); mCurrIdx++) {
+    if (!NS_IsAsciiWhitespace(mIDs[mCurrIdx]))
+      break;
+  }
+
+  if (mCurrIdx >= mIDs.Length())
+    return nsDependentSubstring();
+
+  nsAString::index_type idStartIdx = mCurrIdx;
+  while (++mCurrIdx < mIDs.Length()) {
+    if (NS_IsAsciiWhitespace(mIDs[mCurrIdx]))
+      break;
+  }
+
+  return Substring(mIDs, idStartIdx, mCurrIdx++ - idStartIdx);
+}
+
+nsIContent*
+IDRefsIterator::NextElem()
+{
+  while (true) {
+    const nsDependentSubstring id = NextID();
+    if (id.IsEmpty())
+      break;
+
+    nsIContent* refContent = GetElem(id);
+    if (refContent)
+      return refContent;
+  }
+
+  return nsnull;
+}
+
+nsIContent*
+IDRefsIterator::GetElem(const nsDependentSubstring& aID)
+{
+  if (mXBLDocument) {
+    // If content is anonymous subtree then use "anonid" attribute to get
+    // elements, otherwise search elements in DOM by ID attribute.
+
+    nsCOMPtr<nsIDOMElement> refElm;
+    mXBLDocument->GetAnonymousElementByAttribute(mBindingParent,
+                                                 NS_LITERAL_STRING("anonid"),
+                                                 aID,
+                                                 getter_AddRefs(refElm));
+    nsCOMPtr<nsIContent> refContent = do_QueryInterface(refElm);
+    return refContent;
+  }
+
+  return mDocument->GetElementById(aID);
+}
diff --git a/accessible/src/base/nsCoreUtils.h b/accessible/src/base/nsCoreUtils.h
index 22ed47970401..cf6cb01d98a9 100644
--- a/accessible/src/base/nsCoreUtils.h
+++ b/accessible/src/base/nsCoreUtils.h
@@ -41,6 +41,7 @@
 
 #include "nsAccessibilityAtoms.h"
 
+#include "nsIDOMDocumentXBL.h"
 #include "nsIDOMNode.h"
 #include "nsIContent.h"
 #include "nsIBoxObject.h"
@@ -304,17 +305,6 @@ public:
   static void GetLanguageFor(nsIContent *aContent, nsIContent *aRootContent,
                              nsAString& aLanguage);
 
-  /**
-   * Return the array of elements the given node is referred to by its
-   * IDRefs attribute.
-   *
-   * @param aContent     [in] the given node
-   * @param aAttr        [in] IDRefs attribute on the given node
-   * @param aRefElements [out] result array of elements
-   */
-  static void GetElementsByIDRefsAttr(nsIContent *aContent, nsIAtom *aAttr,
-                                      nsIArray **aRefElements);
-
   /**
    * Return the array of elements having IDRefs that points to the given node.
    *
@@ -515,5 +505,39 @@ private:
   nsTArray<nsString> mNames;
 };
 
+/**
+ * Used to iterate through IDs or elements pointed by IDRefs attribute. Note,
+ * any method used to iterate through IDs or elements moves iterator to next
+ * position.
+ */
+class IDRefsIterator
+{
+public:
+  IDRefsIterator(nsIContent* aContent, nsIAtom* aIDRefsAttr);
+
+  /**
+   * Return next ID.
+   */
+  const nsDependentSubstring NextID();
+
+  /**
+   * Return next element.
+   */
+  nsIContent* NextElem();
+
+  /**
+   * Return the element with the given ID.
+   */
+  nsIContent* GetElem(const nsDependentSubstring& aID);
+
+private:
+  nsString mIDs;
+  nsAString::index_type mCurrIdx;
+
+  nsIDocument* mDocument;
+  nsCOMPtr<nsIDOMDocumentXBL> mXBLDocument;
+  nsCOMPtr<nsIDOMElement> mBindingParent;
+};
+
 #endif
 
diff --git a/accessible/src/base/nsDocAccessible.cpp b/accessible/src/base/nsDocAccessible.cpp
index 3016e0e9d34e..0917e9276cbe 100644
--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@@ -85,6 +85,16 @@ namespace dom = mozilla::dom;
 
 PRUint32 nsDocAccessible::gLastFocusedAccessiblesState = 0;
 
+static nsIAtom** kRelationAttrs[] =
+{
+  &nsAccessibilityAtoms::aria_labelledby,
+  &nsAccessibilityAtoms::aria_describedby,
+  &nsAccessibilityAtoms::aria_owns,
+  &nsAccessibilityAtoms::aria_controls,
+  &nsAccessibilityAtoms::aria_flowto
+};
+
+static const PRUint32 kRelationAttrsLen = NS_ARRAY_LENGTH(kRelationAttrs);
 
 ////////////////////////////////////////////////////////////////////////////////
 // Constructor/desctructor
@@ -93,8 +103,10 @@ nsDocAccessible::
   nsDocAccessible(nsIDocument *aDocument, nsIContent *aRootContent,
                   nsIWeakReference *aShell) :
   nsHyperTextAccessibleWrap(aRootContent, aShell),
-  mDocument(aDocument), mScrollPositionChangedTicks(0), mIsLoaded(PR_FALSE)
+  mDocument(aDocument), mScrollPositionChangedTicks(0), mIsLoaded(PR_FALSE),
+  mCacheRoot(nsnull), mIsPostCacheProcessing(PR_FALSE)
 {
+  mDependentIDsHash.Init();
   // XXX aaronl should we use an algorithm for the initial cache size?
   mAccessibleCache.Init(kDefaultCacheSize);
   mNodeToAccessibleMap.Init(kDefaultCacheSize);
@@ -134,6 +146,7 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsDocAccessible, nsAccessible)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mEventQueue)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSTARRAY(mChildDocuments)
+  tmp->mDependentIDsHash.Clear();
   tmp->mNodeToAccessibleMap.Clear();
   ClearCache(tmp->mAccessibleCache);
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
@@ -155,8 +168,7 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(nsDocAccessible)
     // However at some point we may push <body> to implement the interfaces and
     // return nsDocAccessible to inherit from nsAccessibleWrap.
 
-    nsCOMPtr<nsIDOMXULDocument> xulDoc(do_QueryInterface(mDocument));
-    if (xulDoc)
+    if (mDocument && mDocument->IsXUL())
       status = nsAccessible::QueryInterface(aIID, (void**)&foundInterface);
     else
       status = nsHyperTextAccessible::QueryInterface(aIID,
@@ -664,6 +676,7 @@ nsDocAccessible::Shutdown()
 
   mWeakShell = nsnull;  // Avoid reentrancy
 
+  mDependentIDsHash.Clear();
   mNodeToAccessibleMap.Clear();
   ClearCache(mAccessibleCache);
 
@@ -929,10 +942,19 @@ nsDocAccessible::AttributeWillChange(nsIDocument *aDocument,
                                      PRInt32 aNameSpaceID,
                                      nsIAtom* aAttribute, PRInt32 aModType)
 {
-  // XXX TODO: bugs 381599 467143 472142 472143
+  // XXX TODO: bugs 381599 (partially fixed by 573469), 467143, 472142, 472143.
   // Here we will want to cache whatever state we are potentially interested in,
   // such as the existence of aria-pressed for button (so we know if we need to
   // newly expose it as a toggle button) etc.
+
+  // Update dependent IDs cache.
+  if (aModType == nsIDOMMutationEvent::MODIFICATION ||
+      aModType == nsIDOMMutationEvent::REMOVAL) {
+    nsAccessible* accessible =
+      GetAccService()->GetAccessibleInWeakShell(aElement, mWeakShell);
+    if (accessible)
+      RemoveDependentIDsFor(accessible, aAttribute);
+  }
 }
 
 void
@@ -943,6 +965,16 @@ nsDocAccessible::AttributeChanged(nsIDocument *aDocument,
 {
   AttributeChangedImpl(aElement, aNameSpaceID, aAttribute);
 
+  // Update dependent IDs cache.
+  if (aModType == nsIDOMMutationEvent::MODIFICATION ||
+      aModType == nsIDOMMutationEvent::ADDITION) {
+    nsAccessible* accessible =
+      GetAccService()->GetAccessibleInWeakShell(aElement, mWeakShell);
+
+    if (accessible)
+      AddDependentIDsFor(accessible, aAttribute);
+  }
+
   // If it was the focused node, cache the new state
   if (aElement == gLastFocusedNode) {
     nsAccessible *focusedAccessible = GetAccService()->GetAccessible(aElement);
@@ -1362,6 +1394,7 @@ nsDocAccessible::BindToDocument(nsAccessible* aAccessible,
   }
 
   aAccessible->SetRoleMapEntry(aRoleMapEntry);
+  AddDependentIDsFor(aAccessible);
   return true;
 }
 
@@ -1373,6 +1406,8 @@ nsDocAccessible::UnbindFromDocument(nsAccessible* aAccessible)
       mNodeToAccessibleMap.Get(aAccessible->GetNode()) == aAccessible)
     mNodeToAccessibleMap.Remove(aAccessible->GetNode());
 
+  RemoveDependentIDsFor(aAccessible);
+
 #ifdef DEBUG
   NS_ASSERTION(mAccessibleCache.GetWeak(aAccessible->UniqueID()),
                "Unbinding the unbound accessible!");
@@ -1554,9 +1589,130 @@ nsDocAccessible::RecreateAccessible(nsINode* aNode)
   }
 }
 
+void
+nsDocAccessible::NotifyOfCachingStart(nsAccessible* aAccessible)
+{
+  if (!mCacheRoot)
+    mCacheRoot = aAccessible;
+}
+
+void
+nsDocAccessible::NotifyOfCachingEnd(nsAccessible* aAccessible)
+{
+  if (mCacheRoot == aAccessible && !mIsPostCacheProcessing) {
+    // Allow invalidation list insertions while container children are recached.
+    mIsPostCacheProcessing = PR_TRUE;
+
+    // Invalidate children of container accessible for each element in
+    // invalidation list.
+    for (PRUint32 idx = 0; idx < mInvalidationList.Length(); idx++) {
+      nsIContent* content = mInvalidationList[idx];
+      nsAccessible* container =
+        GetAccService()->GetCachedContainerAccessible(content);
+      container->InvalidateChildren();
+
+      // Make sure we keep children updated. While we're inside of caching loop
+      // then we must exist it with cached children.
+      container->EnsureChildren();
+    }
+    mInvalidationList.Clear();
+
+    mCacheRoot = nsnull;
+    mIsPostCacheProcessing = PR_FALSE;
+  }
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 // Protected members
 
+void
+nsDocAccessible::AddDependentIDsFor(nsAccessible* aRelProvider,
+                                    nsIAtom* aRelAttr)
+{
+  for (PRUint32 idx = 0; idx < kRelationAttrsLen; idx++) {
+    nsIAtom* relAttr = *kRelationAttrs[idx];
+    if (aRelAttr && aRelAttr != relAttr)
+      continue;
+
+    IDRefsIterator iter(aRelProvider->GetContent(), relAttr);
+    while (true) {
+      const nsDependentSubstring id = iter.NextID();
+      if (id.IsEmpty())
+        break;
+
+      AttrRelProviderArray* providers = mDependentIDsHash.Get(id);
+      if (!providers) {
+        providers = new AttrRelProviderArray();
+        if (providers) {
+          if (!mDependentIDsHash.Put(id, providers)) {
+            delete providers;
+            providers = nsnull;
+          }
+        }
+      }
+
+      if (providers) {
+        AttrRelProvider* provider =
+          new AttrRelProvider(relAttr, aRelProvider->GetContent());
+        if (provider) {
+          providers->AppendElement(provider);
+
+          // We've got here during the children caching. If the referenced
+          // content is not accessible then store it to pend its container
+          // children invalidation (this happens immediately after the caching
+          // is finished).
+          nsIContent* dependentContent = iter.GetElem(id);
+          if (dependentContent && !GetCachedAccessible(dependentContent)) {
+            mInvalidationList.AppendElement(dependentContent);
+          }
+        }
+      }
+    }
+
+    // If the relation attribute is given then we don't have anything else to
+    // check.
+    if (aRelAttr)
+      break;
+  }
+}
+
+void
+nsDocAccessible::RemoveDependentIDsFor(nsAccessible* aRelProvider,
+                                       nsIAtom* aRelAttr)
+{
+  for (PRUint32 idx = 0; idx < kRelationAttrsLen; idx++) {
+    nsIAtom* relAttr = *kRelationAttrs[idx];
+    if (aRelAttr && aRelAttr != *kRelationAttrs[idx])
+      continue;
+
+    IDRefsIterator iter(aRelProvider->GetContent(), relAttr);
+    while (true) {
+      const nsDependentSubstring id = iter.NextID();
+      if (id.IsEmpty())
+        break;
+
+      AttrRelProviderArray* providers = mDependentIDsHash.Get(id);
+      if (providers) {
+        for (PRUint32 jdx = 0; jdx < providers->Length(); ) {
+          AttrRelProvider* provider = (*providers)[jdx];
+          if (provider->mRelAttr == relAttr &&
+              provider->mContent == aRelProvider->GetContent())
+            providers->RemoveElement(provider);
+          else
+            jdx++;
+        }
+        if (providers->Length() == 0)
+          mDependentIDsHash.Remove(id);
+      }
+    }
+
+    // If the relation attribute is given then we don't have anything else to
+    // check.
+    if (aRelAttr)
+      break;
+  }
+}
+
 void
 nsDocAccessible::FireValueChangeForTextFields(nsAccessible *aAccessible)
 {
diff --git a/accessible/src/base/nsDocAccessible.h b/accessible/src/base/nsDocAccessible.h
index 7ea913d3687c..8a30c339ab94 100644
--- a/accessible/src/base/nsDocAccessible.h
+++ b/accessible/src/base/nsDocAccessible.h
@@ -44,6 +44,8 @@
 #include "nsHyperTextAccessibleWrap.h"
 #include "nsEventShell.h"
 
+#include "nsClassHashtable.h"
+#include "nsDataHashtable.h"
 #include "nsIDocument.h"
 #include "nsIDocumentObserver.h"
 #include "nsIEditor.h"
@@ -210,6 +212,16 @@ public:
    */
   nsAccessible* GetCachedAccessibleByUniqueIDInSubtree(void* aUniqueID);
 
+  /**
+   * Return true if the given ID is referred by relation attribute.
+   *
+   * @note Different elements may share the same ID if they are hosted inside
+   *       XBL bindings. Be careful the result of this method may be  senseless
+   *       while it's called for XUL elements (where XBL is used widely).
+   */
+  PRBool IsDependentID(const nsAString& aID) const
+    { return mDependentIDsHash.Get(aID, nsnull); }
+
   /**
    * Initialize the newly created accessible and put it into document caches.
    *
@@ -241,6 +253,17 @@ public:
    */
   void RecreateAccessible(nsINode* aNode);
 
+  /**
+   * Used to notify the document that the accessible caching is started or
+   * finished.
+   *
+   * While children are cached we may encounter the case there's no accessible
+   * for referred content by related accessible. Keep the caching root and
+   * these related nodes to invalidate their containers after root caching.
+   */
+  void NotifyOfCachingStart(nsAccessible* aAccessible);
+  void NotifyOfCachingEnd(nsAccessible* aAccessible);
+
 protected:
 
     virtual void GetBoundsRect(nsRect& aRect, nsIFrame** aRelativeFrame);
@@ -267,6 +290,28 @@ protected:
     mChildDocuments.RemoveElement(aChildDocument);
   }
 
+  /**
+   * Add dependent IDs pointed by accessible element by relation attribute to
+   * cache. If the relation attribute is missed then all relation attributes
+   * are checked.
+   *
+   * @param aRelProvider [in] accessible that element has relation attribute
+   * @param aRelAttr     [in, optional] relation attribute
+   */
+  void AddDependentIDsFor(nsAccessible* aRelProvider,
+                          nsIAtom* aRelAttr = nsnull);
+
+  /**
+   * Remove dependent IDs pointed by accessible element by relation attribute
+   * from cache. If the relation attribute is absent then all relation
+   * attributes are checked.
+   *
+   * @param aRelProvider [in] accessible that element has relation attribute
+   * @param aRelAttr     [in, optional] relation attribute
+   */
+  void RemoveDependentIDsFor(nsAccessible* aRelProvider,
+                             nsIAtom* aRelAttr = nsnull);
+
     static void ScrollTimerCallback(nsITimer *aTimer, void *aClosure);
 
     /**
@@ -299,14 +344,6 @@ protected:
                                     CharacterDataChangeInfo* aInfo,
                                     PRBool aIsInserted);
 
-  /**
-   * Used to define should the event be fired on a delay.
-   */
-  enum EEventFiringType {
-    eNormalEvent,
-    eDelayedEvent
-  };
-
   /**
    * Fire a value change event for the the given accessible if it is a text
    * field (has a ROLE_ENTRY).
@@ -347,7 +384,8 @@ protected:
    * Cache of accessibles within this document accessible.
    */
   nsAccessibleHashtable mAccessibleCache;
-  NodeToAccessibleMap mNodeToAccessibleMap;
+  nsDataHashtable<nsPtrHashKey<const nsINode>, nsAccessible*>
+    mNodeToAccessibleMap;
 
     nsCOMPtr<nsIDocument> mDocument;
     nsCOMPtr<nsITimer> mScrollWatchTimer;
@@ -366,9 +404,46 @@ protected:
     static nsIAtom *gLastFocusedFrameType;
 
   nsTArray<nsRefPtr<nsDocAccessible> > mChildDocuments;
+
+  /**
+   * A storage class for pairing content with one of its relation attributes.
+   */
+  class AttrRelProvider
+  {
+  public:
+    AttrRelProvider(nsIAtom* aRelAttr, nsIContent* aContent) :
+      mRelAttr(aRelAttr), mContent(aContent) { }
+
+    nsIAtom* mRelAttr;
+    nsIContent* mContent;
+
+  private:
+    AttrRelProvider();
+    AttrRelProvider(const AttrRelProvider&);
+    AttrRelProvider& operator =(const AttrRelProvider&);
+  };
+
+  /**
+   * The cache of IDs pointed by relation attributes.
+   */
+  typedef nsTArray<nsAutoPtr<AttrRelProvider> > AttrRelProviderArray;
+  nsClassHashtable<nsStringHashKey, AttrRelProviderArray> mDependentIDsHash;
+
+  friend class RelatedAccIterator;
+
+  /**
+   * Used for our caching algorithm. We store the root of the tree that needs
+   * caching, the list of nodes that should be invalidated, and whether we are
+   * processing the invalidation list.
+   *
+   * @see NotifyOfCachingStart/NotifyOfCachingEnd
+   */
+  nsAccessible* mCacheRoot;
+  nsTArray<nsIContent*> mInvalidationList;
+  PRBool mIsPostCacheProcessing;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsDocAccessible,
                               NS_DOCACCESSIBLE_IMPL_CID)
 
-#endif  
+#endif
diff --git a/accessible/src/base/nsRelUtils.cpp b/accessible/src/base/nsRelUtils.cpp
index f272c4ded59f..7ca8a258f9e4 100644
--- a/accessible/src/base/nsRelUtils.cpp
+++ b/accessible/src/base/nsRelUtils.cpp
@@ -134,27 +134,16 @@ nsRelUtils::AddTargetFromIDRefsAttr(PRUint32 aRelationType,
                                     nsIAccessibleRelation **aRelation,
                                     nsIContent *aContent, nsIAtom *aAttr)
 {
-  nsCOMPtr<nsIArray> refElms;
-  nsCoreUtils::GetElementsByIDRefsAttr(aContent, aAttr, getter_AddRefs(refElms));
+  nsresult rv = NS_OK_NO_RELATION_TARGET;
 
-  if (!refElms)
-    return NS_OK_NO_RELATION_TARGET;
-
-  PRUint32 count = 0;
-  nsresult rv = refElms->GetLength(&count);
-  if (NS_FAILED(rv) || count == 0)
-    return NS_OK_NO_RELATION_TARGET;
-
-  nsCOMPtr<nsIContent> content;
-  for (PRUint32 idx = 0; idx < count; idx++) {
-    content = do_QueryElementAt(refElms, idx, &rv);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    rv = AddTargetFromContent(aRelationType, aRelation, content);
+  nsIContent* refElm = nsnull;
+  IDRefsIterator iter(aContent, aAttr);
+  while ((refElm = iter.NextElem())) {
+    rv = AddTargetFromContent(aRelationType, aRelation, refElm);
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
-  return NS_OK;
+  return rv;
 }
 
 nsresult
diff --git a/accessible/src/base/nsTextEquivUtils.cpp b/accessible/src/base/nsTextEquivUtils.cpp
index 0abdb8073c48..48dcc15f7266 100644
--- a/accessible/src/base/nsTextEquivUtils.cpp
+++ b/accessible/src/base/nsTextEquivUtils.cpp
@@ -92,26 +92,14 @@ nsTextEquivUtils::GetTextEquivFromIDRefs(nsAccessible *aAccessible,
   if (!content)
     return NS_OK;
 
-  nsCOMPtr<nsIArray> refElms;
-  nsCoreUtils::GetElementsByIDRefsAttr(content, aIDRefsAttr,
-                                       getter_AddRefs(refElms));
-
-  if (!refElms)
-    return NS_OK;
-
-  PRUint32 count = 0;
-  nsresult rv = refElms->GetLength(&count);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  nsCOMPtr<nsIContent> refContent;
-  for (PRUint32 idx = 0; idx < count; idx++) {
-    refContent = do_QueryElementAt(refElms, idx, &rv);
-    NS_ENSURE_SUCCESS(rv, rv);
-
+  nsIContent* refContent = nsnull;
+  IDRefsIterator iter(content, aIDRefsAttr);
+  while ((refContent = iter.NextElem())) {
     if (!aTextEquiv.IsEmpty())
       aTextEquiv += ' ';
 
-    rv = AppendTextEquivFromContent(aAccessible, refContent, &aTextEquiv);
+    nsresult rv = AppendTextEquivFromContent(aAccessible, refContent,
+                                             &aTextEquiv);
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
diff --git a/accessible/src/html/nsHTMLTableAccessible.cpp b/accessible/src/html/nsHTMLTableAccessible.cpp
index a72dbc63fa66..50d1da285bad 100644
--- a/accessible/src/html/nsHTMLTableAccessible.cpp
+++ b/accessible/src/html/nsHTMLTableAccessible.cpp
@@ -308,34 +308,27 @@ nsHTMLTableCellAccessible::GetHeaderCells(PRInt32 aRowOrColumnHeaderCell,
                                           nsIArray **aHeaderCells)
 {
   // Get header cells from @header attribute.
-  nsCOMPtr<nsIArray> headerCellElms;
-  nsCoreUtils::GetElementsByIDRefsAttr(mContent, nsAccessibilityAtoms::headers,
-                                       getter_AddRefs(headerCellElms));
-
-  if (headerCellElms) {
+  IDRefsIterator iter(mContent, nsAccessibilityAtoms::headers);
+  nsIContent* headerCellElm = iter.NextElem();
+  if (headerCellElm) {
     nsresult rv = NS_OK;
     nsCOMPtr<nsIMutableArray> headerCells =
       do_CreateInstance(NS_ARRAY_CONTRACTID, &rv);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    PRUint32 count = 0;
-    rv = headerCellElms->GetLength(&count);
-    if (NS_SUCCEEDED(rv) && count > 0) {
-      nsCOMPtr<nsIContent> headerCellContent;
-      for (PRUint32 idx = 0; idx < count; idx++) {
-        headerCellContent = do_QueryElementAt(headerCellElms, idx, &rv);
-        nsAccessible *headerCell =
-          GetAccService()->GetAccessibleInWeakShell(headerCellContent, mWeakShell);
+    do {
+      nsAccessible* headerCell =
+        GetAccService()->GetAccessibleInWeakShell(headerCellElm, mWeakShell);
 
-        if (headerCell &&
-            (aRowOrColumnHeaderCell == nsAccUtils::eRowHeaderCells &&
-             headerCell->Role() == nsIAccessibleRole::ROLE_ROWHEADER ||
-             aRowOrColumnHeaderCell == nsAccUtils::eColumnHeaderCells &&
-             headerCell->Role() == nsIAccessibleRole::ROLE_COLUMNHEADER))
-          headerCells->AppendElement(static_cast<nsIAccessible*>(headerCell),
-                                     PR_FALSE);
+      if (headerCell &&
+          (aRowOrColumnHeaderCell == nsAccUtils::eRowHeaderCells &&
+              headerCell->Role() == nsIAccessibleRole::ROLE_ROWHEADER ||
+              aRowOrColumnHeaderCell == nsAccUtils::eColumnHeaderCells &&
+              headerCell->Role() == nsIAccessibleRole::ROLE_COLUMNHEADER)) {
+        headerCells->AppendElement(static_cast<nsIAccessible*>(headerCell),
+                                   PR_FALSE);
       }
-    }
+    } while ((headerCellElm = iter.NextElem()));
 
     NS_ADDREF(*aHeaderCells = headerCells);
     return NS_OK;
diff --git a/accessible/tests/mochitest/relations/Makefile.in b/accessible/tests/mochitest/relations/Makefile.in
index 813f7b6a4632..de3d64cf206e 100644
--- a/accessible/tests/mochitest/relations/Makefile.in
+++ b/accessible/tests/mochitest/relations/Makefile.in
@@ -50,6 +50,7 @@ _TEST_FILES =\
 		test_general.xul \
 		test_tabbrowser.xul \
 		test_tree.xul \
+		test_update.html \
 		$(NULL)
 
 libs:: $(_TEST_FILES)
diff --git a/accessible/tests/mochitest/relations/test_general.html b/accessible/tests/mochitest/relations/test_general.html
index 5a62fc7c8a46..a8fd692c698a 100644
--- a/accessible/tests/mochitest/relations/test_general.html
+++ b/accessible/tests/mochitest/relations/test_general.html
@@ -65,6 +65,9 @@
       testRelation(iframeDocAcc, RELATION_NODE_CHILD_OF, iframeAcc);
 
       // aria-controls
+      getAccessible("tab");
+      todo(false,
+           "Getting an accessible tab, otherwise relations for tabpanel aren't cached. Bug 606924 will fix that.");
       testRelation("tabpanel", RELATION_CONTROLLED_BY, "tab");
       testRelation("tab", RELATION_CONTROLLER_FOR, "tabpanel");
 
diff --git a/accessible/tests/mochitest/relations/test_general.xul b/accessible/tests/mochitest/relations/test_general.xul
index 35ab6fd1c81e..6a689adc2476 100644
--- a/accessible/tests/mochitest/relations/test_general.xul
+++ b/accessible/tests/mochitest/relations/test_general.xul
@@ -66,6 +66,9 @@
       testRelation(iframeDocAcc, RELATION_NODE_CHILD_OF, iframeAcc);
 
       // aria-controls
+      getAccessible("tab");
+      todo(false,
+           "Getting an accessible tab, otherwise relations for tabpanel aren't cached. Bug 606924 will fix that.");
       testRelation("tabpanel", RELATION_CONTROLLED_BY, "tab");
       testRelation("tab", RELATION_CONTROLLER_FOR, "tabpanel");
 
diff --git a/accessible/tests/mochitest/relations/test_update.html b/accessible/tests/mochitest/relations/test_update.html
new file mode 100644
index 000000000000..99dcd6055b6e
--- /dev/null
+++ b/accessible/tests/mochitest/relations/test_update.html
@@ -0,0 +1,162 @@
+<html>
+
+<head>
+  <title>Test updating of accessible relations</title>
+  <link rel="stylesheet" type="text/css"
+        href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+
+  <script type="application/javascript"
+          src="chrome://mochikit/content/MochiKit/packed.js"></script>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+
+  <script type="application/javascript"
+          src="../common.js"></script>
+  <script type="application/javascript"
+          src="../relations.js"></script>
+  <script type="application/javascript"
+          src="../role.js"></script>
+  <script type="application/javascript"
+          src="../events.js"></script>
+
+  <script type="application/javascript">
+    function testRelated(aRelAttr, aHostRelation, aDependentRelation)
+    {
+      // no attribute
+      testRelation("dependent1", aDependentRelation, null);
+      testRelation("dependent2", aDependentRelation, null);
+      if (aHostRelation)
+        testRelation("host", aHostRelation, null);
+
+      // set attribute
+      getNode("host").setAttribute(aRelAttr, "dependent1");
+      testRelation("dependent1", aDependentRelation, "host");
+      testRelation("dependent2", aDependentRelation, null);
+      if (aHostRelation)
+        testRelation("host", aHostRelation, "dependent1");
+
+      // change attribute
+      getNode("host").setAttribute(aRelAttr, "dependent2");
+      testRelation("dependent1", aDependentRelation, null);
+      testRelation("dependent2", aDependentRelation, "host");
+      if (aHostRelation)
+        testRelation("host", aHostRelation, "dependent2");
+
+      // remove attribute
+      getNode("host").removeAttribute(aRelAttr);
+      testRelation("dependent1", aDependentRelation, null);
+      testRelation("dependent2", aDependentRelation, null);
+      if (aHostRelation)
+        testRelation("host", aHostRelation, null);
+    }
+
+    function insertRelated(aHostRelAttr, aDependentID, aInsertHostFirst,
+                           aHostRelation, aDependentRelation)
+    {
+      this.eventSeq = [
+        new invokerChecker(EVENT_REORDER, document)
+      ];
+
+      this.invoke = function insertRelated_invoke()
+      {
+        this.hostNode = document.createElement("div");
+        this.hostNode.setAttribute(aHostRelAttr, aDependentID);
+
+        this.dependentNode = document.createElement("div");
+        this.dependentNode.setAttribute("id", aDependentID);
+
+        if (aInsertHostFirst) {
+          document.body.appendChild(this.hostNode);
+          document.body.appendChild(this.dependentNode);
+        } else {
+          document.body.appendChild(this.dependentNode);
+          document.body.appendChild(this.hostNode);
+        }
+      }
+
+      this.finalCheck = function insertRelated_finalCheck()
+      {
+        testRelation(this.dependentNode, aDependentRelation, this.hostNode);
+        if (aHostRelation)
+          testRelation(this.hostNode, aHostRelation, this.dependentNode);
+      }
+
+      this.getID = function insertRelated_getID()
+      {
+        return "Insert " + aHostRelAttr + "='" + aDependentID + "' node" +
+          (aInsertHostFirst ? " before" : "after") + " dependent node";
+      }
+    }
+
+    var gQueue = null;
+
+    function doTest()
+    {
+      // Relation updates on ARIA attribute changes.
+      testRelated("aria-labelledby", RELATION_LABELLED_BY, RELATION_LABEL_FOR);
+      testRelated("aria-describedby",
+                  RELATION_DESCRIBED_BY, RELATION_DESCRIPTION_FOR);
+      testRelated("aria-owns", null, RELATION_NODE_CHILD_OF);
+      testRelated("aria-controls",
+                  RELATION_CONTROLLER_FOR, RELATION_CONTROLLED_BY);
+      testRelated("aria-flowto", RELATION_FLOWS_TO, RELATION_FLOWS_FROM);
+
+      // Insert related accessibles into tree.
+      gQueue = new eventQueue();
+      gQueue.push(new insertRelated("aria-labelledby", "dependent3", true,
+                                    RELATION_LABELLED_BY, RELATION_LABEL_FOR));
+      gQueue.push(new insertRelated("aria-labelledby", "dependent4", false,
+                                    RELATION_LABELLED_BY, RELATION_LABEL_FOR));
+
+      gQueue.push(new insertRelated("aria-describedby", "dependent5", true,
+                                    RELATION_DESCRIBED_BY,
+                                    RELATION_DESCRIPTION_FOR));
+      gQueue.push(new insertRelated("aria-describedby", "dependent6", false,
+                                    RELATION_DESCRIBED_BY,
+                                    RELATION_DESCRIPTION_FOR));
+
+      gQueue.push(new insertRelated("aria-owns", "dependent7", true,
+                                    null, RELATION_NODE_CHILD_OF));
+      gQueue.push(new insertRelated("aria-owns", "dependent8", false,
+                                    null, RELATION_NODE_CHILD_OF));
+
+      gQueue.push(new insertRelated("aria-controls", "dependent9", true,
+                                    RELATION_CONTROLLER_FOR,
+                                    RELATION_CONTROLLED_BY));
+      gQueue.push(new insertRelated("aria-controls", "dependent10", false,
+                                    RELATION_CONTROLLER_FOR,
+                                    RELATION_CONTROLLED_BY));
+
+      gQueue.push(new insertRelated("aria-flowto", "dependent11", true,
+                                    RELATION_FLOWS_TO, RELATION_FLOWS_FROM));
+      gQueue.push(new insertRelated("aria-flowto", "dependent12", false,
+                                    RELATION_FLOWS_TO, RELATION_FLOWS_FROM));
+
+      gQueue.invoke(); // will call SimpleTest.finish()
+
+    }
+
+    SimpleTest.waitForExplicitFinish();
+    addA11yLoadEvent(doTest);
+  </script>
+
+</head>
+
+<body>
+
+  <a target="_blank"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=573469"
+     title="Cache relations defined by ARIA attributes">
+    Mozilla Bug 573469
+  </a>
+  <p id="display"></p>
+  <div id="content" style="display: none"></div>
+  <pre id="test">
+  </pre>
+
+  <div id="dependent1">label</div>
+  <div id="dependent2">label2</div>
+  <div role="checkbox" id="host"></div>
+
+</body>
+</html>
diff --git a/browser/base/content/browser.css b/browser/base/content/browser.css
index 59dbb84cebab..750221984f27 100644
--- a/browser/base/content/browser.css
+++ b/browser/base/content/browser.css
@@ -166,35 +166,46 @@ html|*.urlbar-input {
 
 /* over-link in location bar */
 
-.urlbar-over-link-layer[overlinkstate="fade-in"],
-.urlbar-textbox-container:not([overlinkstate]) {
-  -moz-transition-property: color;
-  -moz-transition-duration: 150ms;
-  -moz-transition-timing-function: cubic-bezier(0.0, 0.6, 1.0, 1.0);
-}
-
 .urlbar-textbox-container[overlinkstate="fade-in"],
-.urlbar-over-link-layer:not([overlinkstate]) {
+.urlbar-over-link-layer[overlinkstate="fade-out"] {
   -moz-transition-property: color;
   -moz-transition-duration: 150ms;
-  -moz-transition-timing-function: linear;
   color: transparent;
 }
 
-.urlbar-over-link-box[overlinkstate="fade-in"],
-.urlbar-textbox-container-children:not([overlinkstate]) {
+.urlbar-over-link-layer[overlinkstate="fade-in"],
+.urlbar-textbox-container[overlinkstate="fade-out"] {
+  -moz-transition-property: color;
+  -moz-transition-duration: 150ms;
+  -moz-transition-timing-function: cubic-bezier(0.0, 1.0, 1.0, 1.0);
+}
+
+.urlbar-over-link-box[overlinkstate="fade-in"] {
   -moz-transition-property: opacity;
   -moz-transition-duration: 150ms;
   opacity: 1;
 }
 
-.urlbar-textbox-container-children[overlinkstate="fade-in"],
-.urlbar-over-link-box:not([overlinkstate]) {
+.urlbar-over-link-box[overlinkstate="fade-out"] {
+  -moz-transition-property: opacity;
+  -moz-transition-duration: 150ms;
+  -moz-transition-timing-function: cubic-bezier(0.0, 1.0, 1.0, 1.0);
+  opacity: 0;
+}
+
+.urlbar-textbox-container-children[overlinkstate="fade-in"] {
   -moz-transition-property: opacity;
   -moz-transition-duration: 150ms;
   opacity: 0;
 }
 
+.urlbar-textbox-container-children[overlinkstate="fade-out"] {
+  -moz-transition-property: opacity;
+  -moz-transition-duration: 150ms;
+  -moz-transition-timing-function: cubic-bezier(0.0, 1.0, 1.0, 1.0);
+  opacity: 1;
+}
+
 .urlbar-textbox-container[overlinkstate="showing"] {
   color: transparent;
 }
@@ -207,6 +218,14 @@ html|*.urlbar-input {
   opacity: 0;
 }
 
+.urlbar-over-link-layer:not([overlinkstate]) {
+  color: transparent;
+}
+
+.urlbar-over-link-box:not([overlinkstate]) {
+  opacity: 0;
+}
+
 /* For results that are actions, their description text is shown instead of
    the URL - this needs to follow the locale's direction, unlike URLs. */
 richlistitem[type~="action"]:-moz-locale-dir(rtl) > .ac-url-box {
diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index 5f5fc5825b24..9cabf1b4912a 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -3994,14 +3994,16 @@ var XULBrowserWindow = {
     this.defaultStatus = status;
   },
 
-  setOverLink: function (link) {
-    // Encode bidirectional formatting characters.
-    // (RFC 3987 sections 3.2 and 4.1 paragraph 6)
-    link = link.replace(/[\u200e\u200f\u202a\u202b\u202c\u202d\u202e]/g,
+  setOverLink: function (url, anchorElt) {
+    if (gURLBar) {
+      // Encode bidirectional formatting characters.
+      // (RFC 3987 sections 3.2 and 4.1 paragraph 6)
+      url = url.replace(/[\u200e\u200f\u202a\u202b\u202c\u202d\u202e]/g,
                         encodeURIComponent);
-    gURLBar.setOverLink(link);
+      gURLBar.setOverLink(url);
+    }
   },
-  
+
   // Called before links are navigated to to allow us to retarget them if needed.
   onBeforeLinkTraversal: function(originalTarget, linkURI, linkNode, isAppTab) {
     // Don't modify non-default targets or targets that aren't in top-level app
@@ -4198,7 +4200,9 @@ var XULBrowserWindow = {
     else
       this.isImage.setAttribute('disabled', 'true');
 
+    this.hideOverLinkImmediately = true;
     this.setOverLink("", null);
+    this.hideOverLinkImmediately = false;
 
     // We should probably not do this if the value has changed since the user
     // searched
diff --git a/browser/base/content/browser.xul b/browser/base/content/browser.xul
index 910cbf89c3d4..cd2add419c91 100644
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -444,10 +444,12 @@
       </button>
     </hbox>
     <spacer id="titlebar-spacer" flex="1"/>
-    <hbox id="titlebar-buttonbox" align="start">
-      <toolbarbutton class="titlebar-button" id="titlebar-min" oncommand="window.minimize();"/>
-      <toolbarbutton class="titlebar-button" id="titlebar-max" oncommand="onTitlebarMaxClick();"/>
-      <toolbarbutton class="titlebar-button" id="titlebar-close" command="cmd_closeWindow"/>
+    <hbox id="titlebar-buttonbox-container" align="start">
+      <hbox id="titlebar-buttonbox">
+        <toolbarbutton class="titlebar-button" id="titlebar-min" oncommand="window.minimize();"/>
+        <toolbarbutton class="titlebar-button" id="titlebar-max" oncommand="onTitlebarMaxClick();"/>
+        <toolbarbutton class="titlebar-button" id="titlebar-close" command="cmd_closeWindow"/>
+      </hbox>
     </hbox>
   </hbox>
 </vbox>
diff --git a/browser/base/content/tabview/drag.js b/browser/base/content/tabview/drag.js
index 8b47fdf8e147..b6fad5b684c2 100644
--- a/browser/base/content/tabview/drag.js
+++ b/browser/base/content/tabview/drag.js
@@ -43,9 +43,17 @@
 // The Drag that's currently in process.
 var drag = {
   info: null,
-  zIndex: 100
+  zIndex: 100,
+  lastMoveTime: 0
 };
 
+//----------
+//Variable: resize
+//The resize (actually a Drag) that is currently in process
+var resize = {
+  info: null,
+  lastMoveTime: 0
+};
 
 // ##########
 // Class: Drag (formerly DragInfo)
diff --git a/browser/base/content/tabview/groupitems.js b/browser/base/content/tabview/groupitems.js
index ce351527928f..838cd5a6a7aa 100644
--- a/browser/base/content/tabview/groupitems.js
+++ b/browser/base/content/tabview/groupitems.js
@@ -564,17 +564,25 @@ GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
     this._sendToSubscribers("close");
     this.removeTrenches();
 
-    iQ(this.container).animate({
-      opacity: 0,
-      "-moz-transform": "scale(.3)",
-    }, {
-      duration: 170,
-      complete: function() {
-        iQ(this).remove();
-        Items.unsquish();
-      }
-    });
-
+    if (this.hidden) {
+      iQ(this.container).remove();
+      if (this.$undoContainer) {
+        this.$undoContainer.remove();
+        this.$undoContainer = null;
+       }
+      Items.unsquish();
+    } else {
+      iQ(this.container).animate({
+        opacity: 0,
+        "-moz-transform": "scale(.3)",
+      }, {
+        duration: 170,
+        complete: function() {
+          iQ(this).remove();
+          Items.unsquish();
+        }
+      });
+    }
     this.deleteData();
   },
 
@@ -607,10 +615,107 @@ GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
     UI.setActiveTab( UI.getClosestTab(closeCenter) );
   },
 
+  // ----------
+  // Function: _unhide
+  // Shows the hidden group.
+  _unhide: function GroupItem__unhide() {
+    let self = this;
+
+    this._cancelFadeAwayUndoButtonTimer();
+    this.hidden = false;
+    this.$undoContainer.remove();
+    this.$undoContainer = null;
+
+    iQ(this.container).show().animate({
+      "-moz-transform": "scale(1)",
+      "opacity": 1
+    }, {
+      duration: 170,
+      complete: function() {
+        self._children.forEach(function(child) {
+          iQ(child.container).show();
+        });
+      }
+    });
+
+    self._sendToSubscribers("groupShown", { groupItemId: self.id });
+  },
+
+  // ----------
+  // Function: closeHidden
+  // Removes the group item, its children and its container.
+  closeHidden: function GroupItem_closeHidden() {
+    let self = this;
+
+    this._cancelFadeAwayUndoButtonTimer();
+
+    // when "TabClose" event is fired, the browser tab is about to close and our 
+    // item "close" event is fired.  And then, the browser tab gets closed. 
+    // In other words, the group "close" event is fired before all browser
+    // tabs in the group are closed.  The below code would fire the group "close"
+    // event only after all browser tabs in that group are closed.
+    let shouldRemoveTabItems = [];
+    let toClose = this._children.concat();
+    toClose.forEach(function(child) {
+      child.removeSubscriber(self, "close");
+
+      let removed = child.close();
+      if (removed) {
+        shouldRemoveTabItems.push(child);
+      } else {
+        // child.removeSubscriber() must be called before child.close(), 
+        // therefore we call child.addSubscriber() if the tab is not removed.
+        child.addSubscriber(self, "close", function() {
+          self.remove(child);
+        });
+      }
+    });
+
+    if (shouldRemoveTabItems.length != toClose.length) {
+      // remove children without the assiciated tab and show the group item
+      shouldRemoveTabItems.forEach(function(child) {
+        self.remove(child, { dontArrange: true });
+      });
+
+      this.$undoContainer.fadeOut(function() { self._unhide() });
+    } else {
+      this.close();
+    }
+  },
+
+  // ----------
+  // Function: _fadeAwayUndoButton
+  // Fades away the undo button
+  _fadeAwayUndoButton: function GroupItem__fadeAwayUdoButton() {
+    let self = this;
+
+    if (this.$undoContainer) {
+      // if there is one or more orphan tabs or there is more than one group 
+      // and other groupS are not empty, fade away the undo button.
+      let shouldFadeAway = GroupItems.getOrphanedTabs().length > 0;
+      
+      if (!shouldFadeAway && GroupItems.groupItems.length > 1) {
+        shouldFadeAway = 
+          GroupItems.groupItems.some(function(groupItem) {
+            return (groupItem != self && groupItem.getChildren().length > 0);
+          });
+      }
+      if (shouldFadeAway) {
+        self.$undoContainer.animate({
+          color: "transparent",
+          opacity: 0
+        }, {
+          duration: this._fadeAwayUndoButtonDuration,
+          complete: function() { self.closeHidden(); }
+        });
+      }
+    }
+  },
+
   // ----------
   // Function: _createUndoButton
   // Makes the affordance for undo a close group action
-  _createUndoButton: function() {
+  _createUndoButton: function GroupItem__createUndoButton() {
     let self = this;
     this.$undoContainer = iQ("<div/>")
       .addClass("undo")
@@ -629,6 +734,7 @@ GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
     });
     this.hidden = true;
 
+    // hide group item and show undo container.
     setTimeout(function() {
       self.$undoContainer.animate({
         "-moz-transform": "scale(1)",
@@ -642,36 +748,17 @@ GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
       });
     }, 50);
 
+    // add click handlers
     this.$undoContainer.click(function(e) {
       // Only do this for clicks on this actual element.
       if (e.target.nodeName != self.$undoContainer[0].nodeName)
         return;
 
-      self.$undoContainer.fadeOut(function() {
-        iQ(this).remove();
-        self.hidden = false;
-        self._cancelFadeAwayUndoButtonTimer();
-        self.$undoContainer = null;
-
-        iQ(self.container).show().animate({
-          "-moz-transform": "scale(1)",
-          "opacity": 1
-        }, {
-          duration: 170,
-          complete: function() {
-            self._children.forEach(function(child) {
-              iQ(child.container).show();
-            });
-          }
-        });
-
-        self._sendToSubscribers("groupShown", { groupItemId: self.id });
-      });
+      self.$undoContainer.fadeOut(function() { self._unhide(); });
     });
 
     undoClose.click(function() {
-      self._cancelFadeAwayUndoButtonTimer();
-      self.$undoContainer.fadeOut(function() { self._removeHiddenGroupItem(); });
+      self.$undoContainer.fadeOut(function() { self.closeHidden(); });
     });
 
     this.setupFadeAwayUndoButtonTimer();
@@ -704,60 +791,6 @@ GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
     this._undoButtonTimeoutId = null;
   }, 
 
-  // ----------
-  // Fades away the undo button
-  _fadeAwayUndoButton: function() {
-    let self = this;
-
-    if (this.$undoContainer) {
-      // if there is one or more orphan tabs or there is more than one group 
-      // and other groupS are not empty, fade away the undo button.
-      let shouldFadeAway = GroupItems.getOrphanedTabs().length > 0;
-      
-      if (!shouldFadeAway && GroupItems.groupItems.length > 1) {
-        shouldFadeAway = 
-          GroupItems.groupItems.some(function(groupItem) {
-            return (groupItem != self && groupItem.getChildren().length > 0);
-          });
-      }
-      if (shouldFadeAway) {
-        self.$undoContainer.animate({
-          color: "transparent",
-          opacity: 0
-        }, {
-          duration: this.fadeAwayUndoButtonDuration,
-          complete: function() { self._removeHiddenGroupItem(); }
-        });
-      }
-    }
-  },
-
-  // ----------
-  // Removes the group item, its children and its container.
-  _removeHiddenGroupItem: function() {
-    let self = this;
-
-    // close all children
-    let toClose = this._children.concat();
-    toClose.forEach(function(child) {
-      child.removeSubscriber(self, "close");
-      child.close();
-    });
- 
-    // remove all children
-    this.removeAll();
-    GroupItems.unregister(this);
-    this._sendToSubscribers("close");
-    this.removeTrenches();
-
-    iQ(this.container).remove();
-    this.$undoContainer.remove();
-    this.$undoContainer = null;
-    Items.unsquish();
-
-    this.deleteData();
-  },
-
   // ----------
   // Function: add
   // Adds an item to the groupItem.
@@ -1047,6 +1080,10 @@ GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
   // Parameters:
   //   options - passed to <Items.arrange> or <_stackArrange>
   arrange: function GroupItem_arrange(options) {
+    if (GroupItems._arrangePaused) {
+      GroupItems.pushArrange(this, options);
+      return;
+    }
     if (this.expanded) {
       this.topChild = null;
       var box = new Rect(this.expanded.bounds);
@@ -1490,6 +1527,9 @@ let GroupItems = {
   _activeGroupItem: null,
   _activeOrphanTab: null,
   _cleanupFunctions: [],
+  _arrangePaused: false,
+  _arrangesPending: [],
+  _removingHiddenGroups: false,
 
   // ----------
   // Function: init
@@ -1521,6 +1561,51 @@ let GroupItems = {
     this.groupItems = null;
   },
 
+  // ----------
+  // Function: pauseArrange
+  // Bypass arrange() calls and collect for resolution in
+  // resumeArrange()
+  pauseArrange: function GroupItems_pauseArrange() {
+    Utils.assert(this._arrangePaused == false, 
+      "pauseArrange has been called while already paused");
+    Utils.assert(this._arrangesPending.length == 0, 
+      "There are bypassed arrange() calls that haven't been resolved");
+    this._arrangePaused = true;
+  },
+
+  // ----------
+  // Function: pushArrange
+  // Push an arrange() call and its arguments onto an array
+  // to be resolved in resumeArrange()
+  pushArrange: function GroupItems_pushArrange(groupItem, options) {
+    Utils.assert(this._arrangePaused, 
+      "Ensure pushArrange() called while arrange()s aren't paused"); 
+    let i;
+    for (i = 0; i < this._arrangesPending.length; i++)
+      if (this._arrangesPending[i].groupItem === groupItem)
+        break;
+    let arrangeInfo = {
+      groupItem: groupItem,
+      options: options
+    };
+    if (i < this._arrangesPending.length)
+      this._arrangesPending[i] = arrangeInfo;
+    else
+      this._arrangesPending.push(arrangeInfo);
+  },
+
+  // ----------
+  // Function: resumeArrange
+  // Resolve bypassed and collected arrange() calls
+  resumeArrange: function GroupItems_resumeArrange() {
+    for (let i = 0; i < this._arrangesPending.length; i++) {
+      let g = this._arrangesPending[i];
+      g.groupItem.arrange(g.options);
+    }
+    this._arrangesPending = [];
+    this._arrangePaused = false;
+  },
+
   // ----------
   // Function: _handleAttrModified
   // watch for icon changes on app tabs
@@ -2107,19 +2192,16 @@ let GroupItems = {
   // Function: removeHiddenGroups
   // Removes all hidden groups' data and its browser tabs.
   removeHiddenGroups: function GroupItems_removeHiddenGroups() {
-    iQ(".undo").remove();
-    
-    // ToDo: encapsulate this in the group item. bug 594863
-    this.groupItems.forEach(function(groupItem) {
-      if (groupItem.hidden) {
-        let toClose = groupItem._children.concat();
-        toClose.forEach(function(child) {
-          child.removeSubscriber(groupItem, "close");
-          child.close();
-        });
+    if (this._removingHiddenGroups)
+      return;
+    this._removingHiddenGroups = true;
 
-        groupItem.deleteData();
-      }
-    });
+    let groupItems = this.groupItems.concat();
+    groupItems.forEach(function(groupItem) {
+      if (groupItem.hidden)
+        groupItem.closeHidden();
+     });
+
+    this._removingHiddenGroups = false;
   }
 };
diff --git a/browser/base/content/tabview/iq.js b/browser/base/content/tabview/iq.js
index ce22d6b5a2e2..24ba17c7566a 100644
--- a/browser/base/content/tabview/iq.js
+++ b/browser/base/content/tabview/iq.js
@@ -699,6 +699,7 @@ iQClass.prototype = {
 let events = [
   'keyup',
   'keydown',
+  'keypress',
   'mouseup',
   'mousedown',
   'mouseover',
diff --git a/browser/base/content/tabview/items.js b/browser/base/content/tabview/items.js
index 5d3701e9b4dd..ce1548a040de 100644
--- a/browser/base/content/tabview/items.js
+++ b/browser/base/content/tabview/items.js
@@ -216,7 +216,6 @@ Item.prototype = {
 
     // ___ resize
     var self = this;
-    var resizeInfo = null;
     this.resizeOptions = {
       aspectRatio: self.keepProportional,
       minWidth: 90,
@@ -224,16 +223,16 @@ Item.prototype = {
       start: function(e,ui) {
         if (this.isAGroupItem)
           GroupItems.setActiveGroupItem(this);
-        resizeInfo = new Drag(this, e, true); // true = isResizing
+        resize.info = new Drag(this, e, true); // true = isResizing
       },
       resize: function(e,ui) {
-        resizeInfo.snap(UI.rtl ? 'topright' : 'topleft', false, self.keepProportional);
+        resize.info.snap(UI.rtl ? 'topright' : 'topleft', false, self.keepProportional);
       },
       stop: function() {
         self.setUserSize();
         self.pushAway();
-        resizeInfo.stop();
-        resizeInfo = null;
+        resize.info.stop();
+        resize.info = null;
       }
     };
   },
@@ -599,6 +598,9 @@ Item.prototype = {
 
       // ___ mousemove
       var handleMouseMove = function(e) {
+        // global drag tracking
+        drag.lastMoveTime = Date.now();
+
         // positioning
         var mouse = new Point(e.pageX, e.pageY);
         if (!startSent) {
@@ -766,6 +768,9 @@ Item.prototype = {
 
         // ___ mousemove
         var handleMouseMove = function(e) {
+          // global resize tracking
+          resize.lastMoveTime = Date.now();
+
           var mouse = new Point(e.pageX, e.pageY);
           var box = self.getBounds();
           if (UI.rtl) {
diff --git a/browser/base/content/tabview/search.js b/browser/base/content/tabview/search.js
index 0d845ef9821d..3a1dc8804173 100644
--- a/browser/base/content/tabview/search.js
+++ b/browser/base/content/tabview/search.js
@@ -132,7 +132,7 @@ var TabUtils = {
   // Function: favURLOf
   // Given a <TabItem> or a <xul:tab> returns the URL of tab's favicon.
   faviconURLOf: function TabUtils_faviconURLOf(tab) {
-    return tab.image != undefined ? tab.image : tab.favEl.src;
+    return tab.image != undefined ? tab.image : tab.favImgEl.src;
   },
   
   // ---------
@@ -335,9 +335,9 @@ SearchEventHandlerClass.prototype = {
   // Handles all keypresses before the search interface is brought up.
   beforeSearchKeyHandler: function (event) {
     // Only match reasonable text-like characters for quick search.
-    var key = String.fromCharCode(event.which);
     // TODO: Also include funky chars. Bug 593904
-    if (!key.match(/[A-Z0-9]/) || event.altKey || event.ctrlKey || event.metaKey)
+    if (!String.fromCharCode(event.which).match(/[a-zA-Z0-9]/) || event.altKey || 
+        event.ctrlKey || event.metaKey)
       return;
 
     // If we are already in an input field, allow typing as normal.
@@ -353,16 +353,17 @@ SearchEventHandlerClass.prototype = {
   // Handles all keypresses while search mode.
   inSearchKeyHandler: function (event) {
     var term = iQ("#searchbox").val();
-    
-    if (event.which == event.DOM_VK_ESCAPE) 
-      hideSearch(event);
-    if (event.which == event.DOM_VK_BACK_SPACE && term.length <= 1) 
+
+    if ((event.keyCode == event.DOM_VK_ESCAPE) || 
+        (event.keyCode == event.DOM_VK_BACK_SPACE && term.length <= 1)) {
       hideSearch(event);
+      return;
+    }
 
     var matcher = new TabMatcher(term);
     var matches = matcher.matched();
     var others =  matcher.matchedTabsFromOtherWindows();
-    if (event.which == event.DOM_VK_RETURN && (matches.length > 0 || others.length > 0)) {
+    if (event.keyCode == event.DOM_VK_RETURN && (matches.length > 0 || others.length > 0)) {
       hideSearch(event);
       if (matches.length > 0) 
         matches[0].zoomIn();
@@ -378,9 +379,9 @@ SearchEventHandlerClass.prototype = {
   switchToBeforeMode: function switchToBeforeMode() {
     var self = this;
     if (this.currentHandler)
-      iQ(document).unbind("keydown", this.currentHandler);
+      iQ(window).unbind("keypress", this.currentHandler);
     this.currentHandler = function(event) self.beforeSearchKeyHandler(event);
-    iQ(document).keydown(self.currentHandler);
+    iQ(window).keypress(this.currentHandler);
   },
   
   // ----------
@@ -390,9 +391,9 @@ SearchEventHandlerClass.prototype = {
   switchToInMode: function switchToInMode() {
     var self = this;
     if (this.currentHandler)
-      iQ(document).unbind("keydown", this.currentHandler);
+      iQ(window).unbind("keypress", this.currentHandler);
     this.currentHandler = function(event) self.inSearchKeyHandler(event);
-    iQ(document).keydown(self.currentHandler);
+    iQ(window).keypress(this.currentHandler);
   }
 };
 
@@ -488,13 +489,13 @@ function hideSearch(event){
     event.stopPropagation();
   }
 
-  let newEvent = document.createEvent("Events");
-  newEvent.initEvent("tabviewsearchdisabled", false, false);
-  dispatchEvent(newEvent);
-
   // Return focus to the tab window
   UI.blurAll();
   gTabViewFrame.contentWindow.focus();
+
+  let newEvent = document.createEvent("Events");
+  newEvent.initEvent("tabviewsearchdisabled", false, false);
+  dispatchEvent(newEvent);
 }
 
 function performSearch() {
@@ -513,13 +514,13 @@ function ensureSearchShown(event){
   var $search = iQ("#search");
   var $searchbox = iQ("#searchbox");
   iQ("#searchbutton").css({ opacity: 1 });
-  
-  
-  if ($search.css("display") == "none") {
+
+
+  if (!isSearchEnabled()) {
     $search.show();
     var mainWindow = gWindow.document.getElementById("main-window");
     mainWindow.setAttribute("activetitlebarcolor", "#717171");       
-        
+
     // Marshal the focusing, otherwise you end up with
     // a race condition where only sometimes would the
     // first keystroke be registered by the search box.
@@ -529,18 +530,20 @@ function ensureSearchShown(event){
       $searchbox[0].focus();
       $searchbox[0].val = '0';
       $searchbox.css({"z-index":"1015"});
-      if (event != null){
-        var keyCode = event.which + (event.shiftKey ? 0 : 32);
-        $searchbox.val(String.fromCharCode(keyCode));        
-      }
-    }, 0);
+      if (event != null)
+        $searchbox.val(String.fromCharCode(event.charCode));        
 
-    let newEvent = document.createEvent("Events");
-    newEvent.initEvent("tabviewsearchenabled", false, false);
-    dispatchEvent(newEvent);
+      let newEvent = document.createEvent("Events");
+      newEvent.initEvent("tabviewsearchenabled", false, false);
+      dispatchEvent(newEvent);
+    }, 0);
   }
 }
 
+function isSearchEnabled() {
+  return iQ("#search").css("display") != "none";
+}
+
 var SearchEventHandler = new SearchEventHandlerClass();
 
 // Features to add:
diff --git a/browser/base/content/tabview/tabitems.js b/browser/base/content/tabview/tabitems.js
index fa706836b0a6..46b53367b0ad 100644
--- a/browser/base/content/tabview/tabitems.js
+++ b/browser/base/content/tabview/tabitems.js
@@ -70,8 +70,10 @@ function TabItem(tab, options) {
 
   this.canvasSizeForced = false;
   this.isShowingCachedData = false;
-  this.favEl = (iQ('.favicon>img', $div))[0];
+  this.favEl = (iQ('.favicon', $div))[0];
+  this.favImgEl = (iQ('.favicon>img', $div))[0];
   this.nameEl = (iQ('.tab-title', $div))[0];
+  this.thumbEl = (iQ('.thumb', $div))[0];
   this.canvasEl = (iQ('.thumb canvas', $div))[0];
   this.cachedThumbEl = (iQ('img.cached-thumb', $div))[0];
 
@@ -96,6 +98,8 @@ function TabItem(tab, options) {
 
   this.bounds = $div.bounds();
 
+  this._lastTabUpdateTime = Date.now();
+
   // ___ superclass setup
   this._init($div[0]);
 
@@ -194,6 +198,7 @@ function TabItem(tab, options) {
   iQ("<div>")
     .addClass('close')
     .appendTo($div);
+  this.closeEl = (iQ(".close", $div))[0];
 
   iQ("<div>")
     .addClass('expander')
@@ -322,10 +327,10 @@ TabItem.prototype = Utils.extend(new Item(), new Subscribable(), {
       this.bounds.copy(rect);
     else {
       var $container = iQ(this.container);
-      var $title = iQ('.tab-title', $container);
-      var $thumb = iQ('.thumb', $container);
-      var $close = iQ('.close', $container);
-      var $fav   = iQ('.favicon', $container);
+      var $title = iQ(this.nameEl);
+      var $thumb = iQ(this.thumbEl);
+      var $close = iQ(this.closeEl);
+      var $fav   = iQ(this.favEl);
       var css = {};
 
       const fontSizeRange = new Range(8,15);
@@ -461,12 +466,20 @@ TabItem.prototype = Utils.extend(new Item(), new Subscribable(), {
   // Function: close
   // Closes this item (actually closes the tab associated with it, which automatically
   // closes the item.
+  // Returns true if this tab is removed.
   close: function TabItem_close() {
+    // when "TabClose" event is fired, the browser tab is about to close and our 
+    // item "close" is fired before the browser tab actually get closed. 
+    // Therefore, we need "tabRemoved" event below.
     gBrowser.removeTab(this.tab);
-    this._sendToSubscribers("tabRemoved");
+    let tabNotClosed = 
+      Array.some(gBrowser.tabs, function(tab) { return tab == this.tab; }, this);
+    if (!tabNotClosed)
+      this._sendToSubscribers("tabRemoved");
 
     // No need to explicitly delete the tab data, becasue sessionstore data
     // associated with the tab will automatically go away
+    return !tabNotClosed;
   },
 
   // ----------
@@ -544,9 +557,14 @@ TabItem.prototype = Utils.extend(new Item(), new Subscribable(), {
       function onZoomDone() {
         UI.goToTab(tab);
 
-        if (isNewBlankTab)
-          gWindow.gURLBar.focus();
-
+        // tab might not be selected because hideTabView() is invoked after 
+        // UI.goToTab() so we need to setup everything for the gBrowser.selectedTab
+        if (tab != gBrowser.selectedTab) {
+          UI.onTabSelect(gBrowser.selectedTab);
+        } else { 
+          if (isNewBlankTab)
+            gWindow.gURLBar.focus();
+        }
         if (childHitResult.callback)
           childHitResult.callback();
       }
@@ -581,8 +599,9 @@ TabItem.prototype = Utils.extend(new Item(), new Subscribable(), {
             onZoomDone();
           }
         });
-      } else
+      } else {
         setTimeout(onZoomDone, 0);
+      } 
     }
   },
 
@@ -684,10 +703,11 @@ let TabItems = {
   items: [],
   paintingPaused: 0,
   _tabsWaitingForUpdate: [],
-  _heartbeatOn: false,
-  _heartbeatTiming: 100, // milliseconds between beats
+  _heartbeatOn: false, // see explanation at startHeartbeat() below
+  _heartbeatTiming: 100, // milliseconds between _checkHeartbeat() calls
   _lastUpdateTime: Date.now(),
   _eventListeners: [],
+  tempCanvas: null,
 
   // ----------
   // Function: init
@@ -696,6 +716,15 @@ let TabItems = {
     Utils.assert(window.AllTabs, "AllTabs must be initialized first");
     var self = this;
 
+    let $canvas = iQ("<canvas>");
+    $canvas.appendTo(iQ("body"));
+    $canvas.hide();
+    this.tempCanvas = $canvas[0];
+    // 150 pixels is an empirical size, below which FF's drawWindow()
+    // algorithm breaks down
+    this.tempCanvas.width = 150;
+    this.tempCanvas.height = 150;
+
     // When a tab is opened, create the TabItem
     this._eventListeners["open"] = function(tab) {
       if (tab.ownerDocument.defaultView != gWindow || tab.pinned)
@@ -774,6 +803,7 @@ let TabItems = {
       if (shouldDefer && !isCurrentTab) {
         if (this._tabsWaitingForUpdate.indexOf(tab) == -1)
           this._tabsWaitingForUpdate.push(tab);
+        this.startHeartbeat();
       } else
         this._update(tab);
     } catch(e) {
@@ -802,8 +832,8 @@ let TabItems = {
       if (iconUrl == null)
         iconUrl = Utils.defaultFaviconURL;
 
-      if (iconUrl != tabItem.favEl.src)
-        tabItem.favEl.src = iconUrl;
+      if (iconUrl != tabItem.favImgEl.src)
+        tabItem.favImgEl.src = iconUrl;
 
       // ___ URL
       let tabUrl = tab.linkedBrowser.currentURI.spec;
@@ -834,6 +864,9 @@ let TabItems = {
         }
       }
 
+      this._lastUpdateTime = Date.now();
+      tabItem._lastTabUpdateTime = this._lastUpdateTime;
+
       tabItem.tabCanvas.paint();
 
       // ___ cache
@@ -843,8 +876,6 @@ let TabItems = {
     } catch(e) {
       Utils.log(e);
     }
-
-    this._lastUpdateTime = Date.now();
   },
 
   // ----------
@@ -901,55 +932,64 @@ let TabItems = {
   },
 
   // ----------
-  // Function: heartbeat
-  // Allows us to spreadout update calls over a period of time.
-  heartbeat: function TabItems_heartbeat() {
-    if (!this._heartbeatOn)
+  // Function: startHeartbeat
+  // Start a new heartbeat if there isn't one already started.
+  // The heartbeat is a chain of setTimeout calls that allows us to spread
+  // out update calls over a period of time.
+  // _heartbeatOn is used to make sure that we don't add multiple 
+  // setTimeout chains.
+  startHeartbeat: function TabItems_startHeartbeat() {
+    if (!this._heartbeatOn) {
+      this._heartbeatOn = true;
+      let self = this;
+      setTimeout(function() {
+        self._checkHeartbeat();
+      }, this._heartbeatTiming);
+    }
+  },
+  
+  // ----------
+  // Function: _checkHeartbeat
+  // This periodically checks for tabs waiting to be updated, and calls
+  // _update on them.
+  // Should only be called by startHeartbeat and resumePainting.
+  _checkHeartbeat: function TabItems__checkHeartbeat() {
+    this._heartbeatOn = false;
+    
+    if (this.isPaintingPaused())
       return;
 
-    if (this._tabsWaitingForUpdate.length) {
+    if (this._tabsWaitingForUpdate.length && UI.isIdle()) {
       this._update(this._tabsWaitingForUpdate[0]);
-      // _update will remove the tab from the waiting list
+      //_update will remove the tab from the waiting list
     }
 
-    let self = this;
     if (this._tabsWaitingForUpdate.length) {
-      setTimeout(function() {
-        self.heartbeat();
-      }, this._heartbeatTiming);
-    } else
-      this._hearbeatOn = false;
-  },
-
-  // ----------
-  // Function: pausePainting
-  // Tells TabItems to stop updating thumbnails (so you can do
-  // animations without thumbnail paints causing stutters).
-  // pausePainting can be called multiple times, but every call to
-  // pausePainting needs to be mirrored with a call to <resumePainting>.
-  pausePainting: function TabItems_pausePainting() {
-    this.paintingPaused++;
-
-    if (this.isPaintingPaused() && this._heartbeatOn)
-      this._heartbeatOn = false;
-  },
-
-  // ----------
-  // Function: resumePainting
-  // Undoes a call to <pausePainting>. For instance, if you called
-  // pausePainting three times in a row, you'll need to call resumePainting
-  // three times before TabItems will start updating thumbnails again.
-  resumePainting: function TabItems_resumePainting() {
-    this.paintingPaused--;
-
-    if (!this.isPaintingPaused() &&
-        this._tabsWaitingForUpdate.length &&
-        !this._heartbeatOn) {
-      this._heartbeatOn = true;
-      this.heartbeat();
+      this.startHeartbeat();
     }
   },
 
+   // ----------
+   // Function: pausePainting
+   // Tells TabItems to stop updating thumbnails (so you can do
+   // animations without thumbnail paints causing stutters).
+   // pausePainting can be called multiple times, but every call to
+   // pausePainting needs to be mirrored with a call to <resumePainting>.
+   pausePainting: function TabItems_pausePainting() {
+     this.paintingPaused++;
+   },
+ 
+   // ----------
+   // Function: resumePainting
+   // Undoes a call to <pausePainting>. For instance, if you called
+   // pausePainting three times in a row, you'll need to call resumePainting
+   // three times before TabItems will start updating thumbnails again.
+   resumePainting: function TabItems_resumePainting() {
+     this.paintingPaused--;
+     if (!this.isPaintingPaused())
+       this.startHeartbeat();
+   },
+
   // ----------
   // Function: isPaintingPaused
   // Returns a boolean indicating whether painting
@@ -1106,8 +1146,6 @@ TabCanvas.prototype = {
   // ----------
   // Function: paint
   paint: function TabCanvas_paint(evt) {
-    var ctx = this.canvas.getContext("2d");
-
     var w = this.canvas.width;
     var h = this.canvas.height;
     if (!w || !h)
@@ -1119,19 +1157,59 @@ TabCanvas.prototype = {
       return;
     }
 
-    var scaler = w/fromWin.innerWidth;
-
-    // TODO: Potentially only redraw the dirty rect? (Is it worth it?)
-
-    ctx.save();
-    ctx.scale(scaler, scaler);
-    try{
-      ctx.drawWindow(fromWin, fromWin.scrollX, fromWin.scrollY, w/scaler, h/scaler, "#fff");
-    } catch(e) {
-      Utils.error('paint', e);
+    let tempCanvas = TabItems.tempCanvas;
+    if (w < tempCanvas.width) {
+      // Small draw case where nearest-neighbor algorithm breaks down in Windows
+      // First draw to a larger canvas (150px wide), and then draw that image
+      // to the destination canvas.
+      
+      var tempCtx = tempCanvas.getContext("2d");
+      
+      let canvW = tempCanvas.width;
+      let canvH = (h/w) * canvW;
+      
+      var scaler = canvW/fromWin.innerWidth;
+  
+      tempCtx.save();
+      tempCtx.clearRect(0,0,tempCanvas.width,tempCanvas.height);
+      tempCtx.scale(scaler, scaler);
+      try{
+        tempCtx.drawWindow(fromWin, fromWin.scrollX, fromWin.scrollY, 
+          canvW/scaler, canvH/scaler, "#fff");
+      } catch(e) {
+        Utils.error('paint', e);
+      }  
+      tempCtx.restore();
+      
+      // Now copy to tabitem canvas. No save/restore necessary.      
+      var destCtx = this.canvas.getContext("2d");      
+      try{
+        // the tempcanvas is square, so draw it as a square.
+        destCtx.drawImage(tempCanvas, 0, 0, w, w);
+      } catch(e) {
+        Utils.error('paint', e);
+      }  
+      
+    } else {
+      // General case where nearest neighbor algorithm looks good
+      // Draw directly to the destination canvas
+      
+      var ctx = this.canvas.getContext("2d");
+      
+      var scaler = w/fromWin.innerWidth;
+  
+      // TODO: Potentially only redraw the dirty rect? (Is it worth it?)
+  
+      ctx.save();
+      ctx.scale(scaler, scaler);
+      try{
+        ctx.drawWindow(fromWin, fromWin.scrollX, fromWin.scrollY, w/scaler, h/scaler, "#fff");
+      } catch(e) {
+        Utils.error('paint', e);
+      }
+  
+      ctx.restore();
     }
-
-    ctx.restore();
   },
 
   // ----------
diff --git a/browser/base/content/tabview/ui.js b/browser/base/content/tabview/ui.js
index c3f792173a5e..362e7518df37 100644
--- a/browser/base/content/tabview/ui.js
+++ b/browser/base/content/tabview/ui.js
@@ -88,6 +88,12 @@ let UI = {
   // An array of functions to be called at uninit time
   _cleanupFunctions: [],
   
+  // Constant: _maxInteractiveWait
+  // If the UI is in the middle of an operation, this is the max amount of
+  // milliseconds to wait between input events before we no longer consider
+  // the operation interactive.
+  _maxInteractiveWait: 250,
+
   // Variable: _privateBrowsing
   // Keeps track of info related to private browsing, including: 
   //   transitionStage - what step we're on in entering/exiting PB
@@ -171,6 +177,7 @@ let UI = {
 
       // ___ Storage
 
+      GroupItems.pauseArrange();
       GroupItems.init();
 
       let firstTime = true;
@@ -221,9 +228,11 @@ let UI = {
       // initialized.
       let event = document.createEvent("Events");
       event.initEvent("tabviewframeinitialized", true, false);
-      dispatchEvent(event);
+      dispatchEvent(event);      
     } catch(e) {
       Utils.log(e);
+    } finally {
+      GroupItems.resumeArrange();
     }
   },
 
@@ -320,6 +329,18 @@ let UI = {
     });
   },
 
+  // ----------
+  // Function: isIdle
+  // Returns true if the last interaction was long enough ago to consider the
+  // UI idle. Used to determine whether interactivity would be sacrificed if 
+  // the CPU was to become busy.
+  //
+  isIdle: function UI_isIdle() {
+    let time = Date.now();
+    let maxEvent = Math.max(drag.lastMoveTime, resize.lastMoveTime);
+    return (time - maxEvent) > this._maxInteractiveWait;
+  },
+
   // ----------
   // Function: getActiveTab
   // Returns the currently active tab as a <TabItem>
@@ -450,6 +471,8 @@ let UI = {
     if (!this._isTabViewVisible())
       return;
 
+    // another tab might be select if user decides to stay on a page when
+    // a onclose confirmation prompts.
     GroupItems.removeHiddenGroups();
     TabItems.pausePainting();
 
@@ -678,6 +701,7 @@ let UI = {
   },
 
   // ----------
+  // Function: goToTab
   // Selects the given xul:tab in the browser.
   goToTab: function UI_goToTab(xulTab) {
     // If it's not focused, the onFocus listener would handle it.
@@ -710,6 +734,11 @@ let UI = {
     if (this._isTabViewVisible())
       this.hideTabView();
 
+    // another tab might be selected when hideTabView() is invoked so a
+    // validation is needed.
+    if (this._currentTab != tab)
+      return;
+
     let oldItem = null;
     let newItem = null;
 
@@ -814,11 +843,16 @@ let UI = {
     var self = this;
 
     iQ(window).keyup(function(event) {
-      if (!event.metaKey) Keys.meta = false;
+      if (!event.metaKey) 
+        Keys.meta = false;
     });
 
     iQ(window).keydown(function(event) {
-      if (event.metaKey) Keys.meta = true;
+      if (event.metaKey) 
+        Keys.meta = true;
+
+      if (isSearchEnabled())
+        return;
 
       function getClosestTabBy(norm) {
         if (!self.getActiveTab())
@@ -875,7 +909,7 @@ let UI = {
                  event.keyCode == KeyEvent.DOM_VK_ENTER) {
         let activeTab = self.getActiveTab();
         if (activeTab)
-            activeTab.zoomIn();
+          activeTab.zoomIn();
 
         event.stopPropagation();
         event.preventDefault();
@@ -989,11 +1023,12 @@ let UI = {
     }
 
     function collapse() {
+      let center = phantom.bounds().center();
       phantom.animate({
         width: 0,
         height: 0,
-        top: phantom.position().x + phantom.height()/2,
-        left: phantom.position().y + phantom.width()/2
+        top: center.y,
+        left: center.x
       }, {
         duration: 300,
         complete: function() {
diff --git a/browser/base/content/test/browser_keywordSearch.js b/browser/base/content/test/browser_keywordSearch.js
index 4b9b08eed147..38ed7ae48e4b 100644
--- a/browser/base/content/test/browser_keywordSearch.js
+++ b/browser/base/content/test/browser_keywordSearch.js
@@ -3,37 +3,41 @@
  * http://creativecommons.org/publicdomain/zero/1.0/
  **/
 
+var gTests = [
+  {
+    name: "normal search (search service)",
+    testText: "test search",
+    searchURL: Services.search.originalDefaultEngine.getSubmission("test search").uri.spec
+  },
+  {
+    name: "?-prefixed search (search service)",
+    testText: "?   foo  ",
+    searchURL: Services.search.originalDefaultEngine.getSubmission("foo").uri.spec
+  },
+  {
+    name: "normal search (keyword.url)",
+    testText: "test search",
+    keywordURLPref: "http://example.com/?q=",
+    searchURL: "http://example.com/?q=test+search"
+  },
+  {
+    name: "?-prefixed search (keyword.url)",
+    testText: "?   foo  ",
+    keywordURLPref: "http://example.com/?q=",
+    searchURL: "http://example.com/?q=foo"
+  },
+  {
+    name: "encoding test (keyword.url)",
+    testText: "test encoded+%/",
+    keywordURLPref: "http://example.com/?q=",
+    searchURL: "http://example.com/?q=test+encoded%2B%25%2F"
+  }
+];
+
 function test() {
   waitForExplicitFinish();
 
-  let tab = gBrowser.selectedTab = gBrowser.addTab();
-  let searchText = "test search";
-
-  let listener = {
-    onStateChange: function onLocationChange(webProgress, req, flags, status) {
-      ok(flags & Ci.nsIWebProgressListener.STATE_IS_DOCUMENT, "only notified for document");
-
-      // Only care about starts
-      if (!(flags & Ci.nsIWebProgressListener.STATE_START))
-        return;
-
-      ok(req instanceof Ci.nsIChannel, "req is a channel");
-
-      let searchURL = Services.search.originalDefaultEngine.getSubmission(searchText).uri.spec;
-      is(req.originalURI.spec, searchURL, "search URL was loaded");
-      info("Actual URI: " + req.URI.spec);
-
-      Services.ww.unregisterNotification(observer);
-      gBrowser.removeProgressListener(this);
-      executeSoon(function () {
-        gBrowser.removeTab(tab);
-        finish();
-      });
-    }
-  }
-  gBrowser.addProgressListener(listener, Ci.nsIWebProgressListener.NOTIFY_STATE_DOCUMENT);
-
-  let observer = {
+  let windowObserver = {
     observe: function(aSubject, aTopic, aData) {
       if (aTopic == "domwindowopened") {
         ok(false, "Alert window opened");
@@ -42,19 +46,67 @@ function test() {
           win.removeEventListener("load", arguments.callee, false);
           win.close();
         }, false);
-        gBrowser.removeProgressListener(listener);
-        executeSoon(function () {
-          gBrowser.removeTab(tab);
-          finish();
-        });
+        executeSoon(finish);
       }
-      Services.ww.unregisterNotification(this);
     }
   };
-  Services.ww.registerNotification(observer);
+
+  Services.ww.registerNotification(windowObserver);
+
+  let tab = gBrowser.selectedTab = gBrowser.addTab();
+
+  let listener = {
+    onStateChange: function onLocationChange(webProgress, req, flags, status) {
+      // Only care about document starts
+      let docStart = Ci.nsIWebProgressListener.STATE_IS_DOCUMENT |
+                     Ci.nsIWebProgressListener.STATE_START;
+      if (!(flags & docStart))
+        return;
+
+      info("received document start");
+
+      ok(req instanceof Ci.nsIChannel, "req is a channel");
+      is(req.originalURI.spec, gCurrTest.searchURL, "search URL was loaded");
+      info("Actual URI: " + req.URI.spec);
+
+      executeSoon(nextTest);
+    }
+  }
+  gBrowser.addProgressListener(listener);
+
+  registerCleanupFunction(function () {
+    Services.ww.unregisterNotification(windowObserver);
+
+    gBrowser.removeProgressListener(listener);
+    gBrowser.removeTab(tab);
+  });
+
+  nextTest();
+}
+
+var gCurrTest;
+function nextTest() {
+  // Clear the pref before every test (and after the last)
+  try {
+    Services.prefs.clearUserPref("keyword.URL");
+  } catch(ex) {}
+
+  if (gTests.length) {
+    gCurrTest = gTests.shift();
+    doTest();
+  } else {
+    finish();
+  }
+}
+
+function doTest() {
+  info("Running test: " + gCurrTest.name);
+
+  if (gCurrTest.keywordURLPref)
+    Services.prefs.setCharPref("keyword.URL", gCurrTest.keywordURLPref);
 
   // Simulate a user entering search terms
-  gURLBar.value = searchText;
+  gURLBar.value = gCurrTest.testText;
   gURLBar.focus();
   EventUtils.synthesizeKey("VK_RETURN", {});
 }
diff --git a/browser/base/content/test/tabview/Makefile.in b/browser/base/content/test/tabview/Makefile.in
index 53c605cc7899..7726115cca8d 100644
--- a/browser/base/content/test/tabview/Makefile.in
+++ b/browser/base/content/test/tabview/Makefile.in
@@ -48,6 +48,7 @@ _BROWSER_FILES = \
                  browser_tabview_apptabs.js \
                  browser_tabview_bug580412.js \
                  browser_tabview_bug587043.js \
+                 browser_tabview_bug587231.js \
                  browser_tabview_bug587990.js \
                  browser_tabview_bug589324.js \
                  browser_tabview_bug590606.js \
@@ -59,7 +60,9 @@ _BROWSER_FILES = \
                  browser_tabview_bug595804.js \
                  browser_tabview_bug595930.js \
                  browser_tabview_bug595943.js \
+                 browser_tabview_bug597399.js \
                  browser_tabview_bug598600.js \
+                 browser_tabview_bug599626.js \
                  browser_tabview_dragdrop.js \
                  browser_tabview_exit_button.js \
                  browser_tabview_group.js \
@@ -76,6 +79,7 @@ _BROWSER_FILES = \
                  head.js \
                  search1.html \
                  search2.html \
+                 test_bug599626.html \
                  $(NULL)
 
 # compartments: test disabled
diff --git a/browser/base/content/test/tabview/browser_tabview_bug587231.js b/browser/base/content/test/tabview/browser_tabview_bug587231.js
new file mode 100644
index 000000000000..c3e4f4d010d7
--- /dev/null
+++ b/browser/base/content/test/tabview/browser_tabview_bug587231.js
@@ -0,0 +1,125 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is tabview drag and drop test.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ * Sean Dunn <seanedunn@yahoo.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+let activeTab;
+let testTab;
+let testGroup;
+let contentWindow;
+
+function test() {
+  waitForExplicitFinish();
+  contentWindow = document.getElementById("tab-view").contentWindow;
+
+  // create new tab
+  testTab = gBrowser.addTab("http://mochi.test:8888/");
+
+  window.addEventListener("tabviewshown", onTabViewWindowLoaded, false);
+  TabView.toggle();
+}
+
+function onTabViewWindowLoaded() {
+  window.removeEventListener("tabviewshown", onTabViewWindowLoaded, false);
+  ok(TabView.isVisible(), "Tab View is visible");
+
+  // create group
+  let testGroupRect = new contentWindow.Rect(20, 20, 300, 300);
+  testGroup = new contentWindow.GroupItem([], { bounds: testGroupRect });
+  ok(testGroup.isEmpty(), "This group is empty");
+  
+  // place tab in group
+  let testTabItem = testTab.tabItem;
+
+  if (testTabItem.parent)
+    testTabItem.parent.remove(testTabItem);
+  testGroup.add(testTabItem);
+
+  // record last update time of tab canvas
+  let initialUpdateTime = testTabItem._lastTabUpdateTime;
+
+  // simulate resize
+  let resizer = contentWindow.iQ('.iq-resizable-handle', testGroup.container)[0];
+  let offsetX = 100;
+  let offsetY = 100;
+  let delay = 500;
+
+  let funcChain = new Array();
+  funcChain.push(function() {
+    EventUtils.synthesizeMouse(
+      resizer, 1, 1, { type: "mousedown" }, contentWindow);
+    setTimeout(funcChain.shift(), delay);
+  });
+  // drag
+  for (let i = 4; i >= 0; i--) {
+    funcChain.push(function() {
+      EventUtils.synthesizeMouse(
+        resizer,  Math.round(offsetX/4),  Math.round(offsetY/4),
+        { type: "mousemove" }, contentWindow);
+      setTimeout(funcChain.shift(), delay);
+    });
+  }
+  funcChain.push(function() {
+    EventUtils.synthesizeMouse(resizer, 0, 0, { type: "mouseup" }, 
+      contentWindow);    
+    setTimeout(funcChain.shift(), delay);
+  });
+  funcChain.push(function() {
+    // verify that update time has changed after last update
+    let lastTime = testTabItem._lastTabUpdateTime;
+    let hbTiming = contentWindow.TabItems._heartbeatTiming;
+    ok((lastTime - initialUpdateTime) > hbTiming, "Tab has been updated:"+lastTime+"-"+initialUpdateTime+">"+hbTiming);
+
+    // clean up
+    testGroup.remove(testTab.tabItem);
+    testTab.tabItem.close();
+    testGroup.close();
+
+    let currentTabs = contentWindow.TabItems.getItems();
+    ok(currentTabs[0], "A tab item exists to make active");
+    contentWindow.UI.setActiveTab(currentTabs[0]);
+    
+    window.addEventListener("tabviewhidden", finishTest, false);
+    TabView.toggle();
+  });
+  setTimeout(funcChain.shift(), delay);
+}
+
+function finishTest() {
+  window.removeEventListener("tabviewhidden", finishTest, false);
+  ok(!TabView.isVisible(), "Tab View is not visible");
+
+  finish();  
+}
diff --git a/browser/base/content/test/tabview/browser_tabview_bug595191.js b/browser/base/content/test/tabview/browser_tabview_bug595191.js
index 69bdb4f24da7..e4bc3d066004 100644
--- a/browser/base/content/test/tabview/browser_tabview_bug595191.js
+++ b/browser/base/content/test/tabview/browser_tabview_bug595191.js
@@ -55,10 +55,10 @@ function onTabViewWindowLoaded() {
   ok(searchButton, "Search button exists");
   
   let onSearchEnabled = function() {
-    let search = contentWindow.document.getElementById("search");
-    ok(search.style.display != "none", "Search is enabled");
     contentWindow.removeEventListener(
       "tabviewsearchenabled", onSearchEnabled, false);
+    let search = contentWindow.document.getElementById("search");
+    ok(search.style.display != "none", "Search is enabled");
     escapeTest(contentWindow);
   }
   contentWindow.addEventListener("tabviewsearchenabled", onSearchEnabled, 
@@ -70,21 +70,16 @@ function onTabViewWindowLoaded() {
 
 function escapeTest(contentWindow) {  
   let onSearchDisabled = function() {
-    let search = contentWindow.document.getElementById("search");
-
-    ok(search.style.display == "none", "Search is disabled");
-
     contentWindow.removeEventListener(
       "tabviewsearchdisabled", onSearchDisabled, false);
+
+    let search = contentWindow.document.getElementById("search");
+    ok(search.style.display == "none", "Search is disabled");
     toggleTabViewTest(contentWindow);
   }
   contentWindow.addEventListener("tabviewsearchdisabled", onSearchDisabled, 
     false);
-  // the search box focus()es in a function on the timeout queue, so we just
-  // want to queue behind it.
-  setTimeout( function() {
-    EventUtils.synthesizeKey("VK_ESCAPE", {});
-  }, 0);
+  EventUtils.synthesizeKey("VK_ESCAPE", { type: "keypress" }, contentWindow);
 }
 
 function toggleTabViewTest(contentWindow) {
@@ -92,14 +87,9 @@ function toggleTabViewTest(contentWindow) {
     contentWindow.removeEventListener("tabviewhidden", onTabViewHidden, false);
 
     ok(!TabView.isVisible(), "Tab View is hidden");
-
     finish();
   }
   contentWindow.addEventListener("tabviewhidden", onTabViewHidden, false);
-  // When search is hidden, it focus()es on the background, so avert the 
-  // race condition by delaying ourselves on the timeout queue
-  setTimeout( function() {
-    // Use keyboard shortcut to toggle back to browser view
-    EventUtils.synthesizeKey("e", { accelKey: true });
-  }, 0);
+  // Use keyboard shortcut to toggle back to browser view
+  EventUtils.synthesizeKey("e", { accelKey: true });
 }
diff --git a/browser/base/content/test/tabview/browser_tabview_bug597399.js b/browser/base/content/test/tabview/browser_tabview_bug597399.js
new file mode 100644
index 000000000000..20b6da68d9bc
--- /dev/null
+++ b/browser/base/content/test/tabview/browser_tabview_bug597399.js
@@ -0,0 +1,82 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is a test for bug 597399.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ * Raymond Lee <raymond@appcoast.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+function test() {
+  waitForExplicitFinish();
+
+  window.addEventListener("tabviewshown", onTabViewWindowLoaded, false);
+  TabView.toggle();
+}
+
+function onTabViewWindowLoaded() {
+  window.removeEventListener("tabviewshown", onTabViewWindowLoaded, false);
+
+  let contentWindow = document.getElementById("tab-view").contentWindow;
+  let number = -1;
+
+  let onSearchEnabled = function() {
+    let searchBox = contentWindow.document.getElementById("searchbox");
+    is(searchBox.value, number, "The seach box matches the number: " + number);
+    contentWindow.hideSearch(null);
+  }
+  let onSearchDisabled = function() {
+    if (++number <= 9) {
+      EventUtils.synthesizeKey(String(number), { }, contentWindow);
+    } else {
+      contentWindow.removeEventListener(
+        "tabviewsearchenabled", onSearchEnabled, false);
+      contentWindow.removeEventListener(
+        "tabviewsearchdisabled", onSearchDisabled, false);
+
+      let endGame = function() {
+        window.removeEventListener("tabviewhidden", endGame, false);
+
+        ok(!TabView.isVisible(), "Tab View is hidden");
+        finish();
+      }
+      window.addEventListener("tabviewhidden", endGame, false);
+      TabView.toggle();
+    }
+  }
+  contentWindow.addEventListener(
+    "tabviewsearchenabled", onSearchEnabled, false);
+  contentWindow.addEventListener(
+    "tabviewsearchdisabled", onSearchDisabled, false);
+
+  onSearchDisabled();
+}
+
diff --git a/browser/base/content/test/tabview/browser_tabview_bug599626.js b/browser/base/content/test/tabview/browser_tabview_bug599626.js
new file mode 100644
index 000000000000..84abefd70987
--- /dev/null
+++ b/browser/base/content/test/tabview/browser_tabview_bug599626.js
@@ -0,0 +1,194 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is tabview bug 599626 test.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ * Raymond Lee <raymond@appcoast.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+let handleDialog;
+
+function test() {
+  waitForExplicitFinish();
+
+  window.addEventListener("tabviewshown", onTabViewWindowLoaded, false);
+  TabView.toggle();
+}
+
+function onTabViewWindowLoaded() {
+  window.removeEventListener("tabviewshown", onTabViewWindowLoaded, false);
+
+  let contentWindow = document.getElementById("tab-view").contentWindow;
+  let groupItemOne = contentWindow.GroupItems.getActiveGroupItem();
+
+  // Create a group and make it active
+  let box = new contentWindow.Rect(10, 10, 300, 300);
+  let groupItemTwo = new contentWindow.GroupItem([], { bounds: box });
+  contentWindow.GroupItems.setActiveGroupItem(groupItemTwo);
+
+  let testTab = 
+    gBrowser.addTab(
+      "http://mochi.test:8888/browser/browser/base/content/test/tabview/test_bug599626.html");
+  let browser = gBrowser.getBrowserForTab(testTab);
+  let onLoad = function() {
+    browser.removeEventListener("load", onLoad, true);
+
+    testStayOnPage(contentWindow, groupItemOne, groupItemTwo);
+  }
+  browser.addEventListener("load", onLoad, true);
+}
+
+function testStayOnPage(contentWindow, groupItemOne, groupItemTwo) {
+  setupAndRun(contentWindow, groupItemOne, groupItemTwo, function(doc) {
+    groupItemTwo.addSubscriber(groupItemTwo, "groupShown", function() {
+      groupItemTwo.removeSubscriber(groupItemTwo, "groupShown");
+
+      is(gBrowser.tabs.length, 2, 
+         "The total number of tab is 2 when staying on the page");
+      is(contentWindow.TabItems.getItems().length, 2, 
+         "The total number of tab items is 2 when staying on the page");
+
+      let onTabViewShown = function() {
+        window.removeEventListener("tabviewshown", onTabViewShown, false);
+
+        // start the next test
+        testLeavePage(contentWindow, groupItemOne, groupItemTwo);
+      };
+      window.addEventListener("tabviewshown", onTabViewShown, false);
+      TabView.toggle();
+    });
+    // stay on page
+    doc.documentElement.getButton("cancel").click();
+  });
+}
+
+function testLeavePage(contentWindow, groupItemOne, groupItemTwo) {
+  setupAndRun(contentWindow, groupItemOne, groupItemTwo, function(doc) {
+    // clean up and finish the test
+    groupItemTwo.addSubscriber(groupItemTwo, "close", function() {
+      groupItemTwo.removeSubscriber(groupItemTwo, "close");
+
+      is(gBrowser.tabs.length, 1,
+         "The total number of tab is 1 after leaving the page");
+      is(contentWindow.TabItems.getItems().length, 1, 
+         "The total number of tab items is 1 after leaving the page");
+
+      let endGame = function() {
+        window.removeEventListener("tabviewhidden", endGame, false);
+        finish();
+      };
+      window.addEventListener("tabviewhidden", endGame, false);
+    });
+
+    // Leave page
+    doc.documentElement.getButton("accept").click();
+  });
+}
+
+function setupAndRun(contentWindow, groupItemOne, groupItemTwo, callback) {
+  let closeButton = groupItemTwo.container.getElementsByClassName("close");
+  ok(closeButton[0], "Group close button exists");
+  // click the close button
+  EventUtils.sendMouseEvent({ type: "click" }, closeButton[0], contentWindow);
+
+  let onTabViewHidden = function() {
+    window.removeEventListener("tabviewhidden", onTabViewHidden, false);
+
+    handleDialog = function(doc) {
+      callback(doc);
+    };
+    startCallbackTimer();
+  };
+  window.addEventListener("tabviewhidden", onTabViewHidden, false);
+
+  let tabItem = groupItemOne.getChild(0);
+  tabItem.zoomIn();
+}
+
+// Copied from http://mxr.mozilla.org/mozilla-central/source/toolkit/components/places/tests/mochitest/prompt_common.js
+let observer = {
+  QueryInterface : function (iid) {
+    const interfaces = [Ci.nsIObserver, Ci.nsISupports, Ci.nsISupportsWeakReference];
+
+    if (!interfaces.some( function(v) { return iid.equals(v) } ))
+      throw Components.results.NS_ERROR_NO_INTERFACE;
+    return this;
+  },
+
+  observe : function (subject, topic, data) {
+    let doc = getDialogDoc();
+    if (doc)
+      handleDialog(doc);
+    else
+      startCallbackTimer(); // try again in a bit
+  }
+};
+
+function startCallbackTimer() {
+   // Delay before the callback twiddles the prompt.
+   const dialogDelay = 10;
+
+   // Use a timer to invoke a callback to twiddle the authentication dialog
+   let timer = Cc["@mozilla.org/timer;1"].createInstance(Ci.nsITimer);
+   timer.init(observer, dialogDelay, Ci.nsITimer.TYPE_ONE_SHOT);
+}
+
+function getDialogDoc() {
+  // Find the <browser> which contains notifyWindow, by looking
+  // through all the open windows and all the <browsers> in each.
+  let wm = Cc["@mozilla.org/appshell/window-mediator;1"].
+            getService(Ci.nsIWindowMediator);
+  let enumerator = wm.getXULWindowEnumerator(null);
+
+   while (enumerator.hasMoreElements()) {
+     let win = enumerator.getNext();
+     let windowDocShell = win.QueryInterface(Ci.nsIXULWindow).docShell;
+ 
+     let containedDocShells = windowDocShell.getDocShellEnumerator(
+                                Ci.nsIDocShellTreeItem.typeChrome,
+                                Ci.nsIDocShell.ENUMERATE_FORWARDS);
+     while (containedDocShells.hasMoreElements()) {
+       // Get the corresponding document for this docshell
+       let childDocShell = containedDocShells.getNext();
+       // We don't want it if it's not done loading.
+       if (childDocShell.busyFlags != Ci.nsIDocShell.BUSY_FLAGS_NONE)
+         continue;
+       let childDoc = childDocShell.QueryInterface(Ci.nsIDocShell).
+                      contentViewer.DOMDocument;
+
+       if (childDoc.location.href == "chrome://global/content/commonDialog.xul")
+         return childDoc;
+     }
+   }
+ 
+  return null;
+}
diff --git a/browser/base/content/test/tabview/test_bug599626.html b/browser/base/content/test/tabview/test_bug599626.html
new file mode 100644
index 000000000000..590276e6aada
--- /dev/null
+++ b/browser/base/content/test/tabview/test_bug599626.html
@@ -0,0 +1,10 @@
+<html>
+  <script>
+  window.onbeforeunload = function(event){
+    event.returnValue = 'Confirmation? ';
+  }
+  </script>
+  <body>
+    Test page
+  </body>
+</html>
diff --git a/browser/base/content/urlbarBindings.xml b/browser/base/content/urlbarBindings.xml
index 55acac66f865..d6a4a4bf5c05 100644
--- a/browser/base/content/urlbarBindings.xml
+++ b/browser/base/content/urlbarBindings.xml
@@ -200,6 +200,7 @@
       <method name="onBeforeValueSet">
         <parameter name="aValue"/>
         <body><![CDATA[
+          this._hideOverLink();
           this._value = aValue;
           var returnValue = aValue;
           var action = this._parseActionUrl(aValue);
@@ -642,19 +643,21 @@
       <method name="setOverLink">
         <parameter name="aURL"/>
         <body><![CDATA[
-          // If the over-link is already scheduled to appear or hide, cancel it.
-          if (this._overLinkDelayTimer) {
-            clearTimeout(this._overLinkDelayTimer);
-            this._overLinkDelayTimer = null;
+          this._cancelOverLinkDelayTimer();
+
+          // Hide the over-link immediately if necessary.
+          if (!aURL && (XULBrowserWindow.hideOverLinkImmediately ||
+                        this._hideOverLinkImmediately)) {
+            this._setOverLinkState(null);
+            return;
           }
 
-          // Hide the over-link if aURL is falsey or if the URL bar is focused.
-          if (!aURL || this.focused) {
+          // If aURL is falsey, fade it out after a delay.  This happens on
+          // mouseout for example.
+          if (!aURL) {
             this._overLinkDelayTimer = setTimeout(function overLinkOut(self) {
               self._overLinkDelayTimer = null;
-              let style = window.getComputedStyle(self._overLinkBox, null);
-              self._overLinkTransitioning = style.opacity != 0;
-              self.removeAttribute("overlinkstate");
+              self._setOverLinkState("fade-out");
             }, this._overLinkOutDelay, this);
             return;
           }
@@ -662,8 +665,7 @@
           // If it's in transition, update and show it immediately.
           if (this._overLinkTransitioning) {
             this._updateOverLink(aURL);
-            this._overLinkTransitioning = false;
-            this.setAttribute("overlinkstate", "showing");
+            this._setOverLinkState("showing");
             return;
           }
 
@@ -673,13 +675,54 @@
           this._overLinkDelayTimer = setTimeout(function overLinkIn(self) {
             self._overLinkDelayTimer = null;
             self._updateOverLink(aURL);
-            let style = window.getComputedStyle(self._overLinkBox, null);
-            self._overLinkTransitioning = style.opacity != 1;
-            self.setAttribute("overlinkstate", "fade-in");
+            self._setOverLinkState("fade-in");
           }, this._overLinkInDelay, this);
         ]]></body>
       </method>
 
+      <method name="_hideOverLink">
+        <body><![CDATA[
+          this._hideOverLinkImmediately = true;
+          this.setOverLink("");
+          this._hideOverLinkImmediately = false;
+        ]]></body>
+      </method>
+
+      <method name="_cancelOverLinkDelayTimer">
+        <body><![CDATA[
+          if (this._overLinkDelayTimer) {
+            clearTimeout(this._overLinkDelayTimer);
+            this._overLinkDelayTimer = null;
+          }
+        ]]></body>
+      </method>
+
+      <method name="_setOverLinkState">
+        <parameter name="aVal"/>
+        <body><![CDATA[
+          switch (aVal) {
+          case "fade-in":
+            var style = window.getComputedStyle(this._overLinkBox);
+            this._overLinkTransitioning = style.opacity != 1;
+            this.setAttribute("overlinkstate", aVal);
+            break;
+          case "fade-out":
+            style = window.getComputedStyle(this._overLinkBox);
+            this._overLinkTransitioning = style.opacity != 0;
+            this.setAttribute("overlinkstate", aVal);
+            break;
+          case "showing":
+            this._overLinkTransitioning = false;
+            this.setAttribute("overlinkstate", aVal);
+            break;
+          default:
+            this._overLinkTransitioning = false;
+            this.removeAttribute("overlinkstate");
+            break;
+          }
+        ]]></body>
+      </method>
+
       <method name="_updateOverLink">
         <parameter name="aURL"/>
         <body><![CDATA[
@@ -761,8 +804,8 @@
       ]]></handler>
 
       <handler event="focus" phase="capturing"><![CDATA[
+        this._hideOverLink();
         this._hideURLTooltip();
-        this.setOverLink(null);
       ]]></handler>
 
       <handler event="dragover" phase="capturing" action="this.onDragOver(event, this);"/>
diff --git a/browser/components/places/tests/browser/browser_sidebarpanels_click.js b/browser/components/places/tests/browser/browser_sidebarpanels_click.js
index 026548142059..a77baf06adbb 100644
--- a/browser/components/places/tests/browser/browser_sidebarpanels_click.js
+++ b/browser/components/places/tests/browser/browser_sidebarpanels_click.js
@@ -45,8 +45,8 @@ function test() {
   const HISTORY_SIDEBAR_TREE_ID = "historyTree";
 
   // Initialization.
-  let ww = Cc["@mozilla.org/embedcomp/window-watcher;1"].
-           getService(Ci.nsIWindowWatcher);
+  let os = Cc["@mozilla.org/observer-service;1"].
+           getService(Ci.nsIObserverService);
   let bs = PlacesUtils.bookmarks;
   let hs = PlacesUtils.history;
   let sidebarBox = document.getElementById("sidebar-box");
@@ -125,22 +125,20 @@ function test() {
           preFunc();
 
         function observer(aSubject, aTopic, aData) {
-          if (aTopic != "domwindowopened")
-            return;
-          ww.unregisterNotification(observer);
-          let alertDialog = aSubject.QueryInterface(Ci.nsIDOMWindow);
-          alertDialog.addEventListener("load", function () {
-            alertDialog.removeEventListener("load", arguments.callee, false);
-            info("alert dialog observed as expected");
-            executeSoon(function () {
-              alertDialog.close();
+          info("alert dialog observed as expected");
+          os.removeObserver(observer, "common-dialog-loaded");
+          os.removeObserver(observer, "tabmodal-dialog-loaded");
+
+          aSubject.Dialog.ui.button0.click();
+
+          executeSoon(function () {
               toggleSidebar(currentTest.sidebarName);
               currentTest.cleanup();
               postFunc();
             });
-          }, false);
         }
-        ww.registerNotification(observer);
+        os.addObserver(observer, "common-dialog-loaded", false);
+        os.addObserver(observer, "tabmodal-dialog-loaded", false);
 
         // Select the inserted places item.
         currentTest.selectNode(tree);
@@ -160,7 +158,7 @@ function test() {
         y = y.value + height.value / 2;
         // Simulate the click.
         EventUtils.synthesizeMouse(tree.body, x, y, {}, doc.defaultView);
-        // Now, wait for the domwindowopened observer to catch the alert dialog.
+        // Now, wait for the observer to catch the alert dialog.
         // If something goes wrong, the test will time out at this stage.
         // Note that for the history sidebar, the URL itself is not opened,
         // and Places will show the load-js-data-url-error prompt as an alert
diff --git a/browser/components/sessionstore/test/browser/browser_586068-cascaded_restore.js b/browser/components/sessionstore/test/browser/browser_586068-cascaded_restore.js
index 3d6432aefe84..b2c8a7f64365 100644
--- a/browser/components/sessionstore/test/browser/browser_586068-cascaded_restore.js
+++ b/browser/components/sessionstore/test/browser/browser_586068-cascaded_restore.js
@@ -69,10 +69,20 @@ function runNextTest() {
 
   // set an empty state & run the next test, or finish
   if (tests.length) {
+    // Enumerate windows and close everything but our primary window. We can't
+    // use waitForFocus() because apparently it's buggy. See bug 599253.
+    var windowsEnum = Services.wm.getEnumerator("navigator:browser");
+    while (windowsEnum.hasMoreElements()) {
+      var currentWindow = windowsEnum.getNext();
+      if (currentWindow != window) {
+        currentWindow.close();
+      }
+    }
+
     ss.setBrowserState(JSON.stringify({ windows: [{ tabs: [{ url: 'about:blank' }] }] }));
-    let test = tests.shift();
-    info("running " + test.name);
-    executeSoon(test);
+    let currentTest = tests.shift();
+    info("running " + currentTest.name);
+    executeSoon(currentTest);
   }
   else {
     ss.setBrowserState(stateBackup);
diff --git a/browser/themes/winstripe/browser/browser-aero.css b/browser/themes/winstripe/browser/browser-aero.css
index bb0419952fc3..df3dcb5aeaa2 100644
--- a/browser/themes/winstripe/browser/browser-aero.css
+++ b/browser/themes/winstripe/browser/browser-aero.css
@@ -105,7 +105,7 @@
     margin-top: -1px;
   }
 
-  #main-window[sizemode="normal"] > #titlebar > #titlebar-content > #titlebar-buttonbox:-moz-lwtheme {
+  #main-window[sizemode="normal"] #titlebar-buttonbox:-moz-lwtheme {
     margin-top: -2px;
   }
 
diff --git a/browser/themes/winstripe/browser/browser.css b/browser/themes/winstripe/browser/browser.css
index 227940dc9aa6..44786e53c8a5 100644
--- a/browser/themes/winstripe/browser/browser.css
+++ b/browser/themes/winstripe/browser/browser.css
@@ -325,7 +325,7 @@
   -moz-appearance: -moz-window-button-box;
 }
 
-#main-window[sizemode="maximized"] > #titlebar > #titlebar-content > #titlebar-buttonbox {
+#main-window[sizemode="maximized"] #titlebar-buttonbox {
   -moz-appearance: -moz-window-button-box-maximized;
 }
 
@@ -339,7 +339,7 @@
   -moz-appearance: -moz-window-button-maximize;
 }
 
-#main-window[sizemode="maximized"] > #titlebar > #titlebar-content > #titlebar-buttonbox > #titlebar-max {
+#main-window[sizemode="maximized"] #titlebar-max {
   -moz-appearance: -moz-window-button-restore;
 }
 
@@ -1412,10 +1412,6 @@ richlistitem[type~="action"][actiontype="switchtab"] > .ac-url-box > .ac-action-
   padding-bottom: 1px;
 }
 
-.tabbrowser-tabs:-moz-system-metric(touch-enabled) {
-  min-height: 7.3mozmm;
-}
-
 /* Tabs */
 .tabbrowser-tab,
 .tabs-newtab-button {
@@ -1558,6 +1554,10 @@ richlistitem[type~="action"][actiontype="switchtab"] > .ac-url-box > .ac-action-
   .tabs-newtab-button {
     min-width: 10mozmm;
   }
+
+  .tab-content {
+    min-height: -moz-calc(6.8mozmm - 7px); /* subtract borders from the desired height */
+  }
 }
 
 .tabbrowser-arrowscrollbox > .scrollbutton-up,
diff --git a/build/mobile/devicemanager.py b/build/mobile/devicemanager.py
index 712fcb304bbb..8dbf4f8bb636 100644
--- a/build/mobile/devicemanager.py
+++ b/build/mobile/devicemanager.py
@@ -37,6 +37,7 @@
 # ***** END LICENSE BLOCK *****
 
 import socket
+import SocketServer
 import time, datetime
 import os
 import re
@@ -58,14 +59,14 @@ class FileError(Exception):
 class DeviceManager:
   host = ''
   port = 0
-  debug = 2
+  debug = 2 
   _redo = False
   deviceRoot = None
   tempRoot = os.getcwd()
   base_prompt = '\$\>'
   prompt_sep = '\x00'
   prompt_regex = '.*' + base_prompt + prompt_sep
-  agentErrorRE = re.compile('^##AGENT-ERROR##.*')
+  agentErrorRE = re.compile('^##AGENT-WARNING##.*')
 
   def __init__(self, host, port = 20701):
     self.host = host
@@ -272,7 +273,10 @@ class DeviceManager:
       return None
   
   def mkDir(self, name):
-    return self.sendCMD(['mkdr ' + name])
+    if (self.dirExists(name)):
+      return name
+    else:
+      return self.sendCMD(['mkdr ' + name])
   
   # make directory structure on the device
   def mkDirs(self, filename):
@@ -306,7 +310,9 @@ class DeviceManager:
     match = ".*" + dirname + "$"
     dirre = re.compile(match)
     data = self.sendCMD(['cd ' + dirname, 'cwd'])
-    if (data == None):
+    # Because this is a compound command, cd can fail while cwd can succeed, 
+    # we should check for agent error directly
+    if (data == None or self.agentErrorRE.match(data) ):
       return None
     retVal = self.stripPrompt(data)
     data = retVal.split('\n')
@@ -549,11 +555,12 @@ class DeviceManager:
   #       /reftest
   #       /mochitest
   def getDeviceRoot(self):
-    if (not self.deviceRoot):
-      data = self.sendCMD(['testroot'])
-      if (data == None):
-        return '/tests'
-      self.deviceRoot = self.stripPrompt(data).strip('\n') + '/tests'
+    # This caching of deviceRoot is causing issues if things fail
+    # if (not self.deviceRoot):
+    data = self.sendCMD(['testroot'])
+    if (data == None):
+      return '/tests'
+    self.deviceRoot = self.stripPrompt(data).strip('\n') + '/tests'
 
     if (not self.dirExists(self.deviceRoot)):
       self.mkDir(self.deviceRoot)
@@ -690,8 +697,8 @@ class DeviceManager:
   Application bundle - path to the application bundle on the device
   Destination - destination directory of where application should be
                 installed to (optional)
-  Returns True or False depending on what we get back
-  TODO: we need a real way to know if this works or not
+  Returns None for success, or output if known failure
+  TODO: we need a better way to know if this works or not
   """
   def installApp(self, appBundlePath, destPath=None):
     cmd = 'inst ' + appBundlePath
@@ -699,9 +706,13 @@ class DeviceManager:
       cmd += ' ' + destPath
     data = self.sendCMD([cmd])
     if (data is None):
-      return False
-    else:
-      return True
+      return None
+    
+    f = re.compile('Failure')
+    for line in data.split():
+      if (f.match(line)):
+        return data
+    return None
 
   """
   Uninstalls the named application from device and causes a reboot.
@@ -714,9 +725,53 @@ class DeviceManager:
     cmd = 'uninst ' + appName
     if installPath:
       cmd += ' ' + installPath
-    self.sendCMD([cmd])
+    data = self.sendCMD([cmd])
+    if (self.debug > 3): print "uninstallAppAndReboot: " + str(data)
     return True
 
+  """
+  Updates the application on the device.
+  Application bundle - path to the application bundle on the device
+  Process name of application - used to end the process if the applicaiton is
+                                currently running
+  Destination - Destination directory to where the application should be
+                installed (optional)
+  ipAddr - IP address to await a callback ping to let us know that the device has updated
+           properly - defaults to current IP.
+  port - port to await a callback ping to let us know that the device has updated properly
+         defaults to 30000, and counts up from there if it finds a conflict
+  Returns True if succeeds, False if not
+  
+  NOTE: We have no real way to know if the device gets updated or not due to the
+        reboot that the udpate call forces on us.  We can't install our own heartbeat
+        listener here because we run the risk of racing with other heartbeat listeners.
+  """
+  def updateApp(self, appBundlePath, processName=None, destPath=None, ipAddr=None, port=None):
+    status = None
+    cmd = 'updt '
+    if (processName == None):
+      # Then we pass '' for processName
+      cmd += "'' " + appBundlePath
+    else:
+      cmd += processName + ' ' + appBundlePath
+
+    if (destPath):
+      cmd += " " + destPath
+
+    ip, port = self.getCallbackIpAndPort(ipAddr, 30000)
+
+    cmd += " %s %s" % (ip, port)
+
+    if (self.debug > 3): print "updateApp using command: " + str(cmd)
+
+    # Set up our callback server
+    callbacksvr = callbackServer(ip, port, self.debug)
+    data = self.sendCMD([cmd])
+    status = callbacksvr.disconnect()
+    if (self.debug > 3): print "got status back: " + str(status)
+
+    return status
+
   """
     return the current time on the device
   """
@@ -726,3 +781,112 @@ class DeviceManager:
       return None
     return self.stripPrompt(data).strip('\n')
 
+  """
+    Connect the ipaddress and port for a callback ping.  Defaults to current IP address
+    And ports starting at 30000.
+    NOTE: the detection for current IP address only works on Linux!
+  """
+  def getCallbackIpAndPort(self, aIp, aPort):
+    ip = aIp
+    nettools = NetworkTools()
+    if (ip == None):
+      ip = nettools.getLanIp()
+    if (aPort != None):
+      port = nettools.findOpenPort(ip, aPort)
+    else:
+      port = nettools.findOpenPort(ip, 30000)
+    return ip, port
+
+gCallbackData = ''
+
+class callbackServer():
+  def __init__(self, ip, port, debuglevel):
+    self.ip = ip
+    self.port = port
+    self.connected = False
+    self.debug = debuglevel
+    if (self.debug > 3) : print "Creating server with " + str(ip) + ":" + str(port)
+    self.server = SocketServer.TCPServer((ip, port), self.myhandler)
+    self.server_thread = Thread(target=self.server.serve_forever) 
+    self.server_thread.setDaemon(True)
+    self.server_thread.start()
+
+  def disconnect(self, step = 60, timeout = 600):
+    t = 0
+    if (self.debug > 3): print "Calling disconnect on callback server"
+    while t < timeout:
+      if (gCallbackData):
+        # Got the data back
+        if (self.debug > 3): print "Got data back from agent: " + str(gCallbackData)
+        break
+      time.sleep(step)
+      t += step
+
+    try:
+      if (self.debug > 3): print "Shutting down server now"
+      self.server.shutdown()
+    except:
+      print "Unable to shutdown callback server - check for a connection on port: " + str(self.port)
+    return gCallbackData
+
+  class myhandler(SocketServer.BaseRequestHandler):
+    def handle(self):
+      global gCallbackData
+      gCallbackData = self.request.recv(1024)
+      #print "Callback Handler got data: " + str(gCallbackData)
+      self.request.send("OK")
+  
+class NetworkTools:
+  def __init__(self):
+    pass
+
+  # Utilities to get the local ip address
+  def getInterfaceIp(self, ifname):
+    if os.name != "nt":
+      import fcntl
+      import struct
+      s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+      return socket.inet_ntoa(fcntl.ioctl(
+                              s.fileno(),
+                              0x8915,  # SIOCGIFADDR
+                              struct.pack('256s', ifname[:15])
+                              )[20:24])
+    else:
+      return None
+
+  def getLanIp(self):
+    ip = socket.gethostbyname(socket.gethostname())
+    if ip.startswith("127.") and os.name != "nt":
+      interfaces = ["eth0","eth1","eth2","wlan0","wlan1","wifi0","ath0","ath1","ppp0"]
+      for ifname in interfaces:
+        try:
+          ip = self.getInterfaceIp(ifname)
+          break;
+        except IOError:
+          pass
+    return ip
+
+  # Gets an open port starting with the seed by incrementing by 1 each time
+  def findOpenPort(self, ip, seed):
+    try:
+      s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+      s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+      connected = False
+      if isinstance(seed, basestring):
+        seed = int(seed)
+      maxportnum = seed + 5000 # We will try at most 5000 ports to find an open one
+      while not connected:
+        try:
+          s.bind((ip, seed))
+          connected = True
+          s.close()
+        except:          
+          if seed > maxportnum:
+            print "Could not find open port after checking 5000 ports"
+          raise
+        seed += 1
+    except:
+      print "Socket error trying to find open port"
+        
+    return seed
+    
diff --git a/build/mobile/remoteautomation.py b/build/mobile/remoteautomation.py
index 138033f30bad..846d24ffa77d 100644
--- a/build/mobile/remoteautomation.py
+++ b/build/mobile/remoteautomation.py
@@ -42,7 +42,7 @@ import os
 import socket
 
 from automation import Automation
-from devicemanager import DeviceManager
+from devicemanager import DeviceManager, NetworkTools
 
 class RemoteAutomation(Automation):
     _devicemanager = None
@@ -99,31 +99,9 @@ class RemoteAutomation(Automation):
 #        return app, ['--environ:NO_EM_RESTART=1'] + args
         return app, args
 
-    # Utilities to get the local ip address
-    def getInterfaceIp(self, ifname):
-        if os.name != "nt":
-            import fcntl
-            import struct
-            s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-            return socket.inet_ntoa(fcntl.ioctl(
-                                    s.fileno(),
-                                    0x8915,  # SIOCGIFADDR
-                                    struct.pack('256s', ifname[:15])
-                                    )[20:24])
-        else:
-            return None
-
     def getLanIp(self):
-        ip = socket.gethostbyname(socket.gethostname())
-        if ip.startswith("127.") and os.name != "nt":
-            interfaces = ["eth0","eth1","eth2","wlan0","wlan1","wifi0","ath0","ath1","ppp0"]
-            for ifname in interfaces:
-                try:
-                    ip = self.getInterfaceIp(ifname)
-                    break;
-                except IOError:
-                    pass
-        return ip
+        nettools = NetworkTools()
+        return nettools.getLanIp()
 
     def Process(self, cmd, stdout = None, stderr = None, env = None, cwd = '.'):
         if stdout == None or stdout == -1:
@@ -176,4 +154,3 @@ class RemoteAutomation(Automation):
  
         def kill(self):
             self.dm.killProcess(self.procName)
-
diff --git a/build/unix/gnu-ld-scripts/components-mapfile b/build/unix/gnu-ld-scripts/components-mapfile
index e9286d711609..afa463230671 100644
--- a/build/unix/gnu-ld-scripts/components-mapfile
+++ b/build/unix/gnu-ld-scripts/components-mapfile
@@ -1,5 +1,6 @@
 {
    global:
 		NSModule;
+		NSGetModule;
    local: *;
 };
diff --git a/build/unix/gnu-ld-scripts/components-version-script b/build/unix/gnu-ld-scripts/components-version-script
index 1fb7fc8e859c..6487671a4498 100644
--- a/build/unix/gnu-ld-scripts/components-version-script
+++ b/build/unix/gnu-ld-scripts/components-version-script
@@ -1,5 +1,6 @@
 EXPORTED {
    global:
 		NSModule;
+		NSGetModule;
    local: *;
 };
diff --git a/build/unix/gnu-ld-scripts/jemalloc-standalone-linkage-version-script b/build/unix/gnu-ld-scripts/jemalloc-standalone-linkage-version-script
new file mode 100644
index 000000000000..59b3a4c1e669
--- /dev/null
+++ b/build/unix/gnu-ld-scripts/jemalloc-standalone-linkage-version-script
@@ -0,0 +1,19 @@
+{
+   global:
+		_malloc_postfork;
+		_malloc_prefork;
+		jemalloc_stats;
+		malloc_usable_size;
+		posix_memalign;
+		free;
+		realloc;
+		calloc;
+		malloc;
+		memalign;
+		valloc;
+		__free_hook;
+		__malloc_hook;
+		__realloc_hook;
+		__memalign_hook;
+   local: *;
+};
diff --git a/caps/src/nsScriptSecurityManager.cpp b/caps/src/nsScriptSecurityManager.cpp
index 273c1b09a3b7..ebe11885d216 100644
--- a/caps/src/nsScriptSecurityManager.cpp
+++ b/caps/src/nsScriptSecurityManager.cpp
@@ -106,12 +106,6 @@ nsIStringBundle *nsScriptSecurityManager::sStrBundle = nsnull;
 JSRuntime       *nsScriptSecurityManager::sRuntime   = 0;
 PRBool nsScriptSecurityManager::sStrictFileOriginPolicy = PR_TRUE;
 
-// Info we need about the JSClasses used by XPConnects wrapped
-// natives, to avoid having to QI to nsIXPConnectWrappedNative all the
-// time when doing security checks.
-static JSEqualityOp sXPCWrappedNativeEqualityOps;
-
-
 ///////////////////////////
 // Convenience Functions //
 ///////////////////////////
@@ -2414,11 +2408,8 @@ nsScriptSecurityManager::doGetObjectPrincipal(JSObject *aObj
     do {
         // Note: jsClass is set before this loop, and also at the
         // *end* of this loop.
-
-        // NOTE: These class and equality hook checks better match
-        // what IS_WRAPPER_CLASS() does in xpconnect!
         
-        if (jsClass->ext.equality == js::Valueify(sXPCWrappedNativeEqualityOps)) {
+        if (IS_WRAPPER_CLASS(jsClass)) {
             result = sXPConnect->GetPrincipal(aObj,
 #ifdef DEBUG
                                               aAllowShortCircuit
@@ -3423,7 +3414,6 @@ nsresult nsScriptSecurityManager::Init()
     JS_SetRuntimeSecurityCallbacks(sRuntime, &securityCallbacks);
     NS_ASSERTION(!oldcallbacks, "Someone else set security callbacks!");
 
-    sXPConnect->GetXPCWrappedNativeJSClassInfo(&sXPCWrappedNativeEqualityOps);
     return NS_OK;
 }
 
diff --git a/caps/tests/Makefile.in b/caps/tests/Makefile.in
index 817c101472d8..f78ff7f45041 100644
--- a/caps/tests/Makefile.in
+++ b/caps/tests/Makefile.in
@@ -43,6 +43,6 @@ VPATH		= @srcdir@
 
 include $(DEPTH)/config/autoconf.mk
 
-DIRS = mochitest browser
+DIRS = mochitest
 
 include $(topsrcdir)/config/rules.mk
diff --git a/caps/tests/browser/Makefile.in b/caps/tests/browser/Makefile.in
deleted file mode 100644
index 7a4c6030dbb0..000000000000
--- a/caps/tests/browser/Makefile.in
+++ /dev/null
@@ -1,54 +0,0 @@
-#
-# ***** BEGIN LICENSE BLOCK *****
-# Version: MPL 1.1/GPL 2.0/LGPL 2.1
-#
-# The contents of this file are subject to the Mozilla Public License Version
-# 1.1 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-# http://www.mozilla.org/MPL/
-#
-# Software distributed under the License is distributed on an "AS IS" basis,
-# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-# for the specific language governing rights and limitations under the
-# License.
-#
-# The Original Code is mozilla.org code.
-#
-# The Initial Developer of the Original Code is
-# the Mozilla Foundation.
-# Portions created by the Initial Developer are Copyright (C) 2010
-# the Initial Developer. All Rights Reserved.
-#
-# Contributor(s):
-#   Justin Lebar <justin.lebar@gmail.com>
-#
-# Alternatively, the contents of this file may be used under the terms of
-# either of the GNU General Public License Version 2 or later (the "GPL"),
-# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-# in which case the provisions of the GPL or the LGPL are applicable instead
-# of those above. If you wish to allow use of your version of this file only
-# under the terms of either the GPL or the LGPL, and not to allow others to
-# use your version of this file under the terms of the MPL, indicate your
-# decision by deleting the provisions above and replace them with the notice
-# and other provisions required by the GPL or the LGPL. If you do not delete
-# the provisions above, a recipient may use your version of this file under
-# the terms of any one of the MPL, the GPL or the LGPL.
-#
-# ***** END LICENSE BLOCK *****
-
-DEPTH		= ../../..
-topsrcdir	= @top_srcdir@
-srcdir		= @srcdir@
-VPATH		= @srcdir@
-relativesrcdir = caps/tests/browser
-
-include $(DEPTH)/config/autoconf.mk
-
-include $(topsrcdir)/config/rules.mk
-
-_BROWSER_TEST_FILES = \
-  browser_bug571289.js \
-  $(NULL)
-
-libs:: $(_BROWSER_TEST_FILES)
-	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/browser/$(relativesrcdir)
diff --git a/caps/tests/browser/browser_bug571289.js b/caps/tests/browser/browser_bug571289.js
deleted file mode 100644
index fb3967486bd0..000000000000
--- a/caps/tests/browser/browser_bug571289.js
+++ /dev/null
@@ -1,24 +0,0 @@
-function test() {
-  // Access an xpcom component from off the main thread.
-
-  let threadman = Components.classes["@mozilla.org/thread-manager;1"].
-                             getService(Ci.nsIThreadManager);
-  let thread = threadman.newThread(0);
-
-  thread.dispatch(
-    function() {
-      // Get another handle on the thread manager, this time from within the
-      // thread we created.
-      let threadman2 = Components.classes["@mozilla.org/thread-manager;1"].
-                                  getService(Ci.nsIThreadManager);
-
-      // Now do something with the thread manager.  It doesn't really matter
-      // what we do.
-      if (threadman2.mainThread == threadman2.currentThread)
-        ok(false, "Shouldn't be on the main thread.");
-
-    }, 1); // dispatch sync
-
-  thread.shutdown();
-  ok(true, "Done!");
-}
diff --git a/config/autoconf.mk.in b/config/autoconf.mk.in
index 72df00d7df49..78ffd066ec59 100644
--- a/config/autoconf.mk.in
+++ b/config/autoconf.mk.in
@@ -171,6 +171,7 @@ VPX_ASM_SUFFIX = @VPX_ASM_SUFFIX@
 VPX_X86_ASM = @VPX_X86_ASM@
 VPX_ARM_ASM = @VPX_ARM_ASM@
 NS_PRINTING = @NS_PRINTING@
+MOZ_PDF_PRINTING = @MOZ_PDF_PRINTING@
 MOZ_CRASHREPORTER = @MOZ_CRASHREPORTER@
 MOZ_HELP_VIEWER = @MOZ_HELP_VIEWER@
 MOC= @MOC@
@@ -195,6 +196,7 @@ RM = rm -f
 MOZ_UI_LOCALE = @MOZ_UI_LOCALE@
 
 MOZ_COMPONENTS_VERSION_SCRIPT_LDFLAGS = @MOZ_COMPONENTS_VERSION_SCRIPT_LDFLAGS@
+MOZ_JEMALLOC_STANDALONE_GLUE_LDOPTS = @MOZ_JEMALLOC_STANDALONE_GLUE_LDOPTS@
 MOZ_COMPONENT_NSPR_LIBS=@MOZ_COMPONENT_NSPR_LIBS@
 
 MOZ_FIX_LINK_PATHS=@MOZ_FIX_LINK_PATHS@
diff --git a/config/config.mk b/config/config.mk
index 95232c01bfdc..85698d62fb1b 100644
--- a/config/config.mk
+++ b/config/config.mk
@@ -162,6 +162,11 @@ MOZ_WIDGET_SUPPORT_LIBS    = $(DIST)/lib/$(LIB_PREFIX)widgetsupport_s.$(LIB_SUFF
 ifdef MOZ_MEMORY
 ifneq (,$(filter-out WINNT WINCE,$(OS_ARCH)))
 JEMALLOC_LIBS = $(MKSHLIB_FORCE_ALL) $(call EXPAND_MOZLIBNAME,jemalloc) $(MKSHLIB_UNFORCE_ALL)
+# If we are linking jemalloc into a program, we want the jemalloc symbols
+# to be exported
+ifneq (,$(SIMPLE_PROGRAMS)$(PROGRAM))
+JEMALLOC_LIBS += $(MOZ_JEMALLOC_STANDALONE_GLUE_LDOPTS)
+endif
 endif
 endif
 
diff --git a/configure.in b/configure.in
index 35401e77c334..0646e498b78e 100644
--- a/configure.in
+++ b/configure.in
@@ -301,8 +301,8 @@ if test "$target" = "arm-android-eabi" ; then
     STRIP="$android_toolchain"/bin/arm-eabi-strip
 
     CPPFLAGS="-I$android_platform/usr/include $CPPFLAGS"
-    CFLAGS="-mandroid -I$android_platform/usr/include -msoft-float -fno-short-enums -fno-exceptions -march=armv5te -mthumb-interwork $CFLAGS"
-    CXXFLAGS="-mandroid -I$android_platform/usr/include -msoft-float -fno-short-enums -fno-exceptions -march=armv5te -mthumb-interwork $CXXFLAGS"
+    CFLAGS="-mandroid -I$android_platform/usr/include -msoft-float -fno-short-enums -fno-exceptions $CFLAGS"
+    CXXFLAGS="-mandroid -I$android_platform/usr/include -msoft-float -fno-short-enums -fno-exceptions $CXXFLAGS"
 
     dnl Add -llog by default, since we use it all over the place.
     dnl Add --allow-shlib-undefined, because libGLESv2 links to an
@@ -2415,7 +2415,7 @@ ia64*-hpux*)
         LIBXUL_LIBS='$(LIBXUL_DIST)/lib/xpcom.lib $(LIBXUL_DIST)/lib/xul.lib $(LIBXUL_DIST)/lib/mozalloc.lib'
         MOZ_COMPONENT_NSPR_LIBS='$(NSPR_LIBS)'
         if test $_MSC_VER -ge 1400; then
-            LDFLAGS="$LDFLAGS -NXCOMPAT"
+            LDFLAGS="$LDFLAGS -LARGEADDRESSAWARE -NXCOMPAT"
             dnl For profile-guided optimization
             PROFILE_GEN_CFLAGS="-GL"
             PROFILE_GEN_LDFLAGS="-LTCG:PGINSTRUMENT"
@@ -2893,11 +2893,13 @@ esac
 AC_SUBST(NO_LD_ARCHIVE_FLAGS)
 
 dnl ========================================================
-dnl = Flags to strip unused symbols from .so components
+dnl = Flags to strip unused symbols from .so components and
+dnl = to export jemalloc symbols when linking a program
 dnl ========================================================
 case "$target" in
     *-linux*|*-kfreebsd*-gnu|*-gnu*)
         MOZ_COMPONENTS_VERSION_SCRIPT_LDFLAGS='-Wl,--version-script -Wl,$(BUILD_TOOLS)/gnu-ld-scripts/components-version-script'
+        MOZ_JEMALLOC_STANDALONE_GLUE_LDOPTS='-rdynamic -Wl,--version-script -Wl,$(BUILD_TOOLS)/gnu-ld-scripts/jemalloc-standalone-linkage-version-script'
         ;;
     *-solaris*)
         if test -z "$GNU_CC"; then
@@ -4992,6 +4994,7 @@ MOZ_XTF=1
 MOZ_XUL=1
 MOZ_ZIPWRITER=1
 NS_PRINTING=1
+MOZ_PDF_PRINTING=
 MOZ_DISABLE_DOMCRYPTO=
 NSS_DISABLE_DBM=
 NECKO_WIFI=1
@@ -5031,7 +5034,6 @@ case "${target}" in
         NSS_DISABLE_DBM=1
         USE_ARM_KUSER=1
         MOZ_INSTALLER=
-        NS_PRINTING=
         NECKO_WIFI=
         MOZ_THUMB2=1
         MOZ_THEME_FASTSTRIPE=1
@@ -5187,6 +5189,7 @@ cairo-windows)
         NS_PRINTING=
         ;;
     esac
+    MOZ_PDF_PRINTING=1
     ;;
 
 cairo-gtk2|cairo-gtk2-x11)
@@ -5203,6 +5206,7 @@ cairo-gtk2|cairo-gtk2-x11)
     TK_CFLAGS='$(MOZ_GTK2_CFLAGS)'
     TK_LIBS='$(MOZ_GTK2_LIBS)'
     AC_DEFINE(MOZ_WIDGET_GTK2)
+    MOZ_PDF_PRINTING=1
     ;;
 
 cairo-gtk2-dfb)
@@ -5220,6 +5224,7 @@ cairo-gtk2-dfb)
         AC_MSG_WARN([Disabling X when DirectFB is specified.])
         no_x=yes
     fi
+    MOZ_PDF_PRINTING=1
     ;;
 
 cairo-qt)
@@ -5237,6 +5242,7 @@ cairo-qt)
     TK_CFLAGS='$(MOZ_QT_CFLAGS)'
     TK_LIBS='$(MOZ_QT_LIBS)'
     AC_DEFINE(MOZ_WIDGET_QT)
+    MOZ_PDF_PRINTING=1
     ;;
 
 cairo-beos)
@@ -5251,6 +5257,7 @@ cairo-os2)
     USE_FC_FREETYPE=1
     TK_CFLAGS='$(MOZ_CAIRO_CFLAGS)'
     TK_LIBS='$(MOZ_CAIRO_LIBS)'
+    MOZ_PDF_PRINTING=1
     ;;
 
 cairo-cocoa)
@@ -5271,11 +5278,20 @@ cairo-cocoa)
 cairo-android)
     AC_DEFINE(MOZ_WIDGET_ANDROID)
     MOZ_WIDGET_TOOLKIT=android
+    TK_CFLAGS='$(MOZ_CAIRO_CFLAGS)'
+    TK_LIBS='$(MOZ_CAIRO_LIBS)'
     MOZ_WEBGL=1
+    MOZ_PDF_PRINTING=1
     ;;
 
 esac
 
+AC_SUBST(MOZ_PDF_PRINTING)
+if test "$MOZ_PDF_PRINTING"; then
+   PDF_SURFACE_FEATURE="#define CAIRO_HAS_PDF_SURFACE 1"
+   AC_DEFINE(MOZ_PDF_PRINTING)
+fi
+
 if test "$MOZ_ENABLE_XREMOTE"; then
     AC_DEFINE(MOZ_ENABLE_XREMOTE)
 fi
@@ -7098,6 +7114,16 @@ if test -n "$MOZ_THUMB2"; then
       AC_MSG_ERROR([--enable-thumb2 is not supported for non-ARM CPU architectures])
     ;;
   esac
+else
+  case "$target_cpu" in
+    arm*)
+      if test "$GNU_CC"; then
+       CFLAGS="$CFLAGS -march=armv5te -mthumb-interwork -Wa, -march=armv5te -Wa, -mthumb-interwork"
+        CXXFLAGS="$CXXFLAGS -march=armv5te -mthumb-interwork -Wa, -march=armv5te -Wa, -mthumb-interwork"
+        ASFLAGS="$ASFLAGS -march=armv5te -mthumb-interwork"
+      fi
+      ;;
+  esac
 fi
 
 AC_SUBST(MOZ_THUMB2)
@@ -8499,7 +8525,6 @@ if test "$MOZ_TREE_CAIRO"; then
         XLIB_SURFACE_FEATURE="#define CAIRO_HAS_XLIB_SURFACE 1"
         XLIB_XRENDER_SURFACE_FEATURE="#define CAIRO_HAS_XLIB_XRENDER_SURFACE 1"
         PS_SURFACE_FEATURE="#define CAIRO_HAS_PS_SURFACE 1"
-        PDF_SURFACE_FEATURE="#define CAIRO_HAS_PDF_SURFACE 1"
         FT_FONT_FEATURE="#define CAIRO_HAS_FT_FONT 1"
         MOZ_ENABLE_CAIRO_FT=1
         CAIRO_FT_CFLAGS="$FT2_CFLAGS"
@@ -8538,12 +8563,10 @@ if test "$MOZ_TREE_CAIRO"; then
           AC_CHECK_HEADER(d3d10.h, MOZ_ENABLE_D3D10_LAYER=1)
         fi
 
-        PDF_SURFACE_FEATURE="#define CAIRO_HAS_PDF_SURFACE 1"
     fi
     if test "$MOZ_WIDGET_TOOLKIT" = "os2"; then
         OS2_SURFACE_FEATURE="#define CAIRO_HAS_OS2_SURFACE 1"
         FT_FONT_FEATURE="#define CAIRO_HAS_FT_FONT 1"
-        PDF_SURFACE_FEATURE="#define CAIRO_HAS_PDF_SURFACE 1"
         MOZ_ENABLE_CAIRO_FT=1
         CAIRO_FT_CFLAGS="-I${MZFTCFGFT2}/include"
         CAIRO_FT_LIBS="-L${MZFTCFGFT2}/lib -lmozft -lmzfntcfg"
@@ -8924,6 +8947,7 @@ AC_SUBST(PKG_SKIP_STRIP)
 AC_SUBST(USE_ELF_DYNSTR_GC)
 AC_SUBST(INCREMENTAL_LINKER)
 AC_SUBST(MOZ_COMPONENTS_VERSION_SCRIPT_LDFLAGS)
+AC_SUBST(MOZ_JEMALLOC_STANDALONE_GLUE_LDOPTS)
 AC_SUBST(MOZ_COMPONENT_NSPR_LIBS)
 
 AC_SUBST(MOZ_FIX_LINK_PATHS)
diff --git a/content/base/crashtests/606729-1.html b/content/base/crashtests/606729-1.html
new file mode 100644
index 000000000000..c81479c20b2d
--- /dev/null
+++ b/content/base/crashtests/606729-1.html
@@ -0,0 +1 @@
+<script async src="data:">0</script>
diff --git a/content/base/crashtests/crashtests.list b/content/base/crashtests/crashtests.list
index b8d4b5f08710..a8e22a8632f0 100644
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@@ -74,3 +74,4 @@ load 582601.html
 load 575462.svg
 load 595606-1.html
 load 595606-2.html
+load 606729-1.html
diff --git a/content/base/public/nsIContentUtils.h b/content/base/public/nsIContentUtils.h
index 196d6bbd6715..34320650318f 100644
--- a/content/base/public/nsIContentUtils.h
+++ b/content/base/public/nsIContentUtils.h
@@ -42,6 +42,8 @@
 #include "nsAString.h"
 #include "nsMargin.h"
 
+class nsIInterfaceRequestor;
+
 // {3682DD99-8560-44f4-9B8F-CCCE9D7B96FB}
 #define NS_ICONTENTUTILS_IID \
 { 0x3682dd99, 0x8560, 0x44f4, \
@@ -71,4 +73,20 @@ public:
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsIContentUtils, NS_ICONTENTUTILS_IID)
 
+// {60083ad4-f7ed-488b-a706-bacb378fe1a5}
+#define NS_ICONTENTUTILS2_IID \
+{ 0x60083ad4, 0xf7ed, 0x488b, \
+{ 0xa7, 0x06, 0xba, 0xcb, 0x37, 0x8f, 0xe1, 0xa5 } }
+
+class nsIContentUtils2 : public nsISupports
+{
+public:
+  NS_DECLARE_STATIC_IID_ACCESSOR(NS_ICONTENTUTILS2_IID)
+  NS_DECL_ISUPPORTS
+
+  virtual nsIInterfaceRequestor* GetSameOriginChecker();
+};
+
+NS_DEFINE_STATIC_IID_ACCESSOR(nsIContentUtils2, NS_ICONTENTUTILS2_IID)
+
 #endif /* nsIContentUtils_h__ */
diff --git a/content/base/public/nsIScriptElement.h b/content/base/public/nsIScriptElement.h
index ded56f833142..2e65e514c34e 100644
--- a/content/base/public/nsIScriptElement.h
+++ b/content/base/public/nsIScriptElement.h
@@ -70,6 +70,7 @@ public:
       mFrozen(PR_FALSE),
       mDefer(PR_FALSE),
       mAsync(PR_FALSE),
+      mExternal(PR_FALSE),
       mParserCreated(aFromParser == mozilla::dom::FROM_PARSER_FRAGMENT ?
                      mozilla::dom::NOT_FROM_PARSER : aFromParser),
                      // Fragment parser-created scripts (if executable)
@@ -126,6 +127,15 @@ public:
     return mAsync;  
   }
 
+  /**
+   * Is the script an external script?
+   */
+  PRBool GetScriptExternal()
+  {
+    NS_PRECONDITION(mFrozen, "Not ready for this call yet!");
+    return mExternal;
+  }
+
   /**
    * Returns how the element was created.
    */
@@ -249,6 +259,12 @@ protected:
    */
   PRPackedBool mAsync;
   
+  /**
+   * The effective externalness. A script can be external with mUri being null
+   * if the src attribute contained an invalid URL string.
+   */
+  PRPackedBool mExternal;
+
   /**
    * Whether this element was parser-created.
    */
diff --git a/content/base/public/nsIScriptLoader.idl b/content/base/public/nsIScriptLoader.idl
deleted file mode 100644
index 9ca1281288a4..000000000000
--- a/content/base/public/nsIScriptLoader.idl
+++ /dev/null
@@ -1,106 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications.
- * Portions created by the Initial Developer are Copyright (C) 2001
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Vidur Apparao <vidur@netscape.com> (original author)
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#include "nsISupports.idl"
-
-interface nsIDocument;
-interface nsIScriptElement;
-interface nsIScriptLoaderObserver;
-
-[scriptable, uuid(339a4eb5-dac6-4034-8c43-f4f8c645ce57)]
-interface nsIScriptLoader : nsISupports {
-  /**
-   * Initialize loader with a document. The container of this document
-   * will be used for getting script evaluation information, including
-   * the context in which to do the evaluation. The loader maintains a 
-   * strong reference to the document.
-   *
-   * @param aDocument The document to use as the basis for script
-   *        processing.
-   */
-  void init(in nsIDocument aDocument);
-
-  /**
-   * The loader maintains a strong reference to the document with
-   * which it is initialized. This call forces the reference to
-   * be dropped.
-   */
-  void dropDocumentReference();
-
-  /**
-   * Add an observer for all scripts loaded through this loader.
-   *
-   * @param aObserver observer for all script processing.
-   */
-  void addObserver(in nsIScriptLoaderObserver aObserver);
-
-  /**
-   * Remove an observer.
-   *
-   * @param aObserver observer to be removed
-   */
-  void removeObserver(in nsIScriptLoaderObserver aObserver);
-  
-  /**
-   * Process a script element. This will include both loading the 
-   * source of the element if it is not inline and evaluating
-   * the script itself.
-   *
-   * @param aElement The element representing the script to be loaded and
-   *        evaluated.
-   * @param aObserver An observer for this script load only
-   *
-   */
-  void processScriptElement(in nsIScriptElement aElement,
-                            in nsIScriptLoaderObserver aObserver);
-
-  /**
-   * Gets the currently executing script. This is useful if you want to
-   * generate a unique key based on the currently executing script.
-   */
-  nsIScriptElement getCurrentScript();
-
-  /**
-   * Whether the loader is enabled or not.
-   * When disabled, processing of new script elements is disabled. 
-   * Any call to processScriptElement() will fail with a return code of
-   * NS_ERROR_NOT_AVAILABLE. Note that this DOES NOT disable
-   * currently loading or executing scripts.
-   */
-  attribute boolean enabled;
-};
diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
index 3f7b0e82c9d6..13df029ca44f 100644
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -592,6 +592,7 @@ nsContentUtils::InitializeEventTable() {
                                                 
     { nsGkAtoms::onpageshow,                    NS_PAGE_SHOW, EventNameType_HTML, NS_EVENT },
     { nsGkAtoms::onpagehide,                    NS_PAGE_HIDE, EventNameType_HTML, NS_EVENT },
+    { nsGkAtoms::onMozBeforeResize,             NS_BEFORERESIZE_EVENT, EventNameType_None, NS_EVENT },
     { nsGkAtoms::onresize,                      NS_RESIZE_EVENT,
                                                 (EventNameType_HTMLXUL | EventNameType_SVGSVG), NS_EVENT },
     { nsGkAtoms::onscroll,                      NS_SCROLL_EVENT,
@@ -5536,6 +5537,11 @@ nsContentUtils::WrapNative(JSContext *cx, JSObject *scope, nsISupports *native,
     return NS_OK;
   }
 
+  JSObject *wrapper = xpc_GetCachedSlimWrapper(cache, scope, vp);
+  if (wrapper) {
+    return NS_OK;
+  }
+
   NS_ENSURE_TRUE(sXPConnect && sThreadJSContextStack, NS_ERROR_UNEXPECTED);
 
   // Keep sXPConnect and sThreadJSContextStack alive. If we're on the main
@@ -6489,3 +6495,11 @@ nsIContentUtils::FindInternalContentViewer(const char* aType,
 
   return NULL;
 }
+
+NS_IMPL_ISUPPORTS1(nsIContentUtils2, nsIContentUtils2)
+
+nsIInterfaceRequestor*
+nsIContentUtils2::GetSameOriginChecker()
+{
+  return nsContentUtils::GetSameOriginChecker();
+}
diff --git a/content/base/src/nsGkAtomList.h b/content/base/src/nsGkAtomList.h
index e3e36306d1b5..7fe052fdb8b8 100644
--- a/content/base/src/nsGkAtomList.h
+++ b/content/base/src/nsGkAtomList.h
@@ -709,6 +709,7 @@ GK_ATOM(onpopupshown, "onpopupshown")
 GK_ATOM(onreadystatechange, "onreadystatechange")
 GK_ATOM(onRequest, "onRequest")
 GK_ATOM(onreset, "onreset")
+GK_ATOM(onMozBeforeResize, "onMozBeforeResize")
 GK_ATOM(onresize, "onresize")
 GK_ATOM(onscroll, "onscroll")
 GK_ATOM(onselect, "onselect")
diff --git a/content/base/src/nsScriptLoader.cpp b/content/base/src/nsScriptLoader.cpp
index 4d20dcf0a2ef..7b4430c9665d 100644
--- a/content/base/src/nsScriptLoader.cpp
+++ b/content/base/src/nsScriptLoader.cpp
@@ -546,10 +546,13 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
 
   // Step 9. in the HTML5 spec
 
-  nsCOMPtr<nsIURI> scriptURI = aElement->GetScriptURI();
   nsRefPtr<nsScriptLoadRequest> request;
-  if (scriptURI) {
+  if (aElement->GetScriptExternal()) {
     // external script
+    nsCOMPtr<nsIURI> scriptURI = aElement->GetScriptURI();
+    if (!scriptURI) {
+      return NS_ERROR_NOT_AVAILABLE;
+    }
     nsTArray<PreloadInfo>::index_type i =
       mPreloads.IndexOf(scriptURI.get(), 0, PreloadURIComparator());
     if (i != nsTArray<PreloadInfo>::NoIndex) {
diff --git a/content/base/test/Makefile.in b/content/base/test/Makefile.in
index 146ec3391838..8a4ec3e17971 100644
--- a/content/base/test/Makefile.in
+++ b/content/base/test/Makefile.in
@@ -442,6 +442,7 @@ _TEST_FILES2 = \
 		file_bug604660-5.xml \
 		file_bug604660-6.xsl \
 		test_bug605982.html \
+		test_bug606729.html \
 		test_treewalker_nextsibling.xml \
 		$(NULL)
 
diff --git a/content/base/test/test_bug606729.html b/content/base/test/test_bug606729.html
new file mode 100644
index 000000000000..65b72d3bb180
--- /dev/null
+++ b/content/base/test/test_bug606729.html
@@ -0,0 +1,40 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=606729
+-->
+<head>
+  <title>Test for Bug 606729</title>
+  <script type="text/javascript" src="/MochiKit/MochiKit.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=606729">Mozilla Bug 606729</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script
+  src="data:"
+  onerror="ok(false, 'Script with src=data: should not fire onerror.');"
+  onload="ok(false, 'Script with src=data: should not fire onload.');"
+>
+ok(false, "Script with src=data: should not run textContent.");
+</script>
+<script
+  src="bogus:"
+  onerror="ok(false, 'Script with src=bogus: should not fire onerror.');"
+  onload="ok(false, 'Script with src=bogus: should not fire onload.');"
+>
+ok(false, "Script with src=bogus: should not run textContent.");
+</script>
+<script class="testbody" type="text/javascript">
+ok(true, "Obligatory succeeding test assertion.");
+</script>
+</pre>
+</body>
+</html>
+
+
diff --git a/content/canvas/public/nsICanvasRenderingContextInternal.h b/content/canvas/public/nsICanvasRenderingContextInternal.h
index 9140c8e1c041..dc1f18f3bc21 100644
--- a/content/canvas/public/nsICanvasRenderingContextInternal.h
+++ b/content/canvas/public/nsICanvasRenderingContextInternal.h
@@ -50,6 +50,7 @@
 class nsHTMLCanvasElement;
 class gfxContext;
 class gfxASurface;
+class nsIPropertyBag;
 
 namespace mozilla {
 namespace layers {
@@ -115,6 +116,14 @@ public:
   // Redraw the dirty rectangle of this canvas.
   NS_IMETHOD Redraw(const gfxRect &dirty) = 0;
 
+  // Passes a generic nsIPropertyBag options argument, along with the
+  // previous one, if any.  Optional.
+  NS_IMETHOD SetContextOptions(nsIPropertyBag *aNewOptions) { return NS_OK; }
+
+  //
+  // shmem support
+  //
+
   // If this context can be set to use Mozilla's Shmem segments as its backing
   // store, this will set it to that state. Note that if you have drawn
   // anything into this canvas before changing the shmem state, it will be
diff --git a/content/canvas/src/CustomQS_WebGL.h b/content/canvas/src/CustomQS_WebGL.h
index 465fa7221ebc..b7a1db689ca4 100644
--- a/content/canvas/src/CustomQS_WebGL.h
+++ b/content/canvas/src/CustomQS_WebGL.h
@@ -82,14 +82,14 @@ helper_isFloat32Array(JSObject *obj) {
  *    BufferData_array (int, js::TypedArray *, int)
  */
 static JSBool
-nsICanvasRenderingContextWebGL_BufferData(JSContext *cx, uintN argc, jsval *vp)
+nsIDOMWebGLRenderingContext_BufferData(JSContext *cx, uintN argc, jsval *vp)
 {
     XPC_QS_ASSERT_CONTEXT_OK(cx);
     JSObject *obj = JS_THIS_OBJECT(cx, vp);
     if (!obj)
         return JS_FALSE;
 
-    nsICanvasRenderingContextWebGL *self;
+    nsIDOMWebGLRenderingContext *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
     if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
@@ -149,14 +149,14 @@ nsICanvasRenderingContextWebGL_BufferData(JSContext *cx, uintN argc, jsval *vp)
  *    BufferSubData_array (int, int, js::TypedArray *)
  */
 static JSBool
-nsICanvasRenderingContextWebGL_BufferSubData(JSContext *cx, uintN argc, jsval *vp)
+nsIDOMWebGLRenderingContext_BufferSubData(JSContext *cx, uintN argc, jsval *vp)
 {
     XPC_QS_ASSERT_CONTEXT_OK(cx);
     JSObject *obj = JS_THIS_OBJECT(cx, vp);
     if (!obj)
         return JS_FALSE;
 
-    nsICanvasRenderingContextWebGL *self;
+    nsIDOMWebGLRenderingContext *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
     if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
@@ -215,7 +215,7 @@ nsICanvasRenderingContextWebGL_BufferSubData(JSContext *cx, uintN argc, jsval *v
  *    ReadPixels(int, int, int, int, uint, uint, ArrayBufferView)
  */
 static JSBool
-nsICanvasRenderingContextWebGL_ReadPixels(JSContext *cx, uintN argc, jsval *vp)
+nsIDOMWebGLRenderingContext_ReadPixels(JSContext *cx, uintN argc, jsval *vp)
 {
     XPC_QS_ASSERT_CONTEXT_OK(cx);
     JSObject *obj = JS_THIS_OBJECT(cx, vp);
@@ -224,7 +224,7 @@ nsICanvasRenderingContextWebGL_ReadPixels(JSContext *cx, uintN argc, jsval *vp)
 
     nsresult rv;
 
-    nsICanvasRenderingContextWebGL *self;
+    nsIDOMWebGLRenderingContext *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
     if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
@@ -278,7 +278,7 @@ nsICanvasRenderingContextWebGL_ReadPixels(JSContext *cx, uintN argc, jsval *vp)
  *    TexImage2D(uint, int, uint, uint, uint, ImageData)
  */
 static JSBool
-nsICanvasRenderingContextWebGL_TexImage2D(JSContext *cx, uintN argc, jsval *vp)
+nsIDOMWebGLRenderingContext_TexImage2D(JSContext *cx, uintN argc, jsval *vp)
 {
     XPC_QS_ASSERT_CONTEXT_OK(cx);
     JSObject *obj = JS_THIS_OBJECT(cx, vp);
@@ -287,7 +287,7 @@ nsICanvasRenderingContextWebGL_TexImage2D(JSContext *cx, uintN argc, jsval *vp)
 
     nsresult rv;
 
-    nsICanvasRenderingContextWebGL *self;
+    nsIDOMWebGLRenderingContext *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
     if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
@@ -396,7 +396,7 @@ nsICanvasRenderingContextWebGL_TexImage2D(JSContext *cx, uintN argc, jsval *vp)
  *    TexSubImage2D(uint, int, int, int, uint, uint, ImageData)
  */
 static JSBool
-nsICanvasRenderingContextWebGL_TexSubImage2D(JSContext *cx, uintN argc, jsval *vp)
+nsIDOMWebGLRenderingContext_TexSubImage2D(JSContext *cx, uintN argc, jsval *vp)
 {
     XPC_QS_ASSERT_CONTEXT_OK(cx);
     JSObject *obj = JS_THIS_OBJECT(cx, vp);
@@ -405,7 +405,7 @@ nsICanvasRenderingContextWebGL_TexSubImage2D(JSContext *cx, uintN argc, jsval *v
 
     nsresult rv;
 
-    nsICanvasRenderingContextWebGL *self;
+    nsIDOMWebGLRenderingContext *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
     if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
@@ -504,7 +504,7 @@ nsICanvasRenderingContextWebGL_TexSubImage2D(JSContext *cx, uintN argc, jsval *v
 
 /* NOTE: There is a TN version of this below, update it as well */
 static inline JSBool
-helper_nsICanvasRenderingContextWebGL_Uniform_x_iv(JSContext *cx, uintN argc, jsval *vp, int nElements)
+helper_nsIDOMWebGLRenderingContext_Uniform_x_iv(JSContext *cx, uintN argc, jsval *vp, int nElements)
 {
     XPC_QS_ASSERT_CONTEXT_OK(cx);
     JSObject *obj = JS_THIS_OBJECT(cx, vp);
@@ -513,7 +513,7 @@ helper_nsICanvasRenderingContextWebGL_Uniform_x_iv(JSContext *cx, uintN argc, js
 
     nsresult rv;
 
-    nsICanvasRenderingContextWebGL *self;
+    nsIDOMWebGLRenderingContext *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
     if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
@@ -578,7 +578,7 @@ helper_nsICanvasRenderingContextWebGL_Uniform_x_iv(JSContext *cx, uintN argc, js
 
 /* NOTE: There is a TN version of this below, update it as well */
 static inline JSBool
-helper_nsICanvasRenderingContextWebGL_Uniform_x_fv(JSContext *cx, uintN argc, jsval *vp, int nElements)
+helper_nsIDOMWebGLRenderingContext_Uniform_x_fv(JSContext *cx, uintN argc, jsval *vp, int nElements)
 {
     XPC_QS_ASSERT_CONTEXT_OK(cx);
     JSObject *obj = JS_THIS_OBJECT(cx, vp);
@@ -587,7 +587,7 @@ helper_nsICanvasRenderingContextWebGL_Uniform_x_fv(JSContext *cx, uintN argc, js
 
     nsresult rv;
 
-    nsICanvasRenderingContextWebGL *self;
+    nsIDOMWebGLRenderingContext *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
     if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
@@ -652,7 +652,7 @@ helper_nsICanvasRenderingContextWebGL_Uniform_x_fv(JSContext *cx, uintN argc, js
 
 /* NOTE: There is a TN version of this below, update it as well */
 static inline JSBool
-helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv(JSContext *cx, uintN argc, jsval *vp, int nElements)
+helper_nsIDOMWebGLRenderingContext_UniformMatrix_x_fv(JSContext *cx, uintN argc, jsval *vp, int nElements)
 {
     XPC_QS_ASSERT_CONTEXT_OK(cx);
     JSObject *obj = JS_THIS_OBJECT(cx, vp);
@@ -661,7 +661,7 @@ helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv(JSContext *cx, uintN ar
 
     nsresult rv;
 
-    nsICanvasRenderingContextWebGL *self;
+    nsIDOMWebGLRenderingContext *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
     if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
@@ -727,7 +727,7 @@ helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv(JSContext *cx, uintN ar
 }
 
 static inline JSBool
-helper_nsICanvasRenderingContextWebGL_VertexAttrib_x_fv(JSContext *cx, uintN argc, jsval *vp, int nElements)
+helper_nsIDOMWebGLRenderingContext_VertexAttrib_x_fv(JSContext *cx, uintN argc, jsval *vp, int nElements)
 {
     XPC_QS_ASSERT_CONTEXT_OK(cx);
     JSObject *obj = JS_THIS_OBJECT(cx, vp);
@@ -736,7 +736,7 @@ helper_nsICanvasRenderingContextWebGL_VertexAttrib_x_fv(JSContext *cx, uintN arg
 
     nsresult rv;
 
-    nsICanvasRenderingContextWebGL *self;
+    nsIDOMWebGLRenderingContext *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
     if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
@@ -796,104 +796,104 @@ helper_nsICanvasRenderingContextWebGL_VertexAttrib_x_fv(JSContext *cx, uintN arg
 }
 
 static JSBool
-nsICanvasRenderingContextWebGL_Uniform1iv(JSContext *cx, uintN argc, jsval *vp)
+nsIDOMWebGLRenderingContext_Uniform1iv(JSContext *cx, uintN argc, jsval *vp)
 {
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_iv(cx, argc, vp, 1);
+    return helper_nsIDOMWebGLRenderingContext_Uniform_x_iv(cx, argc, vp, 1);
 }
 
 static JSBool
-nsICanvasRenderingContextWebGL_Uniform2iv(JSContext *cx, uintN argc, jsval *vp)
+nsIDOMWebGLRenderingContext_Uniform2iv(JSContext *cx, uintN argc, jsval *vp)
 {
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_iv(cx, argc, vp, 2);
+    return helper_nsIDOMWebGLRenderingContext_Uniform_x_iv(cx, argc, vp, 2);
 }
 
 static JSBool
-nsICanvasRenderingContextWebGL_Uniform3iv(JSContext *cx, uintN argc, jsval *vp)
+nsIDOMWebGLRenderingContext_Uniform3iv(JSContext *cx, uintN argc, jsval *vp)
 {
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_iv(cx, argc, vp, 3);
+    return helper_nsIDOMWebGLRenderingContext_Uniform_x_iv(cx, argc, vp, 3);
 }
 
 static JSBool
-nsICanvasRenderingContextWebGL_Uniform4iv(JSContext *cx, uintN argc, jsval *vp)
+nsIDOMWebGLRenderingContext_Uniform4iv(JSContext *cx, uintN argc, jsval *vp)
 {
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_iv(cx, argc, vp, 4);
+    return helper_nsIDOMWebGLRenderingContext_Uniform_x_iv(cx, argc, vp, 4);
 }
 
 static JSBool
-nsICanvasRenderingContextWebGL_Uniform1fv(JSContext *cx, uintN argc, jsval *vp)
+nsIDOMWebGLRenderingContext_Uniform1fv(JSContext *cx, uintN argc, jsval *vp)
 {
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_fv(cx, argc, vp, 1);
+    return helper_nsIDOMWebGLRenderingContext_Uniform_x_fv(cx, argc, vp, 1);
 }
 
 static JSBool
-nsICanvasRenderingContextWebGL_Uniform2fv(JSContext *cx, uintN argc, jsval *vp)
+nsIDOMWebGLRenderingContext_Uniform2fv(JSContext *cx, uintN argc, jsval *vp)
 {
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_fv(cx, argc, vp, 2);
+    return helper_nsIDOMWebGLRenderingContext_Uniform_x_fv(cx, argc, vp, 2);
 }
 
 static JSBool
-nsICanvasRenderingContextWebGL_Uniform3fv(JSContext *cx, uintN argc, jsval *vp)
+nsIDOMWebGLRenderingContext_Uniform3fv(JSContext *cx, uintN argc, jsval *vp)
 {
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_fv(cx, argc, vp, 3);
+    return helper_nsIDOMWebGLRenderingContext_Uniform_x_fv(cx, argc, vp, 3);
 }
 
 static JSBool
-nsICanvasRenderingContextWebGL_Uniform4fv(JSContext *cx, uintN argc, jsval *vp)
+nsIDOMWebGLRenderingContext_Uniform4fv(JSContext *cx, uintN argc, jsval *vp)
 {
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_fv(cx, argc, vp, 4);
+    return helper_nsIDOMWebGLRenderingContext_Uniform_x_fv(cx, argc, vp, 4);
 }
 
 static JSBool
-nsICanvasRenderingContextWebGL_UniformMatrix2fv(JSContext *cx, uintN argc, jsval *vp)
+nsIDOMWebGLRenderingContext_UniformMatrix2fv(JSContext *cx, uintN argc, jsval *vp)
 {
-    return helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv(cx, argc, vp, 2);
+    return helper_nsIDOMWebGLRenderingContext_UniformMatrix_x_fv(cx, argc, vp, 2);
 }
 
 static JSBool
-nsICanvasRenderingContextWebGL_UniformMatrix3fv(JSContext *cx, uintN argc, jsval *vp)
+nsIDOMWebGLRenderingContext_UniformMatrix3fv(JSContext *cx, uintN argc, jsval *vp)
 {
-    return helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv(cx, argc, vp, 3);
+    return helper_nsIDOMWebGLRenderingContext_UniformMatrix_x_fv(cx, argc, vp, 3);
 }
 
 static JSBool
-nsICanvasRenderingContextWebGL_UniformMatrix4fv(JSContext *cx, uintN argc, jsval *vp)
+nsIDOMWebGLRenderingContext_UniformMatrix4fv(JSContext *cx, uintN argc, jsval *vp)
 {
-    return helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv(cx, argc, vp, 4);
+    return helper_nsIDOMWebGLRenderingContext_UniformMatrix_x_fv(cx, argc, vp, 4);
 }
 
 static JSBool
-nsICanvasRenderingContextWebGL_VertexAttrib1fv(JSContext *cx, uintN argc, jsval *vp)
+nsIDOMWebGLRenderingContext_VertexAttrib1fv(JSContext *cx, uintN argc, jsval *vp)
 {
-    return helper_nsICanvasRenderingContextWebGL_VertexAttrib_x_fv(cx, argc, vp, 1);
+    return helper_nsIDOMWebGLRenderingContext_VertexAttrib_x_fv(cx, argc, vp, 1);
 }
 
 static JSBool
-nsICanvasRenderingContextWebGL_VertexAttrib2fv(JSContext *cx, uintN argc, jsval *vp)
+nsIDOMWebGLRenderingContext_VertexAttrib2fv(JSContext *cx, uintN argc, jsval *vp)
 {
-    return helper_nsICanvasRenderingContextWebGL_VertexAttrib_x_fv(cx, argc, vp, 2);
+    return helper_nsIDOMWebGLRenderingContext_VertexAttrib_x_fv(cx, argc, vp, 2);
 }
 
 static JSBool
-nsICanvasRenderingContextWebGL_VertexAttrib3fv(JSContext *cx, uintN argc, jsval *vp)
+nsIDOMWebGLRenderingContext_VertexAttrib3fv(JSContext *cx, uintN argc, jsval *vp)
 {
-    return helper_nsICanvasRenderingContextWebGL_VertexAttrib_x_fv(cx, argc, vp, 3);
+    return helper_nsIDOMWebGLRenderingContext_VertexAttrib_x_fv(cx, argc, vp, 3);
 }
 
 static JSBool
-nsICanvasRenderingContextWebGL_VertexAttrib4fv(JSContext *cx, uintN argc, jsval *vp)
+nsIDOMWebGLRenderingContext_VertexAttrib4fv(JSContext *cx, uintN argc, jsval *vp)
 {
-    return helper_nsICanvasRenderingContextWebGL_VertexAttrib_x_fv(cx, argc, vp, 4);
+    return helper_nsIDOMWebGLRenderingContext_VertexAttrib_x_fv(cx, argc, vp, 4);
 }
 
 #ifdef JS_TRACER
 
 static inline void FASTCALL
-helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(JSContext *cx, JSObject *obj, JSObject *locationobj,
+helper_nsIDOMWebGLRenderingContext_Uniform_x_iv_tn(JSContext *cx, JSObject *obj, JSObject *locationobj,
                                                       JSObject *arg, int nElements)
 {
     XPC_QS_ASSERT_CONTEXT_OK(cx);
 
-    nsICanvasRenderingContextWebGL *self;
+    nsIDOMWebGLRenderingContext *self;
     xpc_qsSelfRef selfref;
     xpc_qsArgValArray<3> vp(cx);
     if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, &vp.array[0], nsnull)) {
@@ -902,7 +902,7 @@ helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(JSContext *cx, JSObject *o
     }
 
     if (!arg) {
-        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsICanvasRenderingContextWebGL", "uniformNiv");
+        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsIDOMWebGLRenderingContext", "uniformNiv");
         js_SetTraceableNativeFailed(cx);
     }
 
@@ -932,7 +932,7 @@ helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(JSContext *cx, JSObject *o
         *obj_tvr.jsval_addr() = OBJECT_TO_JSVAL(nobj);
         wa = js::TypedArray::fromJSObject(nobj);
     } else {
-        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsICanvasRenderingContextWebGL", "uniformNiv");
+        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsIDOMWebGLRenderingContext", "uniformNiv");
         js_SetTraceableNativeFailed(cx);
         return;
     }
@@ -950,18 +950,18 @@ helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(JSContext *cx, JSObject *o
     }
 
     if (NS_FAILED(rv)) {
-        xpc_qsThrowMethodFailedWithDetails(cx, rv, "nsICanvasRenderingContextWebGL", "uniformNiv");
+        xpc_qsThrowMethodFailedWithDetails(cx, rv, "nsIDOMWebGLRenderingContext", "uniformNiv");
         js_SetTraceableNativeFailed(cx);
     }
 }
 
 static inline void FASTCALL
-helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(JSContext *cx, JSObject *obj, JSObject *locationobj,
+helper_nsIDOMWebGLRenderingContext_Uniform_x_fv_tn(JSContext *cx, JSObject *obj, JSObject *locationobj,
                                                       JSObject *arg, int nElements)
 {
     XPC_QS_ASSERT_CONTEXT_OK(cx);
 
-    nsICanvasRenderingContextWebGL *self;
+    nsIDOMWebGLRenderingContext *self;
     xpc_qsSelfRef selfref;
     xpc_qsArgValArray<3> vp(cx);
     if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, &vp.array[0], nsnull)) {
@@ -970,7 +970,7 @@ helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(JSContext *cx, JSObject *o
     }
 
     if (!arg) {
-        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsICanvasRenderingContextWebGL", "uniformNfv");
+        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsIDOMWebGLRenderingContext", "uniformNfv");
         js_SetTraceableNativeFailed(cx);
     }
 
@@ -1000,7 +1000,7 @@ helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(JSContext *cx, JSObject *o
         *obj_tvr.jsval_addr() = OBJECT_TO_JSVAL(nobj);
         wa = js::TypedArray::fromJSObject(nobj);
     } else {
-        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsICanvasRenderingContextWebGL", "uniformNfv");
+        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsIDOMWebGLRenderingContext", "uniformNfv");
         js_SetTraceableNativeFailed(cx);
         return;
     }
@@ -1018,7 +1018,7 @@ helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(JSContext *cx, JSObject *o
     }
 
     if (NS_FAILED(rv)) {
-        xpc_qsThrowMethodFailedWithDetails(cx, rv, "nsICanvasRenderingContextWebGL", "uniformNfv");
+        xpc_qsThrowMethodFailedWithDetails(cx, rv, "nsIDOMWebGLRenderingContext", "uniformNfv");
         js_SetTraceableNativeFailed(cx);
     }
 
@@ -1026,12 +1026,12 @@ helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(JSContext *cx, JSObject *o
 }
 
 static inline void FASTCALL
-helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv_tn(JSContext *cx, JSObject *obj, JSObject *locationobj,
+helper_nsIDOMWebGLRenderingContext_UniformMatrix_x_fv_tn(JSContext *cx, JSObject *obj, JSObject *locationobj,
                                                             JSBool transpose, JSObject *arg, int nElements)
 {
     XPC_QS_ASSERT_CONTEXT_OK(cx);
 
-    nsICanvasRenderingContextWebGL *self;
+    nsIDOMWebGLRenderingContext *self;
     xpc_qsSelfRef selfref;
     xpc_qsArgValArray<4> vp(cx);
     if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, &vp.array[0], nsnull)) {
@@ -1040,7 +1040,7 @@ helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv_tn(JSContext *cx, JSObj
     }
 
     if (!arg) {
-        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsICanvasRenderingContextWebGL", "uniformMatrixNfv");
+        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsIDOMWebGLRenderingContext", "uniformMatrixNfv");
         js_SetTraceableNativeFailed(cx);
     }
 
@@ -1070,7 +1070,7 @@ helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv_tn(JSContext *cx, JSObj
         *obj_tvr.jsval_addr() = OBJECT_TO_JSVAL(nobj);
         wa = js::TypedArray::fromJSObject(nobj);
     } else {
-        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsICanvasRenderingContextWebGL", "uniformMatrixNfv");
+        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsIDOMWebGLRenderingContext", "uniformMatrixNfv");
         js_SetTraceableNativeFailed(cx);
         return;
     }
@@ -1085,7 +1085,7 @@ helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv_tn(JSContext *cx, JSObj
     }
 
     if (NS_FAILED(rv)) {
-        xpc_qsThrowMethodFailedWithDetails(cx, rv, "nsICanvasRenderingContextWebGL", "uniformMatrixNfv");
+        xpc_qsThrowMethodFailedWithDetails(cx, rv, "nsIDOMWebGLRenderingContext", "uniformMatrixNfv");
         js_SetTraceableNativeFailed(cx);
     }
 }
@@ -1093,133 +1093,133 @@ helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv_tn(JSContext *cx, JSObj
 // FIXME This should return void, not uint32
 //       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
 static uint32 FASTCALL
-nsICanvasRenderingContextWebGL_Uniform1iv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
+nsIDOMWebGLRenderingContext_Uniform1iv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
 {
-    helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(cx, obj, location, arg, 1);
+    helper_nsIDOMWebGLRenderingContext_Uniform_x_iv_tn(cx, obj, location, arg, 1);
     return 0;
 }
 
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform1iv,
-    (4, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_Uniform1iv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
+JS_DEFINE_TRCINFO_1(nsIDOMWebGLRenderingContext_Uniform1iv,
+    (4, (static, UINT32_FAIL, nsIDOMWebGLRenderingContext_Uniform1iv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
 
 // FIXME This should return void, not uint32
 //       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
 static uint32 FASTCALL
-nsICanvasRenderingContextWebGL_Uniform2iv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
+nsIDOMWebGLRenderingContext_Uniform2iv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
 {
-    helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(cx, obj, location, arg, 2);
+    helper_nsIDOMWebGLRenderingContext_Uniform_x_iv_tn(cx, obj, location, arg, 2);
     return 0;
 }
 
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform2iv,
-    (4, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_Uniform2iv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
+JS_DEFINE_TRCINFO_1(nsIDOMWebGLRenderingContext_Uniform2iv,
+    (4, (static, UINT32_FAIL, nsIDOMWebGLRenderingContext_Uniform2iv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
 
 // FIXME This should return void, not uint32
 //       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
 static uint32 FASTCALL
-nsICanvasRenderingContextWebGL_Uniform3iv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
+nsIDOMWebGLRenderingContext_Uniform3iv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
 {
-    helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(cx, obj, location, arg, 3);
+    helper_nsIDOMWebGLRenderingContext_Uniform_x_iv_tn(cx, obj, location, arg, 3);
     return 0;
 }
 
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform3iv,
-    (4, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_Uniform3iv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
+JS_DEFINE_TRCINFO_1(nsIDOMWebGLRenderingContext_Uniform3iv,
+    (4, (static, UINT32_FAIL, nsIDOMWebGLRenderingContext_Uniform3iv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
 
 // FIXME This should return void, not uint32
 //       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
 static uint32 FASTCALL
-nsICanvasRenderingContextWebGL_Uniform4iv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
+nsIDOMWebGLRenderingContext_Uniform4iv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
 {
-    helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(cx, obj, location, arg, 4);
+    helper_nsIDOMWebGLRenderingContext_Uniform_x_iv_tn(cx, obj, location, arg, 4);
     return 0;
 }
 
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform4iv,
-    (4, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_Uniform4iv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
+JS_DEFINE_TRCINFO_1(nsIDOMWebGLRenderingContext_Uniform4iv,
+    (4, (static, UINT32_FAIL, nsIDOMWebGLRenderingContext_Uniform4iv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
 
 // FIXME This should return void, not uint32
 //       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
 static uint32 FASTCALL
-nsICanvasRenderingContextWebGL_Uniform1fv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
+nsIDOMWebGLRenderingContext_Uniform1fv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
 {
-    helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(cx, obj, location, arg, 1);
+    helper_nsIDOMWebGLRenderingContext_Uniform_x_fv_tn(cx, obj, location, arg, 1);
     return 0;
 }
 
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform1fv,
-    (4, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_Uniform1fv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
+JS_DEFINE_TRCINFO_1(nsIDOMWebGLRenderingContext_Uniform1fv,
+    (4, (static, UINT32_FAIL, nsIDOMWebGLRenderingContext_Uniform1fv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
 
 // FIXME This should return void, not uint32
 //       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
 static uint32 FASTCALL
-nsICanvasRenderingContextWebGL_Uniform2fv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
+nsIDOMWebGLRenderingContext_Uniform2fv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
 {
-    helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(cx, obj, location, arg, 2);
+    helper_nsIDOMWebGLRenderingContext_Uniform_x_fv_tn(cx, obj, location, arg, 2);
     return 0;
 }
 
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform2fv,
-    (4, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_Uniform2fv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
+JS_DEFINE_TRCINFO_1(nsIDOMWebGLRenderingContext_Uniform2fv,
+    (4, (static, UINT32_FAIL, nsIDOMWebGLRenderingContext_Uniform2fv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
 
 // FIXME This should return void, not uint32
 //       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
 static uint32 FASTCALL
-nsICanvasRenderingContextWebGL_Uniform3fv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
+nsIDOMWebGLRenderingContext_Uniform3fv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
 {
-    helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(cx, obj, location, arg, 3);
+    helper_nsIDOMWebGLRenderingContext_Uniform_x_fv_tn(cx, obj, location, arg, 3);
     return 0;
 }
 
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform3fv,
-    (4, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_Uniform3fv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
+JS_DEFINE_TRCINFO_1(nsIDOMWebGLRenderingContext_Uniform3fv,
+    (4, (static, UINT32_FAIL, nsIDOMWebGLRenderingContext_Uniform3fv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
 
 // FIXME This should return void, not uint32
 //       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
 static uint32 FASTCALL
-nsICanvasRenderingContextWebGL_Uniform4fv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
+nsIDOMWebGLRenderingContext_Uniform4fv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
 {
-    helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(cx, obj, location, arg, 4);
+    helper_nsIDOMWebGLRenderingContext_Uniform_x_fv_tn(cx, obj, location, arg, 4);
     return 0;
 }
 
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform4fv,
-    (4, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_Uniform4fv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
+JS_DEFINE_TRCINFO_1(nsIDOMWebGLRenderingContext_Uniform4fv,
+    (4, (static, UINT32_FAIL, nsIDOMWebGLRenderingContext_Uniform4fv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
 
 // FIXME This should return void, not uint32
 //       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
 static uint32 FASTCALL
-nsICanvasRenderingContextWebGL_UniformMatrix2fv_tn(JSContext *cx, JSObject *obj, JSObject *loc, JSBool transpose, JSObject *arg)
+nsIDOMWebGLRenderingContext_UniformMatrix2fv_tn(JSContext *cx, JSObject *obj, JSObject *loc, JSBool transpose, JSObject *arg)
 {
-    helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv_tn(cx, obj, loc, transpose, arg, 2);
+    helper_nsIDOMWebGLRenderingContext_UniformMatrix_x_fv_tn(cx, obj, loc, transpose, arg, 2);
     return 0;
 }
 
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_UniformMatrix2fv,
-    (5, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_UniformMatrix2fv_tn, CONTEXT, THIS, OBJECT, BOOL, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
+JS_DEFINE_TRCINFO_1(nsIDOMWebGLRenderingContext_UniformMatrix2fv,
+    (5, (static, UINT32_FAIL, nsIDOMWebGLRenderingContext_UniformMatrix2fv_tn, CONTEXT, THIS, OBJECT, BOOL, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
 
 // FIXME This should return void, not uint32
 //       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
 static uint32 FASTCALL
-nsICanvasRenderingContextWebGL_UniformMatrix3fv_tn(JSContext *cx, JSObject *obj, JSObject *loc, JSBool transpose, JSObject *arg)
+nsIDOMWebGLRenderingContext_UniformMatrix3fv_tn(JSContext *cx, JSObject *obj, JSObject *loc, JSBool transpose, JSObject *arg)
 {
-    helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv_tn(cx, obj, loc, transpose, arg, 3);
+    helper_nsIDOMWebGLRenderingContext_UniformMatrix_x_fv_tn(cx, obj, loc, transpose, arg, 3);
     return 0;
 }
 
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_UniformMatrix3fv,
-    (5, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_UniformMatrix3fv_tn, CONTEXT, THIS, OBJECT, BOOL, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
+JS_DEFINE_TRCINFO_1(nsIDOMWebGLRenderingContext_UniformMatrix3fv,
+    (5, (static, UINT32_FAIL, nsIDOMWebGLRenderingContext_UniformMatrix3fv_tn, CONTEXT, THIS, OBJECT, BOOL, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
 
 // FIXME This should return void, not uint32
 //       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
 static uint32 FASTCALL
-nsICanvasRenderingContextWebGL_UniformMatrix4fv_tn(JSContext *cx, JSObject *obj, JSObject *loc, JSBool transpose, JSObject *arg)
+nsIDOMWebGLRenderingContext_UniformMatrix4fv_tn(JSContext *cx, JSObject *obj, JSObject *loc, JSBool transpose, JSObject *arg)
 {
-    helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv_tn(cx, obj, loc, transpose, arg, 4);
+    helper_nsIDOMWebGLRenderingContext_UniformMatrix_x_fv_tn(cx, obj, loc, transpose, arg, 4);
     return 0;
 }
 
-JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_UniformMatrix4fv,
-    (5, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_UniformMatrix4fv_tn, CONTEXT, THIS, OBJECT, BOOL, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
+JS_DEFINE_TRCINFO_1(nsIDOMWebGLRenderingContext_UniformMatrix4fv,
+    (5, (static, UINT32_FAIL, nsIDOMWebGLRenderingContext_UniformMatrix4fv_tn, CONTEXT, THIS, OBJECT, BOOL, OBJECT, 0, nanojit::ACCSET_STORE_ANY)))
 
 #endif /* JS_TRACER */
diff --git a/content/canvas/src/WebGLContext.cpp b/content/canvas/src/WebGLContext.cpp
index 174152123907..334fe4781a74 100644
--- a/content/canvas/src/WebGLContext.cpp
+++ b/content/canvas/src/WebGLContext.cpp
@@ -48,6 +48,11 @@
 #include "nsDOMError.h"
 #include "nsIGfxInfo.h"
 
+#include "nsIPropertyBag.h"
+#include "nsIVariant.h"
+
+#include "imgIEncoder.h"
+
 #include "gfxContext.h"
 #include "gfxPattern.h"
 #include "gfxUtils.h"
@@ -66,12 +71,12 @@ using namespace mozilla;
 using namespace mozilla::gl;
 using namespace mozilla::layers;
 
-nsresult NS_NewCanvasRenderingContextWebGL(nsICanvasRenderingContextWebGL** aResult);
+nsresult NS_NewCanvasRenderingContextWebGL(nsIDOMWebGLRenderingContext** aResult);
 
 nsresult
-NS_NewCanvasRenderingContextWebGL(nsICanvasRenderingContextWebGL** aResult)
+NS_NewCanvasRenderingContextWebGL(nsIDOMWebGLRenderingContext** aResult)
 {
-    nsICanvasRenderingContextWebGL* ctx = new WebGLContext();
+    nsIDOMWebGLRenderingContext* ctx = new WebGLContext();
     if (!ctx)
         return NS_ERROR_OUT_OF_MEMORY;
 
@@ -88,6 +93,7 @@ WebGLContext::WebGLContext()
     mInvalidated = PR_FALSE;
     mResetLayer = PR_TRUE;
     mVerbose = PR_FALSE;
+    mOptionsFrozen = PR_FALSE;
 
     mActiveTexture = 0;
     mSynthesizedGLError = LOCAL_GL_NO_ERROR;
@@ -266,6 +272,67 @@ WebGLContext::SetCanvasElement(nsHTMLCanvasElement* aParentCanvas)
     return NS_OK;
 }
 
+static bool
+GetBoolFromPropertyBag(nsIPropertyBag *bag, const char *propName, bool *boolResult)
+{
+    nsCOMPtr<nsIVariant> vv;
+    PRBool bv;
+
+    nsresult rv = bag->GetProperty(NS_ConvertASCIItoUTF16(propName), getter_AddRefs(vv));
+    if (NS_FAILED(rv) || !vv)
+        return false;
+
+    rv = vv->GetAsBool(&bv);
+    if (NS_FAILED(rv))
+        return false;
+
+    *boolResult = bv ? true : false;
+    return true;
+}
+
+NS_IMETHODIMP
+WebGLContext::SetContextOptions(nsIPropertyBag *aOptions)
+{
+    if (!aOptions)
+        return NS_OK;
+
+    WebGLContextOptions newOpts;
+
+    // defaults are: yes: depth, alpha, premultipliedAlpha; no: stencil
+    if (!GetBoolFromPropertyBag(aOptions, "stencil", &newOpts.stencil))
+        newOpts.stencil = false;
+
+    if (!GetBoolFromPropertyBag(aOptions, "depth", &newOpts.depth))
+        newOpts.depth = true;
+
+    if (!GetBoolFromPropertyBag(aOptions, "alpha", &newOpts.alpha))
+        newOpts.alpha = true;
+
+    if (!GetBoolFromPropertyBag(aOptions, "premultipliedAlpha", &newOpts.premultipliedAlpha))
+        newOpts.premultipliedAlpha = true;
+
+    GetBoolFromPropertyBag(aOptions, "antialiasHint", &newOpts.antialiasHint);
+
+    // enforce that if stencil is specified, we also give back depth
+    newOpts.depth |= newOpts.stencil;
+
+    LogMessage("aaHint: %d stencil: %d depth: %d alpha: %d premult: %d\n",
+               newOpts.antialiasHint ? 1 : 0,
+               newOpts.stencil ? 1 : 0,
+               newOpts.depth ? 1 : 0,
+               newOpts.alpha ? 1 : 0,
+               newOpts.premultipliedAlpha ? 1 : 0);
+
+    if (mOptionsFrozen && newOpts != mOptions) {
+        // Error if the options are already frozen, and the ones that were asked for
+        // aren't the same as what they were originally.
+        return NS_ERROR_FAILURE;
+    }
+
+    mOptions = newOpts;
+    return NS_OK;
+}
+
 NS_IMETHODIMP
 WebGLContext::SetDimensions(PRInt32 width, PRInt32 height)
 {
@@ -300,8 +367,26 @@ WebGLContext::SetDimensions(PRInt32 width, PRInt32 height)
     DestroyResourcesAndContext();
 
     gl::ContextFormat format(gl::ContextFormat::BasicRGBA32);
-    format.depth = 16;
-    format.minDepth = 1;
+    if (mOptions.depth) {
+        format.depth = 24;
+        format.minDepth = 16;
+    }
+
+    if (mOptions.stencil) {
+        format.stencil = 8;
+        format.minStencil = 8;
+    }
+
+    if (!mOptions.alpha) {
+        // Select 565; we won't/shouldn't hit this on the desktop,
+        // but let mobile know we're ok with it.
+        format.red = 5;
+        format.green = 6;
+        format.blue = 5;
+
+        format.alpha = 0;
+        format.minAlpha = 0;
+    }
 
     nsCOMPtr<nsIPrefBranch> prefService = do_GetService(NS_PREFSERVICE_CONTRACTID);
     NS_ENSURE_TRUE(prefService != nsnull, NS_ERROR_FAILURE);
@@ -421,6 +506,7 @@ WebGLContext::SetDimensions(PRInt32 width, PRInt32 height)
     mWidth = width;
     mHeight = height;
     mResetLayer = PR_TRUE;
+    mOptionsFrozen = PR_TRUE;
 
     // increment the generation number
     ++mGeneration;
@@ -482,17 +568,20 @@ WebGLContext::GetInputStream(const char* aMimeType,
                              const PRUnichar* aEncoderOptions,
                              nsIInputStream **aStream)
 {
-    return NS_ERROR_FAILURE;
-
-    // XXX fix this
-#if 0
-    if (!mGLPbuffer ||
-        !mGLPbuffer->ThebesSurface())
+    NS_ASSERTION(gl, "GetInputStream on invalid context?");
+    if (!gl)
         return NS_ERROR_FAILURE;
 
+    nsRefPtr<gfxImageSurface> surf = new gfxImageSurface(gfxIntSize(mWidth, mHeight),
+                                                         gfxASurface::ImageFormatARGB32);
+    if (surf->CairoStatus() != 0)
+        return NS_ERROR_FAILURE;
+
+    gl->ReadPixelsIntoImageSurface(0, 0, mWidth, mHeight, surf);
+
     nsresult rv;
     const char encoderPrefix[] = "@mozilla.org/image/encoder;2?type=";
-    nsAutoArrayPtr<char> conid(new (std::nothrow) char[strlen(encoderPrefix) + strlen(aMimeType) + 1]);
+    nsAutoArrayPtr<char> conid(new char[strlen(encoderPrefix) + strlen(aMimeType) + 1]);
 
     if (!conid)
         return NS_ERROR_OUT_OF_MEMORY;
@@ -504,45 +593,15 @@ WebGLContext::GetInputStream(const char* aMimeType,
     if (!encoder)
         return NS_ERROR_FAILURE;
 
-    nsAutoArrayPtr<PRUint8> imageBuffer(new (std::nothrow) PRUint8[mWidth * mHeight * 4]);
-    if (!imageBuffer)
-        return NS_ERROR_OUT_OF_MEMORY;
-
-    nsRefPtr<gfxImageSurface> imgsurf = new gfxImageSurface(imageBuffer.get(),
-                                                            gfxIntSize(mWidth, mHeight),
-                                                            mWidth * 4,
-                                                            gfxASurface::ImageFormatARGB32);
-
-    if (!imgsurf || imgsurf->CairoStatus())
-        return NS_ERROR_FAILURE;
-
-    nsRefPtr<gfxContext> ctx = new gfxContext(imgsurf);
-
-    if (!ctx || ctx->HasError())
-        return NS_ERROR_FAILURE;
-
-    nsRefPtr<gfxASurface> surf = mGLPbuffer->ThebesSurface();
-    nsRefPtr<gfxPattern> pat = CanvasGLThebes::CreatePattern(surf);
-    gfxMatrix m;
-    m.Translate(gfxPoint(0.0, mGLPbuffer->Height()));
-    m.Scale(1.0, -1.0);
-    pat->SetMatrix(m);
-
-    // XXX I don't want to use PixelSnapped here, but layout doesn't guarantee
-    // pixel alignment for this stuff!
-    ctx->NewPath();
-    ctx->PixelSnappedRectangleAndSetPattern(gfxRect(0, 0, mWidth, mHeight), pat);
-    ctx->SetOperator(gfxContext::OPERATOR_SOURCE);
-    ctx->Fill();
-
-    rv = encoder->InitFromData(imageBuffer.get(),
-                               mWidth * mHeight * 4, mWidth, mHeight, mWidth * 4,
+    rv = encoder->InitFromData(surf->Data(),
+                               mWidth * mHeight * 4,
+                               mWidth, mHeight,
+                               surf->Stride(),
                                imgIEncoder::INPUT_FORMAT_HOSTARGB,
                                nsDependentString(aEncoderOptions));
     NS_ENSURE_SUCCESS(rv, rv);
 
     return CallQueryInterface(encoder, aStream);
-#endif
 }
 
 NS_IMETHODIMP
@@ -589,7 +648,7 @@ WebGLContext::GetCanvasLayer(CanvasLayer *aOldLayer,
     }
 
     data.mSize = nsIntSize(mWidth, mHeight);
-    data.mGLBufferIsPremultiplied = PR_FALSE;
+    data.mGLBufferIsPremultiplied = mOptions.premultipliedAlpha ? PR_TRUE : PR_FALSE;
 
     canvasLayer->Initialize(data);
     PRUint32 flags = gl->CreationFormat().alpha == 0 ? Layer::CONTENT_OPAQUE : 0;
@@ -602,12 +661,46 @@ WebGLContext::GetCanvasLayer(CanvasLayer *aOldLayer,
     return canvasLayer.forget().get();
 }
 
+NS_IMETHODIMP
+WebGLContext::GetContextAttributes(jsval *aResult)
+{
+    JSContext *cx = nsContentUtils::GetCurrentJSContext();
+    if (!cx)
+        return NS_ERROR_FAILURE;
+
+    JSObject *obj = JS_NewObject(cx, NULL, NULL, NULL);
+    if (!obj)
+        return NS_ERROR_FAILURE;
+
+    *aResult = OBJECT_TO_JSVAL(obj);
+
+    gl::ContextFormat cf = gl->ActualFormat();
+
+    if (!JS_DefineProperty(cx, obj, "alpha", cf.alpha > 0 ? JSVAL_TRUE : JSVAL_FALSE,
+                           NULL, NULL, JSPROP_ENUMERATE) ||
+        !JS_DefineProperty(cx, obj, "depth", cf.depth > 0 ? JSVAL_TRUE : JSVAL_FALSE,
+                           NULL, NULL, JSPROP_ENUMERATE) ||
+        !JS_DefineProperty(cx, obj, "stencil", cf.stencil > 0 ? JSVAL_TRUE : JSVAL_FALSE,
+                           NULL, NULL, JSPROP_ENUMERATE) ||
+        !JS_DefineProperty(cx, obj, "antialias", JSVAL_FALSE,
+                           NULL, NULL, JSPROP_ENUMERATE) ||
+        !JS_DefineProperty(cx, obj, "premultipliedAlpha",
+                           mOptions.premultipliedAlpha ? JSVAL_TRUE : JSVAL_FALSE,
+                           NULL, NULL, JSPROP_ENUMERATE))
+    {
+        *aResult = JSVAL_VOID;
+        return NS_ERROR_FAILURE;
+    }
+
+    return NS_OK;
+}
+
 //
 // XPCOM goop
 //
 
-NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(WebGLContext, nsICanvasRenderingContextWebGL)
-NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(WebGLContext, nsICanvasRenderingContextWebGL)
+NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(WebGLContext, nsIDOMWebGLRenderingContext)
+NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(WebGLContext, nsIDOMWebGLRenderingContext)
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(WebGLContext)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(WebGLContext)
@@ -620,10 +713,10 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 DOMCI_DATA(CanvasRenderingContextWebGL, WebGLContext)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(WebGLContext)
-  NS_INTERFACE_MAP_ENTRY(nsICanvasRenderingContextWebGL)
+  NS_INTERFACE_MAP_ENTRY(nsIDOMWebGLRenderingContext)
   NS_INTERFACE_MAP_ENTRY(nsICanvasRenderingContextInternal)
   NS_INTERFACE_MAP_ENTRY(nsISupportsWeakReference)
-  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsICanvasRenderingContextWebGL)
+  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIDOMWebGLRenderingContext)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(CanvasRenderingContextWebGL)
 NS_INTERFACE_MAP_END
 
diff --git a/content/canvas/src/WebGLContext.h b/content/canvas/src/WebGLContext.h
index 79167cdab039..a9062f799687 100644
--- a/content/canvas/src/WebGLContext.h
+++ b/content/canvas/src/WebGLContext.h
@@ -50,7 +50,7 @@
 
 #include "nsIDocShell.h"
 
-#include "nsICanvasRenderingContextWebGL.h"
+#include "nsIDOMWebGLRenderingContext.h"
 #include "nsICanvasRenderingContextInternal.h"
 #include "nsHTMLCanvasElement.h"
 #include "nsWeakReference.h"
@@ -67,6 +67,7 @@
 #define CONTEXT_LOST_WEBGL             0x9242
 
 class nsIDocShell;
+class nsIPropertyBag;
 
 namespace mozilla {
 
@@ -235,8 +236,10 @@ private:
 class WebGLBuffer;
 
 struct WebGLVertexAttribData {
+    // note that these initial values are what GL initializes vertex attribs to
     WebGLVertexAttribData()
-        : buf(0), stride(0), size(0), byteOffset(0), type(0), enabled(PR_FALSE), normalized(PR_FALSE)
+        : buf(0), stride(0), size(4), byteOffset(0),
+          type(LOCAL_GL_FLOAT), enabled(PR_FALSE), normalized(PR_FALSE)
     { }
 
     WebGLObjectRefPtr<WebGLBuffer> buf;
@@ -277,8 +280,41 @@ struct WebGLVertexAttribData {
     }
 };
 
+struct WebGLContextOptions {
+    // these are defaults
+    WebGLContextOptions()
+        : alpha(true), depth(true), stencil(false),
+          premultipliedAlpha(true), antialiasHint(false)
+    { }
+
+    bool operator==(const WebGLContextOptions& other) const {
+        return
+            alpha == other.alpha &&
+            depth == other.depth &&
+            stencil == other.stencil &&
+            premultipliedAlpha == other.premultipliedAlpha &&
+            antialiasHint == other.antialiasHint;
+    }
+
+    bool operator!=(const WebGLContextOptions& other) const {
+        return
+            alpha != other.alpha ||
+            depth != other.depth ||
+            stencil != other.stencil ||
+            premultipliedAlpha != other.premultipliedAlpha ||
+            antialiasHint != other.antialiasHint;
+    }
+
+    bool alpha;
+    bool depth;
+    bool stencil;
+
+    bool premultipliedAlpha;
+    bool antialiasHint;
+};
+
 class WebGLContext :
-    public nsICanvasRenderingContextWebGL,
+    public nsIDOMWebGLRenderingContext,
     public nsICanvasRenderingContextInternal,
     public nsSupportsWeakReference
 {
@@ -288,9 +324,9 @@ public:
 
     NS_DECL_CYCLE_COLLECTING_ISUPPORTS
 
-    NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(WebGLContext, nsICanvasRenderingContextWebGL)
+    NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(WebGLContext, nsIDOMWebGLRenderingContext)
 
-    NS_DECL_NSICANVASRENDERINGCONTEXTWEBGL
+    NS_DECL_NSIDOMWEBGLRENDERINGCONTEXT
 
     // nsICanvasRenderingContextInternal
     NS_IMETHOD SetCanvasElement(nsHTMLCanvasElement* aParentCanvas);
@@ -305,6 +341,8 @@ public:
                               nsIInputStream **aStream);
     NS_IMETHOD GetThebesSurface(gfxASurface **surface);
     NS_IMETHOD SetIsOpaque(PRBool b) { return NS_OK; };
+    NS_IMETHOD SetContextOptions(nsIPropertyBag *aOptions);
+
     NS_IMETHOD SetIsIPC(PRBool b) { return NS_ERROR_NOT_IMPLEMENTED; }
     NS_IMETHOD Redraw(const gfxRect&) { return NS_ERROR_NOT_IMPLEMENTED; }
     NS_IMETHOD Swap(mozilla::ipc::Shmem& aBack,
@@ -360,9 +398,12 @@ protected:
     PRInt32 mWidth, mHeight;
     CheckedUint32 mGeneration;
 
+    WebGLContextOptions mOptions;
+
     PRPackedBool mInvalidated;
     PRPackedBool mResetLayer;
     PRPackedBool mVerbose;
+    PRPackedBool mOptionsFrozen;
 
     WebGLuint mActiveTexture;
     WebGLenum mSynthesizedGLError;
@@ -729,13 +770,14 @@ public:
     NS_DECL_NSIWEBGLTEXTURE
 
 protected:
+    friend class WebGLContext;
+    friend class WebGLFramebuffer;
+
     PRBool mDeleted;
     WebGLuint mName;
 
-////////////////////////////////////////////////////////////////////////////////////////////////////
-/////// everything below that point is only used for the texture completeness/npot business
-/////// (sections 3.7.10 and 3.8.2 in GL ES 2.0.24 spec)
-////////////////////////////////////////////////////////////////////////////////////////////////////
+    // we store information about the various images that are part of
+    // this texture (cubemap faces, mipmap levels)
 
     struct ImageInfo {
         ImageInfo() : mWidth(0), mHeight(0), mFormat(0), mType(0), mIsDefined(PR_FALSE) {}
@@ -1211,21 +1253,21 @@ public:
         return mAttachedShaders.RemoveElement(shader);
     }
 
-    PRBool HasBothShaderTypesAttached() {
-        PRBool haveVertex = PR_FALSE;
-        PRBool haveFrag = PR_FALSE;
+    PRBool HasAttachedShaderOfType(GLenum shaderType) {
         for (PRUint32 i = 0; i < mAttachedShaders.Length(); ++i) {
-            if (mAttachedShaders[i]->ShaderType() == LOCAL_GL_FRAGMENT_SHADER)
-                haveFrag = PR_TRUE;
-            else if (mAttachedShaders[i]->ShaderType() == LOCAL_GL_VERTEX_SHADER)
-                haveVertex = PR_TRUE;
-            if (haveFrag && haveVertex)
+            if (mAttachedShaders[i]->ShaderType() == shaderType) {
                 return PR_TRUE;
+            }
         }
-
         return PR_FALSE;
     }
 
+    PRBool HasBothShaderTypesAttached() {
+        return
+            HasAttachedShaderOfType(LOCAL_GL_VERTEX_SHADER) &&
+            HasAttachedShaderOfType(LOCAL_GL_FRAGMENT_SHADER);
+    }
+
     PRBool NextGeneration()
     {
         if (!(mGeneration+1).valid())
@@ -1328,6 +1370,7 @@ public:
     WebGLFramebuffer(WebGLContext *context, WebGLuint name) :
         WebGLContextBoundObject(context),
         mName(name), mDeleted(PR_FALSE),
+        mColorAttachment0HasAlpha(PR_FALSE),
         mHasDepthAttachment(PR_FALSE),
         mHasStencilAttachment(PR_FALSE),
         mHasDepthStencilAttachment(PR_FALSE)
@@ -1342,6 +1385,8 @@ public:
     PRBool Deleted() { return mDeleted; }
     WebGLuint GLName() { return mName; }
 
+    PRBool ColorAttachment0HasAlpha() { return mColorAttachment0HasAlpha; }
+
     nsresult FramebufferRenderbuffer(WebGLenum target,
                                      WebGLenum attachment,
                                      WebGLenum rbtarget,
@@ -1405,15 +1450,20 @@ public:
                 {
                     return mContext->ErrorInvalidOperation(badAttachmentFormatMsg);
                 }
+
+                // ReadPixels needs alpha and size information, but only
+                // for COLOR_ATTACHMENT0
+                if (attachment == LOCAL_GL_COLOR_ATTACHMENT0) {
+                    setDimensions(wrb);
+                    mColorAttachment0HasAlpha = InternalFormatHasAlpha(wrb->mInternalFormat);
+                } else {
+                    mColorAttachment0HasAlpha = PR_FALSE;
+                }
             }
             mColorRenderbufferAttachment = wrb;
             break;
         }
 
-        // dimensions are kept for readPixels primarily, function only uses COLOR_ATTACHMENT0
-        if (attachment == LOCAL_GL_COLOR_ATTACHMENT0)
-            setDimensions(wrb);
-
         mContext->MakeContextCurrent();
         mContext->gl->fFramebufferRenderbuffer(target, attachment, rbtarget, renderbuffername);
 
@@ -1460,14 +1510,26 @@ public:
             {
                 return mContext->ErrorInvalidEnumInfo("framebufferTexture2D: attachment", attachment);
             }
-            // nothing to do for color buffers. all textures have a color-renderable format.
+
+            // keep data for readPixels, function only uses COLOR_ATTACHMENT0
+            if (attachment == LOCAL_GL_COLOR_ATTACHMENT0) {
+                setDimensions(wtex);
+
+                if (wtex) {
+                    const WebGLTexture::ImageInfo& ia = wtex->ImageInfoAt
+                        (level, textarget == LOCAL_GL_TEXTURE_2D
+                         ? 0
+                         : textarget - LOCAL_GL_TEXTURE_CUBE_MAP_POSITIVE_X);
+                    mColorAttachment0HasAlpha = InternalFormatHasAlpha(ia.mFormat);
+                } else {
+                    mColorAttachment0HasAlpha = PR_FALSE;
+                }
+            }
+
+            // nothing else to do for color buffers. all textures have a color-renderable format.
             break;
         }
 
-        // dimensions are kept for readPixels primarily, function only uses COLOR_ATTACHMENT0
-        if (attachment == LOCAL_GL_COLOR_ATTACHMENT0)
-            setDimensions(wtex);
-
         mContext->MakeContextCurrent();
         mContext->gl->fFramebufferTexture2D(target, attachment, textarget, texturename, level);
 
@@ -1501,6 +1563,14 @@ public:
                int(mHasDepthStencilAttachment) > 1;
     }
 
+    static PRBool InternalFormatHasAlpha(WebGLenum aInternalFormat) {
+        return
+            aInternalFormat == LOCAL_GL_RGBA ||
+            aInternalFormat == LOCAL_GL_ALPHA ||
+            aInternalFormat == LOCAL_GL_RGBA4 ||
+            aInternalFormat == LOCAL_GL_RGB5_A1;
+    }
+
 protected:
 
     // protected because WebGLContext should only call InitializeRenderbuffers
@@ -1605,7 +1675,8 @@ protected:
     }
 
     WebGLuint mName;
-    PRBool mDeleted;
+    PRPackedBool mDeleted;
+    PRPackedBool mColorAttachment0HasAlpha;
 
     // we only store pointers to attached renderbuffers, not to attached textures, because
     // we will only need to initialize renderbuffers. Textures are already initialized.
diff --git a/content/canvas/src/WebGLContextGL.cpp b/content/canvas/src/WebGLContextGL.cpp
index ec972657a4d4..af6267340b44 100644
--- a/content/canvas/src/WebGLContextGL.cpp
+++ b/content/canvas/src/WebGLContextGL.cpp
@@ -123,18 +123,17 @@ WebGLProgram::GetUniformLocationObject(GLint glLocation)
     return loc.forget();
 }
 
+static PRBool
+InternalFormatHasAlpha(WebGLenum aInternalFormat) {
+    return aInternalFormat == LOCAL_GL_RGBA4 ||
+        aInternalFormat == LOCAL_GL_RGB5_A1;
+}
+
 //
 //  WebGL API
 //
 
 
-/* void present (); */
-NS_IMETHODIMP
-WebGLContext::Present()
-{
-    return NS_ERROR_NOT_IMPLEMENTED;
-}
-
 /* void GlActiveTexture (in GLenum texture); */
 NS_IMETHODIMP
 WebGLContext::ActiveTexture(WebGLenum texture)
@@ -163,6 +162,12 @@ WebGLContext::AttachShader(nsIWebGLProgram *pobj, nsIWebGLShader *shobj)
         !GetConcreteObjectAndGLName("attachShader: shader", shobj, &shader, &shadername))
         return NS_OK;
 
+    // Per GLSL ES 2.0, we can only have one of each type of shader
+    // attached.  This renders the next test somewhat moot, but we'll
+    // leave it for when we support more than one shader of each type.
+    if (program->HasAttachedShaderOfType(shader->ShaderType()))
+        return ErrorInvalidOperation("AttachShader: only one of each type of shader may be attached to a program");
+
     if (!program->AttachShader(shader))
         return ErrorInvalidOperation("AttachShader: shader is already attached");
 
@@ -540,6 +545,11 @@ WebGLContext::Clear(PRUint32 mask)
     if (mBoundFramebuffer && !mBoundFramebuffer->CheckAndInitializeRenderbuffers())
         return NS_OK;
 
+    PRUint32 m = mask & (LOCAL_GL_COLOR_BUFFER_BIT | LOCAL_GL_DEPTH_BUFFER_BIT | LOCAL_GL_STENCIL_BUFFER_BIT);
+    if (mask != m) {
+        return ErrorInvalidValue("clear: invalid mask bits");
+    }
+
     gl->fClear(mask);
     Invalidate();
 
@@ -1433,7 +1443,6 @@ WebGLContext::GetParameter(PRUint32 pname, nsIVariant **retval)
         case LOCAL_GL_CULL_FACE_MODE:
         case LOCAL_GL_FRONT_FACE:
         case LOCAL_GL_ACTIVE_TEXTURE:
-        case LOCAL_GL_DEPTH_CLEAR_VALUE:
         case LOCAL_GL_STENCIL_CLEAR_VALUE:
         case LOCAL_GL_STENCIL_FUNC:
         case LOCAL_GL_STENCIL_REF:
@@ -1521,6 +1530,7 @@ WebGLContext::GetParameter(PRUint32 pname, nsIVariant **retval)
             break;
 
 // float
+        case LOCAL_GL_DEPTH_CLEAR_VALUE:
         case LOCAL_GL_LINE_WIDTH:
         case LOCAL_GL_POLYGON_OFFSET_FACTOR:
         case LOCAL_GL_POLYGON_OFFSET_UNITS:
@@ -2470,30 +2480,31 @@ WebGLContext::ReadPixels_base(WebGLint x, WebGLint y, WebGLsizei width, WebGLsiz
     WebGLsizei boundHeight = mBoundFramebuffer ? mBoundFramebuffer->height() : mHeight;
 
     PRUint32 size = 0;
+    bool badFormat = false, badType = false;
     switch (format) {
-      case LOCAL_GL_ALPHA:
-        size = 1;
-        break;
-      case LOCAL_GL_RGB:
-        size = 3;
-        break;
-      case LOCAL_GL_RGBA:
+    case LOCAL_GL_RGBA:
         size = 4;
         break;
-      default:
-        return ErrorInvalidEnumInfo("readPixels: format", format);
+    default:
+        badFormat = true;
+        break;
     }
 
     switch (type) {
-//         case LOCAL_GL_UNSIGNED_SHORT_4_4_4_4:
-//         case LOCAL_GL_UNSIGNED_SHORT_5_5_5_1:
-//         case LOCAL_GL_UNSIGNED_SHORT_5_6_5:
-      case LOCAL_GL_UNSIGNED_BYTE:
+    case LOCAL_GL_UNSIGNED_BYTE:
+        break;
+    default:
+        badType = true;
         break;
-      default:
-        return ErrorInvalidEnumInfo("ReadPixels: type", type);
     }
 
+    if (badFormat && badType)
+        return ErrorInvalidOperation("readPixels: bad format and type");
+    if (badFormat)
+        return ErrorInvalidEnumInfo("readPixels: format", format);
+    if (badType)
+        return ErrorInvalidEnumInfo("ReadPixels: type", type);
+
     CheckedUint32 checked_plainRowSize = CheckedUint32(width) * size;
 
     PRUint32 packAlignment = mPixelStorePackAlignment;
@@ -2579,6 +2590,51 @@ WebGLContext::ReadPixels_base(WebGLint x, WebGLint y, WebGLsizei width, WebGLsiz
         }
         delete [] subrect_data;
     }
+
+    // if we're reading alpha, we may need to do fixup
+    if (format == LOCAL_GL_ALPHA ||
+        format == LOCAL_GL_RGBA)
+    {
+        PRBool needAlphaFixup;
+        if (mBoundFramebuffer) {
+            needAlphaFixup = !mBoundFramebuffer->ColorAttachment0HasAlpha();
+        } else {
+            needAlphaFixup = gl->ActualFormat().alpha == 0;
+        }
+
+        if (needAlphaFixup) {
+            if (format == LOCAL_GL_ALPHA && type == LOCAL_GL_UNSIGNED_BYTE) {
+                // this is easy; it's an 0xff memset per row
+                PRUint8 *row = (PRUint8*)data;
+                for (GLint j = 0; j < height; ++j) {
+                    memset(row, 0xff, checked_plainRowSize.value());
+                    row += checked_alignedRowSize.value();
+                }
+            } else if (format == LOCAL_GL_RGBA && type == LOCAL_GL_UNSIGNED_BYTE) {
+                // this is harder, we need to just set the alpha byte here
+                PRUint8 *row = (PRUint8*)data;
+                for (GLint j = 0; j < height; ++j) {
+                    PRUint8 *rowp = row;
+#ifdef IS_LITTLE_ENDIAN
+                    // offset to get the alpha byte; we're always going to
+                    // move by 4 bytes
+                    rowp += 3;
+#endif
+                    PRUint8 *endrowp = rowp + 4 * width;
+                    while (rowp != endrowp) {
+                        *rowp = 0xff;
+                        rowp += 4;
+                    }
+
+                    row += checked_alignedRowSize.value();
+                }
+            } else {
+                NS_WARNING("Unhandled case, how'd we get here?");
+                return NS_ERROR_FAILURE;
+            }
+        }            
+    }
+
     return NS_OK;
 }
 
@@ -3767,7 +3823,7 @@ WebGLContext::TexSubImage2D_base(WebGLenum target, WebGLint level,
     PRUint32 bytesNeeded = checked_neededByteLength.value();
  
     if (byteLength < bytesNeeded)
-        return ErrorInvalidValue("texSubImage2D: not enough data for operation (need %d, have %d)", bytesNeeded, byteLength);
+        return ErrorInvalidOperation("texSubImage2D: not enough data for operation (need %d, have %d)", bytesNeeded, byteLength);
 
     WebGLTexture *tex = activeBoundTextureForTarget(target);
 
@@ -3880,129 +3936,6 @@ WebGLContext::TexSubImage2D_dom(WebGLenum target, WebGLint level,
                               srcFormat, PR_TRUE);
 }
 
-#if 0
-// ImageData getImageData (in float x, in float y, in float width, in float height);
-NS_IMETHODIMP
-WebGLContext::GetImageData(PRUint32 x, PRUint32 y, PRUint32 w, PRUint32 h)
-{
-    // disabled due to win32 linkage issues with thebes symbols and NS_RELEASE
-    return NS_ERROR_FAILURE;
-
-#if 0
-    NativeJSContext js;
-    if (NS_FAILED(js.error))
-        return js.error;
-
-    if (js.argc != 4) return NS_ERROR_INVALID_ARG;
-    
-    if (!mGLPbuffer ||
-        !mGLPbuffer->ThebesSurface())
-        return NS_ERROR_FAILURE;
-
-    if (!mCanvasElement)
-        return NS_ERROR_FAILURE;
-
-    if (HTMLCanvasElement()->IsWriteOnly() && !IsCallerTrustedForRead()) {
-        // XXX ERRMSG we need to report an error to developers here! (bug 329026)
-        return NS_ERROR_DOM_SECURITY_ERR;
-    }
-
-    JSContext *ctx = js.ctx;
-
-    if (!CanvasUtils::CheckSaneSubrectSize (x, y, w, h, mWidth, mHeight))
-        return NS_ERROR_DOM_SYNTAX_ERR;
-
-    nsAutoArrayPtr<PRUint8> surfaceData (new (std::nothrow) PRUint8[w * h * 4]);
-    int surfaceDataStride = w*4;
-    int surfaceDataOffset = 0;
-
-    if (!surfaceData)
-        return NS_ERROR_OUT_OF_MEMORY;
-
-    nsRefPtr<gfxImageSurface> tmpsurf = new gfxImageSurface(surfaceData,
-                                                            gfxIntSize(w, h),
-                                                            w * 4,
-                                                            gfxASurface::ImageFormatARGB32);
-    if (!tmpsurf || tmpsurf->CairoStatus())
-        return NS_ERROR_FAILURE;
-
-    nsRefPtr<gfxContext> tmpctx = new gfxContext(tmpsurf);
-
-    if (!tmpctx || tmpctx->HasError())
-        return NS_ERROR_FAILURE;
-
-    nsRefPtr<gfxASurface> surf = mGLPbuffer->ThebesSurface();
-    nsRefPtr<gfxPattern> pat = CanvasGLThebes::CreatePattern(surf);
-    gfxMatrix m;
-    m.Translate(gfxPoint(x, mGLPbuffer->Height()-y));
-    m.Scale(1.0, -1.0);
-    pat->SetMatrix(m);
-
-    // XXX I don't want to use PixelSnapped here, but layout doesn't guarantee
-    // pixel alignment for this stuff!
-    tmpctx->NewPath();
-    tmpctx->PixelSnappedRectangleAndSetPattern(gfxRect(0, 0, w, h), pat);
-    tmpctx->SetOperator(gfxContext::OPERATOR_SOURCE);
-    tmpctx->Fill();
-
-    tmpctx = nsnull;
-    tmpsurf = nsnull;
-
-    PRUint32 len = w * h * 4;
-    if (len > (((PRUint32)0xfff00000)/sizeof(jsval)))
-        return NS_ERROR_INVALID_ARG;
-
-    nsAutoArrayPtr<jsval> jsvector(new (std::nothrow) jsval[w * h * 4]);
-    if (!jsvector)
-        return NS_ERROR_OUT_OF_MEMORY;
-    jsval *dest = jsvector.get();
-    PRUint8 *row;
-    for (PRUint32 j = 0; j < h; j++) {
-        row = surfaceData + surfaceDataOffset + (surfaceDataStride * j);
-        for (PRUint32 i = 0; i < w; i++) {
-            // XXX Is there some useful swizzle MMX we can use here?
-            // I guess we have to INT_TO_JSVAL still
-#ifdef IS_LITTLE_ENDIAN
-            PRUint8 b = *row++;
-            PRUint8 g = *row++;
-            PRUint8 r = *row++;
-            PRUint8 a = *row++;
-#else
-            PRUint8 a = *row++;
-            PRUint8 r = *row++;
-            PRUint8 g = *row++;
-            PRUint8 b = *row++;
-#endif
-            // Convert to non-premultiplied color
-            if (a != 0) {
-                r = (r * 255) / a;
-                g = (g * 255) / a;
-                b = (b * 255) / a;
-            }
-
-            *dest++ = INT_TO_JSVAL(r);
-            *dest++ = INT_TO_JSVAL(g);
-            *dest++ = INT_TO_JSVAL(b);
-            *dest++ = INT_TO_JSVAL(a);
-        }
-    }
-
-    JSObject *dataArray = JS_NewArrayObject(ctx, w*h*4, jsvector);
-    if (!dataArray)
-        return NS_ERROR_OUT_OF_MEMORY;
-
-    JSObjectHelper retobj(&js);
-    retobj.DefineProperty("width", w);
-    retobj.DefineProperty("height", h);
-    retobj.DefineProperty("data", dataArray);
-
-    js.SetRetVal(retobj);
-
-    return NS_OK;
-#endif
-}
-#endif
-
 PRBool
 BaseTypeAndSizeFromUniformType(WebGLenum uType, WebGLenum *baseType, WebGLint *unitSize)
 {
diff --git a/content/canvas/src/WebGLContextNotSupported.cpp b/content/canvas/src/WebGLContextNotSupported.cpp
index 7e034c3c3f0d..0e4c16bc4d2e 100644
--- a/content/canvas/src/WebGLContextNotSupported.cpp
+++ b/content/canvas/src/WebGLContextNotSupported.cpp
@@ -36,12 +36,12 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
-#include "nsICanvasRenderingContextWebGL.h"
+#include "nsIDOMWebGLRenderingContext.h"
 #include "nsDOMClassInfoID.h"
 
 #define DUMMY(func,rtype)  nsresult func (rtype ** aResult) { return NS_ERROR_FAILURE; }
 
-DUMMY(NS_NewCanvasRenderingContextWebGL, nsICanvasRenderingContextWebGL)
+DUMMY(NS_NewCanvasRenderingContextWebGL, nsIDOMWebGLRenderingContext)
 
 DOMCI_DATA(CanvasRenderingContextWebGL, void)
 DOMCI_DATA(WebGLBuffer, void)
diff --git a/content/canvas/test/webgl/README.mozilla b/content/canvas/test/webgl/README.mozilla
index 1d5433e513f9..13b83daa16c4 100644
--- a/content/canvas/test/webgl/README.mozilla
+++ b/content/canvas/test/webgl/README.mozilla
@@ -1,6 +1,6 @@
 This is a local copy of the WebGL conformance suite.
 
-  SVN revision: 11955
+  SVN revision: 12905
 
 The canonical location for this testsuite is:
 
diff --git a/content/canvas/test/webgl/conformance/00_testFIXME_list.txt b/content/canvas/test/webgl/conformance/00_testFIXME_list.txt
index f98f751dfbbb..7912f6548aed 100644
--- a/content/canvas/test/webgl/conformance/00_testFIXME_list.txt
+++ b/content/canvas/test/webgl/conformance/00_testFIXME_list.txt
@@ -7,7 +7,6 @@ buffer-data-array-buffer.html
 canvas-test.html
 constants.html
 context-attributes-alpha-depth-stencil-antialias.html
-context-attributes.html
 context-type-test.html
 copy-tex-image-and-sub-image-2d.html
 draw-arrays-out-of-bounds.html
@@ -17,11 +16,13 @@ framebuffer-object-attachment.html
 framebuffer-test.html
 get-active-test.html
 gl-bind-attrib-location-test.html
+gl-clear.html
 gl-drawelements.html
 gl-enable-enum-test.html
 gl-enable-vertex-attrib.html
 gl-enum-tests.html
 gl-get-active-attribute.html
+gl-get-active-uniform.html
 gl-get-calls.html
 gl-getstring.html
 gl-object-get-calls.html
@@ -45,10 +46,13 @@ index-validation-with-resized-buffer.html
 index-validation.html
 invalid-UTF-16.html
 invalid-passed-params.html
+is-object.html
 methods.html
 more-than-65536-points.html
 null-object-behaviour.html
 null-uniform-location.html
+object-deletion-behaviour.html
+origin-clean-conformance.html
 point-size.html
 program-test.html
 read-pixels-pack-alignment.html
@@ -72,7 +76,9 @@ texture-formats-test.html
 texture-npot.html
 texture-transparent-pixels-initialized.html
 triangle.html
-#uniform-location.html
+type-conversion-test.html
+uniform-location.html
 uniform-samplers-test.html
 uninitialized-test.html
 viewport-unchanged-upon-resize.html
+webgl-specific.html
diff --git a/content/canvas/test/webgl/conformance/00_test_list.txt b/content/canvas/test/webgl/conformance/00_test_list.txt
deleted file mode 100644
index 640d55244c93..000000000000
--- a/content/canvas/test/webgl/conformance/00_test_list.txt
+++ /dev/null
@@ -1,82 +0,0 @@
-array-buffer-crash.html
-array-buffer-view-crash.html
-array-unit-tests.html
-bad-arguments-test.html
-buffer-bind-test.html
-buffer-data-array-buffer.html
-canvas-test.html
-constants.html
-context-attributes-alpha-depth-stencil-antialias.html
-context-attributes.html
-context-type-test.html
-copy-tex-image-and-sub-image-2d.html
-draw-arrays-out-of-bounds.html
-draw-elements-out-of-bounds.html
-error-reporting.html
-framebuffer-object-attachment.html
-framebuffer-test.html
-get-active-test.html
-gl-bind-attrib-location-test.html
-gl-clear.html
-gl-drawelements.html
-gl-enable-enum-test.html
-gl-enable-vertex-attrib.html
-gl-enum-tests.html
-gl-get-active-attribute.html
-gl-get-active-uniform.html
-gl-get-calls.html
-gl-getstring.html
-gl-object-get-calls.html
-gl-pixelstorei.html
-gl-scissor-test.html
-gl-shader-test.html
-gl-teximage.html
-gl-uniform-arrays.html
-gl-uniform-bool.html
-gl-uniformmatrix4fv.html
-gl-unknown-uniform.html
-gl-vertex-attrib.html
-gl-vertexattribpointer.html
-glsl-2types-of-textures-on-same-unit.html
-glsl-conformance.html
-incorrect-context-object-behaviour.html
-index-validation-copies-indices.html
-index-validation-crash-with-buffer-sub-data.html
-index-validation-verifies-too-many-indices.html
-index-validation-with-resized-buffer.html
-index-validation.html
-invalid-UTF-16.html
-invalid-passed-params.html
-methods.html
-more-than-65536-points.html
-null-object-behaviour.html
-null-uniform-location.html
-object-deletion-behaviour.html
-origin-clean-conformance.html
-point-size.html
-program-test.html
-read-pixels-pack-alignment.html
-read-pixels-test.html
-renderbuffer-initialization.html
-resource-sharing-test.html
-tex-image-and-sub-image-2d-with-array-buffer-view.html
-tex-image-and-sub-image-2d-with-image-data.html
-tex-image-and-sub-image-2d-with-image.html
-tex-image-and-sub-image-2d-with-video.html
-tex-image-and-uniform-binding-bugs.html
-tex-image-with-format-and-type.html
-tex-image-with-invalid-data.html
-tex-input-validation.html
-tex-sub-image-2d.html
-texparameter-test.html
-texture-active-bind-2.html
-texture-active-bind.html
-texture-complete.html
-texture-formats-test.html
-texture-npot.html
-texture-transparent-pixels-initialized.html
-triangle.html
-uniform-location.html
-uniform-samplers-test.html
-uninitialized-test.html
-viewport-unchanged-upon-resize.html
diff --git a/content/canvas/test/webgl/conformance/array-unit-tests.html b/content/canvas/test/webgl/conformance/array-unit-tests.html
index d5c72a1d490a..54c0f8e87ca2 100644
--- a/content/canvas/test/webgl/conformance/array-unit-tests.html
+++ b/content/canvas/test/webgl/conformance/array-unit-tests.html
@@ -438,6 +438,15 @@ function testConstructionWithUnalignedOffset(type, name, elementSizeInBytes) {
     }
 }
 
+function testConstructionWithUnalignedLength(type, name, elementSizeInBytes) {
+    if (elementSizeInBytes > 1) {
+        shouldThrowIndexSizeErr(function() {
+            var buffer = new ArrayBuffer(elementSizeInBytes + 1);
+            var array = new type(buffer, 0);
+        }, "Construction of " + name + " with unaligned length");
+    }
+}
+
 function testConstructionOfHugeArray(type, name, sz) {
     if (sz == 1)
         return;
@@ -671,6 +680,7 @@ function runTests() {
     testConstructionWithOutOfRangeValues(type, name);
     testConstructionWithNegativeOutOfRangeValues(type, name);
     testConstructionWithUnalignedOffset(type, name, testCase.elementSizeInBytes);
+    testConstructionWithUnalignedLength(type, name, testCase.elementSizeInBytes);
     testConstructionOfHugeArray(type, name, testCase.elementSizeInBytes);
     testConstructionWithBothArrayBufferAndLength(type, name, testCase.elementSizeInBytes);
     testSlicingWithOutOfRangeValues(type, name, testCase.elementSizeInBytes);
diff --git a/content/canvas/test/webgl/conformance/bad-arguments-test.html b/content/canvas/test/webgl/conformance/bad-arguments-test.html
index f2a9b5fa1aa1..3b38115952fc 100644
--- a/content/canvas/test/webgl/conformance/bad-arguments-test.html
+++ b/content/canvas/test/webgl/conformance/bad-arguments-test.html
@@ -79,7 +79,6 @@ for (var i = 0; i < arguments.length; ++i) {
   argument = arguments[i].value;
   func("context.compileShader(argument)");
   func("context.linkProgram(argument)");
-  func("context.attachShader(argument)");
   func("context.attachShader(program, argument)");
   func("context.attachShader(argument, shader)");
   func("context.detachShader(program, argument)");
diff --git a/content/canvas/test/webgl/conformance/buffer-data-array-buffer.html b/content/canvas/test/webgl/conformance/buffer-data-array-buffer.html
index eb85d7c9b363..0be24dc7fb59 100644
--- a/content/canvas/test/webgl/conformance/buffer-data-array-buffer.html
+++ b/content/canvas/test/webgl/conformance/buffer-data-array-buffer.html
@@ -33,6 +33,10 @@ glErrorShouldBe(gl, gl.INVALID_OPERATION);
 gl.bindBuffer(gl.ARRAY_BUFFER, buf);
 glErrorShouldBe(gl, gl.NO_ERROR);
 
+// This should not crash, but the selection of the overload is ambiguous per Web IDL.
+gl.bufferData(gl.ARRAY_BUFFER, null, gl.STATIC_DRAW);
+gl.getError();
+
 gl.bufferData(gl.ARRAY_BUFFER, array, gl.STATIC_DRAW);
 glErrorShouldBe(gl, gl.NO_ERROR);
 
@@ -41,6 +45,9 @@ array = new ArrayBuffer(64);
 gl.bufferSubData(gl.ARRAY_BUFFER, 10, array);
 glErrorShouldBe(gl, gl.NO_ERROR);
 
+gl.bufferSubData(gl.ARRAY_BUFFER, 10, null);
+glErrorShouldBe(gl, gl.NO_ERROR);
+
 successfullyParsed = true;
 </script>
 
diff --git a/content/canvas/test/webgl/conformance/constants.html b/content/canvas/test/webgl/conformance/constants.html
index 1dff6df0f73a..380092b9abda 100644
--- a/content/canvas/test/webgl/conformance/constants.html
+++ b/content/canvas/test/webgl/conformance/constants.html
@@ -375,10 +375,6 @@ VERTEX_ATTRIB_ARRAY_NORMALIZED     : 0x886A,
 VERTEX_ATTRIB_ARRAY_POINTER        : 0x8645,
 VERTEX_ATTRIB_ARRAY_BUFFER_BINDING : 0x889F,
     
-    /* Read Format */
-IMPLEMENTATION_COLOR_READ_TYPE   : 0x8B9A,
-IMPLEMENTATION_COLOR_READ_FORMAT : 0x8B9B,
-    
     /* Shader Source */
 COMPILE_STATUS                 : 0x8B81,
 INFO_LOG_LENGTH                : 0x8B84,
@@ -403,6 +399,7 @@ RGB565                         : 0x8D62,
 DEPTH_COMPONENT16              : 0x81A5,
 STENCIL_INDEX                  : 0x1901,
 STENCIL_INDEX8                 : 0x8D48,
+DEPTH_STENCIL                  : 0x84F9,
     
 RENDERBUFFER_WIDTH             : 0x8D42,
 RENDERBUFFER_HEIGHT            : 0x8D43,
@@ -422,6 +419,7 @@ FRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE : 0x8CD3,
 COLOR_ATTACHMENT0              : 0x8CE0,
 DEPTH_ATTACHMENT               : 0x8D00,
 STENCIL_ATTACHMENT             : 0x8D20,
+DEPTH_STENCIL_ATTACHMENT       : 0x821A,
     
 NONE                           : 0,
     
@@ -435,7 +433,14 @@ FRAMEBUFFER_BINDING            : 0x8CA6,
 RENDERBUFFER_BINDING           : 0x8CA7,
 MAX_RENDERBUFFER_SIZE          : 0x84E8,
     
-INVALID_FRAMEBUFFER_OPERATION  : 0x0506
+INVALID_FRAMEBUFFER_OPERATION  : 0x0506,
+
+/* WebGL-specific enums */
+UNPACK_FLIP_Y_WEBGL                : 0x9240,
+UNPACK_PREMULTIPLY_ALPHA_WEBGL     : 0x9241,
+CONTEXT_LOST_WEBGL                 : 0x9242,
+UNPACK_COLORSPACE_CONVERSION_WEBGL : 0x9243,
+BROWSER_DEFAULT_WEBGL              : 0x9244
 };
 
 function assertProperty(v, p) {
diff --git a/content/canvas/test/webgl/conformance/context-attributes-alpha-depth-stencil-antialias.html b/content/canvas/test/webgl/conformance/context-attributes-alpha-depth-stencil-antialias.html
index edbdc4ad764a..e97025f9ab4d 100644
--- a/content/canvas/test/webgl/conformance/context-attributes-alpha-depth-stencil-antialias.html
+++ b/content/canvas/test/webgl/conformance/context-attributes-alpha-depth-stencil-antialias.html
@@ -54,66 +54,14 @@ function init()
 
 function getWebGL(canvasName, contextAttribs, clearColor, clearDepth, clearStencil)
 {
-    var canvas = document.getElementById(canvasName);
-    var gl = canvas.getContext("experimental-webgl", contextAttribs);
-    if (!gl) {
-        alert("No WebGL context found");
-        return null;
+    var context = initWebGL(canvasName, "vshader", "fshader", ["pos", "colorIn"], clearColor, clearDepth, contextAttribs);
+    if (context) {
+        context.clearStencil(clearStencil);
+        context.enable(context.STENCIL_TEST);
+        context.disable(context.BLEND);
+        context.clear(context.COLOR_BUFFER_BIT | context.DEPTH_BUFFER_BIT | context.STENCIL_BUFFER_BIT);
     }
-    var actualContextAttribs = gl.getContextAttributes();
-
-    // Add a console
-    gl.console = ("console" in window) ? window.console : { log: function() { } };
-
-    // create our shaders
-    var vertexShader = loadShader(gl, "vshader");
-    var fragmentShader = loadShader(gl, "fshader");
-
-    if (!vertexShader || !fragmentShader)
-        return null;
-
-    // Create the program object
-    gl.program = gl.createProgram();
-
-    if (!gl.program)
-        return null;
-
-    // Attach our two shaders to the program
-    gl.attachShader(gl.program, vertexShader);
-    gl.attachShader(gl.program, fragmentShader);
-
-    // Bind attributes
-    var attribs = [ "pos", "colorIn" ];
-    for (var i in attribs)
-        gl.bindAttribLocation(gl.program, i, attribs[i]);
-
-    // Link the program
-    gl.linkProgram(gl.program);
-
-    // Check the link status
-    var linked = gl.getProgramParameter(gl.program, gl.LINK_STATUS);
-    if (!linked) {
-        // something went wrong with the link
-        var error = gl.getProgramInfoLog (gl.program);
-        gl.console.log("Error in program linking:"+error);
-
-        gl.deleteProgram(gl.program);
-        gl.deleteProgram(fragmentShader);
-        gl.deleteProgram(vertexShader);
-
-        return null;
-    }
-
-    gl.useProgram(gl.program);
-
-    gl.clearColor(clearColor[0], clearColor[1], clearColor[2], clearColor[3]);
-    gl.clearDepth(clearDepth);
-    gl.clearStencil(clearStencil);
-    gl.enable(gl.DEPTH_TEST);
-    gl.enable(gl.STENCIL_TEST);
-    gl.clear(gl.COLOR_BUFFER_BIT | gl.DEPTH_BUFFER_BIT | gl.STENCIL_BUFFER_BIT);
-
-    return gl;
+    return context;
 }
 
 function drawAndReadPixel(gl, vertices, colors, x, y)
@@ -146,11 +94,6 @@ function testAlpha(alpha)
     else
         shouldBeNonNull("webGL = getWebGL('alphaOff', { alpha: false, depth: false, stencil: false, antialias: false }, [ 0, 0, 0, 0 ], 1, 0)");
     shouldBeNonNull("contextAttribs = webGL.getContextAttributes()");
-    shouldBe("contextAttribs.alpha", (alpha ? "true" : "false"));
-    shouldBe("contextAttribs.depth", "false");
-    shouldBe("contextAttribs.stencil", "false");
-    shouldBe("contextAttribs.antialias", "false");
-    shouldBe("contextAttribs.premultipliedAlpha", "true");
 
     var buf = new Uint8Array(1 * 1 * 4);
     webGL.readPixels(0, 0, 1, 1, webGL.RGBA, webGL.UNSIGNED_BYTE, buf);
@@ -158,7 +101,7 @@ function testAlpha(alpha)
     pixel[1] = buf[1];
     pixel[2] = buf[2];
     pixel[3] = buf[3];
-    correctColor = (alpha ? [0, 0, 0, 0] : [0, 0, 0, 255]);
+    correctColor = (contextAttribs.alpha ? [0, 0, 0, 0] : [0, 0, 0, 255]);
     shouldBe("pixel", "correctColor");
 }
 
@@ -170,11 +113,6 @@ function testDepth(depth)
     else
         shouldBeNonNull("webGL = getWebGL('depthOff', { depth: false, stencil: false, antialias: false }, [ 0, 0, 0, 1 ], 1, 0)");
     shouldBeNonNull("contextAttribs = webGL.getContextAttributes()");
-    shouldBe("contextAttribs.depth", (depth ? "true" : "false"));
-    shouldBe("contextAttribs.alpha", "true");
-    shouldBe("contextAttribs.stencil", "false");
-    shouldBe("contextAttribs.antialias", "false");
-    shouldBe("contextAttribs.premultipliedAlpha", "true");
 
     webGL.depthFunc(webGL.NEVER);
 
@@ -198,7 +136,7 @@ function testDepth(depth)
     pixel[1] = buf[1];
     pixel[2] = buf[2];
     pixel[3] = buf[3];
-    correctColor = (depth ? [0, 0, 0, 255] : [255, 0, 0, 255]);
+    correctColor = (contextAttribs.depth ? [0, 0, 0, 255] : [255, 0, 0, 255]);
     shouldBe("pixel", "correctColor");
 }
 
@@ -210,11 +148,6 @@ function testStencil(stencil)
     else
         shouldBeNonNull("webGL = getWebGL('stencilOff', { depth: false, stencil: false, antialias: false }, [ 0, 0, 0, 1 ], 1, 0)");
     shouldBeNonNull("contextAttribs = webGL.getContextAttributes()");
-    // If EXT_packed_depth_stencil is supported, both depth & stencil will be true; otherwise, both will be false.
-    shouldBe("contextAttribs.depth == contextAttribs.stencil", "true");
-    shouldBe("contextAttribs.alpha", "true");
-    shouldBe("contextAttribs.antialias", "false");
-    shouldBe("contextAttribs.premultipliedAlpha", "true");
 
     webGL.depthFunc(webGL.ALWAYS);
 
@@ -241,10 +174,7 @@ function testStencil(stencil)
     pixel[1] = buf[1];
     pixel[2] = buf[2];
     pixel[3] = buf[3];
-    correctColor = (stencil ? [0, 0, 0, 255] : [255, 0, 0, 255]);
-    // If stencil is requested but not supported, we fake the effect.
-    if (stencil && !contextAttribs.stencil)
-        pixel[0] = 0;
+    correctColor = (contextAttribs.stencil ? [0, 0, 0, 255] : [255, 0, 0, 255]);
     shouldBe("pixel", "correctColor");
 }
 
@@ -256,11 +186,6 @@ function testAntialias(antialias)
     else
         shouldBeNonNull("webGL = getWebGL('antialiasOff', { depth: false, stencil: false, alpha: false, antialias: false }, [ 0, 0, 0, 1 ], 1, 0)");
     shouldBeNonNull("contextAttribs = webGL.getContextAttributes()");
-    shouldBe("contextAttribs.depth", "false");
-    shouldBe("contextAttribs.stencil", "false");
-    shouldBe("contextAttribs.alpha", "false");
-    shouldBe("contextAttribs.antialias == true || contextAttribs.antialias == false", "true");
-    shouldBe("contextAttribs.premultipliedAlpha", "true");
 
     var vertices = new Float32Array([
          1.0, 1.0, 0.0,
@@ -272,10 +197,7 @@ function testAntialias(antialias)
         255, 0, 0, 255]);
     var buf = drawAndReadPixel(webGL, vertices, colors, 0, 0);
     pixel[0] = buf[0];
-    // If antialias is requested but not supported, we fake the effect.
-    if (antialias && !contextAttribs.antialias)
-        pixel[0] = 127;
-    shouldBe("pixel[0] == 255 || pixel[0] == 0", (antialias ? "false" : "true"));
+    shouldBe("pixel[0] != 255 && pixel[0] != 0", "contextAttribs.antialias");
 }
 
 function runTest()
diff --git a/content/canvas/test/webgl/conformance/context-attributes.html b/content/canvas/test/webgl/conformance/context-attributes.html
deleted file mode 100644
index ec8827710d73..000000000000
--- a/content/canvas/test/webgl/conformance/context-attributes.html
+++ /dev/null
@@ -1,66 +0,0 @@
-<!--
-Copyright (c) 2010 The Chromium Authors. All rights reserved.
-Use of this source code is governed by a BSD-style license that can be
-found in the LICENSE file.
- -->
-<html>
-<head>
-<link rel="stylesheet" href="../resources/js-test-style.css"/>
-<script src="../resources/js-test-pre.js"></script>
-<script src="resources/webgl-test.js"></script>
-</head>
-<body>
-<div id="description"></div>
-<div id="console"></div>
-
-<script>
-description("Test passing down and fetching of WebGLContextAttributes");
-
-debug("Test default values");
-var context;
-var attribs;
-shouldBeNonNull("context = create3DContext(null)");
-shouldBeNonNull("attribs = context.getContextAttributes()");
-shouldBe("attribs.depth", "true");
-shouldBe("attribs.alpha", "true");
-shouldBe("attribs.stencil", "false");
-// Antialias is requested by default, but might or might not be supported.
-shouldBe("attribs.antialias == true || attribs.antialias == false", "true");
-shouldBe("attribs.premultipliedAlpha", "true");
-
-debug ("Test customized values");
-shouldBeNonNull("context = create3DContext(null, { stencil: false, antialias: false })");
-shouldBeNonNull("attribs = context.getContextAttributes()");
-shouldBe("attribs.depth", "true");
-shouldBe("attribs.alpha", "true");
-shouldBe("attribs.stencil", "false");
-shouldBe("attribs.antialias", "false");
-shouldBe("attribs.premultipliedAlpha", "true");
-
-debug("Test customized values");
-// (stencil == true && depth == false) is not supported.
-// Default depth to true if EXT_packed_depth_stencil is supported.
-// Otherwise, both depth and stencil should be false.
-shouldBeNonNull("context = create3DContext(null, { depth: false, stencil: true, antialias: false })");
-shouldBeNonNull("attribs = context.getContextAttributes()");
-shouldBe("attribs.depth == attribs.stencil", "true");
-shouldBe("attribs.alpha", "true");
-shouldBe("attribs.antialias", "false");
-shouldBe("attribs.premultipliedAlpha", "true");
-
-debug("Test customized values");
-// (premultipliedAlpha == false) is not supported by most implementations yet
-shouldBeNonNull("context = create3DContext(null, { premultipliedAlpha: false, antialias: false })");
-shouldBeNonNull("attribs = context.getContextAttributes()");
-shouldBe("attribs.depth", "true");
-shouldBe("attribs.alpha", "true");
-shouldBe("attribs.stencil == true || attribs.stencil == false", "true");
-shouldBe("attribs.antialias", "false");
-shouldBe("attribs.premultipliedAlpha == true || attribs.premultipliedAlpha == false", "true");
-
-successfullyParsed = true;
-</script>
-
-<script src="../resources/js-test-post.js"></script>
-</body>
-</html>
diff --git a/content/canvas/test/webgl/conformance/copy-tex-image-and-sub-image-2d.html b/content/canvas/test/webgl/conformance/copy-tex-image-and-sub-image-2d.html
index 141d4e8bb441..fb0dfa7c3cb7 100644
--- a/content/canvas/test/webgl/conformance/copy-tex-image-and-sub-image-2d.html
+++ b/content/canvas/test/webgl/conformance/copy-tex-image-and-sub-image-2d.html
@@ -88,7 +88,7 @@ function runTestIteration(antialias)
     gl.enableVertexAttribArray(0);
     gl.vertexAttribPointer(0, 3, gl.FLOAT, false, 0, 0);
     gl.enableVertexAttribArray(1);
-    gl.vertexAttribPointer(1, 2, gl.FLOAT, gl.FALSE, 0, texCoordOffset);
+    gl.vertexAttribPointer(1, 2, gl.FLOAT, false, 0, texCoordOffset);
 
     gl.colorMask(1, 1, 1, 0);
     gl.disable(gl.BLEND);
diff --git a/content/canvas/test/webgl/conformance/draw-arrays-out-of-bounds.html b/content/canvas/test/webgl/conformance/draw-arrays-out-of-bounds.html
index e2ae5c7a796f..5474d79ab6e0 100644
--- a/content/canvas/test/webgl/conformance/draw-arrays-out-of-bounds.html
+++ b/content/canvas/test/webgl/conformance/draw-arrays-out-of-bounds.html
@@ -50,10 +50,10 @@ shouldGenerateGLError(context, context.INVALID_OPERATION, "context.drawArrays(co
 shouldGenerateGLError(context, context.INVALID_OPERATION, "context.drawArrays(context.TRIANGLES, 0, 10000)");
 shouldGenerateGLError(context, context.INVALID_OPERATION, "context.drawArrays(context.TRIANGLES, 0, 10000000000000)");
 shouldGenerateGLError(context, context.INVALID_VALUE, "context.drawArrays(context.TRIANGLES, 0, -1)");
-shouldGenerateGLError(context, context.INVALID_OPERATION, "context.drawArrays(context.TRIANGLES, 1, 0)");
+shouldGenerateGLError(context, context.NO_ERROR, "context.drawArrays(context.TRIANGLES, 1, 0)");
 shouldGenerateGLError(context, context.INVALID_VALUE, "context.drawArrays(context.TRIANGLES, -1, 0)");
 shouldGenerateGLError(context, context.NO_ERROR, "context.drawArrays(context.TRIANGLES, 0, 0)");
-shouldGenerateGLError(context, context.INVALID_OPERATION, "context.drawArrays(context.TRIANGLES, 100, 0)");
+shouldGenerateGLError(context, context.NO_ERROR, "context.drawArrays(context.TRIANGLES, 100, 0)");
 shouldGenerateGLError(context, context.INVALID_VALUE, "context.drawArrays(context.TRIANGLES, 1, -1)");
 shouldGenerateGLError(context, context.INVALID_VALUE, "context.drawArrays(context.TRIANGLES, -1, 1)");
 
@@ -69,7 +69,7 @@ shouldGenerateGLError(context, context.INVALID_OPERATION, "context.drawArrays(co
 shouldGenerateGLError(context, context.INVALID_VALUE, "context.drawArrays(context.TRIANGLES, 0, -1)");
 shouldGenerateGLError(context, context.INVALID_VALUE, "context.drawArrays(context.TRIANGLES, -1, 0)");
 shouldGenerateGLError(context, context.NO_ERROR, "context.drawArrays(context.TRIANGLES, 0, 0)");
-shouldGenerateGLError(context, context.INVALID_OPERATION, "context.drawArrays(context.TRIANGLES, 100, 0)");
+shouldGenerateGLError(context, context.NO_ERROR, "context.drawArrays(context.TRIANGLES, 100, 0)");
 shouldGenerateGLError(context, context.INVALID_VALUE, "context.drawArrays(context.TRIANGLES, 1, -1)");
 shouldGenerateGLError(context, context.INVALID_VALUE, "context.drawArrays(context.TRIANGLES, -1, 1)");
 
diff --git a/content/canvas/test/webgl/conformance/draw-elements-out-of-bounds.html b/content/canvas/test/webgl/conformance/draw-elements-out-of-bounds.html
index 763c4a528a46..5957a8f47a75 100644
--- a/content/canvas/test/webgl/conformance/draw-elements-out-of-bounds.html
+++ b/content/canvas/test/webgl/conformance/draw-elements-out-of-bounds.html
@@ -74,7 +74,7 @@ shouldGenerateGLError(context, context.INVALID_VALUE, "context.drawElements(cont
 shouldGenerateGLError(context, context.INVALID_VALUE, "context.drawElements(context.TRIANGLES, 0, context.UNSIGNED_BYTE, -1)");
 shouldGenerateGLError(context, context.INVALID_VALUE, "context.drawElements(context.TRIANGLES, -1, context.UNSIGNED_BYTE, 1)");
 shouldGenerateGLError(context, context.INVALID_VALUE, "context.drawElements(context.TRIANGLES, 1, context.UNSIGNED_BYTE, -1)");
-shouldGenerateGLError(context, context.INVALID_OPERATION, "context.drawElements(context.TRIANGLES, 0, context.UNSIGNED_BYTE, 4)");
+shouldGenerateGLError(context, context.NO_ERROR, "context.drawElements(context.TRIANGLES, 0, context.UNSIGNED_BYTE, 4)");
 shouldGenerateGLError(context, context.INVALID_VALUE, "context.drawElements(context.TRIANGLES, 0xffffffff, context.UNSIGNED_BYTE, 0)");
 shouldGenerateGLError(context, context.INVALID_OPERATION, "context.drawElements(context.TRIANGLES, 0x7fffffff, context.UNSIGNED_BYTE, 0)");
 shouldGenerateGLError(context, context.INVALID_OPERATION, "context.drawElements(context.TRIANGLES, 0x7fffffff, context.UNSIGNED_BYTE, 0x7fffffff)");
diff --git a/content/canvas/test/webgl/conformance/framebuffer-object-attachment.html b/content/canvas/test/webgl/conformance/framebuffer-object-attachment.html
index 20d2518b11f8..e5caa22f4777 100644
--- a/content/canvas/test/webgl/conformance/framebuffer-object-attachment.html
+++ b/content/canvas/test/webgl/conformance/framebuffer-object-attachment.html
@@ -28,25 +28,29 @@ function testAttachment(attachment, buffer, isConflicted)
 {
     shouldBeNonNull("fbo = gl.createFramebuffer()");
     gl.bindFramebuffer(gl.FRAMEBUFFER, fbo);
+    gl.framebufferRenderbuffer(gl.FRAMEBUFFER, gl.COLOR_ATTACHMENT0, gl.RENDERBUFFER, colorBuffer);
     gl.framebufferRenderbuffer(gl.FRAMEBUFFER, attachment, gl.RENDERBUFFER, buffer);
-    glErrorShouldBe(gl, isConflicted ? gl.INVALID_OPERATION : gl.NO_ERROR);
+    glErrorShouldBe(gl, gl.NO_ERROR);
+    if (isConflicted) {
+        shouldBe("gl.checkFramebufferStatus(gl.FRAMEBUFFER)", "gl.FRAMEBUFFER_UNSUPPORTED");
+        gl.clear(gl.COLOR_BUFFER_BIT);
+        glErrorShouldBe(gl, gl.INVALID_FRAMEBUFFER_OPERATION);
+        gl.readPixels(0, 0, width, height, gl.RGBA, gl.UNSIGNED_BYTE, new Uint8Array(width * height * 4));
+        glErrorShouldBe(gl, gl.INVALID_FRAMEBUFFER_OPERATION);
+    }
 }
 
 function testAttachments(attachment0, buffer0, attachment1, buffer1, isConflicted)
 {
     shouldBeNonNull("fbo = gl.createFramebuffer()");
     gl.bindFramebuffer(gl.FRAMEBUFFER, fbo);
+    gl.framebufferRenderbuffer(gl.FRAMEBUFFER, gl.COLOR_ATTACHMENT0, gl.RENDERBUFFER, colorBuffer);
     gl.framebufferRenderbuffer(gl.FRAMEBUFFER, attachment0, gl.RENDERBUFFER, buffer0);
     glErrorShouldBe(gl, gl.NO_ERROR);
     gl.framebufferRenderbuffer(gl.FRAMEBUFFER, attachment1, gl.RENDERBUFFER, buffer1);
-    glErrorShouldBe(gl, isConflicted ? gl.INVALID_OPERATION : gl.NO_ERROR);
-    if (isConflicted) {
-        // Detach buffer0 first using a null object, then attaching buffer1 should succeed.
-        gl.framebufferRenderbuffer(gl.FRAMEBUFFER, attachment0, gl.RENDERBUFFER, null);
-        glErrorShouldBe(gl, gl.NO_ERROR);
-        gl.framebufferRenderbuffer(gl.FRAMEBUFFER, attachment1, gl.RENDERBUFFER, buffer1);
-        glErrorShouldBe(gl, gl.NO_ERROR);
-    }
+    glErrorShouldBe(gl, gl.NO_ERROR);
+    if (isConflicted)
+        shouldBe("gl.checkFramebufferStatus(gl.FRAMEBUFFER)", "gl.FRAMEBUFFER_UNSUPPORTED");
 }
 
 function testColorRenderbuffer(internalformat)
@@ -58,10 +62,33 @@ function testColorRenderbuffer(internalformat)
     testAttachment(gl.COLOR_ATTACHMENT0, colorBuffer, false);
 }
 
+function testDepthStencilRenderbuffer()
+{
+    shouldBeNonNull("depthStencilBuffer = gl.createRenderbuffer()");
+    gl.bindRenderbuffer(gl.RENDERBUFFER, depthStencilBuffer);
+    gl.renderbufferStorage(gl.RENDERBUFFER, gl.DEPTH_STENCIL, width, height);
+    glErrorShouldBe(gl, gl.NO_ERROR);
+    shouldBe("gl.getRenderbufferParameter(gl.RENDERBUFFER, gl.RENDERBUFFER_WIDTH)", "width");
+    shouldBe("gl.getRenderbufferParameter(gl.RENDERBUFFER, gl.RENDERBUFFER_HEIGHT)", "height");
+    shouldBe("gl.getRenderbufferParameter(gl.RENDERBUFFER, gl.RENDERBUFFER_INTERNAL_FORMAT)", "gl.DEPTH_STENCIL");
+    shouldBe("gl.getRenderbufferParameter(gl.RENDERBUFFER, gl.RENDERBUFFER_RED_SIZE)", "0");
+    shouldBe("gl.getRenderbufferParameter(gl.RENDERBUFFER, gl.RENDERBUFFER_GREEN_SIZE)", "0");
+    shouldBe("gl.getRenderbufferParameter(gl.RENDERBUFFER, gl.RENDERBUFFER_BLUE_SIZE)", "0");
+    shouldBe("gl.getRenderbufferParameter(gl.RENDERBUFFER, gl.RENDERBUFFER_ALPHA_SIZE)", "0");
+    shouldBeTrue("gl.getRenderbufferParameter(gl.RENDERBUFFER, gl.RENDERBUFFER_DEPTH_SIZE) > 0");
+    shouldBeTrue("gl.getRenderbufferParameter(gl.RENDERBUFFER, gl.RENDERBUFFER_STENCIL_SIZE) > 0");
+    glErrorShouldBe(gl, gl.NO_ERROR);
+    testAttachment(gl.DEPTH_STENCIL_ATTACHMENT, depthStencilBuffer, false);
+}
+
 description("Test framebuffer object attachment behaviors");
 
 debug("Create renderbuffers");
 shouldBeNonNull("gl = create3DContext()");
+shouldBeNonNull("colorBuffer = gl.createRenderbuffer()");
+gl.bindRenderbuffer(gl.RENDERBUFFER, colorBuffer);
+gl.renderbufferStorage(gl.RENDERBUFFER, gl.RGBA4, width, height);
+glErrorShouldBe(gl, gl.NO_ERROR);
 shouldBeNonNull("depthBuffer = gl.createRenderbuffer()");
 gl.bindRenderbuffer(gl.RENDERBUFFER, depthBuffer);
 gl.renderbufferStorage(gl.RENDERBUFFER, gl.DEPTH_COMPONENT16, width, height);
@@ -116,6 +143,9 @@ testColorRenderbuffer(gl.RGB5_A1);
 debug("Attach color renderbuffer with internalformat == RGB565");
 testColorRenderbuffer(gl.RGB565);
 
+debug("Create and attach depthStencil renderbuffer");
+testDepthStencilRenderbuffer();
+
 successfullyParsed = true;
 </script>
 
diff --git a/content/canvas/test/webgl/conformance/gl-object-get-calls.html b/content/canvas/test/webgl/conformance/gl-object-get-calls.html
index 2ee92a9b32b6..da08bdc42d19 100644
--- a/content/canvas/test/webgl/conformance/gl-object-get-calls.html
+++ b/content/canvas/test/webgl/conformance/gl-object-get-calls.html
@@ -64,7 +64,7 @@ var shaders = gl.getAttachedShaders(standardProgram);
 shouldBe('shaders.length', '2');
 shouldBeTrue('shaders[0] == standardVert && shaders[1] == standardFrag || shaders[1] == standardVert && shaders[0] == standardFrag');
 glErrorShouldBe(gl, gl.NO_ERROR);
-shouldBeUndefined('gl.getAttachedShaders(null)');
+shouldBeNull('gl.getAttachedShaders(null)');
 glErrorShouldBe(gl, gl.INVALID_VALUE);
 shouldThrow('gl.getAttachedShaders(standardVert)');
 glErrorShouldBe(gl, gl.NO_ERROR);
@@ -174,9 +174,9 @@ gl.uniform3i(bval3Loc, 1, 0, 1);
 gl.uniform4i(bval4Loc, 1, 0, 1, 0);
 glErrorShouldBe(gl, gl.NO_ERROR);
 shouldBe('gl.getUniform(boolProgram, bvalLoc)', 'true');
-shouldBe('gl.getUniform(boolProgram, bval2Loc)', '[1, 0]');
-shouldBe('gl.getUniform(boolProgram, bval3Loc)', '[1, 0, 1]');
-shouldBe('gl.getUniform(boolProgram, bval4Loc)', '[1, 0, 1, 0]');
+shouldBe('gl.getUniform(boolProgram, bval2Loc)', '[true, false]');
+shouldBe('gl.getUniform(boolProgram, bval3Loc)', '[true, false, true]');
+shouldBe('gl.getUniform(boolProgram, bval4Loc)', '[true, false, true, false]');
 // Integer uniform variables
 var intProgram = loadProgram(gl, "resources/intUniformShader.vert", "resources/noopUniformShader.frag");
 shouldBe('gl.getProgramParameter(intProgram, gl.LINK_STATUS)', 'true');
diff --git a/content/canvas/test/webgl/conformance/gl-teximage.html b/content/canvas/test/webgl/conformance/gl-teximage.html
index 218fb8a55b84..80160eec93ab 100755
--- a/content/canvas/test/webgl/conformance/gl-teximage.html
+++ b/content/canvas/test/webgl/conformance/gl-teximage.html
@@ -38,7 +38,8 @@ var imgURLs = [
   'resources/gray-ramp.png',
   'resources/zero-alpha.png',
   'resources/3x3.png',
-  'resources/blue-1x1.jpg'];
+  'resources/blue-1x1.jpg',
+  'resources/green-2x2-16bit.png'];
 
 wtu.loadImagesAsync(imgURLs, runTests);
 
@@ -167,6 +168,7 @@ function runTests(imgs) {
 
   debug("");
   debug("Check that gamma settings don't effect 8bit pngs");
+  gl.pixelStorei(gl.UNPACK_COLORSPACE_CONVERSION_WEBGL, gl.NONE);
   gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGB, gl.RGB, gl.UNSIGNED_BYTE,
                 imgs['resources/gray-ramp-default-gamma.png']);
   glErrorShouldBe(gl, gl.NO_ERROR, "Should be no errors from setup.");
@@ -289,6 +291,19 @@ function runTests(imgs) {
 
   glErrorShouldBe(gl, gl.NO_ERROR, "Should be no errors");
 
+  debug("");
+  debug("check uploading of 16-bit images");
+  gl.pixelStorei(gl.UNPACK_PREMULTIPLY_ALPHA_WEBGL, false);
+  gl.pixelStorei(gl.UNPACK_FLIP_Y_WEBGL, false);
+  gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGB, gl.RGB, gl.UNSIGNED_BYTE,
+                imgs['resources/green-2x2-16bit.png']);
+  glErrorShouldBe(gl, gl.NO_ERROR, "Should be no errors from setup");
+  wtu.drawQuad(gl);
+  gl.readPixels(0, 0, width, height, gl.RGBA, gl.UNSIGNED_BYTE, buf);
+
+  checkPixelRange(buf, middle, center, [   15, 121,   0, 255], 10);
+
+  glErrorShouldBe(gl, gl.NO_ERROR, "Should be no errors");
   debug("");
   successfullyParsed = true;
   shouldBeTrue("successfullyParsed");
diff --git a/content/canvas/test/webgl/conformance/gl-vertexattribpointer.html b/content/canvas/test/webgl/conformance/gl-vertexattribpointer.html
index 4210db601b3b..9822485b16b8 100755
--- a/content/canvas/test/webgl/conformance/gl-vertexattribpointer.html
+++ b/content/canvas/test/webgl/conformance/gl-vertexattribpointer.html
@@ -19,7 +19,7 @@ found in the LICENSE file.
 <div id="console"></div>
 <canvas id="canvas" width="2" height="2"> </canvas>
 <script>
-description("This test ensures WebGL implementations vertexAttribPointer can not be set if no buffer is bound.");
+description("This test checks vertexAttribPointer behaviors in WebGL.");
 
 debug("");
 debug("Canvas.getContext");
@@ -36,6 +36,16 @@ if (!gl) {
   gl.vertexAttribPointer(0, 3, gl.FLOAT, 0, 0, 12);
   glErrorShouldBe(gl, gl.INVALID_OPERATION,
       "vertexAttribPointer should fail if no buffer is bound");
+
+  var vertexObject = gl.createBuffer();
+  gl.bindBuffer(gl.ARRAY_BUFFER, vertexObject);
+  gl.bufferData(gl.ARRAY_BUFFER, new Float32Array(512), gl.STATIC_DRAW);
+  gl.vertexAttribPointer(0, 1, gl.FLOAT, 0, 256, 0);
+  glErrorShouldBe(gl, gl.INVALID_VALUE,
+      "WebGL API supports vertex attribute data strides up to 255 bytes");
+  gl.vertexAttribPointer(0, 1, gl.FLOAT, 0, 255, 0);
+  glErrorShouldBe(gl, gl.NO_ERROR,
+      "vertexAttribPointer with stride <= 255 should succeed");
 }
 
 debug("");
diff --git a/content/canvas/test/webgl/conformance/glsl-2types-of-textures-on-same-unit.html b/content/canvas/test/webgl/conformance/glsl-2types-of-textures-on-same-unit.html
index 2e408df7c89f..d92c4c897211 100644
--- a/content/canvas/test/webgl/conformance/glsl-2types-of-textures-on-same-unit.html
+++ b/content/canvas/test/webgl/conformance/glsl-2types-of-textures-on-same-unit.html
@@ -60,6 +60,7 @@ function init()
 
   gl = initWebGL("example", "vshader", "fshader", [ "vPosition", "texCoord0"],
                  [ 0, 0, 0, 1 ], 1);
+  gl = WebGLDebugUtils.makeDebugContext(gl);
 
   gl.disable(gl.DEPTH_TEST);
   gl.disable(gl.BLEND);
@@ -124,7 +125,7 @@ function init()
     var y = Math.floor(ii / 2);
     gl.drawArrays(gl.TRIANGLES, 0, 6);
     glErrorShouldBe(gl, gl.INVALID_OPERATION,
-                    "drawing with 2 different targets on the same texture unit should generate error");
+              "drawing with 2 different targets on the same texture unit should generate INVALID_VALUE");
   }
 }
 
diff --git a/content/canvas/test/webgl/conformance/glsl-conformance.html b/content/canvas/test/webgl/conformance/glsl-conformance.html
index e3a18cedea4f..c924ea3a144c 100755
--- a/content/canvas/test/webgl/conformance/glsl-conformance.html
+++ b/content/canvas/test/webgl/conformance/glsl-conformance.html
@@ -223,6 +223,37 @@ foo
 <script id="vshaderWith__FILE__" type="text/something-not-javascript">
 __FILE__
 </script>
+<script id="fshaderWithdFdx" type="text/something-not-javascript">
+#extension GL_OES_standard_derivatives:enable
+precision mediump float;
+void main()
+{
+    gl_FragColor = vec4(dFdx(0.5),0.0,0.0,1.0);
+}
+</script>
+<script id="fshaderWithdFdxNoExt" type="text/something-not-javascript">
+precision mediump float;
+void main()
+{
+    gl_FragColor = vec4(dFdx(0.5),0.0,0.0,1.0);
+}
+</script>
+<script id="fshaderWith256CharacterIdentifier" type="text/something-not-javascript">
+precision mediump float;
+uniform float a123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = 2.0;
+void main()
+{
+  gl_FragColor = vec4(a123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345,0.0,0.0,1.0);
+}
+</script>
+<script id="fshaderWith257CharacterIdentifier" type="text/something-not-javascript">
+precision mediump float;
+uniform float a1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456 = 2.0;
+void main()
+{
+  gl_FragColor = vec4(a1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456,0.0,0.0,1.0);
+}
+</script>
 <canvas id="canvas" width="2" height="2"> </canvas>
 <script>
 description("This test ensures WebGL implementations allow proper GLES2 shaders compile and improper ones fail.");
@@ -310,6 +341,20 @@ if (!gl) {
       linkSuccess: false,
       passMsg: 'fragment shader that uses gl_FragDepth should fail',
     },
+    { vShaderId: 'vshader',
+      vShaderSuccess: true,
+      fShaderId: 'fshaderWithdFdx',
+      fShaderSuccess: false,
+      linkSuccess: false,
+      passMsg: 'fragment shader that uses dFdx should fail',
+    },
+    { vShaderId: 'vshader',
+      vShaderSuccess: true,
+      fShaderId: 'fshaderWithdFdxNoExt',
+      fShaderSuccess: false,
+      linkSuccess: false,
+      passMsg: 'fragment shader that uses dFdx without #extension should fail',
+    },
     { vShaderId: 'vshaderWithClipVertex',
       vShaderSuccess: false,
       fShaderId: 'fshader',
@@ -415,7 +460,21 @@ if (!gl) {
       fShaderSuccess: true,
       linkSuccess: false,
       passMsg: 'vertex shader uses #line directive should report correct line',
-    }
+    },
+    { vShaderId: 'vshader',
+      vShaderSuccess: true,
+      fShaderId: 'fshaderWith256CharacterIdentifier',
+      fShaderSuccess: true,
+      linkSuccess: true,
+      passMsg: 'shared that uses 256 character identifier should succeed',
+    },
+    { vShaderId: 'vshader',
+      vShaderSuccess: true,
+      fShaderId: 'fshaderWith257CharacterIdentifier',
+      fShaderSuccess: false,
+      linkSuccess: false,
+      passMsg: 'shared that uses 257 character identifier should fail',
+    },
   ];
 
   // Read in all the shader source.
diff --git a/content/canvas/test/webgl/conformance/is-object.html b/content/canvas/test/webgl/conformance/is-object.html
new file mode 100644
index 000000000000..390f9b97d024
--- /dev/null
+++ b/content/canvas/test/webgl/conformance/is-object.html
@@ -0,0 +1,72 @@
+<html>
+<head>
+<link rel="stylesheet" href="../resources/js-test-style.css"/>
+<script src="../resources/js-test-pre.js"></script>
+<script src="resources/webgl-test.js"></script>
+<script src="resources/webgl-test-utils.js"></script>
+</head>
+<body>
+<div id="description"></div>
+<div id="console"></div>
+<canvas id="canvas">
+<script>
+var wtu;
+var canvas;
+var gl;
+var shouldGenerateGLError;
+
+var buffer;
+var framebuffer;
+var program;
+var renderbuffer;
+var shader;
+var texture;
+
+description("Tests 'is' calls against non-bound and deleted objects");
+
+wtu = WebGLTestUtils;
+canvas = document.getElementById("canvas");
+gl = wtu.create3DContext(canvas);
+shouldGenerateGLError = wtu.shouldGenerateGLError;
+
+shouldGenerateGLError(gl, gl.NO_ERROR, "buffer = gl.createBuffer()");
+shouldBeFalse("gl.isBuffer(buffer)");
+shouldGenerateGLError(gl, gl.NO_ERROR, "gl.bindBuffer(gl.ARRAY_BUFFER, buffer)");
+shouldBeTrue("gl.isBuffer(buffer)");
+debug("");
+
+shouldGenerateGLError(gl, gl.NO_ERROR, "framebuffer = gl.createFramebuffer()");
+shouldBeFalse("gl.isFramebuffer(framebuffer)");
+shouldGenerateGLError(gl, gl.NO_ERROR, "gl.bindFramebuffer(gl.FRAMEBUFFER, framebuffer)");
+shouldBeTrue("gl.isFramebuffer(framebuffer)");
+debug("");
+
+shouldGenerateGLError(gl, gl.NO_ERROR, "renderbuffer = gl.createRenderbuffer()");
+shouldBeFalse("gl.isRenderbuffer(renderbuffer)");
+shouldGenerateGLError(gl, gl.NO_ERROR, "gl.bindRenderbuffer(gl.RENDERBUFFER, renderbuffer)");
+shouldBeTrue("gl.isRenderbuffer(renderbuffer)");
+debug("");
+
+shouldGenerateGLError(gl, gl.NO_ERROR, "texture = gl.createTexture()");
+shouldBeFalse("gl.isTexture(texture)");
+shouldGenerateGLError(gl, gl.NO_ERROR, "gl.bindTexture(gl.TEXTURE_2D, texture)");
+shouldBeTrue("gl.isTexture(texture)");
+debug("");
+
+shouldGenerateGLError(gl, gl.NO_ERROR, "program = gl.createProgram()");
+shouldBeTrue("gl.isProgram(program)");
+shouldGenerateGLError(gl, gl.NO_ERROR, "gl.deleteProgram(program)");
+shouldBeFalse("gl.isProgram(program)");
+debug("");
+
+shouldGenerateGLError(gl, gl.NO_ERROR, "shader = gl.createShader(gl.VERTEX_SHADER)");
+shouldBeTrue("gl.isShader(shader)");
+shouldGenerateGLError(gl, gl.NO_ERROR, "gl.deleteShader(shader)");
+shouldBeFalse("gl.isShader(shader)");
+debug("");
+
+successfullyParsed = true;
+</script>
+<script src="../resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/content/canvas/test/webgl/conformance/read-pixels-pack-alignment.html b/content/canvas/test/webgl/conformance/read-pixels-pack-alignment.html
index 01efa0b60393..2035894492ed 100644
--- a/content/canvas/test/webgl/conformance/read-pixels-pack-alignment.html
+++ b/content/canvas/test/webgl/conformance/read-pixels-pack-alignment.html
@@ -44,8 +44,6 @@ var gl = null;
 var array = null;
 var pixel = [ 0, 0, 0, 0 ];
 var expectedColor = [ 0, 0, 0, 0 ];
-var pixelFormat = 0;
-var pixelType = 0;
 
 function calculatePixelBytes(format, type)
 {
@@ -168,38 +166,26 @@ function runTestIteration(format, type, packAlignment, width, height)
     var bytesPerPixel = calculatePixelBytes(format, type);
     var padding = calculatePaddingBytes(bytesPerPixel, packAlignment, width);
     var size = bytesPerPixel * width * height + padding * (height - 1);
-    var isShort = false;
-    switch (type) {
-    case gl.UNSIGNED_SHORT_5_6_5:
-    case gl.UNSIGNED_SHORT_4_4_4_4:
-    case gl.UNSIGNED_SHORT_5_5_5_1:
-        isShort = true;
+    if (type != gl.UNSIGNED_BYTE) {
+        throw "test error: only UNSIGNED_BYTE is valid to ReadPixels";
     }
-    if (isShort)
-        size /= 2;
     if (size < 0)
         size = 0;
-    if (type == gl.UNSIGNED_BYTE)
-        array = new Uint8Array(size);
-    else
-        array = new Uint16Array(size);
+    array = new Uint8Array(size);
     gl.readPixels(0, 0, width, height, format, type, array);
     if (width < 0 || height < 0) {
         glErrorShouldBe(gl, gl.INVALID_VALUE);
         return;
-    } else {
-        glErrorShouldBe(gl, gl.NO_ERROR);
-        if (!array.length)
-            return;
     }
+
+    glErrorShouldBe(gl, gl.NO_ERROR);
+    if (!array.length)
+        return;
+
     // Check the last pixel of the last row.
     var bytesPerRow = width * bytesPerPixel + padding;
     var pos = bytesPerRow * (height - 1) + (width - 1) * bytesPerPixel;
     var numComponents = bytesPerPixel;
-    if (isShort) {
-        pos /= 2;
-        numComponents /= 2;
-    }
     for (var i = 0; i < numComponents; ++i)
         pixel[i] = array[pos + i];
     for (var i = numComponents; i < 4; ++i)
@@ -209,75 +195,44 @@ function runTestIteration(format, type, packAlignment, width, height)
     shouldBe("pixel", "expectedColor");
 }
 
-function checkSupportedPixelFormatAndType()
-{
-    debug("Check supported pixel format/type besides RGBA/UNSIGNED_BYTE");
-    glErrorShouldBe(gl, gl.NO_ERROR);
-    pixelFormat = gl.getParameter(gl.IMPLEMENTATION_COLOR_READ_FORMAT);
-    pixelType = gl.getParameter(gl.IMPLEMENTATION_COLOR_READ_TYPE);
-    glErrorShouldBe(gl, gl.NO_ERROR);
-    shouldBeFalse("pixelFormat == gl.RGBA && pixelType == gl.UNSIGNED_BYTE");
-}
-
 description('Verify readPixels() works fine with various PACK_ALIGNMENT values.');
 
 shouldBeNonNull("gl = initWebGL('example', 'vshader', 'fshader', [ 'pos', 'colorIn' ], [ 0, 0, 0, 1 ], 1)");
 gl.disable(gl.BLEND);
 
-checkSupportedPixelFormatAndType();
+var formats = [ gl.RGBA ];
+var formatNames = [ "RGBA" ];
 
-debug("Testing format = RGBA and type = UNSIGNED_BYTE");
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 1, 1, 2);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 2, 1, 2);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 4, 1, 2);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 8, 1, 2);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 4, 2, 2);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 8, 2, 2);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 4, 3, 2);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 8, 3, 2);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 4, 4, 2);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 8, 4, 2);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 8, 5, 1);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 4, 5, 2);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 8, 5, 2);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 8, 6, 2);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 8, 7, 2);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 8, 8, 2);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 1, 0, 0);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 2, 0, 0);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 4, 0, 0);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 8, 0, 0);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 1, -1, 1);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 2, 1, -1);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 4, 0, -1);
-runTestIteration(gl.RGBA, gl.UNSIGNED_BYTE, 8, -1, -1);
-
-debug("Testing the other supported format/type combination");
-runTestIteration(pixelFormat, pixelType, 1, 1, 2);
-runTestIteration(pixelFormat, pixelType, 2, 1, 2);
-runTestIteration(pixelFormat, pixelType, 4, 1, 2);
-runTestIteration(pixelFormat, pixelType, 8, 1, 2);
-runTestIteration(pixelFormat, pixelType, 4, 2, 2);
-runTestIteration(pixelFormat, pixelType, 8, 2, 2);
-runTestIteration(pixelFormat, pixelType, 4, 3, 2);
-runTestIteration(pixelFormat, pixelType, 8, 3, 2);
-runTestIteration(pixelFormat, pixelType, 4, 4, 2);
-runTestIteration(pixelFormat, pixelType, 8, 4, 2);
-runTestIteration(pixelFormat, pixelType, 8, 5, 1);
-runTestIteration(pixelFormat, pixelType, 4, 5, 2);
-runTestIteration(pixelFormat, pixelType, 8, 5, 2);
-runTestIteration(pixelFormat, pixelType, 8, 6, 2);
-runTestIteration(pixelFormat, pixelType, 8, 7, 2);
-runTestIteration(pixelFormat, pixelType, 8, 8, 2);
-runTestIteration(pixelFormat, pixelType, 1, 0, 0);
-runTestIteration(pixelFormat, pixelType, 2, 0, 0);
-runTestIteration(pixelFormat, pixelType, 4, 0, 0);
-runTestIteration(pixelFormat, pixelType, 8, 0, 0);
-runTestIteration(pixelFormat, pixelType, 1, -1, 1);
-runTestIteration(pixelFormat, pixelType, 2, 1, -1);
-runTestIteration(pixelFormat, pixelType, 4, 0, -1);
-runTestIteration(pixelFormat, pixelType, 8, -1, -1);
+for (var i = 0; i < formats.length; ++i) {
+    var format = formats[i];
 
+    debug("Testing format = " + formatNames[i] + " and type = UNSIGNED_BYTE");
+    runTestIteration(format, gl.UNSIGNED_BYTE, 1, 1, 2);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 2, 1, 2);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 4, 1, 2);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 8, 1, 2);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 4, 2, 2);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 8, 2, 2);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 4, 3, 2);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 8, 3, 2);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 4, 4, 2);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 8, 4, 2);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 8, 5, 1);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 4, 5, 2);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 8, 5, 2);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 8, 6, 2);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 8, 7, 2);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 8, 8, 2);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 1, 0, 0);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 2, 0, 0);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 4, 0, 0);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 8, 0, 0);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 1, -1, 1);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 2, 1, -1);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 4, 0, -1);
+    runTestIteration(format, gl.UNSIGNED_BYTE, 8, -1, -1);
+}
+    
 successfullyParsed = true;
 </script>
 <script src="../resources/js-test-post.js"></script>
diff --git a/content/canvas/test/webgl/conformance/read-pixels-test.html b/content/canvas/test/webgl/conformance/read-pixels-test.html
index 79bccc003712..35b64d4db028 100644
--- a/content/canvas/test/webgl/conformance/read-pixels-test.html
+++ b/content/canvas/test/webgl/conformance/read-pixels-test.html
@@ -11,6 +11,7 @@ found in the LICENSE file.
     <link rel="stylesheet" href="../resources/js-test-style.css"/>
     <script src="../resources/js-test-pre.js"></script>
     <script src="resources/webgl-test.js"> </script>
+    <script src="resources/webgl-test-utils.js"> </script>
 </head>
 <body>
 <canvas id="example" width="200" height="200"></canvas>
@@ -19,6 +20,7 @@ found in the LICENSE file.
 <script>
 description("Checks that ReadPixels works as expected.");
 
+var wtu = WebGLTestUtils;
 var canvas = document.getElementById("example");
 var gl = create3DContext(canvas);
 
@@ -90,6 +92,56 @@ function checkBuffer(checkColor, x, y, oneColor, oneX, oneY) {
   }
 }
 
+var badFormats = [
+  {
+    format: gl.RGB,
+    type: gl.UNSIGNED_BYTE,
+    dest: new Uint8Array(3)
+  },
+  {
+    format: gl.RGB,
+    type: gl.UNSIGNED_SHORT_5_6_5,
+    dest: new Uint8Array(3)
+  },
+  {
+    format: gl.RGBA,
+    type: gl.UNSIGNED_SHORT_5_5_5_1,
+    dest: new Uint16Array(1)
+  },
+  {
+    format: gl.RGBA,
+    type: gl.UNSIGNED_SHORT_4_4_4_4,
+    dest: new Uint16Array(1)
+  },
+  {
+    format: gl.ALPHA,
+    type: gl.UNSIGNED_BYTE,
+    dest: new Uint8Array(1)
+  },
+  {
+    format: gl.LUMINANCE,
+    type: gl.UNSIGNED_BYTE,
+    dest: new Uint8Array(1) },
+  {
+    format: gl.LUMINANCE_ALPHA,
+    type: gl.UNSIGNED_BYTE,
+    dest: new Uint8Array(2)
+  }
+];
+for (var tt = 0; tt < badFormats.length; ++ tt) {
+  var info = badFormats[tt]
+  var format = info.format;
+  var type = info.type;
+  var dest = info.dest;
+  gl.readPixels(0, 0, 1, 1, format, type, dest);
+  // note that the GL error is INVALID_OPERATION if both format and type are invalid, but
+  // INVALID_ENUM if only one is.
+  glErrorShouldBe(
+      gl, (format == gl.RGBA || type == gl.UNSIGNED_BYTE) ? gl.INVALID_ENUM : gl.INVALID_OPERATION,
+      "Should not be able to read as " + wtu.glEnumToString(gl, format) +
+      " / " + wtu.glEnumToString(gl, type));
+}
+
 debug("");
 successfullyParsed = true;
 </script>
diff --git a/content/canvas/test/webgl/conformance/renderbuffer-initialization.html b/content/canvas/test/webgl/conformance/renderbuffer-initialization.html
index 3f243c298043..45b9ed6ef565 100644
--- a/content/canvas/test/webgl/conformance/renderbuffer-initialization.html
+++ b/content/canvas/test/webgl/conformance/renderbuffer-initialization.html
@@ -12,7 +12,7 @@ found in the LICENSE file.
 function runTest()
 {
     var canvas = document.getElementById("testbed");
-    var gl = canvas.getContext("experimental-webgl");
+    var gl = create3DContext(canvas);
     if (!gl) {
         testFailed('canvas.getContext() failed');
         return false;
diff --git a/content/canvas/test/webgl/conformance/tex-image-and-sub-image-2d-with-array-buffer-view.html b/content/canvas/test/webgl/conformance/tex-image-and-sub-image-2d-with-array-buffer-view.html
index 17adb0b27b30..5c3c5f021d43 100644
--- a/content/canvas/test/webgl/conformance/tex-image-and-sub-image-2d-with-array-buffer-view.html
+++ b/content/canvas/test/webgl/conformance/tex-image-and-sub-image-2d-with-array-buffer-view.html
@@ -9,46 +9,18 @@ found in the LICENSE file.
 <script src="../resources/js-test-pre.js"></script>
 <script src="resources/webgl-test.js"></script>
 <script src="resources/webgl-test-utils.js"></script>
+</head>
+<body>
+<canvas id="example" width="1px" height="2px"></canvas>
+<div id="description"></div>
+<div id="console"></div>
 <script>
+description('Verifies texImage2D and texSubImage2D code paths taking ArrayBufferView');
+
 var wtu = WebGLTestUtils;
 var gl = null;
 var textureLoc = null;
 var successfullyParsed = false;
-var imageData = null;
-
-function init()
-{
-    if (window.initNonKhronosFramework) {
-        window.initNonKhronosFramework(true);
-    }
-
-    description('Verifies texImage2D and texSubImage2D code paths taking ArrayBufferView');
-
-    var canvas2d = document.getElementById("texcanvas");
-    var context2d = canvas2d.getContext("2d");
-    imageData = context2d.createImageData(1, 2);
-    var data = imageData.data;
-    data[0] = 255;
-    data[1] = 0;
-    data[2] = 0;
-    data[3] = 255;
-    data[4] = 0;
-    data[5] = 255;
-    data[6] = 0;
-    data[7] = 0;
-
-    var canvas = document.getElementById("example");
-    gl = wtu.create3DContext(canvas);
-    var program = wtu.setupTexturedQuad(gl);
-    gl.disable(gl.BLEND);
-
-    gl.clearColor(0,0,0,1);
-    gl.clearDepth(1);
-
-    textureLoc = gl.getUniformLocation(program, "tex");
-
-    runTest();
-}
 
 // These two declarations need to be global for "shouldBe" to see them
 var buf = null;
@@ -199,24 +171,21 @@ function runTest()
         }
     }
 
-    successfullyParsed = true;
-    var epilogue = document.createElement("script");
-    epilogue.onload = finish;
-    epilogue.src = "../resources/js-test-post.js";
-    document.body.appendChild(epilogue);
 }
 
-function finish() {
-    if (window.nonKhronosFrameworkNotifyDone) {
-        window.nonKhronosFrameworkNotifyDone();
-    }
-}
+var canvas = document.getElementById("example");
+gl = wtu.create3DContext(canvas);
+var program = wtu.setupTexturedQuad(gl);
+gl.disable(gl.BLEND);
+
+gl.clearColor(0,0,0,1);
+gl.clearDepth(1);
+
+textureLoc = gl.getUniformLocation(program, "tex");
+
+runTest();
+successfullyParsed = true;
 </script>
-</head>
-<body onload="init()">
-<canvas id="texcanvas" width="1px" height="2px"></canvas>
-<canvas id="example" width="1px" height="2px"></canvas>
-<div id="description"></div>
-<div id="console"></div>
+<script src="../resources/js-test-post.js"></script>
 </body>
 </html>
diff --git a/content/canvas/test/webgl/conformance/tex-image-with-invalid-data.html b/content/canvas/test/webgl/conformance/tex-image-with-invalid-data.html
index 04552a822e01..ebe1c7c317e5 100644
--- a/content/canvas/test/webgl/conformance/tex-image-with-invalid-data.html
+++ b/content/canvas/test/webgl/conformance/tex-image-with-invalid-data.html
@@ -6,13 +6,12 @@
   <link rel="stylesheet" href="../resources/js-test-style.css"/>
   <script src="../resources/js-test-pre.js"></script>
   <script src="resources/webgl-test.js"></script>
-  <script src="resources/testrunner.js"></script>
 </head>
 <body>
 <div id="description"></div>
 <div id="console"></div>
 <canvas id="canvas" width="2" height="2"> </canvas>
-<script><!--
+<script type="text/javascript">
 description("texImage2D and texSubImage2D tests with invalid data");
 
 var canvas = document.getElementById("canvas");
@@ -22,63 +21,79 @@ if (!gl)
 else
   testPassed("Context created.");
 
+var tex;
 
-/* object containing all tests in this testsuite */
-var bug32619_tests = {
-  setup: function () {
-    bug32619_tests.tex = gl.createTexture();
+function setup() {
+    tex = gl.createTexture();
     gl.bindTexture(gl.TEXTURE_2D, bug32619_tests.tex);
     gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, 64, 64, 0, gl.RGBA, gl.UNSIGNED_BYTE, null);
-  },
-  teardown: function () {
-    gl.deleteTexture(bug32619_tests.tex);
-  },
-
-  "Passing a buffer not large enough to texImage2D should generate an INVALID_OPERATION" : function () {
-    this.setup = function () {
-      var tooSmall = new Uint8Array(64);
-      gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, 64, 64, 0, gl.RGBA, gl.UNSIGNED_BYTE, tooSmall);
-    };
-    this.expects = gl.INVALID_OPERATION;
-  },
-  "Passing texImage2D parameter data of Number type should throw a TypeError" : function () {
-    this.setup = function () {
-      gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, 64, 64, 0, gl.RGBA, gl.UNSIGNED_BYTE, 42);
-    };
-    this.expects = "TypeError";
-  },
-  "Passing texImage2D parameter data of String type should throw a TypeError" : function () {
-    this.setup = function () {
-      gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, 64, 64, 0, gl.RGBA, gl.UNSIGNED_BYTE, "not a buffer");
-    };
-    this.expects = "TypeError";
-  },
-  "Passing a buffer not large enough to texSubImage2D should generate an INVALID_OPERATION" : function () {
-    this.setup = function () {
-      var tooSmall = new Uint8Array(64);
-      gl.texSubImage2D(gl.TEXTURE_2D, 0, 0, 0, 64, 64, gl.RGBA, gl.UNSIGNED_BYTE, tooSmall);
-    };
-    this.expects = gl.INVALID_OPERATION;
-  },
-  "Passing texSubImage2D parameter data of Number type should throw a TypeError" : function () {
-    this.setup = function () {
-      gl.texSubImage2D(gl.TEXTURE_2D, 0, 0, 0, 64, 64, gl.RGBA, gl.UNSIGNED_BYTE, 42);
-    };
-    this.expects = "TypeError";
-  },
-  "Passing texSubImage2D parameter data of String type should throw a TypeError" : function () {
-    this.setup = function () {
-      gl.texSubImage2D(gl.TEXTURE_2D, 0, 0, 0, 64, 64, gl.RGBA, gl.UNSIGNED_BYTE, "not a buffer");
-    };
-    this.expects = "TypeError";
-  },
 }
 
-runTestsuite(bug32619_tests);
+function teardown() {
+    gl.deleteTexture(tex);
+}
+
+function test(desc, func, expected) {
+    debug(desc);
+
+    var exc = null;
+    try {
+	func();
+    } catch (x) {
+	exc = x;
+    }
+
+    if (expected == gl.INVALID_OPERATION) {
+	glErrorShouldBe(gl, expected);
+    } else if (expected == "exception") {
+        if (exc) {
+	    testPassed("threw exception");
+	} else {
+	    testFailed("did not throw exception");
+	}
+    }
+}
+
+test("Passing a buffer not large enough to texImage2D should generate an INVALID_OPERATION",
+     function () {
+	 var tooSmall = new Uint8Array(64);
+	 gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, 64, 64, 0, gl.RGBA, gl.UNSIGNED_BYTE, tooSmall);
+     },
+     gl.INVALID_OPERATION);
+
+test("Passing texImage2D parameter data of Number type should throw an exception",
+     function () {
+      gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, 64, 64, 0, gl.RGBA, gl.UNSIGNED_BYTE, 42);
+     },
+     "exception");
+
+test("Passing texImage2D parameter data of String type should throw a TypeError",
+     function () {
+      gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, 64, 64, 0, gl.RGBA, gl.UNSIGNED_BYTE, "not a buffer");
+     },
+     "exception");
+test("Passing a buffer not large enough to texSubImage2D should generate an INVALID_OPERATION",
+     function () {
+	 var tooSmall = new Uint8Array(64);
+	 gl.texSubImage2D(gl.TEXTURE_2D, 0, 0, 0, 64, 64, gl.RGBA, gl.UNSIGNED_BYTE, tooSmall);
+     },
+     gl.INVALID_OPERATION);
+
+test("Passing texSubImage2D parameter data of Number type should throw a TypeError",
+     function () {
+	 gl.texSubImage2D(gl.TEXTURE_2D, 0, 0, 0, 64, 64, gl.RGBA, gl.UNSIGNED_BYTE, 42);
+     },
+     "exception");
+
+test("Passing texSubImage2D parameter data of String type should throw a TypeError",
+     function () {
+      gl.texSubImage2D(gl.TEXTURE_2D, 0, 0, 0, 64, 64, gl.RGBA, gl.UNSIGNED_BYTE, "not a buffer");
+     },
+     "exception");
 
 debug("");
 successfullyParsed = true;
---></script>
+</script>
 <script src="../resources/js-test-post.js"></script>
 <script>
 </script>
diff --git a/content/canvas/test/webgl/conformance/texture-transparent-pixels-initialized.html b/content/canvas/test/webgl/conformance/texture-transparent-pixels-initialized.html
index ef659468fbc7..c4d3962eb118 100644
--- a/content/canvas/test/webgl/conformance/texture-transparent-pixels-initialized.html
+++ b/content/canvas/test/webgl/conformance/texture-transparent-pixels-initialized.html
@@ -51,7 +51,7 @@ function init()
     var canvas = document.getElementById("example");
     gl = wtu.create3DContext(canvas);
     var program = wtu.setupTexturedQuad(gl);
-    gl.clearColor(0,0,0,1);
+    gl.clearColor(0.5,0.5,0.5,1);
     gl.clearDepth(1);
 
     textureLoc = gl.getUniformLocation(program, "tex");
@@ -70,7 +70,7 @@ function init()
     gl.bindBuffer(gl.ARRAY_BUFFER, vbo);
     gl.bufferData(gl.ARRAY_BUFFER, texCoords, gl.STATIC_DRAW);
     gl.enableVertexAttribArray(1);
-    gl.vertexAttribPointer(1, 2, gl.FLOAT, gl.FALSE, 0, 0);
+    gl.vertexAttribPointer(1, 2, gl.FLOAT, false, 0, 0);
 
     texture = wtu.loadTexture(gl, "resources/bug-32888-texture.png", runTest);
 }
@@ -82,16 +82,18 @@ var idx = 0;
 function runTest()
 {
     gl.clear(gl.COLOR_BUFFER_BIT | gl.DEPTH_BUFFER_BIT);
+    gl.enable(gl.BLEND);
+    gl.blendFunc(gl.SRC_ALPHA, gl.ONE_MINUS_SRC_ALPHA);
     // Bind the texture to texture unit 0
     gl.bindTexture(gl.TEXTURE_2D, texture);
     // Point the uniform sampler to texture unit 0
     gl.uniform1i(textureLoc, 0);
     // Draw the triangles
-    wtu.drawQuad(gl, [100, 100, 100, 255]);
+    wtu.drawQuad(gl, [0, 0, 0, 255]);
 
     // Spot check a couple of 2x2 regions in the upper and lower left
     // corners; they should be the rgb values in the texture.
-    color = [255, 255, 255]
+    color = [0, 0, 0];
     debug("Checking lower left corner");
     wtu.checkCanvasRect(gl, 1, gl.canvas.height - 3, 2, 2, color,
                         "shouldBe " + color);
diff --git a/content/canvas/test/webgl/conformance/type-conversion-test.html b/content/canvas/test/webgl/conformance/type-conversion-test.html
new file mode 100644
index 000000000000..f692c4180b7c
--- /dev/null
+++ b/content/canvas/test/webgl/conformance/type-conversion-test.html
@@ -0,0 +1,168 @@
+<!--
+Copyright (C) 2009 Apple Computer, Inc.  All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+-->
+<html>
+<head>
+<link rel="stylesheet" href="../resources/js-test-style.css"/>
+<script src="../resources/js-test-pre.js"></script>
+<script src="resources/webgl-test.js"></script>
+<script src="resources/webgl-test-utils.js"></script>
+</head>
+<body>
+<div id="description"></div>
+<div id="console"></div>
+
+<script>
+var wtu = WebGLTestUtils;
+description("Tests calling WebGL APIs with various types");
+
+var context = wtu.create3DContext();
+var program = wtu.loadStandardProgram(context);
+var shader = wtu.loadStandardVertexShader(context);
+var shouldGenerateGLError = wtu.shouldGenerateGLError;
+
+assertMsg(program != null, "Program Compiled");
+assertMsg(shader != null, "Shader Compiled");
+
+var loc = context.getUniformLocation(program, "u_modelViewProjMatrix");
+assertMsg(loc != null, "getUniformLocation succeeded");
+
+var buffer = context.createBuffer();
+context.bindBuffer(context.ARRAY_BUFFER, buffer);
+var texture = context.createTexture();
+context.bindTexture(context.TEXTURE_2D, texture);
+context.useProgram(program);
+
+var args = [
+  { type: "number", value: 0 },
+  { type: "number", value: 2 },
+  { type: "string that is NaN", value: "foo", },
+  { type: "string that is number", value: "2", },
+  { type: "null", value: null },
+  { type: "Empty Array", value: [] },
+  { type: "Object", value: {} },
+  { type: "Array of Number", value: [2] },
+  { type: "Array of String", value: ["foo"] },
+  { type: "Array of String that is number", value: ["0"] },
+  { type: "Array of String that is number", value: ["2"] },
+  { type: "TypedArray", value: new Float32Array(1) }
+];
+
+var argument;
+
+for (var i = 0; i < args.length; ++i) {
+  argument = args[i].value;
+  var func1 = shouldBeUndefined;
+  var func2 = shouldBeNonNull;
+  if (argument == 2) {
+    func2 = shouldBeNull;
+  }
+  func3 = shouldBeNull;
+  debug("");
+  debug("testing type of " + args[i].type + " : value = " + argument);
+  func1("context.bindAttribLocation(program, argument, 'foo')");
+  func1("context.blendColor(argument, argument, argument, argument)");
+  func1("context.bufferData(context.ARRAY_BUFFER, argument, context.STATIC_DRAW)");
+  func1("context.bufferData(context.ARRAY_BUFFER, new Float32Array(10), context.STATIC_DRAW)");
+  func1("context.bufferSubData(context.ARRAY_BUFFER, argument, new Float32Array(2))");
+  func1("context.clear(argument)")
+  func1("context.clearColor(argument, 0, 0, 0)");
+  func1("context.clearColor(0, argument, 0, 0)");
+  func1("context.clearColor(0, 0, argument, 0)");
+  func1("context.clearColor(0, 0, 0, argument)");
+  func1("context.clearDepth(argument)");
+  func1("context.clearStencil(argument)");
+  func1("context.copyTexImage2D(context.TEXTURE_2D, argument, context.RGBA, 0, 0, 1, 1, 0)");
+  func1("context.copyTexImage2D(context.TEXTURE_2D, 0, context.RGBA, argument, 0, 1, 1, 0)");
+  func1("context.copyTexImage2D(context.TEXTURE_2D, 0, context.RGBA, 0, argument, 1, 1, 0)");
+  func1("context.copyTexImage2D(context.TEXTURE_2D, 0, context.RGBA, 0, 0, argument, 1, 0)");
+  func1("context.copyTexImage2D(context.TEXTURE_2D, 0, context.RGBA, 0, 0, 0, argument, 0)");
+  func1("context.copyTexSubImage2D(context.TEXTURE_2D, argument, 0, 0, 0, 0, 0, 0)");
+  func1("context.copyTexSubImage2D(context.TEXTURE_2D, 0, argument, 0, 0, 0, 0, 0)");
+  func1("context.copyTexSubImage2D(context.TEXTURE_2D, 0, 0, argument, 0, 0, 0, 0)");
+  func1("context.copyTexSubImage2D(context.TEXTURE_2D, 0, 0, 0, argument, 0, 0, 0)");
+  func1("context.copyTexSubImage2D(context.TEXTURE_2D, 0, 0, 0, 0, argument, 0, 0)");
+  func1("context.copyTexSubImage2D(context.TEXTURE_2D, 0, 0, 0, 0, 0, argument, 0)");
+  func1("context.copyTexSubImage2D(context.TEXTURE_2D, 0, 0, 0, 0, 0, 0, argument)");
+  func1("context.depthMask(argument)");
+  func1("context.depthRange(argument, 1)");
+  func1("context.depthRange(0, argument)");
+  func1("context.drawArrays(context.POINTS, argument, 1)");
+  func1("context.drawArrays(context.POINTS, 0, argument)");
+  //func1("context.drawElements(...)");
+  func1("context.enableVertexAttribArray(argument)");
+  func1("context.disableVertexAttribArray(argument)");
+  func2("context.getActiveAttrib(program, argument)");
+  func2("context.getActiveUniform(program, argument)");
+  func3("context.getParameter(argument)");
+  func1("context.lineWidth(argument)");
+  func1("context.polygonOffset(argument, 0)");
+  func1("context.polygonOffset(0, argument)");
+  //func1("context.readPixels(...)");
+  //func1("context.renderbufferStorage(...)");
+  func1("context.sampleCoverage(argument, 0)");
+  func1("context.sampleCoverage(0, argument)");
+  func1("context.scissor(argument, 0, 10, 10)");
+  func1("context.scissor(0, argument, 10, 10)");
+  func1("context.scissor(0, 0, argument, 10)");
+  func1("context.scissor(0, 0, 10, argument)");
+  func1("context.shaderSource(shader, argument)");
+  func1("context.stencilFunc(context.NEVER, argument, 255)");
+  func1("context.stencilFunc(context.NEVER, 0, argument)");
+  //func1("context.stencilFuncSeparate(GLenum face, GLenum func, GLint ref, GLuint mask)");
+  func1("context.stencilMask(argument)");
+  //func1("context.stencilMaskSeparate(context.FRONT, argument);
+  //func1("context.texImage2D(GLenum target, GLint level, GLenum internalformat, GLsizei width, GLsizei height, GLint border, GLenum format, GLenum type, ArrayBufferView pixels)");
+  //func1("context.texParameterf(GLenum target, GLenum pname, GLfloat param)");
+  //func1("context.texParameteri(GLenum target, GLenum pname, GLint param)");
+  //func1("context.texSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset,GLsizei width, GLsizei height,GLenum format, GLenum type, ArrayBufferView pixels)");
+  func1("context.uniform1i(loc, argument)");
+  func1("context.uniform2i(loc, argument, 0)");
+  func1("context.uniform2i(loc, 0, argument)");
+  func1("context.uniform3i(loc, argument, 0, 0)");
+  func1("context.uniform3i(loc, 0, argument, 0)");
+  func1("context.uniform3i(loc, 0, 0, argument)");
+  func1("context.uniform4i(loc, argument, 0, 0, 0)");
+  func1("context.uniform4i(loc, 0, argument, 0, 0)");
+  func1("context.uniform4i(loc, 0, 0, argument, 0)");
+  func1("context.uniform4i(loc, 0, 0, 0, argument)");
+  func1("context.uniform1f(loc, argument)");
+  func1("context.uniform2f(loc, argument, 0)");
+  func1("context.uniform2f(loc, 0, argument)");
+  func1("context.uniform3f(loc, argument, 0, 0)");
+  func1("context.uniform3f(loc, 0, argument, 0)");
+  func1("context.uniform3f(loc, 0, 0, argument)");
+  func1("context.uniform4f(loc, argument, 0, 0, 0)");
+  func1("context.uniform4f(loc, 0, argument, 0, 0)");
+  func1("context.uniform4f(loc, 0, 0, argument, 0)");
+  func1("context.uniform4f(loc, 0, 0, 0, argument)");
+}
+
+successfullyParsed = true;
+</script>
+
+<script src="../resources/js-test-post.js"></script>
+</body>
+</html>
+
diff --git a/content/canvas/test/webgl/conformance/uninitialized-test.html b/content/canvas/test/webgl/conformance/uninitialized-test.html
index 6ba85252d341..a6443a7d0524 100644
--- a/content/canvas/test/webgl/conformance/uninitialized-test.html
+++ b/content/canvas/test/webgl/conformance/uninitialized-test.html
@@ -6,13 +6,12 @@
 	<link rel="stylesheet" href="../resources/js-test-style.css"/>
 	<script src="../resources/js-test-pre.js"></script>
 	<script src="resources/webgl-test.js"></script>
-	<script src="resources/testrunner.js"></script>
 </head>
 <body>
 <div id="description"></div>
 <div id="console"></div>
 <canvas id="canvas" width="2" height="2"> </canvas>
-<script><!--
+<script>
 description("Tests to check user code cannot access uninitialized data from GL resources.");
 
 var canvas = document.getElementById("canvas");
@@ -23,66 +22,71 @@ else
   testPassed("Context created.");
 
 
-/* object containing all tests in this testsuite */
-var uninitializedTests = {
-	"Reading an uninitialized texture should succeed with all bytes set to 0." : function () {
-		this._width = 512;
-		this._height = 512;
-		this._bpp = 4;
-		this._expectedDataLength = this._width*this._height*this._bpp;
+debug("Reading an uninitialized texture should succeed with all bytes set to 0.");
 
-		this.setup = function () {
-			var tex = gl.createTexture();
-			gl.bindTexture(gl.TEXTURE_2D, tex);
-			gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, this._width, this._height, 0, gl.RGBA, gl.UNSIGNED_BYTE, null);
+var width = 512;
+var height = 512;
+var bpp = 4;
+var expectedDataLength = width*height*bpp;
 
-			// this can be quite undeterministic so to improve odds of seeing uninitialized data write bits
-			// into tex then delete texture then re-create one with same characteristics (driver will likely reuse mem)
-			// with this trick on r59046 WebKit/OSX I get FAIL 100% of the time instead of ~15% of the time.
-			var badData = new Uint8Array(this._expectedDataLength);
-			for (var i = 0; i < badData.length; ++i) badData[i] = i % 255;
-			gl.texSubImage2D(gl.TEXTURE_2D, 0, 0, 0, this._width, this._height, gl.RGBA, gl.UNSIGNED_BYTE, badData);
-			gl.finish(); // make sure it has been uploaded
-			gl.deleteTexture(tex);
-			gl.finish(); // make sure it has been deleted
+var tex = gl.createTexture();
+gl.bindTexture(gl.TEXTURE_2D, tex);
+gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, width, height, 0, gl.RGBA, gl.UNSIGNED_BYTE, null);
 
-			var tex = gl.createTexture();
-			gl.bindTexture(gl.TEXTURE_2D, tex);
-			gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, this._width, this._height, 0, gl.RGBA, gl.UNSIGNED_BYTE, null);
+// this can be quite undeterministic so to improve odds of seeing uninitialized data write bits
+// into tex then delete texture then re-create one with same characteristics (driver will likely reuse mem)
+// with this trick on r59046 WebKit/OSX I get FAIL 100% of the time instead of ~15% of the time.
 
-			var fb = gl.createFramebuffer();
-			gl.bindFramebuffer(gl.FRAMEBUFFER, fb);
-			gl.framebufferTexture2D(gl.FRAMEBUFFER, gl.COLOR_ATTACHMENT0, gl.TEXTURE_2D, tex, 0);
+var badData = new Uint8Array(expectedDataLength);
+for (var i = 0; i < badData.length; ++i)
+    badData[i] = i % 255;
 
-      this.data = new Uint8Array(this._width * this._height * 4);
-			gl.readPixels(0, 0, this._width, this._height, gl.RGBA, gl.UNSIGNED_BYTE, this.data);
-		};
+gl.texSubImage2D(gl.TEXTURE_2D, 0, 0, 0, width, height, gl.RGBA, gl.UNSIGNED_BYTE, badData);
+gl.finish(); // make sure it has been uploaded
 
-		this.expects = function () {
-			if (this.data.length !== this._expectedDataLength) {
-				debug("expected data length " + this._expectedDataLength + " but got " + this.data.length + " instead.");
-				return false;
-			}
-			for (var i = 0; i < this.data.length; ++i)
-				if (0 !== this.data[i]) {
-					debug("byte at offset " + i + " has value " + this.data[i]);
-					return false;
-				}
-			return true;
-		};
+gl.deleteTexture(tex);
+gl.finish(); // make sure it has been deleted
+
+var tex = gl.createTexture();
+gl.bindTexture(gl.TEXTURE_2D, tex);
+gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, width, height, 0, gl.RGBA, gl.UNSIGNED_BYTE, null);
+
+var fb = gl.createFramebuffer();
+gl.bindFramebuffer(gl.FRAMEBUFFER, fb);
+gl.framebufferTexture2D(gl.FRAMEBUFFER, gl.COLOR_ATTACHMENT0, gl.TEXTURE_2D, tex, 0);
+
+data = new Uint8Array(width * height * 4);
+gl.readPixels(0, 0, width, height, gl.RGBA, gl.UNSIGNED_BYTE, data);
+
+if (data.length != expectedDataLength) {
+    testFailed("expected data length " + expectedDataLength + " but got " + data.length + " instead.");
+} else {
+    var k = 0;
+    for (var i = 0; i < data.length; ++i) {
+	if (data[i] != 0) {
+	    k++;
 	}
-	//TODO: uninitialized vertex array buffer
-	//TODO: uninitialized vertex elements buffer
-	//TODO: uninitialized framebuffer? (implementations would need to do a GL clear at first binding?)
-	//TODO: uninitialized renderbuffer? (implementations would need to do a GL clear at first binding?)
-	//TODO: uninitialized uniform arrays?
+    }
+
+    if (k) {
+	testFailed("Found " + k + " non-zero bytes");
+    } else {
+	testPassed("All data initialized");
+    }
 }
 
-runTestsuite(uninitializedTests);
+glErrorShouldBe(gl, gl.NO_ERROR);
+
+//TODO: uninitialized vertex array buffer
+//TODO: uninitialized vertex elements buffer
+//TODO: uninitialized framebuffer? (implementations would need to do a GL clear at first binding?)
+//TODO: uninitialized renderbuffer? (implementations would need to do a GL clear at first binding?)
+//TODO: uninitialized uniform arrays?
+
 
 debug("");
 successfullyParsed = true;
---></script>
+</script>
 <script src="../resources/js-test-post.js"></script>
 <script>
 </script>
diff --git a/content/canvas/test/webgl/conformance/webgl-specific.html b/content/canvas/test/webgl/conformance/webgl-specific.html
new file mode 100644
index 000000000000..29bc2c8c7f7a
--- /dev/null
+++ b/content/canvas/test/webgl/conformance/webgl-specific.html
@@ -0,0 +1,120 @@
+<!--
+Copyright (c) 2010 The Chromium Authors. All rights reserved.
+Use of this source code is governed by a BSD-style license that can be
+found in the LICENSE file.
+ -->
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
+  "http://www.w3.org/TR/html4/loose.dtd">
+<html>
+<head>
+<title>WebGL GLES2 difference test.</title>
+<link rel="stylesheet" href="../resources/js-test-style.css"/>
+<script src="../resources/js-test-pre.js"></script>
+<script src="resources/webgl-test.js"></script>
+<script src="resources/webgl-test-utils.js"></script>
+</head>
+<body>
+<div id="description"></div>
+<div id="console"></div>
+
+<script>
+var wtu = WebGLTestUtils;
+description("Tests the a few differences between WebGL and GLES2");
+
+var gl = wtu.create3DContext();
+
+gl.blendFunc(gl.CONSTANT_COLOR, gl.CONSTANT_ALPHA);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "constant color and constant alpha cannot be used together as source and destination factors in the blend function");
+gl.blendFunc(gl.ONE_MINUS_CONSTANT_COLOR, gl.CONSTANT_ALPHA);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "constant color and constant alpha cannot be used together as source and destination factors in the blend function");
+gl.blendFunc(gl.CONSTANT_COLOR, gl.ONE_MINUS_CONSTANT_ALPHA);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "constant color and constant alpha cannot be used together as source and destination factors in the blend function");
+gl.blendFunc(gl.ONE_MINUS_CONSTANT_COLOR, gl.ONE_MINUS_CONSTANT_ALPHA);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "constant color and constant alpha cannot be used together as source and destination factors in the blend function");
+gl.blendFunc(gl.CONSTANT_ALPHA, gl.CONSTANT_COLOR);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "constant color and constant alpha cannot be used together as source and destination factors in the blend function");
+gl.blendFunc(gl.CONSTANT_ALPHA, gl.ONE_MINUS_CONSTANT_COLOR);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "constant color and constant alpha cannot be used together as source and destination factors in the blend function");
+gl.blendFunc(gl.ONE_MINUS_CONSTANT_ALPHA, gl.CONSTANT_COLOR);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "constant color and constant alpha cannot be used together as source and destination factors in the blend function");
+gl.blendFunc(gl.ONE_MINUS_CONSTANT_ALPHA, gl.ONE_MINUS_CONSTANT_COLOR);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "constant color and constant alpha cannot be used together as source and destination factors in the blend function");
+
+gl.blendFuncSeparate(gl.CONSTANT_COLOR, gl.CONSTANT_ALPHA, gl.ONE, gl.ZERO);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "constant color and constant alpha cannot be used together as source and destination factors in the blend function");
+gl.blendFuncSeparate(gl.ONE_MINUS_CONSTANT_COLOR, gl.CONSTANT_ALPHA, gl.ONE, gl.ZERO);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "constant color and constant alpha cannot be used together as source and destination factors in the blend function");
+gl.blendFuncSeparate(gl.CONSTANT_COLOR, gl.ONE_MINUS_CONSTANT_ALPHA, gl.ONE, gl.ZERO);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "constant color and constant alpha cannot be used together as source and destination factors in the blend function");
+gl.blendFuncSeparate(gl.ONE_MINUS_CONSTANT_COLOR, gl.ONE_MINUS_CONSTANT_ALPHA, gl.ONE, gl.ZERO);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "constant color and constant alpha cannot be used together as source and destination factors in the blend function");
+gl.blendFuncSeparate(gl.CONSTANT_ALPHA, gl.CONSTANT_COLOR, gl.ONE, gl.ZERO);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "constant color and constant alpha cannot be used together as source and destination factors in the blend function");
+gl.blendFuncSeparate(gl.CONSTANT_ALPHA, gl.ONE_MINUS_CONSTANT_COLOR, gl.ONE, gl.ZERO);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "constant color and constant alpha cannot be used together as source and destination factors in the blend function");
+gl.blendFuncSeparate(gl.ONE_MINUS_CONSTANT_ALPHA, gl.CONSTANT_COLOR, gl.ONE, gl.ZERO);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "constant color and constant alpha cannot be used together as source and destination factors in the blend function");
+gl.blendFuncSeparate(gl.ONE_MINUS_CONSTANT_ALPHA, gl.ONE_MINUS_CONSTANT_COLOR, gl.ONE, gl.ZERO);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "constant color and constant alpha cannot be used together as source and destination factors in the blend function");
+
+gl.depthRange(20, 10);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "depthRange should generate INVALID_OPERATION if zNear is greater than zFar");
+
+gl.stencilMask(255);
+glErrorShouldBe(gl, gl.NO_ERROR,
+    "stencilMask should generate no error");
+gl.stencilMaskSeparate(gl.FRONT, 1);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "a different mask value for front and back facing is illegal");
+gl.stencilMaskSeparate(gl.BACK, 1);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "a different mask value for front and back facing is illegal");
+
+gl.stencilFunc(gl.ALWAYS, 0, 255);
+glErrorShouldBe(gl, gl.NO_ERROR,
+    "stencilFunc should generate no error");
+gl.stencilFuncSeparate(gl.FRONT, gl.ALWAYS, 1, 255);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "a different reference value for front and back facing is illegal");
+gl.stencilFuncSeparate(gl.BACK, gl.ALWAYS, 1, 255);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "a different reference value for front and back facing is illegal");
+gl.stencilFuncSeparate(gl.FRONT, gl.ALWAYS, 0, 1);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "a different mask value for front and back facing is illegal");
+gl.stencilFuncSeparate(gl.BACK, gl.ALWAYS, 0, 1);
+glErrorShouldBe(gl, gl.INVALID_OPERATION,
+    "a different mask value for front and back facing is illegal");
+
+shouldBeUndefined(gl.IMPLEMENTATION_COLOR_READ_FORMAT);
+shouldBeUndefined(gl.IMPLEMENTATION_COLOR_READ_TYPE);
+
+shouldBe("gl.getParameter(gl.UNPACK_COLORSPACE_CONVERSION_WEBGL)", "gl.BROWSER_DEFAULT_WEBGL");
+gl.pixelStorei(gl.UNPACK_COLORSPACE_CONVERSION_WEBGL, gl.NONE);
+shouldBe("gl.getParameter(gl.UNPACK_COLORSPACE_CONVERSION_WEBGL)", "gl.NONE");
+glErrorShouldBe(gl, gl.NO_ERROR,
+    "set/get UNPACK_COLORSPACE_CONVERSION_WEBGL should generate no error");
+
+successfullyParsed = true;
+</script>
+
+<script src="../resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/content/events/src/nsDOMEvent.cpp b/content/events/src/nsDOMEvent.cpp
index 929b15309aa5..50fcd7655404 100644
--- a/content/events/src/nsDOMEvent.cpp
+++ b/content/events/src/nsDOMEvent.cpp
@@ -93,6 +93,7 @@ static const char* const sEventNames[] = {
 #endif // MOZ_MEDIA
   "MozAfterPaint",
   "MozBeforePaint",
+  "MozBeforeResize",
   "MozSwipeGesture",
   "MozMagnifyGestureStart",
   "MozMagnifyGestureUpdate",
@@ -1316,6 +1317,8 @@ const char* nsDOMEvent::GetEventName(PRUint32 aEventType)
     return sEventNames[eDOMEvents_afterpaint];
   case NS_BEFOREPAINT:
     return sEventNames[eDOMEvents_beforepaint];
+  case NS_BEFORERESIZE_EVENT:
+    return sEventNames[eDOMEvents_beforeresize];
   case NS_SIMPLE_GESTURE_SWIPE:
     return sEventNames[eDOMEvents_MozSwipeGesture];
   case NS_SIMPLE_GESTURE_MAGNIFY_START:
diff --git a/content/events/src/nsDOMEvent.h b/content/events/src/nsDOMEvent.h
index 70f1759a2eae..39621e8c86a6 100644
--- a/content/events/src/nsDOMEvent.h
+++ b/content/events/src/nsDOMEvent.h
@@ -175,6 +175,7 @@ public:
 #endif
     eDOMEvents_afterpaint,
     eDOMEvents_beforepaint,
+    eDOMEvents_beforeresize,
     eDOMEvents_MozSwipeGesture,
     eDOMEvents_MozMagnifyGestureStart,
     eDOMEvents_MozMagnifyGestureUpdate,
diff --git a/content/events/test/Makefile.in b/content/events/test/Makefile.in
index 382397ecb49f..65b8652a0388 100644
--- a/content/events/test/Makefile.in
+++ b/content/events/test/Makefile.in
@@ -110,6 +110,8 @@ _CHROME_FILES = \
 		test_bug415498.xul \
 		bug415498-doc1.html \
 		bug415498-doc2.html \
+		bug602962.xul \
+		test_bug602962.xul \
 		$(NULL)
 
 libs:: $(_TEST_FILES)
diff --git a/content/events/test/bug602962.xul b/content/events/test/bug602962.xul
new file mode 100644
index 000000000000..0d54b7ad5260
--- /dev/null
+++ b/content/events/test/bug602962.xul
@@ -0,0 +1,8 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window onload="window.opener.doTest()" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <scrollbox id="page-scrollbox" style="border: 1px solid red; background-color: black;overflow: auto" flex="1">
+    <box id="page-box" style="border: 1px solid green;"/>
+  </scrollbox>
+</window>
diff --git a/content/events/test/test_bug602962.xul b/content/events/test/test_bug602962.xul
new file mode 100644
index 000000000000..b74c6ad0f957
--- /dev/null
+++ b/content/events/test/test_bug602962.xul
@@ -0,0 +1,94 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=602962
+-->
+<window title="Mozilla Bug 602962" onload="openWindow()"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+  <title>Test for Bug 602962</title>
+  <script type="application/javascript" src="chrome://mochikit/content/MochiKit/packed.js"/>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+
+<body  xmlns="http://www.w3.org/1999/xhtml">
+  <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=602962">Mozilla Bug 602962</a>
+  <p id="display"></p>
+<div id="content" style="display: none">
+</div>
+</body>
+
+<script class="testbody" type="application/javascript;version=1.8"><![CDATA[
+/** Test for Bug 602962 **/
+var scrollbox, sbo, content;
+var scrollX = 0, scrollY = 0;
+
+var mozBeforeResizeHasFired = false;
+var oldWidth = 0, oldHeight = 0;
+var win = null;
+
+function openWindow() {
+  win = window.open("chrome://mochitests/content/chrome/content/events/test/bug602962.xul", "_blank", "width=600,height=600");
+}
+
+function doTest() {
+  scrollbox = win.document.getElementById("page-scrollbox");
+  sbo = scrollbox.boxObject.QueryInterface(Components.interfaces.nsIScrollBoxObject);
+  content = win.document.getElementById("page-box");
+  content.style.width = 400 + "px";
+  
+  win.addEventListener("resize", function() {
+    win.removeEventListener("resize", arguments.callee, false);
+
+    sbo.scrollBy(200, 0);
+    setTimeout(function() { resize(); }, 0);
+  }, false);
+
+  oldWidth = win.outerWidth;
+  oldHeight = win.outerHeight;
+  win.resizeTo(200, 400);
+}
+
+function resize() {
+  win.addEventListener("MozBeforeResize", function() {
+    win.removeEventListener("MozBeforeResize", arguments.callee, false);
+    mozBeforeResizeHasFired = true;
+
+    let x = {}, y = {};
+    sbo.getPosition(x, y);
+    scrollX = x.value, scrollY = y.value;
+    is(scrollX, 200, "Scroll X should not have changed yet");
+    is(scrollY, 0, "Scroll Y should not have changed yet");
+  }, false);
+
+  win.addEventListener("resize", function() {
+    content.style.width = (oldWidth + 400) + "px";
+    win.removeEventListener("resize", arguments.callee, true);
+    
+    setTimeout(function() {
+      finish();
+    }, 0);
+  }, true);
+
+  win.resizeTo(oldWidth, oldHeight);
+}
+
+function finish() {
+  is(mozBeforeResizeHasFired, true, "The MozBeforeResize event should already have fired");
+  sbo.scrollBy(scrollX, scrollY);
+
+  let x = {}, y = {};
+  sbo.getPosition(x, y);
+  is(x.value, 200, "Scroll X should have been restored to the value before the resize");
+  is(y.value, 0, "Scroll Y should have been restored to the value before the resize");
+
+  is(win.outerWidth, oldWidth, "Width should be resized");
+  is(win.outerHeight, oldHeight, "Height should be resized");
+  win.close();
+  SimpleTest.finish();
+}
+
+SimpleTest.waitForExplicitFinish();
+]]></script>
+
+</window>
diff --git a/content/html/content/public/nsHTMLCanvasElement.h b/content/html/content/public/nsHTMLCanvasElement.h
index bce11f45e8fa..1e7e503cd8e4 100644
--- a/content/html/content/public/nsHTMLCanvasElement.h
+++ b/content/html/content/public/nsHTMLCanvasElement.h
@@ -169,7 +169,7 @@ public:
 protected:
   nsIntSize GetWidthHeight();
 
-  nsresult UpdateContext();
+  nsresult UpdateContext(nsIPropertyBag *aNewContextOptions = nsnull);
   nsresult ExtractData(const nsAString& aType,
                        const nsAString& aOptions,
                        char*& aData,
diff --git a/content/html/content/public/nsHTMLMediaElement.h b/content/html/content/public/nsHTMLMediaElement.h
index c7a4526f5029..0331d95eff43 100644
--- a/content/html/content/public/nsHTMLMediaElement.h
+++ b/content/html/content/public/nsHTMLMediaElement.h
@@ -598,7 +598,7 @@ protected:
   nsCOMPtr<nsIContent> mSourceLoadCandidate;
 
   // An audio stream for writing audio directly from JS.
-  nsAutoPtr<nsAudioStream> mAudioStream;
+  nsRefPtr<nsAudioStream> mAudioStream;
 
   // PR_TRUE if MozAudioAvailable events can be safely dispatched, based on
   // a media and element same-origin check.
diff --git a/content/html/content/public/nsISelectElement.idl b/content/html/content/public/nsISelectElement.idl
index dbabe9299ef0..b6282670cef6 100644
--- a/content/html/content/public/nsISelectElement.idl
+++ b/content/html/content/public/nsISelectElement.idl
@@ -48,7 +48,7 @@ interface nsIDOMHTMLOptionElement;
  * OPTIONs within a SELECT element.
  */
 
-[scriptable, uuid(35bd8ed5-5f34-4126-8c4f-38ba01681836)]
+[scriptable, uuid(aa73a61a-8ef2-402d-b86c-3a5c5f2a6027)]
 interface nsISelectElement : nsISupports
 {
 
@@ -64,7 +64,8 @@ interface nsISelectElement : nsISupports
    */
   [noscript] void willAddOptions(in nsIContent aOptions,
                                  in nsIContent aParent,
-                                 in long aContentIndex);
+                                 in long aContentIndex,
+                                 in boolean aNotify);
 
   /**
    * To be called when stuff is removed under a child of the select--but
@@ -75,7 +76,8 @@ interface nsISelectElement : nsISupports
    *        parent is an optgroup, the index within the optgroup)
    */
   [noscript] void willRemoveOptions(in nsIContent aParent,
-                                    in long aContentIndex);
+                                    in long aContentIndex,
+                                    in boolean aNotify);
 
   /**
    * Checks whether an option is disabled (even if it's part of an optgroup)
diff --git a/content/html/content/src/nsHTMLAudioElement.cpp b/content/html/content/src/nsHTMLAudioElement.cpp
index c20246729fe2..250354ec1e81 100644
--- a/content/html/content/src/nsHTMLAudioElement.cpp
+++ b/content/html/content/src/nsHTMLAudioElement.cpp
@@ -168,7 +168,7 @@ nsHTMLAudioElement::MozSetup(PRUint32 aChannels, PRUint32 aRate)
     mAudioStream->Shutdown();
   }
 
-  mAudioStream = new nsAudioStream();
+  mAudioStream = nsAudioStream::AllocateStream();
   nsresult rv = mAudioStream->Init(aChannels, aRate,
                                    nsAudioStream::FORMAT_FLOAT32);
   if (NS_FAILED(rv)) {
diff --git a/content/html/content/src/nsHTMLCanvasElement.cpp b/content/html/content/src/nsHTMLCanvasElement.cpp
index 420d6d58a9cf..2df9f42f3118 100644
--- a/content/html/content/src/nsHTMLCanvasElement.cpp
+++ b/content/html/content/src/nsHTMLCanvasElement.cpp
@@ -51,6 +51,9 @@
 #include "nsDisplayList.h"
 #include "ImageLayers.h"
 #include "BasicLayers.h"
+#include "imgIEncoder.h"
+
+#include "nsIWritablePropertyBag2.h"
 
 #define DEFAULT_CANVAS_WIDTH 300
 #define DEFAULT_CANVAS_HEIGHT 150
@@ -151,7 +154,7 @@ nsHTMLCanvasElement::CopyInnerTo(nsGenericElement* aDest) const
   if (aDest->GetOwnerDoc()->IsStaticDocument()) {
     nsHTMLCanvasElement* dest = static_cast<nsHTMLCanvasElement*>(aDest);
     nsCOMPtr<nsISupports> cxt;
-    dest->GetContext(NS_LITERAL_STRING("2d"), getter_AddRefs(cxt));
+    dest->GetContext(NS_LITERAL_STRING("2d"), JSVAL_VOID, getter_AddRefs(cxt));
     nsCOMPtr<nsIDOMCanvasRenderingContext2D> context2d = do_QueryInterface(cxt);
     if (context2d) {
       context2d->DrawImage(const_cast<nsHTMLCanvasElement*>(this),
@@ -230,33 +233,60 @@ nsHTMLCanvasElement::ExtractData(const nsAString& aType,
                                  PRUint32& aSize,
                                  bool& aFellBackToPNG)
 {
-  // We get an input stream from the context. If more than one context type
-  // is supported in the future, this will have to be changed to do the right
-  // thing. For now, just assume that the 2D context has all the goods.
-  nsCOMPtr<nsICanvasRenderingContextInternal> context;
-  nsresult rv = GetContext(NS_LITERAL_STRING("2d"), getter_AddRefs(context));
-  NS_ENSURE_SUCCESS(rv, rv);
-  if (!context) {
-    // XXX bug 578349
-    return NS_ERROR_NOT_IMPLEMENTED;
+  // note that if we don't have a current context, the spec says we're
+  // supposed to just return transparent black pixels of the canvas
+  // dimensions.
+  nsRefPtr<gfxImageSurface> emptyCanvas;
+  nsIntSize size = GetWidthHeight();
+  if (!mCurrentContext) {
+    emptyCanvas = new gfxImageSurface(gfxIntSize(size.width, size.height), gfxASurface::ImageFormatARGB32);
   }
 
+  nsresult rv;
+
   // get image bytes
   nsCOMPtr<nsIInputStream> imgStream;
-  NS_ConvertUTF16toUTF8 aMimeType8(aType);
-  rv = context->GetInputStream(nsPromiseFlatCString(aMimeType8).get(),
-                               nsPromiseFlatString(aOptions).get(),
-                               getter_AddRefs(imgStream));
-  if (NS_FAILED(rv)) {
-    // Use image/png instead.
+  nsCAutoString encoderType;
+  encoderType.Assign(NS_ConvertUTF16toUTF8(aType));
+
+ try_again:
+  if (mCurrentContext) {
+    rv = mCurrentContext->GetInputStream(nsPromiseFlatCString(encoderType).get(),
+                                         nsPromiseFlatString(aOptions).get(),
+                                         getter_AddRefs(imgStream));
+  } else {
+    // no context, so we have to encode the empty image we created above
+    nsCString enccid("@mozilla.org/image/encoder;2?type=");
+    enccid += encoderType;
+
+    nsCOMPtr<imgIEncoder> encoder = do_CreateInstance(nsPromiseFlatCString(enccid).get(), &rv);
+    if (NS_SUCCEEDED(rv) && encoder) {
+      rv = encoder->InitFromData(emptyCanvas->Data(),
+                                 size.width * size.height * 4,
+                                 size.width,
+                                 size.height,
+                                 size.width * 4,
+                                 imgIEncoder::INPUT_FORMAT_HOSTARGB,
+                                 aOptions);
+      if (NS_SUCCEEDED(rv)) {
+        imgStream = do_QueryInterface(encoder);
+      }
+    } else {
+      rv = NS_ERROR_FAILURE;
+    }
+  }
+
+  if (NS_FAILED(rv) && !aFellBackToPNG) {
+    // Try image/png instead.
     // XXX ERRMSG we need to report an error to developers here! (bug 329026)
     aFellBackToPNG = true;
-    rv = context->GetInputStream("image/png",
-                                 nsPromiseFlatString(aOptions).get(),
-                                 getter_AddRefs(imgStream));
-    NS_ENSURE_SUCCESS(rv, rv);
+    encoderType.AssignLiteral("image/png");
+    goto try_again;
   }
 
+  // at this point, we either need to succeed or bail.
+  NS_ENSURE_SUCCESS(rv, rv);
+
   // Generally, there will be only one chunk of data, and it will be available
   // for us to read right away, so optimize this case.
   PRUint32 bufSize;
@@ -301,6 +331,7 @@ nsHTMLCanvasElement::ToDataURLImpl(const nsAString& aMimeType,
                                    nsAString& aDataURL)
 {
   bool fallbackToPNG = false;
+
   PRUint32 imgSize = 0;
   char* imgData;
 
@@ -417,6 +448,7 @@ nsHTMLCanvasElement::GetContextHelper(const nsAString& aContextId,
 
 NS_IMETHODIMP
 nsHTMLCanvasElement::GetContext(const nsAString& aContextId,
+                                const jsval& aContextOptions,
                                 nsISupports **aContext)
 {
   nsresult rv;
@@ -443,7 +475,52 @@ nsHTMLCanvasElement::GetContext(const nsAString& aContextId,
       return rv;
     }
 
-    rv = UpdateContext();
+    nsCOMPtr<nsIPropertyBag> contextProps;
+    if (!JSVAL_IS_NULL(aContextOptions) &&
+        !JSVAL_IS_VOID(aContextOptions))
+    {
+      JSContext *cx = nsContentUtils::GetCurrentJSContext();
+
+      nsCOMPtr<nsIWritablePropertyBag2> newProps;
+
+      // note: if any contexts end up supporting something other
+      // than objects, e.g. plain strings, then we'll need to expand
+      // this to know how to create nsISupportsStrings etc.
+      if (JSVAL_IS_OBJECT(aContextOptions)) {
+        newProps = do_CreateInstance("@mozilla.org/hash-property-bag;1");
+
+        JSObject *opts = JSVAL_TO_OBJECT(aContextOptions);
+        JSIdArray *props = JS_Enumerate(cx, opts);
+        for (int i = 0; props && i < props->length; ++i) {
+          jsid propid = props->vector[i];
+          jsval propname, propval;
+          if (!JS_IdToValue(cx, propid, &propname) ||
+              !JS_GetPropertyById(cx, opts, propid, &propval))
+          {
+            continue;
+          }
+
+          JSString *propnameString = JS_ValueToString(cx, propname);
+
+          nsDependentString pstr(JS_GetStringChars(propnameString), JS_GetStringLength(propnameString));
+
+          if (JSVAL_IS_BOOLEAN(propval)) {
+            newProps->SetPropertyAsBool(pstr, propval == JSVAL_TRUE ? PR_TRUE : PR_FALSE);
+          } else if (JSVAL_IS_INT(propval)) {
+            newProps->SetPropertyAsInt32(pstr, JSVAL_TO_INT(propval));
+          } else if (JSVAL_IS_DOUBLE(propval)) {
+            newProps->SetPropertyAsDouble(pstr, JSVAL_TO_DOUBLE(propval));
+          } else if (JSVAL_IS_STRING(propval)) {
+            newProps->SetPropertyAsAString(pstr, nsDependentString(JS_GetStringChars(JS_ValueToString(cx, propval)),
+                                                                   JS_GetStringLength(JS_ValueToString(cx, propval))));
+          }
+        }
+      }
+
+      contextProps = newProps;
+    }
+
+    rv = UpdateContext(contextProps);
     if (NS_FAILED(rv)) {
       mCurrentContext = nsnull;
       return rv;
@@ -504,14 +581,25 @@ nsHTMLCanvasElement::MozGetIPCContext(const nsAString& aContextId,
 }
 
 nsresult
-nsHTMLCanvasElement::UpdateContext()
+nsHTMLCanvasElement::UpdateContext(nsIPropertyBag *aNewContextOptions)
 {
+  if (!mCurrentContext)
+    return NS_OK;
+
   nsresult rv = NS_OK;
-  if (mCurrentContext) {
-    nsIntSize sz = GetWidthHeight();
-    rv = mCurrentContext->SetIsOpaque(GetIsOpaque());
-    rv = mCurrentContext->SetDimensions(sz.width, sz.height);
-  }
+
+  rv = mCurrentContext->SetIsOpaque(GetIsOpaque());
+  if (NS_FAILED(rv))
+    return rv;
+
+  rv = mCurrentContext->SetContextOptions(aNewContextOptions);
+  if (NS_FAILED(rv))
+    return rv;
+
+  nsIntSize sz = GetWidthHeight();
+  rv = mCurrentContext->SetDimensions(sz.width, sz.height);
+  if (NS_FAILED(rv))
+    return rv;
 
   return rv;
 }
diff --git a/content/html/content/src/nsHTMLOptGroupElement.cpp b/content/html/content/src/nsHTMLOptGroupElement.cpp
index 9e7d68bf31d7..0d815f7d0a50 100644
--- a/content/html/content/src/nsHTMLOptGroupElement.cpp
+++ b/content/html/content/src/nsHTMLOptGroupElement.cpp
@@ -175,7 +175,7 @@ nsHTMLOptGroupElement::InsertChildAt(nsIContent* aKid,
                                      PRUint32 aIndex,
                                      PRBool aNotify)
 {
-  nsSafeOptionListMutation safeMutation(GetSelect(), this, aKid, aIndex);
+  nsSafeOptionListMutation safeMutation(GetSelect(), this, aKid, aIndex, aNotify);
   nsresult rv = nsGenericHTMLElement::InsertChildAt(aKid, aIndex, aNotify);
   if (NS_FAILED(rv)) {
     safeMutation.MutationFailed();
@@ -186,7 +186,7 @@ nsHTMLOptGroupElement::InsertChildAt(nsIContent* aKid,
 nsresult
 nsHTMLOptGroupElement::RemoveChildAt(PRUint32 aIndex, PRBool aNotify, PRBool aMutationEvent)
 {
-  nsSafeOptionListMutation safeMutation(GetSelect(), this, nsnull, aIndex);
+  nsSafeOptionListMutation safeMutation(GetSelect(), this, nsnull, aIndex, aNotify);
   nsresult rv = nsGenericHTMLElement::RemoveChildAt(aIndex, aNotify, aMutationEvent);
   if (NS_FAILED(rv)) {
     safeMutation.MutationFailed();
diff --git a/content/html/content/src/nsHTMLOutputElement.cpp b/content/html/content/src/nsHTMLOutputElement.cpp
index 39442d1d8328..5918a7b5e4f4 100644
--- a/content/html/content/src/nsHTMLOutputElement.cpp
+++ b/content/html/content/src/nsHTMLOutputElement.cpp
@@ -41,6 +41,8 @@
 #include "nsDOMSettableTokenList.h"
 #include "nsStubMutationObserver.h"
 #include "nsIConstraintValidation.h"
+#include "nsIEventStateManager.h"
+#include "mozAutoDocUpdate.h"
 
 
 class nsHTMLOutputElement : public nsGenericHTMLFormElement,
@@ -81,6 +83,8 @@ public:
   PRBool ParseAttribute(PRInt32 aNamespaceID, nsIAtom* aAttribute,
                         const nsAString& aValue, nsAttrValue& aResult);
 
+  nsEventStates IntrinsicState() const;
+
   // This function is called when a callback function from nsIMutationObserver
   // has to be used to update the defaultValue attribute.
   void DescendantsChanged();
@@ -115,8 +119,6 @@ nsHTMLOutputElement::nsHTMLOutputElement(already_AddRefed<nsINodeInfo> aNodeInfo
   , mValueModeFlag(eModeDefault)
 {
   AddMutationObserver(this);
-  // <output> is always barred from constraint validation.
-  SetBarredFromConstraintValidation(PR_TRUE);
 }
 
 nsHTMLOutputElement::~nsHTMLOutputElement()
@@ -147,7 +149,22 @@ NS_IMPL_ELEMENT_CLONE(nsHTMLOutputElement)
 NS_IMPL_STRING_ATTR(nsHTMLOutputElement, Name, name)
 
 // nsIConstraintValidation
-NS_IMPL_NSICONSTRAINTVALIDATION(nsHTMLOutputElement)
+NS_IMPL_NSICONSTRAINTVALIDATION_EXCEPT_SETCUSTOMVALIDITY(nsHTMLOutputElement)
+
+NS_IMETHODIMP
+nsHTMLOutputElement::SetCustomValidity(const nsAString& aError)
+{
+  nsIConstraintValidation::SetCustomValidity(aError);
+
+  nsIDocument* doc = GetCurrentDoc();
+  if (doc) {
+    MOZ_AUTO_DOC_UPDATE(doc, UPDATE_CONTENT_STATE, PR_TRUE);
+    doc->ContentStatesChanged(this, nsnull, NS_EVENT_STATE_INVALID |
+                                            NS_EVENT_STATE_VALID);
+  }
+
+  return NS_OK;
+}
 
 NS_IMETHODIMP
 nsHTMLOutputElement::Reset()
@@ -180,6 +197,18 @@ nsHTMLOutputElement::ParseAttribute(PRInt32 aNamespaceID, nsIAtom* aAttribute,
                                                   aValue, aResult);
 }
 
+nsEventStates
+nsHTMLOutputElement::IntrinsicState() const
+{
+  nsEventStates states = nsGenericHTMLFormElement::IntrinsicState();
+
+  // We don't have to call IsCandidateForConstraintValidation()
+  // because <output> can't be barred from constraint validation.
+  states |= IsValid() ? NS_EVENT_STATE_VALID : NS_EVENT_STATE_INVALID;
+
+  return states;
+}
+
 NS_IMETHODIMP
 nsHTMLOutputElement::GetForm(nsIDOMHTMLFormElement** aForm)
 {
diff --git a/content/html/content/src/nsHTMLScriptElement.cpp b/content/html/content/src/nsHTMLScriptElement.cpp
index 469c3d5c790d..295582c51ff1 100644
--- a/content/html/content/src/nsHTMLScriptElement.cpp
+++ b/content/html/content/src/nsHTMLScriptElement.cpp
@@ -556,6 +556,8 @@ nsHTMLScriptElement::FreezeUriAsyncDefer()
     nsAutoString src;
     GetSrc(src);
     NS_NewURI(getter_AddRefs(mUri), src);
+    // At this point mUri will be null for invalid URLs.
+    mExternal = PR_TRUE;
 
     PRBool defer, async;
     GetAsync(&async);
@@ -571,7 +573,7 @@ nsHTMLScriptElement::FreezeUriAsyncDefer()
 PRBool
 nsHTMLScriptElement::HasScriptContent()
 {
-  return (mFrozen ? !!mUri : HasAttr(kNameSpaceID_None, nsGkAtoms::src)) ||
+  return (mFrozen ? mExternal : HasAttr(kNameSpaceID_None, nsGkAtoms::src)) ||
          nsContentUtils::HasNonEmptyTextContent(this);
 }
 
diff --git a/content/html/content/src/nsHTMLSelectElement.cpp b/content/html/content/src/nsHTMLSelectElement.cpp
index 5009842dcba7..1dd6ac025adc 100644
--- a/content/html/content/src/nsHTMLSelectElement.cpp
+++ b/content/html/content/src/nsHTMLSelectElement.cpp
@@ -86,7 +86,8 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsSelectState, NS_SELECT_STATE_IID)
 nsSafeOptionListMutation::nsSafeOptionListMutation(nsIContent* aSelect,
                                                    nsIContent* aParent,
                                                    nsIContent* aKid,
-                                                   PRUint32 aIndex)
+                                                   PRUint32 aIndex,
+                                                   PRBool aNotify)
   : mSelect(do_QueryInterface(aSelect)), mTopLevelMutation(PR_FALSE),
     mNeedsRebuild(PR_FALSE)
 {
@@ -104,9 +105,9 @@ nsSafeOptionListMutation::nsSafeOptionListMutation(nsIContent* aSelect,
     }
     nsresult rv;
     if (aKid) {
-      rv = mSelect->WillAddOptions(aKid, aParent, aIndex);
+      rv = mSelect->WillAddOptions(aKid, aParent, aIndex, aNotify);
     } else {
-      rv = mSelect->WillRemoveOptions(aParent, aIndex);
+      rv = mSelect->WillRemoveOptions(aParent, aIndex, aNotify);
     }
     mNeedsRebuild = NS_FAILED(rv);
   }
@@ -182,8 +183,9 @@ DOMCI_NODE_DATA(HTMLSelectElement, nsHTMLSelectElement)
 
 // QueryInterface implementation for nsHTMLSelectElement
 NS_INTERFACE_TABLE_HEAD_CYCLE_COLLECTION_INHERITED(nsHTMLSelectElement)
-  NS_HTML_CONTENT_INTERFACE_TABLE3(nsHTMLSelectElement,
+  NS_HTML_CONTENT_INTERFACE_TABLE4(nsHTMLSelectElement,
                                    nsIDOMHTMLSelectElement,
+                                   nsIDOMHTMLSelectElement_Mozilla_2_0_Branch,
                                    nsISelectElement,
                                    nsIConstraintValidation)
   NS_HTML_CONTENT_INTERFACE_TABLE_TO_MAP_SEGUE(nsHTMLSelectElement,
@@ -225,7 +227,7 @@ nsHTMLSelectElement::InsertChildAt(nsIContent* aKid,
                                    PRUint32 aIndex,
                                    PRBool aNotify)
 {
-  nsSafeOptionListMutation safeMutation(this, this, aKid, aIndex);
+  nsSafeOptionListMutation safeMutation(this, this, aKid, aIndex, aNotify);
   nsresult rv = nsGenericHTMLFormElement::InsertChildAt(aKid, aIndex, aNotify);
   if (NS_FAILED(rv)) {
     safeMutation.MutationFailed();
@@ -237,7 +239,7 @@ nsresult
 nsHTMLSelectElement::RemoveChildAt(PRUint32 aIndex, PRBool aNotify, PRBool aMutationEvent)
 {
   NS_ASSERTION(aMutationEvent, "Someone tried to inhibit mutations on select child removal.");
-  nsSafeOptionListMutation safeMutation(this, this, nsnull, aIndex);
+  nsSafeOptionListMutation safeMutation(this, this, nsnull, aIndex, aNotify);
   nsresult rv = nsGenericHTMLFormElement::RemoveChildAt(aIndex, aNotify, aMutationEvent);
   if (NS_FAILED(rv)) {
     safeMutation.MutationFailed();
@@ -251,7 +253,8 @@ nsHTMLSelectElement::RemoveChildAt(PRUint32 aIndex, PRBool aNotify, PRBool aMuta
 nsresult
 nsHTMLSelectElement::InsertOptionsIntoList(nsIContent* aOptions,
                                            PRInt32 aListIndex,
-                                           PRInt32 aDepth)
+                                           PRInt32 aDepth,
+                                           PRBool aNotify)
 {
   PRInt32 insertIndex = aListIndex;
   nsresult rv = InsertOptionsIntoListRecurse(aOptions, &insertIndex, aDepth);
@@ -305,7 +308,7 @@ nsHTMLSelectElement::InsertOptionsIntoList(nsIContent* aOptions,
       }
     }
 
-    CheckSelectSomething();
+    CheckSelectSomething(aNotify);
   }
 
   return NS_OK;
@@ -314,7 +317,8 @@ nsHTMLSelectElement::InsertOptionsIntoList(nsIContent* aOptions,
 nsresult
 nsHTMLSelectElement::RemoveOptionsFromList(nsIContent* aOptions,
                                            PRInt32 aListIndex,
-                                           PRInt32 aDepth)
+                                           PRInt32 aDepth,
+                                           PRBool aNotify)
 {
   PRInt32 numRemoved = 0;
   nsresult rv = RemoveOptionsFromListRecurse(aOptions, aListIndex, &numRemoved,
@@ -346,7 +350,20 @@ nsHTMLSelectElement::RemoveOptionsFromList(nsIContent* aOptions,
 
     // Select something in case we removed the selected option on a
     // single select
-    CheckSelectSomething();
+    if (!CheckSelectSomething(aNotify) && mSelectedIndex == -1) {
+      // Update the validity state in case of we've just removed the last
+      // option.
+      UpdateValueMissingValidityState();
+
+      if (aNotify) {
+        nsIDocument* doc = GetCurrentDoc();
+        if (doc) {
+          MOZ_AUTO_DOC_UPDATE(doc, UPDATE_CONTENT_STATE, PR_TRUE);
+          doc->ContentStatesChanged(this, nsnull, NS_EVENT_STATE_VALID |
+                                                  NS_EVENT_STATE_INVALID);
+        }
+      }
+    }
   }
 
   return NS_OK;
@@ -454,7 +471,8 @@ nsHTMLSelectElement::RemoveOptionsFromListRecurse(nsIContent* aOptions,
 NS_IMETHODIMP
 nsHTMLSelectElement::WillAddOptions(nsIContent* aOptions,
                                     nsIContent* aParent,
-                                    PRInt32 aContentIndex)
+                                    PRInt32 aContentIndex,
+                                    PRBool aNotify)
 {
   PRInt32 level = GetContentDepth(aParent);
   if (level == -1) {
@@ -489,12 +507,13 @@ nsHTMLSelectElement::WillAddOptions(nsIContent* aOptions,
     }
   }
 
-  return InsertOptionsIntoList(aOptions, ind, level);
+  return InsertOptionsIntoList(aOptions, ind, level, aNotify);
 }
 
 NS_IMETHODIMP
 nsHTMLSelectElement::WillRemoveOptions(nsIContent* aParent,
-                                       PRInt32 aContentIndex)
+                                       PRInt32 aContentIndex,
+                                       PRBool aNotify)
 {
   PRInt32 level = GetContentDepth(aParent);
   NS_ASSERTION(level >= 0, "getting notified by unexpected content");
@@ -515,7 +534,7 @@ nsHTMLSelectElement::WillRemoveOptions(nsIContent* aParent,
       ind = GetFirstOptionIndex(currentKid);
     }
     if (ind != -1) {
-      nsresult rv = RemoveOptionsFromList(currentKid, ind, level);
+      nsresult rv = RemoveOptionsFromList(currentKid, ind, level, aNotify);
       NS_ENSURE_SUCCESS(rv, rv);
     }
   }
@@ -856,6 +875,16 @@ nsHTMLSelectElement::OnOptionSelected(nsISelectControlFrame* aSelectFrame,
   if (aSelectFrame) {
     aSelectFrame->OnOptionSelected(aIndex, aSelected);
   }
+
+  UpdateValueMissingValidityState();
+  if (aNotify) {
+    nsIDocument* doc = GetCurrentDoc();
+    if (doc) {
+      MOZ_AUTO_DOC_UPDATE(doc, UPDATE_CONTENT_STATE, PR_TRUE);
+      doc->ContentStatesChanged(this, nsnull, NS_EVENT_STATE_VALID |
+                                              NS_EVENT_STATE_INVALID);
+    }
+  }
 }
 
 void
@@ -1082,7 +1111,7 @@ nsHTMLSelectElement::SetOptionsSelectedByIndex(PRInt32 aStartIndex,
 
   // Make sure something is selected unless we were set to -1 (none)
   if (optionsDeselected && aStartIndex != -1) {
-    optionsSelected = CheckSelectSomething() || optionsSelected;
+    optionsSelected = CheckSelectSomething(aNotify) || optionsSelected;
   }
 
   // Let the caller know whether anything was changed
@@ -1217,6 +1246,7 @@ NS_IMPL_BOOL_ATTR(nsHTMLSelectElement, Autofocus, autofocus)
 NS_IMPL_BOOL_ATTR(nsHTMLSelectElement, Disabled, disabled)
 NS_IMPL_BOOL_ATTR(nsHTMLSelectElement, Multiple, multiple)
 NS_IMPL_STRING_ATTR(nsHTMLSelectElement, Name, name)
+NS_IMPL_BOOL_ATTR(nsHTMLSelectElement, Required, required)
 NS_IMPL_POSITIVE_INT_ATTR_DEFAULT_VALUE(nsHTMLSelectElement, Size, size, 0)
 NS_IMPL_INT_ATTR(nsHTMLSelectElement, TabIndex, tabindex)
 
@@ -1259,18 +1289,18 @@ nsHTMLSelectElement::NamedItem(const nsAString& aName,
 }
 
 PRBool
-nsHTMLSelectElement::CheckSelectSomething()
+nsHTMLSelectElement::CheckSelectSomething(PRBool aNotify)
 {
   if (mIsDoneAddingChildren) {
     if (mSelectedIndex < 0 && IsCombobox()) {
-      return SelectSomething();
+      return SelectSomething(aNotify);
     }
   }
   return PR_FALSE;
 }
 
 PRBool
-nsHTMLSelectElement::SelectSomething()
+nsHTMLSelectElement::SelectSomething(PRBool aNotify)
 {
   // If we're not done building the select, don't play with this yet.
   if (!mIsDoneAddingChildren) {
@@ -1286,6 +1316,17 @@ nsHTMLSelectElement::SelectSomething()
     if (NS_FAILED(rv) || !disabled) {
       rv = SetSelectedIndex(i);
       NS_ENSURE_SUCCESS(rv, PR_FALSE);
+
+      UpdateValueMissingValidityState();
+      if (aNotify) {
+        nsIDocument* doc = GetCurrentDoc();
+        if (doc) {
+          MOZ_AUTO_DOC_UPDATE(doc, UPDATE_CONTENT_STATE, PR_TRUE);
+          doc->ContentStatesChanged(this, nsnull, NS_EVENT_STATE_VALID |
+                                                  NS_EVENT_STATE_INVALID);
+        }
+      }
+
       return PR_TRUE;
     }
   }
@@ -1327,15 +1368,23 @@ nsresult
 nsHTMLSelectElement::AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
                                   const nsAString* aValue, PRBool aNotify)
 {
-  if (aName == nsGkAtoms::disabled && aNameSpaceID == kNameSpaceID_None) {
-    UpdateBarredFromConstraintValidation();
-    if (aNotify) {
-      nsIDocument* doc = GetCurrentDoc();
-      if (doc) {
-        MOZ_AUTO_DOC_UPDATE(doc, UPDATE_CONTENT_STATE, PR_TRUE);
-        doc->ContentStatesChanged(this, nsnull, NS_EVENT_STATE_VALID |
-                                                NS_EVENT_STATE_INVALID);
-      }
+  nsEventStates states;
+
+  if (aNameSpaceID == kNameSpaceID_None) {
+    if (aName == nsGkAtoms::disabled) {
+      UpdateBarredFromConstraintValidation();
+      states |= NS_EVENT_STATE_VALID | NS_EVENT_STATE_INVALID;
+    } else if (aName == nsGkAtoms::required) {
+      UpdateValueMissingValidityState();
+      states |= NS_EVENT_STATE_VALID | NS_EVENT_STATE_INVALID;
+    }
+  }
+
+  if (aNotify && !states.IsEmpty()) {
+    nsIDocument* doc = GetCurrentDoc();
+    if (doc) {
+      MOZ_AUTO_DOC_UPDATE(doc, UPDATE_CONTENT_STATE, PR_TRUE);
+      doc->ContentStatesChanged(this, nsnull, states);
     }
   }
 
@@ -1368,7 +1417,7 @@ nsHTMLSelectElement::UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute,
       aAttribute == nsGkAtoms::multiple) {
     // We might have become a combobox; make sure _something_ gets
     // selected in that case
-    CheckSelectSomething();
+    CheckSelectSomething(aNotify);
   }
 
   return rv;
@@ -1406,7 +1455,12 @@ nsHTMLSelectElement::DoneAddingChildren(PRBool aHaveNotified)
 
   // Now that we're done, select something (if it's a single select something
   // must be selected)
-  CheckSelectSomething();
+  if (!CheckSelectSomething(PR_FALSE)) {
+    // If an option has @selected set, it will be selected during parsing but
+    // with an empty value. We have to make sure the select element updates it's
+    // validity state to take this into account.
+    UpdateValueMissingValidityState();
+  }
 
   return NS_OK;
 }
@@ -1498,7 +1552,13 @@ nsHTMLSelectElement::IntrinsicState() const
     state |= IsValid() ? NS_EVENT_STATE_VALID : NS_EVENT_STATE_INVALID;
   }
 
-  return state | NS_EVENT_STATE_OPTIONAL;
+  if (HasAttr(kNameSpaceID_None, nsGkAtoms::required)) {
+    state |= NS_EVENT_STATE_REQUIRED;
+  } else {
+    state |= NS_EVENT_STATE_OPTIONAL;
+  }
+
+  return state;
 }
 
 // nsIFormControl
@@ -1631,7 +1691,7 @@ nsHTMLSelectElement::Reset()
   // If nothing was selected and it's not multiple, select something
   //
   if (numSelected == 0 && IsCombobox()) {
-    SelectSomething();
+    SelectSomething(PR_TRUE);
   }
 
   //
@@ -1768,6 +1828,75 @@ nsHTMLSelectElement::RebuildOptionsArray()
   FindSelectedIndex(0);
 }
 
+bool
+nsHTMLSelectElement::IsValueMissing()
+{
+  if (!HasAttr(kNameSpaceID_None, nsGkAtoms::required)) {
+    return false;
+  }
+
+  PRUint32 length;
+  nsIDOMHTMLOptionElement* option = nsnull;
+  PRBool disabled;
+  PRBool selected;
+
+  mOptions->GetLength(&length);
+
+  for (PRUint32 i=0; i<length; ++i) {
+    option = mOptions->ItemAsOption(i);
+    NS_ENSURE_SUCCESS(option->GetSelected(&selected), false);
+
+    if (!selected) {
+      continue;
+    }
+
+    IsOptionDisabled(i, &disabled);
+    if (disabled) {
+      continue;
+    }
+
+    nsAutoString value;
+    NS_ENSURE_SUCCESS(option->GetValue(value), false);
+    if (!value.IsEmpty()) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+void
+nsHTMLSelectElement::UpdateValueMissingValidityState()
+{
+  SetValidityState(VALIDITY_STATE_VALUE_MISSING, IsValueMissing());
+}
+
+nsresult
+nsHTMLSelectElement::GetValidationMessage(nsAString& aValidationMessage,
+                                            ValidityStateType aType)
+{
+  nsresult rv = NS_OK;
+
+  switch (aType)
+  {
+    case VALIDITY_STATE_VALUE_MISSING:
+      {
+        nsXPIDLString message;
+
+        rv = nsContentUtils::GetLocalizedString(nsContentUtils::eDOM_PROPERTIES,
+                                                "FormValidationSelectMissing",
+                                                message);
+
+        aValidationMessage = message;
+      }
+      break;
+    default:
+      rv = nsIConstraintValidation::GetValidationMessage(aValidationMessage, aType);
+  }
+
+  return rv;
+}
+
 #ifdef DEBUG
 
 static void
diff --git a/content/html/content/src/nsHTMLSelectElement.h b/content/html/content/src/nsHTMLSelectElement.h
index 79f6905288dd..628653b367e0 100644
--- a/content/html/content/src/nsHTMLSelectElement.h
+++ b/content/html/content/src/nsHTMLSelectElement.h
@@ -215,7 +215,7 @@ public:
    * @param aIndex  The index of the content object in the parent.
    */
   nsSafeOptionListMutation(nsIContent* aSelect, nsIContent* aParent,
-                           nsIContent* aKid, PRUint32 aIndex);
+                           nsIContent* aKid, PRUint32 aIndex, PRBool aNotify);
   ~nsSafeOptionListMutation();
   void MutationFailed() { mNeedsRebuild = PR_TRUE; }
 private:
@@ -236,7 +236,7 @@ private:
  * Implementation of &lt;select&gt;
  */
 class nsHTMLSelectElement : public nsGenericHTMLFormElement,
-                            public nsIDOMHTMLSelectElement,
+                            public nsIDOMHTMLSelectElement_Mozilla_2_0_Branch,
                             public nsISelectElement,
                             public nsIConstraintValidation
 {
@@ -262,6 +262,9 @@ public:
   // nsIDOMHTMLSelectElement
   NS_DECL_NSIDOMHTMLSELECTELEMENT
 
+  // nsIDOMHTMLSelectElement_Mozilla_2_0_Branch
+  NS_DECL_NSIDOMHTMLSELECTELEMENT_MOZILLA_2_0_BRANCH
+
   // nsIContent
   virtual nsresult PreHandleEvent(nsEventChainPreVisitor& aVisitor);
 
@@ -327,7 +330,8 @@ public:
   virtual nsXPCClassInfo* GetClassInfo();
 
   // nsIConstraintValidation
-  void UpdateBarredFromConstraintValidation();
+  nsresult GetValidationMessage(nsAString& aValidationMessage,
+                                ValidityStateType aType);
 
 protected:
   friend class nsSafeOptionListMutation;
@@ -349,13 +353,13 @@ protected:
    * Select some option if possible (generally the first non-disabled option).
    * @return true if something was selected, false otherwise
    */
-  PRBool SelectSomething();
+  PRBool SelectSomething(PRBool aNotify);
   /**
    * Call SelectSomething(), but only if nothing is selected
    * @see SelectSomething()
    * @return true if something was selected, false otherwise
    */
-  PRBool CheckSelectSomething();
+  PRBool CheckSelectSomething(PRBool aNotify);
   /**
    * Called to trigger notifications of frames and fixing selected index
    *
@@ -387,7 +391,8 @@ protected:
    */
   nsresult InsertOptionsIntoList(nsIContent* aOptions,
                                  PRInt32 aListIndex,
-                                 PRInt32 aDepth);
+                                 PRInt32 aDepth,
+                                 PRBool aNotify);
   /**
    * Remove option(s) from the options[] array
    * @param aOptions the option or optgroup being added
@@ -396,7 +401,8 @@ protected:
    */
   nsresult RemoveOptionsFromList(nsIContent* aOptions,
                                  PRInt32 aListIndex,
-                                 PRInt32 aDepth);
+                                 PRInt32 aDepth,
+                                 PRBool aNotify);
   /**
    * Insert option(s) into the options[] array (called by InsertOptionsIntoList)
    * @param aOptions the option or optgroup being added
@@ -417,6 +423,12 @@ protected:
                                         PRInt32 aRemoveIndex,
                                         PRInt32* aNumRemoved,
                                         PRInt32 aDepth);
+
+  // nsIConstraintValidation
+  void UpdateBarredFromConstraintValidation();
+  bool IsValueMissing();
+  void UpdateValueMissingValidityState();
+
   /**
    * Find out how deep this content is from the select (1=direct child)
    * @param aContent the content to check
diff --git a/content/html/content/test/Makefile.in b/content/html/content/test/Makefile.in
index 1b0100d6dbb1..5932661d060c 100644
--- a/content/html/content/test/Makefile.in
+++ b/content/html/content/test/Makefile.in
@@ -240,6 +240,7 @@ _TEST_FILES = \
 		file_bug297761.html \
 		test_bug607145.html \
 		test_bug601061.html \
+		test_bug596511.html \
 		reflect.js \
 		$(NULL)
 
diff --git a/content/html/content/test/test_bug345624-1.html b/content/html/content/test/test_bug345624-1.html
index 2fc6da217fc6..b16575917b08 100644
--- a/content/html/content/test/test_bug345624-1.html
+++ b/content/html/content/test/test_bug345624-1.html
@@ -23,8 +23,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=345624
   <button id='b' oninvalid="invalidEventHandler(event);"></button>
   <select id='s' oninvalid="invalidEventHandler(event);"></select>
   <textarea id='t' oninvalid="invalidEventHandler(event);"></textarea>
+  <output id='o' oninvalid="invalidEventHandler(event);"></output>
   <keygen id='k'></keygen>
-  <output id='o'></output>
   <object id='obj'></object>
 </div>
 <pre id="test">
@@ -94,8 +94,8 @@ function checkDefaultPseudoClass()
      "Nor :valid and :invalid should apply");
 
   is(window.getComputedStyle(document.getElementById('o'), null)
-       .getPropertyValue('background-color'), "rgb(0, 0, 0)",
-     "Nor :valid and :invalid should apply");
+       .getPropertyValue('background-color'), "rgb(0, 255, 0)",
+     ":valid should apply");
 
   is(window.getComputedStyle(document.getElementById('obj'), null)
        .getPropertyValue('background-color'), "rgb(0, 0, 0)",
@@ -126,9 +126,9 @@ function checkSpecificWillValidate()
 {
   // fieldset, output, object, keygen (TODO) and select elements
   ok(!document.getElementById('f').willValidate, "Fielset element should be barred from constraint validation");
-  ok(!document.getElementById('o').willValidate, "Output element should be barred from constraint validation");
   ok(!document.getElementById('obj').willValidate, "Object element should be barred from constraint validation");
   todo(!document.getElementById('k').willValidate, "Keygen element should be barred from constraint validation");
+  ok(document.getElementById('o').willValidate, "Output element should not be barred from constraint validation");
   ok(document.getElementById('s').willValidate, "Select element should not be barred from constraint validation");
 
   // input element
@@ -189,13 +189,16 @@ function checkCommonWillValidate(element)
 {
   // Not checking the default value because it has been checked previously.
 
-  element.disabled = true;
-  ok(!element.willValidate, "Disabled element should be barred from constraint validation");
+  // Not checking output elements because they can't be disabled.
+  if (element.tagName != 'OUTPUT') {
+    element.disabled = true;
+    ok(!element.willValidate, "Disabled element should be barred from constraint validation");
 
-  is(window.getComputedStyle(element, null).getPropertyValue('background-color'),
-     "rgb(0, 0, 0)", "Nor :valid and :invalid should apply");
+    is(window.getComputedStyle(element, null).getPropertyValue('background-color'),
+       "rgb(0, 0, 0)", "Nor :valid and :invalid should apply");
 
-  element.removeAttribute('disabled');
+    element.removeAttribute('disabled');
+  }
 
   // TODO: If an element has a datalist element ancestor, it is barred from constraint validation.
 }
@@ -293,28 +296,30 @@ checkDefaultPseudoClass();
 
 checkSpecificWillValidate();
 
-// Not checking fieldset, output, object and keygen
+// Not checking fieldset, object and keygen
 // because they are always barred from constraint validation.
 checkCommonWillValidate(document.getElementById('i'));
 checkCommonWillValidate(document.getElementById('b'));
 checkCommonWillValidate(document.getElementById('s'));
 checkCommonWillValidate(document.getElementById('t'));
+checkCommonWillValidate(document.getElementById('o'));
 
 /* TODO: add "keygen" element */
 checkCustomError(document.getElementById('i'), false);
 checkCustomError(document.getElementById('b'), false);
 checkCustomError(document.getElementById('s'), false);
 checkCustomError(document.getElementById('t'), false);
+checkCustomError(document.getElementById('o'), false);
 checkCustomError(document.getElementById('f'), true);
-checkCustomError(document.getElementById('o'), true);
 checkCustomError(document.getElementById('obj'), true);
 
-// Not checking fieldset, output, object and keygen
+// Not checking fieldset, object and keygen
 // because they are always barred from constraint validation.
 checkCheckValidity(document.getElementById('i'));
 checkCheckValidity(document.getElementById('b'));
 checkCheckValidity(document.getElementById('s'));
 checkCheckValidity(document.getElementById('t'));
+checkCheckValidity(document.getElementById('o'));
 
 /* TODO: add "keygen" element */
 checkValidityStateObjectAliveWithoutElement("fieldset");
diff --git a/content/html/content/test/test_bug389797.html b/content/html/content/test/test_bug389797.html
index f6730204cea1..a34f995c5091 100644
--- a/content/html/content/test/test_bug389797.html
+++ b/content/html/content/test/test_bug389797.html
@@ -219,7 +219,7 @@ HTML_TAG("s", ""); // HTMLElement
 HTML_TAG("samp", ""); // HTMLElement
 HTML_TAG("script", "Script", [], [ "nsIScriptLoaderObserver" ]);
 HTML_TAG("section", "") // HTMLElement
-HTML_TAG("select", "Select");
+HTML_TAG("select", "Select", ["nsIDOMHTMLSelectElement_Mozilla_2_0_Branch"]);
 HTML_TAG("small", ""); // HTMLElement
 HTML_TAG("span", "Span");
 HTML_TAG("strike", ""); // HTMLElement
diff --git a/content/html/content/test/test_bug596511.html b/content/html/content/test/test_bug596511.html
new file mode 100644
index 000000000000..3af194b185fb
--- /dev/null
+++ b/content/html/content/test/test_bug596511.html
@@ -0,0 +1,230 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=596511
+-->
+<head>
+  <title>Test for Bug 596511</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <style>
+    select:valid { background-color: green; }
+    select:invalid { background-color: red; }
+  </style>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=596511">Mozilla Bug 596511</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 596511 **/
+
+function checkNotSufferingFromBeingMissing(element, aTodo)
+{
+  if (aTodo) {
+    ok = todo;
+    is = todo_is;
+  }
+
+  ok(!element.validity.valueMissing,
+    "Element should not suffer from value missing");
+  ok(element.validity.valid, "Element should be valid");
+  ok(element.checkValidity(), "Element should be valid");
+
+  is(element.validationMessage, "",
+    "Validation message should be the empty string");
+
+  is(window.getComputedStyle(element, null).getPropertyValue('background-color'),
+     "rgb(0, 128, 0)", ":valid pseudo-class should apply");
+
+  if (aTodo) {
+    ok = SimpleTest.ok;
+    is = SimpleTest.is;
+  }
+}
+
+function checkSufferingFromBeingMissing(element, aTodo)
+{
+  if (aTodo) {
+    ok = todo;
+    is = todo_is;
+  }
+
+  ok(element.validity.valueMissing, "Element should suffer from value missing");
+  ok(!element.validity.valid, "Element should not be valid");
+  ok(!element.checkValidity(), "Element should not be valid");
+
+  is(element.validationMessage, "Please select an item in the list.",
+     "Validation message is wrong");
+
+  is(window.getComputedStyle(element, null).getPropertyValue('background-color'),
+     "rgb(255, 0, 0)", ":invalid pseudo-class should apply");
+
+  if (aTodo) {
+    ok = SimpleTest.ok;
+    is = SimpleTest.is;
+  }
+}
+
+function checkRequiredAttribute(element)
+{
+  ok('required' in element, "select should have a required attribute");
+
+  ok(!element.required, "select required attribute should be disabled");
+  is(element.getAttribute('required'), null,
+    "select required attribute should be disabled");
+
+  element.required = true;
+  ok(element.required, "select required attribute should be enabled");
+  isnot(element.getAttribute('required'), null,
+    "select required attribute should be enabled");
+
+  element.removeAttribute('required');
+  element.setAttribute('required', '');
+  ok(element.required, "select required attribute should be enabled");
+  isnot(element.getAttribute('required'), null,
+    "select required attribute should be enabled");
+
+  element.removeAttribute('required');
+  ok(!element.required, "select required attribute should be disabled");
+  is(element.getAttribute('required'), null,
+    "select required attribute should be disabled");
+}
+
+function checkRequiredAndOptionalSelectors(element)
+{
+  is(document.querySelector("select:optional"), element,
+     "select should be optional");
+  is(document.querySelector("select:required"), null,
+     "select shouldn't be required");
+
+  element.required = true;
+
+  is(document.querySelector("select:optional"), null,
+     "select shouldn't be optional");
+  is(document.querySelector("select:required"), element,
+     "select should be required");
+
+  element.required = false;
+}
+
+function checkInvalidWhenValueMissing(element)
+{
+  checkNotSufferingFromBeingMissing(select);
+
+  element.required = true;
+  checkSufferingFromBeingMissing(select);
+
+  /**
+   * Non-multiple and size=1.
+   */
+  select.appendChild(new Option());
+  checkSufferingFromBeingMissing(select);
+
+  // When removing the required attribute, element should not be invalid.
+  element.required = false;
+  checkNotSufferingFromBeingMissing(select);
+
+  element.required = true;
+  select.options[0].textContent = "foo";
+  // TODO: having that working would require us to add a mutation observer on
+  // the select element.
+  checkNotSufferingFromBeingMissing(select, true);
+
+  select.remove(0);
+  checkSufferingFromBeingMissing(select);
+
+  select.add(new Option("foo", "foo"), null);
+  checkNotSufferingFromBeingMissing(select);
+
+  select.add(new Option(), null);
+  checkNotSufferingFromBeingMissing(select);
+
+  select.options[1].selected = true;
+  checkSufferingFromBeingMissing(select);
+
+  select.selectedIndex = 0;
+  checkNotSufferingFromBeingMissing(select);
+
+  select.selectedIndex = 1;
+  checkSufferingFromBeingMissing(select);
+
+  select.remove(1);
+  checkNotSufferingFromBeingMissing(select);
+
+  select.options[0].disabled = true;
+  // TODO: having that working would require us to add a mutation observer on
+  // the select element.
+  checkSufferingFromBeingMissing(select, true);
+
+  select.options[0].disabled = false
+  select.remove(0);
+  checkSufferingFromBeingMissing(select);
+
+  var option = new Option("foo", "foo");
+  option.disabled = true;
+  select.add(option, null);
+  select.add(new Option("bar"), null);
+  option.selected = true;
+  checkSufferingFromBeingMissing(select);
+
+  select.remove(0);
+  select.remove(0);
+
+  /**
+   * Non-multiple and size > 1.
+   * Everything should be the same except moving the selection.
+   */
+  select.multiple = false;
+  select.size = 4;
+  checkSufferingFromBeingMissing(select);
+
+  select.add(new Option("", "", true), null);
+  checkSufferingFromBeingMissing(select);
+
+  select.add(new Option("foo", "foo"), null);
+  select.remove(0);
+  checkSufferingFromBeingMissing(select);
+
+  select.options[0].selected = true;
+  checkNotSufferingFromBeingMissing(select);
+
+  select.remove(0);
+
+  /**
+   * Multiple, any size.
+   * We can select more than one element and at least needs a value.
+   */
+  select.multiple = true;
+  select.size = 4;
+  checkSufferingFromBeingMissing(select);
+
+  select.add(new Option("", "", true), null);
+  checkSufferingFromBeingMissing(select);
+
+  select.add(new Option("", "", true), null);
+  checkSufferingFromBeingMissing(select);
+
+  select.add(new Option("foo"), null);
+  checkSufferingFromBeingMissing(select);
+
+  select.options[2].selected = true;
+  checkNotSufferingFromBeingMissing(select);
+}
+
+var select = document.createElement("select");
+var content = document.getElementById('content');
+content.appendChild(select);
+
+checkRequiredAttribute(select);
+checkRequiredAndOptionalSelectors(select);
+checkInvalidWhenValueMissing(select);
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/content/media/Makefile.in b/content/media/Makefile.in
index 4953bfd07432..e4e4563fc8b4 100644
--- a/content/media/Makefile.in
+++ b/content/media/Makefile.in
@@ -98,6 +98,8 @@ endif
 
 FORCE_STATIC_LIB = 1
 
+include $(topsrcdir)/config/config.mk
+include $(topsrcdir)/ipc/chromium/chromium-config.mk
 include $(topsrcdir)/config/rules.mk
 
 INCLUDES += \
diff --git a/content/media/nsAudioStream.cpp b/content/media/nsAudioStream.cpp
index 5915713d177b..739956409087 100644
--- a/content/media/nsAudioStream.cpp
+++ b/content/media/nsAudioStream.cpp
@@ -35,6 +35,15 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
+
+#ifdef MOZ_IPC
+#include "mozilla/dom/ContentChild.h"
+#include "mozilla/dom/PAudioChild.h"
+#include "mozilla/dom/AudioChild.h"
+#include "nsXULAppAPI.h"
+using namespace mozilla::dom;
+#endif
+
 #include <stdio.h>
 #include <math.h>
 #include "prlog.h"
@@ -46,6 +55,7 @@ extern "C" {
 #include "sydneyaudio/sydney_audio.h"
 }
 #include "mozilla/TimeStamp.h"
+#include "nsThreadUtils.h"
 
 #if defined(XP_MACOSX)
 #define SA_PER_STREAM_VOLUME 1
@@ -57,21 +67,282 @@ using mozilla::TimeStamp;
 PRLogModuleInfo* gAudioStreamLog = nsnull;
 #endif
 
+#ifdef MOZ_IPC
+static nsIThread *gAudioPlaybackThread = nsnull;
+#endif
+
 #define FAKE_BUFFER_SIZE 176400
 #define MILLISECONDS_PER_SECOND 1000
 
+class nsAudioStreamLocal : public nsAudioStream
+{
+ public:
+  NS_DECL_ISUPPORTS
+
+  ~nsAudioStreamLocal();
+  nsAudioStreamLocal();
+  
+  nsresult Init(PRInt32 aNumChannels, PRInt32 aRate, SampleFormat aFormat);
+  void Shutdown();
+  nsresult Write(const void* aBuf, PRUint32 aCount, PRBool aBlocking);
+  PRUint32 Available();
+  void SetVolume(float aVolume);
+  void Drain();
+  void Pause();
+  void Resume();
+  PRInt64 GetPosition();
+  PRInt64 GetSampleOffset();
+  PRBool IsPaused();
+
+ private:
+
+  double mVolume;
+  void* mAudioHandle;
+  int mRate;
+  int mChannels;
+
+  SampleFormat mFormat;
+
+  // When a Write() request is made, and the number of samples
+  // requested to be written exceeds the buffer size of the audio
+  // backend, the remaining samples are stored in this variable. They
+  // will be written on the next Write() request.
+  nsTArray<short> mBufferOverflow;
+
+  // PR_TRUE if this audio stream is paused.
+  PRPackedBool mPaused;
+
+  // PR_TRUE if this stream has encountered an error.
+  PRPackedBool mInError;
+
+};
+
+#ifdef MOZ_IPC
+class nsAudioStreamRemote : public nsAudioStream
+{
+ public:
+  NS_DECL_ISUPPORTS
+
+  nsAudioStreamRemote();
+  ~nsAudioStreamRemote();
+  
+  nsresult Init(PRInt32 aNumChannels, PRInt32 aRate, SampleFormat aFormat);
+  void Shutdown();
+  nsresult Write(const void* aBuf, PRUint32 aCount, PRBool aBlocking);
+  PRUint32 Available();
+  void SetVolume(float aVolume);
+  void Drain();
+  void Pause();
+  void Resume();
+  PRInt64 GetPosition();
+  PRInt64 GetSampleOffset();
+  PRBool IsPaused();
+
+  AudioChild* mAudioChild;
+
+  SampleFormat mFormat;
+  int mRate;
+  int mChannels;
+  // PR_TRUE if this audio stream is paused.
+  PRPackedBool mPaused;
+
+  PRInt32 mBytesPerSample;
+
+  friend class AudioInitEvent;
+  friend class AudioShutdownEvent;
+  friend class AudioWriteEvent;
+  friend class AudioSetVolumeEvent;
+  friend class AudioPauseEvent;
+  friend class AudioDrainEvent;
+  friend class AudioGetSampleEvent;
+};
+
+class AudioInitEvent : public nsRunnable
+{
+ public:
+  AudioInitEvent(nsAudioStreamRemote* owner)
+  {
+    mOwner = owner;
+  }
+
+  NS_IMETHOD Run()
+  {
+    ContentChild * cpc = ContentChild::GetSingleton();
+    NS_ASSERTION(cpc, "Content Protocol is NULL!");
+    mOwner->mAudioChild =  static_cast<AudioChild*> (cpc->SendPAudioConstructor(mOwner->mChannels,
+                                                                                mOwner->mRate,
+                                                                                mOwner->mFormat));
+    return NS_OK;
+  }
+  
+  nsRefPtr<nsAudioStreamRemote> mOwner;
+};
+
+class AudioShutdownEvent : public nsRunnable
+{
+ public:
+  AudioShutdownEvent(nsAudioStreamRemote* owner)
+  {
+    mOwner = owner;
+  }
+
+  NS_IMETHOD Run()
+  {
+    if (mOwner->mAudioChild) {
+      PAudioChild::Send__delete__(mOwner->mAudioChild);
+      mOwner->mAudioChild = nsnull;
+    }
+    mOwner = nsnull;
+    return NS_OK;
+  }
+  nsRefPtr<nsAudioStreamRemote> mOwner;
+};
+
+class AudioWriteEvent : public nsRunnable
+{
+ public:
+  AudioWriteEvent(nsAudioStreamRemote* owner,
+                  const void* aBuf,
+                  PRUint32 aNumberOfSamples,
+                  PRUint32 aBytesPerSample)
+  {    
+    mOwner = owner;
+    mBytesPerSample = aBytesPerSample;
+    mBuffer.Assign((const char*)aBuf, aNumberOfSamples*aBytesPerSample);
+  }
+
+  NS_IMETHOD Run()
+  {
+    if (!mOwner->mAudioChild)
+      return NS_OK;
+
+    mOwner->mAudioChild->SendWrite(mBuffer,
+                                   mBuffer.Length() / mBytesPerSample);
+    return NS_OK;
+  }
+
+  nsRefPtr<nsAudioStreamRemote> mOwner;
+  nsCString mBuffer;
+  PRUint32 mBytesPerSample;
+};
+
+class AudioSetVolumeEvent : public nsRunnable
+{
+ public:
+  AudioSetVolumeEvent(nsAudioStreamRemote* owner, float volume)
+  {
+    mOwner = owner;
+    mVolume = volume;
+  }
+
+  NS_IMETHOD Run()
+  {
+    if (!mOwner->mAudioChild)
+      return NS_OK;
+
+    mOwner->mAudioChild->SendSetVolume(mVolume);
+    return NS_OK;
+  }
+  
+  nsRefPtr<nsAudioStreamRemote> mOwner;
+  float mVolume;
+};
+
+class AudioDrainEvent : public nsRunnable
+{
+ public:
+  AudioDrainEvent(nsAudioStreamRemote* owner)
+  {
+    mOwner = owner;
+  }
+
+  NS_IMETHOD Run()
+  {
+    if (!mOwner->mAudioChild)
+      return NS_OK;
+
+    mOwner->mAudioChild->SendDrain();
+    return NS_OK;
+  }
+  
+  nsRefPtr<nsAudioStreamRemote> mOwner;
+};
+
+
+class AudioPauseEvent : public nsRunnable
+{
+ public:
+  AudioPauseEvent(nsAudioStreamRemote* owner, PRBool pause)
+  {
+    mOwner = owner;
+    mPause = pause;
+  }
+
+  NS_IMETHOD Run()
+  {
+    if (!mOwner->mAudioChild)
+      return NS_OK;
+
+    if (mPause)
+      mOwner->mAudioChild->SendPause();
+    else
+      mOwner->mAudioChild->SendResume();
+
+    return NS_OK;
+  }
+  
+  nsRefPtr<nsAudioStreamRemote> mOwner;
+  PRBool mPause;
+};
+
+
+#endif // MOZ_IPC
+
+
 void nsAudioStream::InitLibrary()
 {
 #ifdef PR_LOGGING
   gAudioStreamLog = PR_NewLogModule("nsAudioStream");
 #endif
+
+#ifdef MOZ_IPC
+  // We only need this thread in the main process.
+  if (XRE_GetProcessType() == GeckoProcessType_Default) {
+      NS_NewThread(&gAudioPlaybackThread);
+  }
+#endif
 }
 
 void nsAudioStream::ShutdownLibrary()
 {
+#ifdef MOZ_IPC
+  NS_IF_RELEASE(gAudioPlaybackThread);
+#endif
 }
 
-nsAudioStream::nsAudioStream() :
+
+nsIThread *
+nsAudioStream::GetGlobalThread()
+{
+#ifdef MOZ_IPC
+  NS_IF_ADDREF(gAudioPlaybackThread);
+  return gAudioPlaybackThread;
+#else
+  return nsnull;
+#endif
+}
+
+nsAudioStream* nsAudioStream::AllocateStream()
+{
+#ifdef MOZ_IPC
+  if (XRE_GetProcessType() == GeckoProcessType_Content) {
+    return new nsAudioStreamRemote();
+  }
+#endif
+  return new nsAudioStreamLocal();
+}
+
+nsAudioStreamLocal::nsAudioStreamLocal() :
   mVolume(1.0),
   mAudioHandle(0),
   mRate(0),
@@ -82,16 +353,16 @@ nsAudioStream::nsAudioStream() :
 {
 }
 
-nsAudioStream::~nsAudioStream()
-{
-  Shutdown();
-}
+nsAudioStreamLocal::~nsAudioStreamLocal(){}
 
-nsresult nsAudioStream::Init(PRInt32 aNumChannels, PRInt32 aRate, SampleFormat aFormat)
+NS_IMPL_THREADSAFE_ISUPPORTS0(nsAudioStreamLocal)
+
+nsresult nsAudioStreamLocal::Init(PRInt32 aNumChannels, PRInt32 aRate, SampleFormat aFormat)
 {
   mRate = aRate;
   mChannels = aNumChannels;
   mFormat = aFormat;
+
   if (sa_stream_create_pcm(reinterpret_cast<sa_stream_t**>(&mAudioHandle),
                            NULL, 
                            SA_MODE_WRONLY, 
@@ -100,7 +371,7 @@ nsresult nsAudioStream::Init(PRInt32 aNumChannels, PRInt32 aRate, SampleFormat a
                            aNumChannels) != SA_SUCCESS) {
     mAudioHandle = nsnull;
     mInError = PR_TRUE;
-    PR_LOG(gAudioStreamLog, PR_LOG_ERROR, ("nsAudioStream: sa_stream_create_pcm error"));
+    PR_LOG(gAudioStreamLog, PR_LOG_ERROR, ("nsAudioStreamLocal: sa_stream_create_pcm error"));
     return NS_ERROR_FAILURE;
   }
   
@@ -108,16 +379,17 @@ nsresult nsAudioStream::Init(PRInt32 aNumChannels, PRInt32 aRate, SampleFormat a
     sa_stream_destroy(static_cast<sa_stream_t*>(mAudioHandle));
     mAudioHandle = nsnull;
     mInError = PR_TRUE;
-    PR_LOG(gAudioStreamLog, PR_LOG_ERROR, ("nsAudioStream: sa_stream_open error"));
+    PR_LOG(gAudioStreamLog, PR_LOG_ERROR, ("nsAudioStreamLocal: sa_stream_open error"));
     return NS_ERROR_FAILURE;
   }
   mInError = PR_FALSE;
+
   return NS_OK;
 }
 
-void nsAudioStream::Shutdown()
+void nsAudioStreamLocal::Shutdown()
 {
-  if (!mAudioHandle) 
+  if (!mAudioHandle)
     return;
 
   sa_stream_destroy(static_cast<sa_stream_t*>(mAudioHandle));
@@ -125,7 +397,7 @@ void nsAudioStream::Shutdown()
   mInError = PR_TRUE;
 }
 
-nsresult nsAudioStream::Write(const void* aBuf, PRUint32 aCount, PRBool aBlocking)
+nsresult nsAudioStreamLocal::Write(const void* aBuf, PRUint32 aCount, PRBool aBlocking)
 {
   NS_ABORT_IF_FALSE(aCount % mChannels == 0,
                     "Buffer size must be divisible by channel count");
@@ -199,7 +471,7 @@ nsresult nsAudioStream::Write(const void* aBuf, PRUint32 aCount, PRBool aBlockin
                         s_data.get(),
                         count * sizeof(short)) != SA_SUCCESS)
     {
-      PR_LOG(gAudioStreamLog, PR_LOG_ERROR, ("nsAudioStream: sa_stream_write error"));
+      PR_LOG(gAudioStreamLog, PR_LOG_ERROR, ("nsAudioStreamLocal: sa_stream_write error"));
       mInError = PR_TRUE;
       return NS_ERROR_FAILURE;
     }
@@ -207,7 +479,7 @@ nsresult nsAudioStream::Write(const void* aBuf, PRUint32 aCount, PRBool aBlockin
   return NS_OK;
 }
 
-PRUint32 nsAudioStream::Available()
+PRUint32 nsAudioStreamLocal::Available()
 {
   // If the audio backend failed to open, lie and say we'll accept some
   // data.
@@ -221,12 +493,12 @@ PRUint32 nsAudioStream::Available()
   return s / sizeof(short);
 }
 
-void nsAudioStream::SetVolume(float aVolume)
+void nsAudioStreamLocal::SetVolume(float aVolume)
 {
   NS_ASSERTION(aVolume >= 0.0 && aVolume <= 1.0, "Invalid volume");
 #if defined(SA_PER_STREAM_VOLUME)
   if (sa_stream_set_volume_abs(static_cast<sa_stream_t*>(mAudioHandle), aVolume) != SA_SUCCESS) {
-    PR_LOG(gAudioStreamLog, PR_LOG_ERROR, ("nsAudioStream: sa_stream_set_volume_abs error"));
+    PR_LOG(gAudioStreamLog, PR_LOG_ERROR, ("nsAudioStreamLocal: sa_stream_set_volume_abs error"));
     mInError = PR_TRUE;
   }
 #else
@@ -234,7 +506,7 @@ void nsAudioStream::SetVolume(float aVolume)
 #endif
 }
 
-void nsAudioStream::Drain()
+void nsAudioStreamLocal::Drain()
 {
   if (mInError)
     return;
@@ -244,19 +516,19 @@ void nsAudioStream::Drain()
     if (sa_stream_write(static_cast<sa_stream_t*>(mAudioHandle),
                         mBufferOverflow.Elements(),
                         mBufferOverflow.Length() * sizeof(short)) != SA_SUCCESS)
-      PR_LOG(gAudioStreamLog, PR_LOG_ERROR, ("nsAudioStream: sa_stream_write error"));
+      PR_LOG(gAudioStreamLog, PR_LOG_ERROR, ("nsAudioStreamLocal: sa_stream_write error"));
       mInError = PR_TRUE;
       return;
   }
 
   int r = sa_stream_drain(static_cast<sa_stream_t*>(mAudioHandle));
   if (r != SA_SUCCESS && r != SA_ERROR_INVALID) {
-    PR_LOG(gAudioStreamLog, PR_LOG_ERROR, ("nsAudioStream: sa_stream_drain error"));
+    PR_LOG(gAudioStreamLog, PR_LOG_ERROR, ("nsAudioStreamLocal: sa_stream_drain error"));
     mInError = PR_TRUE;
   }
 }
 
-void nsAudioStream::Pause()
+void nsAudioStreamLocal::Pause()
 {
   if (mInError)
     return;
@@ -264,7 +536,7 @@ void nsAudioStream::Pause()
   sa_stream_pause(static_cast<sa_stream_t*>(mAudioHandle));
 }
 
-void nsAudioStream::Resume()
+void nsAudioStreamLocal::Resume()
 {
   if (mInError)
     return;
@@ -272,17 +544,16 @@ void nsAudioStream::Resume()
   sa_stream_resume(static_cast<sa_stream_t*>(mAudioHandle));
 }
 
-PRInt64 nsAudioStream::GetPosition()
+PRInt64 nsAudioStreamLocal::GetPosition()
 {
   PRInt64 sampleOffset = GetSampleOffset();
   if (sampleOffset >= 0) {
     return ((MILLISECONDS_PER_SECOND * sampleOffset) / mRate / mChannels);
   }
-
   return -1;
 }
 
-PRInt64 nsAudioStream::GetSampleOffset()
+PRInt64 nsAudioStreamLocal::GetSampleOffset()
 {
   if (mInError) {
     return -1;
@@ -300,3 +571,141 @@ PRInt64 nsAudioStream::GetSampleOffset()
 
   return -1;
 }
+
+PRBool nsAudioStreamLocal::IsPaused()
+{
+  return mPaused;
+}
+
+#ifdef MOZ_IPC
+
+nsAudioStreamRemote::nsAudioStreamRemote()
+ : mAudioChild(NULL),
+   mFormat(FORMAT_S16_LE),
+   mRate(0),
+   mChannels(0),
+   mPaused(PR_FALSE),
+   mBytesPerSample(1)
+{}
+
+nsAudioStreamRemote::~nsAudioStreamRemote()
+{}
+
+NS_IMPL_THREADSAFE_ISUPPORTS0(nsAudioStreamRemote)
+
+nsresult 
+nsAudioStreamRemote::Init(PRInt32 aNumChannels,
+                          PRInt32 aRate,
+                          SampleFormat aFormat)
+{
+  mRate = aRate;
+  mChannels = aNumChannels;
+  mFormat = aFormat;
+
+  switch (mFormat) {
+    case FORMAT_U8: {
+      mBytesPerSample = sizeof(PRUint8);
+      break;
+    }
+    case FORMAT_S16_LE: {
+      mBytesPerSample = sizeof(short);
+      break;
+    }
+    case FORMAT_FLOAT32: {
+      mBytesPerSample = sizeof(float);
+    }
+  }
+
+  nsCOMPtr<nsIRunnable> event = new AudioInitEvent(this);
+  NS_DispatchToMainThread(event);
+  return NS_OK;
+}
+
+void
+nsAudioStreamRemote::Shutdown()
+{
+  nsCOMPtr<nsIRunnable> event = new AudioShutdownEvent(this);
+  NS_DispatchToMainThread(event);
+}
+
+nsresult
+nsAudioStreamRemote::Write(const void* aBuf,
+                           PRUint32 aCount,
+                           PRBool aBlocking)
+{
+  nsCOMPtr<nsIRunnable> event = new AudioWriteEvent(this,
+                                                    aBuf,
+                                                    aCount,
+                                                    mBytesPerSample);
+  NS_DispatchToMainThread(event);
+  return NS_OK;
+}
+
+PRUint32
+nsAudioStreamRemote::Available()
+{
+  return FAKE_BUFFER_SIZE;
+}
+
+void
+nsAudioStreamRemote::SetVolume(float aVolume)
+{
+  nsCOMPtr<nsIRunnable> event = new AudioSetVolumeEvent(this, aVolume);
+  NS_DispatchToMainThread(event);
+}
+
+void
+nsAudioStreamRemote::Drain()
+{
+  nsCOMPtr<nsIRunnable> event = new AudioDrainEvent(this);
+  NS_DispatchToMainThread(event, NS_DISPATCH_SYNC);
+}
+ 
+void
+nsAudioStreamRemote::Pause()
+{
+  mPaused = PR_TRUE;
+  nsCOMPtr<nsIRunnable> event = new AudioPauseEvent(this, PR_TRUE);
+  NS_DispatchToMainThread(event);
+}
+
+void
+nsAudioStreamRemote::Resume()
+{
+  mPaused = PR_FALSE;
+  nsCOMPtr<nsIRunnable> event = new AudioPauseEvent(this, PR_FALSE);
+  NS_DispatchToMainThread(event);
+}
+
+PRInt64 nsAudioStreamRemote::GetPosition()
+{
+  PRInt64 sampleOffset = GetSampleOffset();
+  if (sampleOffset >= 0) {
+    return ((MILLISECONDS_PER_SECOND * sampleOffset) / mRate / mChannels);
+  }
+  return 0;
+}
+
+PRInt64
+nsAudioStreamRemote::GetSampleOffset()
+{
+  if(!mAudioChild)
+    return 0;
+
+  PRInt64 offset = mAudioChild->GetLastKnownSampleOffset();
+  if (offset == -1)
+    return 0;
+
+  PRInt64 time   = mAudioChild->GetLastKnownSampleOffsetTime();
+  PRInt64 result = offset + (mRate * mChannels * (PR_IntervalNow() - time) / MILLISECONDS_PER_SECOND);
+
+  return result;
+}
+
+PRBool
+nsAudioStreamRemote::IsPaused()
+{
+  return mPaused;
+}
+
+#endif // MOZ_IPC
diff --git a/content/media/nsAudioStream.h b/content/media/nsAudioStream.h
index c89724bcb5d7..dbc75837e956 100644
--- a/content/media/nsAudioStream.h
+++ b/content/media/nsAudioStream.h
@@ -39,14 +39,13 @@
 #define nsAudioStream_h_
 
 #include "nscore.h"
-#include "prlog.h"
-#include "nsTArray.h"
+#include "nsISupportsImpl.h"
+#include "nsIThread.h"
 
-extern PRLogModuleInfo* gAudioStreamLog;
-
-class nsAudioStream 
+class nsAudioStream : public nsISupports
 {
- public:
+public:
+
   enum SampleFormat
   {
     FORMAT_U8,
@@ -62,16 +61,23 @@ class nsAudioStream
   // library after using it.
   static void ShutdownLibrary();
 
-  nsAudioStream();
-  ~nsAudioStream();
+  // Thread, usually for MOZ_IPC handling, that is shared between audio streams.
+  // This may return null in the child process
+  static nsIThread *GetGlobalThread();
+
+  // AllocateStream will return either a local stream or a remoted stream
+  // depending on where you call it from.  If MOZ_IPC is enabled, and you
+  // call this from a child process, you may recieve an implementation which
+  // forwards to a compositing process.
+  static nsAudioStream* AllocateStream();
 
   // Initialize the audio stream. aNumChannels is the number of audio channels 
   // (1 for mono, 2 for stereo, etc) and aRate is the frequency of the sound 
   // samples (22050, 44100, etc).
-  nsresult Init(PRInt32 aNumChannels, PRInt32 aRate, SampleFormat aFormat);
+  virtual nsresult Init(PRInt32 aNumChannels, PRInt32 aRate, SampleFormat aFormat) = 0;
 
   // Closes the stream. All future use of the stream is an error.
-  void Shutdown();
+  virtual void Shutdown() = 0;
 
   // Write sound data to the audio hardware.  aBuf is an array of samples in
   // the format specified by mFormat of length aCount.  aCount should be
@@ -79,54 +85,35 @@ class nsAudioStream
   // When aBlocking is PR_TRUE, we'll block until the write has completed,
   // otherwise we'll buffer any data we can't write immediately, and write
   // it in a later call.
-  nsresult Write(const void* aBuf, PRUint32 aCount, PRBool aBlocking);
+  virtual nsresult Write(const void* aBuf, PRUint32 aCount, PRBool aBlocking) = 0;
 
   // Return the number of sound samples that can be written to the audio device
   // without blocking.
-  PRUint32 Available();
+  virtual PRUint32 Available() = 0;
 
   // Set the current volume of the audio playback. This is a value from
   // 0 (meaning muted) to 1 (meaning full volume).
-  void SetVolume(float aVolume);
+  virtual void SetVolume(float aVolume) = 0;
 
   // Block until buffered audio data has been consumed.
-  void Drain();
+  virtual void Drain() = 0;
 
   // Pause audio playback
-  void Pause();
+  virtual void Pause() = 0;
 
   // Resume audio playback
-  void Resume();
+  virtual void Resume() = 0;
 
   // Return the position in milliseconds of the sample being played by the
   // audio hardware.
-  PRInt64 GetPosition();
+  virtual PRInt64 GetPosition() = 0;
 
   // Return the position, measured in samples played since the start, by
   // the audio hardware.
-  PRInt64 GetSampleOffset();
+  virtual PRInt64 GetSampleOffset() = 0;
 
   // Returns PR_TRUE when the audio stream is paused.
-  PRBool IsPaused() { return mPaused; }
-
- private:
-  double mVolume;
-  void* mAudioHandle;
-  int mRate;
-  int mChannels;
-
-  SampleFormat mFormat;
-
-  // When a Write() request is made, and the number of samples
-  // requested to be written exceeds the buffer size of the audio
-  // backend, the remaining samples are stored in this variable. They
-  // will be written on the next Write() request.
-  nsTArray<short> mBufferOverflow;
-
-  // PR_TRUE if this audio stream is paused.
-  PRPackedBool mPaused;
-
-  // PR_TRUE if this stream has encountered an error.
-  PRPackedBool mInError;
+  virtual PRBool IsPaused() = 0;
 };
+
 #endif
diff --git a/content/media/nsBuiltinDecoderStateMachine.cpp b/content/media/nsBuiltinDecoderStateMachine.cpp
index 4f7ce39cb54f..944d06550539 100644
--- a/content/media/nsBuiltinDecoderStateMachine.cpp
+++ b/content/media/nsBuiltinDecoderStateMachine.cpp
@@ -161,6 +161,12 @@ nsBuiltinDecoderStateMachine::nsBuiltinDecoderStateMachine(nsBuiltinDecoder* aDe
 nsBuiltinDecoderStateMachine::~nsBuiltinDecoderStateMachine()
 {
   MOZ_COUNT_DTOR(nsBuiltinDecoderStateMachine);
+
+  if (mAudioStream) {
+    MonitorAutoEnter mon(mDecoder->GetMonitor());
+    mAudioStream->Shutdown();
+    mAudioStream = nsnull;
+  }
 }
 
 PRBool nsBuiltinDecoderStateMachine::HasFutureAudio() const {
@@ -611,7 +617,7 @@ void nsBuiltinDecoderStateMachine::StartPlayback()
     } else {
       // No audiostream, create one.
       const nsVideoInfo& info = mReader->GetInfo();
-      mAudioStream = new nsAudioStream();
+      mAudioStream = nsAudioStream::AllocateStream();
       mAudioStream->Init(info.mAudioChannels,
                          info.mAudioRate,
                          MOZ_SOUND_DATA_FORMAT);
diff --git a/content/media/nsBuiltinDecoderStateMachine.h b/content/media/nsBuiltinDecoderStateMachine.h
index c5aa9b8887cb..925e2b0b4202 100644
--- a/content/media/nsBuiltinDecoderStateMachine.h
+++ b/content/media/nsBuiltinDecoderStateMachine.h
@@ -426,7 +426,7 @@ protected:
   // The audio stream resource. Used on the state machine, audio, and main
   // threads. You must hold the mAudioMonitor, and must NOT hold the decoder
   // monitor when using the audio stream!
-  nsAutoPtr<nsAudioStream> mAudioStream;
+  nsRefPtr<nsAudioStream> mAudioStream;
 
   // The reader, don't call its methods with the decoder monitor held.
   // This is created in the play state machine's constructor, and destroyed
diff --git a/content/media/wave/nsWaveDecoder.cpp b/content/media/wave/nsWaveDecoder.cpp
index 9efb1822a9fd..a4d935dfc1a7 100644
--- a/content/media/wave/nsWaveDecoder.cpp
+++ b/content/media/wave/nsWaveDecoder.cpp
@@ -295,7 +295,7 @@ private:
   // Our audio stream.  Created on demand when entering playback state.  It
   // is destroyed when seeking begins and will not be reinitialized until
   // playback resumes, so it is possible for this to be null.
-  nsAutoPtr<nsAudioStream> mAudioStream;
+  nsRefPtr<nsAudioStream> mAudioStream;
 
   // Maximum time to spend waiting for data during buffering.
   TimeDuration mBufferingWait;
@@ -906,7 +906,7 @@ nsWaveStateMachine::ChangeState(State aState)
 void
 nsWaveStateMachine::OpenAudioStream()
 {
-  mAudioStream = new nsAudioStream();
+  mAudioStream = nsAudioStream::AllocateStream();
   if (!mAudioStream) {
     LOG(PR_LOG_ERROR, ("Could not create audio stream"));
   } else {
diff --git a/content/svg/content/src/nsSVGLength2.cpp b/content/svg/content/src/nsSVGLength2.cpp
index 55a841d0d28b..1f1f318133a1 100644
--- a/content/svg/content/src/nsSVGLength2.cpp
+++ b/content/svg/content/src/nsSVGLength2.cpp
@@ -307,6 +307,7 @@ nsSVGLength2::SetBaseValueInSpecifiedUnits(float aValue,
                                            nsSVGElement *aSVGElement)
 {
   mBaseVal = aValue;
+  mIsBaseSet = PR_TRUE;
   if (!mIsAnimated) {
     mAnimVal = mBaseVal;
   }
@@ -344,6 +345,7 @@ nsSVGLength2::NewValueSpecifiedUnits(PRUint16 unitType,
     return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
 
   mBaseVal = valueInSpecifiedUnits;
+  mIsBaseSet = PR_TRUE;
   mSpecifiedUnitType = PRUint8(unitType);
   if (!mIsAnimated) {
     mAnimVal = mBaseVal;
@@ -413,6 +415,7 @@ nsSVGLength2::SetBaseValueString(const nsAString &aValueAsString,
   }
   
   mBaseVal = value;
+  mIsBaseSet = PR_TRUE;
   mSpecifiedUnitType = PRUint8(unitType);
   if (!mIsAnimated) {
     mAnimVal = mBaseVal;
@@ -445,6 +448,7 @@ void
 nsSVGLength2::SetBaseValue(float aValue, nsSVGElement *aSVGElement)
 {
   mBaseVal = aValue * GetUnitScaleFactor(aSVGElement, mSpecifiedUnitType);
+  mIsBaseSet = PR_TRUE;
   if (!mIsAnimated) {
     mAnimVal = mBaseVal;
   }
diff --git a/content/svg/content/src/nsSVGLength2.h b/content/svg/content/src/nsSVGLength2.h
index b1d7e8729109..2c43d10c3800 100644
--- a/content/svg/content/src/nsSVGLength2.h
+++ b/content/svg/content/src/nsSVGLength2.h
@@ -64,6 +64,7 @@ public:
     mAttrEnum = aAttrEnum;
     mCtxType = aCtxType;
     mIsAnimated = PR_FALSE;
+    mIsBaseSet = PR_FALSE;
   }
 
   nsresult SetBaseValueString(const nsAString& aValue,
@@ -90,6 +91,14 @@ public:
     { return mBaseVal / GetUnitScaleFactor(aCtx, mSpecifiedUnitType); }
   float GetAnimValue(nsSVGSVGElement* aCtx) const
     { return mAnimVal / GetUnitScaleFactor(aCtx, mSpecifiedUnitType); }
+
+  // Returns PR_TRUE if the animated value of this length has been explicitly
+  // set (either by animation, or by taking on the base value which has been
+  // explicitly set by markup or a DOM call), PR_FALSE otherwise.
+  // If this returns PR_FALSE, the animated value is still valid, that is,
+  // useable, and represents the default base value of the attribute.
+  PRBool IsAnimValSet() const
+    { return mIsAnimated || mIsBaseSet; }
   
   nsresult ToDOMAnimatedLength(nsIDOMSVGAnimatedLength **aResult,
                                nsSVGElement* aSVGElement);
@@ -105,7 +114,8 @@ private:
   PRUint8 mSpecifiedUnitType;
   PRUint8 mAttrEnum; // element specified tracking for attribute
   PRUint8 mCtxType; // X, Y or Unspecified
-  PRPackedBool mIsAnimated;
+  PRPackedBool mIsAnimated:1;
+  PRPackedBool mIsBaseSet:1;
   
   static float GetMMPerPixel() { return MM_PER_INCH_FLOAT / 96; }
   float GetAxisLength(nsIFrame *aNonSVGFrame) const;
diff --git a/content/svg/content/src/nsSVGRectElement.cpp b/content/svg/content/src/nsSVGRectElement.cpp
index 8c08d892f75a..6fb3c8e94ada 100644
--- a/content/svg/content/src/nsSVGRectElement.cpp
+++ b/content/svg/content/src/nsSVGRectElement.cpp
@@ -190,10 +190,10 @@ nsSVGRectElement::ConstructPath(gfxContext *aCtx)
     return;
   }
 
-  /* If either the 'rx' or the 'ry' attribute isn't set in the markup, then we
+  /* If either the 'rx' or the 'ry' attribute isn't set, then we
      have to set it to the value of the other. */
-  PRBool hasRx = HasAttr(kNameSpaceID_None, nsGkAtoms::rx);
-  PRBool hasRy = HasAttr(kNameSpaceID_None, nsGkAtoms::ry);
+  PRBool hasRx = mLengthAttributes[RX].IsAnimValSet();
+  PRBool hasRy = mLengthAttributes[RY].IsAnimValSet();
   if (hasRx && !hasRy)
     ry = rx;
   else if (hasRy && !hasRx)
diff --git a/content/svg/content/src/nsSVGSVGElement.cpp b/content/svg/content/src/nsSVGSVGElement.cpp
index 7c0e46b75fae..2bbe374a2ccf 100644
--- a/content/svg/content/src/nsSVGSVGElement.cpp
+++ b/content/svg/content/src/nsSVGSVGElement.cpp
@@ -60,6 +60,7 @@
 #include "nsGUIEvent.h"
 #include "nsSVGUtils.h"
 #include "nsSVGSVGElement.h"
+#include "nsSVGEffects.h" // For nsSVGEffects::RemoveAllRenderingObservers
 
 #ifdef MOZ_SMIL
 #include "nsEventDispatcher.h"
@@ -1229,3 +1230,12 @@ nsSVGSVGElement::GetPreserveAspectRatio()
 {
   return &mPreserveAspectRatio;
 }
+
+#ifndef MOZ_ENABLE_LIBXUL
+// XXXdholbert HACK -- see comment w/ this method's declaration in header file.
+void
+nsSVGSVGElement::RemoveAllRenderingObservers()
+{
+  nsSVGEffects::RemoveAllRenderingObservers(this);
+}
+#endif // !MOZ_LIBXUL
diff --git a/content/svg/content/src/nsSVGSVGElement.h b/content/svg/content/src/nsSVGSVGElement.h
index bebeaa1f4c35..6811bca2fca0 100644
--- a/content/svg/content/src/nsSVGSVGElement.h
+++ b/content/svg/content/src/nsSVGSVGElement.h
@@ -221,6 +221,14 @@ public:
   }
 
   virtual nsXPCClassInfo* GetClassInfo();
+
+#ifndef MOZ_ENABLE_LIBXUL
+  // XXXdholbert HACK to call static method
+  // nsSVGEffects::RemoveAllRenderingObservers() on myself, on behalf
+  // of imagelib in non-libxul builds.
+  virtual void RemoveAllRenderingObservers();
+#endif // !MOZ_LIBXUL
+
 protected:
   // nsSVGElement overrides
   PRBool IsEventName(nsIAtom* aName);
diff --git a/content/svg/content/src/nsSVGScriptElement.cpp b/content/svg/content/src/nsSVGScriptElement.cpp
index 3a523bf3aa71..fc3ef730ea0d 100644
--- a/content/svg/content/src/nsSVGScriptElement.cpp
+++ b/content/svg/content/src/nsSVGScriptElement.cpp
@@ -231,6 +231,8 @@ nsSVGScriptElement::FreezeUriAsyncDefer()
   if (!src.IsEmpty()) {
     nsCOMPtr<nsIURI> baseURI = GetBaseURI();
     NS_NewURI(getter_AddRefs(mUri), src, nsnull, baseURI);
+    // At this point mUri will be null for invalid URLs.
+    mExternal = PR_TRUE;
   }
   
   mFrozen = PR_TRUE;
@@ -245,7 +247,7 @@ nsSVGScriptElement::HasScriptContent()
   nsAutoString src;
   mStringAttributes[HREF].GetAnimValue(src, this);
   // preserving bug 528444 here due to being unsure how to fix correctly
-  return (mFrozen ? !!mUri : !src.IsEmpty()) ||
+  return (mFrozen ? mExternal : !src.IsEmpty()) ||
          nsContentUtils::HasNonEmptyTextContent(this);
 }
 
diff --git a/content/xul/templates/tests/chrome/templates_shared.js b/content/xul/templates/tests/chrome/templates_shared.js
index b50bbb44cc27..941d05c7bcc5 100644
--- a/content/xul/templates/tests/chrome/templates_shared.js
+++ b/content/xul/templates/tests/chrome/templates_shared.js
@@ -75,8 +75,13 @@ function test_template()
     var src = window.location.href.replace(/test_tmpl.*xul/, "animals.rdf");
     ds = RDF.GetDataSourceBlocking(src);
 
-    if (root.datasources == "rdf:null")
-      root.datasources = "animals.rdf";
+    if (expectLoggedMessages) {
+      Components.classes["@mozilla.org/consoleservice;1"].
+                 getService(Components.interfaces.nsIConsoleService).reset();
+    }
+
+    if (root.getAttribute("datasources") == "rdf:null")
+      root.setAttribute("datasources", "animals.rdf");
   }
   else if (queryType == "xml") {
     var src = window.location.href.replace(/test_tmpl.*xul/, "animals.xml");
@@ -126,7 +131,8 @@ function iterateChanged(root, ds)
 
   if (needsOpen)
     root.open = false;
-  compareConsoleMessages();
+  if (expectedConsoleMessages.length)
+    compareConsoleMessages();
   SimpleTest.finish();
 }
 
@@ -172,7 +178,8 @@ function checkResults(root, step)
     serializedXML = serializedXML.replace(nsrepl, "");
     if (debug)
       dump("-------- " + adjtestid + "  " + error + ":\n" + serializedXML + "\n");
-    is(serializedXML, "Same", "Error is: " + error);
+    if (error)
+      is(serializedXML, "Same", "Error is: " + error);
   }
 }
 
diff --git a/content/xul/templates/tests/chrome/test_tmpl_bindingsmultiple.xul b/content/xul/templates/tests/chrome/test_tmpl_bindingsmultiple.xul
index 83a3e6e3d2d3..f63209a6ec91 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_bindingsmultiple.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_bindingsmultiple.xul
@@ -58,7 +58,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/all-animals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/all-animals">
 <template>
 <query>
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_bindingsquerysyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_bindingsquerysyntax.xul
index 9e624f9eae31..920b5f0b840f 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_bindingsquerysyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_bindingsquerysyntax.xul
@@ -53,7 +53,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/humans">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/humans">
 <template id="template">
 <query>
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_bindingsreversed.xul b/content/xul/templates/tests/chrome/test_tmpl_bindingsreversed.xul
index 4f4997ea0b4c..b9a554c2732c 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_bindingsreversed.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_bindingsreversed.xul
@@ -38,7 +38,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/humans">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/humans">
 <template id="template">
 <query>
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_bindingssameastriple.xul b/content/xul/templates/tests/chrome/test_tmpl_bindingssameastriple.xul
index 85b818257ca0..d294284211b4 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_bindingssameastriple.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_bindingssameastriple.xul
@@ -38,7 +38,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/humans">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/humans">
 <template id="template">
 <query>
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_containerandmembervariablechanged.xul b/content/xul/templates/tests/chrome/test_tmpl_containerandmembervariablechanged.xul
index 7c67ef4815a6..03dcf7771fc0 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_containerandmembervariablechanged.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_containerandmembervariablechanged.xul
@@ -78,7 +78,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template container="?parent" member="?child">
 <rule>
 <button uri="?" label="?parent ?child"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_containervariablechanged.xul b/content/xul/templates/tests/chrome/test_tmpl_containervariablechanged.xul
index f22976ff9949..93e4e9dc2ad6 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_containervariablechanged.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_containervariablechanged.xul
@@ -39,7 +39,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template container="?parent">
 <rule>
 <button uri="?" label="?parent ?child"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_containmentattribute.xul b/content/xul/templates/tests/chrome/test_tmpl_containmentattribute.xul
index 35333e212d82..69f6c50dd762 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_containmentattribute.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_containmentattribute.xul
@@ -54,7 +54,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/humans/robert" containment="http://www.some-fictitious-zoo.com/rdf#favoriteAnimal">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/humans/robert" containment="http://www.some-fictitious-zoo.com/rdf#favoriteAnimal">
 <template id="template">
 <rule id="rule">
 <conditions>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_defaultcontainervariableisuri.xul b/content/xul/templates/tests/chrome/test_tmpl_defaultcontainervariableisuri.xul
index 7e089e9a6009..94aa8e7b0af5 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_defaultcontainervariableisuri.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_defaultcontainervariableisuri.xul
@@ -39,7 +39,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template>
 <rule>
 <button uri="?uri" label="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_extendedsyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_extendedsyntax.xul
index 815b5fd85646..90fb76dce492 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_extendedsyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_extendedsyntax.xul
@@ -78,7 +78,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template id="template">
 <rule id="rule">
 <conditions id="conditions">
diff --git a/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxemptyconditions.xul b/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxemptyconditions.xul
index 3fe05b86725d..7d380e71dd3d 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxemptyconditions.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxemptyconditions.xul
@@ -35,7 +35,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template id="template">
 <rule id="rule">
 <conditions id="conditions"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxotherrefvariable.xul b/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxotherrefvariable.xul
index 4a6c37c06a5a..0414fe0a8236 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxotherrefvariable.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxotherrefvariable.xul
@@ -78,7 +78,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template id="template">
 <rule id="rule">
 <conditions id="conditions">
diff --git a/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxremoveunmatched.xul b/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxremoveunmatched.xul
index 6f87d2ac6764..efb7b622b689 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxremoveunmatched.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxremoveunmatched.xul
@@ -37,7 +37,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/humans">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/humans">
 <template id="template">
 <rule>
 <conditions>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxsimplevariablesubstitution.xul b/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxsimplevariablesubstitution.xul
index bb732a1c679d..374db53332ce 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxsimplevariablesubstitution.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxsimplevariablesubstitution.xul
@@ -35,7 +35,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/arachnids">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/arachnids">
 <template id="template">
 <rule id="rule">
 <conditions id="conditions">
diff --git a/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxtworulesrecurse.xul b/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxtworulesrecurse.xul
index 878caeb0ca10..e56cce0fe71d 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxtworulesrecurse.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxtworulesrecurse.xul
@@ -49,7 +49,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/humans">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/humans">
 <template>
 <rule>
 <conditions>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxusinganinterveningcontainer.xul b/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxusinganinterveningcontainer.xul
index d8dd5ea15c31..32a67dddd5be 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxusinganinterveningcontainer.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_extendedsyntaxusinganinterveningcontainer.xul
@@ -39,7 +39,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template id="template">
 <rule id="rule">
 <conditions id="conditions">
diff --git a/content/xul/templates/tests/chrome/test_tmpl_extendedvariablesubstitution.xul b/content/xul/templates/tests/chrome/test_tmpl_extendedvariablesubstitution.xul
index 6a316b252c9c..0a6fdad1adfd 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_extendedvariablesubstitution.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_extendedvariablesubstitution.xul
@@ -35,7 +35,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/arachnids">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/arachnids">
 <template id="template">
 <rule id="rule">
 <conditions id="conditions">
diff --git a/content/xul/templates/tests/chrome/test_tmpl_gridelement.xul b/content/xul/templates/tests/chrome/test_tmpl_gridelement.xul
index 802759cac4f1..914e204b64ee 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_gridelement.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_gridelement.xul
@@ -93,7 +93,7 @@ var changes = [
 ]]>
 </script>
 
-<grid xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<grid xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <columns>
 <column/>
 <column/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_htmlelementextendedsyntaxwithbinding.xul b/content/xul/templates/tests/chrome/test_tmpl_htmlelementextendedsyntaxwithbinding.xul
index d40612d0ff3d..a03f37f53cc7 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_htmlelementextendedsyntaxwithbinding.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_htmlelementextendedsyntaxwithbinding.xul
@@ -111,5 +111,5 @@ var changes = [
 ]]>
 </script>
 
-<div xmlns="http://www.w3.org/1999/xhtml" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals"><template xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="template"><rule><conditions><content uri="?uri"/><member container="?uri" child="?animal"/><triple subject="?animal" predicate="http://www.some-fictitious-zoo.com/rdf#name" object="?name"/><where subject="?name" rel="contains" value="an"/></conditions><bindings><binding subject="?animal" predicate="http://www.some-fictitious-zoo.com/rdf#specimens" object="?specimens"/></bindings><action><p xmlns="http://www.w3.org/1999/xhtml" uri="?animal"><textnode xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" value="?name"/><span title="?specimens"/></p></action></rule><rule><conditions><content uri="?uri"/><member container="?uri" child="?animal"/><triple subject="?animal" predicate="http://www.some-fictitious-zoo.com/rdf#name" object="?name"/></conditions><bindings><binding subject="?animal" predicate="http://www.some-fictitious-zoo.com/rdf#specimens" object="?specimens"/></bindings><action><div xmlns="http://www.w3.org/1999/xhtml" uri="?animal" title="?name"><em><textnode xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" value="?specimens"/></em></div></action></rule></template></div>
+<div xmlns="http://www.w3.org/1999/xhtml" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals"><template xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="template"><rule><conditions><content uri="?uri"/><member container="?uri" child="?animal"/><triple subject="?animal" predicate="http://www.some-fictitious-zoo.com/rdf#name" object="?name"/><where subject="?name" rel="contains" value="an"/></conditions><bindings><binding subject="?animal" predicate="http://www.some-fictitious-zoo.com/rdf#specimens" object="?specimens"/></bindings><action><p xmlns="http://www.w3.org/1999/xhtml" uri="?animal"><textnode xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" value="?name"/><span title="?specimens"/></p></action></rule><rule><conditions><content uri="?uri"/><member container="?uri" child="?animal"/><triple subject="?animal" predicate="http://www.some-fictitious-zoo.com/rdf#name" object="?name"/></conditions><bindings><binding subject="?animal" predicate="http://www.some-fictitious-zoo.com/rdf#specimens" object="?specimens"/></bindings><action><div xmlns="http://www.w3.org/1999/xhtml" uri="?animal" title="?name"><em><textnode xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" value="?specimens"/></em></div></action></rule></template></div>
 </window>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_htmlelementquerysyntaxrecursive.xul b/content/xul/templates/tests/chrome/test_tmpl_htmlelementquerysyntaxrecursive.xul
index d59f83dc41b0..e47936b596c8 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_htmlelementquerysyntaxrecursive.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_htmlelementquerysyntaxrecursive.xul
@@ -78,5 +78,5 @@ var changes = [
 ]]>
 </script>
 
-<div xmlns="http://www.w3.org/1999/xhtml" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/all-animals"><template xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="template"><query><content uri="?uri"/><member container="?uri" child="?child"/><triple subject="?child" predicate="http://www.some-fictitious-zoo.com/rdf#name" object="?name"/></query><rule><conditions><where subject="?name" rel="endswith" multiple="true" value="mals,ects,nids,irds"/></conditions><action><strong xmlns="http://www.w3.org/1999/xhtml" uri="?child"><textnode xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" value="?name"/></strong></action></rule><rule><conditions><where subject="?uri" rel="equals" negate="true" value="http://www.some-fictitious-zoo.com/all-animals"/><where subject="?name" rel="contains" ignorecase="true" value="o"/></conditions><action><span xmlns="http://www.w3.org/1999/xhtml" uri="?child"><textnode xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" value="?name"/></span></action></rule></template></div>
+<div xmlns="http://www.w3.org/1999/xhtml" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/all-animals"><template xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="template"><query><content uri="?uri"/><member container="?uri" child="?child"/><triple subject="?child" predicate="http://www.some-fictitious-zoo.com/rdf#name" object="?name"/></query><rule><conditions><where subject="?name" rel="endswith" multiple="true" value="mals,ects,nids,irds"/></conditions><action><strong xmlns="http://www.w3.org/1999/xhtml" uri="?child"><textnode xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" value="?name"/></strong></action></rule><rule><conditions><where subject="?uri" rel="equals" negate="true" value="http://www.some-fictitious-zoo.com/all-animals"/><where subject="?name" rel="contains" ignorecase="true" value="o"/></conditions><action><span xmlns="http://www.w3.org/1999/xhtml" uri="?child"><textnode xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" value="?name"/></span></action></rule></template></div>
 </window>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_htmlelementquerysyntaxwithmultiplerules.xul b/content/xul/templates/tests/chrome/test_tmpl_htmlelementquerysyntaxwithmultiplerules.xul
index 3b45fe94b90d..0e38ef1fbde5 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_htmlelementquerysyntaxwithmultiplerules.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_htmlelementquerysyntaxwithmultiplerules.xul
@@ -99,5 +99,5 @@ var changes = [
 ]]>
 </script>
 
-<div xmlns="http://www.w3.org/1999/xhtml" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals"><template xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="template"><query><content uri="?uri"/><member container="?uri" child="?animal"/><triple subject="?animal" predicate="http://www.some-fictitious-zoo.com/rdf#name" object="?name"/><triple subject="?animal" predicate="http://www.some-fictitious-zoo.com/rdf#specimens" object="?specimens"/></query><rule><conditions id="conditions"><where subject="?specimens" rel="greater" value="6"/></conditions><action><vbox><p xmlns="http://www.w3.org/1999/xhtml" uri="?animal"><span title="?name"/></p></vbox></action></rule><rule><action><span xmlns="http://www.w3.org/1999/xhtml" uri="?animal"><textnode xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" value="?name"/></span></action></rule></template></div>
+<div xmlns="http://www.w3.org/1999/xhtml" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals"><template xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="template"><query><content uri="?uri"/><member container="?uri" child="?animal"/><triple subject="?animal" predicate="http://www.some-fictitious-zoo.com/rdf#name" object="?name"/><triple subject="?animal" predicate="http://www.some-fictitious-zoo.com/rdf#specimens" object="?specimens"/></query><rule><conditions id="conditions"><where subject="?specimens" rel="greater" value="6"/></conditions><action><vbox><p xmlns="http://www.w3.org/1999/xhtml" uri="?animal"><span title="?name"/></p></vbox></action></rule><rule><action><span xmlns="http://www.w3.org/1999/xhtml" uri="?animal"><textnode xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" value="?name"/></span></action></rule></template></div>
 </window>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_htmlelementsimplesyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_htmlelementsimplesyntax.xul
index 3ebacf91a1c3..a6225e3f4668 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_htmlelementsimplesyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_htmlelementsimplesyntax.xul
@@ -78,5 +78,5 @@ var changes = [
 ]]>
 </script>
 
-<div xmlns="http://www.w3.org/1999/xhtml" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds"><template xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><p xmlns="http://www.w3.org/1999/xhtml" uri="rdf:*" title="rdf:http://www.some-fictitious-zoo.com/rdf#name"/></template></div>
+<div xmlns="http://www.w3.org/1999/xhtml" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds"><template xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><p xmlns="http://www.w3.org/1999/xhtml" uri="rdf:*" title="rdf:http://www.some-fictitious-zoo.com/rdf#name"/></template></div>
 </window>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_htmlelementsimplesyntaxusingatextnode.xul b/content/xul/templates/tests/chrome/test_tmpl_htmlelementsimplesyntaxusingatextnode.xul
index 4e086e2cc00f..8507b5e8dfc7 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_htmlelementsimplesyntaxusingatextnode.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_htmlelementsimplesyntaxusingatextnode.xul
@@ -78,5 +78,5 @@ var changes = [
 ]]>
 </script>
 
-<div xmlns="http://www.w3.org/1999/xhtml" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds"><template xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><p xmlns="http://www.w3.org/1999/xhtml" uri="rdf:*"><textnode xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" value="rdf:http://www.some-fictitious-zoo.com/rdf#name"/></p></template></div>
+<div xmlns="http://www.w3.org/1999/xhtml" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds"><template xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><p xmlns="http://www.w3.org/1999/xhtml" uri="rdf:*"><textnode xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" value="rdf:http://www.some-fictitious-zoo.com/rdf#name"/></p></template></div>
 </window>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_invalidqp.xul b/content/xul/templates/tests/chrome/test_tmpl_invalidqp.xul
index 93ef2b97ad90..ff435703800d 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_invalidqp.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_invalidqp.xul
@@ -38,7 +38,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf"
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null"
       ref="http://www.some-fictitious-zoo.com/birds" querytype="blah">
 <template zoo:name="Barn Owl" xmlns:zoo="http://www.some-fictitious-zoo.com/rdf#">
 <label uri="rdf:*" value="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_listboxelement.xul b/content/xul/templates/tests/chrome/test_tmpl_listboxelement.xul
index c350f25f3346..82b5404aad52 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_listboxelement.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_listboxelement.xul
@@ -100,7 +100,7 @@ var changes = [
 ]]>
 </script>
 
-<listbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<listbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <listcols>
 <listcol flex="1"/>
 <listcol flex="1"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_literalasmember.xul b/content/xul/templates/tests/chrome/test_tmpl_literalasmember.xul
index 51536749dbda..26f2599cedf6 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_literalasmember.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_literalasmember.xul
@@ -35,7 +35,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/arachnids">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/arachnids">
 <template id="template">
 <rule id="rule">
 <conditions id="conditions">
diff --git a/content/xul/templates/tests/chrome/test_tmpl_membervariablechanged.xul b/content/xul/templates/tests/chrome/test_tmpl_membervariablechanged.xul
index a19c6669db0f..76098d2306f1 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_membervariablechanged.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_membervariablechanged.xul
@@ -39,7 +39,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template member="?child">
 <rule>
 <button uri="?child" label="?child rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_membervariablesubstitution.xul b/content/xul/templates/tests/chrome/test_tmpl_membervariablesubstitution.xul
index 5af1a54527ba..0af0e3c3f199 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_membervariablesubstitution.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_membervariablesubstitution.xul
@@ -35,7 +35,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/arachnids">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/arachnids">
 <template id="template">
 <rule id="rule">
 <conditions id="conditions">
diff --git a/content/xul/templates/tests/chrome/test_tmpl_menuelement.xul b/content/xul/templates/tests/chrome/test_tmpl_menuelement.xul
index b7b40f69cfbe..361bb48dbd06 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_menuelement.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_menuelement.xul
@@ -78,7 +78,7 @@ var changes = [
 ]]>
 </script>
 
-<button xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" type="menu" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<button xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" type="menu" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template>
 <menupopup>
 <menuitem uri="rdf:*" label="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_menuelementrecursive.xul b/content/xul/templates/tests/chrome/test_tmpl_menuelementrecursive.xul
index 257b05e6678e..5ce3c955d1c2 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_menuelementrecursive.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_menuelementrecursive.xul
@@ -97,7 +97,7 @@ var changes = [
 ]]>
 </script>
 
-<button xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" type="menu" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/all-animals">
+<button xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" type="menu" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/all-animals">
 <template>
 <rule iscontainer="true" zoo:name="Birds" xmlns:zoo="http://www.some-fictitious-zoo.com/rdf#">
 <menupopup>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_menulistelement.xul b/content/xul/templates/tests/chrome/test_tmpl_menulistelement.xul
index 4d82a33e6f1d..00737d745325 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_menulistelement.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_menulistelement.xul
@@ -78,7 +78,7 @@ var changes = [
 ]]>
 </script>
 
-<menulist xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<menulist xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template>
 <menupopup>
 <menuitem uri="rdf:*" label="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_mixedsyntaxiscontainer.xul b/content/xul/templates/tests/chrome/test_tmpl_mixedsyntaxiscontainer.xul
index 40e29d3aa3a3..93b0dcb234b9 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_mixedsyntaxiscontainer.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_mixedsyntaxiscontainer.xul
@@ -47,7 +47,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/marked" flags="dont-recurse">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/marked" flags="dont-recurse">
 <template id="template">
 <rule id="rule1" iscontainer="true">
 <button uri="rdf:*" label="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_mixedsyntaxiscontainerisempty.xul b/content/xul/templates/tests/chrome/test_tmpl_mixedsyntaxiscontainerisempty.xul
index 3280938bd157..d09f336b0e82 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_mixedsyntaxiscontainerisempty.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_mixedsyntaxiscontainerisempty.xul
@@ -40,7 +40,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/marked" flags="dont-recurse">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/marked" flags="dont-recurse">
 <template id="template">
 <rule id="rule1" iscontainer="true" isempty="true">
 <label uri="rdf:*" value="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_mixedsyntaxisempty.xul b/content/xul/templates/tests/chrome/test_tmpl_mixedsyntaxisempty.xul
index 102b0056e8ca..e162cfbf31fb 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_mixedsyntaxisempty.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_mixedsyntaxisempty.xul
@@ -40,7 +40,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/marked" flags="dont-recurse">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/marked" flags="dont-recurse">
 <template id="template">
 <rule id="rule1" isempty="true">
 <label uri="rdf:*" value="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_noaction.xul b/content/xul/templates/tests/chrome/test_tmpl_noaction.xul
index 198b1d40ae7d..a70594d78b9d 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_noaction.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_noaction.xul
@@ -35,7 +35,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template>
 <query>
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_noactionuriattribute.xul b/content/xul/templates/tests/chrome/test_tmpl_noactionuriattribute.xul
index 67947abcfcbf..276538726f37 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_noactionuriattribute.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_noactionuriattribute.xul
@@ -47,7 +47,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/arachnids">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/arachnids">
 <template id="template">
 <label value="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
 </template>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_parentconditions.xul b/content/xul/templates/tests/chrome/test_tmpl_parentconditions.xul
index 0fb1918bf4d0..39abc04eb738 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_parentconditions.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_parentconditions.xul
@@ -83,7 +83,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/all-animals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/all-animals">
 <template>
 <query>
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_parentcontenttag.xul b/content/xul/templates/tests/chrome/test_tmpl_parentcontenttag.xul
index e4eab6abba5f..cf8064005342 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_parentcontenttag.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_parentcontenttag.xul
@@ -83,7 +83,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/all-animals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/all-animals">
 <template>
 <rule>
 <conditions>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_parentsimplesyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_parentsimplesyntax.xul
index fa5ab9ddbdf8..7784130687a8 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_parentsimplesyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_parentsimplesyntax.xul
@@ -87,7 +87,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/all-animals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/all-animals">
 <template member="?parent">
 <rule parent="hbox">
 <button uri="?parent" label="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_query3triples.xul b/content/xul/templates/tests/chrome/test_tmpl_query3triples.xul
index f9dcb54fd52d..397981f02c0f 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_query3triples.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_query3triples.xul
@@ -40,7 +40,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/humans/robert">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/humans/robert">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_query3tripleswherecontains.xul b/content/xul/templates/tests/chrome/test_tmpl_query3tripleswherecontains.xul
index aee3e52a0ae2..4a49a911142e 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_query3tripleswherecontains.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_query3tripleswherecontains.xul
@@ -90,7 +90,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/humans/robert">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/humans/robert">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_querymember3tripleswhereequals.xul b/content/xul/templates/tests/chrome/test_tmpl_querymember3tripleswhereequals.xul
index 9c5a25931f1f..d3830f97e914 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_querymember3tripleswhereequals.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_querymember3tripleswhereequals.xul
@@ -38,7 +38,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/humans">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/humans">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_querymemberandtwotriples.xul b/content/xul/templates/tests/chrome/test_tmpl_querymemberandtwotriples.xul
index ea89042142f8..efd9ed40939a 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_querymemberandtwotriples.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_querymemberandtwotriples.xul
@@ -42,7 +42,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/humans">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/humans">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_querymembertriplemembertriple.xul b/content/xul/templates/tests/chrome/test_tmpl_querymembertriplemembertriple.xul
index 0847712419c7..93bceb68a979 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_querymembertriplemembertriple.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_querymembertriplemembertriple.xul
@@ -47,7 +47,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/humans">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/humans">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_queryresourcematch.xul b/content/xul/templates/tests/chrome/test_tmpl_queryresourcematch.xul
index 86829c04af28..7b25f89cbe77 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_queryresourcematch.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_queryresourcematch.xul
@@ -42,7 +42,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/all-animals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/all-animals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_queryreversetriple.xul b/content/xul/templates/tests/chrome/test_tmpl_queryreversetriple.xul
index 64f26f62296a..9dec479a1bb1 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_queryreversetriple.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_queryreversetriple.xul
@@ -38,7 +38,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/humans/robert">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/humans/robert">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_queryselfwithtriple.xul b/content/xul/templates/tests/chrome/test_tmpl_queryselfwithtriple.xul
index c54fa261fd4f..d42af9df250a 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_queryselfwithtriple.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_queryselfwithtriple.xul
@@ -35,7 +35,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template>
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_querysetone.xul b/content/xul/templates/tests/chrome/test_tmpl_querysetone.xul
index 69edce321393..7abc1b709a51 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_querysetone.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_querysetone.xul
@@ -78,7 +78,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template id="template">
 <queryset>
 <query>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_querysettwo.xul b/content/xul/templates/tests/chrome/test_tmpl_querysettwo.xul
index 551ca5f2fb4f..0ec45a97b924 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_querysettwo.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_querysettwo.xul
@@ -89,7 +89,7 @@ var changes = [
 </script>
 
 <vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" flags="logging"
-      datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+      datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template>
 <queryset>
 <query>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_querysettwowithcondition.xul b/content/xul/templates/tests/chrome/test_tmpl_querysettwowithcondition.xul
index 84b1946d4542..6beb2565bede 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_querysettwowithcondition.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_querysettwowithcondition.xul
@@ -112,7 +112,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template>
 <queryset>
 <query>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_querysyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_querysyntax.xul
index c3b37d77ca2e..c7af5c71ad98 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_querysyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_querysyntax.xul
@@ -48,7 +48,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/arachnids">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/arachnids">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_querysyntaxmultiplerules.xul b/content/xul/templates/tests/chrome/test_tmpl_querysyntaxmultiplerules.xul
index d4418e363b25..b0ba6562e3ea 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_querysyntaxmultiplerules.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_querysyntaxmultiplerules.xul
@@ -89,7 +89,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query>
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_querysyntaxmultiplerulesfirstconditionall.xul b/content/xul/templates/tests/chrome/test_tmpl_querysyntaxmultiplerulesfirstconditionall.xul
index a11eb8bb6664..d3ec4f2e9837 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_querysyntaxmultiplerulesfirstconditionall.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_querysyntaxmultiplerulesfirstconditionall.xul
@@ -44,7 +44,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query>
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_querysyntaxmultiplerulestwoconditions.xul b/content/xul/templates/tests/chrome/test_tmpl_querysyntaxmultiplerulestwoconditions.xul
index 80a61f6a151b..ff379ae59221 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_querysyntaxmultiplerulestwoconditions.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_querysyntaxmultiplerulestwoconditions.xul
@@ -84,7 +84,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query>
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_querytripleandmembermerge.xul b/content/xul/templates/tests/chrome/test_tmpl_querytripleandmembermerge.xul
index 1ddad46e19a4..a814427aaa53 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_querytripleandmembermerge.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_querytripleandmembermerge.xul
@@ -38,7 +38,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/humans/robert">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/humans/robert">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_querytripleobjecttosubject.xul b/content/xul/templates/tests/chrome/test_tmpl_querytripleobjecttosubject.xul
index ae6127af92f1..29bf498d7948 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_querytripleobjecttosubject.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_querytripleobjecttosubject.xul
@@ -52,7 +52,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/arachnids/tarantula">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/arachnids/tarantula">
 <template id="template">
 <query>
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_querytwomembers.xul b/content/xul/templates/tests/chrome/test_tmpl_querytwomembers.xul
index 5539cc00290b..441934b405d1 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_querytwomembers.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_querytwomembers.xul
@@ -91,7 +91,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/all-animals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/all-animals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_querytwomembersfiltered.xul b/content/xul/templates/tests/chrome/test_tmpl_querytwomembersfiltered.xul
index 169a07a31a98..a30573757f0b 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_querytwomembersfiltered.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_querytwomembersfiltered.xul
@@ -37,7 +37,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/all-animals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/all-animals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_querytwotriples.xul b/content/xul/templates/tests/chrome/test_tmpl_querytwotriples.xul
index a023e258aace..44c4f9020f57 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_querytwotriples.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_querytwotriples.xul
@@ -40,7 +40,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/humans/robert">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/humans/robert">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_queryupwardsmember.xul b/content/xul/templates/tests/chrome/test_tmpl_queryupwardsmember.xul
index aecb814ad88c..7e78f790da09 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_queryupwardsmember.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_queryupwardsmember.xul
@@ -39,7 +39,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds/emu" flags="dont-recurse">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds/emu" flags="dont-recurse">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_queryupwardsmembertripleandfilteringtriple.xul b/content/xul/templates/tests/chrome/test_tmpl_queryupwardsmembertripleandfilteringtriple.xul
index 5f858bffe8d2..fae8fbb2d558 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_queryupwardsmembertripleandfilteringtriple.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_queryupwardsmembertripleandfilteringtriple.xul
@@ -38,7 +38,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/humans/robert">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/humans/robert">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_querywithemptyconditions.xul b/content/xul/templates/tests/chrome/test_tmpl_querywithemptyconditions.xul
index 930003e9857d..f19132604349 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_querywithemptyconditions.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_querywithemptyconditions.xul
@@ -99,7 +99,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_referenceasmember.xul b/content/xul/templates/tests/chrome/test_tmpl_referenceasmember.xul
index 439e8324d125..49e3838f6fea 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_referenceasmember.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_referenceasmember.xul
@@ -48,7 +48,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/arachnids">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/arachnids">
 <template id="template">
 <rule id="rule">
 <conditions id="conditions">
diff --git a/content/xul/templates/tests/chrome/test_tmpl_selfgenerationextendedsyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_selfgenerationextendedsyntax.xul
index 4582192847b8..c2903c9e857c 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_selfgenerationextendedsyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_selfgenerationextendedsyntax.xul
@@ -48,7 +48,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/arachnids/tarantula">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/arachnids/tarantula">
 <template id="template">
 <query>
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_selfgenerationsimplesyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_selfgenerationsimplesyntax.xul
index de372c6239fb..1579fc9331f8 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_selfgenerationsimplesyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_selfgenerationsimplesyntax.xul
@@ -45,7 +45,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/arachnids/tarantula">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/arachnids/tarantula">
 <template id="template">
 <button uri="?" label="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
 </template>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxenclosedinacontainer.xul b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxenclosedinacontainer.xul
index 0550c5cf5bdd..2980ef43dc1f 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxenclosedinacontainer.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxenclosedinacontainer.xul
@@ -80,7 +80,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template id="template">
 <hbox>
 <label uri="rdf:*" value="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxenclosedinacontainerwitharule.xul b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxenclosedinacontainerwitharule.xul
index 08ce43d6185a..e4450b156034 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxenclosedinacontainerwitharule.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxenclosedinacontainerwitharule.xul
@@ -46,7 +46,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template id="template">
 <rule>
 <hbox uri="rdf:*">
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxfilter.xul b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxfilter.xul
index b833c3cb870f..3a301eccb730 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxfilter.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxfilter.xul
@@ -35,7 +35,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template zoo:name="Barn Owl" xmlns:zoo="http://www.some-fictitious-zoo.com/rdf#">
 <label uri="rdf:*" value="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
 </template>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxfilterwithmultiplerules.xul b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxfilterwithmultiplerules.xul
index 5b64bb9b6e9e..76b355e63a44 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxfilterwithmultiplerules.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxfilterwithmultiplerules.xul
@@ -84,7 +84,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template>
 <rule zoo:name="Barn Owl" xmlns:zoo="http://www.some-fictitious-zoo.com/rdf#">
 <label uri="rdf:*" value="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxfilterwithrule.xul b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxfilterwithrule.xul
index c8242d268da9..54a2410c45f7 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxfilterwithrule.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxfilterwithrule.xul
@@ -86,7 +86,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template>
 <rule zoo:name="Barn Owl" xmlns:zoo="http://www.some-fictitious-zoo.com/rdf#">
 <hbox uri="rdf:*">
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxiteratingoverasinglevalue.xul b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxiteratingoverasinglevalue.xul
index 56c3c96b3732..7cf66642ceda 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxiteratingoverasinglevalue.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxiteratingoverasinglevalue.xul
@@ -78,7 +78,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template id="template">
 <label uri="rdf:*" value="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
 </template>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusinganinterveningcontainer.xul b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusinganinterveningcontainer.xul
index 8b73a943aef6..c5423da0bd35 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusinganinterveningcontainer.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusinganinterveningcontainer.xul
@@ -78,7 +78,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template id="template">
 <groupbox>
 <label uri="rdf:*" value="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusingatextnode.xul b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusingatextnode.xul
index 86bb949a2255..f90f3c3021cc 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusingatextnode.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusingatextnode.xul
@@ -42,7 +42,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template id="template">
 <description uri="rdf:*"><textnode value="rdf:http://www.some-fictitious-zoo.com/rdf#name"/></description>
 </template>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusingcontainerasthegenerationelement.xul b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusingcontainerasthegenerationelement.xul
index a726cbd03c44..da464f2a9170 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusingcontainerasthegenerationelement.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusingcontainerasthegenerationelement.xul
@@ -90,7 +90,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template id="template">
 <hbox uri="rdf:*">
 <label value="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusingdontrecurse.xul b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusingdontrecurse.xul
index 6be866bb04fa..77e65bc24a59 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusingdontrecurse.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusingdontrecurse.xul
@@ -42,7 +42,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/some-animals" flags="dont-recurse">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/some-animals" flags="dont-recurse">
 <template id="template">
 <hbox uri="rdf:*">
 <label value="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusingrecursivegeneration.xul b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusingrecursivegeneration.xul
index 841d58a50085..8888514786f4 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusingrecursivegeneration.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusingrecursivegeneration.xul
@@ -99,7 +99,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/some-animals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/some-animals">
 <template id="template">
 <hbox uri="rdf:*">
 <label value="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusingrecursivegenerationagain.xul b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusingrecursivegenerationagain.xul
index 5bbbbf18489b..b713d1572f1b 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusingrecursivegenerationagain.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxusingrecursivegenerationagain.xul
@@ -54,7 +54,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/some-animals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/some-animals">
 <template id="template">
 <hbox uri="rdf:*">
 <label value="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxwithtwovariablesused.xul b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxwithtwovariablesused.xul
index ea782f1c6128..0ff705dde5c3 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxwithtwovariablesused.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplesyntaxwithtwovariablesused.xul
@@ -48,7 +48,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template id="template">
 <hbox uri="rdf:*">
 <label value="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutioncaretsatbeginningandend.xul b/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutioncaretsatbeginningandend.xul
index 21b2f2e9ec21..7cf6d210164b 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutioncaretsatbeginningandend.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutioncaretsatbeginningandend.xul
@@ -35,7 +35,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/arachnids">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/arachnids">
 <template id="template">
 <label uri="rdf:*" value="^^Before rdf:http://www.some-fictitious-zoo.com/rdf#name^^"/>
 </template>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutioncaretsubstitution.xul b/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutioncaretsubstitution.xul
index 3cc2f996c543..ac494933a7d9 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutioncaretsubstitution.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutioncaretsubstitution.xul
@@ -35,7 +35,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/arachnids">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/arachnids">
 <template id="template">
 <label uri="rdf:*" value="rdf:http://www.some-fictitious-zoo.com/rdf#name^^ and^^ lots ^ more"/>
 </template>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutionnovariable.xul b/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutionnovariable.xul
index 9990ce37f3a1..4faefea514fc 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutionnovariable.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutionnovariable.xul
@@ -35,7 +35,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/arachnids">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/arachnids">
 <template id="template">
 <label uri="rdf:*" value="Name"/>
 </template>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutionquestionmarkaspartofvariable.xul b/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutionquestionmarkaspartofvariable.xul
index 79ad1cde89ea..253743297895 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutionquestionmarkaspartofvariable.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutionquestionmarkaspartofvariable.xul
@@ -35,7 +35,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/arachnids">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/arachnids">
 <template id="template">
 <label uri="rdf:*" value="Name is rdf:http://www.some-fictitious-zoo.com/rdf#name?"/>
 </template>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutionquestionmarksubstitution.xul b/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutionquestionmarksubstitution.xul
index 629d220ee950..33bee075405c 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutionquestionmarksubstitution.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutionquestionmarksubstitution.xul
@@ -48,7 +48,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/arachnids">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/arachnids">
 <template id="template">
 <label uri="rdf:*" value="Are you a rdf:http://www.some-fictitious-zoo.com/rdf#name ?sample ??"/>
 </template>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutiontextandvariable.xul b/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutiontextandvariable.xul
index 0275213e4075..722c2041669c 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutiontextandvariable.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutiontextandvariable.xul
@@ -48,7 +48,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/arachnids">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/arachnids">
 <template id="template">
 <label uri="rdf:*" value="Name is rdf:http://www.some-fictitious-zoo.com/rdf#name the Spider"/>
 </template>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutionvariableandtextconcatenated.xul b/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutionvariableandtextconcatenated.xul
index 560f9de2d62b..ac54e01124b7 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutionvariableandtextconcatenated.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutionvariableandtextconcatenated.xul
@@ -35,7 +35,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/arachnids">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/arachnids">
 <template id="template">
 <label uri="rdf:*" value="The rdf:http://www.some-fictitious-zoo.com/rdf#name^'s Nest"/>
 </template>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutionvariablesconcatenated.xul b/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutionvariablesconcatenated.xul
index 8d4984752042..00fe91fdd84a 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutionvariablesconcatenated.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_simplevariablesubstitutionvariablesconcatenated.xul
@@ -35,7 +35,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/arachnids">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/arachnids">
 <template id="template">
 <label uri="rdf:*" value="rdf:http://www.some-fictitious-zoo.com/rdf#name^rdf:http://www.some-fictitious-zoo.com/rdf#specimens"/>
 </template>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_sortascendinginteger.xul b/content/xul/templates/tests/chrome/test_tmpl_sortascendinginteger.xul
index 63a171e89ef7..59b8192e3085 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_sortascendinginteger.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_sortascendinginteger.xul
@@ -53,7 +53,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf"
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null"
       ref="http://www.some-fictitious-zoo.com/mammals" sort="?specimens ?name" sortDirection="ascending" sorthints="integer">
 <template id="template">
 <query id="query">
diff --git a/content/xul/templates/tests/chrome/test_tmpl_sortascendingquerysyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_sortascendingquerysyntax.xul
index fdbea85ee269..da6e446d39ea 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_sortascendingquerysyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_sortascendingquerysyntax.xul
@@ -99,7 +99,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals" sort="?name" sortDirection="ascending">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals" sort="?name" sortDirection="ascending">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_sortascendingtworulesquerysyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_sortascendingtworulesquerysyntax.xul
index ebc6d6bb138c..22e780d319b4 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_sortascendingtworulesquerysyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_sortascendingtworulesquerysyntax.xul
@@ -44,7 +44,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals" sortDirection="ascending" sort="?specimens ?name" sortResource="http://www.some-fictitious-zoo.com/rdf#specimens" sortResource2="http://www.some-fictitious-zoo.com/rdf#name">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals" sortDirection="ascending" sort="?specimens ?name" sortResource="http://www.some-fictitious-zoo.com/rdf#specimens" sortResource2="http://www.some-fictitious-zoo.com/rdf#name">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_sortascendingtworuleswithcontainerquerysyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_sortascendingtworuleswithcontainerquerysyntax.xul
index 13ffe1d160ed..7cfa4e93f5d0 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_sortascendingtworuleswithcontainerquerysyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_sortascendingtworuleswithcontainerquerysyntax.xul
@@ -52,7 +52,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals" sortDirection="ascending" sort="?specimens ?name" sortResource="http://www.some-fictitious-zoo.com/rdf#specimens" sortResource2="http://www.some-fictitious-zoo.com/rdf#name">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals" sortDirection="ascending" sort="?specimens ?name" sortResource="http://www.some-fictitious-zoo.com/rdf#specimens" sortResource2="http://www.some-fictitious-zoo.com/rdf#name">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_sortascendingtworuleswithdifferentcontainerquerysyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_sortascendingtworuleswithdifferentcontainerquerysyntax.xul
index 0708eb53572d..6891fd7508f0 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_sortascendingtworuleswithdifferentcontainerquerysyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_sortascendingtworuleswithdifferentcontainerquerysyntax.xul
@@ -54,7 +54,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals" sortDirection="ascending" sort="?specimens ?name" sortResource="http://www.some-fictitious-zoo.com/rdf#specimens" sortResource2="http://www.some-fictitious-zoo.com/rdf#name">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals" sortDirection="ascending" sort="?specimens ?name" sortResource="http://www.some-fictitious-zoo.com/rdf#specimens" sortResource2="http://www.some-fictitious-zoo.com/rdf#name">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_sortdescendingquerysyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_sortdescendingquerysyntax.xul
index d63a881928e4..685318ab3ed3 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_sortdescendingquerysyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_sortdescendingquerysyntax.xul
@@ -99,7 +99,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals" sort="?name" sortDirection="descending">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals" sort="?name" sortDirection="descending">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_sortquerymemberandtwotriples.xul b/content/xul/templates/tests/chrome/test_tmpl_sortquerymemberandtwotriples.xul
index 922f544aaeb8..3582907277a0 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_sortquerymemberandtwotriples.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_sortquerymemberandtwotriples.xul
@@ -42,7 +42,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/humans" sortDirection="ascending" sort="?name" sortResource="http://www.some-fictitious-zoo.com/rdf#specimens" sortResource2="http://www.some-fictitious-zoo.com/rdf#name">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/humans" sortDirection="ascending" sort="?name" sortResource="http://www.some-fictitious-zoo.com/rdf#specimens" sortResource2="http://www.some-fictitious-zoo.com/rdf#name">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_sortresource2descendingsimplesyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_sortresource2descendingsimplesyntax.xul
index 0e4b2cd9c6ae..4128e4d7e295 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_sortresource2descendingsimplesyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_sortresource2descendingsimplesyntax.xul
@@ -44,7 +44,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals" sortDirection="descending" sort="http://www.some-fictitious-zoo.com/rdf#specimens http://www.some-fictitious-zoo.com/rdf#name" sortResource="http://www.some-fictitious-zoo.com/rdf#specimens" sortResource2="http://www.some-fictitious-zoo.com/rdf#name">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals" sortDirection="descending" sort="http://www.some-fictitious-zoo.com/rdf#specimens http://www.some-fictitious-zoo.com/rdf#name" sortResource="http://www.some-fictitious-zoo.com/rdf#specimens" sortResource2="http://www.some-fictitious-zoo.com/rdf#name">
 <template id="template">
 <label uri="rdf:*" value="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
 </template>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_sortresource2settopredicateascendingquerysyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_sortresource2settopredicateascendingquerysyntax.xul
index b91525a32d09..773c42370669 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_sortresource2settopredicateascendingquerysyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_sortresource2settopredicateascendingquerysyntax.xul
@@ -44,7 +44,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals" sortResource="http://www.some-fictitious-zoo.com/rdf#specimens" sortDirection="ascending" sortResource2="http://www.some-fictitious-zoo.com/rdf#name">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals" sortResource="http://www.some-fictitious-zoo.com/rdf#specimens" sortDirection="ascending" sortResource2="http://www.some-fictitious-zoo.com/rdf#name">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_sortresource2settopredicatedescendingquerysyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_sortresource2settopredicatedescendingquerysyntax.xul
index ed39accba686..1ea4b2f20373 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_sortresource2settopredicatedescendingquerysyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_sortresource2settopredicatedescendingquerysyntax.xul
@@ -44,7 +44,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals" sortResource="http://www.some-fictitious-zoo.com/rdf#specimens" sortDirection="descending" sortResource2="http://www.some-fictitious-zoo.com/rdf#name">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals" sortResource="http://www.some-fictitious-zoo.com/rdf#specimens" sortDirection="descending" sortResource2="http://www.some-fictitious-zoo.com/rdf#name">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_sortresourceascendingquerysyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_sortresourceascendingquerysyntax.xul
index 6e1356b492f6..8f578ed79799 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_sortresourceascendingquerysyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_sortresourceascendingquerysyntax.xul
@@ -44,7 +44,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals" sortResource="?name" sortDirection="ascending">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals" sortResource="?name" sortDirection="ascending">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_sortresourcedescendingquerysyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_sortresourcedescendingquerysyntax.xul
index 0a8b1c19f5e9..dc6ee71d4a7e 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_sortresourcedescendingquerysyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_sortresourcedescendingquerysyntax.xul
@@ -44,7 +44,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals" sortResource="?name" sortDirection="descending">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals" sortResource="?name" sortDirection="descending">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_sortresourcesettopredicateascendingquerysyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_sortresourcesettopredicateascendingquerysyntax.xul
index 50cb67ce7dea..8754bc65faab 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_sortresourcesettopredicateascendingquerysyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_sortresourcesettopredicateascendingquerysyntax.xul
@@ -44,7 +44,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals" sortResource="http://www.some-fictitious-zoo.com/rdf#specimens" sortDirection="ascending">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals" sortResource="http://www.some-fictitious-zoo.com/rdf#specimens" sortDirection="ascending">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_sortresourcesettopredicatedescendingquerysyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_sortresourcesettopredicatedescendingquerysyntax.xul
index 963d9affaaf7..67103f1e7903 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_sortresourcesettopredicatedescendingquerysyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_sortresourcesettopredicatedescendingquerysyntax.xul
@@ -44,7 +44,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals" sortResource="http://www.some-fictitious-zoo.com/rdf#specimens" sortDirection="descending">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals" sortResource="http://www.some-fictitious-zoo.com/rdf#specimens" sortDirection="descending">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_sorttworesourcesasstringsettopredicatedescendingquerysyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_sorttworesourcesasstringsettopredicatedescendingquerysyntax.xul
index a06d94728b5f..a86fffe305fb 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_sorttworesourcesasstringsettopredicatedescendingquerysyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_sorttworesourcesasstringsettopredicatedescendingquerysyntax.xul
@@ -44,7 +44,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals" sortDirection="descending" sort="http://www.some-fictitious-zoo.com/rdf#specimensAsString http://www.some-fictitious-zoo.com/rdf#name">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals" sortDirection="descending" sort="http://www.some-fictitious-zoo.com/rdf#specimensAsString http://www.some-fictitious-zoo.com/rdf#name">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_sorttworesourcessettopredicateascendingquerysyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_sorttworesourcessettopredicateascendingquerysyntax.xul
index c0217d5879f2..3efaff4b3537 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_sorttworesourcessettopredicateascendingquerysyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_sorttworesourcessettopredicateascendingquerysyntax.xul
@@ -44,7 +44,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals" sortDirection="ascending" sort="http://www.some-fictitious-zoo.com/rdf#specimens http://www.some-fictitious-zoo.com/rdf#name">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals" sortDirection="ascending" sort="http://www.some-fictitious-zoo.com/rdf#specimens http://www.some-fictitious-zoo.com/rdf#name">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_sorttwovariablesascendingquerysyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_sorttwovariablesascendingquerysyntax.xul
index 9836237b484d..400bf52e4a79 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_sorttwovariablesascendingquerysyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_sorttwovariablesascendingquerysyntax.xul
@@ -99,7 +99,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals" sortDirection="ascending" sort="?specimens ?name">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals" sortDirection="ascending" sort="?specimens ?name">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_sorttwovariablesascendingsimplesyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_sorttwovariablesascendingsimplesyntax.xul
index d581bf43d05b..1cdb7ed2cc24 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_sorttwovariablesascendingsimplesyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_sorttwovariablesascendingsimplesyntax.xul
@@ -44,7 +44,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals" sortDirection="ascending" sort="http://www.some-fictitious-zoo.com/rdf#specimens http://www.some-fictitious-zoo.com/rdf#name">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals" sortDirection="ascending" sort="http://www.some-fictitious-zoo.com/rdf#specimens http://www.some-fictitious-zoo.com/rdf#name">
 <template id="template">
 <label uri="rdf:*" value="rdf:http://www.some-fictitious-zoo.com/rdf#name"/>
 </template>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_sorttwovariablesdescendingquerysyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_sorttwovariablesdescendingquerysyntax.xul
index e48675ce0219..1fe029c12482 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_sorttwovariablesdescendingquerysyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_sorttwovariablesdescendingquerysyntax.xul
@@ -44,7 +44,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals" sortDirection="descending" sort="?specimens ?name">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals" sortDirection="descending" sort="?specimens ?name">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_sortunknownascendingquerysyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_sortunknownascendingquerysyntax.xul
index b0cd1c4386a3..0d47e83ba137 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_sortunknownascendingquerysyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_sortunknownascendingquerysyntax.xul
@@ -44,7 +44,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals" sort="?other">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals" sort="?other">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntax.xul b/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntax.xul
index cc136be7d66b..fa06684f9d74 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntax.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntax.xul
@@ -127,7 +127,7 @@ var changes = [
 ]]>
 </script>
 
-<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="animals.rdf" flags="" id="root" ref="http://www.some-fictitious-zoo.com/birds">
+<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="rdf:null" flags="" id="root" ref="http://www.some-fictitious-zoo.com/birds">
 <treecols orient="horizontal" id="treecols">
 <treecol id="treecol" primary="true" label="Name"/>
 <treecol label="Species"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxnotrecursive.xul b/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxnotrecursive.xul
index 704a8421afe1..623c7a5006a6 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxnotrecursive.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxnotrecursive.xul
@@ -117,7 +117,7 @@ var changes = [
 ]]>
 </script>
 
-<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/marked" flags="dont-recurse" id="root">
+<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/marked" flags="dont-recurse" id="root">
 <treecols orient="horizontal" id="treecols">
 <treecol id="treecol" primary="true" label="Name"/>
 <treecol label="Species"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxnotrecursivetreebuilder.xul b/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxnotrecursivetreebuilder.xul
index 29e2e7fa9948..7acc04229cc4 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxnotrecursivetreebuilder.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxnotrecursivetreebuilder.xul
@@ -117,7 +117,7 @@ var changes = [
 ]]>
 </script>
 
-<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/marked" flags="dont-recurse dont-build-content" id="root">
+<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/marked" flags="dont-recurse dont-build-content" id="root">
 <treecols orient="horizontal" id="treecols">
 <treecol id="treecol" primary="true" label="Name"/>
 <treecol label="Species"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxrecursive.xul b/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxrecursive.xul
index 46cc2709646a..712e8290f674 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxrecursive.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxrecursive.xul
@@ -187,7 +187,7 @@ var changes = [
 ]]>
 </script>
 
-<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/marked" id="root">
+<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/marked" id="root">
 <treecols orient="horizontal" id="treecols">
 <treecol id="treecol" primary="true" label="Name"/>
 <treecol label="Species"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxrecursivemultiplerules.xul b/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxrecursivemultiplerules.xul
index 935536749aba..1261b92b2c99 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxrecursivemultiplerules.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxrecursivemultiplerules.xul
@@ -225,7 +225,7 @@ var changes = [
 </script>
 
 <tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true"
-      flags="logging" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/marked" id="root">
+      flags="logging" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/marked" id="root">
 <treecols orient="horizontal" id="treecols">
 <treecol id="treecol" primary="true" label="Name"/>
 <treecol label="Species"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxrecursivemultiplerulestreebuilder.xul b/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxrecursivemultiplerulestreebuilder.xul
index 5d087a9a1a4d..52cc04ff4dee 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxrecursivemultiplerulestreebuilder.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxrecursivemultiplerulestreebuilder.xul
@@ -187,7 +187,7 @@ var changes = [
 ]]>
 </script>
 
-<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/marked" flags=" dont-build-content" id="root">
+<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/marked" flags=" dont-build-content" id="root">
 <treecols orient="horizontal" id="treecols">
 <treecol id="treecol" primary="true" label="Name"/>
 <treecol label="Species"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxrecursivetreebuilder.xul b/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxrecursivetreebuilder.xul
index 5b41b310bc1f..a8ebaf0af847 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxrecursivetreebuilder.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxrecursivetreebuilder.xul
@@ -187,7 +187,7 @@ var changes = [
 ]]>
 </script>
 
-<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/marked" flags=" dont-build-content" id="root">
+<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/marked" flags=" dont-build-content" id="root">
 <treecols orient="horizontal" id="treecols">
 <treecol id="treecol" primary="true" label="Name"/>
 <treecol label="Species"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxtreebuilder.xul b/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxtreebuilder.xul
index 50892b457565..4d2b28984144 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxtreebuilder.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_treeelementquerysyntaxtreebuilder.xul
@@ -127,7 +127,7 @@ var changes = [
 ]]>
 </script>
 
-<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="animals.rdf" flags="dont-build-content" id="root" ref="http://www.some-fictitious-zoo.com/birds">
+<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="rdf:null" flags="dont-build-content" id="root" ref="http://www.some-fictitious-zoo.com/birds">
 <treecols orient="horizontal" id="treecols">
 <treecol id="treecol" primary="true" label="Name"/>
 <treecol label="Species"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_treeelementsimplesyntaxnotrecursive.xul b/content/xul/templates/tests/chrome/test_tmpl_treeelementsimplesyntaxnotrecursive.xul
index 7a7f0c733566..e999a64d3cea 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_treeelementsimplesyntaxnotrecursive.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_treeelementsimplesyntaxnotrecursive.xul
@@ -117,7 +117,7 @@ var changes = [
 ]]>
 </script>
 
-<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="animals.rdf" flags="dont-recurse" ref="http://www.some-fictitious-zoo.com/marked" id="root">
+<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="rdf:null" flags="dont-recurse" ref="http://www.some-fictitious-zoo.com/marked" id="root">
 <treecols orient="horizontal" id="treecols">
 <treecol id="treecol" primary="true" label="Name"/>
 <treecol label="Species"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_treeelementsimplesyntaxnotrecursivetreebuilder.xul b/content/xul/templates/tests/chrome/test_tmpl_treeelementsimplesyntaxnotrecursivetreebuilder.xul
index 2f09f55c4878..444b4072d7c5 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_treeelementsimplesyntaxnotrecursivetreebuilder.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_treeelementsimplesyntaxnotrecursivetreebuilder.xul
@@ -117,7 +117,7 @@ var changes = [
 ]]>
 </script>
 
-<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="animals.rdf" flags="dont-recurse dont-build-content" ref="http://www.some-fictitious-zoo.com/marked" id="root">
+<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="rdf:null" flags="dont-recurse dont-build-content" ref="http://www.some-fictitious-zoo.com/marked" id="root">
 <treecols orient="horizontal" id="treecols">
 <treecol id="treecol" primary="true" label="Name"/>
 <treecol label="Species"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_treeelementsimplesyntaxrecursive.xul b/content/xul/templates/tests/chrome/test_tmpl_treeelementsimplesyntaxrecursive.xul
index 612d8a0741ad..498707d16287 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_treeelementsimplesyntaxrecursive.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_treeelementsimplesyntaxrecursive.xul
@@ -187,7 +187,7 @@ var changes = [
 ]]>
 </script>
 
-<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="animals.rdf" flags="" ref="http://www.some-fictitious-zoo.com/marked" id="root">
+<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="rdf:null" flags="" ref="http://www.some-fictitious-zoo.com/marked" id="root">
 <treecols orient="horizontal" id="treecols">
 <treecol id="treecol" primary="true" label="Name"/>
 <treecol label="Species"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_treeelementsimplesyntaxrecursivetreebuilder.xul b/content/xul/templates/tests/chrome/test_tmpl_treeelementsimplesyntaxrecursivetreebuilder.xul
index e8a331e14d74..69b19aa92081 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_treeelementsimplesyntaxrecursivetreebuilder.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_treeelementsimplesyntaxrecursivetreebuilder.xul
@@ -187,7 +187,7 @@ var changes = [
 ]]>
 </script>
 
-<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="animals.rdf" flags="dont-build-content" ref="http://www.some-fictitious-zoo.com/marked" id="root">
+<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="rdf:null" flags="dont-build-content" ref="http://www.some-fictitious-zoo.com/marked" id="root">
 <treecols orient="horizontal" id="treecols">
 <treecol id="treecol" primary="true" label="Name"/>
 <treecol label="Species"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_treeelementtreecell.xul b/content/xul/templates/tests/chrome/test_tmpl_treeelementtreecell.xul
index 3c84f1bbdb23..eced60d9904d 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_treeelementtreecell.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_treeelementtreecell.xul
@@ -114,7 +114,7 @@ var changes = [
 ]]>
 </script>
 
-<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds" hidevscroll="true" hidehscroll="true">
+<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds" hidevscroll="true" hidehscroll="true">
 <treecols orient="horizontal" id="treecols">
 <treecol id="treecol" primary="true" label="Name" ordinal="1"/>
 <treecol label="Species" ordinal="3"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_treeelementtreecellsortascending.xul b/content/xul/templates/tests/chrome/test_tmpl_treeelementtreecellsortascending.xul
index 861c8809645e..f0f6c7e29619 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_treeelementtreecellsortascending.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_treeelementtreecellsortascending.xul
@@ -114,7 +114,7 @@ var changes = [
 ]]>
 </script>
 
-<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="animals.rdf" flags="" sort="rdf:http://www.some-fictitious-zoo.com/rdf#name" sortDirection="ascending" id="root" ref="http://www.some-fictitious-zoo.com/birds">
+<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="rdf:null" flags="" sort="rdf:http://www.some-fictitious-zoo.com/rdf#name" sortDirection="ascending" id="root" ref="http://www.some-fictitious-zoo.com/birds">
 <treecols orient="horizontal" id="treecols">
 <treecol id="treecol" primary="true" label="Name" ordinal="1" sort="rdf:http://www.some-fictitious-zoo.com/rdf#name" sortDirection="ascending" sortActive="true"/>
 <treecol label="Species" ordinal="3"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_treeelementtreecellsortascendingtreebuilder.xul b/content/xul/templates/tests/chrome/test_tmpl_treeelementtreecellsortascendingtreebuilder.xul
index 55886d8791a1..91deb4ea09a3 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_treeelementtreecellsortascendingtreebuilder.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_treeelementtreecellsortascendingtreebuilder.xul
@@ -114,7 +114,7 @@ var changes = [
 ]]>
 </script>
 
-<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="animals.rdf" flags="dont-build-content" sort="rdf:http://www.some-fictitious-zoo.com/rdf#name" sortDirection="ascending" id="root" ref="http://www.some-fictitious-zoo.com/birds">
+<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="rdf:null" flags="dont-build-content" sort="rdf:http://www.some-fictitious-zoo.com/rdf#name" sortDirection="ascending" id="root" ref="http://www.some-fictitious-zoo.com/birds">
 <treecols orient="horizontal" id="treecols">
 <treecol id="treecol" primary="true" label="Name" ordinal="1" sort="rdf:http://www.some-fictitious-zoo.com/rdf#name" sortDirection="ascending" sortActive="true"/>
 <treecol label="Species" ordinal="3"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_treeelementtreecelltreebuilder.xul b/content/xul/templates/tests/chrome/test_tmpl_treeelementtreecelltreebuilder.xul
index fa46543aad68..16cdfb66e534 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_treeelementtreecelltreebuilder.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_treeelementtreecelltreebuilder.xul
@@ -114,7 +114,7 @@ var changes = [
 ]]>
 </script>
 
-<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="animals.rdf" flags="dont-build-content" id="root" ref="http://www.some-fictitious-zoo.com/birds">
+<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="rdf:null" flags="dont-build-content" id="root" ref="http://www.some-fictitious-zoo.com/birds">
 <treecols orient="horizontal" id="treecols">
 <treecol id="treecol" primary="true" label="Name" ordinal="1"/>
 <treecol label="Species" ordinal="3"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_treeelementtreeitemonly.xul b/content/xul/templates/tests/chrome/test_tmpl_treeelementtreeitemonly.xul
index 733e3039ef2e..b5e1396a85d1 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_treeelementtreeitemonly.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_treeelementtreeitemonly.xul
@@ -83,7 +83,7 @@ var changes = [
 ]]>
 </script>
 
-<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds" hidevscroll="true" hidehscroll="true">
+<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds" hidevscroll="true" hidehscroll="true">
 <treecols orient="horizontal" id="treecols">
 <treecol id="treecol" primary="true" label="Name"/>
 </treecols>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_treeelementtreeitemsortascending.xul b/content/xul/templates/tests/chrome/test_tmpl_treeelementtreeitemsortascending.xul
index 99befd2c7bd3..61337325ef3b 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_treeelementtreeitemsortascending.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_treeelementtreeitemsortascending.xul
@@ -83,7 +83,7 @@ var changes = [
 ]]>
 </script>
 
-<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="animals.rdf" sort="rdf:http://www.some-fictitious-zoo.com/rdf#name" sortDirection="ascending" id="root" ref="http://www.some-fictitious-zoo.com/birds">
+<tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" hidevscroll="true" hidehscroll="true" datasources="rdf:null" sort="rdf:http://www.some-fictitious-zoo.com/rdf#name" sortDirection="ascending" id="root" ref="http://www.some-fictitious-zoo.com/birds">
 <treecols orient="horizontal" id="treecols">
 <treecol id="treecol" primary="true" label="Name" ordinal="1" sort="rdf:http://www.some-fictitious-zoo.com/rdf#name" sortDirection="ascending" sortActive="true"/>
 </treecols>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_twogenerationnodes.xul b/content/xul/templates/tests/chrome/test_tmpl_twogenerationnodes.xul
index 07f1d55a08a2..c2faaca2472e 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_twogenerationnodes.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_twogenerationnodes.xul
@@ -84,7 +84,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/birds">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/birds">
 <template>
 <query>
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereafterignorecase.xul b/content/xul/templates/tests/chrome/test_tmpl_whereafterignorecase.xul
index 1c0b5c9582be..d7f6bd786626 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereafterignorecase.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereafterignorecase.xul
@@ -40,7 +40,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereafterlowercase.xul b/content/xul/templates/tests/chrome/test_tmpl_whereafterlowercase.xul
index d2e95b4ddec1..a22b3a4960ba 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereafterlowercase.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereafterlowercase.xul
@@ -43,7 +43,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereafternegation.xul b/content/xul/templates/tests/chrome/test_tmpl_whereafternegation.xul
index 5930ae44a174..db2cbb9cca3c 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereafternegation.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereafternegation.xul
@@ -39,7 +39,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereafteruppercase.xul b/content/xul/templates/tests/chrome/test_tmpl_whereafteruppercase.xul
index 47ef3a303b3e..1dbe929aba9b 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereafteruppercase.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereafteruppercase.xul
@@ -40,7 +40,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherebeforeignorecase.xul b/content/xul/templates/tests/chrome/test_tmpl_wherebeforeignorecase.xul
index f2fe4e0f8663..50867b1af8b9 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherebeforeignorecase.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherebeforeignorecase.xul
@@ -40,7 +40,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherebeforelowercase.xul b/content/xul/templates/tests/chrome/test_tmpl_wherebeforelowercase.xul
index bff97a2a4649..a66a1a1de66b 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherebeforelowercase.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherebeforelowercase.xul
@@ -44,7 +44,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherebeforenegation.xul b/content/xul/templates/tests/chrome/test_tmpl_wherebeforenegation.xul
index 0125cd5dc029..ca29911323a2 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherebeforenegation.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherebeforenegation.xul
@@ -38,7 +38,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherebeforeuppercase.xul b/content/xul/templates/tests/chrome/test_tmpl_wherebeforeuppercase.xul
index 8bcbc03cf5cb..6ff2cdc55628 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherebeforeuppercase.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherebeforeuppercase.xul
@@ -39,7 +39,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherecontains.xul b/content/xul/templates/tests/chrome/test_tmpl_wherecontains.xul
index 58b3536c5b03..b202e82c1967 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherecontains.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherecontains.xul
@@ -93,7 +93,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherecontainsignorecase.xul b/content/xul/templates/tests/chrome/test_tmpl_wherecontainsignorecase.xul
index c1f3e110d77b..7b221c93c1e1 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherecontainsignorecase.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherecontainsignorecase.xul
@@ -39,7 +39,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherecontainsnegation.xul b/content/xul/templates/tests/chrome/test_tmpl_wherecontainsnegation.xul
index 742170f3f0c8..90ce6cb0bb37 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherecontainsnegation.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherecontainsnegation.xul
@@ -39,7 +39,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherecontainsnumber.xul b/content/xul/templates/tests/chrome/test_tmpl_wherecontainsnumber.xul
index 6f8bab216c96..86b9b394b334 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherecontainsnumber.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherecontainsnumber.xul
@@ -39,7 +39,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherecontainsnumberstring.xul b/content/xul/templates/tests/chrome/test_tmpl_wherecontainsnumberstring.xul
index 59d026d5c2c9..fde608222de8 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherecontainsnumberstring.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherecontainsnumberstring.xul
@@ -39,7 +39,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherecontainsresource.xul b/content/xul/templates/tests/chrome/test_tmpl_wherecontainsresource.xul
index 2d178c6f557d..f512987c07f5 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherecontainsresource.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherecontainsresource.xul
@@ -37,7 +37,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherecontainstwo.xul b/content/xul/templates/tests/chrome/test_tmpl_wherecontainstwo.xul
index 4af50535c00c..887cb5c07b5a 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherecontainstwo.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherecontainstwo.xul
@@ -92,7 +92,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereendswith.xul b/content/xul/templates/tests/chrome/test_tmpl_whereendswith.xul
index 23561e8fa9f8..964ae6ce2071 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereendswith.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereendswith.xul
@@ -35,7 +35,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereendswithignorecase.xul b/content/xul/templates/tests/chrome/test_tmpl_whereendswithignorecase.xul
index ee0b76dded22..bc28850532b3 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereendswithignorecase.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereendswithignorecase.xul
@@ -38,7 +38,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereendswithnegation.xul b/content/xul/templates/tests/chrome/test_tmpl_whereendswithnegation.xul
index 603ec79dcd12..2a940cb980a6 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereendswithnegation.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereendswithnegation.xul
@@ -43,7 +43,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereequals.xul b/content/xul/templates/tests/chrome/test_tmpl_whereequals.xul
index 6466ff392861..de3526c4b789 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereequals.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereequals.xul
@@ -89,7 +89,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereequalsignorecase.xul b/content/xul/templates/tests/chrome/test_tmpl_whereequalsignorecase.xul
index 57cdc88d52bc..e6db31e1579c 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereequalsignorecase.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereequalsignorecase.xul
@@ -35,7 +35,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereequalsmultiple.xul b/content/xul/templates/tests/chrome/test_tmpl_whereequalsmultiple.xul
index 36de36dd6a0c..eb77d0e02b5f 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereequalsmultiple.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereequalsmultiple.xul
@@ -38,7 +38,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereequalsmultiplenegation.xul b/content/xul/templates/tests/chrome/test_tmpl_whereequalsmultiplenegation.xul
index 936cd49d0988..6bdda1f4d570 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereequalsmultiplenegation.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereequalsmultiplenegation.xul
@@ -105,7 +105,7 @@ var changes = [
 </script>
 
 <vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" flags="logging"
-      datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+      datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereequalsmultiplenegationignorecase.xul b/content/xul/templates/tests/chrome/test_tmpl_whereequalsmultiplenegationignorecase.xul
index 0fd70b698bec..41e8b908ad1b 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereequalsmultiplenegationignorecase.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereequalsmultiplenegationignorecase.xul
@@ -40,7 +40,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereequalsnegation.xul b/content/xul/templates/tests/chrome/test_tmpl_whereequalsnegation.xul
index c9939c88a2f4..62adb4feee1e 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereequalsnegation.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereequalsnegation.xul
@@ -43,7 +43,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereequalsnegationignorecase.xul b/content/xul/templates/tests/chrome/test_tmpl_whereequalsnegationignorecase.xul
index 288142f4792a..67d9956940d5 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereequalsnegationignorecase.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereequalsnegationignorecase.xul
@@ -43,7 +43,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereequalsnegationwrongcase.xul b/content/xul/templates/tests/chrome/test_tmpl_whereequalsnegationwrongcase.xul
index bfe0b63a9183..934b60c43c0d 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereequalsnegationwrongcase.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereequalsnegationwrongcase.xul
@@ -44,7 +44,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereequalsnumber.xul b/content/xul/templates/tests/chrome/test_tmpl_whereequalsnumber.xul
index dec01b348b11..b22d6d2377d6 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereequalsnumber.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereequalsnumber.xul
@@ -38,7 +38,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereequalsothervariable.xul b/content/xul/templates/tests/chrome/test_tmpl_whereequalsothervariable.xul
index 631b906561e8..4b2b4c526c5f 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereequalsothervariable.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereequalsothervariable.xul
@@ -44,7 +44,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereequalsresource.xul b/content/xul/templates/tests/chrome/test_tmpl_whereequalsresource.xul
index cf6e3ed7f28c..04be79343afd 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereequalsresource.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereequalsresource.xul
@@ -37,7 +37,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereequalssamevariable.xul b/content/xul/templates/tests/chrome/test_tmpl_whereequalssamevariable.xul
index 1a4aca4a83e8..8fe575125ee4 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereequalssamevariable.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereequalssamevariable.xul
@@ -44,7 +44,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereequalswrongcase.xul b/content/xul/templates/tests/chrome/test_tmpl_whereequalswrongcase.xul
index 6a6f1e246682..7cc0c1b3d8e4 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereequalswrongcase.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereequalswrongcase.xul
@@ -35,7 +35,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wheregreater.xul b/content/xul/templates/tests/chrome/test_tmpl_wheregreater.xul
index 07b025349050..0757a81725c3 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wheregreater.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wheregreater.xul
@@ -40,7 +40,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wheregreaternegation.xul b/content/xul/templates/tests/chrome/test_tmpl_wheregreaternegation.xul
index 570d1dd13084..2b446b1a4243 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wheregreaternegation.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wheregreaternegation.xul
@@ -40,7 +40,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wheregreaternegationstring.xul b/content/xul/templates/tests/chrome/test_tmpl_wheregreaternegationstring.xul
index d8d1fc9e7782..360044a6eca3 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wheregreaternegationstring.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wheregreaternegationstring.xul
@@ -40,7 +40,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wheregreaterstring.xul b/content/xul/templates/tests/chrome/test_tmpl_wheregreaterstring.xul
index 8fe983adc2c0..15eaf2331313 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wheregreaterstring.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wheregreaterstring.xul
@@ -93,7 +93,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_whereless.xul b/content/xul/templates/tests/chrome/test_tmpl_whereless.xul
index 4bd4031312a7..18104f82f518 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_whereless.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_whereless.xul
@@ -42,7 +42,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherelessnegation.xul b/content/xul/templates/tests/chrome/test_tmpl_wherelessnegation.xul
index 0fba0f146e87..8e013ed75f1e 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherelessnegation.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherelessnegation.xul
@@ -41,7 +41,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherelessnegationstring.xul b/content/xul/templates/tests/chrome/test_tmpl_wherelessnegationstring.xul
index 4d66bbef47b4..0a6b5271e171 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherelessnegationstring.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherelessnegationstring.xul
@@ -41,7 +41,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherelessstring.xul b/content/xul/templates/tests/chrome/test_tmpl_wherelessstring.xul
index 835347ffbec2..4c72e3a24c4b 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherelessstring.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherelessstring.xul
@@ -42,7 +42,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherenorel.xul b/content/xul/templates/tests/chrome/test_tmpl_wherenorel.xul
index f514e12fb614..fa0b93fd5a32 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherenorel.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherenorel.xul
@@ -22,9 +22,10 @@
 <![CDATA[
 SimpleTest.waitForExplicitFinish();
 
-Components.classes["@mozilla.org/consoleservice;1"].
-           getService(Components.interfaces.nsIConsoleService).reset();
-expectedConsoleMessages.push("Error parsing template: <where> element is missing a rel attribute");
+expectLoggedMessages = function()
+{
+  expectedConsoleMessages.push("Error parsing template: <where> element is missing a rel attribute");
+}
 
 var testid ="where - no rel";
 var queryType = "rdf";
@@ -48,7 +49,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherenosubject.xul b/content/xul/templates/tests/chrome/test_tmpl_wherenosubject.xul
index 87aff5303425..bb78e2c2cf72 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherenosubject.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherenosubject.xul
@@ -22,9 +22,10 @@
 <![CDATA[
 SimpleTest.waitForExplicitFinish();
 
-Components.classes["@mozilla.org/consoleservice;1"].
-           getService(Components.interfaces.nsIConsoleService).reset();
-expectedConsoleMessages.push("Error parsing template: <where> element is missing a subject attribute");
+expectLoggedMessages = function()
+{
+  expectedConsoleMessages.push("Error parsing template: <where> element is missing a subject attribute");
+}
 
 var testid ="where - no subject";
 var queryType = "rdf";
@@ -48,7 +49,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherenovalue.xul b/content/xul/templates/tests/chrome/test_tmpl_wherenovalue.xul
index 483148722989..03d416b59067 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherenovalue.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherenovalue.xul
@@ -22,9 +22,10 @@
 <![CDATA[
 SimpleTest.waitForExplicitFinish();
 
-Components.classes["@mozilla.org/consoleservice;1"].
-           getService(Components.interfaces.nsIConsoleService).reset();
-expectedConsoleMessages.push("Error parsing template: <where> element is missing a value attribute");
+expectLoggedMessages = function()
+{
+  expectedConsoleMessages.push("Error parsing template: <where> element is missing a value attribute");
+}
 
 var testid ="where - no value";
 var queryType = "rdf";
@@ -48,7 +49,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherestartswith.xul b/content/xul/templates/tests/chrome/test_tmpl_wherestartswith.xul
index a137a890216c..4f59ebd7095b 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherestartswith.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherestartswith.xul
@@ -86,7 +86,7 @@ var changes = [
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherestartswithignorecase.xul b/content/xul/templates/tests/chrome/test_tmpl_wherestartswithignorecase.xul
index 79a00b3f9165..fd79ab60e24d 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherestartswithignorecase.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherestartswithignorecase.xul
@@ -38,7 +38,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherestartswithmultiple.xul b/content/xul/templates/tests/chrome/test_tmpl_wherestartswithmultiple.xul
index a7d061efb212..8ef2513baa9e 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherestartswithmultiple.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherestartswithmultiple.xul
@@ -39,7 +39,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherestartswithnegation.xul b/content/xul/templates/tests/chrome/test_tmpl_wherestartswithnegation.xul
index 0735f903d3ab..d5c21f76de5f 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherestartswithnegation.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherestartswithnegation.xul
@@ -42,7 +42,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherestartswithunknownvariable.xul b/content/xul/templates/tests/chrome/test_tmpl_wherestartswithunknownvariable.xul
index 8cefef22d1c7..eec3e1e81935 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherestartswithunknownvariable.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherestartswithunknownvariable.xul
@@ -35,7 +35,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wherestartswithvariable.xul b/content/xul/templates/tests/chrome/test_tmpl_wherestartswithvariable.xul
index 833f95389be7..b9903b945ca3 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wherestartswithvariable.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wherestartswithvariable.xul
@@ -44,7 +44,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wheresubjectequalsvariable.xul b/content/xul/templates/tests/chrome/test_tmpl_wheresubjectequalsvariable.xul
index 86d789d3f842..f880962f300a 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wheresubjectequalsvariable.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wheresubjectequalsvariable.xul
@@ -35,7 +35,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/content/xul/templates/tests/chrome/test_tmpl_wheresubjectstartswithvariable.xul b/content/xul/templates/tests/chrome/test_tmpl_wheresubjectstartswithvariable.xul
index c6b5ef93914d..8f1b6486e2a5 100644
--- a/content/xul/templates/tests/chrome/test_tmpl_wheresubjectstartswithvariable.xul
+++ b/content/xul/templates/tests/chrome/test_tmpl_wheresubjectstartswithvariable.xul
@@ -35,7 +35,7 @@ var changes = [];
 ]]>
 </script>
 
-<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="animals.rdf" ref="http://www.some-fictitious-zoo.com/mammals">
+<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="root" datasources="rdf:null" ref="http://www.some-fictitious-zoo.com/mammals">
 <template id="template">
 <query id="query">
 <content uri="?uri"/>
diff --git a/docshell/base/nsDefaultURIFixup.cpp b/docshell/base/nsDefaultURIFixup.cpp
index 5e56cd40ad90..508c29aad6b8 100644
--- a/docshell/base/nsDefaultURIFixup.cpp
+++ b/docshell/base/nsDefaultURIFixup.cpp
@@ -354,29 +354,19 @@ nsDefaultURIFixup::CreateFixupURI(const nsACString& aStringURI, PRUint32 aFixupF
     return rv;
 }
 
-static nsresult MangleKeywordIntoURI(const char *aKeyword, const char *aURL,
-                                     nsCString& query)
-{
-    query = (*aKeyword == '?') ? (aKeyword + 1) : aKeyword;
-    query.Trim(" "); // pull leading/trailing spaces.
-
-    // encode
-    char * encQuery = nsEscape(query.get(), url_XPAlphas);
-    if (!encQuery) return NS_ERROR_OUT_OF_MEMORY;
-    query.Adopt(encQuery);
-
-    // prepend the query with the keyword url
-    // XXX this url should come from somewhere else
-    query.Insert(aURL, 0);
-    return NS_OK;
-}
-
 NS_IMETHODIMP nsDefaultURIFixup::KeywordToURI(const nsACString& aKeyword,
                                               nsIURI **aURI)
 {
     *aURI = nsnull;
     NS_ENSURE_STATE(mPrefBranch);
 
+    // Strip leading "?" and leading/trailing spaces from aKeyword
+    nsCAutoString keyword(aKeyword);
+    if (StringBeginsWith(keyword, NS_LITERAL_CSTRING("?"))) {
+        keyword.Cut(0, 1);
+    }
+    keyword.Trim(" ");
+
     nsXPIDLCString url;
     nsCOMPtr<nsIPrefLocalizedString> keywordURL;
     mPrefBranch->GetComplexValue("keyword.URL", 
@@ -394,10 +384,13 @@ NS_IMETHODIMP nsDefaultURIFixup::KeywordToURI(const nsACString& aKeyword,
 
     // If the pref is set and non-empty, use it.
     if (!url.IsEmpty()) {
+        // Escape keyword, then prepend URL
         nsCAutoString spec;
-        nsresult rv = MangleKeywordIntoURI(PromiseFlatCString(aKeyword).get(),
-                                           url.get(), spec);
-        if (NS_FAILED(rv)) return rv;
+        if (!NS_Escape(keyword, spec, url_XPAlphas)) {
+            return NS_ERROR_OUT_OF_MEMORY;
+        }
+
+        spec.Insert(url, 0);
 
         return NS_NewURI(aURI, spec);
     }
@@ -415,13 +408,13 @@ NS_IMETHODIMP nsDefaultURIFixup::KeywordToURI(const nsACString& aKeyword,
             // do this by first looking for a magic
             // "application/x-moz-keywordsearch" submission type. In the future,
             // we should instead use a solution that relies on bug 587780.
-            defaultEngine->GetSubmission(NS_ConvertUTF8toUTF16(aKeyword),
+            defaultEngine->GetSubmission(NS_ConvertUTF8toUTF16(keyword),
                                          NS_LITERAL_STRING("application/x-moz-keywordsearch"),
                                          getter_AddRefs(submission));
             // If getting the special x-moz-keywordsearch submission type failed,
             // fall back to the default response type.
             if (!submission) {
-                defaultEngine->GetSubmission(NS_ConvertUTF8toUTF16(aKeyword),
+                defaultEngine->GetSubmission(NS_ConvertUTF8toUTF16(keyword),
                                              EmptyString(),
                                              getter_AddRefs(submission));
             }
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 42ffaec92703..11855ee30f3a 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -755,6 +755,12 @@ nsDocShell::~nsDocShell()
 {
     Destroy();
 
+    nsCOMPtr<nsISHistoryInternal>
+        shPrivate(do_QueryInterface(mSessionHistory));
+    if (shPrivate) {
+        shPrivate->SetRootDocShell(nsnull);
+    }
+
     if (--gDocShellCount == 0) {
         NS_IF_RELEASE(sURIFixup);
     }
diff --git a/docshell/shistory/src/nsSHistory.cpp b/docshell/shistory/src/nsSHistory.cpp
index 11de1052b666..a1067262c54f 100644
--- a/docshell/shistory/src/nsSHistory.cpp
+++ b/docshell/shistory/src/nsSHistory.cpp
@@ -1209,7 +1209,9 @@ nsSHistory::RemoveDuplicate(PRInt32 aIndex, PRBool aKeepNext)
       // We're removing the very first session history transaction!
       mListRoot = txToKeep;
     }
-    static_cast<nsDocShell*>(mRootDocShell)->HistoryTransactionRemoved(aIndex);
+    if (mRootDocShell) {
+      static_cast<nsDocShell*>(mRootDocShell)->HistoryTransactionRemoved(aIndex);
+    }
     if (mIndex > aIndex) {
       mIndex = mIndex - 1;
     }
@@ -1589,6 +1591,8 @@ nsSHistory::CompareFrames(nsISHEntry * aPrevEntry, nsISHEntry * aNextEntry, nsID
 nsresult 
 nsSHistory::InitiateLoad(nsISHEntry * aFrameEntry, nsIDocShell * aFrameDS, long aLoadType)
 {
+  NS_ENSURE_STATE(aFrameDS && aFrameEntry);
+
   nsCOMPtr<nsIDocShellLoadInfo> loadInfo;
 
   /* Set the loadType in the SHEntry too to  what was passed on.
diff --git a/docshell/test/unit/test_nsIDownloadHistory.js b/docshell/test/unit/test_nsIDownloadHistory.js
index b578c012f0fa..b89e959fa874 100644
--- a/docshell/test/unit/test_nsIDownloadHistory.js
+++ b/docshell/test/unit/test_nsIDownloadHistory.js
@@ -37,6 +37,13 @@
 
 const NS_DOWNLOADHISTORY_CID = "{2ee83680-2af0-4bcb-bfa0-c9705f6554f1}";
 
+Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
+
+XPCOMUtils.defineLazyGetter(this, "Services", function() {
+  Components.utils.import("resource://gre/modules/Services.jsm");
+  return Services;
+});
+
 function testLinkVistedObserver()
 {
   const NS_LINK_VISITED_EVENT_TOPIC = "link-visited";
@@ -84,6 +91,8 @@ function run_test()
     return;
   }
 
+  Services.prefs.setBoolPref("places.history.enabled", true);
+
   for (var i = 0; i < tests.length; i++)
     tests[i]();
 
diff --git a/dom/base/ConsoleAPI.js b/dom/base/ConsoleAPI.js
index 026ebb165c6c..9ee8fa86db0f 100644
--- a/dom/base/ConsoleAPI.js
+++ b/dom/base/ConsoleAPI.js
@@ -48,50 +48,46 @@ ConsoleAPI.prototype = {
 
   QueryInterface: XPCOMUtils.generateQI([Ci.nsIDOMGlobalPropertyInitializer]),
 
-  // The ID of our attached window
-  id: null,
-
   // nsIDOMGlobalPropertyInitializer
-  // Associates us with the window we're attached to.
   init: function CA_init(aWindow) {
+    let id;
     try {
-      this.id = aWindow.QueryInterface(Ci.nsIInterfaceRequestor)
-                       .getInterface(Ci.nsIDOMWindowUtils)
-                       .outerWindowID;
+      id = aWindow.QueryInterface(Ci.nsIInterfaceRequestor)
+                  .getInterface(Ci.nsIDOMWindowUtils)
+                  .outerWindowID;
     } catch (ex) {
       Cu.reportError(ex);
     }
 
-    return this;
-  },
-
-  // window.console API
-  log: function CA_log() {
-    this.notifyObservers("log", arguments);
-  },
-  info: function CA_info() {
-    this.notifyObservers("info", arguments);
-  },
-  warn: function CA_warn() {
-    this.notifyObservers("warn", arguments);
-  },
-  error: function CA_error() {
-    this.notifyObservers("error", arguments);
-  },
-
-  __exposedProps__: {
-    log: "r",
-    info: "r",
-    warn: "r",
-    error: "r"
+    let self = this;
+    return {
+      // window.console API
+      log: function CA_log() {
+        self.notifyObservers(id, "log", arguments);
+      },
+      info: function CA_info() {
+        self.notifyObservers(id, "info", arguments);
+      },
+      warn: function CA_warn() {
+        self.notifyObservers(id, "warn", arguments);
+      },
+      error: function CA_error() {
+        self.notifyObservers(id, "error", arguments);
+      },
+      // TODO: remove this once bug 612405 is fixed
+      classID: self.classID
+    };
   },
 
   /**
    * Notify all observers of any console API call
    **/
-  notifyObservers: function CA_notifyObservers(aLevel, aArguments) {
+  notifyObservers: function CA_notifyObservers(aID, aLevel, aArguments) {
+    if (!aID)
+      return;
+
     let consoleEvent = {
-      ID: this.id,
+      ID: aID,
       level: aLevel,
       arguments: aArguments
     };
@@ -99,7 +95,7 @@ ConsoleAPI.prototype = {
     consoleEvent.wrappedJSObject = consoleEvent;
 
     Services.obs.notifyObservers(consoleEvent,
-                                 "console-api-log-event", this.id);
+                                 "console-api-log-event", aID);
   }
 };
 
diff --git a/dom/base/ConsoleAPI.manifest b/dom/base/ConsoleAPI.manifest
index 9fcc9d5538c4..c48de4658fa5 100644
--- a/dom/base/ConsoleAPI.manifest
+++ b/dom/base/ConsoleAPI.manifest
@@ -1,4 +1,3 @@
 component {b49c18f8-3379-4fc0-8c90-d7772c1a9ff3} ConsoleAPI.js
 contract @mozilla.org/console-api;1 {b49c18f8-3379-4fc0-8c90-d7772c1a9ff3}
-# disabled for now
-# category JavaScript-global-property console @mozilla.org/console-api;1
+category JavaScript-global-property console @mozilla.org/console-api;1
diff --git a/dom/base/crashtests/612018-1.html b/dom/base/crashtests/612018-1.html
new file mode 100644
index 000000000000..7f81422a7158
--- /dev/null
+++ b/dom/base/crashtests/612018-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+  var input = document.createElement("input");
+  document.body.appendChild(input);
+  input.focus();
+  document.body.appendChild(input);
+  input.focus();
+
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 0);"></body>
+</html>
diff --git a/dom/base/crashtests/crashtests.list b/dom/base/crashtests/crashtests.list
index cfaac4fe4fc8..0a113ca4eb60 100644
--- a/dom/base/crashtests/crashtests.list
+++ b/dom/base/crashtests/crashtests.list
@@ -24,3 +24,4 @@ load 502617.html
 asserts(1) load 504224.html # bug 564098
 load 603531.html
 load 601247.html
+load 612018-1.html
diff --git a/dom/base/nsDOMClassInfo.cpp b/dom/base/nsDOMClassInfo.cpp
index c534ba45ddd7..79cdbfc9144d 100644
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -446,7 +446,7 @@
 #endif // MOZ_SVG
 
 #include "nsIDOMCanvasRenderingContext2D.h"
-#include "nsICanvasRenderingContextWebGL.h"
+#include "nsIDOMWebGLRenderingContext.h"
 
 #include "nsIImageDocument.h"
 
@@ -2718,6 +2718,7 @@ nsDOMClassInfo::Init()
 
   DOM_CLASSINFO_MAP_BEGIN(HTMLSelectElement, nsIDOMHTMLSelectElement)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMHTMLSelectElement)
+    DOM_CLASSINFO_MAP_ENTRY(nsIDOMHTMLSelectElement_Mozilla_2_0_Branch)
     DOM_CLASSINFO_GENERIC_HTML_MAP_ENTRIES
   DOM_CLASSINFO_MAP_END
 
@@ -3959,8 +3960,8 @@ nsDOMClassInfo::Init()
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMEventTarget)
   DOM_CLASSINFO_MAP_END
 
-  DOM_CLASSINFO_MAP_BEGIN(CanvasRenderingContextWebGL, nsICanvasRenderingContextWebGL)
-    DOM_CLASSINFO_MAP_ENTRY(nsICanvasRenderingContextWebGL)
+  DOM_CLASSINFO_MAP_BEGIN(CanvasRenderingContextWebGL, nsIDOMWebGLRenderingContext)
+    DOM_CLASSINFO_MAP_ENTRY(nsIDOMWebGLRenderingContext)
   DOM_CLASSINFO_MAP_END
 
   DOM_CLASSINFO_MAP_BEGIN(WebGLBuffer, nsIWebGLBuffer)
diff --git a/dom/base/nsDOMClassInfo.h b/dom/base/nsDOMClassInfo.h
index c6ec031348cb..77b16b75af33 100644
--- a/dom/base/nsDOMClassInfo.h
+++ b/dom/base/nsDOMClassInfo.h
@@ -48,6 +48,7 @@
 #include "nsDOMJSUtils.h" // for GetScriptContextFromJSContext
 #include "nsIScriptGlobalObject.h"
 #include "nsContentUtils.h"
+#include "xpcpublic.h"
 
 class nsIDOMWindow;
 class nsIDOMNSHTMLOptionCollection;
@@ -140,8 +141,8 @@ public:
                              // while there's a ref to it
                              nsIXPConnectJSObjectHolder** aHolder = nsnull)
   {
-    return nsContentUtils::WrapNative(cx, scope, native, aIID, vp, aHolder,
-                                      aAllowWrapping);
+    return WrapNative(cx, scope, native, nsnull, aIID, vp, aHolder,
+                      aAllowWrapping);
   }
 
   // Used for cases where PreCreate needs to wrap the native parent, and the
@@ -161,8 +162,8 @@ public:
                              // while there's a ref to it
                              nsIXPConnectJSObjectHolder** aHolder = nsnull)
   {
-    return nsContentUtils::WrapNative(cx, scope, native, vp, aHolder,
-                                      aAllowWrapping);
+    return WrapNative(cx, scope, native, nsnull, nsnull, vp, aHolder,
+                      aAllowWrapping);
   }
   static nsresult WrapNative(JSContext *cx, JSObject *scope,
                              nsISupports *native, nsWrapperCache *cache,
@@ -171,8 +172,8 @@ public:
                              // while there's a ref to it
                              nsIXPConnectJSObjectHolder** aHolder = nsnull)
   {
-    return nsContentUtils::WrapNative(cx, scope, native, cache, vp, aHolder,
-                                      aAllowWrapping);
+    return WrapNative(cx, scope, native, cache, nsnull, vp, aHolder,
+                      aAllowWrapping);
   }
 
   static nsresult ThrowJSException(JSContext *cx, nsresult aResult);
@@ -247,6 +248,29 @@ protected:
             id == sName_id);
   }
 
+  static nsresult WrapNative(JSContext *cx, JSObject *scope,
+                             nsISupports *native, nsWrapperCache *cache,
+                             const nsIID* aIID, jsval *vp,
+                             nsIXPConnectJSObjectHolder** aHolder,
+                             PRBool aAllowWrapping)
+  {
+    if (!native) {
+      NS_ASSERTION(!aHolder || !*aHolder, "*aHolder should be null!");
+
+      *vp = JSVAL_NULL;
+
+      return NS_OK;
+    }
+
+    JSObject *wrapper = xpc_GetCachedSlimWrapper(cache, scope, vp);
+    if (wrapper) {
+      return NS_OK;
+    }
+
+    return sXPConnect->WrapNativeToJSVal(cx, scope, native, cache, aIID,
+                                         aAllowWrapping, vp, aHolder);
+  }
+
   static nsIXPConnect *sXPConnect;
   static nsIScriptSecurityManager *sSecMan;
 
diff --git a/dom/base/nsFocusManager.cpp b/dom/base/nsFocusManager.cpp
index f87ab1b6ff9d..5f9cf1af6a6c 100644
--- a/dom/base/nsFocusManager.cpp
+++ b/dom/base/nsFocusManager.cpp
@@ -1357,8 +1357,7 @@ nsFocusManager::CheckIfFocusable(nsIContent* aContent, PRUint32 aFlags)
     return nsnull;
 
   // Make sure that our frames are up to date
-  if (doc)
-    doc->FlushPendingNotifications(Flush_Frames);
+  doc->FlushPendingNotifications(Flush_Layout);
 
   nsIPresShell *shell = doc->GetShell();
   if (!shell)
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 9e63c5bf1909..5224c812aedb 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -4481,8 +4481,6 @@ nsGlobalWindow::Alert(const nsAString& aString)
     do_GetService("@mozilla.org/embedcomp/prompt-service;1", &rv);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  EnterModalState();
-
   if (shouldEnableDisableDialog) {
     PRBool disallowDialog = PR_FALSE;
     nsXPIDLString label;
@@ -4497,8 +4495,6 @@ nsGlobalWindow::Alert(const nsAString& aString)
     rv = promptSvc->Alert(this, title.get(), final.get());
   }
 
-  LeaveModalState();
-
   return rv;
 }
 
@@ -4538,8 +4534,6 @@ nsGlobalWindow::Confirm(const nsAString& aString, PRBool* aReturn)
     do_GetService("@mozilla.org/embedcomp/prompt-service;1", &rv);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  EnterModalState();
-
   if (shouldEnableDisableDialog) {
     PRBool disallowDialog = PR_FALSE;
     nsXPIDLString label;
@@ -4554,8 +4548,6 @@ nsGlobalWindow::Confirm(const nsAString& aString, PRBool* aReturn)
     rv = promptSvc->Confirm(this, title.get(), final.get(), aReturn);
   }
 
-  LeaveModalState();
-
   return rv;
 }
 
@@ -4605,14 +4597,10 @@ nsGlobalWindow::Prompt(const nsAString& aMessage, const nsAString& aInitial,
                                        "ScriptDialogLabel", label);
   }
 
-  EnterModalState();
-
   PRBool ok;
   rv = promptSvc->Prompt(this, title.get(), fixedMessage.get(),
                          &inoutValue, label.get(), &disallowDialog, &ok);
 
-  LeaveModalState();
-
   if (disallowDialog) {
     PreventFurtherDialogs();
   }
diff --git a/dom/base/nsJSEnvironment.cpp b/dom/base/nsJSEnvironment.cpp
index 4923ca48b08b..36361be06c8d 100644
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -2115,7 +2115,7 @@ nsJSContext::CallEventHandler(nsISupports* aTarget, void *aScope, void *aHandler
 #ifdef NS_FUNCTION_TIMER
   {
     JSObject *obj = static_cast<JSObject *>(aHandler);
-    JSString *id = JS_GetFunctionId(static_cast<JSFunction *>(JS_GetPrivate(mContext, obj));
+    JSString *id = JS_GetFunctionId(static_cast<JSFunction *>(JS_GetPrivate(mContext, obj)));
     JSAutoByteString bytes;
     const char *name = !id ? "anonymous" : bytes.encode(mContext, id) ? bytes.ptr() : "<error>";
     NS_TIME_FUNCTION_FMT(1.0, "%s (line %d) (function: %s)", MOZ_FUNCTION_NAME, __LINE__, name);
@@ -4183,7 +4183,7 @@ nsJSRuntime::GetNameSpaceManager()
 
   if (!gNameSpaceManager) {
     gNameSpaceManager = new nsScriptNameSpaceManager;
-    NS_ENSURE_TRUE(gNameSpaceManager, nsnull);
+    NS_ADDREF(gNameSpaceManager);
 
     nsresult rv = gNameSpaceManager->Init();
     NS_ENSURE_SUCCESS(rv, nsnull);
@@ -4207,8 +4207,7 @@ nsJSRuntime::Shutdown()
     sLoadInProgressGCTimer = PR_FALSE;
   }
 
-  delete gNameSpaceManager;
-  gNameSpaceManager = nsnull;
+  NS_IF_RELEASE(gNameSpaceManager);
 
   if (!sContextCount) {
     // We're being shutdown, and there are no more contexts
diff --git a/dom/base/nsScriptNameSpaceManager.cpp b/dom/base/nsScriptNameSpaceManager.cpp
index eca0f85869c1..97c1937e219f 100644
--- a/dom/base/nsScriptNameSpaceManager.cpp
+++ b/dom/base/nsScriptNameSpaceManager.cpp
@@ -54,6 +54,7 @@
 #include "nsHashKeys.h"
 #include "nsDOMClassInfo.h"
 #include "nsCRT.h"
+#include "nsIObserverService.h"
 
 #define NS_INTERFACE_PREFIX "nsI"
 #define NS_DOM_INTERFACE_PREFIX "nsIDOM"
@@ -132,6 +133,10 @@ GlobalNameHashInitEntry(PLDHashTable *table, PLDHashEntryHdr *entry,
   return PR_TRUE;
 }
 
+NS_IMPL_ISUPPORTS2(nsScriptNameSpaceManager,
+                   nsIObserver,
+                   nsISupportsWeakReference)
+
 nsScriptNameSpaceManager::nsScriptNameSpaceManager()
   : mIsInitialized(PR_FALSE)
 {
@@ -188,93 +193,18 @@ nsScriptNameSpaceManager::GetConstructorProto(const nsGlobalNameStruct* aStruct)
 
 nsresult
 nsScriptNameSpaceManager::FillHash(nsICategoryManager *aCategoryManager,
-                                   const char *aCategory,
-                                   nsGlobalNameStruct::nametype aType,
-                                   PRBool aChromeOnly)
+                                   const char *aCategory)
 {
-  nsCOMPtr<nsIComponentRegistrar> registrar;
-  nsresult rv = NS_GetComponentRegistrar(getter_AddRefs(registrar));
-  NS_ENSURE_SUCCESS(rv, rv);
-
   nsCOMPtr<nsISimpleEnumerator> e;
-  rv = aCategoryManager->EnumerateCategory(aCategory, getter_AddRefs(e));
+  nsresult rv = aCategoryManager->EnumerateCategory(aCategory,
+                                                    getter_AddRefs(e));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCAutoString categoryEntry;
-  nsXPIDLCString contractId;
   nsCOMPtr<nsISupports> entry;
-
   while (NS_SUCCEEDED(e->GetNext(getter_AddRefs(entry)))) {
-    nsCOMPtr<nsISupportsCString> category(do_QueryInterface(entry));
-
-    if (!category) {
-      NS_WARNING("Category entry not an nsISupportsCString!");
-
-      continue;
-    }
-
-    rv = category->GetData(categoryEntry);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    rv = aCategoryManager->GetCategoryEntry(aCategory, categoryEntry.get(),
-                                            getter_Copies(contractId));
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    nsCID *cidPtr;
-    rv = registrar->ContractIDToCID(contractId, &cidPtr);
-
+    rv = AddCategoryEntryToHash(aCategoryManager, aCategory, entry);
     if (NS_FAILED(rv)) {
-      NS_WARNING("Bad contract id registed with the script namespace manager");
-
-      continue;
-    }
-
-    // Copy CID onto the stack, so we can free it right away and avoid having
-    // to add cleanup code at every exit point from this loop/function.
-    nsCID cid = *cidPtr;
-    nsMemory::Free(cidPtr);
-
-    if (aType == nsGlobalNameStruct::eTypeExternalConstructor) {
-      nsXPIDLCString constructorProto;
-      rv = aCategoryManager->GetCategoryEntry(JAVASCRIPT_GLOBAL_CONSTRUCTOR_PROTO_ALIAS_CATEGORY,
-                                              categoryEntry.get(),
-                                              getter_Copies(constructorProto));
-      if (NS_SUCCEEDED(rv)) {
-        nsGlobalNameStruct *s = AddToHash(categoryEntry.get());
-        NS_ENSURE_TRUE(s, NS_ERROR_OUT_OF_MEMORY);
-
-        if (s->mType == nsGlobalNameStruct::eTypeNotInitialized) {
-          s->mAlias = new nsGlobalNameStruct::ConstructorAlias;
-          if (!s->mAlias) {
-            // Free entry
-            NS_ConvertASCIItoUTF16 key(categoryEntry);
-            PL_DHashTableOperate(&mGlobalNames,
-                                 &key,
-                                 PL_DHASH_REMOVE);
-            return NS_ERROR_OUT_OF_MEMORY;
-          }
-          s->mType = nsGlobalNameStruct::eTypeExternalConstructorAlias;
-          s->mChromeOnly = PR_FALSE;
-          s->mAlias->mCID = cid;
-          AppendASCIItoUTF16(constructorProto, s->mAlias->mProtoName);
-          s->mAlias->mProto = nsnull;
-        } else {
-          NS_WARNING("Global script name not overwritten!");
-        }
-
-        continue;
-      }
-    }
-
-    nsGlobalNameStruct *s = AddToHash(categoryEntry.get());
-    NS_ENSURE_TRUE(s, NS_ERROR_OUT_OF_MEMORY);
-
-    if (s->mType == nsGlobalNameStruct::eTypeNotInitialized) {
-      s->mType = aType;
-      s->mCID = cid;
-      s->mChromeOnly = aChromeOnly;
-    } else {
-      NS_WARNING("Global script name not overwritten!");
+      return rv;
     }
   }
 
@@ -487,26 +417,30 @@ nsScriptNameSpaceManager::Init()
     do_GetService(NS_CATEGORYMANAGER_CONTRACTID, &rv);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  rv = FillHash(cm, JAVASCRIPT_GLOBAL_CONSTRUCTOR_CATEGORY,
-                nsGlobalNameStruct::eTypeExternalConstructor, PR_FALSE);
+  rv = FillHash(cm, JAVASCRIPT_GLOBAL_CONSTRUCTOR_CATEGORY);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  rv = FillHash(cm, JAVASCRIPT_GLOBAL_PROPERTY_CATEGORY,
-                nsGlobalNameStruct::eTypeProperty, PR_FALSE);
+  rv = FillHash(cm, JAVASCRIPT_GLOBAL_PROPERTY_CATEGORY);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  rv = FillHash(cm, JAVASCRIPT_GLOBAL_PRIVILEGED_PROPERTY_CATEGORY,
-                nsGlobalNameStruct::eTypeProperty, PR_TRUE);
+  rv = FillHash(cm, JAVASCRIPT_GLOBAL_PRIVILEGED_PROPERTY_CATEGORY);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  rv = FillHash(cm, JAVASCRIPT_GLOBAL_STATIC_NAMESET_CATEGORY,
-                nsGlobalNameStruct::eTypeStaticNameSet, PR_FALSE);
+  rv = FillHash(cm, JAVASCRIPT_GLOBAL_STATIC_NAMESET_CATEGORY);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  rv = FillHash(cm, JAVASCRIPT_GLOBAL_DYNAMIC_NAMESET_CATEGORY,
-                nsGlobalNameStruct::eTypeDynamicNameSet, PR_FALSE);
+  rv = FillHash(cm, JAVASCRIPT_GLOBAL_DYNAMIC_NAMESET_CATEGORY);
   NS_ENSURE_SUCCESS(rv, rv);
 
+  // Initial filling of the has table has been done.
+  // Now, listen for changes.
+  nsCOMPtr<nsIObserverService> serv = 
+    do_GetService(NS_OBSERVERSERVICE_CONTRACTID);
+
+  if (serv) {
+    serv->AddObserver(this, NS_XPCOM_CATEGORY_ENTRY_ADDED_OBSERVER_ID, PR_TRUE);
+  }
+
   return NS_OK;
 }
 
@@ -704,3 +638,126 @@ nsScriptNameSpaceManager::RegisterDOMCIData(const char *aName,
 
   return NS_OK;
 }
+
+nsresult
+nsScriptNameSpaceManager::AddCategoryEntryToHash(nsICategoryManager* aCategoryManager,
+                                                 const char* aCategory,
+                                                 nsISupports* aEntry)
+{
+  nsCOMPtr<nsISupportsCString> strWrapper = do_QueryInterface(aEntry);
+
+  if (!strWrapper) {
+    NS_WARNING("Category entry not an nsISupportsCString!");
+    return NS_OK;
+  }
+
+  nsCAutoString categoryEntry;
+  nsresult rv = strWrapper->GetData(categoryEntry);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsXPIDLCString contractId;
+  rv = aCategoryManager->GetCategoryEntry(aCategory, categoryEntry.get(),
+                                          getter_Copies(contractId));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIComponentRegistrar> registrar;
+  rv = NS_GetComponentRegistrar(getter_AddRefs(registrar));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCID *cidPtr;
+  rv = registrar->ContractIDToCID(contractId, &cidPtr);
+
+  if (NS_FAILED(rv)) {
+    NS_WARNING("Bad contract id registed with the script namespace manager");
+    return NS_OK;
+  }
+
+  // Get the type from the category name.
+  // NOTE: we could have passed the type in FillHash() and guessed it in
+  // Observe() but this way, we have only one place to update and this is
+  // not performance sensitive.
+  nsGlobalNameStruct::nametype type;
+  if (strcmp(aCategory, JAVASCRIPT_GLOBAL_CONSTRUCTOR_CATEGORY) == 0) {
+    type = nsGlobalNameStruct::eTypeExternalConstructor;
+  } else if (strcmp(aCategory, JAVASCRIPT_GLOBAL_PROPERTY_CATEGORY) == 0 ||
+             strcmp(aCategory, JAVASCRIPT_GLOBAL_PRIVILEGED_PROPERTY_CATEGORY) == 0) {
+    type = nsGlobalNameStruct::eTypeProperty;
+  } else if (strcmp(aCategory, JAVASCRIPT_GLOBAL_STATIC_NAMESET_CATEGORY) == 0) {
+    type = nsGlobalNameStruct::eTypeStaticNameSet;
+  } else if (strcmp(aCategory, JAVASCRIPT_GLOBAL_DYNAMIC_NAMESET_CATEGORY) == 0) {
+    type = nsGlobalNameStruct::eTypeDynamicNameSet;
+  } else {
+    NS_WARNING("The category has no corresponding type!");
+    return NS_ERROR_UNEXPECTED;
+  }
+
+  // Copy CID onto the stack, so we can free it right away and avoid having
+  // to add cleanup code at every exit point from this function.
+  nsCID cid = *cidPtr;
+  nsMemory::Free(cidPtr);
+
+  if (type == nsGlobalNameStruct::eTypeExternalConstructor) {
+    nsXPIDLCString constructorProto;
+    rv = aCategoryManager->GetCategoryEntry(JAVASCRIPT_GLOBAL_CONSTRUCTOR_PROTO_ALIAS_CATEGORY,
+                                            categoryEntry.get(),
+                                            getter_Copies(constructorProto));
+    if (NS_SUCCEEDED(rv)) {
+      nsGlobalNameStruct *s = AddToHash(categoryEntry.get());
+      NS_ENSURE_TRUE(s, NS_ERROR_OUT_OF_MEMORY);
+
+      if (s->mType == nsGlobalNameStruct::eTypeNotInitialized) {
+        s->mAlias = new nsGlobalNameStruct::ConstructorAlias;
+        s->mType = nsGlobalNameStruct::eTypeExternalConstructorAlias;
+        s->mChromeOnly = PR_FALSE;
+        s->mAlias->mCID = cid;
+        AppendASCIItoUTF16(constructorProto, s->mAlias->mProtoName);
+        s->mAlias->mProto = nsnull;
+      } else {
+        NS_WARNING("Global script name not overwritten!");
+      }
+
+      return NS_OK;
+    }
+  }
+
+  nsGlobalNameStruct *s = AddToHash(categoryEntry.get());
+  NS_ENSURE_TRUE(s, NS_ERROR_OUT_OF_MEMORY);
+
+  if (s->mType == nsGlobalNameStruct::eTypeNotInitialized) {
+    s->mType = type;
+    s->mCID = cid;
+    s->mChromeOnly =
+      strcmp(aCategory, JAVASCRIPT_GLOBAL_PRIVILEGED_PROPERTY_CATEGORY) == 0;
+  } else {
+    NS_WARNING("Global script name not overwritten!");
+  }
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsScriptNameSpaceManager::Observe(nsISupports* aSubject, const char* aTopic,
+                                  const PRUnichar* aData)
+{
+  if (!aData) {
+    return NS_OK;
+  }
+
+  if (strcmp(aTopic, NS_XPCOM_CATEGORY_ENTRY_ADDED_OBSERVER_ID) == 0) {
+    nsCOMPtr<nsICategoryManager> cm =
+      do_GetService(NS_CATEGORYMANAGER_CONTRACTID);
+    if (!cm) {
+      return NS_OK;
+    }
+
+    return AddCategoryEntryToHash(cm, NS_ConvertUTF16toUTF8(aData).get(),
+                                  aSubject);
+  }
+
+  // TODO: we could observe NS_XPCOM_CATEGORY_ENTRY_REMOVED_OBSERVER_ID
+  // and NS_XPCOM_CATEGORY_CLEARED_OBSERVER_ID but we are safe without it.
+  // See bug 600460.
+
+  return NS_OK;
+}
+
diff --git a/dom/base/nsScriptNameSpaceManager.h b/dom/base/nsScriptNameSpaceManager.h
index df4754d18030..ae95394846ea 100644
--- a/dom/base/nsScriptNameSpaceManager.h
+++ b/dom/base/nsScriptNameSpaceManager.h
@@ -57,8 +57,10 @@
 #include "nsString.h"
 #include "nsID.h"
 #include "pldhash.h"
-
 #include "nsDOMClassInfo.h"
+#include "nsIObserver.h"
+#include "nsWeakReference.h"
+
 
 struct nsGlobalNameStruct
 {
@@ -104,9 +106,13 @@ class nsICategoryManager;
 class GlobalNameMapEntry;
 
 
-class nsScriptNameSpaceManager
+class nsScriptNameSpaceManager : public nsIObserver
+                               , public nsSupportsWeakReference
 {
 public:
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIOBSERVER
+
   nsScriptNameSpaceManager();
   virtual ~nsScriptNameSpaceManager();
 
@@ -157,14 +163,23 @@ protected:
                                 const PRUnichar **aClassName = nsnull);
 
   nsresult FillHash(nsICategoryManager *aCategoryManager,
-                    const char *aCategory,
-                    nsGlobalNameStruct::nametype aType,
-                    PRBool aPrivilegedOnly);
+                    const char *aCategory);
   nsresult FillHashWithDOMInterfaces();
   nsresult RegisterInterface(const char* aIfName,
                              const nsIID *aIfIID,
                              PRBool* aFoundOld);
 
+  /**
+   * Add a new category entry into the hash table.
+   *
+   * @aCategoryManager Instance of the category manager service.
+   * @aCategory        Category where the entry comes from.
+   * @aEntry           The entry that should be added.
+   */
+  nsresult AddCategoryEntryToHash(nsICategoryManager* aCategoryManager,
+                                  const char* aCategory,
+                                  nsISupports* aEntry);
+
   // Inline PLDHashTable, init with PL_DHashTableInit() and delete
   // with PL_DHashTableFinish().
   PLDHashTable mGlobalNames;
diff --git a/dom/indexedDB/IDBTransaction.cpp b/dom/indexedDB/IDBTransaction.cpp
index dc7c7cd36060..01e89f8d686e 100644
--- a/dom/indexedDB/IDBTransaction.cpp
+++ b/dom/indexedDB/IDBTransaction.cpp
@@ -62,8 +62,6 @@ USING_INDEXEDDB_NAMESPACE
 
 namespace {
 
-IDBTransaction::ThreadObserver* gThreadObserver = nsnull;
-
 PLDHashOperator
 DoomCachedStatements(const nsACString& aQuery,
                      nsCOMPtr<mozIStorageStatement>& aStatement,
@@ -106,9 +104,21 @@ IDBTransaction::Create(IDBDatabase* aDatabase,
   }
 
   if (!aDispatchDelayed) {
-    if (!ThreadObserver::BeginObserving(transaction)) {
-      return nsnull;
-    }
+    nsCOMPtr<nsIThreadInternal2> thread =
+      do_QueryInterface(NS_GetCurrentThread());
+    NS_ENSURE_TRUE(thread, nsnull);
+
+    // We need the current recursion depth first.
+    PRUint32 depth;
+    nsresult rv = thread->GetRecursionDepth(&depth);
+    NS_ENSURE_SUCCESS(rv, nsnull);
+
+    NS_ASSERTION(depth, "This should never be 0!");
+    transaction->mCreatedRecursionDepth = depth - 1;
+
+    rv = thread->AddObserver(transaction);
+    NS_ENSURE_SUCCESS(rv, nsnull);
+
     transaction->mCreating = true;
   }
 
@@ -120,6 +130,7 @@ IDBTransaction::IDBTransaction()
   mMode(nsIIDBTransaction::READ_ONLY),
   mTimeout(0),
   mPendingRequests(0),
+  mCreatedRecursionDepth(0),
   mSavepointCount(0),
   mAborted(false),
   mCreating(false)
@@ -633,6 +644,7 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(IDBTransaction)
   NS_INTERFACE_MAP_ENTRY(nsIIDBTransaction)
+  NS_INTERFACE_MAP_ENTRY(nsIThreadObserver)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(IDBTransaction)
 NS_INTERFACE_MAP_END_INHERITING(nsDOMEventTargetHelper)
 
@@ -819,229 +831,52 @@ IDBTransaction::PreHandleEvent(nsEventChainPreVisitor& aVisitor)
   return NS_OK;
 }
 
-IDBTransaction::
-ThreadObserver::ThreadObserver()
-: mBaseRecursionDepth(0),
-  mDone(false)
-{
-  NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
-  NS_ASSERTION(!gThreadObserver, "Multiple observers?!");
-}
-
-IDBTransaction::
-ThreadObserver::~ThreadObserver()
-{
-  NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
-  NS_ASSERTION(gThreadObserver == this, "Multiple observers?!");
-
-#ifdef DEBUG
-  for (PRUint32 i = 0; i < mTransactions.Length(); i++) {
-    NS_ASSERTION(mTransactions[i].transactions.IsEmpty(),
-                 "Unprocessed transactions!");
-  }
-#endif
-
-  // Clear the global.
-  gThreadObserver = nsnull;
-}
-
-void
-IDBTransaction::
-ThreadObserver::UpdateNewlyCreatedTransactions(PRUint32 aRecursionDepth)
-{
-  NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
-
-  for (PRUint32 i = 0; i < mTransactions.Length(); i++) {
-    TransactionInfo& info = mTransactions[i];
-
-    if (info.recursionDepth == aRecursionDepth) {
-      for (PRUint32 j = 0; j < info.transactions.Length(); j++) {
-        nsRefPtr<IDBTransaction>& transaction = info.transactions[j];
-
-        // Clear the mCreating flag now.
-        transaction->mCreating = false;
-
-        // And maybe set the readyState to DONE if there were no requests
-        // generated.
-        if (transaction->mReadyState == nsIIDBTransaction::INITIAL) {
-          transaction->mReadyState = nsIIDBTransaction::DONE;
-        }
-      }
-
-      // Don't hang on to transactions any longer than we have to.
-      info.transactions.Clear();
-
-      break;
-    }
-  }
-}
-
-// static
-bool
-IDBTransaction::
-ThreadObserver::BeginObserving(IDBTransaction* aTransaction)
-{
-  NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
-  NS_ASSERTION(aTransaction, "Null pointer!");
-
-  nsCOMPtr<nsIThreadInternal2> thread(do_QueryInterface(NS_GetCurrentThread()));
-  NS_ENSURE_TRUE(thread, false);
-
-  // We need the current recursion depth first.
-  PRUint32 depth;
-  nsresult rv = thread->GetRecursionDepth(&depth);
-  NS_ENSURE_SUCCESS(rv, false);
-
-  NS_ASSERTION(depth, "This should never be 0!");
-  depth--;
-
-  // If we've already got an observer created then simply append this
-  // transaction to its list.
-  if (gThreadObserver) {
-    for (PRUint32 i = 0; i < gThreadObserver->mTransactions.Length(); i++) {
-      TransactionInfo& info = gThreadObserver->mTransactions[i];
-      if (info.recursionDepth == depth) {
-        if (!info.transactions.AppendElement(aTransaction)) {
-          NS_WARNING("Out of memory!");
-          return false;
-        }
-        return true;
-      }
-    }
-
-    // No transactions at this depth yet, make a new entry
-    TransactionInfo* newInfo = gThreadObserver->mTransactions.AppendElement();
-    if (!newInfo || !newInfo->transactions.AppendElement(aTransaction)) {
-      NS_WARNING("Out of memory!");
-      return false;
-    }
-    newInfo->recursionDepth = depth;
-
-    return true;
-  }
-
-  // Make a new thread observer and install it.
-  nsRefPtr<ThreadObserver> observer(new ThreadObserver());
-
-  TransactionInfo* info = observer->mTransactions.AppendElement();
-  NS_ASSERTION(info, "This should never fail!");
-
-  info->recursionDepth = observer->mBaseRecursionDepth = depth;
-
-  if (!info->transactions.AppendElement(aTransaction)) {
-    NS_WARNING("Out of memory!");
-    return false;
-  }
-
-  // We need to keep the thread observer chain intact so grab the previous
-  // observer.
-  rv = thread->GetObserver(getter_AddRefs(observer->mPreviousObserver));
-  NS_ENSURE_SUCCESS(rv, false);
-
-  // Now set our new observer.
-  rv = thread->SetObserver(observer);
-  NS_ENSURE_SUCCESS(rv, false);
-
-  // And set the global so that we don't recreate it later.
-  gThreadObserver = observer;
-  return true;
-}
-
-NS_IMPL_THREADSAFE_ISUPPORTS1(IDBTransaction::ThreadObserver, nsIThreadObserver)
-
+// XXX Once nsIThreadObserver gets split this method will disappear.
 NS_IMETHODIMP
-IDBTransaction::
-ThreadObserver::OnDispatchedEvent(nsIThreadInternal* aThread)
+IDBTransaction::OnDispatchedEvent(nsIThreadInternal* aThread)
 {
-  // This may be called on any thread!
-
-  // Nothing special is needed here, just call the previous observer.
-  if (mPreviousObserver) {
-    return mPreviousObserver->OnDispatchedEvent(aThread);
-  }
-
-  return NS_OK;
+  NS_NOTREACHED("Don't call me!");
+  return NS_ERROR_NOT_IMPLEMENTED;
 }
 
 NS_IMETHODIMP
-IDBTransaction::
-ThreadObserver::OnProcessNextEvent(nsIThreadInternal* aThread,
+IDBTransaction::OnProcessNextEvent(nsIThreadInternal* aThread,
                                    PRBool aMayWait,
                                    PRUint32 aRecursionDepth)
 {
   NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
-  NS_ASSERTION(aThread, "This should never be null!");
-  NS_ASSERTION(!mKungFuDeathGrip, "Shouldn't have a self-ref here!");
-
-  // If we're at the base recursion depth here then we're ready to unset
-  // ourselves as the thread observer.
-  if (aRecursionDepth == mBaseRecursionDepth || mDone) {
-    // From here on we'll continue to try to unset ourselves.
-    mDone = true;
-
-    nsCOMPtr<nsIThreadObserver> currentObserver;
-    if (NS_FAILED(aThread->GetObserver(getter_AddRefs(currentObserver)))) {
-      NS_WARNING("Can't get current observer?!");
-    }
-
-    // We can only set the previous observer if this is the current observer.
-    // Otherwise someone else has installed themselves into the chain and we
-    // have to hang around until they unset themselves.
-    if (currentObserver == this) {
-      // Setting a different thread observer could delete us. Maintain a
-      // reference until AfterProcessNextEvent is called.
-      mKungFuDeathGrip = this;
-
-      // Set our previous observer back on the thread.
-      if (NS_FAILED(aThread->SetObserver(mPreviousObserver))) {
-        NS_ERROR("This should never fail!");
-      }
-    }
-  }
-
-  // Take care of any transactions that were created at this recursion depth.
-  UpdateNewlyCreatedTransactions(aRecursionDepth);
-
-  // And call the previous observer.
-  if (mPreviousObserver) {
-    return mPreviousObserver->OnProcessNextEvent(aThread, aMayWait,
-                                                 aRecursionDepth);
-  }
-
+  NS_ASSERTION(aRecursionDepth > mCreatedRecursionDepth,
+               "Should be impossible!");
+  NS_ASSERTION(mCreating, "Should be true!");
   return NS_OK;
 }
 
 NS_IMETHODIMP
-IDBTransaction::
-ThreadObserver::AfterProcessNextEvent(nsIThreadInternal* aThread,
+IDBTransaction::AfterProcessNextEvent(nsIThreadInternal* aThread,
                                       PRUint32 aRecursionDepth)
 {
   NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
   NS_ASSERTION(aThread, "This should never be null!");
+  NS_ASSERTION(aRecursionDepth >= mCreatedRecursionDepth,
+               "Should be impossible!");
+  NS_ASSERTION(mCreating, "Should be true!");
 
-  nsRefPtr<ThreadObserver> kungFuDeathGrip;
-  nsCOMPtr<nsIThreadObserver> observer;
+  if (aRecursionDepth == mCreatedRecursionDepth) {
+    // We're back at the event loop, no longer newborn.
+    mCreating = false;
 
-  if (mKungFuDeathGrip) {
-    NS_ASSERTION(mDone, "Huh?!");
+    // Maybe set the readyState to DONE if there were no requests generated.
+    if (mReadyState == nsIIDBTransaction::INITIAL) {
+      mReadyState = nsIIDBTransaction::DONE;
+    }
 
-    // We can drop the reference to this observer after this call.
-    kungFuDeathGrip.swap(mKungFuDeathGrip);
+    // No longer need to observe thread events.
+    nsCOMPtr<nsIThreadInternal2> thread = do_QueryInterface(aThread);
+    NS_ASSERTION(thread, "This must never fail!");
 
-    // And we don't need the previous observer after this call either.
-    observer.swap(mPreviousObserver);
-  }
-  else {
-    // Still call the previous observer.
-    observer = mPreviousObserver;
-  }
-
-  // We may have collected more transactions while the event was processed.
-  // Update them now.
-  UpdateNewlyCreatedTransactions(aRecursionDepth);
-
-  if (observer) {
-    return observer->AfterProcessNextEvent(aThread, aRecursionDepth);
+    if(NS_FAILED(thread->RemoveObserver(this))) {
+      NS_ERROR("Failed to remove observer!");
+    }
   }
 
   return NS_OK;
diff --git a/dom/indexedDB/IDBTransaction.h b/dom/indexedDB/IDBTransaction.h
index 7acfed85547e..76a758b884e4 100644
--- a/dom/indexedDB/IDBTransaction.h
+++ b/dom/indexedDB/IDBTransaction.h
@@ -66,7 +66,8 @@ struct ObjectStoreInfo;
 class TransactionThreadPool;
 
 class IDBTransaction : public nsDOMEventTargetHelper,
-                       public nsIIDBTransaction
+                       public nsIIDBTransaction,
+                       public nsIThreadObserver
 {
   friend class AsyncConnectionHelper;
   friend class CommitHelper;
@@ -76,6 +77,7 @@ class IDBTransaction : public nsDOMEventTargetHelper,
 public:
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSIIDBTRANSACTION
+  NS_DECL_NSITHREADOBSERVER
 
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(IDBTransaction,
                                            nsDOMEventTargetHelper)
@@ -159,35 +161,6 @@ public:
   GetOrCreateObjectStore(const nsAString& aName,
                          ObjectStoreInfo* aObjectStoreInfo);
 
-  class ThreadObserver : public nsIThreadObserver
-  {
-  public:
-    NS_DECL_ISUPPORTS
-    NS_DECL_NSITHREADOBSERVER
-
-    static bool BeginObserving(IDBTransaction* aTransaction);
-
-  private:
-    ThreadObserver();
-    ~ThreadObserver();
-
-    void UpdateNewlyCreatedTransactions(PRUint32 aRecursionDepth);
-
-    struct TransactionInfo
-    {
-      PRUint32 recursionDepth;
-      nsTArray<nsRefPtr<IDBTransaction> > transactions;
-    };
-
-    nsAutoTArray<TransactionInfo, 1> mTransactions;
-
-    nsCOMPtr<nsIThreadObserver> mPreviousObserver;
-    nsRefPtr<ThreadObserver> mKungFuDeathGrip;
-
-    PRUint32 mBaseRecursionDepth;
-    bool mDone;
-  };
-
 private:
   IDBTransaction();
   ~IDBTransaction();
@@ -200,6 +173,7 @@ private:
   PRUint16 mMode;
   PRUint32 mTimeout;
   PRUint32 mPendingRequests;
+  PRUint32 mCreatedRecursionDepth;
 
   // Only touched on the main thread.
   nsRefPtr<nsDOMEventListenerWrapper> mOnErrorListener;
diff --git a/dom/interfaces/canvas/Makefile.in b/dom/interfaces/canvas/Makefile.in
index 4d2dfa652377..7f90f0cbe204 100644
--- a/dom/interfaces/canvas/Makefile.in
+++ b/dom/interfaces/canvas/Makefile.in
@@ -48,7 +48,7 @@ GRE_MODULE	= 1
 
 XPIDLSRCS = \
 	nsIDOMCanvasRenderingContext2D.idl \
-	nsICanvasRenderingContextWebGL.idl \
+	nsIDOMWebGLRenderingContext.idl \
 	$(NULL)
 
 include $(topsrcdir)/config/rules.mk
diff --git a/dom/interfaces/canvas/nsICanvasRenderingContextWebGL.idl b/dom/interfaces/canvas/nsIDOMWebGLRenderingContext.idl
similarity index 99%
rename from dom/interfaces/canvas/nsICanvasRenderingContextWebGL.idl
rename to dom/interfaces/canvas/nsIDOMWebGLRenderingContext.idl
index 569db52299a3..ec9ce050cce4 100644
--- a/dom/interfaces/canvas/nsICanvasRenderingContextWebGL.idl
+++ b/dom/interfaces/canvas/nsIDOMWebGLRenderingContext.idl
@@ -41,6 +41,7 @@
 
 interface nsIDOMElement;
 interface nsIDOMHTMLCanvasElement;
+interface nsIPropertyBag;
 
 // XXX should we comment out these typedefs in the C++ header?
 
@@ -55,6 +56,9 @@ typedef float          WebGLfloat;
 typedef float          WebGLclampf;
 
 %{C++
+// for jsval
+#include "jsapi.h"
+
 namespace js {
 struct ArrayBuffer;
 struct TypedArray;
@@ -130,7 +134,7 @@ interface nsIWebGLUniformLocation : nsISupports
 
 
 [scriptable, uuid(2f21ca21-9720-4eee-ad94-27eefe4f72dc)]
-interface nsICanvasRenderingContextWebGL : nsISupports
+interface nsIDOMWebGLRenderingContext : nsISupports
 {
   //
   //  CONSTANTS
@@ -558,7 +562,7 @@ interface nsICanvasRenderingContextWebGL : nsISupports
   //
   //  METHODS
   //
-  void present();
+  jsval getContextAttributes();
 
   void activeTexture(in WebGLenum texture);
   void attachShader([optional] in nsIWebGLProgram program, [optional] in nsIWebGLShader shader);
diff --git a/dom/interfaces/html/nsIDOMHTMLAnchorElement.idl b/dom/interfaces/html/nsIDOMHTMLAnchorElement.idl
index 1bc45a231ae8..c35941107e45 100644
--- a/dom/interfaces/html/nsIDOMHTMLAnchorElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLAnchorElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLAnchorElement interface is the interface to a [X]HTML
  * a element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(4e237175-3628-4dc8-892f-5270edc3c71a)]
diff --git a/dom/interfaces/html/nsIDOMHTMLAppletElement.idl b/dom/interfaces/html/nsIDOMHTMLAppletElement.idl
index 50429609a371..685305eae816 100644
--- a/dom/interfaces/html/nsIDOMHTMLAppletElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLAppletElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLAppletElement interface is the interface to a [X]HTML
  * applet element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90ae-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLAreaElement.idl b/dom/interfaces/html/nsIDOMHTMLAreaElement.idl
index 3b1853c6c2b9..393f8655441a 100644
--- a/dom/interfaces/html/nsIDOMHTMLAreaElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLAreaElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLAreaElement interface is the interface to a [X]HTML
  * area element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(fca7d30d-c834-470d-9bb2-25eddfedd86b)]
diff --git a/dom/interfaces/html/nsIDOMHTMLBRElement.idl b/dom/interfaces/html/nsIDOMHTMLBRElement.idl
index 03f32e07a230..625b749e2410 100644
--- a/dom/interfaces/html/nsIDOMHTMLBRElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLBRElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLBRElement interface is the interface to a [X]HTML br
  * element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90a5-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLBaseElement.idl b/dom/interfaces/html/nsIDOMHTMLBaseElement.idl
index 0a473bddfd7e..559826ca747a 100644
--- a/dom/interfaces/html/nsIDOMHTMLBaseElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLBaseElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLBaseElement interface is the interface to a [X]HTML
  * base element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf908b-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLBodyElement.idl b/dom/interfaces/html/nsIDOMHTMLBodyElement.idl
index 2c0f9b5d5dc0..6547fdf17dc3 100644
--- a/dom/interfaces/html/nsIDOMHTMLBodyElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLBodyElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLBodyElement interface is the interface to a [X]HTML
  * body element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf908e-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLButtonElement.idl b/dom/interfaces/html/nsIDOMHTMLButtonElement.idl
index af7405a5563b..34faf2047c77 100644
--- a/dom/interfaces/html/nsIDOMHTMLButtonElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLButtonElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLButtonElement interface is the interface to a [X]HTML
  * button element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 interface nsIDOMValidityState;
@@ -73,7 +76,7 @@ interface nsIDOMHTMLButtonElement : nsIDOMHTMLElement
   void                      click();
 
   // The following lines are parte of the constraint validation API, see:
-  // http://dev.w3.org/html5/spec/forms.html#the-constraint-validation-api
+  // http://www.whatwg.org/specs/web-apps/current-work/#the-constraint-validation-api
   readonly attribute boolean             willValidate;
   readonly attribute nsIDOMValidityState validity;
   readonly attribute DOMString           validationMessage;
diff --git a/dom/interfaces/html/nsIDOMHTMLCanvasElement.idl b/dom/interfaces/html/nsIDOMHTMLCanvasElement.idl
index d189f7b292cb..ae00d848e996 100644
--- a/dom/interfaces/html/nsIDOMHTMLCanvasElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLCanvasElement.idl
@@ -37,6 +37,11 @@
 
 #include "nsIDOMHTMLElement.idl"
 
+%{C++
+// for jsval
+#include "jsapi.h"
+%}
+
 /**
  * The nsIDOMHTMLCanvasElement interface is the interface to a HTML
  * <canvas> element.
@@ -49,14 +54,15 @@
 
 interface nsIDOMFile;
 
-[scriptable, uuid(28945fd6-c4a0-44e3-8629-98358eab5d7b)]
+[scriptable, uuid(53ad994a-3cd0-48fa-8ffb-7f3d8cd19c50)]
 interface nsIDOMHTMLCanvasElement : nsIDOMHTMLElement
 {
   attribute long width;
   attribute long height;
   attribute boolean mozOpaque;
 
-  nsISupports getContext(in DOMString contextId);
+  nsISupports getContext(in DOMString contextId,
+                         [optional] in jsval contextOptions);
 
 
   // Valid calls are:
diff --git a/dom/interfaces/html/nsIDOMHTMLCollection.idl b/dom/interfaces/html/nsIDOMHTMLCollection.idl
index 18056fb9e478..9b5d67b8897a 100644
--- a/dom/interfaces/html/nsIDOMHTMLCollection.idl
+++ b/dom/interfaces/html/nsIDOMHTMLCollection.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLCollection interface is an interface to a collection
  * of [X]HTML elements.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf9083-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLDListElement.idl b/dom/interfaces/html/nsIDOMHTMLDListElement.idl
index d87e1616c3da..5767ac3a3c6c 100644
--- a/dom/interfaces/html/nsIDOMHTMLDListElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLDListElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLDListElement interface is the interface to a [X]HTML
  * dl element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf909b-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLDataListElement.idl b/dom/interfaces/html/nsIDOMHTMLDataListElement.idl
index e2c4509c2b9b..33895fd9adcd 100644
--- a/dom/interfaces/html/nsIDOMHTMLDataListElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLDataListElement.idl
@@ -42,7 +42,7 @@
  * <datalist> element.
  *
  * For more information on this interface, please see
- * http://dev.w3.org/html5/spec/forms.html#the-datalist-element
+ * http://www.whatwg.org/specs/web-apps/current-work/#the-datalist-element
  *
  * @status UNDER_DEVELOPMENT
  */
diff --git a/dom/interfaces/html/nsIDOMHTMLDirectoryElement.idl b/dom/interfaces/html/nsIDOMHTMLDirectoryElement.idl
index 5993c158d9fa..19312bff1b98 100644
--- a/dom/interfaces/html/nsIDOMHTMLDirectoryElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLDirectoryElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLDirectoryElement interface is the interface to a
  * [X]HTML dir element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf909c-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLDivElement.idl b/dom/interfaces/html/nsIDOMHTMLDivElement.idl
index 2581fa578ec7..f076d52ec4b8 100644
--- a/dom/interfaces/html/nsIDOMHTMLDivElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLDivElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLDivElement interface is the interface to a [X]HTML
  * div element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90a0-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLDocument.idl b/dom/interfaces/html/nsIDOMHTMLDocument.idl
index 104b0bf6b71d..06bf85b9414d 100644
--- a/dom/interfaces/html/nsIDOMHTMLDocument.idl
+++ b/dom/interfaces/html/nsIDOMHTMLDocument.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLDocument interface is the interface to a [X]HTML
  * document object.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf9084-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLElement.idl b/dom/interfaces/html/nsIDOMHTMLElement.idl
index 9b3d99174a62..ff2c0b24d266 100644
--- a/dom/interfaces/html/nsIDOMHTMLElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLElement.idl
@@ -44,8 +44,11 @@
  * interface. It represents a single [X]HTML element in the document
  * tree.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf9085-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLEmbedElement.idl b/dom/interfaces/html/nsIDOMHTMLEmbedElement.idl
index 8fa6f32efb53..f3de3799a80f 100644
--- a/dom/interfaces/html/nsIDOMHTMLEmbedElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLEmbedElement.idl
@@ -43,8 +43,8 @@
  * The nsIDOMHTMLEmbedElement interface is the interface to a [X]HTML
  * embed element.
  *
- * Note that this is not a W3C standard interface, it is Mozilla
- * proprietary.
+ * For more information on this interface, please see
+ * http://www.whatwg.org/specs/web-apps/current-work/#the-embed-element
  */
 
 [scriptable, uuid(123f90ab-15b3-11d2-456e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLFieldSetElement.idl b/dom/interfaces/html/nsIDOMHTMLFieldSetElement.idl
index a62ec13ca1a1..8465dc2913ad 100644
--- a/dom/interfaces/html/nsIDOMHTMLFieldSetElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLFieldSetElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLFieldSetElement interface is the interface to a
  * [X]HTML fieldset element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 interface nsIDOMValidityState;
@@ -61,7 +64,7 @@ interface nsIDOMHTMLFieldSetElement : nsIDOMHTMLElement
   readonly attribute nsIDOMHTMLCollection   elements;
 
   // The following lines are parte of the constraint validation API, see:
-  // http://dev.w3.org/html5/spec/forms.html#the-constraint-validation-api
+  // http://www.whatwg.org/specs/web-apps/current-work/#the-constraint-validation-api
   readonly attribute boolean               willValidate;
   readonly attribute nsIDOMValidityState   validity;
   readonly attribute DOMString             validationMessage;
diff --git a/dom/interfaces/html/nsIDOMHTMLFontElement.idl b/dom/interfaces/html/nsIDOMHTMLFontElement.idl
index 3c4787e2a3fb..0d6878a0b53d 100644
--- a/dom/interfaces/html/nsIDOMHTMLFontElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLFontElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLFontElement interface is the interface to a [X]HTML
  * font element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90a7-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLFormElement.idl b/dom/interfaces/html/nsIDOMHTMLFormElement.idl
index 7d78a2d0035f..7dad1dc73989 100644
--- a/dom/interfaces/html/nsIDOMHTMLFormElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLFormElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLFormElement interface is the interface to a [X]HTML
  * form element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(0884ce23-e069-499e-a13c-a91c8ae0fc98)]
diff --git a/dom/interfaces/html/nsIDOMHTMLFrameElement.idl b/dom/interfaces/html/nsIDOMHTMLFrameElement.idl
index d50233324a6e..3d86d92333f3 100644
--- a/dom/interfaces/html/nsIDOMHTMLFrameElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLFrameElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLFrameElement interface is the interface to a [X]HTML
  * frame element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90b9-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLFrameSetElement.idl b/dom/interfaces/html/nsIDOMHTMLFrameSetElement.idl
index 86ff98076fac..b15cfd5b83dd 100644
--- a/dom/interfaces/html/nsIDOMHTMLFrameSetElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLFrameSetElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLFrameSetElement interface is the interface to a
  * [X]HTML frameset element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90b8-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLHRElement.idl b/dom/interfaces/html/nsIDOMHTMLHRElement.idl
index 17e357a15e9e..46cade332e16 100644
--- a/dom/interfaces/html/nsIDOMHTMLHRElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLHRElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLHRElement interface is the interface to a [X]HTML hr
  * element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90a8-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLHeadElement.idl b/dom/interfaces/html/nsIDOMHTMLHeadElement.idl
index 592b3c5794c1..ab6b77b7476b 100644
--- a/dom/interfaces/html/nsIDOMHTMLHeadElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLHeadElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLHeadElement interface is the interface to a [X]HTML
  * head element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf9087-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLHeadingElement.idl b/dom/interfaces/html/nsIDOMHTMLHeadingElement.idl
index 04607d7657ee..0dca71ecf552 100644
--- a/dom/interfaces/html/nsIDOMHTMLHeadingElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLHeadingElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLHeadingElement interface is the interface to a
  * [X]HTML h1, h2, h3, ... element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90a2-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLHtmlElement.idl b/dom/interfaces/html/nsIDOMHTMLHtmlElement.idl
index eae25dfb3e39..394faef20764 100644
--- a/dom/interfaces/html/nsIDOMHTMLHtmlElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLHtmlElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLHtmlElement interface is the interface to a [X]HTML
  * html element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf9086-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLIFrameElement.idl b/dom/interfaces/html/nsIDOMHTMLIFrameElement.idl
index 6bf00e92723e..c46c676498eb 100644
--- a/dom/interfaces/html/nsIDOMHTMLIFrameElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLIFrameElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLIFrameElement interface is the interface to a [X]HTML
  * iframe element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90ba-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLImageElement.idl b/dom/interfaces/html/nsIDOMHTMLImageElement.idl
index b807c47eefa9..9a58810f911b 100644
--- a/dom/interfaces/html/nsIDOMHTMLImageElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLImageElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLImageElement interface is the interface to a [X]HTML
  * img element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(3fc9c313-49b9-4315-b39f-7166cf362e10)]
diff --git a/dom/interfaces/html/nsIDOMHTMLInputElement.idl b/dom/interfaces/html/nsIDOMHTMLInputElement.idl
index 3730fd7090af..dac8f4c2ce02 100644
--- a/dom/interfaces/html/nsIDOMHTMLInputElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLInputElement.idl
@@ -47,8 +47,11 @@ interface nsIDOMValidityState;
   * The nsIDOMHTMLInputElement interface is the interface to a [X]HTML
   * input element.
   *
-  * For more information on this interface please see
+  * This interface is trying to follow the DOM Level 2 HTML specification:
   * http://www.w3.org/TR/DOM-Level-2-HTML/
+  *
+  * with changes from the work-in-progress WHATWG HTML specification:
+  * http://www.whatwg.org/specs/web-apps/current-work/
   */
 
 [scriptable, uuid(0805059d-f18f-4095-ae6b-0bf6df80b7b8)]
@@ -95,7 +98,7 @@ interface nsIDOMHTMLInputElement : nsIDOMHTMLElement
            attribute DOMString             value;
 
   // The following lines are parte of the constraint validation API, see:
-  // http://dev.w3.org/html5/spec/forms.html#the-constraint-validation-api
+  // http://www.whatwg.org/specs/web-apps/current-work/#the-constraint-validation-api
   readonly attribute boolean             willValidate;
   readonly attribute nsIDOMValidityState validity;
   readonly attribute DOMString           validationMessage;
diff --git a/dom/interfaces/html/nsIDOMHTMLIsIndexElement.idl b/dom/interfaces/html/nsIDOMHTMLIsIndexElement.idl
index 63bc981ff1db..795204a21570 100644
--- a/dom/interfaces/html/nsIDOMHTMLIsIndexElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLIsIndexElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLIsIndexElement interface is the interface to a
  * [X]HTML isindex element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf908c-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLLIElement.idl b/dom/interfaces/html/nsIDOMHTMLLIElement.idl
index a32c7ed97fa0..c8479b2071a2 100644
--- a/dom/interfaces/html/nsIDOMHTMLLIElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLLIElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLLIElement interface is the interface to a [X]HTML li
  * element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf909e-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLLabelElement.idl b/dom/interfaces/html/nsIDOMHTMLLabelElement.idl
index 31d69cbadfc6..fde1539b27bb 100644
--- a/dom/interfaces/html/nsIDOMHTMLLabelElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLLabelElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLLabelElement interface is the interface to a [X]HTML
  * label element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(8a207452-e725-4a9e-beb6-9e0c0a65012c)]
diff --git a/dom/interfaces/html/nsIDOMHTMLLegendElement.idl b/dom/interfaces/html/nsIDOMHTMLLegendElement.idl
index 958f7b729bbf..bd38283cdee7 100644
--- a/dom/interfaces/html/nsIDOMHTMLLegendElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLLegendElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLLegendElement interface is the interface to a [X]HTML
  * legend element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf9098-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLLinkElement.idl b/dom/interfaces/html/nsIDOMHTMLLinkElement.idl
index f768b2027e2a..fb3a4fb2cbcb 100644
--- a/dom/interfaces/html/nsIDOMHTMLLinkElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLLinkElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLLinkElement interface is the interface to a [X]HTML
  * link element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf9088-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLMapElement.idl b/dom/interfaces/html/nsIDOMHTMLMapElement.idl
index 6bae5093b58e..ebac76ec8421 100644
--- a/dom/interfaces/html/nsIDOMHTMLMapElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLMapElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLMapElement interface is the interface to a [X]HTML
  * map element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90af-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLMenuElement.idl b/dom/interfaces/html/nsIDOMHTMLMenuElement.idl
index 272c3da9b292..e59503bfd72a 100644
--- a/dom/interfaces/html/nsIDOMHTMLMenuElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLMenuElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLMenuElement interface is the interface to a [X]HTML
  * menu element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf909d-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLMetaElement.idl b/dom/interfaces/html/nsIDOMHTMLMetaElement.idl
index 46a128151422..739598f764a3 100644
--- a/dom/interfaces/html/nsIDOMHTMLMetaElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLMetaElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLMetaElement interface is the interface to a [X]HTML
  * meta element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf908a-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLModElement.idl b/dom/interfaces/html/nsIDOMHTMLModElement.idl
index a8a48ef413ee..fa218d59cea6 100644
--- a/dom/interfaces/html/nsIDOMHTMLModElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLModElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLModElement interface is the interface to a [X]HTML
  * ins and del element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90a9-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLOListElement.idl b/dom/interfaces/html/nsIDOMHTMLOListElement.idl
index 7fc0eef42b9c..ece5f3a032c5 100644
--- a/dom/interfaces/html/nsIDOMHTMLOListElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLOListElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLOListElement interface is the interface to a [X]HTML
  * ol element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf909a-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLObjectElement.idl b/dom/interfaces/html/nsIDOMHTMLObjectElement.idl
index 7db2f98de6db..4357a2dd4db6 100644
--- a/dom/interfaces/html/nsIDOMHTMLObjectElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLObjectElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLObjectElement interface is the interface to a [X]HTML
  * object element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 interface nsIDOMValidityState;
@@ -74,7 +77,7 @@ interface nsIDOMHTMLObjectElement : nsIDOMHTMLElement
   readonly attribute nsIDOMDocument        contentDocument;
 
   // The following lines are parte of the constraint validation API, see:
-  // http://dev.w3.org/html5/spec/forms.html#the-constraint-validation-api
+  // http://www.whatwg.org/specs/web-apps/current-work/#the-constraint-validation-api
   readonly attribute boolean               willValidate;
   readonly attribute nsIDOMValidityState   validity;
   readonly attribute DOMString             validationMessage;
diff --git a/dom/interfaces/html/nsIDOMHTMLOptGroupElement.idl b/dom/interfaces/html/nsIDOMHTMLOptGroupElement.idl
index e1ee01d2dc1c..2dc9146219ab 100644
--- a/dom/interfaces/html/nsIDOMHTMLOptGroupElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLOptGroupElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLOptGroupElement interface is the interface to a
  * [X]HTML optgroup element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf9091-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLOptionElement.idl b/dom/interfaces/html/nsIDOMHTMLOptionElement.idl
index c5d150d2fac8..b1287bc03526 100644
--- a/dom/interfaces/html/nsIDOMHTMLOptionElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLOptionElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLOptionElement interface is the interface to a [X]HTML
  * option element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(611d00f5-1eb8-4571-b995-2a2019d2d11c)]
diff --git a/dom/interfaces/html/nsIDOMHTMLOptionsCollection.idl b/dom/interfaces/html/nsIDOMHTMLOptionsCollection.idl
index 36dfe6b67069..d6d8fd2bcde0 100644
--- a/dom/interfaces/html/nsIDOMHTMLOptionsCollection.idl
+++ b/dom/interfaces/html/nsIDOMHTMLOptionsCollection.idl
@@ -42,8 +42,11 @@
  * The nsIDOMHTMLOptionsCollection interface is the interface to a
  * collection of [X]HTML option elements.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 // Introduced in DOM Level 2:
diff --git a/dom/interfaces/html/nsIDOMHTMLOutputElement.idl b/dom/interfaces/html/nsIDOMHTMLOutputElement.idl
index 8c10de2dfa53..bf1e45e18ea0 100644
--- a/dom/interfaces/html/nsIDOMHTMLOutputElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLOutputElement.idl
@@ -42,7 +42,7 @@
  * <output> element.
  *
  * For more information on this interface, please see
- * http://dev.w3.org/html5/spec/forms.html#the-output-element
+ * http://www.whatwg.org/specs/web-apps/current-work/#the-output-element
  *
  * @status UNDER_DEVELOPMENT
  */
diff --git a/dom/interfaces/html/nsIDOMHTMLParagraphElement.idl b/dom/interfaces/html/nsIDOMHTMLParagraphElement.idl
index 3298ab4971c5..43044cc24eb8 100644
--- a/dom/interfaces/html/nsIDOMHTMLParagraphElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLParagraphElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLParagraphElement interface is the interface to a
  * [X]HTML p element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90a1-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLParamElement.idl b/dom/interfaces/html/nsIDOMHTMLParamElement.idl
index 3f4ced913ed5..46f6fc369af5 100644
--- a/dom/interfaces/html/nsIDOMHTMLParamElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLParamElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLParamElement interface is the interface to a [X]HTML
  * param element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90ad-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLPreElement.idl b/dom/interfaces/html/nsIDOMHTMLPreElement.idl
index 7801b4127acb..b52cb02589af 100644
--- a/dom/interfaces/html/nsIDOMHTMLPreElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLPreElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLPreElement interface is the interface to a [X]HTML
  * pre element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90a4-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLQuoteElement.idl b/dom/interfaces/html/nsIDOMHTMLQuoteElement.idl
index a1ef42322f47..d3fd2e24e465 100644
--- a/dom/interfaces/html/nsIDOMHTMLQuoteElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLQuoteElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLQuoteElement interface is the interface to a [X]HTML
  * q element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90a3-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLScriptElement.idl b/dom/interfaces/html/nsIDOMHTMLScriptElement.idl
index 5aa4b826a6f4..7137e64aa3e7 100644
--- a/dom/interfaces/html/nsIDOMHTMLScriptElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLScriptElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLScriptElement interface is the interface to a [X]HTML
  * script element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(4af8568c-375c-42fd-a82f-b25a7c03fc3e)]
diff --git a/dom/interfaces/html/nsIDOMHTMLSelectElement.idl b/dom/interfaces/html/nsIDOMHTMLSelectElement.idl
index 6b6e7777be6a..e10281d93f3a 100644
--- a/dom/interfaces/html/nsIDOMHTMLSelectElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLSelectElement.idl
@@ -44,8 +44,11 @@
  * The nsIDOMHTMLSelectElement interface is the interface to a [X]HTML
  * select element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 interface nsIDOMValidityState;
@@ -79,10 +82,16 @@ interface nsIDOMHTMLSelectElement : nsIDOMHTMLElement
   void                      focus();
 
   // The following lines are parte of the constraint validation API, see:
-  // http://dev.w3.org/html5/spec/forms.html#the-constraint-validation-api
+  // http://www.whatwg.org/specs/web-apps/current-work/#the-constraint-validation-api
   readonly attribute boolean             willValidate;
   readonly attribute nsIDOMValidityState validity;
   readonly attribute DOMString           validationMessage;
   boolean checkValidity();
   void setCustomValidity(in DOMString error);
 };
+
+[scriptable, uuid(9b63d2d3-ccb0-4eed-a9e5-d1c142a805b7)]
+interface nsIDOMHTMLSelectElement_Mozilla_2_0_Branch : nsIDOMHTMLSelectElement
+{
+           attribute boolean                     required;
+};
diff --git a/dom/interfaces/html/nsIDOMHTMLStyleElement.idl b/dom/interfaces/html/nsIDOMHTMLStyleElement.idl
index 48a01f18f25c..f0d409d96823 100644
--- a/dom/interfaces/html/nsIDOMHTMLStyleElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLStyleElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLStyleElement interface is the interface to a [X]HTML
  * style element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf908d-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLTableCaptionElem.idl b/dom/interfaces/html/nsIDOMHTMLTableCaptionElem.idl
index 9eb53965dbbe..920ea8a407b0 100644
--- a/dom/interfaces/html/nsIDOMHTMLTableCaptionElem.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTableCaptionElem.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLTableCaptionElement interface is the interface to a
  * [X]HTML caption element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90b3-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLTableCellElement.idl b/dom/interfaces/html/nsIDOMHTMLTableCellElement.idl
index c3d21de2dd3c..347ed28f7b1a 100644
--- a/dom/interfaces/html/nsIDOMHTMLTableCellElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTableCellElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLTableCellElement interface is the interface to a
  * [X]HTML td element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90b7-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLTableColElement.idl b/dom/interfaces/html/nsIDOMHTMLTableColElement.idl
index 9668294044de..9ff47cd8e335 100644
--- a/dom/interfaces/html/nsIDOMHTMLTableColElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTableColElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLTableColElement interface is the interface to a
  * [X]HTML col element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90b4-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLTableElement.idl b/dom/interfaces/html/nsIDOMHTMLTableElement.idl
index afb64afb3d64..0525a8db3089 100644
--- a/dom/interfaces/html/nsIDOMHTMLTableElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTableElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLTableElement interface is the interface to a [X]HTML
  * table element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90b2-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLTableRowElement.idl b/dom/interfaces/html/nsIDOMHTMLTableRowElement.idl
index 4a35028aad88..707e636f4005 100644
--- a/dom/interfaces/html/nsIDOMHTMLTableRowElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTableRowElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLTableRowElement interface is the interface to a
  * [X]HTML tr element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90b6-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLTableSectionElem.idl b/dom/interfaces/html/nsIDOMHTMLTableSectionElem.idl
index 69e14111f71f..7a8d402622cd 100644
--- a/dom/interfaces/html/nsIDOMHTMLTableSectionElem.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTableSectionElem.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLTableSectionElement interface is the interface to a
  * [X]HTML thead, tbody, and tfoot element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf90b5-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLTextAreaElement.idl b/dom/interfaces/html/nsIDOMHTMLTextAreaElement.idl
index 1a953fba6d6a..d12fcd77a941 100644
--- a/dom/interfaces/html/nsIDOMHTMLTextAreaElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTextAreaElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLTextAreaElement interface is the interface to a
  * [X]HTML textarea element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf9094-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLTitleElement.idl b/dom/interfaces/html/nsIDOMHTMLTitleElement.idl
index 4856c996b82b..61a3e6550cd3 100644
--- a/dom/interfaces/html/nsIDOMHTMLTitleElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTitleElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLTitleElement interface is the interface to a [X]HTML
  * title element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf9089-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMHTMLUListElement.idl b/dom/interfaces/html/nsIDOMHTMLUListElement.idl
index b0b6a22ea136..64e42ea2f49e 100644
--- a/dom/interfaces/html/nsIDOMHTMLUListElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLUListElement.idl
@@ -43,8 +43,11 @@
  * The nsIDOMHTMLUListElement interface is the interface to a [X]HTML
  * ul element.
  *
- * For more information on this interface please see
+ * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
+ *
+ * with changes from the work-in-progress WHATWG HTML specification:
+ * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 [scriptable, uuid(a6cf9099-15b3-11d2-932e-00805f8add32)]
diff --git a/dom/interfaces/html/nsIDOMNSHTMLTextAreaElement.idl b/dom/interfaces/html/nsIDOMNSHTMLTextAreaElement.idl
index 8441135df2b1..5d47c7323cc5 100644
--- a/dom/interfaces/html/nsIDOMNSHTMLTextAreaElement.idl
+++ b/dom/interfaces/html/nsIDOMNSHTMLTextAreaElement.idl
@@ -62,7 +62,7 @@ interface nsIDOMNSHTMLTextAreaElement : nsISupports
   [Null(Stringify)] attribute DOMString wrap;
 
   // The following lines are parte of the constraint validation API, see:
-  // http://dev.w3.org/html5/spec/forms.html#the-constraint-validation-api
+  // http://www.whatwg.org/specs/web-apps/current-work/#the-constraint-validation-api
   readonly attribute boolean          willValidate;
   readonly attribute nsIDOMValidityState validity;
   readonly attribute DOMString        validationMessage;
diff --git a/dom/interfaces/html/nsIDOMValidityState.idl b/dom/interfaces/html/nsIDOMValidityState.idl
index a96c5ae76c08..04b474f58eef 100644
--- a/dom/interfaces/html/nsIDOMValidityState.idl
+++ b/dom/interfaces/html/nsIDOMValidityState.idl
@@ -42,7 +42,7 @@
  * object which represents the validity states of an element.
  *
  * For more information on this interface please see
- * http://dev.w3.org/html5/spec/forms.html#validitystate
+ * http://www.whatwg.org/specs/web-apps/current-work/#validitystate
  */
 
 [scriptable, uuid(5e62197a-9b74-4812-b5a2-ca102e886f7a)]
diff --git a/dom/ipc/AudioChild.cpp b/dom/ipc/AudioChild.cpp
new file mode 100644
index 000000000000..243bcec0b654
--- /dev/null
+++ b/dom/ipc/AudioChild.cpp
@@ -0,0 +1,79 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* vim: set sw=4 ts=8 et tw=80 : */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Audio IPC
+ *
+ * The Initial Developer of the Original Code is
+ *   The Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Doug Turner <dougt@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "mozilla/dom/AudioChild.h"
+
+namespace mozilla {
+namespace dom {
+
+AudioChild::AudioChild()
+  : mLastSampleOffset(-1),
+    mLastSampleOffsetTime(0)
+{
+  MOZ_COUNT_CTOR(AudioChild);
+}
+
+AudioChild::~AudioChild()
+{
+  MOZ_COUNT_DTOR(AudioChild);
+}
+
+bool
+AudioChild::RecvSampleOffsetUpdate(const PRInt64& offset,
+                                   const PRInt64& time)
+{
+  mLastSampleOffset = offset;
+  mLastSampleOffsetTime = time;
+  return true;
+}
+
+PRInt64
+AudioChild::GetLastKnownSampleOffset()
+{
+  return mLastSampleOffset;
+}
+
+PRInt64
+AudioChild::GetLastKnownSampleOffsetTime()
+{
+  return mLastSampleOffsetTime;
+}
+
+} // namespace dom
+} // namespace mozilla
diff --git a/dom/ipc/AudioChild.h b/dom/ipc/AudioChild.h
new file mode 100644
index 000000000000..1360ae03d3c6
--- /dev/null
+++ b/dom/ipc/AudioChild.h
@@ -0,0 +1,64 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* vim: set sw=4 ts=8 et tw=80 : */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Audio IPC
+ *
+ * The Initial Developer of the Original Code is
+ *   The Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Doug Turner <dougt@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef mozilla_dom_AudioChild_h
+#define mozilla_dom_AudioChild_h
+
+#include "mozilla/dom/PAudioChild.h"
+
+namespace mozilla {
+namespace dom {
+
+class AudioChild : public PAudioChild
+{
+ public:
+    AudioChild();
+    virtual ~AudioChild();
+    virtual bool RecvSampleOffsetUpdate(const PRInt64&, const PRInt64&);
+    
+    PRInt64 GetLastKnownSampleOffset();
+    PRInt64 GetLastKnownSampleOffsetTime();
+ private:
+    PRInt64 mLastSampleOffset, mLastSampleOffsetTime;
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif
diff --git a/dom/ipc/AudioParent.cpp b/dom/ipc/AudioParent.cpp
new file mode 100644
index 000000000000..9fa6a690144c
--- /dev/null
+++ b/dom/ipc/AudioParent.cpp
@@ -0,0 +1,160 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* vim: set sw=4 ts=8 et tw=80 : */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Audio IPC
+ *
+ * The Initial Developer of the Original Code is
+ *   The Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Doug Turner <dougt@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "mozilla/dom/AudioParent.h"
+#include "nsThreadUtils.h"
+
+// C++ file contents
+namespace mozilla {
+namespace dom {
+
+class AudioWriteEvent : public nsRunnable
+{
+ public:
+  AudioWriteEvent(nsAudioStream* owner, nsCString data, PRUint32 count)
+  {
+    mOwner = owner;
+    mData  = data;
+    mCount = count;
+  }
+
+  NS_IMETHOD Run()
+  {
+    mOwner->Write(mData.get(), mCount, true);
+    return NS_OK;
+  }
+
+ private:
+    nsRefPtr<nsAudioStream> mOwner;
+    nsCString mData;
+    PRUint32  mCount;
+};
+
+NS_IMPL_THREADSAFE_ISUPPORTS1(AudioParent, nsITimerCallback)
+
+nsresult
+AudioParent::Notify(nsITimer* timer)
+{
+  if (!mStream) {
+    timer->Cancel();
+    return NS_ERROR_FAILURE;
+  }
+
+  PRInt64 offset = mStream->GetSampleOffset();
+  SendSampleOffsetUpdate(offset, PR_IntervalNow());
+  return NS_OK;
+}
+bool
+AudioParent::RecvWrite(
+        const nsCString& data,
+        const PRUint32& count)
+{
+  nsCOMPtr<nsIRunnable> event = new AudioWriteEvent(mStream, data, count);
+  nsCOMPtr<nsIThread> thread = nsAudioStream::GetGlobalThread();
+  thread->Dispatch(event, nsIEventTarget::DISPATCH_NORMAL);
+  return true;
+}
+    
+bool
+AudioParent::RecvSetVolume(const float& aVolume)
+{
+  if (mStream)
+    mStream->SetVolume(aVolume);
+  return true;
+}
+
+bool
+AudioParent::RecvDrain()
+{
+  if (mStream)
+    mStream->Drain();
+  return true;
+}
+
+bool
+AudioParent::RecvPause()
+{
+  if (mStream)
+    mStream->Pause();
+  return true;
+}
+
+bool
+AudioParent::RecvResume()
+{
+  if (mStream)
+    mStream->Resume();
+  return true;
+}
+
+bool
+AudioParent::Recv__delete__()
+{
+  if (mStream) {
+    mStream->Shutdown();
+    mStream = nsnull;
+  }
+
+  if (mTimer) {
+    mTimer->Cancel();
+    mTimer = nsnull;
+  }
+  return true;
+}
+
+AudioParent::AudioParent(PRInt32 aNumChannels, PRInt32 aRate, PRInt32 aFormat)
+{
+  mStream = nsAudioStream::AllocateStream();
+  if (mStream)
+    mStream->Init(aNumChannels,
+                  aRate,
+                  (nsAudioStream::SampleFormat) aFormat);
+  if (!mStream)
+    return; 
+
+  mTimer = do_CreateInstance("@mozilla.org/timer;1");
+  mTimer->InitWithCallback(this, 1000, nsITimer::TYPE_REPEATING_SLACK);
+}
+
+AudioParent::~AudioParent()
+{
+}
+
+} // namespace dom
+} // namespace mozilla
diff --git a/dom/ipc/AudioParent.h b/dom/ipc/AudioParent.h
new file mode 100644
index 000000000000..260f693352bd
--- /dev/null
+++ b/dom/ipc/AudioParent.h
@@ -0,0 +1,86 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* vim: set sw=4 ts=8 et tw=80 : */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Audio IPC
+ *
+ * The Initial Developer of the Original Code is
+ *   The Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Doug Turner <dougt@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef mozilla_dom_AudioParent_h
+#define mozilla_dom_AudioParent_h
+
+#include "mozilla/dom/PAudioParent.h"
+#include "nsAudioStream.h"
+#include "nsITimer.h"
+
+namespace mozilla {
+namespace dom {
+class AudioParent : public PAudioParent, public nsITimerCallback
+{
+ public:
+
+    NS_DECL_ISUPPORTS
+    NS_DECL_NSITIMERCALLBACK
+
+    virtual bool
+    RecvWrite(
+            const nsCString& data,
+            const PRUint32& count);
+
+    virtual bool
+    RecvSetVolume(const float& aVolume);
+
+    virtual bool
+    RecvDrain();
+
+    virtual bool
+    RecvPause();
+
+    virtual bool
+    RecvResume();
+
+    virtual bool
+    Recv__delete__();
+
+    AudioParent(PRInt32 aNumChannels, PRInt32 aRate, PRInt32 aFormat);
+    virtual ~AudioParent();
+
+    nsRefPtr<nsAudioStream> mStream;
+    nsCOMPtr<nsITimer> mTimer;
+
+};
+} // namespace dom
+} // namespace mozilla
+
+#endif
diff --git a/dom/ipc/ContentChild.cpp b/dom/ipc/ContentChild.cpp
index a55eef4b6c7e..b3669e57fc76 100644
--- a/dom/ipc/ContentChild.cpp
+++ b/dom/ipc/ContentChild.cpp
@@ -47,6 +47,7 @@
 
 #include "ContentChild.h"
 #include "TabChild.h"
+#include "AudioChild.h"
 
 #include "mozilla/ipc/TestShellChild.h"
 #include "mozilla/net/NeckoChild.h"
@@ -54,6 +55,8 @@
 #include "mozilla/jsipc/PContextWrapperChild.h"
 #include "mozilla/dom/ExternalHelperAppChild.h"
 
+#include "nsAudioStream.h"
+
 #include "nsIObserverService.h"
 #include "nsTObserverArray.h"
 #include "nsIObserver.h"
@@ -287,6 +290,22 @@ ContentChild::RecvPTestShellConstructor(PTestShellChild* actor)
     return true;
 }
 
+PAudioChild*
+ContentChild::AllocPAudio(const PRInt32& numChannels,
+                          const PRInt32& rate,
+                          const PRInt32& format)
+{
+    PAudioChild *child = new AudioChild();
+    return child;
+}
+
+bool
+ContentChild::DeallocPAudio(PAudioChild* doomed)
+{
+    delete doomed;
+    return true;
+}
+
 PNeckoChild* 
 ContentChild::AllocPNecko()
 {
diff --git a/dom/ipc/ContentChild.h b/dom/ipc/ContentChild.h
index c7069eb66568..22b2b164dffa 100644
--- a/dom/ipc/ContentChild.h
+++ b/dom/ipc/ContentChild.h
@@ -83,6 +83,11 @@ public:
     virtual bool DeallocPTestShell(PTestShellChild*);
     virtual bool RecvPTestShellConstructor(PTestShellChild*);
 
+    virtual PAudioChild* AllocPAudio(const PRInt32&,
+                                     const PRInt32&,
+                                     const PRInt32&);
+    virtual bool DeallocPAudio(PAudioChild*);
+
     virtual PNeckoChild* AllocPNecko();
     virtual bool DeallocPNecko(PNeckoChild*);
 
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index dd937d545678..c7e38bc1c4d2 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -66,6 +66,7 @@
 #include "nsIConsoleService.h"
 #include "nsIScriptError.h"
 #include "nsConsoleMessage.h"
+#include "AudioParent.h"
 
 #ifdef MOZ_PERMISSIONS
 #include "nsPermissionManager.h"
@@ -361,6 +362,24 @@ ContentParent::DeallocPTestShell(PTestShellParent* shell)
   delete shell;
   return true;
 }
+ 
+PAudioParent*
+ContentParent::AllocPAudio(const PRInt32& numChannels,
+                           const PRInt32& rate,
+                           const PRInt32& format)
+{
+    AudioParent *parent = new AudioParent(numChannels, rate, format);
+    parent->AddRef();
+    return parent;
+}
+
+bool
+ContentParent::DeallocPAudio(PAudioParent* doomed)
+{
+    AudioParent *parent = static_cast<AudioParent*>(doomed);
+    NS_RELEASE(parent);
+    return true;
+}
 
 PNeckoParent* 
 ContentParent::AllocPNecko()
diff --git a/dom/ipc/ContentParent.h b/dom/ipc/ContentParent.h
index b19bb363734a..89ac9db8c5eb 100644
--- a/dom/ipc/ContentParent.h
+++ b/dom/ipc/ContentParent.h
@@ -117,6 +117,11 @@ private:
     virtual PTestShellParent* AllocPTestShell();
     virtual bool DeallocPTestShell(PTestShellParent* shell);
 
+    virtual PAudioParent* AllocPAudio(const PRInt32&,
+                                     const PRInt32&,
+                                     const PRInt32&);
+    virtual bool DeallocPAudio(PAudioParent*);
+
     virtual PNeckoParent* AllocPNecko();
     virtual bool DeallocPNecko(PNeckoParent* necko);
 
diff --git a/dom/ipc/Makefile.in b/dom/ipc/Makefile.in
index 352a6b23888d..abfb0f4083ee 100644
--- a/dom/ipc/Makefile.in
+++ b/dom/ipc/Makefile.in
@@ -52,6 +52,8 @@ EXPORTS = TabMessageUtils.h PCOMContentPermissionRequestChild.h
 EXPORTS_NAMESPACES = mozilla/dom
 
 EXPORTS_mozilla/dom = \
+  AudioChild.h \
+  AudioParent.h \
   ContentChild.h \
   ContentParent.h \
   ContentProcess.h \
@@ -60,6 +62,8 @@ EXPORTS_mozilla/dom = \
   $(NULL)
 
 CPPSRCS = \
+  AudioChild.cpp \
+  AudioParent.cpp \
   ContentProcess.cpp \
   ContentParent.cpp \
   ContentChild.cpp \
diff --git a/dom/ipc/PAudio.ipdl b/dom/ipc/PAudio.ipdl
new file mode 100644
index 000000000000..e936360236ee
--- /dev/null
+++ b/dom/ipc/PAudio.ipdl
@@ -0,0 +1,70 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* vim: set sw=4 ts=8 et tw=80 : */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Audio IPC
+ *
+ * The Initial Developer of the Original Code is
+ *   The Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Doug Turner <dougt@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+include protocol PContent;
+
+namespace mozilla {
+namespace dom {
+
+sync protocol PAudio
+{
+  manager PContent;
+
+parent:
+
+  __delete__();
+
+  Write(nsCString data, PRUint32 count);
+
+  SetVolume(float aVolume);
+
+  sync Drain();
+
+  Pause();
+  Resume();
+
+ child:
+
+  SampleOffsetUpdate(PRInt64 offset, PRInt64 time);
+
+
+};
+
+} // namespace dom
+} // namespace mozilla
diff --git a/dom/ipc/PContent.ipdl b/dom/ipc/PContent.ipdl
index c018abc2fefd..b6440390f71f 100644
--- a/dom/ipc/PContent.ipdl
+++ b/dom/ipc/PContent.ipdl
@@ -36,6 +36,7 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
+include protocol PAudio;
 include protocol PBrowser;
 include protocol PTestShell;
 include protocol PNecko;
@@ -61,6 +62,7 @@ namespace dom {
 
 rpc protocol PContent
 {
+    manages PAudio;
     manages PBrowser;
     manages PTestShell;
     manages PNecko;
@@ -92,6 +94,8 @@ child:
 parent:
     PNecko();
 
+    PAudio(PRInt32 aNumChannels, PRInt32 aRate, PRInt32 aFormat);
+
     // Services remoting
 
     async StartVisitedQuery(URI uri);
diff --git a/dom/ipc/ipdl.mk b/dom/ipc/ipdl.mk
index 05763579bb5c..b4c6df4cb181 100644
--- a/dom/ipc/ipdl.mk
+++ b/dom/ipc/ipdl.mk
@@ -35,6 +35,7 @@
 # ***** END LICENSE BLOCK *****
 
 IPDLSRCS = \
+  PAudio.ipdl \
   PBrowser.ipdl \
   PContent.ipdl \
   PContentDialog.ipdl \
diff --git a/dom/src/notification/nsDesktopNotification.cpp b/dom/src/notification/nsDesktopNotification.cpp
index a69cab073404..06b786624cc7 100644
--- a/dom/src/notification/nsDesktopNotification.cpp
+++ b/dom/src/notification/nsDesktopNotification.cpp
@@ -181,6 +181,9 @@ nsDOMDesktopNotification::HandleAlertServiceNotification(const char *aTopic)
 NS_IMETHODIMP
 nsDOMDesktopNotification::Show()
 {
+  if (nsContentUtils::GetBoolPref("notification.disabled", PR_FALSE))
+    return NS_OK;
+
   // If we are in testing mode (running mochitests, for example)
   // and we are suppose to allow requests, then just post an allow event.
   if (nsContentUtils::GetBoolPref("notification.prompt.testing", PR_FALSE) &&
diff --git a/dom/tests/browser/browser_ConsoleAPITests.js b/dom/tests/browser/browser_ConsoleAPITests.js
index a5c87eae0714..e5af4a9a9158 100644
--- a/dom/tests/browser/browser_ConsoleAPITests.js
+++ b/dom/tests/browser/browser_ConsoleAPITests.js
@@ -40,10 +40,6 @@ const TEST_URI = "http://example.com/browser/dom/tests/browser/test-console-api.
 var gWindow;
 
 function test() {
-  // FIXME
-  todo(false, "This test is disabled until bug 587734 lands");
-  return;
-
   waitForExplicitFinish();
 
   var tab = gBrowser.addTab(TEST_URI);
diff --git a/dom/tests/mochitest/bugs/Makefile.in b/dom/tests/mochitest/bugs/Makefile.in
index 002223daf1a4..eb812f31e6ea 100644
--- a/dom/tests/mochitest/bugs/Makefile.in
+++ b/dom/tests/mochitest/bugs/Makefile.in
@@ -125,6 +125,7 @@ _TEST_FILES	= \
 		test_bug585819.html \
 		test_bug369306.html \
 		test_bug61098.html \
+		test_bug597809.html \
 		$(NULL)
 
 libs:: 	$(_TEST_FILES)
diff --git a/dom/tests/mochitest/bugs/test_bug597809.html b/dom/tests/mochitest/bugs/test_bug597809.html
new file mode 100644
index 000000000000..649e9c725de2
--- /dev/null
+++ b/dom/tests/mochitest/bugs/test_bug597809.html
@@ -0,0 +1,37 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=597809
+-->
+<head>
+  <title>Test for Bug 597809</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=597809">Mozilla Bug 597809</a>
+<p id="display"></p>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 597809 **/
+
+SimpleTest.waitForExplicitFinish();
+
+netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
+var cm = Components.classes["@mozilla.org/categorymanager;1"]
+                   .getService(Components.interfaces.nsICategoryManager);
+cm.addCategoryEntry("JavaScript-global-property", "testSNSM", "@mozilla.org/embedcomp/prompt-service;1",
+                    false, true);
+
+SimpleTest.executeSoon(function () {
+  ok(window.testSNSM, "testSNSM should returns an object");
+  SimpleTest.finish();
+});
+
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/dom/tests/mochitest/bugs/test_bug61098.html b/dom/tests/mochitest/bugs/test_bug61098.html
index eec8c6bd1afe..66b2be6fd4e1 100644
--- a/dom/tests/mochitest/bugs/test_bug61098.html
+++ b/dom/tests/mochitest/bugs/test_bug61098.html
@@ -25,7 +25,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=61098
 
 SimpleTest.waitForExplicitFinish();
 
-var mockPromptServiceRegisterer;
+var mockPromptServiceRegisterer, mockPromptFactoryRegisterer;
 
 var promptState;
 
@@ -34,29 +34,46 @@ function registerMockPromptService()
   netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
   Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
 
-  // Override the prompt service with our own so that we can test
-  // modal dialogs
-
-  function MockPromptService()
-  {
+  function MockPrompt(aDOMWindow) {
+    this.domWindow = aDOMWindow;
   }
 
-  MockPromptService.prototype = {
-    QueryInterface: XPCOMUtils.generateQI([Ci.nsIPromptService]),
+  MockPrompt.prototype = {
+    QueryInterface: XPCOMUtils.generateQI([Ci.nsIPrompt]),
 
-    alert: function(aParent, aDialogTitle, aText)
+    domWindow : null,
+
+    _toggleModalState: function()
     {
+      // The real prompt service puts the window into a modal state
+      // immediately before showing a modal prompt, and leaves the modal state
+      // when the prompt is dismissed by the user. This mock prompt doesn't
+      // show anything to the user, so we only need to enter and immediately
+      // leave the modal state -- this is done to trigger the necessary
+      // accounting for triggering the "stop showing more prompts" code for
+      // abusive pages.
+      var winUtils = this.domWindow
+                         .QueryInterface(Ci.nsIInterfaceRequestor)
+                         .getInterface(Ci.nsIDOMWindowUtils);
+      winUtils.enterModalState();
+      winUtils.leaveModalState();
+    },
+
+    alert: function(aDialogTitle, aText)
+    {
+      this._toggleModalState();
       promptState = {method: "alert",
-                     parent: aParent,
+                     parent: this.domWindow,
                      title: aDialogTitle,
                      msg: aText
       };
     },
 
-    alertCheck: function(aParent, aDialogTitle, aText, aCheckMsg, aCheckState)
+    alertCheck: function(aDialogTitle, aText, aCheckMsg, aCheckState)
     {
+      this._toggleModalState();
       promptState = {method: "alertCheck",
-                     parent: aParent,
+                     parent: this.domWindow,
                      title: aDialogTitle,
                      msg: aText,
                      checkMsg: aCheckMsg,
@@ -66,10 +83,11 @@ function registerMockPromptService()
       aCheckState.value = true;
     },
 
-    confirm: function(aParent, aDialogTitle, aText)
+    confirm: function(aDialogTitle, aText)
     {
+      this._toggleModalState();
       promptState = {method: "confirm",
-                     parent: aParent,
+                     parent: this.domWindow,
                      title: aDialogTitle,
                      msg: aText
       };
@@ -77,11 +95,11 @@ function registerMockPromptService()
       return true;
     },
 
-    confirmCheck: function(aParent, aDialogTitle, aText, aCheckMsg,
-                           aCheckState)
+    confirmCheck: function(aDialogTitle, aText, aCheckMsg, aCheckState)
     {
+      this._toggleModalState();
       promptState = {method: "confirmCheck",
-                     parent: aParent,
+                     parent: this.domWindow,
                      title: aDialogTitle,
                      msg: aText,
                      checkMsg: aCheckMsg,
@@ -93,12 +111,13 @@ function registerMockPromptService()
       return true;
     },
 
-    confirmEx: function(aParent, aDialogTitle, aText, aButtonFlags,
+    confirmEx: function(aDialogTitle, aText, aButtonFlags,
                         aButton0Title, aButton1Title, aButton2Title,
                         aCheckMsg, aCheckState)
     {
+      this._toggleModalState();
       promptState = {method: "confirmCheck",
-                     parent: aParent,
+                     parent: this.domWindow,
                      title: aDialogTitle,
                      msg: aText,
                      checkMsg: aCheckMsg,
@@ -111,11 +130,12 @@ function registerMockPromptService()
       return 0;
     },
 
-    prompt: function(aParent, aDialogTitle, aText, aValue, aCheckMsg,
+    prompt: function(aDialogTitle, aText, aValue, aCheckMsg,
                      aCheckState)
     {
+      this._toggleModalState();
       promptState = {method: "prompt",
-                     parent: aParent,
+                     parent: this.domWindow,
                      title: aDialogTitle,
                      msg: aText,
                      checkMsg: aCheckMsg,
@@ -129,11 +149,75 @@ function registerMockPromptService()
     },
   };
 
+
+  // Override the prompt service with our own so that we can test
+  // modal dialogs
+
+  function MockPromptService()
+  {
+  }
+
+  MockPromptService.prototype = {
+    QueryInterface: XPCOMUtils.generateQI([Ci.nsIPromptFactory, Ci.nsIPromptService]),
+
+    getPrompt: function(aDOMWindow, aIID)
+    {
+        return new MockPrompt(aDOMWindow);
+    },
+
+    alert: function(aParent, aDialogTitle, aText)
+    {
+      var prompt = new MockPrompt(aParent);
+      return prompt.alert(aDialogTitle, aText);
+    },
+
+    alertCheck: function(aParent, aDialogTitle, aText, aCheckMsg, aCheckState)
+    {
+      var prompt = new MockPrompt(aParent);
+      return prompt.alertCheck(aDialogTitle, aText, aCheckMsg, aCheckState);
+    },
+
+    confirm: function(aParent, aDialogTitle, aText)
+    {
+      var prompt = new MockPrompt(aParent);
+      return prompt.confirm(aDialogTitle, aText);
+    },
+
+    confirmCheck: function(aParent, aDialogTitle, aText, aCheckMsg,
+                           aCheckState)
+    {
+      var prompt = new MockPrompt(aParent);
+      return prompt.confirmCheck(aDialogTitle, aText, aCheckMsg, aCheckState);
+    },
+
+    confirmEx: function(aParent, aDialogTitle, aText, aButtonFlags,
+                        aButton0Title, aButton1Title, aButton2Title,
+                        aCheckMsg, aCheckState)
+    {
+      var prompt = new MockPrompt(aParent);
+      return prompt.confirmEx(aDialogTitle, aText, aButtonFlags,
+                        aButton0Title, aButton1Title, aButton2Title,
+                        aCheckMsg, aCheckState);
+    },
+
+    prompt: function(aParent, aDialogTitle, aText, aValue, aCheckMsg,
+                     aCheckState)
+    {
+      var prompt = new MockPrompt(aParent);
+      return prompt.prompt(aDialogTitle, aText, aValue, aCheckMsg, aCheckState);
+    },
+
+  };
+
   mockPromptServiceRegisterer =
     new MockObjectRegisterer("@mozilla.org/embedcomp/prompt-service;1",
                              MockPromptService);
+  mockPromptFactoryRegisterer =
+    new MockObjectRegisterer("@mozilla.org/prompter;1",
+                             MockPromptService);
 
   mockPromptServiceRegisterer.register();
+  mockPromptFactoryRegisterer.register();
 };
 
 function enableDialogLoopBlocking()
@@ -260,6 +344,8 @@ function runtests()
   w.close();
 
   resetDialogLoopBlocking();
+
+  mockPromptFactoryRegisterer.unregister();
   mockPromptServiceRegisterer.unregister();
 
   SimpleTest.finish();
diff --git a/dom/tests/mochitest/general/Makefile.in b/dom/tests/mochitest/general/Makefile.in
index fe75951a5995..9b1cfe698c3b 100644
--- a/dom/tests/mochitest/general/Makefile.in
+++ b/dom/tests/mochitest/general/Makefile.in
@@ -49,6 +49,7 @@ _TEST_FILES = \
 		489127.html \
 		test_497898.html \
 		test_bug504220.html \
+		test_consoleAPI.html \
 		test_domWindowUtils.html \
 		test_domWindowUtils_scrollXY.html \
 		test_innerScreen.xul \
diff --git a/dom/tests/mochitest/general/test_consoleAPI.html b/dom/tests/mochitest/general/test_consoleAPI.html
new file mode 100644
index 000000000000..e9747548a467
--- /dev/null
+++ b/dom/tests/mochitest/general/test_consoleAPI.html
@@ -0,0 +1,49 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>window.console test</title>
+  <script type="text/javascript" src="/MochiKit/packed.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css">
+</head>
+
+<body id="body">
+
+<script type="application/javascript;version=1.8">
+
+function doTest() {
+  ok(window.console, "console exists");
+
+  try {
+    ok(!console.foo, "random property doesn't throw");
+  } catch (ex) {
+    ok(false, "random property threw: " + ex);
+  }
+
+  var expectedProps = {
+    "log": "function",
+    "info": "function",
+    "warn": "function",
+    "error": "function",
+    "classID": "object" // XXX Bug 612405
+  };
+
+  var foundProps = 0;
+  for (var prop in console) {
+    foundProps++;
+    is(typeof(console[prop]), expectedProps[prop], "expect console prop " + prop + " exists");
+  }
+  is(foundProps, Object.keys(expectedProps).length, "found correct number of properties");
+
+  SimpleTest.finish();
+}
+
+SimpleTest.waitForExplicitFinish();
+addLoadEvent(doTest);
+
+</script>
+
+<p id="display"></p>
+
+</body>
+</html>
diff --git a/editor/crashtests.list b/editor/crashtests.list
new file mode 100644
index 000000000000..3e00ebc05320
--- /dev/null
+++ b/editor/crashtests.list
@@ -0,0 +1,5 @@
+include libeditor/html/crashtests/crashtests.list
+include libeditor/base/crashtests/crashtests.list
+include libeditor/text/crashtests/crashtests.list
+include composer/src/crashtests/crashtests.list
+include txmgr/tests/crashtests/crashtests.list
diff --git a/editor/libeditor/html/crashtests/612565-1.html b/editor/libeditor/html/crashtests/612565-1.html
new file mode 100644
index 000000000000..1b059aa6624c
--- /dev/null
+++ b/editor/libeditor/html/crashtests/612565-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <iframe></iframe>
+  </body>
+  <script>
+    onload = function() {
+      var i = document.querySelector("iframe");
+      var doc = i.contentDocument;
+      doc.body.appendChild(doc.createTextNode("foo"));
+      doc.designMode = "on";
+      while (doc.body.firstChild) {
+        doc.body.removeChild(doc.body.firstChild);
+      }
+    };
+  </script>
+</html>
diff --git a/editor/libeditor/html/crashtests/crashtests.list b/editor/libeditor/html/crashtests/crashtests.list
index 4126c9216cba..af35cf6789a2 100644
--- a/editor/libeditor/html/crashtests/crashtests.list
+++ b/editor/libeditor/html/crashtests/crashtests.list
@@ -18,3 +18,4 @@ load 513375-1.xhtml
 load 535632-1.xhtml
 load 574558-1.xhtml
 load 582138-1.xhtml
+load 612565-1.html
diff --git a/editor/libeditor/html/nsHTMLDataTransfer.cpp b/editor/libeditor/html/nsHTMLDataTransfer.cpp
index d0bf6c86dbaa..924f092cba11 100644
--- a/editor/libeditor/html/nsHTMLDataTransfer.cpp
+++ b/editor/libeditor/html/nsHTMLDataTransfer.cpp
@@ -1330,6 +1330,9 @@ NS_IMETHODIMP nsHTMLEditor::InsertFromTransferable(nsITransferable *transferable
       nsCOMPtr<nsIFile> fileObj(do_QueryInterface(genericDataObj));
       if (fileObj && len > 0)
       {
+        rv = NS_NewFileURI(getter_AddRefs(fileURI), fileObj);
+        NS_ENSURE_SUCCESS(rv, rv);
+
         nsCOMPtr<nsIMIMEService> mime = do_GetService("@mozilla.org/mime;1");
         NS_ENSURE_TRUE(mime, NS_ERROR_FAILURE);
         nsCAutoString contentType;
@@ -1403,7 +1406,8 @@ NS_IMETHODIMP nsHTMLEditor::InsertFromTransferable(nsITransferable *transferable
     }
     else if (0 == nsCRT::strcmp(bestFlavor, kJPEGImageMime) ||
              0 == nsCRT::strcmp(bestFlavor, kPNGImageMime) ||
-             0 == nsCRT::strcmp(bestFlavor, kGIFImageMime))
+             0 == nsCRT::strcmp(bestFlavor, kGIFImageMime) ||
+             insertAsImage)
     {
       nsCOMPtr<nsIInputStream> imageStream;
       if (insertAsImage) {
diff --git a/editor/libeditor/html/nsHTMLEditor.cpp b/editor/libeditor/html/nsHTMLEditor.cpp
index 8180a7e131dd..5f44c014e793 100644
--- a/editor/libeditor/html/nsHTMLEditor.cpp
+++ b/editor/libeditor/html/nsHTMLEditor.cpp
@@ -3865,6 +3865,11 @@ nsHTMLEditor::ContentInserted(nsIDocument *aDocument, nsIContent* aContainer,
   }
   // We don't need to handle our own modifications
   else if (!mAction && (aContainer ? aContainer->IsEditable() : aDocument->IsEditable())) {
+    nsCOMPtr<nsIDOMNode> node = do_QueryInterface(aChild);
+    if (node && IsMozEditorBogusNode(node)) {
+      // Ignore insertion of the bogus node
+      return;
+    }
     mRules->DocumentModified();
   }
 }
@@ -3879,6 +3884,11 @@ nsHTMLEditor::ContentRemoved(nsIDocument *aDocument, nsIContent* aContainer,
   }
   // We don't need to handle our own modifications
   else if (!mAction && (aContainer ? aContainer->IsEditable() : aDocument->IsEditable())) {
+    nsCOMPtr<nsIDOMNode> node = do_QueryInterface(aChild);
+    if (node && IsMozEditorBogusNode(node)) {
+      // Ignore removal of the bogus node
+      return;
+    }
     mRules->DocumentModified();
   }
 }
diff --git a/editor/libeditor/html/tests/browserscope/lib/browserscope/current_revision b/editor/libeditor/html/tests/browserscope/lib/browserscope/current_revision
deleted file mode 100644
index 2d78492f50c7..000000000000
--- a/editor/libeditor/html/tests/browserscope/lib/browserscope/current_revision
+++ /dev/null
@@ -1 +0,0 @@
-547
diff --git a/editor/libeditor/html/tests/browserscope/lib/browserscope/LICENSE b/editor/libeditor/html/tests/browserscope/lib/richtext/LICENSE
similarity index 100%
rename from editor/libeditor/html/tests/browserscope/lib/browserscope/LICENSE
rename to editor/libeditor/html/tests/browserscope/lib/richtext/LICENSE
diff --git a/editor/libeditor/html/tests/browserscope/lib/browserscope/README b/editor/libeditor/html/tests/browserscope/lib/richtext/README
similarity index 100%
rename from editor/libeditor/html/tests/browserscope/lib/browserscope/README
rename to editor/libeditor/html/tests/browserscope/lib/richtext/README
diff --git a/editor/libeditor/html/tests/browserscope/lib/browserscope/README.Mozilla b/editor/libeditor/html/tests/browserscope/lib/richtext/README.Mozilla
similarity index 100%
rename from editor/libeditor/html/tests/browserscope/lib/browserscope/README.Mozilla
rename to editor/libeditor/html/tests/browserscope/lib/richtext/README.Mozilla
diff --git a/editor/libeditor/html/tests/browserscope/lib/browserscope/currentStatus.js b/editor/libeditor/html/tests/browserscope/lib/richtext/currentStatus.js
similarity index 100%
rename from editor/libeditor/html/tests/browserscope/lib/browserscope/currentStatus.js
rename to editor/libeditor/html/tests/browserscope/lib/richtext/currentStatus.js
diff --git a/editor/libeditor/html/tests/browserscope/lib/richtext/current_revision b/editor/libeditor/html/tests/browserscope/lib/richtext/current_revision
new file mode 100644
index 000000000000..1e256991451e
--- /dev/null
+++ b/editor/libeditor/html/tests/browserscope/lib/richtext/current_revision
@@ -0,0 +1 @@
+775
diff --git a/editor/libeditor/html/tests/browserscope/lib/browserscope/richtext/editable.html b/editor/libeditor/html/tests/browserscope/lib/richtext/richtext/editable.html
similarity index 100%
rename from editor/libeditor/html/tests/browserscope/lib/browserscope/richtext/editable.html
rename to editor/libeditor/html/tests/browserscope/lib/richtext/richtext/editable.html
diff --git a/editor/libeditor/html/tests/browserscope/lib/browserscope/richtext/js/range.js b/editor/libeditor/html/tests/browserscope/lib/richtext/richtext/js/range.js
similarity index 100%
rename from editor/libeditor/html/tests/browserscope/lib/browserscope/richtext/js/range.js
rename to editor/libeditor/html/tests/browserscope/lib/richtext/richtext/js/range.js
diff --git a/editor/libeditor/html/tests/browserscope/lib/browserscope/richtext/richtext.html b/editor/libeditor/html/tests/browserscope/lib/richtext/richtext/richtext.html
similarity index 100%
rename from editor/libeditor/html/tests/browserscope/lib/browserscope/richtext/richtext.html
rename to editor/libeditor/html/tests/browserscope/lib/richtext/richtext/richtext.html
diff --git a/editor/libeditor/html/tests/browserscope/lib/browserscope/update_from_upstream b/editor/libeditor/html/tests/browserscope/lib/richtext/update_from_upstream
similarity index 100%
rename from editor/libeditor/html/tests/browserscope/lib/browserscope/update_from_upstream
rename to editor/libeditor/html/tests/browserscope/lib/richtext/update_from_upstream
diff --git a/editor/libeditor/html/tests/browserscope/test_browserscope.html b/editor/libeditor/html/tests/browserscope/test_richtext.html
similarity index 86%
rename from editor/libeditor/html/tests/browserscope/test_browserscope.html
rename to editor/libeditor/html/tests/browserscope/test_richtext.html
index c396e36f1ab3..27c1bdbb29c5 100644
--- a/editor/libeditor/html/tests/browserscope/test_browserscope.html
+++ b/editor/libeditor/html/tests/browserscope/test_richtext.html
@@ -9,13 +9,13 @@ BrowserScope richtext category tests
   <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
   <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>  
-  <script type="text/javascript" src="lib/browserscope/currentStatus.js"></script>
+  <script type="text/javascript" src="lib/richtext/currentStatus.js"></script>
 </head>
 <body>
 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=550569">Mozilla Bug 550569</a>
 <p id="display"></p>
 <div id="content">
-  <iframe src="lib/browserscope/richtext/richtext.html"></iframe>
+  <iframe src="lib/richtext/richtext/richtext.html"></iframe>
 </div>
 <pre id="test">
 <script type="application/javascript">
@@ -33,7 +33,7 @@ function sendScore(results, continueParams) {
     if (isKnownFailure(type, command, param)) {
       comp = todo_is;
     }
-    comp(success, "1", "Browserscope category=" + type +
+    comp(success, "1", "Browserscope richtext category=" + type +
          " test=" + command +
          " param=" + param);
   }
diff --git a/editor/libeditor/html/tests/test_bug607584.xul b/editor/libeditor/html/tests/test_bug607584.xul
index 0c993837947e..c5cc5a6e8b2f 100644
--- a/editor/libeditor/html/tests/test_bug607584.xul
+++ b/editor/libeditor/html/tests/test_bug607584.xul
@@ -71,6 +71,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=607584
 	                       firstP.id == "foo" &&
 	                       lastP.id == "";
               ok(isOk, "CR in a paragraph with an ID should not create two paragraphs of same ID");
+              progress.removeProgressListener(this);
               SimpleTest.finish();
           }
         }
@@ -99,14 +100,16 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=607584
       mEditor: null
   };
 
+  var progress;
+
   function runTest() {
     var newEditorElement = document.getElementById("editor");
     newEditorElement.makeEditable("html", true);
     var docShell = newEditorElement.boxObject.QueryInterface(Components.interfaces.nsIEditorBoxObject).docShell;
-    var progress = docShell.QueryInterface(Components.interfaces.nsIInterfaceRequestor).getInterface(Components.interfaces.nsIWebProgress);
+    progress = docShell.QueryInterface(Components.interfaces.nsIInterfaceRequestor).getInterface(Components.interfaces.nsIWebProgress);
     var progressListener = new EditorContentListener(newEditorElement);
     progress.addProgressListener(progressListener, Components.interfaces.nsIWebProgress.NOTIFY_ALL);
-    newEditorElement.setAttribute("src", "about:blank");
+    newEditorElement.setAttribute("src", "data:text/html,");
   }
 ]]>
 </script>
diff --git a/editor/libeditor/text/tests/test_bug569988.html b/editor/libeditor/text/tests/test_bug569988.html
index 05f68bc0c21c..a1765c4065c4 100644
--- a/editor/libeditor/text/tests/test_bug569988.html
+++ b/editor/libeditor/text/tests/test_bug569988.html
@@ -25,85 +25,61 @@ SimpleTest.waitForExplicitFinish();
 SimpleTest.waitForFocus(runTest);
 
 var gPromptInput = null;
-var gPromptWindow = null;
 
 function runTest()
 {
   netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
 
-  function WindowObserver()
-  {
-    Components.classes["@mozilla.org/observer-service;1"].
-               getService(Components.interfaces.nsIObserverService).
-               addObserver(this, "domwindowopened", false);
-  }
-  WindowObserver.prototype = {
-    QueryInterface: function (iid) {
-      if (iid.equals(Components.interfaces.nsIObserver) ||
-          iid.equals(Components.interfaces.nsISupports)) {
-        return this;
-      }
-      throw Components.results.NS_ERROR_NO_INTERFACE;
-    },
+  var os = Components.classes["@mozilla.org/observer-service;1"].
+             getService(Components.interfaces.nsIObserverService);
 
-    observe: function (subject, topic, data) {
-      netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
-      if (topic === "domwindowopened") {
-        ok(true, "prompt window is created");
-        gPromptWindow =
-          subject.QueryInterface(Components.interfaces.nsIDOMWindow);
-        gPromptWindow.addEventListener("load", onPromptLoad, false);
-      }
-    }
-  };
-
-  var observer = new WindowObserver();
+  os.addObserver(onPromptLoad, "common-dialog-loaded", false);
+  os.addObserver(onPromptLoad, "tabmodal-dialog-loaded", false);
 
+  ok(true, "opening prompt...");
   prompt("summary", "text");
   ok(true, "prompt is closed");
 
-  Components.classes["@mozilla.org/observer-service;1"].          
-             getService(Components.interfaces.nsIObserverService).
-             removeObserver(observer, "domwindowopened");
-  SimpleTest.finish();
+  os.removeObserver(onPromptLoad, "tabmodal-dialog-loaded");
+  os.removeObserver(onPromptLoad, "common-dialog-loaded");
 }
 
-function onPromptLoad()
+function onPromptLoad(subject, topic, data)
 {
   ok(true, "onPromptLoad is called");
   netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
-  gPromptWindow.removeEventListener("load", onPromptLoad, false);
-  gPromptInput = gPromptWindow.document.getElementById("loginTextbox");
+  gPromptInput = subject.Dialog.ui.loginTextbox;
   gPromptInput.addEventListener("focus", onPromptFocus, false);
+  // shift focus to ensure it fires.
+  subject.Dialog.ui.button0.focus();
+  gPromptInput.focus();
 }
 
-function onPromptFocus()
-{
+function onPromptFocus() {
   ok(true, "onPromptFocus is called");
   netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
   gPromptInput.removeEventListener("focus", onPromptFocus, false);
+
   var systemGroup =
     Components.classes["@mozilla.org/eventlistenerservice;1"].
       getService(Components.interfaces.nsIEventListenerService).
       systemEventGroup;
   gPromptInput.QueryInterface(Components.interfaces.nsIDOM3EventTarget);
-  var isPrevented = false;
   var listener = {
     handleEvent: function _hv(aEvent)
     {
-      isPrevented = aEvent.getPreventDefault();
+      netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
+      var isPrevented = aEvent.getPreventDefault();
+      ok(!isPrevented, "ESC key event is prevented by editor");
+      gPromptInput.removeGroupedEventListener("keypress", listener, false,
+                                              systemGroup);
+      SimpleTest.finish();
     }
   };
   gPromptInput.addGroupedEventListener("keypress", listener, false,
                                        systemGroup);
-  synthesizeKey("VK_ESCAPE", { }, gPromptWindow);
-  gPromptInput.removeGroupedEventListener("keypress", listener, false,
-                                          systemGroup);
-
-  ok(!isPrevented, "ESC key event is prevented by editor");
-  if (isPrevented) {
-    gPromptWindow.close();
-  }
+  ok(true, "sending key");
+  synthesizeKey("VK_ESCAPE", { }, gPromptInput.ownerDocument.defaultView);
 }
 
 </script>
diff --git a/embedding/android/GeckoApp.java b/embedding/android/GeckoApp.java
index b585376405bb..43d181e4645e 100644
--- a/embedding/android/GeckoApp.java
+++ b/embedding/android/GeckoApp.java
@@ -497,7 +497,7 @@ abstract public class GeckoApp
 
         int statusCode = 8; // UNEXPECTED_ERROR
 
-        String updateDir = "/data/data/org.mozilla." + getAppName() + "/updates/0/";
+        String updateDir = Environment.getExternalStorageDirectory().getPath() + "/downloads/updates/0/";
         File updateFile = new File(updateDir + "update.apk");
 
         if (!updateFile.exists())
diff --git a/embedding/android/GeckoAppShell.java b/embedding/android/GeckoAppShell.java
index a4051e975e19..e8856c185371 100644
--- a/embedding/android/GeckoAppShell.java
+++ b/embedding/android/GeckoAppShell.java
@@ -125,6 +125,8 @@ class GeckoAppShell
         f = Environment.getDownloadCacheDirectory();
         GeckoAppShell.putenv("EXTERNAL_STORAGE" + f.getPath());
 
+        GeckoAppShell.putenv("LANG=" + Locale.getDefault().toString());
+
         loadLibs(apkName);
     }
 
diff --git a/embedding/android/Makefile.in b/embedding/android/Makefile.in
index 00d3acff913c..48d10f7f7daf 100644
--- a/embedding/android/Makefile.in
+++ b/embedding/android/Makefile.in
@@ -110,6 +110,7 @@ MOZ_ANDROID_DRAWABLES += embedding/android/resources/drawable/crash_reporter.png
 RES_LAYOUT += res/layout/crash_reporter.xml
 endif
 
+MOZ_ANDROID_DRAWABLES += $(shell if test -e $(topsrcdir)/$(MOZ_BRANDING_DIRECTORY)/android-resources.mn; then cat $(topsrcdir)/$(MOZ_BRANDING_DIRECTORY)/android-resources.mn | tr '\n' ' ';  fi)
 
 include $(topsrcdir)/config/rules.mk
 
diff --git a/embedding/components/build/Makefile.in b/embedding/components/build/Makefile.in
index 02f15e9116d4..15529589890e 100644
--- a/embedding/components/build/Makefile.in
+++ b/embedding/components/build/Makefile.in
@@ -82,7 +82,7 @@ ifeq ($(MOZ_WIDGET_TOOLKIT),os2)
 LOCAL_INCLUDES += -I$(srcdir)/../printingui/src/os2 
 endif
 
-ifneq (,$(filter qt gtk2 beos photon, $(MOZ_WIDGET_TOOLKIT)))
+ifdef MOZ_PDF_PRINTING
 LOCAL_INCLUDES += -I$(srcdir)/../printingui/src/unixshared 
 endif
 
diff --git a/embedding/components/printingui/src/Makefile.in b/embedding/components/printingui/src/Makefile.in
index 37ab50bf75e7..a49065507e3e 100644
--- a/embedding/components/printingui/src/Makefile.in
+++ b/embedding/components/printingui/src/Makefile.in
@@ -42,7 +42,7 @@ VPATH		= @srcdir@
 
 include $(DEPTH)/config/autoconf.mk
 
-ifneq (,$(filter qt gtk2 photon beos,$(MOZ_WIDGET_TOOLKIT)))
+ifdef MOZ_PDF_PRINTING
 PLATFORM_DIR += unixshared
 endif
 
diff --git a/gfx/cairo/README b/gfx/cairo/README
index ba2f7732f07f..71d962a97047 100644
--- a/gfx/cairo/README
+++ b/gfx/cairo/README
@@ -152,6 +152,8 @@ quartz-layers-content.patch: Store cairo content type in CGLayer surfaces
 
 quartz-optimize-OVER.patch: Optimize OVER to SOURCE for opaque patterns
 
+quartz-check-imageSurfaceEquiv.patch: Drop cairo_quartz_surface_t's "imageSurfaceEquiv" member variable if we have problems creating it
+
 ==== pixman patches ====
 
 pixman-android-cpu-detect.patch: Add CPU detection support for Android, where we can't reliably access /proc/self/auxv.
diff --git a/gfx/cairo/cairo/src/Makefile.in b/gfx/cairo/cairo/src/Makefile.in
index 0894920af74d..70c9c53ecd2f 100644
--- a/gfx/cairo/cairo/src/Makefile.in
+++ b/gfx/cairo/cairo/src/Makefile.in
@@ -208,6 +208,11 @@ CSRCS   += $(PSPDF_BASE_CSRCS) $(PDF_CSRCS) $(PS_CSRCS)
 EXPORTS_cairo += $(PDF_EXPORTS) $(PS_EXPORTS)
 endif
 
+ifeq ($(MOZ_WIDGET_TOOLKIT),android)
+CSRCS   += $(PSPDF_BASE_CSRCS) $(PDF_CSRCS)
+EXPORTS_cairo += $(PDF_EXPORTS)
+endif
+
 ifeq ($(MOZ_WIDGET_TOOLKIT),qt)
 CPPSRCS += cairo-qt-surface.cpp
 CSRCS   += $(PSPDF_BASE_CSRCS) $(PDF_CSRCS) 
diff --git a/gfx/cairo/cairo/src/cairo-quartz-surface.c b/gfx/cairo/cairo/src/cairo-quartz-surface.c
index c64cd2c0bf14..50e8469ba44d 100644
--- a/gfx/cairo/cairo/src/cairo-quartz-surface.c
+++ b/gfx/cairo/cairo/src/cairo-quartz-surface.c
@@ -3157,7 +3157,18 @@ cairo_quartz_surface_create (cairo_format_t format,
     }
 
     surf->imageData = imageData;
-    surf->imageSurfaceEquiv = cairo_image_surface_create_for_data (imageData, format, width, height, stride);
+
+    cairo_surface_t* tmpImageSurfaceEquiv =
+      cairo_image_surface_create_for_data (imageData, format,
+                                           width, height, stride);
+
+    if (cairo_surface_status (tmpImageSurfaceEquiv)) {
+        // Tried & failed to create an imageSurfaceEquiv!
+        cairo_surface_destroy (tmpImageSurfaceEquiv);
+        surf->imageSurfaceEquiv = NULL;
+    } else {
+        surf->imageSurfaceEquiv = tmpImageSurfaceEquiv;
+    }
 
     return (cairo_surface_t *) surf;
 }
diff --git a/gfx/cairo/quartz-check-imageSurfaceEquiv.patch b/gfx/cairo/quartz-check-imageSurfaceEquiv.patch
new file mode 100644
index 000000000000..1d84ab27e1d8
--- /dev/null
+++ b/gfx/cairo/quartz-check-imageSurfaceEquiv.patch
@@ -0,0 +1,36 @@
+From: Daniel Holbert <dholbert@cs.stanford.edu>
+Bug 612662 patch 3: Drop cairo_quartz_surface_t's "imageSurfaceEquiv" member if we fail to create it. r=roc a=blocking-final+
+
+diff --git a/gfx/cairo/cairo/src/cairo-quartz-surface.c b/gfx/cairo/cairo/src/cairo-quartz-surface.c
+--- a/gfx/cairo/cairo/src/cairo-quartz-surface.c
++++ b/gfx/cairo/cairo/src/cairo-quartz-surface.c
+@@ -3152,17 +3152,28 @@ cairo_quartz_surface_create (cairo_forma
+     if (surf->base.status) {
+ 	CGContextRelease (cgc);
+ 	free (imageData);
+ 	// create_internal will have set an error
+ 	return (cairo_surface_t*) surf;
+     }
+ 
+     surf->imageData = imageData;
+-    surf->imageSurfaceEquiv = cairo_image_surface_create_for_data (imageData, format, width, height, stride);
++
++    cairo_surface_t* tmpImageSurfaceEquiv =
++      cairo_image_surface_create_for_data (imageData, format,
++                                           width, height, stride);
++
++    if (cairo_surface_status (tmpImageSurfaceEquiv)) {
++        // Tried & failed to create an imageSurfaceEquiv!
++        cairo_surface_destroy (tmpImageSurfaceEquiv);
++        surf->imageSurfaceEquiv = NULL;
++    } else {
++        surf->imageSurfaceEquiv = tmpImageSurfaceEquiv;
++    }
+ 
+     return (cairo_surface_t *) surf;
+ }
+ 
+ /**
+  * cairo_quartz_surface_get_cg_context
+  * @surface: the Cairo Quartz surface
+  *
diff --git a/gfx/ipc/SharedDIBSurface.cpp b/gfx/ipc/SharedDIBSurface.cpp
index 3f98f7bdaabc..466d3ba8ca1a 100644
--- a/gfx/ipc/SharedDIBSurface.cpp
+++ b/gfx/ipc/SharedDIBSurface.cpp
@@ -74,11 +74,8 @@ void
 SharedDIBSurface::InitSurface(PRUint32 aWidth, PRUint32 aHeight,
                               bool aTransparent)
 {
-  // Windows DIBs are bottom-to-top by default, so the stride is negative
-  // and the data is the beginning of the last row.
-  long stride = -long(aWidth * kBytesPerPixel);
+  long stride = long(aWidth * kBytesPerPixel);
   unsigned char* data = reinterpret_cast<unsigned char*>(mSharedDIB.GetBits());
-  data -= (aHeight - 1) * stride;
 
   gfxImageFormat format = aTransparent ? ImageFormatARGB32 : ImageFormatRGB24;
 
diff --git a/gfx/ipc/SharedDIBWin.cpp b/gfx/ipc/SharedDIBWin.cpp
index c79471551d8a..53b328d49ef2 100644
--- a/gfx/ipc/SharedDIBWin.cpp
+++ b/gfx/ipc/SharedDIBWin.cpp
@@ -124,10 +124,12 @@ PRUint32
 SharedDIBWin::SetupBitmapHeader(PRUint32 aWidth, PRUint32 aHeight,
                                 bool aTransparent, BITMAPV4HEADER *aHeader)
 {
+  // D3D cannot handle an offscreen memory that pitch (SysMemPitch) is negative.
+  // So we create top-to-bottom DIB.
   memset((void*)aHeader, 0, sizeof(BITMAPV4HEADER));
   aHeader->bV4Size          = sizeof(BITMAPV4HEADER);
   aHeader->bV4Width         = aWidth;
-  aHeader->bV4Height        = aHeight;
+  aHeader->bV4Height        = -LONG(aHeight); // top-to-buttom DIB
   aHeader->bV4Planes        = 1;
   aHeader->bV4BitCount      = 32;
   aHeader->bV4V4Compression = BI_BITFIELDS;
@@ -138,7 +140,7 @@ SharedDIBWin::SetupBitmapHeader(PRUint32 aWidth, PRUint32 aHeight,
   if (aTransparent)
     aHeader->bV4AlphaMask     = 0xFF000000;
 
-  return (sizeof(BITMAPV4HEADER) + (aHeader->bV4Height * aHeader->bV4Width * kBytesPerPixel));
+  return (sizeof(BITMAPV4HEADER) + (-aHeader->bV4Height * aHeader->bV4Width * kBytesPerPixel));
 }
 
 nsresult
diff --git a/gfx/layers/Layers.h b/gfx/layers/Layers.h
index 0509e7156073..48fb10d57ecc 100644
--- a/gfx/layers/Layers.h
+++ b/gfx/layers/Layers.h
@@ -590,6 +590,7 @@ public:
   Layer* GetNextSibling() { return mNextSibling; }
   Layer* GetPrevSibling() { return mPrevSibling; }
   virtual Layer* GetFirstChild() { return nsnull; }
+  virtual Layer* GetLastChild() { return nsnull; }
   const gfx3DMatrix& GetTransform() { return mTransform; }
 
   /**
@@ -885,6 +886,7 @@ public:
   // These getters can be used anytime.
 
   virtual Layer* GetFirstChild() { return mFirstChild; }
+  virtual Layer* GetLastChild() { return mLastChild; }
   const FrameMetrics& GetFrameMetrics() { return mFrameMetrics; }
 
   MOZ_LAYER_DECL_NAME("ContainerLayer", TYPE_CONTAINER)
@@ -914,6 +916,7 @@ protected:
   ContainerLayer(LayerManager* aManager, void* aImplData)
     : Layer(aManager, aImplData),
       mFirstChild(nsnull),
+      mLastChild(nsnull),
       mUseIntermediateSurface(PR_FALSE)
   {}
 
@@ -931,6 +934,7 @@ protected:
   virtual nsACString& PrintInfo(nsACString& aTo, const char* aPrefix);
 
   Layer* mFirstChild;
+  Layer* mLastChild;
   FrameMetrics mFrameMetrics;
   PRPackedBool mUseIntermediateSurface;
 };
diff --git a/gfx/layers/basic/BasicLayers.cpp b/gfx/layers/basic/BasicLayers.cpp
index 5ad8f4f74e88..7fb4e16d5754 100644
--- a/gfx/layers/basic/BasicLayers.cpp
+++ b/gfx/layers/basic/BasicLayers.cpp
@@ -126,6 +126,18 @@ public:
    * LayerManager ceases to exist.
    */
   virtual void ClearCachedResources() {}
+
+  /**
+   * This variable is used by layer manager in order to
+   * MarkLeafLayersCoveredByOpaque() before painting.
+   * We keep it here for now. Once we need to cull completely covered
+   * non-Basic layers, mCoveredByOpaque should be moved to Layer.
+   */
+  void SetCoveredByOpaque(PRBool aCovered) { mCoveredByOpaque = aCovered; }
+  PRBool IsCoveredByOpaque() const { return mCoveredByOpaque; }
+
+protected:
+  PRPackedBool mCoveredByOpaque;
 };
 
 static BasicImplData*
@@ -226,6 +238,9 @@ ContainerInsertAfter(Layer* aChild, Layer* aAfter, Container* aContainer)
   NS_ADDREF(aChild);
 
   aChild->SetParent(aContainer);
+  if (aAfter == aContainer->mLastChild) {
+    aContainer->mLastChild = aChild;
+  }
   if (!aAfter) {
     aChild->SetNextSibling(aContainer->mFirstChild);
     if (aContainer->mFirstChild) {
@@ -262,6 +277,8 @@ ContainerRemoveChild(Layer* aChild, Container* aContainer)
   }
   if (next) {
     next->SetPrevSibling(prev);
+  } else {
+    aContainer->mLastChild = prev;
   }
 
   aChild->SetNextSibling(nsnull);
@@ -924,6 +941,14 @@ ToOutsideIntRect(const gfxRect &aRect)
   return nsIntRect(r.pos.x, r.pos.y, r.size.width, r.size.height);
 }
 
+static nsIntRect
+ToInsideIntRect(const gfxRect& aRect)
+{
+  gfxRect r = aRect;
+  r.RoundIn();
+  return nsIntRect(r.pos.x, r.pos.y, r.size.width, r.size.height);
+}
+
 /**
  * Returns false if there is at most one leaf layer overlapping aBounds
  * and that layer is opaque.
@@ -1085,6 +1110,81 @@ BasicLayerManager::BeginTransactionWithTarget(gfxContext* aTarget)
   mTarget = aTarget;
 }
 
+static void
+TransformIntRect(nsIntRect& aRect, const gfxMatrix& aMatrix,
+                 nsIntRect (*aRoundMethod)(const gfxRect&))
+{
+  gfxRect gr = gfxRect(aRect.x, aRect.y, aRect.width, aRect.height);
+  gr = aMatrix.TransformBounds(gr);
+  aRect = (*aRoundMethod)(gr);
+}
+
+// This implementation assumes that GetEffectiveTransform transforms
+// all layers to the same coordinate system. It can't be used as is
+// by accelerated layers because of intermediate surfaces.
+static void
+MarkLeafLayersCoveredByOpaque(Layer* aLayer, const nsIntRect& aClipRect,
+                              nsIntRegion& aRegion)
+{
+  Layer* child = aLayer->GetLastChild();
+  BasicImplData* data = ToData(aLayer);
+  data->SetCoveredByOpaque(PR_FALSE);
+
+  const nsIntRect* clipRect = aLayer->GetEffectiveClipRect();
+  nsIntRect newClipRect(aClipRect);
+
+  // Allow aLayer or aLayer's descendants to cover underlying layers
+  // only if it's opaque. GetEffectiveOpacity() could be used instead,
+  // but it does extra passes from descendant to ancestor.
+  if (aLayer->GetOpacity() != 1.0f) {
+    newClipRect.SetRect(0, 0, 0, 0);
+  }
+
+  if (clipRect) {
+    nsIntRect cr = *clipRect;
+    gfxMatrix tr;
+    if (aLayer->GetEffectiveTransform().Is2D(&tr)) {
+      TransformIntRect(cr, tr, ToInsideIntRect);
+      newClipRect.IntersectRect(newClipRect, cr);
+    } else {
+      newClipRect.SetRect(0, 0, 0, 0);
+    }
+  }
+
+  if (!child) {
+    gfxMatrix transform;
+    if (!aLayer->GetEffectiveTransform().Is2D(&transform)) {
+      return;
+    }
+
+    nsIntRegion region = aLayer->GetEffectiveVisibleRegion();
+    nsIntRect r = region.GetBounds();
+    TransformIntRect(r, transform, ToOutsideIntRect);
+    data->SetCoveredByOpaque(aRegion.Contains(r));
+
+    // Allow aLayer to cover underlying layers only if aLayer's
+    // content is opaque
+    if (!(aLayer->GetContentFlags() & Layer::CONTENT_OPAQUE)) {
+      return;
+    }
+
+    nsIntRegionRectIterator it(region);
+    while (const nsIntRect* sr = it.Next()) {
+      r = *sr;
+      TransformIntRect(r, transform, ToInsideIntRect);
+
+      r.IntersectRect(r, newClipRect);
+      if (!r.IsEmpty()) {
+        aRegion.Or(aRegion, r);
+      }
+    }
+  } else {
+    for (; child; child = child->GetPrevSibling()) {
+      MarkLeafLayersCoveredByOpaque(child, newClipRect, aRegion);
+    }
+  }
+}
+
 void
 BasicLayerManager::EndTransaction(DrawThebesLayerCallback aCallback,
                                   void* aCallbackData)
@@ -1120,6 +1220,11 @@ BasicLayerManager::EndTransaction(DrawThebesLayerCallback aCallback,
     mSnapEffectiveTransforms =
       !(mTarget->GetFlags() & gfxContext::FLAG_DISABLE_SNAPPING);
     mRoot->ComputeEffectiveTransforms(gfx3DMatrix::From2D(mTarget->CurrentMatrix()));
+
+    nsIntRegion region;
+    MarkLeafLayersCoveredByOpaque(mRoot,
+                                  mRoot->GetEffectiveVisibleRegion().GetBounds(),
+                                  region);
     PaintLayer(mRoot, aCallback, aCallbackData);
 
     if (useDoubleBuffering) {
@@ -1197,7 +1302,14 @@ BasicLayerManager::PaintLayer(Layer* aLayer,
   /* Only paint ourself, or our children - This optimization relies on this! */
   Layer* child = aLayer->GetFirstChild();
   if (!child) {
-    ToData(aLayer)->Paint(mTarget, aCallback, aCallbackData);
+    BasicImplData* data = ToData(aLayer);
+#ifdef MOZ_LAYERS_HAVE_LOG
+    MOZ_LAYERS_LOG(("%s (0x%p) is covered: %i\n", __FUNCTION__,
+                   (void*)aLayer, data->IsCoveredByOpaque()));
+#endif
+    if (!data->IsCoveredByOpaque()) {
+      data->Paint(mTarget, aCallback, aCallbackData);
+    }
   } else {
     for (; child; child = child->GetNextSibling()) {
       PaintLayer(child, aCallback, aCallbackData);
diff --git a/gfx/layers/d3d10/ContainerLayerD3D10.cpp b/gfx/layers/d3d10/ContainerLayerD3D10.cpp
index 0103922c8072..8fff92e18e65 100644
--- a/gfx/layers/d3d10/ContainerLayerD3D10.cpp
+++ b/gfx/layers/d3d10/ContainerLayerD3D10.cpp
@@ -66,6 +66,8 @@ ContainerLayerD3D10::InsertAfter(Layer* aChild, Layer* aAfter)
     aChild->SetPrevSibling(nsnull);
     if (oldFirstChild) {
       oldFirstChild->SetPrevSibling(aChild);
+    } else {
+      mLastChild = aChild;
     }
     NS_ADDREF(aChild);
     return;
@@ -78,6 +80,8 @@ ContainerLayerD3D10::InsertAfter(Layer* aChild, Layer* aAfter)
       aChild->SetNextSibling(oldNextSibling);
       if (oldNextSibling) {
         oldNextSibling->SetPrevSibling(aChild);
+      } else {
+        mLastChild = aChild;
       }
       aChild->SetPrevSibling(child);
       NS_ADDREF(aChild);
@@ -94,6 +98,8 @@ ContainerLayerD3D10::RemoveChild(Layer *aChild)
     mFirstChild = GetFirstChild()->GetNextSibling();
     if (mFirstChild) {
       mFirstChild->SetPrevSibling(nsnull);
+    } else {
+      mLastChild = nsnull;
     }
     aChild->SetNextSibling(nsnull);
     aChild->SetPrevSibling(nsnull);
@@ -109,6 +115,8 @@ ContainerLayerD3D10::RemoveChild(Layer *aChild)
       lastChild->SetNextSibling(child->GetNextSibling());
       if (child->GetNextSibling()) {
         child->GetNextSibling()->SetPrevSibling(lastChild);
+      } else {
+        mLastChild = lastChild;
       }
       child->SetNextSibling(nsnull);
       child->SetPrevSibling(nsnull);
diff --git a/gfx/layers/d3d9/ContainerLayerD3D9.cpp b/gfx/layers/d3d9/ContainerLayerD3D9.cpp
index 321088ba5f0f..ebed1e862dda 100644
--- a/gfx/layers/d3d9/ContainerLayerD3D9.cpp
+++ b/gfx/layers/d3d9/ContainerLayerD3D9.cpp
@@ -65,6 +65,8 @@ ContainerLayerD3D9::InsertAfter(Layer* aChild, Layer* aAfter)
     aChild->SetPrevSibling(nsnull);
     if (oldFirstChild) {
       oldFirstChild->SetPrevSibling(aChild);
+    } else {
+      mLastChild = aChild;
     }
     NS_ADDREF(aChild);
     return;
@@ -77,6 +79,8 @@ ContainerLayerD3D9::InsertAfter(Layer* aChild, Layer* aAfter)
       aChild->SetNextSibling(oldNextSibling);
       if (oldNextSibling) {
         oldNextSibling->SetPrevSibling(aChild);
+      } else {
+        mLastChild = aChild;
       }
       aChild->SetPrevSibling(child);
       NS_ADDREF(aChild);
@@ -93,6 +97,8 @@ ContainerLayerD3D9::RemoveChild(Layer *aChild)
     mFirstChild = GetFirstChild()->GetNextSibling();
     if (mFirstChild) {
       mFirstChild->SetPrevSibling(nsnull);
+    } else {
+      mLastChild = nsnull;
     }
     aChild->SetNextSibling(nsnull);
     aChild->SetPrevSibling(nsnull);
@@ -108,6 +114,8 @@ ContainerLayerD3D9::RemoveChild(Layer *aChild)
       lastChild->SetNextSibling(child->GetNextSibling());
       if (child->GetNextSibling()) {
         child->GetNextSibling()->SetPrevSibling(lastChild);
+      } else {
+        mLastChild = lastChild;
       }
       child->SetNextSibling(nsnull);
       child->SetPrevSibling(nsnull);
diff --git a/gfx/layers/d3d9/ImageLayerD3D9.cpp b/gfx/layers/d3d9/ImageLayerD3D9.cpp
index 066f0820e980..e969c57120c5 100644
--- a/gfx/layers/d3d9/ImageLayerD3D9.cpp
+++ b/gfx/layers/d3d9/ImageLayerD3D9.cpp
@@ -104,7 +104,7 @@ ImageContainerD3D9::GetCurrentAsSurface(gfxIntSize *aSize)
   } else if (mActiveImage->GetFormat() == Image::CAIRO_SURFACE) {
     CairoImageD3D9 *cairoImage =
       static_cast<CairoImageD3D9*>(mActiveImage.get());
-    *aSize = cairoImage->mSize;
+    *aSize = cairoImage->GetSize();
   }
 
   return static_cast<ImageD3D9*>(mActiveImage->GetImplData())->GetAsSurface();
@@ -128,7 +128,7 @@ ImageContainerD3D9::GetCurrentSize()
   } else if (mActiveImage->GetFormat() == Image::CAIRO_SURFACE) {
     CairoImageD3D9 *cairoImage =
       static_cast<CairoImageD3D9*>(mActiveImage.get());
-    return cairoImage->mSize;
+    return cairoImage->GetSize();
   }
 
   return gfxIntSize(0,0);
@@ -208,15 +208,15 @@ ImageLayerD3D9::RenderLayer()
     device()->SetVertexShaderConstantF(CBvLayerQuad,
                                        ShaderConstantRect(0,
                                                           0,
-                                                          cairoImage->mSize.width,
-                                                          cairoImage->mSize.height),
+                                                          cairoImage->GetSize().width,
+                                                          cairoImage->GetSize().height),
                                        1);
 
     SetShaderTransformAndOpacity();
 
     mD3DManager->SetShaderMode(DeviceManagerD3D9::RGBALAYER);
 
-    device()->SetTexture(0, cairoImage->mTexture);
+    device()->SetTexture(0, cairoImage->GetOrCreateTexture());
     device()->DrawPrimitive(D3DPT_TRIANGLESTRIP, 0, 2);
   }
 }
@@ -454,58 +454,87 @@ void
 CairoImageD3D9::SetData(const CairoImage::Data &aData)
 {
   mSize = aData.mSize;
+  mCachedSurface = aData.mSurface;
+  mTexture = NULL;
+
+  // Try to upload the surface immediately, so that we don't block the
+  // rendering pipeline at paint time.
+  (void) GetOrCreateTexture();
+}
+
+IDirect3DTexture9*
+CairoImageD3D9::GetOrCreateTexture()
+{
+  if (mTexture)
+    return mTexture;
 
   nsRefPtr<gfxImageSurface> imageSurface =
-    new gfxImageSurface(aData.mSize, gfxASurface::ImageFormatARGB32);
+    new gfxImageSurface(mSize, gfxASurface::ImageFormatARGB32);
 
   nsRefPtr<gfxContext> context = new gfxContext(imageSurface);
 
-  context->SetSource(aData.mSurface);
+  context->SetSource(mCachedSurface);
   context->Paint();
 
   if (mManager->deviceManager()->IsD3D9Ex()) {
     // D3D9Ex doesn't support managed textures. We could use dynamic textures
     // here but since Images are immutable that probably isn't such a great
     // idea.
-    mManager->device()->CreateTexture(aData.mSize.width, aData.mSize.height,
-                    1, 0, D3DFMT_A8R8G8B8, D3DPOOL_DEFAULT,
-                    getter_AddRefs(mTexture), NULL);
+    if (FAILED(mManager->device()->
+               CreateTexture(mSize.width, mSize.height,
+                             1, 0, D3DFMT_A8R8G8B8, D3DPOOL_DEFAULT,
+                             getter_AddRefs(mTexture), NULL)))
+      return NULL;
+
     nsRefPtr<IDirect3DSurface9> surface;
-    mManager->device()->CreateOffscreenPlainSurface(aData.mSize.width,
-                                                    aData.mSize.height,
-                                                    D3DFMT_A8R8G8B8,
-                                                    D3DPOOL_SYSTEMMEM,
-                                                    getter_AddRefs(surface),
-                                                    NULL);
+    if (FAILED(mManager->device()->
+               CreateOffscreenPlainSurface(mSize.width,
+                                           mSize.height,
+                                           D3DFMT_A8R8G8B8,
+                                           D3DPOOL_SYSTEMMEM,
+                                           getter_AddRefs(surface),
+                                           NULL))) {
+      mTexture = NULL;
+      return NULL;
+    }
+
     D3DLOCKED_RECT lockedRect;
     surface->LockRect(&lockedRect, NULL, 0);
-    for (int y = 0; y < aData.mSize.height; y++) {
+    for (int y = 0; y < mSize.height; y++) {
       memcpy((char*)lockedRect.pBits + lockedRect.Pitch * y,
              imageSurface->Data() + imageSurface->Stride() * y,
-             aData.mSize.width * 4);
+             mSize.width * 4);
     }
     surface->UnlockRect();
     nsRefPtr<IDirect3DSurface9> dstSurface;
     mTexture->GetSurfaceLevel(0, getter_AddRefs(dstSurface));
     mManager->device()->UpdateSurface(surface, NULL, dstSurface, NULL);
   } else {
-    mManager->device()->CreateTexture(aData.mSize.width, aData.mSize.height,
-                    1, 0, D3DFMT_A8R8G8B8, D3DPOOL_MANAGED,
-                    getter_AddRefs(mTexture), NULL);
+    if (FAILED(mManager->device()->
+               CreateTexture(mSize.width, mSize.height,
+                             1, 0, D3DFMT_A8R8G8B8, D3DPOOL_MANAGED,
+                             getter_AddRefs(mTexture), NULL)))
+      return NULL;
+
     D3DLOCKED_RECT lockrect;
     /* lock the entire texture */
     mTexture->LockRect(0, &lockrect, NULL, 0);
 
     // copy over data. If we don't need to do any swaping we can
     // use memcpy
-    for (int y = 0; y < aData.mSize.height; y++) {
+    for (int y = 0; y < mSize.height; y++) {
       memcpy((char*)lockrect.pBits + lockrect.Pitch * y,
              imageSurface->Data() + imageSurface->Stride() * y,
-             aData.mSize.width * 4);
+             mSize.width * 4);
     }
 
     mTexture->UnlockRect(0);
   }
+
+  NS_ASSERTION(mTexture, "Should have succeeded by now.");
+  // Release our no-longer-needed mCachedSurface
+  mCachedSurface = NULL;
+  return mTexture;
 }
 
 already_AddRefed<gfxASurface>
diff --git a/gfx/layers/d3d9/ImageLayerD3D9.h b/gfx/layers/d3d9/ImageLayerD3D9.h
index 687d5d6fa0d6..65954ca41c18 100644
--- a/gfx/layers/d3d9/ImageLayerD3D9.h
+++ b/gfx/layers/d3d9/ImageLayerD3D9.h
@@ -148,8 +148,17 @@ public:
 
   virtual already_AddRefed<gfxASurface> GetAsSurface();
 
-  nsRefPtr<IDirect3DTexture9> mTexture;
+  /**
+   * Uploading a texture may fail if the screen is locked. If this happens,
+   * we need to save the backing surface and retry when we are asked to paint.
+   */
+  virtual IDirect3DTexture9* GetOrCreateTexture();
+  const gfxIntSize& GetSize() { return mSize; }
+
+private:
   gfxIntSize mSize;
+  nsRefPtr<gfxASurface> mCachedSurface;
+  nsRefPtr<IDirect3DTexture9> mTexture;
   LayerManagerD3D9 *mManager;
 };
 
diff --git a/gfx/layers/d3d9/Nv3DVUtils.cpp b/gfx/layers/d3d9/Nv3DVUtils.cpp
index 2ec0e0d7b688..8e44a23c1692 100644
--- a/gfx/layers/d3d9/Nv3DVUtils.cpp
+++ b/gfx/layers/d3d9/Nv3DVUtils.cpp
@@ -69,9 +69,6 @@ Nv3DVUtils::~Nv3DVUtils()
 void
 Nv3DVUtils::Initialize()
 {
-  nsCOMPtr<nsIConsoleService>
-  consoleCustom(do_GetService(NS_CONSOLESERVICE_CONTRACTID));
-
   /*
    * Detect if 3D Streaming object is already loaded. Do nothing in that case.
    */
@@ -85,42 +82,19 @@ Nv3DVUtils::Initialize()
    */
   HRESULT hr = CoCreateInstance(CLSID_NV3DVStreaming, NULL, CLSCTX_INPROC_SERVER, IID_INV3DVStreaming, (void**)(getter_AddRefs(m3DVStreaming)));
   if (FAILED(hr) || !m3DVStreaming) {
-    if (consoleCustom) {
-      nsString msg;
-      msg += NS_LITERAL_STRING("CoCreateInstance() FAILED.\n");
-      consoleCustom->LogStringMessage(msg.get());
-    }
+    NS_WARNING("Nv3DVStreaming CoCreateInstance failed (disabled).");
     return;
   }
 
-  if (consoleCustom) {
-    nsString msg;
-    msg += NS_LITERAL_STRING("Nv3DVStreaming COM object instantiated successfully.\n");
-    consoleCustom->LogStringMessage(msg.get());
-  }
-
   /*
    * Initialize the object. Note that m3DVStreaming cannot be NULL at this point.
    */
   bool bRetVal = m3DVStreaming->Nv3DVInitialize();
 
   if (!bRetVal) {
-    if (consoleCustom) {
-      nsString msg;
-      msg += NS_LITERAL_STRING("Nv3DVInitialize() FAILED!\n");
-      consoleCustom->LogStringMessage(msg.get());
-    }
+    NS_WARNING("Nv3DVStreaming Nv3DVInitialize failed!");
     return;
   }
-
-  /*
-   * Nv3DVUtils::Initialize() was successful
-   */
-  if (consoleCustom) {
-    nsString msg;
-    msg += NS_LITERAL_STRING("Nv3DVUtils::Initialize SUCCEEDED!\n");
-    consoleCustom->LogStringMessage(msg.get());
-  }
 }
 
 /**
@@ -143,45 +117,24 @@ Nv3DVUtils::UnInitialize()
 void 
 Nv3DVUtils::SetDeviceInfo(IUnknown *devUnknown)
 {
-  nsCOMPtr<nsIConsoleService>
-  consoleCustom(do_GetService(NS_CONSOLESERVICE_CONTRACTID));
-
   if (!devUnknown) {
     NS_WARNING("D3D Device Pointer (IUnknown) is NULL.\n");
     return;
   }
 
-  if (m3DVStreaming) {
-    bool rv = false;
-    rv = m3DVStreaming->Nv3DVSetDevice(devUnknown);
-    if (!rv) {
-      if (consoleCustom) {
-        nsString msg;
-        msg += NS_LITERAL_STRING("Nv3DVSetDevice() FAILED!\n");
-        consoleCustom->LogStringMessage(msg.get());
-      }
+  if (!m3DVStreaming) {
       return;
-    }
+  }
 
-    rv = m3DVStreaming->Nv3DVControl(STEREO_MODE_RIGHT_LEFT, true, FIREFOX_3DV_APP_HANDLE);
-    if (!rv) {
-      if (consoleCustom) {
-        nsString msg;
-        msg += NS_LITERAL_STRING("Nv3DVControl() FAILED!\n");
-        consoleCustom->LogStringMessage(msg.get());
-      }
+  bool rv = false;
+  rv = m3DVStreaming->Nv3DVSetDevice(devUnknown);
+  NS_ASSERTION(rv, "Nv3DVStreaming Nv3DVControl failed!");
+
+  if (!rv)
       return;
-    }
 
-    if (consoleCustom) {
-      nsString msg;
-      msg += NS_LITERAL_STRING("Nv3DVSetDevice() and Nv3DVControl() both SUCCEEDED!\n");
-      consoleCustom->LogStringMessage(msg.get());
-    }
-
-  } // m3DVStreaming
-
-  return;
+  rv = m3DVStreaming->Nv3DVControl(STEREO_MODE_RIGHT_LEFT, true, FIREFOX_3DV_APP_HANDLE);
+  NS_ASSERTION(rv, "Nv3DVStreaming Nv3DVControl failed!");
 }
 
 /*
@@ -191,22 +144,11 @@ Nv3DVUtils::SetDeviceInfo(IUnknown *devUnknown)
 void 
 Nv3DVUtils::SendNv3DVControl(Stereo_Mode eStereoMode, bool bEnableStereo, DWORD dw3DVAppHandle)
 {
-  nsCOMPtr<nsIConsoleService>
-    consoleCustom(do_GetService(NS_CONSOLESERVICE_CONTRACTID));
-
-  if (m3DVStreaming) {
-    bool rv = m3DVStreaming->Nv3DVControl(eStereoMode, bEnableStereo, dw3DVAppHandle);
-    if (consoleCustom) {
-      nsString msg;
-      if (rv) {
-        msg += NS_LITERAL_STRING("Nv3DVControl() SUCCEEDED!\n");
-      } else {
-        msg += NS_LITERAL_STRING("Nv3DVControl()FAILED!\n");
-      }
-      consoleCustom->LogStringMessage(msg.get());
-    }
-  } // m3DVStreaming
+  if (!m3DVStreaming)
+      return;
 
+  bool rv = m3DVStreaming->Nv3DVControl(eStereoMode, bEnableStereo, dw3DVAppHandle);
+  NS_ASSERTION(rv, "Nv3DVStreaming Nv3DVControl failed");
 }
 
 /*
@@ -216,21 +158,11 @@ Nv3DVUtils::SendNv3DVControl(Stereo_Mode eStereoMode, bool bEnableStereo, DWORD
 void 
 Nv3DVUtils::SendNv3DVMetaData(unsigned int dwWidth, unsigned int dwHeight, HANDLE hSrcLuma, HANDLE hDst)
 {
-  nsCOMPtr<nsIConsoleService>
-    consoleCustom(do_GetService(NS_CONSOLESERVICE_CONTRACTID));
+  if (!m3DVStreaming)
+      return;
 
-  if (m3DVStreaming) {
-    bool rv = m3DVStreaming->Nv3DVMetaData((DWORD)dwWidth, (DWORD)dwHeight, hSrcLuma, hDst);
-    if (consoleCustom) {
-      nsString msg;
-      if (rv) {
-        msg += NS_LITERAL_STRING("Nv3DVMetaData() SUCCEEDED!\n");
-      } else {
-        msg += NS_LITERAL_STRING("Nv3DVMetaData() FAILED!\n");
-      }
-      consoleCustom->LogStringMessage(msg.get());
-    }
-  } // m3DVStreaming
+  bool rv = m3DVStreaming->Nv3DVMetaData((DWORD)dwWidth, (DWORD)dwHeight, hSrcLuma, hDst);
+  NS_ASSERTION(rv, "Nv3DVStreaming Nv3DVMetaData failed!");
 }
 
 } /* namespace layers */
diff --git a/gfx/layers/opengl/ContainerLayerOGL.cpp b/gfx/layers/opengl/ContainerLayerOGL.cpp
index 73e31db6673b..f9f17c01dc80 100644
--- a/gfx/layers/opengl/ContainerLayerOGL.cpp
+++ b/gfx/layers/opengl/ContainerLayerOGL.cpp
@@ -52,6 +52,8 @@ ContainerInsertAfter(Container* aContainer, Layer* aChild, Layer* aAfter)
     aChild->SetPrevSibling(nsnull);
     if (oldFirstChild) {
       oldFirstChild->SetPrevSibling(aChild);
+    } else {
+      aContainer->mLastChild = aChild;
     }
     NS_ADDREF(aChild);
     return;
@@ -64,6 +66,8 @@ ContainerInsertAfter(Container* aContainer, Layer* aChild, Layer* aAfter)
       aChild->SetNextSibling(oldNextSibling);
       if (oldNextSibling) {
         oldNextSibling->SetPrevSibling(aChild);
+      } else {
+        aContainer->mLastChild = aChild;
       }
       aChild->SetPrevSibling(child);
       NS_ADDREF(aChild);
@@ -81,6 +85,8 @@ ContainerRemoveChild(Container* aContainer, Layer* aChild)
     aContainer->mFirstChild = aContainer->GetFirstChild()->GetNextSibling();
     if (aContainer->mFirstChild) {
       aContainer->mFirstChild->SetPrevSibling(nsnull);
+    } else {
+      aContainer->mLastChild = nsnull;
     }
     aChild->SetNextSibling(nsnull);
     aChild->SetPrevSibling(nsnull);
@@ -96,6 +102,8 @@ ContainerRemoveChild(Container* aContainer, Layer* aChild)
       lastChild->SetNextSibling(child->GetNextSibling());
       if (child->GetNextSibling()) {
         child->GetNextSibling()->SetPrevSibling(lastChild);
+      } else {
+        aContainer->mLastChild = lastChild;
       }
       child->SetNextSibling(nsnull);
       child->SetPrevSibling(nsnull);
diff --git a/gfx/src/thebes/nsThebesDeviceContext.cpp b/gfx/src/thebes/nsThebesDeviceContext.cpp
index 4aa25afa560c..73f2aee7e1a9 100644
--- a/gfx/src/thebes/nsThebesDeviceContext.cpp
+++ b/gfx/src/thebes/nsThebesDeviceContext.cpp
@@ -91,6 +91,7 @@ static nsSystemFontsMac *gSystemFonts = nsnull;
 static nsSystemFontsQt *gSystemFonts = nsnull;
 #elif defined(ANDROID)
 #include "nsSystemFontsAndroid.h"
+#include "gfxPDFSurface.h"
 static nsSystemFontsAndroid *gSystemFonts = nsnull;
 #else
 #error Need to declare gSystemFonts!
@@ -1109,7 +1110,7 @@ nsThebesDeviceContext::CalcPrintingSize()
         size = reinterpret_cast<gfxImageSurface*>(mPrintingSurface.get())->GetSize();
         break;
 
-#if defined(MOZ_ENABLE_GTK2) || defined(XP_WIN) || defined(XP_OS2) || defined(MOZ_WIDGET_QT)
+#if defined(MOZ_PDF_PRINTING)
     case gfxASurface::SurfaceTypePDF:
         inPoints = PR_TRUE;
         size = reinterpret_cast<gfxPDFSurface*>(mPrintingSurface.get())->GetSize();
diff --git a/gfx/thebes/GLContext.cpp b/gfx/thebes/GLContext.cpp
index f88d0947baab..e1a5667b7c65 100644
--- a/gfx/thebes/GLContext.cpp
+++ b/gfx/thebes/GLContext.cpp
@@ -364,6 +364,8 @@ GLContext::InitWithPrefix(const char *prefix, PRBool trygl)
             }
         }
 #endif
+
+        UpdateActualFormat();
     }
 
 #ifdef DEBUG
@@ -459,6 +461,10 @@ GLContext::IsExtensionSupported(const char *extension)
 PRBool
 GLContext::ListHasExtension(const GLubyte *extensions, const char *extension)
 {
+    // fix bug 612572 - we were crashing as we were calling this function with extensions==null
+    if (extensions == nsnull || extension == nsnull)
+        return PR_FALSE;
+
     const GLubyte *start;
     GLubyte *where, *terminator;
 
@@ -709,6 +715,10 @@ GLContext::ResizeOffscreenFBO(const gfxIntSize& aSize)
     fGetIntegerv(LOCAL_GL_RENDERBUFFER_BINDING, (GLint*) &curBoundRenderbuffer);
     fGetIntegerv(LOCAL_GL_VIEWPORT, viewport);
 
+    // the context format of what we're defining;
+    // for some reason, UpdateActualFormat isn't working with a bound FBO.
+    ContextFormat cf;
+
     // If this is the first time we're going through this, we need
     // to create the objects we'll use.  Otherwise, just bind them.
     if (firstTime) {
@@ -746,6 +756,8 @@ GLContext::ResizeOffscreenFBO(const gfxIntSize& aSize)
                     LOCAL_GL_RGBA,
                     LOCAL_GL_UNSIGNED_BYTE,
                     NULL);
+
+        cf.red = cf.green = cf.blue = cf.alpha = 8;
     } else {
         fTexImage2D(LOCAL_GL_TEXTURE_2D,
                     0,
@@ -760,6 +772,15 @@ GLContext::ResizeOffscreenFBO(const gfxIntSize& aSize)
                              : LOCAL_GL_UNSIGNED_BYTE,
 #endif
                     NULL);
+
+#ifdef XP_WIN
+        cf.red = cf.green = cf.blue = 8;
+#else
+        cf.red = 5;
+        cf.green = 6;
+        cf.blue = 5;
+#endif
+        cf.alpha = 0;
     }
 
     if (depth && stencil && useDepthStencil) {
@@ -767,6 +788,8 @@ GLContext::ResizeOffscreenFBO(const gfxIntSize& aSize)
         fRenderbufferStorage(LOCAL_GL_RENDERBUFFER,
                              LOCAL_GL_DEPTH24_STENCIL8,
                              aSize.width, aSize.height);
+        cf.depth = 24;
+        cf.stencil = 8;
     } else {
         if (depth) {
             GLenum depthType;
@@ -787,6 +810,7 @@ GLContext::ResizeOffscreenFBO(const gfxIntSize& aSize)
                                  mIsGLES2 ? LOCAL_GL_DEPTH_COMPONENT16
                                           : LOCAL_GL_DEPTH_COMPONENT24,
                                  aSize.width, aSize.height);
+            cf.depth = mIsGLES2 ? 16 : 24;
         }
 
         if (stencil) {
@@ -794,6 +818,7 @@ GLContext::ResizeOffscreenFBO(const gfxIntSize& aSize)
             fRenderbufferStorage(LOCAL_GL_RENDERBUFFER,
                                  LOCAL_GL_STENCIL_INDEX8,
                                  aSize.width, aSize.height);
+            cf.stencil = 8;
         }
     }
 
@@ -843,7 +868,10 @@ GLContext::ResizeOffscreenFBO(const gfxIntSize& aSize)
     mOffscreenActualSize = aSize;
 
     if (firstTime) {
-        UpdateActualFormat();
+        // UpdateActualFormat() doesn't work for some reason, with a
+        // FBO bound, even though it should.
+        //UpdateActualFormat();
+        mActualFormat = cf;
 
 #ifdef DEBUG
         printf_stderr("Created offscreen FBO: r: %d g: %d b: %d a: %d depth: %d stencil: %d\n",
diff --git a/gfx/thebes/GLContextProviderEGL.cpp b/gfx/thebes/GLContextProviderEGL.cpp
index 50c60e55fadc..ac4f7e0bd415 100644
--- a/gfx/thebes/GLContextProviderEGL.cpp
+++ b/gfx/thebes/GLContextProviderEGL.cpp
@@ -863,6 +863,7 @@ public:
         : TextureImage(aTexture, aSize, aWrapMode, aContentType, aIsRGB)
         , mGLContext(aContext)
         , mImpl(aImpl)
+        , mTextureSized(PR_FALSE)
     { }
 
     virtual ~TextureImageEGL()
@@ -882,7 +883,16 @@ public:
             // TextureImageEGL can handle updates to disparate regions
             // aRegion = aRegion;
         } else {
-            mUpdateRect = aRegion.GetBounds();
+            if (mTextureSized) {
+                mUpdateRect = aRegion.GetBounds();
+            } else {
+                // force a TexImage2D instead of TexSubImage2D
+                mUpdateRect.x = 0;
+                mUpdateRect.y = 0;
+                mUpdateRect.width = mSize.width;
+                mUpdateRect.height = mSize.height;
+            }
+
             if (!mUpdateSurface) {
                 NS_ASSERTION(mUpdateRect.x == 0 && mUpdateRect.y == 0,
                              "Initial update has to be full surface!");
@@ -898,10 +908,11 @@ public:
                 }
             }
 
+            // we can only draw a rectangle, not subregions
             aRegion = nsIntRegion(mUpdateRect);
+
             //mUpdateSurface->SetDeviceOffset(gfxPoint(-mUpdateRect.x, -mUpdateRect.y));
             mUpdateContext = new gfxContext(mUpdateSurface);
-            printf_stderr("UpdateRect: %d %d %d %d\n", mUpdateRect.x, mUpdateRect.y, mUpdateRect.width, mUpdateRect.height);
             mUpdateContext->Rectangle(gfxRect(mUpdateRect.x, mUpdateRect.y, mUpdateRect.width, mUpdateRect.height));
             mUpdateContext->Clip();
         }
@@ -927,15 +938,31 @@ public:
 
         mGLContext->MakeCurrent();
         mGLContext->fBindTexture(LOCAL_GL_TEXTURE_2D, mTexture);
-        mGLContext->fTexImage2D(LOCAL_GL_TEXTURE_2D,
-                                0,
-                                LOCAL_GL_RGBA,
-                                mUpdateSurface->Width(),
-                                mUpdateSurface->Height(),
-                                0,
-                                LOCAL_GL_RGBA,
-                                LOCAL_GL_UNSIGNED_BYTE,
-                                mUpdateSurface->Data());
+
+        if (mTextureSized) {
+            mGLContext->fTexSubImage2D(LOCAL_GL_TEXTURE_2D,
+                                       0,
+                                       mUpdateRect.x,
+                                       mUpdateRect.y,
+                                       mUpdateRect.width,
+                                       mUpdateRect.height,
+                                       LOCAL_GL_RGBA,
+                                       LOCAL_GL_UNSIGNED_BYTE,
+                                       mUpdateSurface->Data());
+        } else {
+            NS_ASSERTION(mUpdateRect.x == 0 && mUpdateRect.y == 0 &&
+                         mUpdateRect.width == mSize.width && mUpdateRect.height == mSize.height,
+                         "Initial update region doesn't cover entire surface!");
+            mGLContext->fTexImage2D(LOCAL_GL_TEXTURE_2D,
+                                    0,
+                                    LOCAL_GL_RGBA,
+                                    mUpdateSurface->Width(),
+                                    mUpdateSurface->Height(),
+                                    0,
+                                    LOCAL_GL_RGBA,
+                                    LOCAL_GL_UNSIGNED_BYTE,
+                                    mUpdateSurface->Data());
+        }
 
         return PR_TRUE; // texture bound
     }
@@ -960,6 +987,7 @@ private:
     nsRefPtr<gfxImageSurface> mUpdateSurface;
 
     nsIntRect mUpdateRect;
+    PRPackedBool mTextureSized;
 };
 
 already_AddRefed<TextureImage>
diff --git a/gfx/thebes/GLContextProviderWGL.cpp b/gfx/thebes/GLContextProviderWGL.cpp
index b582ce8c311a..51ba1ab3b9e5 100644
--- a/gfx/thebes/GLContextProviderWGL.cpp
+++ b/gfx/thebes/GLContextProviderWGL.cpp
@@ -568,6 +568,7 @@ CreatePBufferOffscreenContext(const gfxIntSize& aSize,
     A2(attrs, LOCAL_WGL_ALPHA_BITS_ARB, aFormat.alpha);
 
     A2(attrs, LOCAL_WGL_DEPTH_BITS_ARB, aFormat.depth);
+    A2(attrs, LOCAL_WGL_STENCIL_BITS_ARB, aFormat.stencil);
 
     if (aFormat.alpha > 0) {
         A2(attrs, LOCAL_WGL_BIND_TO_TEXTURE_RGBA_ARB, LOCAL_GL_TRUE);
diff --git a/gfx/thebes/Makefile.in b/gfx/thebes/Makefile.in
index 6ba2913917a7..e06930728067 100644
--- a/gfx/thebes/Makefile.in
+++ b/gfx/thebes/Makefile.in
@@ -290,12 +290,16 @@ ACDEFINES +=	-UWIN32_LEAN_AND_MEAN
 endif
 
 ifeq ($(MOZ_WIDGET_TOOLKIT),android)
+EXPORTS	+= \
+	gfxPDFSurface.h \
+	$(NULL)
 CPPSRCS += \
 	gfxAndroidPlatform.cpp \
 	gfxFT2Fonts.cpp \
 	gfxFT2FontBase.cpp \
 	gfxFT2Utils.cpp \
 	gfxFT2FontList.cpp \
+	gfxPDFSurface.cpp \
 	nsUnicodeRange.cpp \
 	$(NULL)
 endif
diff --git a/gfx/thebes/gfxImageSurface.cpp b/gfx/thebes/gfxImageSurface.cpp
index d6795433359a..427d7ecd76c6 100644
--- a/gfx/thebes/gfxImageSurface.cpp
+++ b/gfx/thebes/gfxImageSurface.cpp
@@ -125,7 +125,10 @@ gfxImageSurface::gfxImageSurface(const gfxIntSize& size, gfxImageFormat format)
 
     Init(surface);
 
-    RecordMemoryUsed(mSize.height * ComputeStride() + sizeof(gfxImageSurface));
+    if (mSurfaceValid) {
+        RecordMemoryUsed(mSize.height * ComputeStride() +
+                         sizeof(gfxImageSurface));
+    }
 }
 
 gfxImageSurface::gfxImageSurface(cairo_surface_t *csurf)
diff --git a/gfx/thebes/gfxPlatformGtk.cpp b/gfx/thebes/gfxPlatformGtk.cpp
index efbb53986b0b..f76f6d6ec263 100644
--- a/gfx/thebes/gfxPlatformGtk.cpp
+++ b/gfx/thebes/gfxPlatformGtk.cpp
@@ -163,7 +163,7 @@ already_AddRefed<gfxASurface>
 gfxPlatformGtk::CreateOffscreenSurface(const gfxIntSize& size,
                                        gfxASurface::gfxContentType contentType)
 {
-    nsRefPtr<gfxASurface> newSurface = nsnull;
+    nsRefPtr<gfxASurface> newSurface;
     PRBool needsClear = PR_TRUE;
     gfxASurface::gfxImageFormat imageFormat = gfxASurface::FormatFromContent(contentType);
 #ifdef MOZ_X11
@@ -211,6 +211,10 @@ gfxPlatformGtk::CreateOffscreenSurface(const gfxIntSize& size,
         newSurface = new gfxImageSurface(size, imageFormat);
     }
 
+    if (newSurface->CairoStatus()) {
+        newSurface = nsnull; // surface isn't valid for some reason
+    }
+
     if (newSurface && needsClear) {
         gfxContext tmpCtx(newSurface);
         tmpCtx.SetOperator(gfxContext::OPERATOR_CLEAR);
diff --git a/gfx/thebes/gfxWindowsNativeDrawing.cpp b/gfx/thebes/gfxWindowsNativeDrawing.cpp
index 4102eb364841..4d613e14fb69 100644
--- a/gfx/thebes/gfxWindowsNativeDrawing.cpp
+++ b/gfx/thebes/gfxWindowsNativeDrawing.cpp
@@ -307,6 +307,7 @@ gfxWindowsNativeDrawing::PaintToContext()
         if (mNativeDrawFlags & DO_NEAREST_NEIGHBOR_FILTERING)
             pat->SetFilter(gfxPattern::FILTER_FAST);
 
+        pat->SetExtend(gfxPattern::EXTEND_PAD);
         mContext->SetPattern(pat);
         mContext->Fill();
         mContext->Restore();
diff --git a/gfx/thebes/gfxWindowsSurface.cpp b/gfx/thebes/gfxWindowsSurface.cpp
index 50d2f4cfb99b..c5be70d3113d 100644
--- a/gfx/thebes/gfxWindowsSurface.cpp
+++ b/gfx/thebes/gfxWindowsSurface.cpp
@@ -202,7 +202,7 @@ gfxWindowsSurface::BeginPrinting(const nsAString& aTitle,
                                  const nsAString& aPrintToFileName)
 {
 #ifdef NS_PRINTING
-#define DOC_TITLE_LENGTH 30
+#define DOC_TITLE_LENGTH (MAX_PATH-1)
     DOCINFOW docinfo;
 
     nsString titleStr(aTitle);
diff --git a/gfx/ycbcr/convert.patch b/gfx/ycbcr/convert.patch
index b80682fd38c1..62bdc70c2f2a 100644
--- a/gfx/ycbcr/convert.patch
+++ b/gfx/ycbcr/convert.patch
@@ -550,7 +550,7 @@ index 0a2990b..4ce9eb8 100644
  // Warning C4799: function has no EMMS instruction.
  // EMMS() is slow and should be called by the calling function once per image.
 -#if USE_MMX && !defined(ARCH_CPU_X86_64)
-+#if !defined(ARCH_CPU_X86_64)
++#if defined(ARCH_CPU_X86) && !defined(ARCH_CPU_X86_64)
  #if defined(_MSC_VER)
  #define EMMS() __asm emms
  #pragma warning(disable: 4799)
diff --git a/gfx/ycbcr/yuv_row.h b/gfx/ycbcr/yuv_row.h
index 4ce9eb8cf1d9..6d9d3cb585d9 100644
--- a/gfx/ycbcr/yuv_row.h
+++ b/gfx/ycbcr/yuv_row.h
@@ -123,7 +123,7 @@ extern SIMD_ALIGNED(int16 kCoefficientsRgbY[768][4]);
 // x64 uses MMX2 (SSE) so emms is not required.
 // Warning C4799: function has no EMMS instruction.
 // EMMS() is slow and should be called by the calling function once per image.
-#if !defined(ARCH_CPU_X86_64)
+#if defined(ARCH_CPU_X86) && !defined(ARCH_CPU_X86_64)
 #if defined(_MSC_VER)
 #define EMMS() __asm emms
 #pragma warning(disable: 4799)
diff --git a/intl/unicharutil/util/bidicattable.h b/intl/unicharutil/util/bidicattable.h
index 7b351a04c7f0..47f94fdcc725 100644
--- a/intl/unicharutil/util/bidicattable.h
+++ b/intl/unicharutil/util/bidicattable.h
@@ -269,8 +269,8 @@ static PRUint8 gBidiCatIdx1[1664] = {
       5,  /* U+06F0 - U+06F7 : 0x55555555 */
      53,  /* U+06F8 - U+06FF : 0x33333355 */
       3,  /* U+0700 - U+0707 : 0x33333333 */
-     54,  /* U+0708 - U+070F : 0x43333333 */
-     55,  /* U+0710 - U+0717 : 0x333333A3 */
+      3,  /* U+0708 - U+070F : 0x33333333 */
+     54,  /* U+0710 - U+0717 : 0x333333A3 */
       3,  /* U+0718 - U+071F : 0x33333333 */
       3,  /* U+0720 - U+0727 : 0x33333333 */
       3,  /* U+0728 - U+072F : 0x33333333 */
@@ -297,21 +297,21 @@ static PRUint8 gBidiCatIdx1[1664] = {
       2,  /* U+07D0 - U+07D7 : 0x22222222 */
       2,  /* U+07D8 - U+07DF : 0x22222222 */
       2,  /* U+07E0 - U+07E7 : 0x22222222 */
-     56,  /* U+07E8 - U+07EF : 0xAAAAA222 */
-     57,  /* U+07F0 - U+07F7 : 0x9922AAAA */
-     58,  /* U+07F8 - U+07FF : 0x22222299 */
+     55,  /* U+07E8 - U+07EF : 0xAAAAA222 */
+     56,  /* U+07F0 - U+07F7 : 0x9922AAAA */
+     57,  /* U+07F8 - U+07FF : 0x22222299 */
       2,  /* U+0800 - U+0807 : 0x22222222 */
       2,  /* U+0808 - U+080F : 0x22222222 */
-     59,  /* U+0810 - U+0817 : 0xAA222222 */
-     60,  /* U+0818 - U+081F : 0xAAAAA2AA */
-     61,  /* U+0820 - U+0827 : 0xAAA2AAAA */
-     62,  /* U+0828 - U+082F : 0x22AAAAA2 */
+     58,  /* U+0810 - U+0817 : 0xAA222222 */
+     59,  /* U+0818 - U+081F : 0xAAAAA2AA */
+     60,  /* U+0820 - U+0827 : 0xAAA2AAAA */
+     61,  /* U+0828 - U+082F : 0x22AAAAA2 */
       2,  /* U+0830 - U+0837 : 0x22222222 */
       2,  /* U+0838 - U+083F : 0x22222222 */
       2,  /* U+0840 - U+0847 : 0x22222222 */
       2,  /* U+0848 - U+084F : 0x22222222 */
       2,  /* U+0850 - U+0857 : 0x22222222 */
-     63,  /* U+0858 - U+085F : 0x2222AAA2 */
+     62,  /* U+0858 - U+085F : 0x2222AAA2 */
       2,  /* U+0860 - U+0867 : 0x22222222 */
       2,  /* U+0868 - U+086F : 0x22222222 */
       2,  /* U+0870 - U+0877 : 0x22222222 */
@@ -332,87 +332,87 @@ static PRUint8 gBidiCatIdx1[1664] = {
       2,  /* U+08E8 - U+08EF : 0x22222222 */
       2,  /* U+08F0 - U+08F7 : 0x22222222 */
       2,  /* U+08F8 - U+08FF : 0x22222222 */
-     64,  /* U+0900 - U+0907 : 0x11111AAA */
+     63,  /* U+0900 - U+0907 : 0x11111AAA */
       1,  /* U+0908 - U+090F : 0x11111111 */
       1,  /* U+0910 - U+0917 : 0x11111111 */
       1,  /* U+0918 - U+091F : 0x11111111 */
       1,  /* U+0920 - U+0927 : 0x11111111 */
       1,  /* U+0928 - U+092F : 0x11111111 */
       1,  /* U+0930 - U+0937 : 0x11111111 */
-     65,  /* U+0938 - U+093F : 0x111A1A11 */
-     66,  /* U+0940 - U+0947 : 0xAAAAAAA1 */
-     67,  /* U+0948 - U+094F : 0x11A1111A */
-     66,  /* U+0950 - U+0957 : 0xAAAAAAA1 */
+     64,  /* U+0938 - U+093F : 0x111A1A11 */
+     65,  /* U+0940 - U+0947 : 0xAAAAAAA1 */
+     66,  /* U+0948 - U+094F : 0x11A1111A */
+     65,  /* U+0950 - U+0957 : 0xAAAAAAA1 */
       1,  /* U+0958 - U+095F : 0x11111111 */
-     68,  /* U+0960 - U+0967 : 0x1111AA11 */
+     67,  /* U+0960 - U+0967 : 0x1111AA11 */
       1,  /* U+0968 - U+096F : 0x11111111 */
       1,  /* U+0970 - U+0977 : 0x11111111 */
       1,  /* U+0978 - U+097F : 0x11111111 */
-     69,  /* U+0980 - U+0987 : 0x111111A1 */
+     68,  /* U+0980 - U+0987 : 0x111111A1 */
       1,  /* U+0988 - U+098F : 0x11111111 */
       1,  /* U+0990 - U+0997 : 0x11111111 */
       1,  /* U+0998 - U+099F : 0x11111111 */
       1,  /* U+09A0 - U+09A7 : 0x11111111 */
       1,  /* U+09A8 - U+09AF : 0x11111111 */
       1,  /* U+09B0 - U+09B7 : 0x11111111 */
-     70,  /* U+09B8 - U+09BF : 0x111A1111 */
-     71,  /* U+09C0 - U+09C7 : 0x111AAAA1 */
-     72,  /* U+09C8 - U+09CF : 0x11A11111 */
+     69,  /* U+09B8 - U+09BF : 0x111A1111 */
+     70,  /* U+09C0 - U+09C7 : 0x111AAAA1 */
+     71,  /* U+09C8 - U+09CF : 0x11A11111 */
       1,  /* U+09D0 - U+09D7 : 0x11111111 */
       1,  /* U+09D8 - U+09DF : 0x11111111 */
-     68,  /* U+09E0 - U+09E7 : 0x1111AA11 */
+     67,  /* U+09E0 - U+09E7 : 0x1111AA11 */
       1,  /* U+09E8 - U+09EF : 0x11111111 */
-     73,  /* U+09F0 - U+09F7 : 0x11117711 */
-     74,  /* U+09F8 - U+09FF : 0x11117111 */
-     75,  /* U+0A00 - U+0A07 : 0x11111AA1 */
+     72,  /* U+09F0 - U+09F7 : 0x11117711 */
+     73,  /* U+09F8 - U+09FF : 0x11117111 */
+     74,  /* U+0A00 - U+0A07 : 0x11111AA1 */
       1,  /* U+0A08 - U+0A0F : 0x11111111 */
       1,  /* U+0A10 - U+0A17 : 0x11111111 */
       1,  /* U+0A18 - U+0A1F : 0x11111111 */
       1,  /* U+0A20 - U+0A27 : 0x11111111 */
       1,  /* U+0A28 - U+0A2F : 0x11111111 */
       1,  /* U+0A30 - U+0A37 : 0x11111111 */
-     70,  /* U+0A38 - U+0A3F : 0x111A1111 */
-     76,  /* U+0A40 - U+0A47 : 0xA1111AA1 */
-     77,  /* U+0A48 - U+0A4F : 0x11AAA11A */
-     69,  /* U+0A50 - U+0A57 : 0x111111A1 */
+     69,  /* U+0A38 - U+0A3F : 0x111A1111 */
+     75,  /* U+0A40 - U+0A47 : 0xA1111AA1 */
+     76,  /* U+0A48 - U+0A4F : 0x11AAA11A */
+     68,  /* U+0A50 - U+0A57 : 0x111111A1 */
       1,  /* U+0A58 - U+0A5F : 0x11111111 */
       1,  /* U+0A60 - U+0A67 : 0x11111111 */
       1,  /* U+0A68 - U+0A6F : 0x11111111 */
-     78,  /* U+0A70 - U+0A77 : 0x11A111AA */
+     77,  /* U+0A70 - U+0A77 : 0x11A111AA */
       1,  /* U+0A78 - U+0A7F : 0x11111111 */
-     75,  /* U+0A80 - U+0A87 : 0x11111AA1 */
+     74,  /* U+0A80 - U+0A87 : 0x11111AA1 */
       1,  /* U+0A88 - U+0A8F : 0x11111111 */
       1,  /* U+0A90 - U+0A97 : 0x11111111 */
       1,  /* U+0A98 - U+0A9F : 0x11111111 */
       1,  /* U+0AA0 - U+0AA7 : 0x11111111 */
       1,  /* U+0AA8 - U+0AAF : 0x11111111 */
       1,  /* U+0AB0 - U+0AB7 : 0x11111111 */
-     70,  /* U+0AB8 - U+0ABF : 0x111A1111 */
-     79,  /* U+0AC0 - U+0AC7 : 0xA1AAAAA1 */
-     67,  /* U+0AC8 - U+0ACF : 0x11A1111A */
+     69,  /* U+0AB8 - U+0ABF : 0x111A1111 */
+     78,  /* U+0AC0 - U+0AC7 : 0xA1AAAAA1 */
+     66,  /* U+0AC8 - U+0ACF : 0x11A1111A */
       1,  /* U+0AD0 - U+0AD7 : 0x11111111 */
       1,  /* U+0AD8 - U+0ADF : 0x11111111 */
-     68,  /* U+0AE0 - U+0AE7 : 0x1111AA11 */
+     67,  /* U+0AE0 - U+0AE7 : 0x1111AA11 */
       1,  /* U+0AE8 - U+0AEF : 0x11111111 */
-     80,  /* U+0AF0 - U+0AF7 : 0x11111171 */
+     79,  /* U+0AF0 - U+0AF7 : 0x11111171 */
       1,  /* U+0AF8 - U+0AFF : 0x11111111 */
-     69,  /* U+0B00 - U+0B07 : 0x111111A1 */
+     68,  /* U+0B00 - U+0B07 : 0x111111A1 */
       1,  /* U+0B08 - U+0B0F : 0x11111111 */
       1,  /* U+0B10 - U+0B17 : 0x11111111 */
       1,  /* U+0B18 - U+0B1F : 0x11111111 */
       1,  /* U+0B20 - U+0B27 : 0x11111111 */
       1,  /* U+0B28 - U+0B2F : 0x11111111 */
       1,  /* U+0B30 - U+0B37 : 0x11111111 */
-     81,  /* U+0B38 - U+0B3F : 0xA11A1111 */
-     71,  /* U+0B40 - U+0B47 : 0x111AAAA1 */
-     72,  /* U+0B48 - U+0B4F : 0x11A11111 */
-     82,  /* U+0B50 - U+0B57 : 0x1A111111 */
+     80,  /* U+0B38 - U+0B3F : 0xA11A1111 */
+     70,  /* U+0B40 - U+0B47 : 0x111AAAA1 */
+     71,  /* U+0B48 - U+0B4F : 0x11A11111 */
+     81,  /* U+0B50 - U+0B57 : 0x1A111111 */
       1,  /* U+0B58 - U+0B5F : 0x11111111 */
-     68,  /* U+0B60 - U+0B67 : 0x1111AA11 */
+     67,  /* U+0B60 - U+0B67 : 0x1111AA11 */
       1,  /* U+0B68 - U+0B6F : 0x11111111 */
       1,  /* U+0B70 - U+0B77 : 0x11111111 */
       1,  /* U+0B78 - U+0B7F : 0x11111111 */
-     83,  /* U+0B80 - U+0B87 : 0x11111A11 */
+     82,  /* U+0B80 - U+0B87 : 0x11111A11 */
       1,  /* U+0B88 - U+0B8F : 0x11111111 */
       1,  /* U+0B90 - U+0B97 : 0x11111111 */
       1,  /* U+0B98 - U+0B9F : 0x11111111 */
@@ -420,14 +420,14 @@ static PRUint8 gBidiCatIdx1[1664] = {
       1,  /* U+0BA8 - U+0BAF : 0x11111111 */
       1,  /* U+0BB0 - U+0BB7 : 0x11111111 */
       1,  /* U+0BB8 - U+0BBF : 0x11111111 */
-     84,  /* U+0BC0 - U+0BC7 : 0x1111111A */
-     72,  /* U+0BC8 - U+0BCF : 0x11A11111 */
+     83,  /* U+0BC0 - U+0BC7 : 0x1111111A */
+     71,  /* U+0BC8 - U+0BCF : 0x11A11111 */
       1,  /* U+0BD0 - U+0BD7 : 0x11111111 */
       1,  /* U+0BD8 - U+0BDF : 0x11111111 */
       1,  /* U+0BE0 - U+0BE7 : 0x11111111 */
       1,  /* U+0BE8 - U+0BEF : 0x11111111 */
      22,  /* U+0BF0 - U+0BF7 : 0x99999111 */
-     85,  /* U+0BF8 - U+0BFF : 0x11111979 */
+     84,  /* U+0BF8 - U+0BFF : 0x11111979 */
       1,  /* U+0C00 - U+0C07 : 0x11111111 */
       1,  /* U+0C08 - U+0C0F : 0x11111111 */
       1,  /* U+0C10 - U+0C17 : 0x11111111 */
@@ -435,15 +435,15 @@ static PRUint8 gBidiCatIdx1[1664] = {
       1,  /* U+0C20 - U+0C27 : 0x11111111 */
       1,  /* U+0C28 - U+0C2F : 0x11111111 */
       1,  /* U+0C30 - U+0C37 : 0x11111111 */
-     86,  /* U+0C38 - U+0C3F : 0xAA111111 */
-     87,  /* U+0C40 - U+0C47 : 0xAA11111A */
-     88,  /* U+0C48 - U+0C4F : 0x11AAAA1A */
-     89,  /* U+0C50 - U+0C57 : 0x1AA11111 */
+     85,  /* U+0C38 - U+0C3F : 0xAA111111 */
+     86,  /* U+0C40 - U+0C47 : 0xAA11111A */
+     87,  /* U+0C48 - U+0C4F : 0x11AAAA1A */
+     88,  /* U+0C50 - U+0C57 : 0x1AA11111 */
       1,  /* U+0C58 - U+0C5F : 0x11111111 */
-     68,  /* U+0C60 - U+0C67 : 0x1111AA11 */
+     67,  /* U+0C60 - U+0C67 : 0x1111AA11 */
       1,  /* U+0C68 - U+0C6F : 0x11111111 */
       1,  /* U+0C70 - U+0C77 : 0x11111111 */
-     90,  /* U+0C78 - U+0C7F : 0x19999999 */
+     89,  /* U+0C78 - U+0C7F : 0x19999999 */
       1,  /* U+0C80 - U+0C87 : 0x11111111 */
       1,  /* U+0C88 - U+0C8F : 0x11111111 */
       1,  /* U+0C90 - U+0C97 : 0x11111111 */
@@ -451,12 +451,12 @@ static PRUint8 gBidiCatIdx1[1664] = {
       1,  /* U+0CA0 - U+0CA7 : 0x11111111 */
       1,  /* U+0CA8 - U+0CAF : 0x11111111 */
       1,  /* U+0CB0 - U+0CB7 : 0x11111111 */
-     70,  /* U+0CB8 - U+0CBF : 0x111A1111 */
+     69,  /* U+0CB8 - U+0CBF : 0x111A1111 */
       1,  /* U+0CC0 - U+0CC7 : 0x11111111 */
-     91,  /* U+0CC8 - U+0CCF : 0x11AA1111 */
+     90,  /* U+0CC8 - U+0CCF : 0x11AA1111 */
       1,  /* U+0CD0 - U+0CD7 : 0x11111111 */
       1,  /* U+0CD8 - U+0CDF : 0x11111111 */
-     68,  /* U+0CE0 - U+0CE7 : 0x1111AA11 */
+     67,  /* U+0CE0 - U+0CE7 : 0x1111AA11 */
       1,  /* U+0CE8 - U+0CEF : 0x11111111 */
       1,  /* U+0CF0 - U+0CF7 : 0x11111111 */
       1,  /* U+0CF8 - U+0CFF : 0x11111111 */
@@ -468,11 +468,11 @@ static PRUint8 gBidiCatIdx1[1664] = {
       1,  /* U+0D28 - U+0D2F : 0x11111111 */
       1,  /* U+0D30 - U+0D37 : 0x11111111 */
       1,  /* U+0D38 - U+0D3F : 0x11111111 */
-     71,  /* U+0D40 - U+0D47 : 0x111AAAA1 */
-     72,  /* U+0D48 - U+0D4F : 0x11A11111 */
+     70,  /* U+0D40 - U+0D47 : 0x111AAAA1 */
+     71,  /* U+0D48 - U+0D4F : 0x11A11111 */
       1,  /* U+0D50 - U+0D57 : 0x11111111 */
       1,  /* U+0D58 - U+0D5F : 0x11111111 */
-     68,  /* U+0D60 - U+0D67 : 0x1111AA11 */
+     67,  /* U+0D60 - U+0D67 : 0x1111AA11 */
       1,  /* U+0D68 - U+0D6F : 0x11111111 */
       1,  /* U+0D70 - U+0D77 : 0x11111111 */
       1,  /* U+0D78 - U+0D7F : 0x11111111 */
@@ -485,8 +485,8 @@ static PRUint8 gBidiCatIdx1[1664] = {
       1,  /* U+0DB0 - U+0DB7 : 0x11111111 */
       1,  /* U+0DB8 - U+0DBF : 0x11111111 */
       1,  /* U+0DC0 - U+0DC7 : 0x11111111 */
-     83,  /* U+0DC8 - U+0DCF : 0x11111A11 */
-     92,  /* U+0DD0 - U+0DD7 : 0x1A1AAA11 */
+     82,  /* U+0DC8 - U+0DCF : 0x11111A11 */
+     91,  /* U+0DD0 - U+0DD7 : 0x1A1AAA11 */
       1,  /* U+0DD8 - U+0DDF : 0x11111111 */
       1,  /* U+0DE0 - U+0DE7 : 0x11111111 */
       1,  /* U+0DE8 - U+0DEF : 0x11111111 */
@@ -498,10 +498,10 @@ static PRUint8 gBidiCatIdx1[1664] = {
       1,  /* U+0E18 - U+0E1F : 0x11111111 */
       1,  /* U+0E20 - U+0E27 : 0x11111111 */
       1,  /* U+0E28 - U+0E2F : 0x11111111 */
-     93,  /* U+0E30 - U+0E37 : 0xAAAA11A1 */
-     94,  /* U+0E38 - U+0E3F : 0x71111AAA */
-     95,  /* U+0E40 - U+0E47 : 0xA1111111 */
-     96,  /* U+0E48 - U+0E4F : 0x1AAAAAAA */
+     92,  /* U+0E30 - U+0E37 : 0xAAAA11A1 */
+     93,  /* U+0E38 - U+0E3F : 0x71111AAA */
+     94,  /* U+0E40 - U+0E47 : 0xA1111111 */
+     95,  /* U+0E48 - U+0E4F : 0x1AAAAAAA */
       1,  /* U+0E50 - U+0E57 : 0x11111111 */
       1,  /* U+0E58 - U+0E5F : 0x11111111 */
       1,  /* U+0E60 - U+0E67 : 0x11111111 */
@@ -514,10 +514,10 @@ static PRUint8 gBidiCatIdx1[1664] = {
       1,  /* U+0E98 - U+0E9F : 0x11111111 */
       1,  /* U+0EA0 - U+0EA7 : 0x11111111 */
       1,  /* U+0EA8 - U+0EAF : 0x11111111 */
-     93,  /* U+0EB0 - U+0EB7 : 0xAAAA11A1 */
-     97,  /* U+0EB8 - U+0EBF : 0x111AA1AA */
+     92,  /* U+0EB0 - U+0EB7 : 0xAAAA11A1 */
+     96,  /* U+0EB8 - U+0EBF : 0x111AA1AA */
       1,  /* U+0EC0 - U+0EC7 : 0x11111111 */
-     98,  /* U+0EC8 - U+0ECF : 0x11AAAAAA */
+     97,  /* U+0EC8 - U+0ECF : 0x11AAAAAA */
       1,  /* U+0ED0 - U+0ED7 : 0x11111111 */
       1,  /* U+0ED8 - U+0EDF : 0x11111111 */
       1,  /* U+0EE0 - U+0EE7 : 0x11111111 */
@@ -530,25 +530,25 @@ static PRUint8 gBidiCatIdx1[1664] = {
      38,  /* U+0F18 - U+0F1F : 0x111111AA */
       1,  /* U+0F20 - U+0F27 : 0x11111111 */
       1,  /* U+0F28 - U+0F2F : 0x11111111 */
-     99,  /* U+0F30 - U+0F37 : 0xA1A11111 */
-    100,  /* U+0F38 - U+0F3F : 0x119999A1 */
+     98,  /* U+0F30 - U+0F37 : 0xA1A11111 */
+     99,  /* U+0F38 - U+0F3F : 0x119999A1 */
       1,  /* U+0F40 - U+0F47 : 0x11111111 */
       1,  /* U+0F48 - U+0F4F : 0x11111111 */
       1,  /* U+0F50 - U+0F57 : 0x11111111 */
       1,  /* U+0F58 - U+0F5F : 0x11111111 */
       1,  /* U+0F60 - U+0F67 : 0x11111111 */
       1,  /* U+0F68 - U+0F6F : 0x11111111 */
-     66,  /* U+0F70 - U+0F77 : 0xAAAAAAA1 */
-     96,  /* U+0F78 - U+0F7F : 0x1AAAAAAA */
-    101,  /* U+0F80 - U+0F87 : 0xAA1AAAAA */
-    102,  /* U+0F88 - U+0F8F : 0xAAA11111 */
+     65,  /* U+0F70 - U+0F77 : 0xAAAAAAA1 */
+     95,  /* U+0F78 - U+0F7F : 0x1AAAAAAA */
+    100,  /* U+0F80 - U+0F87 : 0xAA1AAAAA */
+    101,  /* U+0F88 - U+0F8F : 0xAAA11111 */
      10,  /* U+0F90 - U+0F97 : 0xAAAAAAAA */
-     66,  /* U+0F98 - U+0F9F : 0xAAAAAAA1 */
+     65,  /* U+0F98 - U+0F9F : 0xAAAAAAA1 */
      10,  /* U+0FA0 - U+0FA7 : 0xAAAAAAAA */
      10,  /* U+0FA8 - U+0FAF : 0xAAAAAAAA */
      10,  /* U+0FB0 - U+0FB7 : 0xAAAAAAAA */
-    103,  /* U+0FB8 - U+0FBF : 0x111AAAAA */
-     82,  /* U+0FC0 - U+0FC7 : 0x1A111111 */
+    102,  /* U+0FB8 - U+0FBF : 0x111AAAAA */
+     81,  /* U+0FC0 - U+0FC7 : 0x1A111111 */
       1,  /* U+0FC8 - U+0FCF : 0x11111111 */
       1,  /* U+0FD0 - U+0FD7 : 0x11111111 */
       1,  /* U+0FD8 - U+0FDF : 0x11111111 */
@@ -561,21 +561,21 @@ static PRUint8 gBidiCatIdx1[1664] = {
       1,  /* U+1010 - U+1017 : 0x11111111 */
       1,  /* U+1018 - U+101F : 0x11111111 */
       1,  /* U+1020 - U+1027 : 0x11111111 */
-    102,  /* U+1028 - U+102F : 0xAAA11111 */
-    104,  /* U+1030 - U+1037 : 0xAAAAAA1A */
-    105,  /* U+1038 - U+103F : 0x1AA11AA1 */
+    101,  /* U+1028 - U+102F : 0xAAA11111 */
+    103,  /* U+1030 - U+1037 : 0xAAAAAA1A */
+    104,  /* U+1038 - U+103F : 0x1AA11AA1 */
       1,  /* U+1040 - U+1047 : 0x11111111 */
       1,  /* U+1048 - U+104F : 0x11111111 */
       1,  /* U+1050 - U+1057 : 0x11111111 */
-    106,  /* U+1058 - U+105F : 0xAA1111AA */
-     84,  /* U+1060 - U+1067 : 0x1111111A */
+    105,  /* U+1058 - U+105F : 0xAA1111AA */
+     83,  /* U+1060 - U+1067 : 0x1111111A */
       1,  /* U+1068 - U+106F : 0x11111111 */
-     71,  /* U+1070 - U+1077 : 0x111AAAA1 */
+     70,  /* U+1070 - U+1077 : 0x111AAAA1 */
       1,  /* U+1078 - U+107F : 0x11111111 */
-    107,  /* U+1080 - U+1087 : 0x1AA11A11 */
-     72,  /* U+1088 - U+108F : 0x11A11111 */
+    106,  /* U+1080 - U+1087 : 0x1AA11A11 */
+     71,  /* U+1088 - U+108F : 0x11A11111 */
       1,  /* U+1090 - U+1097 : 0x11111111 */
-     72,  /* U+1098 - U+109F : 0x11A11111 */
+     71,  /* U+1098 - U+109F : 0x11A11111 */
       1,  /* U+10A0 - U+10A7 : 0x11111111 */
       1,  /* U+10A8 - U+10AF : 0x11111111 */
       1,  /* U+10B0 - U+10B7 : 0x11111111 */
@@ -663,7 +663,7 @@ static PRUint8 gBidiCatIdx1[1664] = {
       1,  /* U+1340 - U+1347 : 0x11111111 */
       1,  /* U+1348 - U+134F : 0x11111111 */
       1,  /* U+1350 - U+1357 : 0x11111111 */
-    102,  /* U+1358 - U+135F : 0xAAA11111 */
+    101,  /* U+1358 - U+135F : 0xAAA11111 */
       1,  /* U+1360 - U+1367 : 0x11111111 */
       1,  /* U+1368 - U+136F : 0x11111111 */
       1,  /* U+1370 - U+1377 : 0x11111111 */
@@ -671,7 +671,7 @@ static PRUint8 gBidiCatIdx1[1664] = {
       1,  /* U+1380 - U+1387 : 0x11111111 */
       1,  /* U+1388 - U+138F : 0x11111111 */
       9,  /* U+1390 - U+1397 : 0x99999999 */
-    108,  /* U+1398 - U+139F : 0x11111199 */
+    107,  /* U+1398 - U+139F : 0x11111199 */
       1,  /* U+13A0 - U+13A7 : 0x11111111 */
       1,  /* U+13A8 - U+13AF : 0x11111111 */
       1,  /* U+13B0 - U+13B7 : 0x11111111 */
@@ -764,10 +764,10 @@ static PRUint8 gBidiCatIdx1[1664] = {
       1,  /* U+1668 - U+166F : 0x11111111 */
       1,  /* U+1670 - U+1677 : 0x11111111 */
       1,  /* U+1678 - U+167F : 0x11111111 */
-    109,  /* U+1680 - U+1687 : 0x1111111E */
+    108,  /* U+1680 - U+1687 : 0x1111111E */
       1,  /* U+1688 - U+168F : 0x11111111 */
       1,  /* U+1690 - U+1697 : 0x11111111 */
-    110,  /* U+1698 - U+169F : 0x11199111 */
+    109,  /* U+1698 - U+169F : 0x11199111 */
       1,  /* U+16A0 - U+16A7 : 0x11111111 */
       1,  /* U+16A8 - U+16AF : 0x11111111 */
       1,  /* U+16B0 - U+16B7 : 0x11111111 */
@@ -782,19 +782,19 @@ static PRUint8 gBidiCatIdx1[1664] = {
       1,  /* U+16F8 - U+16FF : 0x11111111 */
       1,  /* U+1700 - U+1707 : 0x11111111 */
       1,  /* U+1708 - U+170F : 0x11111111 */
-    111,  /* U+1710 - U+1717 : 0x111AAA11 */
+    110,  /* U+1710 - U+1717 : 0x111AAA11 */
       1,  /* U+1718 - U+171F : 0x11111111 */
       1,  /* U+1720 - U+1727 : 0x11111111 */
       1,  /* U+1728 - U+172F : 0x11111111 */
-    111,  /* U+1730 - U+1737 : 0x111AAA11 */
+    110,  /* U+1730 - U+1737 : 0x111AAA11 */
       1,  /* U+1738 - U+173F : 0x11111111 */
       1,  /* U+1740 - U+1747 : 0x11111111 */
       1,  /* U+1748 - U+174F : 0x11111111 */
-     68,  /* U+1750 - U+1757 : 0x1111AA11 */
+     67,  /* U+1750 - U+1757 : 0x1111AA11 */
       1,  /* U+1758 - U+175F : 0x11111111 */
       1,  /* U+1760 - U+1767 : 0x11111111 */
       1,  /* U+1768 - U+176F : 0x11111111 */
-     68,  /* U+1770 - U+1777 : 0x1111AA11 */
+     67,  /* U+1770 - U+1777 : 0x1111AA11 */
       1,  /* U+1778 - U+177F : 0x11111111 */
       1,  /* U+1780 - U+1787 : 0x11111111 */
       1,  /* U+1788 - U+178F : 0x11111111 */
@@ -802,16 +802,16 @@ static PRUint8 gBidiCatIdx1[1664] = {
       1,  /* U+1798 - U+179F : 0x11111111 */
       1,  /* U+17A0 - U+17A7 : 0x11111111 */
       1,  /* U+17A8 - U+17AF : 0x11111111 */
-     95,  /* U+17B0 - U+17B7 : 0xA1111111 */
-     98,  /* U+17B8 - U+17BF : 0x11AAAAAA */
-     82,  /* U+17C0 - U+17C7 : 0x1A111111 */
-     66,  /* U+17C8 - U+17CF : 0xAAAAAAA1 */
+    111,  /* U+17B0 - U+17B7 : 0xA1AA1111 */
+     97,  /* U+17B8 - U+17BF : 0x11AAAAAA */
+     81,  /* U+17C0 - U+17C7 : 0x1A111111 */
+     65,  /* U+17C8 - U+17CF : 0xAAAAAAA1 */
     112,  /* U+17D0 - U+17D7 : 0x1111AAAA */
     113,  /* U+17D8 - U+17DF : 0x11A17111 */
       1,  /* U+17E0 - U+17E7 : 0x11111111 */
       1,  /* U+17E8 - U+17EF : 0x11111111 */
       9,  /* U+17F0 - U+17F7 : 0x99999999 */
-    108,  /* U+17F8 - U+17FF : 0x11111199 */
+    107,  /* U+17F8 - U+17FF : 0x11111199 */
       9,  /* U+1800 - U+1807 : 0x99999999 */
     114,  /* U+1808 - U+180F : 0x1EAAA999 */
       1,  /* U+1810 - U+1817 : 0x11111111 */
@@ -833,7 +833,7 @@ static PRUint8 gBidiCatIdx1[1664] = {
       1,  /* U+1890 - U+1897 : 0x11111111 */
       1,  /* U+1898 - U+189F : 0x11111111 */
       1,  /* U+18A0 - U+18A7 : 0x11111111 */
-     69,  /* U+18A8 - U+18AF : 0x111111A1 */
+     68,  /* U+18A8 - U+18AF : 0x111111A1 */
       1,  /* U+18B0 - U+18B7 : 0x11111111 */
       1,  /* U+18B8 - U+18BF : 0x11111111 */
       1,  /* U+18C0 - U+18C7 : 0x11111111 */
@@ -849,8 +849,8 @@ static PRUint8 gBidiCatIdx1[1664] = {
       1,  /* U+1910 - U+1917 : 0x11111111 */
       1,  /* U+1918 - U+191F : 0x11111111 */
     115,  /* U+1920 - U+1927 : 0xA1111AAA */
-     84,  /* U+1928 - U+192F : 0x1111111A */
-     83,  /* U+1930 - U+1937 : 0x11111A11 */
+     83,  /* U+1928 - U+192F : 0x1111111A */
+     82,  /* U+1930 - U+1937 : 0x11111A11 */
     116,  /* U+1938 - U+193F : 0x1111AAA1 */
     117,  /* U+1940 - U+1947 : 0x11991119 */
       1,  /* U+1948 - U+194F : 0x11111111 */
@@ -878,18 +878,18 @@ static PRUint8 gBidiCatIdx1[1664] = {
       9,  /* U+19F8 - U+19FF : 0x99999999 */
       1,  /* U+1A00 - U+1A07 : 0x11111111 */
       1,  /* U+1A08 - U+1A0F : 0x11111111 */
-     95,  /* U+1A10 - U+1A17 : 0xA1111111 */
-     84,  /* U+1A18 - U+1A1F : 0x1111111A */
+     94,  /* U+1A10 - U+1A17 : 0xA1111111 */
+     83,  /* U+1A18 - U+1A1F : 0x1111111A */
       1,  /* U+1A20 - U+1A27 : 0x11111111 */
       1,  /* U+1A28 - U+1A2F : 0x11111111 */
       1,  /* U+1A30 - U+1A37 : 0x11111111 */
       1,  /* U+1A38 - U+1A3F : 0x11111111 */
       1,  /* U+1A40 - U+1A47 : 0x11111111 */
       1,  /* U+1A48 - U+1A4F : 0x11111111 */
-     82,  /* U+1A50 - U+1A57 : 0x1A111111 */
-     96,  /* U+1A58 - U+1A5F : 0x1AAAAAAA */
+     81,  /* U+1A50 - U+1A57 : 0x1A111111 */
+     95,  /* U+1A58 - U+1A5F : 0x1AAAAAAA */
     119,  /* U+1A60 - U+1A67 : 0xAAA11A1A */
-    103,  /* U+1A68 - U+1A6F : 0x111AAAAA */
+    102,  /* U+1A68 - U+1A6F : 0x111AAAAA */
      37,  /* U+1A70 - U+1A77 : 0xAAAAA111 */
     120,  /* U+1A78 - U+1A7F : 0xA11AAAAA */
       1,  /* U+1A80 - U+1A87 : 0x11111111 */
@@ -916,7 +916,7 @@ static PRUint8 gBidiCatIdx1[1664] = {
       1,  /* U+1B28 - U+1B2F : 0x11111111 */
     121,  /* U+1B30 - U+1B37 : 0xAA1A1111 */
     122,  /* U+1B38 - U+1B3F : 0x111A1AAA */
-     83,  /* U+1B40 - U+1B47 : 0x11111A11 */
+     82,  /* U+1B40 - U+1B47 : 0x11111A11 */
       1,  /* U+1B48 - U+1B4F : 0x11111111 */
       1,  /* U+1B50 - U+1B57 : 0x11111111 */
       1,  /* U+1B58 - U+1B5F : 0x11111111 */
@@ -936,7 +936,7 @@ static PRUint8 gBidiCatIdx1[1664] = {
       1,  /* U+1BC8 - U+1BCF : 0x11111111 */
       1,  /* U+1BD0 - U+1BD7 : 0x11111111 */
       1,  /* U+1BD8 - U+1BDF : 0x11111111 */
-     82,  /* U+1BE0 - U+1BE7 : 0x1A111111 */
+     81,  /* U+1BE0 - U+1BE7 : 0x1A111111 */
     124,  /* U+1BE8 - U+1BEF : 0xA1A111AA */
      38,  /* U+1BF0 - U+1BF7 : 0x111111AA */
       1,  /* U+1BF8 - U+1BFF : 0x11111111 */
@@ -968,8 +968,8 @@ static PRUint8 gBidiCatIdx1[1664] = {
       1,  /* U+1CC8 - U+1CCF : 0x11111111 */
     127,  /* U+1CD0 - U+1CD7 : 0xAAAA1AAA */
      10,  /* U+1CD8 - U+1CDF : 0xAAAAAAAA */
-    104,  /* U+1CE0 - U+1CE7 : 0xAAAAAA1A */
-     67,  /* U+1CE8 - U+1CEF : 0x11A1111A */
+    103,  /* U+1CE0 - U+1CE7 : 0xAAAAAA1A */
+     66,  /* U+1CE8 - U+1CEF : 0x11A1111A */
       1,  /* U+1CF0 - U+1CF7 : 0x11111111 */
       1,  /* U+1CF8 - U+1CFF : 0x11111111 */
       1,  /* U+1D00 - U+1D07 : 0x11111111 */
@@ -1000,7 +1000,7 @@ static PRUint8 gBidiCatIdx1[1664] = {
      10,  /* U+1DC8 - U+1DCF : 0xAAAAAAAA */
      10,  /* U+1DD0 - U+1DD7 : 0xAAAAAAAA */
      10,  /* U+1DD8 - U+1DDF : 0xAAAAAAAA */
-     96,  /* U+1DE0 - U+1DE7 : 0x1AAAAAAA */
+     95,  /* U+1DE0 - U+1DE7 : 0x1AAAAAAA */
       1,  /* U+1DE8 - U+1DEF : 0x11111111 */
       1,  /* U+1DF0 - U+1DF7 : 0x11111111 */
     125,  /* U+1DF8 - U+1DFF : 0xAAAA1111 */
@@ -1060,7 +1060,7 @@ static PRUint8 gBidiCatIdx1[1664] = {
       1,  /* U+1FA8 - U+1FAF : 0x11111111 */
       1,  /* U+1FB0 - U+1FB7 : 0x11111111 */
     128,  /* U+1FB8 - U+1FBF : 0x91911111 */
-    108,  /* U+1FC0 - U+1FC7 : 0x11111199 */
+    107,  /* U+1FC0 - U+1FC7 : 0x11111199 */
      32,  /* U+1FC8 - U+1FCF : 0x99911111 */
       1,  /* U+1FD0 - U+1FD7 : 0x11111111 */
      32,  /* U+1FD8 - U+1FDF : 0x99911111 */
@@ -1098,10 +1098,10 @@ static PRUint8 gBidiCatIdx1[1664] = {
      10,  /* U+20D8 - U+20DF : 0xAAAAAAAA */
      10,  /* U+20E0 - U+20E7 : 0xAAAAAAAA */
      10,  /* U+20E8 - U+20EF : 0xAAAAAAAA */
-     84,  /* U+20F0 - U+20F7 : 0x1111111A */
+     83,  /* U+20F0 - U+20F7 : 0x1111111A */
       1,  /* U+20F8 - U+20FF : 0x11111111 */
     140,  /* U+2100 - U+2107 : 0x19999199 */
-    108,  /* U+2108 - U+210F : 0x11111199 */
+    107,  /* U+2108 - U+210F : 0x11111199 */
     141,  /* U+2110 - U+2117 : 0x99191111 */
     142,  /* U+2118 - U+211F : 0x99111119 */
     143,  /* U+2120 - U+2127 : 0x91919999 */
@@ -1200,7 +1200,7 @@ static PRUint8 gBidiCatIdx1[1664] = {
       9,  /* U+2408 - U+240F : 0x99999999 */
       9,  /* U+2410 - U+2417 : 0x99999999 */
       9,  /* U+2418 - U+241F : 0x99999999 */
-     90,  /* U+2420 - U+2427 : 0x19999999 */
+     89,  /* U+2420 - U+2427 : 0x19999999 */
       1,  /* U+2428 - U+242F : 0x11111111 */
       1,  /* U+2430 - U+2437 : 0x11111111 */
       1,  /* U+2438 - U+243F : 0x11111111 */
@@ -1431,7 +1431,7 @@ static PRUint8 gBidiCatIdx1[1664] = {
       9,  /* U+2B40 - U+2B47 : 0x99999999 */
     146,  /* U+2B48 - U+2B4F : 0x11199999 */
       9,  /* U+2B50 - U+2B57 : 0x99999999 */
-    108,  /* U+2B58 - U+2B5F : 0x11111199 */
+    107,  /* U+2B58 - U+2B5F : 0x11111199 */
       1,  /* U+2B60 - U+2B67 : 0x11111111 */
       1,  /* U+2B68 - U+2B6F : 0x11111111 */
       1,  /* U+2B70 - U+2B77 : 0x11111111 */
@@ -1499,7 +1499,7 @@ static PRUint8 gBidiCatIdx1[1664] = {
       1,  /* U+2D60 - U+2D67 : 0x11111111 */
       1,  /* U+2D68 - U+2D6F : 0x11111111 */
       1,  /* U+2D70 - U+2D77 : 0x11111111 */
-     95,  /* U+2D78 - U+2D7F : 0xA1111111 */
+     94,  /* U+2D78 - U+2D7F : 0xA1111111 */
       1,  /* U+2D80 - U+2D87 : 0x11111111 */
       1,  /* U+2D88 - U+2D8F : 0x11111111 */
       1,  /* U+2D90 - U+2D97 : 0x11111111 */
@@ -1522,7 +1522,7 @@ static PRUint8 gBidiCatIdx1[1664] = {
       9,  /* U+2E18 - U+2E1F : 0x99999999 */
       9,  /* U+2E20 - U+2E27 : 0x99999999 */
       9,  /* U+2E28 - U+2E2F : 0x99999999 */
-    108,  /* U+2E30 - U+2E37 : 0x11111199 */
+    107,  /* U+2E30 - U+2E37 : 0x11111199 */
       1,  /* U+2E38 - U+2E3F : 0x11111111 */
       1,  /* U+2E40 - U+2E47 : 0x11111111 */
       1,  /* U+2E48 - U+2E4F : 0x11111111 */
@@ -1874,7 +1874,7 @@ static PRUint8 gBidiCatIdx3[384] = {
       9,  /* U+A4A8 - U+A4AF : 0x99999999 */
       9,  /* U+A4B0 - U+A4B7 : 0x99999999 */
       9,  /* U+A4B8 - U+A4BF : 0x99999999 */
-     90,  /* U+A4C0 - U+A4C7 : 0x19999999 */
+     89,  /* U+A4C0 - U+A4C7 : 0x19999999 */
       1,  /* U+A4C8 - U+A4CF : 0x11111111 */
       1,  /* U+A4D0 - U+A4D7 : 0x11111111 */
       1,  /* U+A4D8 - U+A4DF : 0x11111111 */
@@ -1927,7 +1927,7 @@ static PRUint8 gBidiCatIdx3[384] = {
       1,  /* U+A650 - U+A657 : 0x11111111 */
       1,  /* U+A658 - U+A65F : 0x11111111 */
       1,  /* U+A660 - U+A667 : 0x11111111 */
-     95,  /* U+A668 - U+A66F : 0xA1111111 */
+     94,  /* U+A668 - U+A66F : 0xA1111111 */
     166,  /* U+A670 - U+A677 : 0x11119AAA */
     167,  /* U+A678 - U+A67F : 0x99AA1111 */
       1,  /* U+A680 - U+A687 : 0x11111111 */
@@ -1950,7 +1950,7 @@ static PRUint8 gBidiCatIdx3[384] = {
       9,  /* U+A708 - U+A70F : 0x99999999 */
       9,  /* U+A710 - U+A717 : 0x99999999 */
       9,  /* U+A718 - U+A71F : 0x99999999 */
-    108,  /* U+A720 - U+A727 : 0x11111199 */
+    107,  /* U+A720 - U+A727 : 0x11111199 */
       1,  /* U+A728 - U+A72F : 0x11111111 */
       1,  /* U+A730 - U+A737 : 0x11111111 */
       1,  /* U+A738 - U+A73F : 0x11111111 */
@@ -1982,7 +1982,7 @@ static PRUint8 gBidiCatIdx3[384] = {
     169,  /* U+A808 - U+A80F : 0x1111A111 */
       1,  /* U+A810 - U+A817 : 0x11111111 */
       1,  /* U+A818 - U+A81F : 0x11111111 */
-     89,  /* U+A820 - U+A827 : 0x1AA11111 */
+     88,  /* U+A820 - U+A827 : 0x1AA11111 */
     152,  /* U+A828 - U+A82F : 0x11119999 */
       1,  /* U+A830 - U+A837 : 0x11111111 */
     139,  /* U+A838 - U+A83F : 0x11111177 */
@@ -2002,7 +2002,7 @@ static PRUint8 gBidiCatIdx3[384] = {
       1,  /* U+A8A8 - U+A8AF : 0x11111111 */
       1,  /* U+A8B0 - U+A8B7 : 0x11111111 */
       1,  /* U+A8B8 - U+A8BF : 0x11111111 */
-     70,  /* U+A8C0 - U+A8C7 : 0x111A1111 */
+     69,  /* U+A8C0 - U+A8C7 : 0x111A1111 */
       1,  /* U+A8C8 - U+A8CF : 0x11111111 */
       1,  /* U+A8D0 - U+A8D7 : 0x11111111 */
       1,  /* U+A8D8 - U+A8DF : 0x11111111 */
@@ -2014,11 +2014,11 @@ static PRUint8 gBidiCatIdx3[384] = {
       1,  /* U+A908 - U+A90F : 0x11111111 */
       1,  /* U+A910 - U+A917 : 0x11111111 */
       1,  /* U+A918 - U+A91F : 0x11111111 */
-     86,  /* U+A920 - U+A927 : 0xAA111111 */
-     98,  /* U+A928 - U+A92F : 0x11AAAAAA */
+     85,  /* U+A920 - U+A927 : 0xAA111111 */
+     97,  /* U+A928 - U+A92F : 0x11AAAAAA */
       1,  /* U+A930 - U+A937 : 0x11111111 */
       1,  /* U+A938 - U+A93F : 0x11111111 */
-     95,  /* U+A940 - U+A947 : 0xA1111111 */
+     94,  /* U+A940 - U+A947 : 0xA1111111 */
      10,  /* U+A948 - U+A94F : 0xAAAAAAAA */
      38,  /* U+A950 - U+A957 : 0x111111AA */
       1,  /* U+A958 - U+A95F : 0x11111111 */
@@ -2026,7 +2026,7 @@ static PRUint8 gBidiCatIdx3[384] = {
       1,  /* U+A968 - U+A96F : 0x11111111 */
       1,  /* U+A970 - U+A977 : 0x11111111 */
       1,  /* U+A978 - U+A97F : 0x11111111 */
-     64,  /* U+A980 - U+A987 : 0x11111AAA */
+     63,  /* U+A980 - U+A987 : 0x11111AAA */
       1,  /* U+A988 - U+A98F : 0x11111111 */
       1,  /* U+A990 - U+A997 : 0x11111111 */
       1,  /* U+A998 - U+A99F : 0x11111111 */
@@ -2048,10 +2048,10 @@ static PRUint8 gBidiCatIdx3[384] = {
       1,  /* U+AA18 - U+AA1F : 0x11111111 */
       1,  /* U+AA20 - U+AA27 : 0x11111111 */
     172,  /* U+AA28 - U+AA2F : 0x1AAAAAA1 */
-    105,  /* U+AA30 - U+AA37 : 0x1AA11AA1 */
+    104,  /* U+AA30 - U+AA37 : 0x1AA11AA1 */
       1,  /* U+AA38 - U+AA3F : 0x11111111 */
     169,  /* U+AA40 - U+AA47 : 0x1111A111 */
-     70,  /* U+AA48 - U+AA4F : 0x111A1111 */
+     69,  /* U+AA48 - U+AA4F : 0x111A1111 */
       1,  /* U+AA50 - U+AA57 : 0x11111111 */
       1,  /* U+AA58 - U+AA5F : 0x11111111 */
       1,  /* U+AA60 - U+AA67 : 0x11111111 */
@@ -2065,8 +2065,8 @@ static PRUint8 gBidiCatIdx3[384] = {
       1,  /* U+AAA0 - U+AAA7 : 0x11111111 */
       1,  /* U+AAA8 - U+AAAF : 0x11111111 */
     173,  /* U+AAB0 - U+AAB7 : 0xA11AAA1A */
-     87,  /* U+AAB8 - U+AABF : 0xAA11111A */
-     69,  /* U+AAC0 - U+AAC7 : 0x111111A1 */
+     86,  /* U+AAB8 - U+AABF : 0xAA11111A */
+     68,  /* U+AAC0 - U+AAC7 : 0x111111A1 */
       1,  /* U+AAC8 - U+AACF : 0x11111111 */
       1,  /* U+AAD0 - U+AAD7 : 0x11111111 */
       1,  /* U+AAD8 - U+AADF : 0x11111111 */
@@ -2102,8 +2102,8 @@ static PRUint8 gBidiCatIdx3[384] = {
       1,  /* U+ABC8 - U+ABCF : 0x11111111 */
       1,  /* U+ABD0 - U+ABD7 : 0x11111111 */
       1,  /* U+ABD8 - U+ABDF : 0x11111111 */
-     72,  /* U+ABE0 - U+ABE7 : 0x11A11111 */
-     67,  /* U+ABE8 - U+ABEF : 0x11A1111A */
+     71,  /* U+ABE0 - U+ABE7 : 0x11A11111 */
+     66,  /* U+ABE8 - U+ABEF : 0x11A1111A */
       1,  /* U+ABF0 - U+ABF7 : 0x11111111 */
       1,  /* U+ABF8 - U+ABFF : 0x11111111 */
 };
@@ -2285,8 +2285,8 @@ static PRUint8 gBidiCatIdx5[276] = {
      10,  /* U+FE00 - U+FE07 : 0xAAAAAAAA */
      10,  /* U+FE08 - U+FE0F : 0xAAAAAAAA */
       9,  /* U+FE10 - U+FE17 : 0x99999999 */
-    108,  /* U+FE18 - U+FE1F : 0x11111199 */
-     96,  /* U+FE20 - U+FE27 : 0x1AAAAAAA */
+    107,  /* U+FE18 - U+FE1F : 0x11111199 */
+     95,  /* U+FE20 - U+FE27 : 0x1AAAAAAA */
       1,  /* U+FE28 - U+FE2F : 0x11111111 */
       9,  /* U+FE30 - U+FE37 : 0x99999999 */
       9,  /* U+FE38 - U+FE3F : 0x99999999 */
@@ -2343,7 +2343,7 @@ static PRUint8 gBidiCatIdx5[276] = {
       1,  /* U+FFD0 - U+FFD7 : 0x11111111 */
       1,  /* U+FFD8 - U+FFDF : 0x11111111 */
     184,  /* U+FFE0 - U+FFE7 : 0x17799977 */
-     90,  /* U+FFE8 - U+FFEF : 0x19999999 */
+     89,  /* U+FFE8 - U+FFEF : 0x19999999 */
       1,  /* U+FFF0 - U+FFF7 : 0x11111111 */
     185,  /* U+FFF8 - U+FFFF : 0x11999991 */
       1,  /* U+10000 - U+10007 : 0x11111111 */
@@ -2406,7 +2406,7 @@ static PRUint8 gBidiCatIdx6[6] = {
       1,  /* U+101E0 - U+101E7 : 0x11111111 */
       1,  /* U+101E8 - U+101EF : 0x11111111 */
       1,  /* U+101F0 - U+101F7 : 0x11111111 */
-     72,  /* U+101F8 - U+101FF : 0x11A11111 */
+     71,  /* U+101F8 - U+101FF : 0x11A11111 */
 };
 
 static PRUint8 gBidiCatIdx7[80] = {
@@ -2577,7 +2577,7 @@ static PRUint8 gBidiCatIdx13[4] = {
 };
 
 static PRUint8 gBidiCatIdx14[26] = {
-     69,  /* U+11000 - U+11007 : 0x111111A1 */
+     68,  /* U+11000 - U+11007 : 0x111111A1 */
       1,  /* U+11008 - U+1100F : 0x11111111 */
       1,  /* U+11010 - U+11017 : 0x11111111 */
       1,  /* U+11018 - U+1101F : 0x11111111 */
@@ -2585,7 +2585,7 @@ static PRUint8 gBidiCatIdx14[26] = {
       1,  /* U+11028 - U+1102F : 0x11111111 */
       1,  /* U+11030 - U+11037 : 0x11111111 */
      10,  /* U+11038 - U+1103F : 0xAAAAAAAA */
-     96,  /* U+11040 - U+11047 : 0x1AAAAAAA */
+     95,  /* U+11040 - U+11047 : 0x1AAAAAAA */
       1,  /* U+11048 - U+1104F : 0x11111111 */
      31,  /* U+11050 - U+11057 : 0x99999911 */
       9,  /* U+11058 - U+1105F : 0x99999999 */
@@ -2600,7 +2600,7 @@ static PRUint8 gBidiCatIdx14[26] = {
       1,  /* U+110A0 - U+110A7 : 0x11111111 */
       1,  /* U+110A8 - U+110AF : 0x11111111 */
     192,  /* U+110B0 - U+110B7 : 0x1AAAA111 */
-     75,  /* U+110B8 - U+110BF : 0x11111AA1 */
+     74,  /* U+110B8 - U+110BF : 0x11111AA1 */
       1,  /* U+110C0 - U+110C7 : 0x11111111 */
       1,  /* U+110C8 - U+110CF : 0x11111111 */
 };
@@ -3014,7 +3014,7 @@ static PRUint8 gBidiCatIdx19[256] = {
       1,  /* U+1D148 - U+1D14F : 0x11111111 */
       1,  /* U+1D150 - U+1D157 : 0x11111111 */
       1,  /* U+1D158 - U+1D15F : 0x11111111 */
-     95,  /* U+1D160 - U+1D167 : 0xA1111111 */
+     94,  /* U+1D160 - U+1D167 : 0xA1111111 */
      38,  /* U+1D168 - U+1D16F : 0x111111AA */
     193,  /* U+1D170 - U+1D177 : 0xBBBBB111 */
     194,  /* U+1D178 - U+1D17F : 0xAAAAABBB */
@@ -3076,7 +3076,7 @@ static PRUint8 gBidiCatIdx19[256] = {
       9,  /* U+1D338 - U+1D33F : 0x99999999 */
       9,  /* U+1D340 - U+1D347 : 0x99999999 */
       9,  /* U+1D348 - U+1D34F : 0x99999999 */
-     90,  /* U+1D350 - U+1D357 : 0x19999999 */
+     89,  /* U+1D350 - U+1D357 : 0x19999999 */
       1,  /* U+1D358 - U+1D35F : 0x11111111 */
       1,  /* U+1D360 - U+1D367 : 0x11111111 */
       1,  /* U+1D368 - U+1D36F : 0x11111111 */
@@ -3250,9 +3250,9 @@ static PRUint8 gBidiCatIdx20[240] = {
     152,  /* U+1F090 - U+1F097 : 0x11119999 */
       1,  /* U+1F098 - U+1F09F : 0x11111111 */
       9,  /* U+1F0A0 - U+1F0A7 : 0x99999999 */
-     90,  /* U+1F0A8 - U+1F0AF : 0x19999999 */
+     89,  /* U+1F0A8 - U+1F0AF : 0x19999999 */
     156,  /* U+1F0B0 - U+1F0B7 : 0x99999991 */
-     90,  /* U+1F0B8 - U+1F0BF : 0x19999999 */
+     89,  /* U+1F0B8 - U+1F0BF : 0x19999999 */
     156,  /* U+1F0C0 - U+1F0C7 : 0x99999991 */
       9,  /* U+1F0C8 - U+1F0CF : 0x99999999 */
     156,  /* U+1F0D0 - U+1F0D7 : 0x99999991 */
@@ -3364,7 +3364,7 @@ static PRUint8 gBidiCatIdx20[240] = {
       9,  /* U+1F420 - U+1F427 : 0x99999999 */
       9,  /* U+1F428 - U+1F42F : 0x99999999 */
       9,  /* U+1F430 - U+1F437 : 0x99999999 */
-     90,  /* U+1F438 - U+1F43F : 0x19999999 */
+     89,  /* U+1F438 - U+1F43F : 0x19999999 */
     200,  /* U+1F440 - U+1F447 : 0x99999919 */
       9,  /* U+1F448 - U+1F44F : 0x99999999 */
       9,  /* U+1F450 - U+1F457 : 0x99999999 */
@@ -3664,64 +3664,64 @@ static PRUint32 gBidiCatPat[207] = {
     0xA33AAAAA,  /* 51 */
     0x33AAAA9A,  /* 52 */
     0x33333355,  /* 53 */
-    0x43333333,  /* 54 */
-    0x333333A3,  /* 55 */
-    0xAAAAA222,  /* 56 */
-    0x9922AAAA,  /* 57 */
-    0x22222299,  /* 58 */
-    0xAA222222,  /* 59 */
-    0xAAAAA2AA,  /* 60 */
-    0xAAA2AAAA,  /* 61 */
-    0x22AAAAA2,  /* 62 */
-    0x2222AAA2,  /* 63 */
-    0x11111AAA,  /* 64 */
-    0x111A1A11,  /* 65 */
-    0xAAAAAAA1,  /* 66 */
-    0x11A1111A,  /* 67 */
-    0x1111AA11,  /* 68 */
-    0x111111A1,  /* 69 */
-    0x111A1111,  /* 70 */
-    0x111AAAA1,  /* 71 */
-    0x11A11111,  /* 72 */
-    0x11117711,  /* 73 */
-    0x11117111,  /* 74 */
-    0x11111AA1,  /* 75 */
-    0xA1111AA1,  /* 76 */
-    0x11AAA11A,  /* 77 */
-    0x11A111AA,  /* 78 */
-    0xA1AAAAA1,  /* 79 */
-    0x11111171,  /* 80 */
-    0xA11A1111,  /* 81 */
-    0x1A111111,  /* 82 */
-    0x11111A11,  /* 83 */
-    0x1111111A,  /* 84 */
-    0x11111979,  /* 85 */
-    0xAA111111,  /* 86 */
-    0xAA11111A,  /* 87 */
-    0x11AAAA1A,  /* 88 */
-    0x1AA11111,  /* 89 */
-    0x19999999,  /* 90 */
-    0x11AA1111,  /* 91 */
-    0x1A1AAA11,  /* 92 */
-    0xAAAA11A1,  /* 93 */
-    0x71111AAA,  /* 94 */
-    0xA1111111,  /* 95 */
-    0x1AAAAAAA,  /* 96 */
-    0x111AA1AA,  /* 97 */
-    0x11AAAAAA,  /* 98 */
-    0xA1A11111,  /* 99 */
-    0x119999A1,  /* 100 */
-    0xAA1AAAAA,  /* 101 */
-    0xAAA11111,  /* 102 */
-    0x111AAAAA,  /* 103 */
-    0xAAAAAA1A,  /* 104 */
-    0x1AA11AA1,  /* 105 */
-    0xAA1111AA,  /* 106 */
-    0x1AA11A11,  /* 107 */
-    0x11111199,  /* 108 */
-    0x1111111E,  /* 109 */
-    0x11199111,  /* 110 */
-    0x111AAA11,  /* 111 */
+    0x333333A3,  /* 54 */
+    0xAAAAA222,  /* 55 */
+    0x9922AAAA,  /* 56 */
+    0x22222299,  /* 57 */
+    0xAA222222,  /* 58 */
+    0xAAAAA2AA,  /* 59 */
+    0xAAA2AAAA,  /* 60 */
+    0x22AAAAA2,  /* 61 */
+    0x2222AAA2,  /* 62 */
+    0x11111AAA,  /* 63 */
+    0x111A1A11,  /* 64 */
+    0xAAAAAAA1,  /* 65 */
+    0x11A1111A,  /* 66 */
+    0x1111AA11,  /* 67 */
+    0x111111A1,  /* 68 */
+    0x111A1111,  /* 69 */
+    0x111AAAA1,  /* 70 */
+    0x11A11111,  /* 71 */
+    0x11117711,  /* 72 */
+    0x11117111,  /* 73 */
+    0x11111AA1,  /* 74 */
+    0xA1111AA1,  /* 75 */
+    0x11AAA11A,  /* 76 */
+    0x11A111AA,  /* 77 */
+    0xA1AAAAA1,  /* 78 */
+    0x11111171,  /* 79 */
+    0xA11A1111,  /* 80 */
+    0x1A111111,  /* 81 */
+    0x11111A11,  /* 82 */
+    0x1111111A,  /* 83 */
+    0x11111979,  /* 84 */
+    0xAA111111,  /* 85 */
+    0xAA11111A,  /* 86 */
+    0x11AAAA1A,  /* 87 */
+    0x1AA11111,  /* 88 */
+    0x19999999,  /* 89 */
+    0x11AA1111,  /* 90 */
+    0x1A1AAA11,  /* 91 */
+    0xAAAA11A1,  /* 92 */
+    0x71111AAA,  /* 93 */
+    0xA1111111,  /* 94 */
+    0x1AAAAAAA,  /* 95 */
+    0x111AA1AA,  /* 96 */
+    0x11AAAAAA,  /* 97 */
+    0xA1A11111,  /* 98 */
+    0x119999A1,  /* 99 */
+    0xAA1AAAAA,  /* 100 */
+    0xAAA11111,  /* 101 */
+    0x111AAAAA,  /* 102 */
+    0xAAAAAA1A,  /* 103 */
+    0x1AA11AA1,  /* 104 */
+    0xAA1111AA,  /* 105 */
+    0x1AA11A11,  /* 106 */
+    0x11111199,  /* 107 */
+    0x1111111E,  /* 108 */
+    0x11199111,  /* 109 */
+    0x111AAA11,  /* 110 */
+    0xA1AA1111,  /* 111 */
     0x1111AAAA,  /* 112 */
     0x11A17111,  /* 113 */
     0x1EAAA999,  /* 114 */
diff --git a/ipc/glue/AsyncChannel.cpp b/ipc/glue/AsyncChannel.cpp
index ab3528066f92..8bdf9b13243a 100644
--- a/ipc/glue/AsyncChannel.cpp
+++ b/ipc/glue/AsyncChannel.cpp
@@ -464,6 +464,14 @@ AsyncChannel::OnChannelOpened()
     /*assert*/mTransport->Connect();
 }
 
+void
+AsyncChannel::DispatchOnChannelConnected(int32 peer_pid)
+{
+    AssertWorkerThread();
+    if (mListener)
+        mListener->OnChannelConnected(peer_pid);
+}
+
 void
 AsyncChannel::OnChannelConnected(int32 peer_pid)
 {
@@ -477,6 +485,10 @@ AsyncChannel::OnChannelConnected(int32 peer_pid)
 
     if(mExistingListener)
         mExistingListener->OnChannelConnected(peer_pid);
+
+    mWorkerLoop->PostTask(FROM_HERE, NewRunnableMethod(this, 
+                                                       &AsyncChannel::DispatchOnChannelConnected, 
+                                                       peer_pid));
 }
 
 void
diff --git a/ipc/glue/AsyncChannel.h b/ipc/glue/AsyncChannel.h
index 4c24fdf1e252..3f2feb689247 100644
--- a/ipc/glue/AsyncChannel.h
+++ b/ipc/glue/AsyncChannel.h
@@ -95,6 +95,7 @@ public:
         virtual void OnChannelError() = 0;
         virtual Result OnMessageReceived(const Message& aMessage) = 0;
         virtual void OnProcessingError(Result aError) = 0;
+        virtual void OnChannelConnected(int32 peer_pid) {};
     };
 
 public:
@@ -117,6 +118,9 @@ public:
     // Asynchronously send a message to the other side of the channel
     virtual bool Send(Message* msg);
 
+    // Send OnChannelConnected notification to listeners.
+    void DispatchOnChannelConnected(int32 peer_pid);
+
     //
     // These methods are called on the "IO" thread
     //
diff --git a/ipc/glue/RPCChannel.h b/ipc/glue/RPCChannel.h
index a7826e93a657..86be780e72fa 100644
--- a/ipc/glue/RPCChannel.h
+++ b/ipc/glue/RPCChannel.h
@@ -84,6 +84,7 @@ public:
                                          Message*& aReply) = 0;
         virtual Result OnCallReceived(const Message& aMessage,
                                       Message*& aReply) = 0;
+        virtual void OnChannelConnected(int32 peer_pid) {};
 
         virtual void OnEnteredCxxStack()
         {
diff --git a/ipc/glue/SyncChannel.h b/ipc/glue/SyncChannel.h
index f221692d58d9..35719bfc9ddf 100644
--- a/ipc/glue/SyncChannel.h
+++ b/ipc/glue/SyncChannel.h
@@ -67,6 +67,7 @@ public:
         virtual bool OnReplyTimeout() = 0;
         virtual Result OnMessageReceived(const Message& aMessage,
                                          Message*& aReply) = 0;
+        virtual void OnChannelConnected(int32 peer_pid) {};
     };
 
     SyncChannel(SyncListener* aListener);
diff --git a/ipc/ipdl/ipdl/lower.py b/ipc/ipdl/ipdl/lower.py
index 4c94f6924ba5..b63553050825 100644
--- a/ipc/ipdl/ipdl/lower.py
+++ b/ipc/ipdl/ipdl/lower.py
@@ -2816,6 +2816,13 @@ class _GenerateProtocolActorCode(ipdl.ast.Visitor):
                 _runtimeAbort("`OnError' called on non-toplevel actor"))
         self.cls.addstmts([ onerror, Whitespace.NL ])
 
+        # OnChannelConnected()
+        onconnected = MethodDefn(MethodDecl('OnChannelConnected'))
+        if not ptype.isToplevel():
+            onconnected.addstmt(
+                _runtimeAbort("'OnConnected' called on non-toplevel actor"))
+
+        self.cls.addstmts([ onconnected, Whitespace.NL ])
         # FIXME/bug 535053: only manager protocols and non-manager
         # protocols with union types need Lookup().  we'll give it to
         # all for the time being (simpler)
@@ -2844,6 +2851,16 @@ class _GenerateProtocolActorCode(ipdl.ast.Visitor):
             self.cls.addstmts([ processnative, Whitespace.NL ])
 
         if ptype.isToplevel() and self.side is 'parent':
+            ## void SetOtherProcess(ProcessHandle pid)
+            otherprocessvar = ExprVar('aOtherProcess')
+            setotherprocess = MethodDefn(MethodDecl(
+                    'SetOtherProcess',
+                    params=[ Decl(Type('ProcessHandle'), otherprocessvar.name)]))
+            setotherprocess.addstmt(StmtExpr(ExprAssn(p.otherProcessVar(), otherprocessvar)))
+            self.cls.addstmts([
+                    setotherprocess,
+                    Whitespace.NL])
+
             ## bool GetMinidump(nsIFile** dump)
             self.cls.addstmt(Label.PROTECTED)
 
diff --git a/js/jetpack/JetpackActorCommon.cpp b/js/jetpack/JetpackActorCommon.cpp
index bc070e5f6672..b95b62e2a5aa 100644
--- a/js/jetpack/JetpackActorCommon.cpp
+++ b/js/jetpack/JetpackActorCommon.cpp
@@ -533,8 +533,7 @@ JetpackActorCommon::RegisterReceiver(JSContext* cx,
                                      const nsString& messageName,
                                      jsval receiver)
 {
-  if (!JSVAL_IS_OBJECT(receiver) ||
-      !JS_ObjectIsFunction(cx, JSVAL_TO_OBJECT(receiver)))
+  if (JS_TypeOfValue(cx, receiver) != JSTYPE_FUNCTION)
     return NS_ERROR_INVALID_ARG;
 
   RecList* list;
diff --git a/js/jetpack/JetpackChild.cpp b/js/jetpack/JetpackChild.cpp
index f714f71cb032..bd47fe0d4f63 100644
--- a/js/jetpack/JetpackChild.cpp
+++ b/js/jetpack/JetpackChild.cpp
@@ -42,6 +42,7 @@
 
 #include "mozilla/jetpack/JetpackChild.h"
 #include "mozilla/jetpack/Handle.h"
+#include "mozilla/IntentionalCrash.h"
 
 #include "jsarray.h"
 
@@ -75,6 +76,8 @@ JetpackChild::sImplMethods[] = {
 #ifdef JS_GC_ZEAL
   JS_FN("gczeal", GCZeal, 1, IMPL_METHOD_FLAGS),
 #endif
+  JS_FN("_noteIntentionalCrash", NoteIntentionalCrash, 0,
+        IMPL_METHOD_FLAGS),
   JS_FS_END
 };
 
@@ -358,9 +361,7 @@ ReceiverCommon(JSContext* cx, uintN argc, jsval* vp,
   if (arity < 2)
     return JS_TRUE;
 
-  if (!JSVAL_IS_OBJECT(argv[1]) ||
-      !JS_ObjectIsFunction(cx, JSVAL_TO_OBJECT(argv[1])))
-  {
+  if (JS_TypeOfValue(cx, argv[1]) != JSTYPE_FUNCTION) {
     JS_ReportError(cx, "%s expects a function as its second argument",
                    methodName);
     return JS_FALSE;
@@ -563,5 +564,12 @@ JetpackChild::GCZeal(JSContext* cx, uintN argc, jsval *vp)
 }
 #endif
 
+JSBool
+JetpackChild::NoteIntentionalCrash(JSContext* cx, uintN argc, jsval *vp)
+{
+  mozilla::NoteIntentionalCrash("jetpack");
+  return JS_TRUE;
+}
+
 } // namespace jetpack
 } // namespace mozilla
diff --git a/js/jetpack/JetpackChild.h b/js/jetpack/JetpackChild.h
index 933762a3e722..ab539c036402 100644
--- a/js/jetpack/JetpackChild.h
+++ b/js/jetpack/JetpackChild.h
@@ -93,6 +93,7 @@ private:
 #ifdef JS_GC_ZEAL
   static JSBool GCZeal(JSContext* cx, uintN argc, jsval *vp);
 #endif
+  static JSBool NoteIntentionalCrash(JSContext* cx, uintN argc, jsval *vp);
 
   static void ReportError(JSContext* cx, const char* message,
                           JSErrorReport* report);
diff --git a/js/jetpack/JetpackParent.cpp b/js/jetpack/JetpackParent.cpp
index 1bda1af512a3..cad8a253ba72 100644
--- a/js/jetpack/JetpackParent.cpp
+++ b/js/jetpack/JetpackParent.cpp
@@ -37,6 +37,7 @@
 
 #include "mozilla/jetpack/JetpackParent.h"
 #include "mozilla/jetpack/Handle.h"
+#include "base/process_util.h"
 
 #include "nsIURI.h"
 #include "nsNetUtil.h"
@@ -44,12 +45,17 @@
 #include "nsIXPConnect.h"
 #include "nsIJSContextStack.h"
 
+#ifdef MOZ_CRASHREPORTER
+#include "nsExceptionHandler.h"
+#endif
+
 namespace mozilla {
 namespace jetpack {
 
 JetpackParent::JetpackParent(JSContext* cx)
   : mSubprocess(new JetpackProcessParent())
   , mContext(cx)
+  , mTaskFactory(this)
 {
   mSubprocess->Launch();
   Open(mSubprocess->GetChannel(),
@@ -60,6 +66,9 @@ JetpackParent::~JetpackParent()
 {
   if (mSubprocess)
     Destroy();
+
+  if (OtherProcess())
+    base::CloseProcessHandle(OtherProcess());
 }
 
 NS_IMPL_ISUPPORTS1(JetpackParent, nsIJetpack)
@@ -148,6 +157,7 @@ public:
   AutoCXPusher(JSContext* cx)
     : mCXStack(do_GetService("@mozilla.org/js/xpc/ContextStack;1"))
   {
+    NS_ASSERTION(mCXStack, "No JS context stack?");
     if (mCXStack)
       mCXStack->Push(cx);
   }
@@ -162,6 +172,39 @@ private:
   JSContext* mCX;
 };
 
+void
+JetpackParent::ActorDestroy(ActorDestroyReason why)
+{
+  switch (why) {
+    case AbnormalShutdown: {
+      nsAutoString dumpID;
+
+#ifdef MOZ_CRASHREPORTER
+      nsCOMPtr<nsILocalFile> crashDump;
+      TakeMinidump(getter_AddRefs(crashDump)) &&
+        CrashReporter::GetIDFromMinidump(crashDump, dumpID);
+#endif
+
+      MessageLoop::current()->
+        PostTask(FROM_HERE,
+                 mTaskFactory.NewRunnableMethod(
+                   &JetpackParent::DispatchFailureMessage,
+                   dumpID));
+      break;
+    }
+
+    case NormalShutdown:
+      break;
+
+    default:
+      NS_ERROR("Unexpected actordestroy reason for toplevel actor.");
+  }  
+
+  XRE_GetIOMessageLoop()
+    ->PostTask(FROM_HERE, new DeleteTask<JetpackProcessParent>(mSubprocess));
+  mSubprocess = NULL;
+}
+
 bool
 JetpackParent::RecvSendMessage(const nsString& messageName,
                                const InfallibleTArray<Variant>& data)
@@ -218,13 +261,12 @@ JetpackParent::CreateHandle(nsIVariant** aResult)
 NS_IMETHODIMP
 JetpackParent::Destroy()
 {
-  if (!mSubprocess)
-    return NS_ERROR_NOT_INITIALIZED;
+  if (mSubprocess)
+    Close();
 
-  Close();
-  XRE_GetIOMessageLoop()
-    ->PostTask(FROM_HERE, new DeleteTask<JetpackProcessParent>(mSubprocess));
-  mSubprocess = NULL;
+  NS_ASSERTION(!mSubprocess, "ActorDestroy should have been called.");
+
+  ClearReceivers();
 
   return NS_OK;
 }
@@ -242,5 +284,30 @@ JetpackParent::DeallocPHandle(PHandleParent* actor)
   return true;
 }
 
+void
+JetpackParent::OnChannelConnected(int32 pid) 
+{
+  ProcessHandle handle;
+  if (!base::OpenPrivilegedProcessHandle(pid, &handle))
+    NS_RUNTIMEABORT("can't open handle to child process");
+
+  SetOtherProcess(handle);
+}
+
+void
+JetpackParent::DispatchFailureMessage(const nsString& aDumpID)
+{
+  KeyValue kv(NS_LITERAL_STRING("dumpID"), PrimVariant(aDumpID));
+  InfallibleTArray<KeyValue> keyvalues;
+  keyvalues.AppendElement(kv);
+
+  CompVariant object(keyvalues);
+
+  InfallibleTArray<Variant> arguments;
+  arguments.AppendElement(object);
+
+  RecvSendMessage(NS_LITERAL_STRING("core:process-error"), arguments);
+}
+
 } // namespace jetpack
 } // namespace mozilla
diff --git a/js/jetpack/JetpackParent.h b/js/jetpack/JetpackParent.h
index 7ea4a895142a..c39d6c526c2c 100644
--- a/js/jetpack/JetpackParent.h
+++ b/js/jetpack/JetpackParent.h
@@ -65,7 +65,11 @@ public:
   JetpackParent(JSContext* cx);
   ~JetpackParent();
 
+  void OnChannelConnected(int32 pid);
+
 protected:
+  NS_OVERRIDE virtual void ActorDestroy(ActorDestroyReason why);
+
   NS_OVERRIDE virtual bool RecvSendMessage(const nsString& messageName,
                                            const InfallibleTArray<Variant>& data);
   NS_OVERRIDE virtual bool AnswerCallMessage(const nsString& messageName,
@@ -78,6 +82,9 @@ protected:
 private:
   JetpackProcessParent* mSubprocess;
   JSContext* mContext;
+  ScopedRunnableMethodFactory<JetpackParent> mTaskFactory;
+
+  void DispatchFailureMessage(const nsString& aDumpID);
 
   DISALLOW_EVIL_CONSTRUCTORS(JetpackParent);
 };
diff --git a/js/jetpack/tests/Makefile.in b/js/jetpack/tests/Makefile.in
index 675206204b83..6794b6fb91f1 100644
--- a/js/jetpack/tests/Makefile.in
+++ b/js/jetpack/tests/Makefile.in
@@ -49,3 +49,12 @@ XPCSHELL_TESTS = unit
 
 include $(topsrcdir)/config/config.mk
 include $(topsrcdir)/config/rules.mk
+
+ifneq (cocoa,$(MOZ_WIDGET_TOOLKIT)) # Disabled for bug 599475
+MOCHICHROME_FILES = \
+  test_jetpack_crash.xul \
+  $(NULL)
+
+libs:: $(MOCHICHROME_FILES)
+	$(INSTALL) $^ $(DEPTH)/_tests/testing/mochitest/chrome/$(relativesrcdir)
+endif
diff --git a/js/jetpack/tests/test_jetpack_crash.xul b/js/jetpack/tests/test_jetpack_crash.xul
new file mode 100644
index 000000000000..ae5e4794cd91
--- /dev/null
+++ b/js/jetpack/tests/test_jetpack_crash.xul
@@ -0,0 +1,84 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css" ?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css" ?>
+
+<window title="Jetpack Crash Test"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript"
+          src="chrome://mochikit/content/MochiKit/packed.js" />
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js" />
+
+  <description id="remoteScript">
+  <![CDATA[
+  registerReceiver("testCTypes", function(name, libfile) {
+    var library = ctypes.open(libfile);
+    var zero = new ctypes.intptr_t(8);
+    _noteIntentionalCrash();
+    var badptr = ctypes.cast(zero, ctypes.PointerType(ctypes.int32_t));
+    sendMessage("testCTypes:response", badptr.contents); // should crash here!
+  });
+  ]]>
+  </description>
+
+  <script class="testbody" type="application/javascript">
+  <![CDATA[
+    Components.utils.import("resource://gre/modules/ctypes.jsm");
+    const libURL = "chrome://mochitests/content/chrome/libraries/" +
+      ctypes.libraryName("jsctypes-test");
+
+    SimpleTest.waitForExplicitFinish();
+
+    var jp = Components.classes["@mozilla.org/jetpack/service;1"].
+      getService(Components.interfaces.nsIJetpackService).
+      createJetpack();
+
+    jp.registerReceiver("core:exception", function(msgName, e) {
+      ok(false, "Received exception from remote code: " + uneval(e));
+    });
+
+    jp.registerReceiver("testCTypes:response", function(msgName, v) {
+      ok(false, "Should not have received testCTypes response!");
+      jp.destroy();
+      jp = null;
+      SimpleTest.finish();
+    });
+
+    jp.registerReceiver("core:process-error", function(msgName, e) {
+      ok(true, "Received process-error notification.");
+
+      if ('nsICrashReporter' in Components.interfaces)
+        ok(e.dumpID, "Process error has a dumpID");
+
+      jp.destroy();
+      jp = null;
+
+      SimpleTest.executeSoon(SimpleTest.finish);
+    });
+
+    var remoteScript = document.getElementById('remoteScript').textContent;
+    jp.evalScript(remoteScript);
+
+    var downloadObserver = {
+      onDownloadComplete: function(downloader, request, cx, status, file) {
+        Components.utils.reportError("download status: " + status);
+        try {
+          file.permission = 0700;
+        }
+        catch (e) {
+          Components.utils.reportError(e);
+        }
+        jp.sendMessage('testCTypes', file.path);
+      }
+    };
+    var downloader = Components.classes["@mozilla.org/network/downloader;1"].
+      createInstance(Components.interfaces.nsIDownloader);
+    downloader.init(downloadObserver, null);
+    var channel = Components.classes["@mozilla.org/network/io-service;1"].
+      getService(Components.interfaces.nsIIOService).
+      newChannel(libURL, null, null);
+    channel.asyncOpen(downloader, null);
+  ]]>
+  </script>
+</window>
diff --git a/js/jetpack/tests/unit/test_jetpack_sandbox.js b/js/jetpack/tests/unit/test_jetpack_sandbox.js
new file mode 100644
index 000000000000..127b1e378ea5
--- /dev/null
+++ b/js/jetpack/tests/unit/test_jetpack_sandbox.js
@@ -0,0 +1,19 @@
+function run_test() {
+    var jetpack = createJetpack({ scriptFile: do_get_file("impl.js") });
+  
+  var sandbox = Components.utils.Sandbox("about:blank");
+  function registerReceiver(name, fn) {
+    jetpack.registerReceiver(name, fn);
+  }
+  sandbox.registerReceiver = registerReceiver;
+  sandbox.echoed = function(message, arg) {
+    do_check_eq(message, "echo");
+    do_check_eq(arg, "testdata");
+    jetpack.destroy();
+    sandbox = null;
+    do_test_finished();
+  };
+  Components.utils.evalInSandbox("registerReceiver('echo', function(message, arg){ echoed(message, arg); });", sandbox);
+  jetpack.sendMessage("echo", "testdata");
+  do_test_pending();
+}
diff --git a/js/src/config/config.mk b/js/src/config/config.mk
index 95232c01bfdc..85698d62fb1b 100644
--- a/js/src/config/config.mk
+++ b/js/src/config/config.mk
@@ -162,6 +162,11 @@ MOZ_WIDGET_SUPPORT_LIBS    = $(DIST)/lib/$(LIB_PREFIX)widgetsupport_s.$(LIB_SUFF
 ifdef MOZ_MEMORY
 ifneq (,$(filter-out WINNT WINCE,$(OS_ARCH)))
 JEMALLOC_LIBS = $(MKSHLIB_FORCE_ALL) $(call EXPAND_MOZLIBNAME,jemalloc) $(MKSHLIB_UNFORCE_ALL)
+# If we are linking jemalloc into a program, we want the jemalloc symbols
+# to be exported
+ifneq (,$(SIMPLE_PROGRAMS)$(PROGRAM))
+JEMALLOC_LIBS += $(MOZ_JEMALLOC_STANDALONE_GLUE_LDOPTS)
+endif
 endif
 endif
 
diff --git a/js/src/configure.in b/js/src/configure.in
index e5d8c24e6960..3c546942e6e6 100644
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -2389,7 +2389,7 @@ ia64*-hpux*)
         LIBXUL_LIBS='$(LIBXUL_DIST)/lib/xpcom.lib $(LIBXUL_DIST)/lib/xul.lib $(LIBXUL_DIST)/lib/mozalloc.lib'
         MOZ_COMPONENT_NSPR_LIBS='$(NSPR_LIBS)'
         if test $_MSC_VER -ge 1400; then
-            LDFLAGS="$LDFLAGS -NXCOMPAT"
+            LDFLAGS="$LDFLAGS -LARGEADDRESSAWARE -NXCOMPAT"
             dnl For profile-guided optimization
             PROFILE_GEN_CFLAGS="-GL"
             PROFILE_GEN_LDFLAGS="-LTCG:PGINSTRUMENT"
@@ -4643,6 +4643,16 @@ if test -n "$MOZ_THUMB2"; then
       AC_MSG_ERROR([--enable-thumb2 is not supported for non-ARM CPU architectures])
     ;;
   esac
+else
+  case "$target_cpu" in
+    arm*)
+      if test "$GNU_CC"; then
+       CFLAGS="$CFLAGS -march=armv5te -mthumb-interwork -Wa, -march=armv5te -Wa, -mthumb-interwork"
+        CXXFLAGS="$CXXFLAGS -march=armv5te -mthumb-interwork -Wa, -march=armv5te -Wa, -mthumb-interwork"
+        ASFLAGS="$ASFLAGS -march=armv5te -mthumb-interwork"
+      fi
+      ;;
+  esac
 fi
 
 AC_SUBST(MOZ_THUMB2)
diff --git a/js/src/jscntxt.cpp b/js/src/jscntxt.cpp
index 0669532e3c56..c0593c0bb0a8 100644
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -46,6 +46,7 @@
 #include <stdlib.h>
 #include <string.h>
 #ifdef ANDROID
+# include <android/log.h>
 # include <fstream>
 # include <string>
 #endif  // ANDROID
@@ -2219,8 +2220,23 @@ ComputeIsJITBroken()
         return false;
     }
 
-    bool broken = false;
     std::string line;
+
+    // Check for the known-bad kernel version (2.6.29).
+    std::ifstream osrelease("/proc/sys/kernel/osrelease");
+    std::getline(osrelease, line);
+    __android_log_print(ANDROID_LOG_INFO, "Gecko", "Detected osrelease `%s'",
+                        line.c_str());
+
+    if (line.npos == line.find("2.6.29")) {
+        // We're using something other than 2.6.29, so the JITs should work.
+        __android_log_print(ANDROID_LOG_INFO, "Gecko", "JITs are not broken");
+        return false;
+    }
+
+    // We're using 2.6.29, and this causes trouble with the JITs on i9000.
+    line = "";
+    bool broken = false;
     std::ifstream cpuinfo("/proc/cpuinfo");
     do {
         if (0 == line.find("Hardware")) {
@@ -2234,6 +2250,8 @@ ComputeIsJITBroken()
             };
             for (const char** hw = &blacklist[0]; *hw; ++hw) {
                 if (line.npos != line.find(*hw)) {
+                    __android_log_print(ANDROID_LOG_INFO, "Gecko",
+                                        "Blacklisted device `%s'", *hw);
                     broken = true;
                     break;
                 }
@@ -2242,6 +2260,10 @@ ComputeIsJITBroken()
         }
         std::getline(cpuinfo, line);
     } while(!cpuinfo.fail() && !cpuinfo.eof());
+
+    __android_log_print(ANDROID_LOG_INFO, "Gecko", "JITs are %sbroken",
+                        broken ? "" : "not ");
+
     return broken;
 #endif  // ifndef ANDROID
 }
diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index 905d4ef5f0f9..64a58320c584 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -2364,6 +2364,16 @@ struct JSContext
     void assertValidStackDepth(uintN /*depth*/) {}
 #endif
 
+    enum DollarPath {
+        DOLLAR_LITERAL = 1,
+        DOLLAR_AMP,
+        DOLLAR_PLUS,
+        DOLLAR_TICK,
+        DOLLAR_QUOT
+    };
+    volatile DollarPath *dollarPath;
+    volatile jschar *blackBox;
+
 private:
 
     /*
@@ -2376,7 +2386,7 @@ private:
 
     /* To silence MSVC warning about using 'this' in a member initializer. */
     JSContext *thisInInitializer() { return this; }
-};
+}; /* struct JSContext */
 
 #ifdef JS_THREADSAFE
 # define JS_THREAD_ID(cx)       ((cx)->thread ? (cx)->thread->id : 0)
diff --git a/js/src/jsnum.cpp b/js/src/jsnum.cpp
index b8b01e40386f..b93da84dc573 100644
--- a/js/src/jsnum.cpp
+++ b/js/src/jsnum.cpp
@@ -1256,6 +1256,12 @@ ValueToNumberSlow(JSContext *cx, Value v, double *out)
             break;
 
         JS_ASSERT(v.isObject());
+        if (!v.isObject()) {
+            if (v.isMagic(JS_ARRAY_HOLE))
+                *(int *) 0x88 = 0;
+            else
+                *(int *) 0x99 = 0;
+        }
         if (!DefaultValue(cx, &v.toObject(), JSTYPE_NUMBER, &v))
             return false;
         if (v.isObject())
diff --git a/js/src/jsregexp.h b/js/src/jsregexp.h
index b2fdcffd9025..ba0653cb5675 100644
--- a/js/src/jsregexp.h
+++ b/js/src/jsregexp.h
@@ -75,6 +75,11 @@ class RegExpStatics
         return matchPairs.length() / 2;
     }
 
+    size_t pairCountCrash() const {
+        JS_CRASH_UNLESS(matchPairs.length() % 2 == 0);
+        return pairCount();
+    }
+
     void copyTo(RegExpStatics &dst) {
         dst.matchPairs.clear();
         /* 'save' has already reserved space in matchPairs */
@@ -137,6 +142,11 @@ class RegExpStatics
         return matchPairs[2 * pairNum + which];
     }
 
+    int getCrash(size_t pairNum, bool which) const {
+         JS_CRASH_UNLESS(pairNum < pairCountCrash());
+         return get(pairNum, which);
+    }
+
     /*
      * Check whether the index at |checkValidIndex| is valid (>= 0).
      * If so, construct a string for it and place it in |*out|.
@@ -246,9 +256,9 @@ class RegExpStatics
     }
 
     size_t getParenLength(size_t parenNum) const {
-        if (pairCount() <= parenNum + 1)
+        if (pairCountCrash() <= parenNum + 1)
             return 0;
-        return get(parenNum + 1, 1) - get(parenNum + 1, 0);
+        return getCrash(parenNum + 1, 1) - getCrash(parenNum + 1, 0);
     }
 
     /* Value creators. */
diff --git a/js/src/jsregexpinlines.h b/js/src/jsregexpinlines.h
index 6dbdf00ae080..17cb1e5c809f 100644
--- a/js/src/jsregexpinlines.h
+++ b/js/src/jsregexpinlines.h
@@ -86,7 +86,7 @@ class RegExp
     uint32                      flags;
 
     RegExp(JSString *source, uint32 flags)
-      : refCount(1), source(source), compiled(), parenCount(), flags(flags) {}
+      : refCount(1), source(source), compiled(), parenCount(0), flags(flags) {}
     bool compileHelper(JSContext *cx, UString &pattern);
     bool compile(JSContext *cx);
     static const uint32 allFlags = JSREG_FOLD | JSREG_GLOB | JSREG_MULTILINE | JSREG_STICKY;
@@ -160,6 +160,7 @@ class RegExp
     bool global() const { return flags & JSREG_GLOB; }
     bool multiline() const { return flags & JSREG_MULTILINE; }
     bool sticky() const { return flags & JSREG_STICKY; }
+
     const uint32 &getFlags() const { JS_ASSERT((flags & allFlags) == flags); return flags; }
     uint32 flagCount() const;
 };
@@ -620,56 +621,56 @@ RegExpStatics::createRightContext(JSContext *cx, Value *out) const
 inline void
 RegExpStatics::getParen(size_t num, JSSubString *out) const
 {
-    out->chars = matchPairsInput->chars() + get(num + 1, 0);
+    out->chars = matchPairsInput->chars() + getCrash(num + 1, 0);
     out->length = getParenLength(num);
 }
 
 inline void
 RegExpStatics::getLastMatch(JSSubString *out) const
 {
-    if (!pairCount()) {
+    if (!pairCountCrash()) {
         *out = js_EmptySubString;
         return;
     }
-    JS_ASSERT(matchPairsInput);
-    out->chars = matchPairsInput->chars() + get(0, 0);
-    JS_ASSERT(get(0, 1) >= get(0, 0));
+    JS_CRASH_UNLESS(matchPairsInput);
+    out->chars = matchPairsInput->chars() + getCrash(0, 0);
+    JS_CRASH_UNLESS(getCrash(0, 1) >= getCrash(0, 0));
     out->length = get(0, 1) - get(0, 0);
 }
 
 inline void
 RegExpStatics::getLastParen(JSSubString *out) const
 {
-    if (!pairCount()) {
+    if (!pairCountCrash()) {
         *out = js_EmptySubString;
         return;
     }
     size_t num = pairCount() - 1;
-    out->chars = matchPairsInput->chars() + get(num, 0);
-    JS_ASSERT(get(num, 1) >= get(num, 0));
+    out->chars = matchPairsInput->chars() + getCrash(num, 0);
+    JS_CRASH_UNLESS(getCrash(num, 1) >= get(num, 0));
     out->length = get(num, 1) - get(num, 0);
 }
 
 inline void
 RegExpStatics::getLeftContext(JSSubString *out) const
 {
-    if (!pairCount()) {
+    if (!pairCountCrash()) {
         *out = js_EmptySubString;
         return;
     }
     out->chars = matchPairsInput->chars();
-    out->length = get(0, 0);
+    out->length = getCrash(0, 0);
 }
 
 inline void
 RegExpStatics::getRightContext(JSSubString *out) const
 {
-    if (!pairCount()) {
+    if (!pairCountCrash()) {
         *out = js_EmptySubString;
         return;
     }
-    out->chars = matchPairsInput->chars() + get(0, 1);
-    JS_ASSERT(get(0, 1) <= int(matchPairsInput->length()));
+    out->chars = matchPairsInput->chars() + getCrash(0, 1);
+    JS_CRASH_UNLESS(get(0, 1) <= int(matchPairsInput->length()));
     out->length = matchPairsInput->length() - get(0, 1);
 }
 
diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp
index f0fa1fe74383..9fb2590cedfb 100644
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -1990,7 +1990,7 @@ struct ReplaceData
 
 static bool
 InterpretDollar(JSContext *cx, RegExpStatics *res, jschar *dp, jschar *ep, ReplaceData &rdata,
-                JSSubString *out, size_t *skip)
+                JSSubString *out, size_t *skip, volatile JSContext::DollarPath *path)
 {
     JS_ASSERT(*dp == '$');
 
@@ -2033,18 +2033,23 @@ InterpretDollar(JSContext *cx, RegExpStatics *res, jschar *dp, jschar *ep, Repla
         rdata.dollarStr.chars = dp;
         rdata.dollarStr.length = 1;
         *out = rdata.dollarStr;
+        *path = JSContext::DOLLAR_LITERAL;
         return true;
       case '&':
         res->getLastMatch(out);
+        *path = JSContext::DOLLAR_AMP;
         return true;
       case '+':
         res->getLastParen(out);
+        *path = JSContext::DOLLAR_PLUS;
         return true;
       case '`':
         res->getLeftContext(out);
+        *path = JSContext::DOLLAR_TICK;
         return true;
       case '\'':
         res->getRightContext(out);
+        *path = JSContext::DOLLAR_QUOT;
         return true;
     }
     return false;
@@ -2157,10 +2162,11 @@ FindReplaceLength(JSContext *cx, RegExpStatics *res, ReplaceData &rdata, size_t
 
     JSString *repstr = rdata.repstr;
     size_t replen = repstr->length();
+    JSContext::DollarPath path;
     for (jschar *dp = rdata.dollar, *ep = rdata.dollarEnd; dp; dp = js_strchr_limit(dp, '$', ep)) {
         JSSubString sub;
         size_t skip;
-        if (InterpretDollar(cx, res, dp, ep, rdata, &sub, &skip)) {
+        if (InterpretDollar(cx, res, dp, ep, rdata, &sub, &skip, &path)) {
             replen += sub.length - skip;
             dp += skip;
         } else {
@@ -2177,6 +2183,11 @@ DoReplace(JSContext *cx, RegExpStatics *res, ReplaceData &rdata, jschar *chars)
     JSString *repstr = rdata.repstr;
     jschar *cp;
     jschar *bp = cp = repstr->chars();
+    volatile JSContext::DollarPath path;
+    cx->dollarPath = &path;
+    jschar sourceBuf[128];
+    cx->blackBox = sourceBuf;
+
     for (jschar *dp = rdata.dollar, *ep = rdata.dollarEnd; dp; dp = js_strchr_limit(dp, '$', ep)) {
         size_t len = dp - cp;
         js_strncpy(chars, cp, len);
@@ -2185,7 +2196,13 @@ DoReplace(JSContext *cx, RegExpStatics *res, ReplaceData &rdata, jschar *chars)
 
         JSSubString sub;
         size_t skip;
-        if (InterpretDollar(cx, res, dp, ep, rdata, &sub, &skip)) {
+        if (InterpretDollar(cx, res, dp, ep, rdata, &sub, &skip, &path)) {
+            if (((size_t(sub.chars) & 0xfffffU) + sub.length) > 0x100000U) {
+                /* Going to cross a 0xffffe address, so take a gander at the replace value. */
+                size_t peekLen = JS_MIN(rdata.dollarEnd - rdata.dollar, 128);
+                js_strncpy(sourceBuf, rdata.dollar, peekLen);
+            }
+
             len = sub.length;
             js_strncpy(chars, sub.chars, len);
             chars += len;
diff --git a/js/src/jstl.h b/js/src/jstl.h
index 1c837b85fcb9..ef390d3fe117 100644
--- a/js/src/jstl.h
+++ b/js/src/jstl.h
@@ -40,19 +40,19 @@
 #ifndef jstl_h_
 #define jstl_h_
 
-/* Gross special case for Gecko, which defines malloc/calloc/free. */
-#ifdef mozilla_mozalloc_macro_wrappers_h
-#  define JS_UNDEFD_MOZALLOC_WRAPPERS
-/* The "anti-header" */
-#  include "mozilla/mozalloc_undef_macro_wrappers.h"
-#endif
-
 #include "jsbit.h"
 #include "jsstaticcheck.h"
 
 #include <new>
 #include <string.h>
 
+/* Gross special case for Gecko, which defines malloc/calloc/free. */
+#ifdef mozilla_mozalloc_macro_wrappers_h
+#  define JSSTL_UNDEFD_MOZALLOC_WRAPPERS
+/* The "anti-header" */
+#  include "mozilla/mozalloc_undef_macro_wrappers.h"
+#endif
+
 namespace js {
 
 /* JavaScript Template Library. */
@@ -467,4 +467,8 @@ InitConst(const T &t)
 
 } /* namespace js */
 
+#ifdef JSSTL_UNDEFD_MOZALLOC_WRAPPERS
+#  include "mozilla/mozalloc_macro_wrappers.h"
+#endif
+
 #endif /* jstl_h_ */
diff --git a/js/src/jsutil.h b/js/src/jsutil.h
index b374e3a8b9fc..d735a4adeed0 100644
--- a/js/src/jsutil.h
+++ b/js/src/jsutil.h
@@ -56,6 +56,14 @@ JS_BEGIN_EXTERN_C
 extern JS_PUBLIC_API(void)
 JS_Assert(const char *s, const char *file, JSIntn ln);
 
+#define JS_CRASH_UNLESS(__cond)                                                 \
+    JS_BEGIN_MACRO                                                              \
+        if (!(__cond)) {                                                        \
+            *(int *)(uintptr_t)0xccadbeef = 0;                                  \
+            ((void(*)())0)(); /* More reliable, but doesn't say CCADBEEF */     \
+        }                                                                       \
+    JS_END_MACRO
+
 #ifdef DEBUG
 
 #define JS_ASSERT(expr)                                                       \
diff --git a/js/src/jsvector.h b/js/src/jsvector.h
index 428797c584c1..c893a471224a 100644
--- a/js/src/jsvector.h
+++ b/js/src/jsvector.h
@@ -50,6 +50,12 @@
 #pragma warning(disable:4345)
 #endif
 
+/* Gross special case for Gecko, which defines malloc/calloc/free. */
+#ifdef mozilla_mozalloc_macro_wrappers_h
+#  define JSVECTOR_UNDEFD_MOZALLOC_WRAPPERS
+#  include "mozilla/mozalloc_undef_macro_wrappers.h"
+#endif
+
 namespace js {
 
 /*
@@ -743,4 +749,8 @@ Vector<T,N,AP>::replaceRawBuffer(T *p, size_t length)
 #pragma warning(pop)
 #endif
 
+#ifdef JSVECTOR_UNDEFD_MOZALLOC_WRAPPERS
+#  include "mozilla/mozalloc_macro_wrappers.h"
+#endif
+
 #endif /* jsvector_h_ */
diff --git a/js/src/xpconnect/src/dom_quickstubs.qsconf b/js/src/xpconnect/src/dom_quickstubs.qsconf
index c53bfc374319..7a7c0fd879c5 100644
--- a/js/src/xpconnect/src/dom_quickstubs.qsconf
+++ b/js/src/xpconnect/src/dom_quickstubs.qsconf
@@ -445,19 +445,20 @@ members = [
     'nsIWebSocket.*',
 
     # webgl
-    'nsICanvasRenderingContextWebGL.*',
+    'nsIDOMWebGLRenderingContext.*',
     # These all use GetCurrentNativeCallContext and should be
     # custom-quickstubbed.
-    '-nsICanvasRenderingContextWebGL.getActiveAttrib',
-    '-nsICanvasRenderingContextWebGL.getActiveUniform',
-    '-nsICanvasRenderingContextWebGL.getParameter',
-    '-nsICanvasRenderingContextWebGL.getBufferParameter',
-    '-nsICanvasRenderingContextWebGL.getFramebufferAttachmentParameter',
-    '-nsICanvasRenderingContextWebGL.getRenderbufferParameter',
-    '-nsICanvasRenderingContextWebGL.getProgramParameter',
-    '-nsICanvasRenderingContextWebGL.getUniform',
-    '-nsICanvasRenderingContextWebGL.getVertexAttrib',
-    '-nsICanvasRenderingContextWebGL.getShaderParameter',
+    '-nsIDOMWebGLRenderingContext.getActiveAttrib',
+    '-nsIDOMWebGLRenderingContext.getActiveUniform',
+    '-nsIDOMWebGLRenderingContext.getParameter',
+    '-nsIDOMWebGLRenderingContext.getBufferParameter',
+    '-nsIDOMWebGLRenderingContext.getFramebufferAttachmentParameter',
+    '-nsIDOMWebGLRenderingContext.getRenderbufferParameter',
+    '-nsIDOMWebGLRenderingContext.getProgramParameter',
+    '-nsIDOMWebGLRenderingContext.getUniform',
+    '-nsIDOMWebGLRenderingContext.getVertexAttrib',
+    '-nsIDOMWebGLRenderingContext.getShaderParameter',
+    '-nsIDOMWebGLRenderingContext.getContextAttributes',
 
     # Audio
     'nsIDOMNotifyAudioAvailableEvent.frameBuffer',
@@ -501,15 +502,15 @@ irregularFilenames = {
     'nsIDOMCanvasPattern': 'nsIDOMCanvasRenderingContext2D',
     'nsIXPointerResult': 'nsIXPointer',
 
-    'nsIWebGLTexture': 'nsICanvasRenderingContextWebGL',
-    'nsIWebGLBuffer': 'nsICanvasRenderingContextWebGL',
-    'nsIWebGLProgram': 'nsICanvasRenderingContextWebGL',
-    'nsIWebGLShader': 'nsICanvasRenderingContextWebGL',
-    'nsIWebGLShaderArray': 'nsICanvasRenderingContextWebGL',
-    'nsIWebGLFramebuffer': 'nsICanvasRenderingContextWebGL',
-    'nsIWebGLRenderbuffer': 'nsICanvasRenderingContextWebGL',
-    'nsIWebGLActiveInfo': 'nsICanvasRenderingContextWebGL',
-    'nsIWebGLUniformLocation': 'nsICanvasRenderingContextWebGL',
+    'nsIWebGLTexture': 'nsIDOMWebGLRenderingContext',
+    'nsIWebGLBuffer': 'nsIDOMWebGLRenderingContext',
+    'nsIWebGLProgram': 'nsIDOMWebGLRenderingContext',
+    'nsIWebGLShader': 'nsIDOMWebGLRenderingContext',
+    'nsIWebGLShaderArray': 'nsIDOMWebGLRenderingContext',
+    'nsIWebGLFramebuffer': 'nsIDOMWebGLRenderingContext',
+    'nsIWebGLRenderbuffer': 'nsIDOMWebGLRenderingContext',
+    'nsIWebGLActiveInfo': 'nsIDOMWebGLRenderingContext',
+    'nsIWebGLUniformLocation': 'nsIDOMWebGLRenderingContext',
 
     'nsIIndexedDatabaseUsageCallback': 'nsIIndexedDatabaseManager',
     }
@@ -914,26 +915,26 @@ customMethodCalls = {
                 '    rv = self->CreateTextNode(arg0, getter_AddRefs(result));'
     },
     # WebGL
-    'nsICanvasRenderingContextWebGL_BufferData': CUSTOM_QS,
-    'nsICanvasRenderingContextWebGL_BufferSubData': CUSTOM_QS,
-    'nsICanvasRenderingContextWebGL_ReadPixels': CUSTOM_QS,
-    'nsICanvasRenderingContextWebGL_TexImage2D': CUSTOM_QS,
-    'nsICanvasRenderingContextWebGL_TexSubImage2D': CUSTOM_QS,
-    'nsICanvasRenderingContextWebGL_Uniform1iv': CUSTOM_QS_TN,
-    'nsICanvasRenderingContextWebGL_Uniform2iv': CUSTOM_QS_TN,
-    'nsICanvasRenderingContextWebGL_Uniform3iv': CUSTOM_QS_TN,
-    'nsICanvasRenderingContextWebGL_Uniform4iv': CUSTOM_QS_TN,
-    'nsICanvasRenderingContextWebGL_Uniform1fv': CUSTOM_QS_TN,
-    'nsICanvasRenderingContextWebGL_Uniform2fv': CUSTOM_QS_TN,
-    'nsICanvasRenderingContextWebGL_Uniform3fv': CUSTOM_QS_TN,
-    'nsICanvasRenderingContextWebGL_Uniform4fv': CUSTOM_QS_TN,
-    'nsICanvasRenderingContextWebGL_UniformMatrix2fv': CUSTOM_QS_TN,
-    'nsICanvasRenderingContextWebGL_UniformMatrix3fv': CUSTOM_QS_TN,
-    'nsICanvasRenderingContextWebGL_UniformMatrix4fv': CUSTOM_QS_TN,
-    'nsICanvasRenderingContextWebGL_VertexAttrib1fv': CUSTOM_QS,
-    'nsICanvasRenderingContextWebGL_VertexAttrib2fv': CUSTOM_QS,
-    'nsICanvasRenderingContextWebGL_VertexAttrib3fv': CUSTOM_QS,
-    'nsICanvasRenderingContextWebGL_VertexAttrib4fv': CUSTOM_QS,
+    'nsIDOMWebGLRenderingContext_BufferData': CUSTOM_QS,
+    'nsIDOMWebGLRenderingContext_BufferSubData': CUSTOM_QS,
+    'nsIDOMWebGLRenderingContext_ReadPixels': CUSTOM_QS,
+    'nsIDOMWebGLRenderingContext_TexImage2D': CUSTOM_QS,
+    'nsIDOMWebGLRenderingContext_TexSubImage2D': CUSTOM_QS,
+    'nsIDOMWebGLRenderingContext_Uniform1iv': CUSTOM_QS_TN,
+    'nsIDOMWebGLRenderingContext_Uniform2iv': CUSTOM_QS_TN,
+    'nsIDOMWebGLRenderingContext_Uniform3iv': CUSTOM_QS_TN,
+    'nsIDOMWebGLRenderingContext_Uniform4iv': CUSTOM_QS_TN,
+    'nsIDOMWebGLRenderingContext_Uniform1fv': CUSTOM_QS_TN,
+    'nsIDOMWebGLRenderingContext_Uniform2fv': CUSTOM_QS_TN,
+    'nsIDOMWebGLRenderingContext_Uniform3fv': CUSTOM_QS_TN,
+    'nsIDOMWebGLRenderingContext_Uniform4fv': CUSTOM_QS_TN,
+    'nsIDOMWebGLRenderingContext_UniformMatrix2fv': CUSTOM_QS_TN,
+    'nsIDOMWebGLRenderingContext_UniformMatrix3fv': CUSTOM_QS_TN,
+    'nsIDOMWebGLRenderingContext_UniformMatrix4fv': CUSTOM_QS_TN,
+    'nsIDOMWebGLRenderingContext_VertexAttrib1fv': CUSTOM_QS,
+    'nsIDOMWebGLRenderingContext_VertexAttrib2fv': CUSTOM_QS,
+    'nsIDOMWebGLRenderingContext_VertexAttrib3fv': CUSTOM_QS,
+    'nsIDOMWebGLRenderingContext_VertexAttrib4fv': CUSTOM_QS,
     # Canvas 2D
     'nsIDOMCanvasRenderingContext2D_CreateImageData': CUSTOM_QS,
     'nsIDOMCanvasRenderingContext2D_GetImageData': CUSTOM_QS,
diff --git a/js/src/xpconnect/src/qsgen.py b/js/src/xpconnect/src/qsgen.py
index 9ba9ddce8742..45639fb76c37 100644
--- a/js/src/xpconnect/src/qsgen.py
+++ b/js/src/xpconnect/src/qsgen.py
@@ -707,17 +707,8 @@ def writeResultConv(f, type, jsvalPtr, jsvalRef):
             return
         else:
             f.write("    nsWrapperCache* cache = xpc_qsGetWrapperCache(result);\n"
-                    "    if (cache) {\n"
-                    "      JSObject* wrapper = cache->GetWrapper();\n"
-                    "      NS_ASSERTION(cx->compartment == obj->compartment(),\n"
-                    "                   \"wrong compartment in object or context!\");\n"
-                    "      if (wrapper &&\n"
-                    # FIXME: Bug 585786, this check should go away
-                    "          IS_SLIM_WRAPPER_OBJECT(wrapper) &&\n"
-                    "          cx->compartment == wrapper->compartment()) {\n"
-                    "        *%s = OBJECT_TO_JSVAL(wrapper);\n"
-                    "        return JS_TRUE;\n"
-                    "      }\n"
+                    "    if (xpc_GetCachedSlimWrapper(cache, obj, %s)) {\n"
+                    "      return JS_TRUE;\n"
                     "    }\n"
                     "    // After this point do not use 'result'!\n"
                     "    qsObjectHelper helper(result, cache);\n"
@@ -1259,17 +1250,10 @@ def writeTraceableResultConv(f, type):
                     "&vp.array[0]);\n")
         else:
             f.write("    nsWrapperCache* cache = xpc_qsGetWrapperCache(result);\n"
-                    "    if (cache) {\n"
-                    "      JSObject* wrapper = cache->GetWrapper();\n"
-                    "      NS_ASSERTION(cx->compartment == obj->compartment(),\n"
-                    "                   \"wrong compartment in object or context!\");\n"
-                    "      if (wrapper &&\n"
-                    # FIXME: Bug 585786, this check should go away
-                    "          IS_SLIM_WRAPPER_OBJECT(wrapper) &&\n"
-                    "          cx->compartment == wrapper->compartment()) {\n"
-                    "        vp.array[0] = OBJECT_TO_JSVAL(wrapper);\n"
-                    "        return wrapper;\n"
-                    "      }\n"
+                    "    JSObject* wrapper =\n"
+                    "      xpc_GetCachedSlimWrapper(cache, obj, &vp.array[0]);\n"
+                    "    if (wrapper) {\n"
+                    "      return wrapper;\n"
                     "    }\n"
                     "    // After this point do not use 'result'!\n"
                     "    qsObjectHelper helper(result, cache);\n"
diff --git a/js/src/xpconnect/src/xpcprivate.h b/js/src/xpconnect/src/xpcprivate.h
index 789a8270da2b..7f334359abbc 100644
--- a/js/src/xpconnect/src/xpcprivate.h
+++ b/js/src/xpconnect/src/xpcprivate.h
@@ -50,6 +50,7 @@
 #include <stdlib.h>
 #include <stdarg.h>
 #include <math.h>
+#include "xpcpublic.h"
 #include "jsapi.h"
 #include "jsdhash.h"
 #include "jsprf.h"
@@ -1454,46 +1455,6 @@ XPC_WN_JSOp_ThisObject(JSContext *cx, JSObject *obj);
      (clazz) == &XPC_WN_ModsAllowed_WithCall_Proto_JSClass ||                 \
      (clazz) == &XPC_WN_ModsAllowed_NoCall_Proto_JSClass)
 
-// NOTE!!!
-//
-// If this ever changes,
-// nsScriptSecurityManager::doGetObjectPrincipal() *must* be updated
-// also!
-//
-// NOTE!!!
-#define IS_WRAPPER_CLASS(clazz)                                               \
-    (clazz->ext.equality == js::Valueify(XPC_WN_Equality))
-
-inline JSBool
-DebugCheckWrapperClass(JSObject* obj)
-{
-    NS_ASSERTION(IS_WRAPPER_CLASS(obj->getClass()),
-                 "Forgot to check if this is a wrapper?");
-    return JS_TRUE;
-}
-
-// If IS_WRAPPER_CLASS for the JSClass of an object is true, the object can be
-// a slim wrapper, holding a native in its private slot, or a wrappednative
-// wrapper, holding the XPCWrappedNative in its private slot. A slim wrapper
-// also holds a pointer to its XPCWrappedNativeProto in a reserved slot, we can
-// check that slot for a non-void value to distinguish between the two.
-
-// Only use these macros if IS_WRAPPER_CLASS(obj->getClass()) is true.
-#define IS_WN_WRAPPER_OBJECT(obj)                                             \
-    (DebugCheckWrapperClass(obj) &&                                           \
-     obj->getSlot(0).isUndefined())
-#define IS_SLIM_WRAPPER_OBJECT(obj)                                           \
-    (DebugCheckWrapperClass(obj) &&                                           \
-     !obj->getSlot(0).isUndefined())
-
-// Use these macros if IS_WRAPPER_CLASS(obj->getClass()) might be false.
-// Avoid calling them if IS_WRAPPER_CLASS(obj->getClass()) can only be
-// true, as we'd do a redundant call to IS_WRAPPER_CLASS.
-#define IS_WN_WRAPPER(obj)                                                    \
-    (IS_WRAPPER_CLASS(obj->getClass()) && IS_WN_WRAPPER_OBJECT(obj))
-#define IS_SLIM_WRAPPER(obj)                                                  \
-    (IS_WRAPPER_CLASS(obj->getClass()) && IS_SLIM_WRAPPER_OBJECT(obj))
-
 // Comes from xpcwrappednativeops.cpp
 extern void
 xpc_TraceForValidWrapper(JSTracer *trc, XPCWrappedNative* wrapper);
@@ -2463,7 +2424,6 @@ private:
 };
 
 void *xpc_GetJSPrivate(JSObject *obj);
-inline JSObject *xpc_GetGlobalForObject(JSObject *obj);
 
 /***************************************************************************/
 // XPCWrappedNative the wrapper around one instance of a native xpcom object
@@ -4457,13 +4417,6 @@ xpc_GetJSPrivate(JSObject *obj)
 {
     return obj->getPrivate();
 }
-inline JSObject *
-xpc_GetGlobalForObject(JSObject *obj)
-{
-    while(JSObject *parent = obj->getParent())
-        obj = parent;
-    return obj;
-}
 
 
 #ifndef XPCONNECT_STANDALONE
diff --git a/js/src/xpconnect/src/xpcpublic.h b/js/src/xpconnect/src/xpcpublic.h
index 3be157907f06..6b0cfa57f4b6 100644
--- a/js/src/xpconnect/src/xpcpublic.h
+++ b/js/src/xpconnect/src/xpcpublic.h
@@ -41,7 +41,10 @@
 #define xpcpublic_h
 
 #include "jsapi.h"
-#include "nsISupports.h"
+#include "jsobj.h"
+#include "nsAString.h"
+#include "nsIPrincipal.h"
+#include "nsWrapperCache.h"
 
 class nsIPrincipal;
 
@@ -56,4 +59,65 @@ xpc_CreateMTGlobalObject(JSContext *cx, JSClass *clasp,
                          nsISupports *ptr, JSObject **global,
                          JSCompartment **compartment);
 
+extern JSBool
+XPC_WN_Equality(JSContext *cx, JSObject *obj, const jsval *v, JSBool *bp);
+
+#define IS_WRAPPER_CLASS(clazz)                                               \
+    (clazz->ext.equality == js::Valueify(XPC_WN_Equality))
+
+inline JSBool
+DebugCheckWrapperClass(JSObject* obj)
+{
+    NS_ASSERTION(IS_WRAPPER_CLASS(obj->getClass()),
+                 "Forgot to check if this is a wrapper?");
+    return JS_TRUE;
+}
+
+// If IS_WRAPPER_CLASS for the JSClass of an object is true, the object can be
+// a slim wrapper, holding a native in its private slot, or a wrappednative
+// wrapper, holding the XPCWrappedNative in its private slot. A slim wrapper
+// also holds a pointer to its XPCWrappedNativeProto in a reserved slot, we can
+// check that slot for a non-void value to distinguish between the two.
+
+// Only use these macros if IS_WRAPPER_CLASS(obj->getClass()) is true.
+#define IS_WN_WRAPPER_OBJECT(obj)                                             \
+    (DebugCheckWrapperClass(obj) && obj->getSlot(0).isUndefined())
+#define IS_SLIM_WRAPPER_OBJECT(obj)                                           \
+    (DebugCheckWrapperClass(obj) && !obj->getSlot(0).isUndefined())
+
+// Use these macros if IS_WRAPPER_CLASS(obj->getClass()) might be false.
+// Avoid calling them if IS_WRAPPER_CLASS(obj->getClass()) can only be
+// true, as we'd do a redundant call to IS_WRAPPER_CLASS.
+#define IS_WN_WRAPPER(obj)                                                    \
+    (IS_WRAPPER_CLASS(obj->getClass()) && IS_WN_WRAPPER_OBJECT(obj))
+#define IS_SLIM_WRAPPER(obj)                                                  \
+    (IS_WRAPPER_CLASS(obj->getClass()) && IS_SLIM_WRAPPER_OBJECT(obj))
+
+inline JSObject *
+xpc_GetGlobalForObject(JSObject *obj)
+{
+    while(JSObject *parent = obj->getParent())
+        obj = parent;
+    return obj;
+}
+
+inline JSObject*
+xpc_GetCachedSlimWrapper(nsWrapperCache *cache, JSObject *scope, jsval *vp)
+{
+    if (cache) {
+        JSObject* wrapper = cache->GetWrapper();
+        // FIXME: Bug 585786, the check for IS_SLIM_WRAPPER_OBJECT should go
+        //        away
+        if (wrapper &&
+            IS_SLIM_WRAPPER_OBJECT(wrapper) &&
+            wrapper->getCompartment() == scope->getCompartment()) {
+            *vp = OBJECT_TO_JSVAL(wrapper);
+
+            return wrapper;
+        }
+    }
+
+    return nsnull;
+}
+
 #endif
diff --git a/js/src/xpconnect/src/xpcwrappedjs.cpp b/js/src/xpconnect/src/xpcwrappedjs.cpp
index e872e90ba698..7b127ed9d8d8 100644
--- a/js/src/xpconnect/src/xpcwrappedjs.cpp
+++ b/js/src/xpconnect/src/xpcwrappedjs.cpp
@@ -44,6 +44,7 @@
 #include "xpcprivate.h"
 #include "nsAtomicRefcnt.h"
 #include "nsThreadUtils.h"
+#include "nsTextFormatter.h"
 
 // NOTE: much of the fancy footwork is done in xpcstubs.cpp
 
@@ -571,6 +572,17 @@ nsXPCWrappedJS::CallMethod(PRUint16 methodIndex,
     if(!IsValid())
         return NS_ERROR_UNEXPECTED;
     if (NS_IsMainThread() != mMainThread) {
+        NS_NAMED_LITERAL_STRING(kFmt, "Attempt to use JS function on a different thread calling %s.%s. JS objects may not be shared across threads.");
+        PRUnichar* msg =
+            nsTextFormatter::smprintf(kFmt.get(),
+                                      GetClass()->GetInterfaceName(),
+                                      info->name);
+        nsCOMPtr<nsIConsoleService> cs =
+            do_GetService(NS_CONSOLESERVICE_CONTRACTID);
+        if (cs)
+            cs->LogStringMessage(msg);
+        NS_Free(msg);
+        
         return NS_ERROR_NOT_SAME_THREAD;
     }
     return GetClass()->CallMethod(this, methodIndex, info, params);
diff --git a/js/src/xpconnect/tests/unit/test_bug608142.js b/js/src/xpconnect/tests/unit/test_bug608142.js
index ab1cd93d1206..0aea65e207bf 100644
--- a/js/src/xpconnect/tests/unit/test_bug608142.js
+++ b/js/src/xpconnect/tests/unit/test_bug608142.js
@@ -40,6 +40,19 @@ function run_test() {
     var tm = Components.classes["@mozilla.org/thread-manager;1"].getService();
     var thr = tm.newThread(0);
 
+    var foundThreadError = false;
+ 
+    var listener = {
+        observe: function(message) {
+            if (/JS function on a different thread/.test(message.message))
+                foundThreadError = true;
+        }
+    };
+
+    var cs = Components.classes["@mozilla.org/consoleservice;1"].
+        getService(Components.interfaces.nsIConsoleService);
+    cs.registerListener(listener);
+
     thr.dispatch({
         run: function() {
             do_check_true(false);
@@ -47,5 +60,8 @@ function run_test() {
     }, Components.interfaces.nsIThread.DISPATCH_NORMAL);
 
     thr.shutdown();
+
+    cs.unregisterListener(listener);
+    do_check_true(foundThreadError);
 }
 
diff --git a/js/src/xpconnect/wrappers/XrayWrapper.cpp b/js/src/xpconnect/wrappers/XrayWrapper.cpp
index 773ddaa34299..51cd6d45a242 100644
--- a/js/src/xpconnect/wrappers/XrayWrapper.cpp
+++ b/js/src/xpconnect/wrappers/XrayWrapper.cpp
@@ -236,7 +236,7 @@ ResolveNativeProperty(JSContext *cx, JSObject *wrapper, JSObject *holder, jsid i
     desc->attrs = JSPROP_ENUMERATE;
     desc->getter = NULL;
     desc->setter = NULL;
-    desc->shortid = NULL;
+    desc->shortid = 0;
     desc->value = JSVAL_VOID;
 
     jsval fval = JSVAL_VOID;
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index ee239693a378..f6ed4e4f3ee1 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -5560,10 +5560,9 @@ nsCSSFrameConstructor::GetAbsoluteContainingBlock(nsIFrame* aFrame)
         }
       }
 
-#ifdef DEBUG
-      if (!containingBlock)
-        NS_WARNING("Positioned frame that does not handle positioned kids; looking further up the parent chain");
-#endif
+      // We sometimes have a null containing block here because we
+      // haven't yet fixed bug 455338.  Once we fix that we shouldn't
+      // have to loop here.
     }
   }
 
diff --git a/layout/base/nsCSSRenderingBorders.cpp b/layout/base/nsCSSRenderingBorders.cpp
index b0fda2daf135..6fa6b475f649 100644
--- a/layout/base/nsCSSRenderingBorders.cpp
+++ b/layout/base/nsCSSRenderingBorders.cpp
@@ -423,7 +423,8 @@ typedef enum {
 // Given three points, p0, p1, and midPoint, move p1 further in to the
 // rectangle (of which aMidPoint is the center) so that it reaches the
 // closer of the horizontal or vertical lines intersecting the midpoint,
-// while maintaing the slope of the line.  p0 and p1 must be distinct.
+// while maintaing the slope of the line.  If p0 and p1 are the same,
+// just move p1 to midPoint (since there's no slope to maintain).
 // FIXME: Extending only to the midpoint isn't actually sufficient for
 // boxes with asymmetric radii.
 static void
@@ -433,7 +434,7 @@ MaybeMoveToMidPoint(gfxPoint& aP0, gfxPoint& aP1, const gfxPoint& aMidPoint)
 
   if (ps.x == 0.0) {
     if (ps.y == 0.0) {
-      NS_NOTREACHED("points should be different");
+      aP1 = aMidPoint;
     } else {
       aP1.y = aMidPoint.y;
     }
diff --git a/layout/base/nsDisplayList.cpp b/layout/base/nsDisplayList.cpp
index 31147b70cdf0..77f1a8bbf69b 100644
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -1030,7 +1030,7 @@ nsDisplayBackground::GetBounds(nsDisplayListBuilder* aBuilder) {
 
 nsRect
 nsDisplayOutline::GetBounds(nsDisplayListBuilder* aBuilder) {
-  return mFrame->GetVisualOverflowRect() + ToReferenceFrame();
+  return mFrame->GetVisualOverflowRectRelativeToSelf() + ToReferenceFrame();
 }
 
 void
@@ -1172,7 +1172,7 @@ nsDisplayBoxShadowOuter::Paint(nsDisplayListBuilder* aBuilder,
 
 nsRect
 nsDisplayBoxShadowOuter::GetBounds(nsDisplayListBuilder* aBuilder) {
-  return mFrame->GetVisualOverflowRect() + ToReferenceFrame();
+  return mFrame->GetVisualOverflowRectRelativeToSelf() + ToReferenceFrame();
 }
 
 PRBool
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index 2b97518d0ba9..5249ac358f78 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -1355,6 +1355,7 @@ private:
                                            nsIWidget *aRootWidget);
 
   void FireResizeEvent();
+  void FireBeforeResizeEvent();
   static void AsyncResizeEventCallback(nsITimer* aTimer, void* aPresShell);
   nsRevocableEventPtr<nsRunnableMethod<PresShell> > mResizeEvent;
   nsCOMPtr<nsITimer> mAsyncResizeEventTimer;
@@ -2830,6 +2831,11 @@ PresShell::ResizeReflowIgnoreOverride(nscoord aWidth, nscoord aHeight)
     return NS_ERROR_NOT_AVAILABLE;
   }
 
+  if (!mIsDestroying && !mResizeEvent.IsPending() &&
+      !mAsyncResizeTimerIsActive) {
+    FireBeforeResizeEvent();
+  }
+
   mPresContext->SetVisibleArea(nsRect(0, 0, aWidth, aHeight));
 
   // There isn't anything useful we can do if the initial reflow hasn't happened
@@ -2905,6 +2911,22 @@ PresShell::ResizeReflowIgnoreOverride(nscoord aWidth, nscoord aHeight)
   return NS_OK; //XXX this needs to be real. MMP
 }
 
+void
+PresShell::FireBeforeResizeEvent()
+{
+  if (mIsDocumentGone)
+    return;
+
+  // Send beforeresize event from here.
+  nsEvent event(PR_TRUE, NS_BEFORERESIZE_EVENT);
+
+  nsPIDOMWindow *window = mDocument->GetWindow();
+  if (window) {
+    nsCOMPtr<nsIPresShell> kungFuDeathGrip(this);
+    nsEventDispatcher::Dispatch(window, mPresContext, &event);
+  }
+}
+
 void
 PresShell::FireResizeEvent()
 {
diff --git a/layout/base/nsStyleChangeList.cpp b/layout/base/nsStyleChangeList.cpp
index f857820e6c58..be4ebcd8a967 100644
--- a/layout/base/nsStyleChangeList.cpp
+++ b/layout/base/nsStyleChangeList.cpp
@@ -145,8 +145,8 @@ nsStyleChangeList::AppendChange(nsIFrame* aFrame, nsIContent* aContent, nsChange
   return NS_OK;
 }
 
-void 
-nsStyleChangeList::Clear() 
+void
+nsStyleChangeList::Clear()
 {
   for (PRInt32 index = mCount - 1; index >= 0; --index) {
     nsIContent* content = mArray[index].mContent;
diff --git a/layout/build/nsLayoutCID.h b/layout/build/nsLayoutCID.h
index 44976bd535c3..2b6e28445f91 100644
--- a/layout/build/nsLayoutCID.h
+++ b/layout/build/nsLayoutCID.h
@@ -242,6 +242,10 @@
 #define NS_ICONTENTUTILS_CID \
 { 0x762C4AE7, 0xB923, 0x422F, { 0xB9, 0x7E, 0xB9, 0xBF, 0xC1, 0xEF, 0x7B, 0xF0 } }
 
+// {1802442d-a59b-43b8-b8fd-070da5549593}
+#define NS_ICONTENTUTILS2_CID \
+{ 0x1802442d, 0xa59b, 0x43b8, { 0xb8, 0xfd, 0x07, 0x0d, 0xa5, 0x54, 0x95, 0x93 } }
+
 // {1A26A7B7-D06E-4F45-8B45-D7AD60F7A9AB}
 #define INDEXEDDB_MANAGER_CID \
 { 0x1a26a7b7, 0xd06e, 0x4f45, { 0x8b, 0x45, 0xd7, 0xad, 0x60, 0xf7, 0xa9, 0xab } }
diff --git a/layout/build/nsLayoutModule.cpp b/layout/build/nsLayoutModule.cpp
index 47586b1d2032..bff3bf059e60 100644
--- a/layout/build/nsLayoutModule.cpp
+++ b/layout/build/nsLayoutModule.cpp
@@ -226,7 +226,7 @@ NS_GENERIC_FACTORY_CONSTRUCTOR(nsHTMLEditor)
 #include "nsHTMLCanvasFrame.h"
 
 #include "nsIDOMCanvasRenderingContext2D.h"
-#include "nsICanvasRenderingContextWebGL.h"
+#include "nsIDOMWebGLRenderingContext.h"
 
 class nsIDocumentLoaderFactory;
 
@@ -448,7 +448,7 @@ nsresult NS_NewTreeBoxObject(nsIBoxObject** aResult);
 #endif
 
 nsresult NS_NewCanvasRenderingContext2D(nsIDOMCanvasRenderingContext2D** aResult);
-nsresult NS_NewCanvasRenderingContextWebGL(nsICanvasRenderingContextWebGL** aResult);
+nsresult NS_NewCanvasRenderingContextWebGL(nsIDOMWebGLRenderingContext** aResult);
 
 nsresult NS_CreateFrameTraversal(nsIFrameTraversal** aResult);
 
@@ -584,9 +584,10 @@ MAKE_CTOR(CreateVideoDocument,            nsIDocument,                 NS_NewVid
 MAKE_CTOR(CreateFocusManager,             nsIFocusManager,      NS_NewFocusManager)
 
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsIContentUtils)
+NS_GENERIC_FACTORY_CONSTRUCTOR(nsIContentUtils2)
 
 MAKE_CTOR(CreateCanvasRenderingContext2D, nsIDOMCanvasRenderingContext2D, NS_NewCanvasRenderingContext2D)
-MAKE_CTOR(CreateCanvasRenderingContextWebGL, nsICanvasRenderingContextWebGL, NS_NewCanvasRenderingContextWebGL)
+MAKE_CTOR(CreateCanvasRenderingContextWebGL, nsIDOMWebGLRenderingContext, NS_NewCanvasRenderingContextWebGL)
 
 NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(nsStyleSheetService, Init)
 
@@ -876,6 +877,7 @@ NS_DEFINE_NAMED_CID(NS_GEOLOCATION_SERVICE_CID);
 NS_DEFINE_NAMED_CID(NS_GEOLOCATION_CID);
 NS_DEFINE_NAMED_CID(NS_FOCUSMANAGER_CID);
 NS_DEFINE_NAMED_CID(NS_ICONTENTUTILS_CID);
+NS_DEFINE_NAMED_CID(NS_ICONTENTUTILS2_CID);
 NS_DEFINE_NAMED_CID(CSPSERVICE_CID);
 NS_DEFINE_NAMED_CID(NS_EVENTLISTENERSERVICE_CID);
 NS_DEFINE_NAMED_CID(NS_GLOBALMESSAGEMANAGER_CID);
@@ -1028,6 +1030,7 @@ static const mozilla::Module::CIDEntry kLayoutCIDs[] = {
   { &kNS_GEOLOCATION_CID, false, NULL, nsGeolocationConstructor },
   { &kNS_FOCUSMANAGER_CID, false, NULL, CreateFocusManager },
   { &kNS_ICONTENTUTILS_CID, false, NULL, nsIContentUtilsConstructor },
+  { &kNS_ICONTENTUTILS2_CID, false, NULL, nsIContentUtils2Constructor },
   { &kCSPSERVICE_CID, false, NULL, CSPServiceConstructor },
   { &kNS_EVENTLISTENERSERVICE_CID, false, NULL, CreateEventListenerService },
   { &kNS_GLOBALMESSAGEMANAGER_CID, false, NULL, CreateGlobalMessageManager },
@@ -1174,6 +1177,7 @@ static const mozilla::Module::ContractIDEntry kLayoutContracts[] = {
   { "@mozilla.org/geolocation;1", &kNS_GEOLOCATION_CID },
   { "@mozilla.org/focus-manager;1", &kNS_FOCUSMANAGER_CID },
   { "@mozilla.org/content/contentutils;1", &kNS_ICONTENTUTILS_CID },
+  { "@mozilla.org/content/contentutils2;1", &kNS_ICONTENTUTILS2_CID },
   { CSPSERVICE_CONTRACTID, &kCSPSERVICE_CID },
   { NS_EVENTLISTENERSERVICE_CONTRACTID, &kNS_EVENTLISTENERSERVICE_CID },
   { NS_GLOBALMESSAGEMANAGER_CONTRACTID, &kNS_GLOBALMESSAGEMANAGER_CID },
diff --git a/layout/generic/nsGfxScrollFrame.cpp b/layout/generic/nsGfxScrollFrame.cpp
index 0197c255481d..10a1b378c73d 100644
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@@ -2129,15 +2129,16 @@ nsGfxScrollFrameInner::CreateAnonymousContent(nsTArray<nsIContent*>& aElements)
   nsPresContext* presContext = mOuter->PresContext();
   nsIFrame* parent = mOuter->GetParent();
 
-  // Don't create scrollbars if we're printing/print previewing
-  // Get rid of this code when printing moves to its own presentation
-  if (!presContext->IsDynamic()) {
-    // allow scrollbars if this is the child of the viewport, because
-    // we must be the scrollbars for the print preview window
-    if (!(mIsRoot && presContext->HasPaginatedScrolling())) {
-      mNeverHasVerticalScrollbar = mNeverHasHorizontalScrollbar = PR_TRUE;
-      return NS_OK;
-    }
+  // Don't create scrollbars if we're an SVG document being used as an image,
+  // or if we're printing/print previewing.
+  // (In the printing case, we allow scrollbars if this is the child of the
+  // viewport & paginated scrolling is enabled, because then we must be the
+  // scroll frame for the print preview window, & that does need scrollbars.)
+  if (presContext->Document()->IsBeingUsedAsImage() ||
+      (!presContext->IsDynamic() &&
+       !(mIsRoot && presContext->HasPaginatedScrolling()))) {
+    mNeverHasVerticalScrollbar = mNeverHasHorizontalScrollbar = PR_TRUE;
+    return NS_OK;
   }
 
   // Check if the frame is resizable.
diff --git a/layout/generic/nsObjectFrame.cpp b/layout/generic/nsObjectFrame.cpp
index 0709bab524fe..fa79fd2427ff 100644
--- a/layout/generic/nsObjectFrame.cpp
+++ b/layout/generic/nsObjectFrame.cpp
@@ -52,6 +52,7 @@
 #ifdef MOZ_X11
 #include <QX11Info>
 #endif
+#undef slots
 #endif
 
 #ifdef MOZ_IPC
diff --git a/layout/printing/nsPrintEngine.cpp b/layout/printing/nsPrintEngine.cpp
index 2f534cbeb7b2..68db6c02ad05 100644
--- a/layout/printing/nsPrintEngine.cpp
+++ b/layout/printing/nsPrintEngine.cpp
@@ -974,7 +974,7 @@ nsPrintEngine::GetCurrentPrintSettings(nsIPrintSettings * *aCurrentPrintSettings
 nsresult
 nsPrintEngine::CheckForPrinters(nsIPrintSettings* aPrintSettings)
 {
-#ifdef XP_MACOSX
+#if defined(XP_MACOSX) || defined(ANDROID)
   // Mac doesn't support retrieving a printer list.
   return NS_OK;
 #else
diff --git a/layout/reftests/bidi/612843-1-ref.html b/layout/reftests/bidi/612843-1-ref.html
new file mode 100644
index 000000000000..5dab89080ff5
--- /dev/null
+++ b/layout/reftests/bidi/612843-1-ref.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<!-- Tests bidi class of U+070F SYRIAC ABBREVIATION MARK -->
+<html>
+ <head>
+  <meta http-equiv="content-type" content="text/html; charset=utf-8">
+ </head>
+  <style type="text/css">
+body {
+  font-family: serif;
+  font-size: 24px;
+}
+  </style
+ <body>
+  <p dir="rtl" style="unicode-bidi: bidi-override;">&#x661;&#x662;&#x60c;&#x070f;&#x071f;&#x0725;</p>
+ </body>
+</html>
diff --git a/layout/reftests/bidi/612843-1.html b/layout/reftests/bidi/612843-1.html
new file mode 100644
index 000000000000..2065322c5107
--- /dev/null
+++ b/layout/reftests/bidi/612843-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<!-- Tests bidi class of U+070F SYRIAC ABBREVIATION MARK -->
+<html>
+ <head>
+  <meta http-equiv="content-type" content="text/html; charset=utf-8">
+ </head>
+  <style type="text/css">
+body {
+  font-family: serif;
+  font-size: 24px;
+}
+  </style
+ <body>
+  <p dir="rtl">&#x662;&#x661;&#x60c;&#x070f;&#x071f;&#x0725;</p>
+ </body>
+</html>
diff --git a/layout/reftests/bidi/reftest.list b/layout/reftests/bidi/reftest.list
index cb7f1356ebe5..30dff1e2b3ef 100644
--- a/layout/reftests/bidi/reftest.list
+++ b/layout/reftests/bidi/reftest.list
@@ -57,3 +57,4 @@ random-if(gtk2Widget) == 386339.html 386339-ref.html
 == 588739-1.html 588739-ref.html
 == 588739-2.html 588739-ref.html
 == 588739-3.html 588739-ref.html
+== 612843-1.html 612843-1-ref.html
diff --git a/layout/reftests/border-radius/corner-joins-1-ref.xhtml b/layout/reftests/border-radius/corner-joins-1-ref.xhtml
new file mode 100644
index 000000000000..1b0ba24a6b0c
--- /dev/null
+++ b/layout/reftests/border-radius/corner-joins-1-ref.xhtml
@@ -0,0 +1,89 @@
+<?xml version="1.0"?>
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:svg="http://www.w3.org/2000/svg">
+<head>
+<title>border</title>
+<style type="text/css">
+@namespace url("http://www.w3.org/1999/xhtml");
+@namespace svg url("http://www.w3.org/2000/svg");
+
+div.wrapper {
+  float: left;
+  margin-left: 20px;
+  margin-top: 10px;
+}
+
+div.cover, div.cover2 {
+	position: absolute;
+	border: 4px solid white; /* cover areas that may differ */
+	width: 140px;
+	height: 118px;
+	border-radius: 63px;
+	margin-left: -2px;
+	margin-top: -2px;
+}
+div.cover2 {
+	height: 82px;
+	margin-top: 16px;
+	border-radius: 63px / 45px;
+}
+
+svg|svg {
+	display: block;
+	width: 146px;
+	height: 122px;
+	margin-right: -2px;
+	margin-bottom: 20px;
+}
+
+</style>
+</head>
+<body>
+<div class="wrapper">
+<div class="cover"></div>
+<div class="cover2"></div>
+<svg:svg>
+  <svg:rect x="0" y="0" width="144px" height="122px" rx="61px" ry="61px"
+            fill="blue"/>
+  <svg:rect x="0" y="18px" width="144px" height="86px" rx="61px" ry="43px"
+            fill="red"/>
+</svg:svg>
+<div class="cover"></div>
+<div class="cover2"></div>
+<svg:svg>
+  <svg:clipPath id="topclip">
+    <svg:rect x="0" y="0" width="144px" height="61px"/>
+  </svg:clipPath>
+  <svg:clipPath id="botclip">
+    <svg:rect x="0" y="61px" width="144px" height="61px"/>
+  </svg:clipPath>
+  <svg:rect x="0" y="0" width="144px" height="122px" rx="61px" ry="61px"
+            fill="black" clip-path="url(#topclip)"/>
+  <svg:rect x="0" y="0" width="144px" height="122px" rx="61px" ry="61px"
+            fill="blue" clip-path="url(#botclip)"/>
+  <svg:rect x="0" y="18px" width="144px" height="86px" rx="61px" ry="43px"
+            fill="red"/>
+</svg:svg>
+</div>
+<div class="wrapper">
+<div class="cover" style="width: 142px"></div>
+<div class="cover2" style="margin-left: -1px; border-radius: 61px / 45px"></div>
+<svg:svg>
+  <svg:rect x="0" y="0" width="146px" height="122px" rx="61px" ry="61px"
+            fill="blue"/>
+  <svg:rect x="0" y="18px" width="146px" height="86px" rx="61px" ry="43px"
+            fill="red"/>
+</svg:svg>
+<div class="cover"></div>
+<div class="cover2"></div>
+<svg:svg>
+  <svg:rect x="0" y="0" width="144px" height="122px" rx="61px" ry="61px"
+            fill="black" clip-path="url(#topclip)"/>
+  <svg:rect x="0" y="0" width="144px" height="122px" rx="61px" ry="61px"
+            fill="blue" clip-path="url(#botclip)"/>
+  <svg:rect x="0" y="18px" width="144px" height="86px" rx="61px" ry="43px"
+            fill="red"/>
+</svg:svg>
+</div>
+</body>
+</html>
diff --git a/layout/reftests/border-radius/corner-joins-1.xhtml b/layout/reftests/border-radius/corner-joins-1.xhtml
new file mode 100644
index 000000000000..f7a9b8ecdc23
--- /dev/null
+++ b/layout/reftests/border-radius/corner-joins-1.xhtml
@@ -0,0 +1,78 @@
+<?xml version="1.0"?>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>border</title>
+<style type="text/css">
+
+div.wrapper {
+  float: left;
+  margin-left: 20px;
+  margin-top: 10px;
+}
+
+div.test {
+	width: 144px;
+	height: 86px;
+	border-radius: 72px;
+	border-top: 18px solid;
+	border-bottom: 18px solid;
+	background: red;
+	margin-bottom: 20px;
+}
+
+div.cover, div.cover2 {
+	position: absolute;
+	border: 4px solid white; /* cover areas that may differ */
+	width: 140px;
+	height: 118px;
+	border-radius: 63px;
+	margin-left: -2px;
+	margin-top: -2px;
+}
+div.cover2 {
+	height: 82px;
+	margin-top: 16px;
+	border-radius: 63px / 45px;
+}
+
+#one {
+	border-color: blue;
+}
+
+#two {
+	border-bottom-color: blue;
+}
+
+#three {
+	border-color: blue;
+	border-left: 0.01px solid red;
+	border-right: 0.01px solid red;
+}
+
+#four {
+	border-bottom-color: blue;
+	border-left: 0.001px solid red;
+	border-right: 0.001px solid red;
+}
+
+</style>
+</head>
+<body>
+<div class="wrapper">
+<div class="cover"></div>
+<div class="cover2"></div>
+<div class="test" id="one"></div>
+<div class="cover"></div>
+<div class="cover2"></div>
+<div class="test" id="two"></div>
+</div>
+<div class="wrapper">
+<div class="cover" style="width: 142px"></div>
+<div class="cover2" style="margin-left: -1px; border-radius: 61px / 45px"></div>
+<div class="test" id="three"></div>
+<div class="cover"></div>
+<div class="cover2"></div>
+<div class="test" id="four"></div>
+</div>
+</body>
+</html>
diff --git a/layout/reftests/border-radius/corner-joins-2-ref.xhtml b/layout/reftests/border-radius/corner-joins-2-ref.xhtml
new file mode 100644
index 000000000000..de765cd10de5
--- /dev/null
+++ b/layout/reftests/border-radius/corner-joins-2-ref.xhtml
@@ -0,0 +1,36 @@
+<?xml version="1.0"?>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>border</title>
+<style type="text/css">
+
+body {
+	filter: url('../filters.svg#NonWhiteToBlack');
+}
+
+body > div {
+	/* filter doesn't change alpha */
+	background: white;
+}
+
+div.test {
+	width: 154px;
+	height: 142px;
+	border-radius: 72px;
+	background: black;
+}
+
+</style>
+</head>
+<body>
+<div>
+<div class="test"></div>
+</div>
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     version="1.1">
+  <!-- use an empty g to force filters.svg to load before onload -->
+  <use xlink:href="../filters.svg#empty" />
+</svg>
+</body>
+</html>
diff --git a/layout/reftests/border-radius/corner-joins-2.xhtml b/layout/reftests/border-radius/corner-joins-2.xhtml
new file mode 100644
index 000000000000..fcc0399c3241
--- /dev/null
+++ b/layout/reftests/border-radius/corner-joins-2.xhtml
@@ -0,0 +1,42 @@
+<?xml version="1.0"?>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>border</title>
+<style type="text/css">
+
+body {
+	filter: url('../filters.svg#NonWhiteToBlack');
+}
+
+body > div {
+	/* filter doesn't change alpha */
+	background: white;
+}
+
+div.test {
+	width: 144px;
+	height: 86px;
+	border-radius: 72px;
+	border-top: 28px solid;
+	border-bottom: 28px solid;
+	background: cyan;
+	margin-bottom: 20px;
+	border-color: blue;
+	border-left: 5px solid red;
+	border-right: 5px solid red;
+}
+
+</style>
+</head>
+<body>
+<div>
+<div class="test"></div>
+</div>
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     version="1.1">
+  <!-- use an empty g to force filters.svg to load before onload -->
+  <use xlink:href="../filters.svg#empty" />
+</svg>
+</body>
+</html>
diff --git a/layout/reftests/border-radius/reftest.list b/layout/reftests/border-radius/reftest.list
index 15dd1485f850..7e59dc18e029 100644
--- a/layout/reftests/border-radius/reftest.list
+++ b/layout/reftests/border-radius/reftest.list
@@ -69,3 +69,7 @@ fails-if(cocoaWidget) == intersecting-clipping-1-refc.html intersecting-clipping
 # test that border-radius is reduced for scrollbars
 == scrollbar-clamping-1.html scrollbar-clamping-1-ref.html
 == scrollbar-clamping-2.html scrollbar-clamping-2-ref.html
+
+# Test for bad corner joins.
+== corner-joins-1.xhtml corner-joins-1-ref.xhtml
+random-if(winWidget) HTTP(..) == corner-joins-2.xhtml corner-joins-2-ref.xhtml
diff --git a/layout/reftests/bugs/536061-ref.html b/layout/reftests/bugs/536061-ref.html
new file mode 100644
index 000000000000..78f44693e0cb
--- /dev/null
+++ b/layout/reftests/bugs/536061-ref.html
@@ -0,0 +1,53 @@
+<!DOCTYPE html>
+
+<html lang="en">
+<head>
+  <meta http-equiv="content-type" content="text/html; charset=utf-8" />
+  <title>Bugs with -moz-transform: rotate() and -moz-box-shadow</title>
+
+  <style>
+    body {
+        overflow: hidden;
+    }
+
+    .label {
+        position: absolute;
+        top: 200px;
+        left: 196px;
+        margin: 0;
+        height:16px;
+        width: 300px;
+        -moz-box-shadow: 0 0 .7em black;
+        border: 1px black solid;
+    }
+    .vlabel {
+        position: absolute;
+        top: 58px;
+        left: 42px;
+        margin: 0;
+        width: 16px;
+        height: 300px;
+        -moz-box-shadow: 0 0 .7em black;
+        border: 1px black solid;
+    }
+  </style>
+</head>
+
+<body>
+
+<p class="label"></p>
+<p class="label" style="top: 400px; -moz-box-shadow:none; outline: 3px dashed blue;"></p>
+<p class="vlabel" style="-moz-box-shadow:none; outline: 3px dashed blue;"></p>
+<p class="vlabel" style="left:102px; "></p>
+<p class="vlabel" style="top:454px; -moz-box-shadow:none; outline: 3px dashed blue; "></p>
+<p class="vlabel" style="top:454px; left:102px;"></p>
+
+<!-- cover a few shadow corners which are a bit different -->
+<div style="position:absolute; top:40px; left:85px; width:50px; height:50px; background:black; z-index:99;"></div>
+<div style="position:absolute; top:340px; left:85px; width:50px; height:50px; background:black; z-index:99;"></div>
+<div style="position:absolute; top:420px; left:85px; width:50px; height:50px; background:black; z-index:99;"></div>
+<div style="position:absolute; top:730px; left:85px; width:50px; height:50px; background:black; z-index:99;"></div>
+
+</body>
+
+</html>
diff --git a/layout/reftests/bugs/536061.html b/layout/reftests/bugs/536061.html
new file mode 100644
index 000000000000..ba207a94405e
--- /dev/null
+++ b/layout/reftests/bugs/536061.html
@@ -0,0 +1,54 @@
+<!DOCTYPE html>
+
+<html lang="en">
+<head>
+  <meta http-equiv="content-type" content="text/html; charset=utf-8" />
+  <title>Bugs with -moz-transform: rotate() and -moz-box-shadow</title>
+
+  <style>
+    body {
+        overflow: hidden;
+    }
+
+    .label {
+        position: absolute;
+        top: 200px;
+        left: 100px;
+        margin: 0;
+        height: 16px;
+        width: 300px;
+        -moz-transform: translate(96px);
+        -moz-box-shadow: 0 0 .7em black;
+        border: 1px black solid;
+    }
+    .vlabel {
+        position: absolute;
+        top: 40px;
+        left: 40px;
+        margin: 0;
+        width: 16px;
+        height: 300px;
+        -moz-box-shadow: 0 0 .7em black;
+        border: 1px black solid;
+    }
+  </style>
+</head>
+
+<body>
+
+<p class="label"></p>
+<p class="label" style="top: 400px; -moz-box-shadow:none; outline: 3px dashed blue;"></p>
+<p class="label" style="left:-100px; top: 200px; -moz-box-shadow:none; outline: 3px dashed blue; -moz-transform: rotate(90deg);"></p>
+<p class="label" style="left:-40px; top: 200px; -moz-transform: rotate(90deg);"></p>
+<p class="label" style="left:-100px; top: 200px; -moz-box-shadow:none; outline: 3px dashed blue; -moz-transform: translate(0,396px) rotate(90deg);"></p>
+<p class="label" style="left:-40px; top: 200px; -moz-transform: translate(0,396px) rotate(90deg);"></p>
+
+<!-- cover a few shadow corners which are a bit different -->
+<div style="position:absolute; top:40px; left:85px; width:50px; height:50px; background:black; z-index:99;"></div>
+<div style="position:absolute; top:340px; left:85px; width:50px; height:50px; background:black; z-index:99;"></div>
+<div style="position:absolute; top:420px; left:85px; width:50px; height:50px; background:black; z-index:99;"></div>
+<div style="position:absolute; top:730px; left:85px; width:50px; height:50px; background:black; z-index:99;"></div>
+
+</body>
+
+</html>
diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list
index 77e4c2de924d..99c35127bcc0 100644
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -1413,6 +1413,7 @@ asserts(5) == 528038-2.html 528038-2-ref.html # bug 512749
 == 534808-1.html 534808-1-ref.html
 == 534808-2.html 534808-2-ref.html
 == 534919-1.html 534919-1-ref.html
+== 536061.html 536061-ref.html
 == 537507-1.xul 537507-1-ref.xul
 == 537507-2.html 537507-2-ref.html
 == 537471-1.html 537471-1-ref.html
diff --git a/layout/reftests/counters/reftest.list b/layout/reftests/counters/reftest.list
index 0930e0bd3c55..2972b90b1d8e 100644
--- a/layout/reftests/counters/reftest.list
+++ b/layout/reftests/counters/reftest.list
@@ -9,7 +9,7 @@
 == t1202-counter-07-b-test.html t1202-counter-07-b-reference.html
 == t1202-counter-08-b-test.html t1202-counter-08-b-reference.html
 == t1202-counter-09-b-test.html t1202-counter-09-b-reference.html
-fails == t1202-counter-10-b-test.html t1202-counter-10-b-reference.html # need to re-read bug 287166 to see if this is correct
+== t1202-counter-10-b-test.html t1202-counter-10-b-reference.html
 == t1202-counter-11-b-test.html t1202-counter-11-b-reference.html
 == t1202-counter-12-b-test.html t1202-counter-12-b-reference.html
 == t1202-counter-13-b-test.html t1202-counter-13-b-reference.html
@@ -26,7 +26,7 @@ fails == t1202-counter-10-b-test.html t1202-counter-10-b-reference.html # need t
 == t1202-counters-07-b-test.html t1202-counters-07-b-reference.html
 == t1202-counters-08-b-test.html t1202-counters-08-b-reference.html
 == t1202-counters-09-b-test.html t1202-counters-09-b-reference.html
-fails == t1202-counters-10-b-test.html t1202-counters-10-b-reference.html # need to re-read bug 287166 to see if this is correct
+== t1202-counters-10-b-test.html t1202-counters-10-b-reference.html
 == t1202-counters-11-b-test.html t1202-counters-11-b-reference.html
 == t1202-counters-12-b-test.html t1202-counters-12-b-reference.html
 == t1202-counters-13-b-test.html t1202-counters-13-b-reference.html
diff --git a/layout/reftests/counters/t1202-counter-10-b-reference.html b/layout/reftests/counters/t1202-counter-10-b-reference.html
index 5ce9565ad1e2..02965401ec4c 100644
--- a/layout/reftests/counters/t1202-counter-10-b-reference.html
+++ b/layout/reftests/counters/t1202-counter-10-b-reference.html
@@ -46,7 +46,7 @@
    <span>&#x54F;</span>
    <span>&#x550;</span>
    <span>&#x551;</span>
-   <span>&#x548;&#x552;</span>
+   <span>&#x552;</span>
    <span>&#x553;</span>
    <span>&#x554;</span>
    <span>&#x554;&#x54B;&#x542;&#x539;</span>
diff --git a/layout/reftests/counters/t1202-counters-10-b-reference.html b/layout/reftests/counters/t1202-counters-10-b-reference.html
index 037e5d62bdb5..af593dab5c08 100644
--- a/layout/reftests/counters/t1202-counters-10-b-reference.html
+++ b/layout/reftests/counters/t1202-counters-10-b-reference.html
@@ -47,7 +47,7 @@
    <span>&#x531;.&#x54F;</span>
    <span>&#x531;.&#x550;</span>
    <span>&#x531;.&#x551;</span>
-   <span>&#x531;.&#x548;&#x552;</span>
+   <span>&#x531;.&#x552;</span>
    <span>&#x531;.&#x553;</span>
    <span>&#x531;.&#x554;</span>
    <span>&#x531;.&#x554;&#x54B;&#x542;&#x539;</span>
diff --git a/layout/reftests/css-invalid/output/output-invalid.html b/layout/reftests/css-invalid/output/output-invalid.html
new file mode 100644
index 000000000000..75dc7b09c5e1
--- /dev/null
+++ b/layout/reftests/css-invalid/output/output-invalid.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <!-- Test: if output has a custom error, it should not be affected by :valid
+             pseudo-class. -->
+  <link rel='stylesheet' type='text/css' href='style.css'>
+  <body onload="document.getElementById('b').setCustomValidity('foo'); document.documentElement.className='';">
+    <output class='invalid' id='b'>foo</output>
+  </body>
+</html>
diff --git a/layout/reftests/css-invalid/output/output-ref.html b/layout/reftests/css-invalid/output/output-ref.html
new file mode 100644
index 000000000000..0db2c440c753
--- /dev/null
+++ b/layout/reftests/css-invalid/output/output-ref.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+  <link rel='stylesheet' type='text/css' href='style.css'>
+  <body>
+    <output class='ref'>foo</output>
+  </body>
+</html>
diff --git a/layout/reftests/css-invalid/output/output-valid.html b/layout/reftests/css-invalid/output/output-valid.html
new file mode 100644
index 000000000000..f113342c9c17
--- /dev/null
+++ b/layout/reftests/css-invalid/output/output-valid.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+  <!-- Test: if output has no custom error and is not barred from constraint
+             validation, it should be affected by :valid pseudo-class. -->
+  <link rel='stylesheet' type='text/css' href='style.css'>
+  <body>
+    <output class='notinvalid'>foo</output>
+  </body>
+</html>
diff --git a/layout/reftests/css-invalid/output/reftest.list b/layout/reftests/css-invalid/output/reftest.list
new file mode 100644
index 000000000000..74468e394a3d
--- /dev/null
+++ b/layout/reftests/css-invalid/output/reftest.list
@@ -0,0 +1,2 @@
+== output-valid.html output-ref.html
+== output-invalid.html output-ref.html
diff --git a/layout/reftests/css-invalid/output/style.css b/layout/reftests/css-invalid/output/style.css
new file mode 100644
index 000000000000..3ede65943efe
--- /dev/null
+++ b/layout/reftests/css-invalid/output/style.css
@@ -0,0 +1,22 @@
+/* Override default style */
+output {
+  color: black;
+}
+
+output.notinvalid {
+  color: green;
+}
+output.notinvalid:invalid {
+  color: red;
+}
+
+output.invalid {
+  color: red;
+}
+output.invalid:invalid {
+  color: green;
+}
+
+output.ref {
+  color: green;
+}
diff --git a/layout/reftests/css-invalid/reftest.list b/layout/reftests/css-invalid/reftest.list
index 8e5f96ebfedf..7a9fcda3a7d6 100644
--- a/layout/reftests/css-invalid/reftest.list
+++ b/layout/reftests/css-invalid/reftest.list
@@ -6,6 +6,7 @@ include button/reftest.list
 include input/reftest.list
 include select/reftest.list
 include textarea/reftest.list
+include output/reftest.list
 
 # default :invalid style
 include default-style/reftest.list
diff --git a/layout/reftests/css-invalid/select/reftest.list b/layout/reftests/css-invalid/select/reftest.list
index af53f259a4ca..1b3ae0430c35 100644
--- a/layout/reftests/css-invalid/select/reftest.list
+++ b/layout/reftests/css-invalid/select/reftest.list
@@ -3,6 +3,10 @@
 == select-disabled.html select-disabled-ref.html
 == select-dyn-disabled.html select-disabled-ref.html
 == select-dyn-not-disabled.html select-ref.html
+== select-required-invalid.html select-required-ref.html
+== select-required-valid.html select-required-ref.html
+== select-required-multiple-invalid.html select-required-multiple-ref.html
+== select-required-multiple-valid.html select-required-multiple-ref.html
 == select-disabled-fieldset-1.html select-fieldset-ref.html
 == select-disabled-fieldset-2.html select-fieldset-ref.html
 == select-fieldset-legend.html select-fieldset-legend-ref.html
diff --git a/layout/reftests/css-invalid/select/select-required-invalid.html b/layout/reftests/css-invalid/select/select-required-invalid.html
new file mode 100644
index 000000000000..31f6c81d11ee
--- /dev/null
+++ b/layout/reftests/css-invalid/select/select-required-invalid.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+  <!-- Test: if select is required and has a select option which has an empty
+             string value, :invalid should apply. -->
+  <link rel='stylesheet' type='text/css' href='style.css'>
+  <body>
+    <select class='invalid' required>
+      <option selected value="">foo</option>
+    </select>
+  </body>
+</html></html>
diff --git a/layout/reftests/css-invalid/select/select-required-multiple-invalid.html b/layout/reftests/css-invalid/select/select-required-multiple-invalid.html
new file mode 100644
index 000000000000..d61068d03a03
--- /dev/null
+++ b/layout/reftests/css-invalid/select/select-required-multiple-invalid.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+  <!-- Test: if select is required and has all selected option value set to the
+             string string, :invalid should apply. -->
+  <link rel='stylesheet' type='text/css' href='style.css'>
+  <body>
+    <select class='invalid' required multiple>
+      <option selected></option>
+      <option selected value="">foo</option>
+    </select>
+  </body>
+</html>
diff --git a/layout/reftests/css-invalid/select/select-required-multiple-ref.html b/layout/reftests/css-invalid/select/select-required-multiple-ref.html
new file mode 100644
index 000000000000..a9477333f8a6
--- /dev/null
+++ b/layout/reftests/css-invalid/select/select-required-multiple-ref.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+  <link rel='stylesheet' type='text/css' href='style.css'>
+  <body>
+    <select multiple style="background-color: green;">
+      <option selected></option>
+      <option selected value="">foo</option>
+    </select>
+  </body>
+</html>
diff --git a/layout/reftests/css-invalid/select/select-required-multiple-valid.html b/layout/reftests/css-invalid/select/select-required-multiple-valid.html
new file mode 100644
index 000000000000..e58e0c576aaf
--- /dev/null
+++ b/layout/reftests/css-invalid/select/select-required-multiple-valid.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+  <!-- Test: if select is required and has a selected option which has value
+             different from the empty string, :invalid should not apply. -->
+  <link rel='stylesheet' type='text/css' href='style.css'>
+  <body>
+    <select class='notinvalid' required multiple>
+      <option selected></option>
+      <option selected>foo</option>
+    </select>
+  </body>
+</html>
diff --git a/layout/reftests/css-invalid/select/select-required-ref.html b/layout/reftests/css-invalid/select/select-required-ref.html
new file mode 100644
index 000000000000..3c2bde80a042
--- /dev/null
+++ b/layout/reftests/css-invalid/select/select-required-ref.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+  <link rel='stylesheet' type='text/css' href='style.css'>
+  <body>
+    <select style="background-color: green;">
+      <option selected value="">foo</option>
+    </selecT>
+  </body>
+</html>
diff --git a/layout/reftests/css-invalid/select/select-required-valid.html b/layout/reftests/css-invalid/select/select-required-valid.html
new file mode 100644
index 000000000000..e6e4856dc4ef
--- /dev/null
+++ b/layout/reftests/css-invalid/select/select-required-valid.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+  <!-- Test: if select is required and has a select option which has value
+             different from the empty string, :invalid should not apply. -->
+  <link rel='stylesheet' type='text/css' href='style.css'>
+  <body>
+    <select class='notinvalid' required>
+      <option selected>foo</option>
+    </select>
+  </body>
+</html>
diff --git a/layout/reftests/css-required/css-required-select-ref.html b/layout/reftests/css-required/css-required-select-ref.html
new file mode 100644
index 000000000000..e419bb1845b1
--- /dev/null
+++ b/layout/reftests/css-required/css-required-select-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <select></select>
+  </body>
+</html>
diff --git a/layout/reftests/css-required/reftest.list b/layout/reftests/css-required/reftest.list
index 7335a37247f6..cd5943920b38 100644
--- a/layout/reftests/css-required/reftest.list
+++ b/layout/reftests/css-required/reftest.list
@@ -7,6 +7,7 @@
 == css-required-password.html css-required-password-ref.html
 == css-required-tel.html css-required-tel-ref.html
 == css-required-search.html css-required-search-ref.html
+== css-required-select.html css-required-select-ref.html
 
 # Checking dynamic behavior with <input type='text'>
 == css-required-dyn-1.html css-required-text-ref.html
@@ -24,6 +25,5 @@
 == css-required-reset.html about:blank
 
 # Following elements can be optional but can't be required
-== css-required-select.html about:blank
 == css-required-button-element.html about:blank
 
diff --git a/layout/reftests/css-valid/output/output-invalid.html b/layout/reftests/css-valid/output/output-invalid.html
new file mode 100644
index 000000000000..dc0abeb3478e
--- /dev/null
+++ b/layout/reftests/css-valid/output/output-invalid.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <!-- Test: if output has a custom error, it should not be affected by :valid
+             pseudo-class. -->
+  <link rel='stylesheet' type='text/css' href='style.css'>
+  <body onload="document.getElementById('b').setCustomValidity('foo'); document.documentElement.className='';">
+    <output class='notvalid' id='b'>foo</output>
+  </body>
+</html>
diff --git a/layout/reftests/css-valid/output/output-ref.html b/layout/reftests/css-valid/output/output-ref.html
new file mode 100644
index 000000000000..0db2c440c753
--- /dev/null
+++ b/layout/reftests/css-valid/output/output-ref.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+  <link rel='stylesheet' type='text/css' href='style.css'>
+  <body>
+    <output class='ref'>foo</output>
+  </body>
+</html>
diff --git a/layout/reftests/css-valid/output/output-valid.html b/layout/reftests/css-valid/output/output-valid.html
new file mode 100644
index 000000000000..524ac8ea88f0
--- /dev/null
+++ b/layout/reftests/css-valid/output/output-valid.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+  <!-- Test: if output has no custom error and is not barred from constraint
+             validation, it should be affected by :valid pseudo-class. -->
+  <link rel='stylesheet' type='text/css' href='style.css'>
+  <body>
+    <output class='valid'>foo</output>
+  </body>
+</html>
diff --git a/layout/reftests/css-valid/output/reftest.list b/layout/reftests/css-valid/output/reftest.list
new file mode 100644
index 000000000000..74468e394a3d
--- /dev/null
+++ b/layout/reftests/css-valid/output/reftest.list
@@ -0,0 +1,2 @@
+== output-valid.html output-ref.html
+== output-invalid.html output-ref.html
diff --git a/layout/reftests/css-valid/output/style.css b/layout/reftests/css-valid/output/style.css
new file mode 100644
index 000000000000..dbfc3f7a4c28
--- /dev/null
+++ b/layout/reftests/css-valid/output/style.css
@@ -0,0 +1,22 @@
+/* Override default style */
+output {
+  color: black;
+}
+
+output.notvalid {
+  color: green;
+}
+output.notvalid:valid {
+  color: red;
+}
+
+output.valid {
+  color: red;
+}
+output.valid:valid {
+  color: green;
+}
+
+output.ref {
+  color: green;
+}
diff --git a/layout/reftests/css-valid/reftest.list b/layout/reftests/css-valid/reftest.list
index 6f1c9fa29a9e..5e76064244fb 100644
--- a/layout/reftests/css-valid/reftest.list
+++ b/layout/reftests/css-valid/reftest.list
@@ -6,3 +6,6 @@ include button/reftest.list
 include input/reftest.list
 include select/reftest.list
 include textarea/reftest.list
+include output/reftest.list
+include output/reftest.list
+include output/reftest.list
diff --git a/layout/reftests/css-valid/select/reftest.list b/layout/reftests/css-valid/select/reftest.list
index af53f259a4ca..1b3ae0430c35 100644
--- a/layout/reftests/css-valid/select/reftest.list
+++ b/layout/reftests/css-valid/select/reftest.list
@@ -3,6 +3,10 @@
 == select-disabled.html select-disabled-ref.html
 == select-dyn-disabled.html select-disabled-ref.html
 == select-dyn-not-disabled.html select-ref.html
+== select-required-invalid.html select-required-ref.html
+== select-required-valid.html select-required-ref.html
+== select-required-multiple-invalid.html select-required-multiple-ref.html
+== select-required-multiple-valid.html select-required-multiple-ref.html
 == select-disabled-fieldset-1.html select-fieldset-ref.html
 == select-disabled-fieldset-2.html select-fieldset-ref.html
 == select-fieldset-legend.html select-fieldset-legend-ref.html
diff --git a/layout/reftests/css-valid/select/select-required-invalid.html b/layout/reftests/css-valid/select/select-required-invalid.html
new file mode 100644
index 000000000000..45e38acb78c8
--- /dev/null
+++ b/layout/reftests/css-valid/select/select-required-invalid.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+  <!-- Test: if select is required and has a select option which has an empty
+             string value, :valid should not apply. -->
+  <link rel='stylesheet' type='text/css' href='style.css'>
+  <body>
+    <select class='notvalid' required>
+      <option selected value="">foo</option>
+    </select>
+  </body>
+</html></html>
diff --git a/layout/reftests/css-valid/select/select-required-multiple-invalid.html b/layout/reftests/css-valid/select/select-required-multiple-invalid.html
new file mode 100644
index 000000000000..8ee7b6515ab0
--- /dev/null
+++ b/layout/reftests/css-valid/select/select-required-multiple-invalid.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+  <!-- Test: if select is required and has all selected option value set to the
+             string string, :valid should not apply. -->
+  <link rel='stylesheet' type='text/css' href='style.css'>
+  <body>
+    <select class='notvalid' required multiple>
+      <option selected></option>
+      <option selected value="">foo</option>
+    </select>
+  </body>
+</html>
diff --git a/layout/reftests/css-valid/select/select-required-multiple-ref.html b/layout/reftests/css-valid/select/select-required-multiple-ref.html
new file mode 100644
index 000000000000..a9477333f8a6
--- /dev/null
+++ b/layout/reftests/css-valid/select/select-required-multiple-ref.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+  <link rel='stylesheet' type='text/css' href='style.css'>
+  <body>
+    <select multiple style="background-color: green;">
+      <option selected></option>
+      <option selected value="">foo</option>
+    </select>
+  </body>
+</html>
diff --git a/layout/reftests/css-valid/select/select-required-multiple-valid.html b/layout/reftests/css-valid/select/select-required-multiple-valid.html
new file mode 100644
index 000000000000..6bf74d623b7a
--- /dev/null
+++ b/layout/reftests/css-valid/select/select-required-multiple-valid.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+  <!-- Test: if select is required and has a selected option which has value
+             different from the empty string, :valid should apply. -->
+  <link rel='stylesheet' type='text/css' href='style.css'>
+  <body>
+    <select class='valid' required multiple>
+      <option selected></option>
+      <option selected>foo</option>
+    </select>
+  </body>
+</html>
diff --git a/layout/reftests/css-valid/select/select-required-ref.html b/layout/reftests/css-valid/select/select-required-ref.html
new file mode 100644
index 000000000000..3c2bde80a042
--- /dev/null
+++ b/layout/reftests/css-valid/select/select-required-ref.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+  <link rel='stylesheet' type='text/css' href='style.css'>
+  <body>
+    <select style="background-color: green;">
+      <option selected value="">foo</option>
+    </selecT>
+  </body>
+</html>
diff --git a/layout/reftests/css-valid/select/select-required-valid.html b/layout/reftests/css-valid/select/select-required-valid.html
new file mode 100644
index 000000000000..685995b67317
--- /dev/null
+++ b/layout/reftests/css-valid/select/select-required-valid.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+  <!-- Test: if select is required and has a select option which has value
+             different from the empty string, :valid should apply. -->
+  <link rel='stylesheet' type='text/css' href='style.css'>
+  <body>
+    <select class='valid' required>
+      <option selected>foo</option>
+    </select>
+  </body>
+</html>
diff --git a/layout/reftests/svg/as-image/lime-anim-100x100.svg b/layout/reftests/svg/as-image/lime-anim-100x100.svg
index ca815d9fedf1..8d8ddb61fb9c 100644
--- a/layout/reftests/svg/as-image/lime-anim-100x100.svg
+++ b/layout/reftests/svg/as-image/lime-anim-100x100.svg
@@ -1,5 +1,6 @@
 <svg xmlns="http://www.w3.org/2000/svg" version="1.1"
      width="100" height="100">
+  <rect width="100%" height="100%" fill="red"/>
   <rect x="-600" width="100%" height="100%" fill="lime">
     <animate attributeName="x" by="600" dur="0.001" fill="freeze"/>
   </rect>
diff --git a/layout/reftests/svg/filters/feSpecularLighting-1-ref.svg b/layout/reftests/svg/filters/feSpecularLighting-1-ref.svg
index 64c6e48349c9..9e82d10045c5 100644
--- a/layout/reftests/svg/filters/feSpecularLighting-1-ref.svg
+++ b/layout/reftests/svg/filters/feSpecularLighting-1-ref.svg
@@ -3,5 +3,5 @@
      http://creativecommons.org/licenses/publicdomain/
 -->
 <svg xmlns='http://www.w3.org/2000/svg' xmlns:xlink='http://www.w3.org/1999/xlink'>
-  <image width='100' height='100' xlink:href="data:image/png,%89PNG%0D%0A%1A%0A%00%00%00%0DIHDR%00%00%00d%00%00%00d%08%06%00%00%00p%E2%95T%00%00%17DiCCPICC%20Profile%00%00x%DA%D5yWTUK%B0m%AD%B5%D7N%C0%26%E7%9Cs%CE9%07I%92%B3%92s%DCl2(%02%02%12%14%04%14%11P%14TDT%10%25%8A%80%A8(%E2ADAET%82H%10%15%03%8A%8Ar%3F%F4%9Cs%C3%BB%1Fo%8C%F7%F3%E6G%8F9fU%CF%AA%FA%EA%D1%DD%00%3C%AB%01Tj4%CA%0C%10%13%9BHs%B62%15%F6%F4%F2%16%26N%01%3D%E0%80%0C8%40%02%82%12%A8%26%8E%8Ev%F0%BF%E2%CB%24%20%00%00%0F%15%02%A8%D4h%F8%BF%03KpHB%10%00%E2%08%00%81%C1%09A1%00%C8%15%00%D44%88JK%04%C0m%00%C0XJ%225%11%00%BB%03%00%EC4O%2Fo%00l%1A%00%D8%C3~%F35%00%60%0F%F4%F4%F2%06%C0c%00%C0Nsu6%03%C0s%03%90%18%02%02ha%00%14q%00%10N%0E%0AK%04%A0%98%03%10Xc%83%23b%01%D8%3C%01%08%86A%E1%01%C1%00%3CU%00%20%1F%13%13%17%0C%C0s%13%00%A4%03%FF%93O%D8%7F%F1%0C%FC%C73%20%20%EC%1F%FE%7B%16%00%00%20%99G%24P%A3%03%D2%E0%FF5b%A2%93%FE%AE%C1%0A%00%0C%B1%D1%DB%ED%00%80%13%00%96%82%03%CCm%01%80%1F%00~Q%A3%1D%ED~%E7%20%BC!%B1n.%7F%B8%7Cl%E0v%87%3F%DC0%94f%E9%FC%7B%2F%E2HM4u%06%00n%00%24%94%9A%E8%E8%FAG%CFL%0F7%DB%0E%00%0C%00%C8%A1%90%04%8B%BF%7DND%06%D88%02%00%23%00%D2FKrv%03%00q%00d%20!%D9%C5%02%00%98%01%90W%E9%E1%AE%1E%7Fr%3E%07%87%98%FF%D1Q44%C2%D2%FA%0Fg%8DH%B4v%05%00v%00T4*%CE%D6%F9w-T%13l!%1AB%20%09h%10%02%B1%A0%00v%60%06%E6%7FV%05%08%85%00%A0A2%84%40%02D%C1k%A0A%0C%D8B%1CDC%1C%D0%40%F8O%9E%D9%FFP%2C!%00h%10%06!%FF%CDQ%18%82%20%0E%92%FE%A9%F9%B7%FA%AFC%04%04C%DC%3Fz%C0%9F%18%0DB%20%C1%2F%22%E7%DF%0A%FF%D9%2F%1A%E2%80%A6%DC%AC%BC%AC%BC%F9w%1C%93%C4T1%0D%CC%143%C0%0C1%1D%10%C681%5EP%C0%D41m%CC%043%C2%F40%0DL%07%2C%E1%15%D0%20%EC%EF%1E%FD%22rh1m%A1%C9Uqi%BA%EE%E1%7Ff%08%FCg%02wx%054%88%F8%3FN%F4%A7%F7%D1%D5%CE%D5%7F%3A%84%C4%90%D4D%00%00%B38j%1A-%22%2C%3CQ%D8%84J%8D%0E%91%17%B6%8E%0DR%94%17VUVQ%86%FF%9F%E0%E9%E5-%FC%9B%7Dr%06%04%00%10%CE%FB%FFjq*%00%3AA%00%C8%DE%7F5%FFw%00%9D%91%00%24%D6%7F5%C9N%00%26U%80%E1%23AI%B4%E4%DF%1A%06%00%80%07%3A%60%02v%E0%01A%10%03iP%00U%D0%04%3D0%06%0B%B0%01%07p%05%2F%F0%85%20%08%87%18%A0A%0A%EC%82l%C8%87b8%08%87%A1%1A%EA%A0%01%CE%C2%05h%83N%E8%85%EB0%04%230%06%13%F0%0Cf%60%01%DE%C0%1A%7C%81%1F%08%82%10%11%0A%C2%86%F0%20B%88%04%22%87%A8%22%DA%88!b%81%D8!%CE%88%17%E2%8F%84!%B1H%12%B2%0B%D9%8B%14%23%E5H5r%12iB.!%DD%C8ud%18y%80%3CEf%91e%E4%23%F2%1D%C5%A1%0C(%3B*%80J%A2J%A86j%82%DA%A2%AE%E8N4%0C%8DG%D3%D1%5C%B4%04%ADB%EB%D1%F3h%07z%1D%1DA'%D0%19%F4%0D%BA%8E%03%1C%3D%8E%13'%82S%C0i%E3%CCp%0E8o%5C(%8E%86%CB%C4%15%E1*q%F5%B8%8B%B8%1E%DCm%DCC%DC%0Cn%15%F7%0D%23%60l%980%A6%80%E9a%DB07%2C%08%8B%C72%B1%FDX5v%16%EB%C0nb%0F%B1Yl%0D%FB%85%A7%E0%F9%F1rx%5D%BC5%DE%13%1F%86O%C1%E7%E3%2B%F1g%F0%ED%F8%5B%F8%09%FC%02%FE%0B%81%40%E0%24H%11%B4%08%DB%08%5E%84HB%06a%3F%E1%18%A1%850%40x%40%98'%AC%13%89D%1E%A2%1C%D1%80%E8%40%0C%20%26%12%F3%89G%89%E7%89%FD%C4q%E2%02q%83DO%12%22%A9%92%2CI%DE%A4XR%0E%A9%92t%8E%D4G%1A'-%92~%90%99%C9%12d%5D%B2%039%98%9CF.%25%9F%22%F7%90%EF%93%17%C8%3F%E8X%E8%A4%E8%0C%E8%5C%E9%22%E9%B2%E9%AA%E8.%D2%DD%A2%9B%A6%FBDOO%2FJ%AFC%EFD%1FA%9FE_E%DFJ%7F%87~%96%FE%1B%03%2B%83%2C%83%19%C3%0E%86%24%86%12%86F%86%01%86%A7%0C%9F(%14%8A%24%C5%98%E2MI%A4%94P%9A(7(%2F(%1B%8Cl%8C%8A%8C%D6%8C%C1%8C%7B%18k%18%3B%18%C7%19%DF1%91%99%24%98L%98%7C%99%D2%99*%99.3%DDgZe%263K2%9B1%070g2%D70w3%3Ff%5EgacQaq%60%89a%D9%CFr%8Ee%98e%89%95%C8*%C9j%C1%1A%CC%9A%CB%DA%C0z%83u%9E%0D%C7%26%C6f%C6%16%C4%B6%97%ED%14%DB-%B6%05v%02%BB%14%BB5%7B%24%7B1%FB%05%F6Q%F65%0EV%0Eu%0Ew%8ET%8E%1A%8Ek%1C3%9C8NINk%CEh%CER%CE6%CEI%CE%EF%5C%02%5C%26%5C!%5C%85%5C%17%B9%C6%B9%BEr%F3q%1Bs%87p%17q%B7pOp%7F%E7%11%E6%B1%E0%89%E2)%E3%E9%E4y%CE%8B%F1%CA%F2%3A%F1%A6%F0%1E%E7%BD%C5%BB%CA%C7%CE%A7%C7%17%C4W%C4%D7%C67%C5%8F%F2%CB%F2%3B%F3g%F07%F0%DF%E3_%17%10%14%B0%12%A0%0A%1C%15%B8!%B0*%C8)h%2C%18)xH%B0OpY%88M%C8P(B%E8%90P%BF%D0%8A0%87%B0%89p%B4p%95%F0M%E15%11~%91m%22I%22'EFE~%88J%89%BA%89%E6%88%B6%88%3E%17%A3%13%D3%16%0B%15%3B%246(%B6%26.%24n%2F%BEK%BCY%7CJ%82%2C%A1-%11.qD%E2%B6%C4WI)I%0F%C9%7D%92%9D%92KR%DCR%D6R%E9R%CDR%D3%D2%14i%23%E9x%E9z%E9G2%04%19m%99(%99c2c%B2%A8%AC%86l%B8l%8D%EC%7D9TNS.B%EE%98%DC%03y%BC%BC%8E%7C%AC%7C%BD%FCc%05%06%05%13%85d%85f%85YENE%3B%C5%1C%C5N%C5wJ%E2J%DEJeJ%B7%95~)k(G%2B%9FR~%A6%C2%AAb%A3%92%A3%D2%A3%F2QUV5H%B5F%F5%91%1AE%CDRm%8FZ%97%DA%07u9%F5%10%F5%E3%EAO4%D84%EC5%F6i%0Cj%FC%D4%D4%D2%A4i%5E%D4%5C%D6%12%D7%F2%D7%AA%D5z%AC%CD%AE%ED%A8%BD_%FB%8E%0E%5E%C7Tg%8FN%AF%CE7%5DM%DDD%DD6%DD%F7z%0AzQz%E7%F4%96%F4%A5%F4C%F4O%E9%CF%1B%88%1A%04%18%9C4%981%146%F47%3Ca8c%24b%14%60To4g%2Cf%1Cl%7C%C6x%D1D%C6%24%D2%E4%BC%C9%3BSeS%9Ai%BB%E9W3%5D%B3%DDf%03%E68s%2B%F3%22%F3Q%0BV%0B7%8Bj%8B%17%96%A2%96a%96%CD%96kV%1AV%19V%03%DB%F0%DBl%B7%95m%7Bl-%60%1Dd%DDd%BDf%A3e%B3%DB%E6%A6-%83%AD%8Bm%B5%ED%9C%9D%AC%1D%CD%AE%C7%1E%B5%B7%B1%AF%B0%9F%DE.%B1%3Dv%7B%A7%038X%3BT8%3Cw%94r%8Cw%BC%EADprt%AAqz%ED%AC%E2%BC%CB%F9%B6%0B%9B%8B%9F%CB9%97%2F%AE%A6%AE%A5%AE%CF%DC%A4%DD%92%DC%06%DD%99%DCw%B87%B9%7F%F50%F7(%F7%98%F1T%F2%DC%ED9%E2%C5%EB%15%E1%D5%E5M%F4v%F7%3E%E3%BD%EEc%E1s%D8ga%87%C6%8E%FC%1D%93%3B%A5v%A6%EE%1C%F6%E5%F5%8D%F6%BD%E6%C7%E4%17%E0w%D9%1F%EF%EF%E1%7F%CE%7F3%C0!%A0%3E%60%3D%D0%3A%B06p-%C8%2C%E8H%D0%9B%60%E3%E0C%C1%CB!%06!%E5!%8B%A1%06%A1%E5%A1Ka%06a%15a%CB%E1F%E1%95%E1%AB%11f%11%D5%11%1F%22%B7E%D6E~%8Dr%88j%8C%DA%8A%F6%88n%89!%C5%F8%C7t%C7%B2%C6F%C5%DE%8C%13%8CK%8D%7B%40%95%A3%E6Sg%E2u%E3%0F%C7%AF%D1lig%12%90%84%9D%09%5D%89%EC%89%D4%C4%7BI%D2IyI%B3%C9%86%C95%C9%1B)%EE)%97SYRcS%EF%A5%C9%A6%15%A6-%A6%5B%A6%9F%CE%C02%822%06w%89%EC%CA%DE5%BB%DBd%F7%C9L%2430sp%8F%D8%9E%DC%3D%0BYVYg%B3%E9%B2%A3%B2%FF%CAQ%CE)%CF%F9%BC%D7coO%AE%40nV%EE%7C%9EU%5Es%3Ec%3E-%FF%F1%3E%BD%7Du%05XAD%C1h%A1Z%E1%D1%C2_E%C1Ew%8B%95%8B%2B%8B7%F7%07%ED%BF%7B%40%E5%40%D5%81%AD%92%D0%92%D1R%CD%D2%E3%07%09%07c%0FN%96%19%95%9D-g)O%2F%9F%AF%B0%AF%E88%24%7C%A8%E8%D0%E7%C3~%87%87%2B%D5%2B%EB%8E%D0%1DI%3A2SeW%D5uT%FC%E8%C1%A3%9B%D5%E1%D5%135%A65-%B5%FC%B5%85%B5_%8F%05%1F%1B%3Fn%7C%FCb%9D%40%5Dq%DD%F7%13%11'%9E%9C%B4%3A%D9Q%2FY_%D9%40hHnx%7D%CA%FD%D4%ED%D3%DA%A7%9B%CE%F0%9E)%3E%F3%B31%B6q%E6%AC%F3%D9%9BMZMM%E7%F8%CF%956%A3%CDI%CD%CB%E7w%9C%1F%BB%60~%A1%EB%A2%C2%C5%93-%9C-%C5%AD%D0%9A%D4%BAr%C9%FF%D2d%9Bm%DB%E0e%ED%CB%17%AFH%5C%A9mgk%2F%EA%40%3A%D2%3A%D6%3A%C3%3Bg%BA%BC%BA%1Et%DBt%0F%F6%E8%F5%B4_U%BC%DA%D8%2B%D2%5Bs%8D%E3Zi%1F%5D_n%DFV%7Fz%FF%FA%00u%60%F5z%D8%F5%F9A%BF%C1g7%3Co%3C%BA%E9ts%F4%96%ED%AD%3BC%96C7n%9B%DC%EE%BFcp%A7wXw%B8%FB%AE%F6%DD%CE%11%CD%91%8E%7B%1A%F7%DA%FF%D2%F8%AB%7DTs%B4%E3%BE%D6%FD%AE1%9D%B1%9E%07%FA%0F%FA%C6%8D%C6%AF%3F4%7F8%F4%C8%FA%D1%C8%C4%F6%89%07%93n%93O%1E%EFx%3C%F3%24%F8%C9%D2%D3%E8%A7%1F%A6%92%A7~%3C%CB%9A%C6O%17%3Dg~%5E%F9%82%FFE%FDK%99%97-3%9A3%D7f%CDg%EF%CD%B9%CC%3D%9B%0F%9A%7F%F3*%E1%D5%E6B%EEk%CA%EB%CAE%A1%C5%A6%25%D5%A5%DEe%CB%E5%B1%15%9F%95%857%D47%3FV%F3%DF%B2%BC%AD%7D'%FD%EE%CA%7B%E3%F7%F7%D6%3C%D7%16%3E%D0%3El%7D%DC%FF%89%E7S%E3g%F5%CF%83%EB%8E%EB%2F%BE%C4%7C%F9%F1%B5h%83g%E3%EC7%EDo%B7%BF%7B%7C_%FC%91%B2I%DC%AC%FA)%F3%B3%E7%97%ED%AF%E9%AD%98%AD-j%00-%00%00%00p%00%80%86%86%02%7Cl%04%A0x%01%B0%8D%01%D0%0D%FC%BES%FC%01%0E%01%40%01%80%08%82%60%03%C50%8F%C8%22%B1%C8%00%CA%83%26%A2S8k%DC%0D%CC%0A%7B%84%8F!%B0%10%06%89%BBH%86d%22%F99%5D7%7D-C)%A5%91q%9A%99%99%C5%96%B5%90m%98%83%85s%07%D7y%1E%8C7%80%EF%9A%80%B0%E0~%A1%0D%91%60%D1)%F1%ED%12%C3RJ%D2%252o%E4%AC%E5%EB%14%BE(%99)%1FP%19S%A3%A8%9Bj%24h%D6j%0Dh%CF%E8%FC%D4%E3%D2%973%D01%B40r6%0E2I0%CD5%3Bb%DEl%D1o%F9%D0jy%DB%96%0D%87%AD%BC%9D%99%BD%CF%F6%08%87d%C7%3C%A7r%E7%3A%97f%D7N%B7A%F7%11%8Fq%CF%A7%5E%2F%BD%E7%7D%96v%BC%DD%B9%E4%3B%ED7%EA%DF%1F%D0%12x%3C%E8%40pzHh%A8S%98%5E%B8x%04c%C4%97%C8%97QC%D1M1%07b%A9q.T%ADx%DE%F8M%DA%8B%84%81%C4%86%A4%BC%E4%D0%14%EBT%B94%BA%B4%95%F4%7B%19%AD%BB%AAv%E7f%A6%EC%89%CF%A2e%A7%E7%14%ED%3D%99%7B-%EF%E5%3Er%81~!%B5%A8%A1x%F2%00%5D%89~i%CC%C1%E3e%A3%E5%3F%0F%C9%1F%F6%A9%2C%3A%D2Q5SM_%A3Q%EBw%AC%F0x%5B%DD%B3%93X%BDB%83%FB%A9%3D%A7%CF%9Ey%D0%B8%D1%24%7C%CE%AEy%D7%F9%B6%0B%1FZt%5BK%2F%BD%BF%ECs%E5~%87C%E7%A3n%FD%9E%C4%ABM%BD%D3%7D%F4%FDj%03%EE%D7%E3%07%F3n%94%DD%AC%BCU9Tv%BB%E0%CE%DE%E1%7Dw%0F%8C%1C%B8%97%F7W%E2%A8%C7%7D%C5%FB%3F%C6%06%1Ed%8Ck%8E%7Fy%F8%F8Q%F7D%F5%E4%EE%C7~OL%9FJL%91%A7%DE%3E%7B0%DD%FE%BC%FA%C5%EE%97%FE3%E6%B32s%CCs%DF%E6_%BF%9A%5C%18~%7D%7D%F1%EAR%F7r%F7%CA%E97%25%AB%C9o%7D%DFY%BC%97%5Bc%5E%5B%FF0%F5%B1%EF%D3%C9%CFy%EB%E1_l%BF*m%B0m%7C%FD6%FD%7D%E0G%FDf%EE%CF%90_%E6%5B%A2%5B%5B%00%40%00%5E0%86T%B8%85%B0!v%C8A%E4%25%AA%86%96%A0%9Fp~%B8I%CC%0D%7B%8E%A7%12%18%09%9D%C4%10%12%2Fi%8A%5CK%17Fo%CA%60%40qe%0Cg%CAb%3E%C1r%9Du%99%9D%83%C3%9C3%8D%AB%85%FB%3D%AF%22%1F%8D%BFW%90%5E%C8%5D%F8%9C%C8%96%98%89x%B6D%BF%E4%A6%B4%96L%A4%EC1%B9%11%F9%8F%8A%1CJj%CA%DBT%7CT%C3%D4%E2%D5%D34vk%A6kEj%FB%E8%D8%E9%1A%E8)%EB%8B%1Ap%18%92%0C%BF%1B%BD5%9E5%990%BDk%D6g~%D9%A2%D1%B2%CA%AA%60%5B%8Au%B8%8D%97%ED6%3Bm%7B%A9%ED%1C%0E%98%C3g%C79%A7%07%CE%03.%AD%AE%C7%DD%0A%DC%13%3C%7C%3D%AD%BD%D4%BC%05%7C%08%3E%EFvL%EE%BC%E6%DB%E0W%E4%1F%17%E0%1A%A8%1E%C4%104%17%DC%1DR%1A%1A%1A%A6%1F%CE%12%FE%3A%E2jdYTH%B4n%0CS%CC%7Clg%5C%01%D5%2B%5E.~%936%9Ap%22%91%96d%96%CC%91%BC%98%D2%9D%BA%3F%CD7%5D9%03%CDx%BC%ABewqf%CC%1E%B7%2C%F3l%DD%1C%9D%BD%06%B9%DB%F2%3C%F3c%F7%ED%2B8%5Dx%A3h%B6%F8%D7%01%FE%12%9DR%F7%83%09e%07%CB%CFW%0C%1Fz%5D%89%1E%E1%AF%D2%3C%EAT%1DSS%5C%7B%FE%D8%D8%F1%2F'DO%3A%D6%EFm%E8%3E%F5%E1%8Cbc%FC%D9%2BM_%9Bu%CE%EF%BA%D0%D7%02%AD%26%97%F6%B6%DD%BA%82o%B7%EA(%E8%BC%DDM%EC%B1%B8%9A%D3%7B%ED%DA%E7~%C9%01%97%EB%19%83%C7o%5C%BD9qky%E8%EB%1Dl%98%ED%AE%C8%88%D2%3D%83%BF%ECF%BD%EF%87%8F%A5%3C%C8%1F%3F%FC%B0%FEQ%CBD%EF%E4%F0%E3%C9'%0BO%3F%3F%C3M%B3%3F%97x%A1%FD%D2n%26l%B6an%F9%95%D4%82%F7%EB%FC%C5sK%B7%97gW6V%19%DFJ%BC3z%EF%B3%96%F5a%EC%93%DA%E7%8A%F5O_%9D7%AE%7C%E7%FE%91%B7%B9%F1%2Bek%0B%000%60%01Y%D8%0EY0%80%10%11%5D%24%11%E9DQ%D4%1E%3D%81%FE%C0%F9%E2%EEb%FAX%07%5E%1B%3FHp%24%CC%133H%7C%A4%DB%E4%03tA%F4%FA%0C%7C%0C%BF(s%8C%23L%ED%CC%A7Y%AAXK%D8%0A%D8%F38%F29%8B%B9*%B8%EBx%9Ay%BB%F8%AE%F1_%13%E8%13%EC%17%EA%13%BE*%D2.%DA%2CvL%BCX%22Ir%87%94%B1%B4%A8%0C%C8%3C%93%ED%94%2B%96wW%10VXQlW%CAR%B6U%E1T%99UmVKR7%D2%20k%3C%D4%3C%A6%15%AE%AD%AE%BD%A1%D3%A7%9B%A7g%AB%CF%AA%3FePo%18i%A4j%B4i%3CdRf%BA%D3L%D6%EC%AB%F9%0D%8BRK%1F%2B)%AB%8F%DB%FA%AC%8Bl%DCmEl%DF%D8u%D8gm%B7s%E0t%98ulvJp%D6sA%5D%EE%BA%96%BBy%BB%0B%BB%2Fz%5C%F4L%F2%D2%F3F%BD%87%7DJw%B8%EC%E4%DC%F9%D4%B7%C6o%A7%BF%80%FF%F3%80c%81%3B%83%F8%83%A6%82%ABB%DCC%D9B%EF%87%15%87%5BD%40%C4%D5%C8%E4(%95%A8%D5%E8%C6%98%C0X%FE%D8%C7q%15%D4%ED%F1%A4%F8%EB%B4%F4%04%B5%84%D5%C4%D3I%BE%C9%5C%C9%F7S%F6%A5%1A%A5n%A4%B5%A6Gd%08g%3C%DDuh%B7k%26O%E6%C2%9E%AE%ACC%D9i9%A1%7Bw%E4z%E5%F9%E4%87%ECK*%C8%2B%AC%2C%3AS%DC%B1%7F%E8%C0D%C9B%E9%E72%5C9%5B%85%E8!%E5%C3%BA%95fGl%AA%9C%8EzU%07%D6%C4%D5%EE9Vq%FC%7C%DD%C8%89%F7%F5%12%0Di%A7%C6%CEH5f%9E%9D%3C%A7%D0%9C%7B%FE%D9E%95%96%82%D6%17m%9A%97%8B%AF%BC%ECP%EB%DC%D75%DD%A3v%B5%A8w%AEO%BF%BFj%E0%CB%A0%EB%8D%F6%5BRC%A7%EE(%0C%DF%1A%89%FAK%7Ctu%EC%F6%F8%A5GM%93%ADO%AEO%3D%7F%0E%2F%95g%1B_%E5%2F%16%ADt%BEc%FAP%B0%CE%BD%D1%BE%E9%B1%B5%05%F0%FBm%09%00%80%A0%09pz%1E%C0%FD%24%80%93%0F%40%A3%1C%80D%0D%00%23%3B%80%23%05%C0U%07P%D3R%40%9E%1E%05%C4%EA%E2%3F%E7%07%05%A4%C0%12Ba%1F%9C%85ax%830%22*%88%1B%92%8E%1CCz%91g%C8%26*%80%1A%A1%81h%3Ez%0E%BD%8F~%C6%F1%E1Lp%E1%B8%83%B8n%DC%1CF%8Fi%60%FE%D8~%AC%0B%7B%85g%C5%1B%E1c%F1'%F1%13%04%3A%82%09!%95%D0FX%25J%13%C3%88%8D%C4e%92%22)%89%D4O%A6'%7B%93%CF%D3!t%9Etm%F4%8C%F4%B1%F4%E3%0C%DA%0C'(%24%0A%8D%F2%82%D1%86%B1%9BI%9A%A9%9A%99%C2%9C%CD%FC%95%25%8Ee%895%88%F5%25%5B%20%DB%22%7B%0C%FB%17%8ElNF%CEc%5CJ%5C7%B8%7D%B8%D7y%CAxUx%1F%F2%A5%F0%0B%F0%8F%09%EC%134%15%02%A1%EB%C2y%22%F6%A2%3C%A2KbW%C5%CB%24%22%25-%A5%24%A4%19%A4%D7e%E6d%C7%E5n%CA%F7(%5CVlUjQnS%E9R%1DP%1BQ%7F%A1%F1A%0B%D3%E6%D0%11%D3U%D0S%D1W6%905%146b5F%8D%DF%9B%3C3%ED7%AB7%2F%B0%88%B3%F4%B42%DD%A6d-h%C3d%8B%B3%DD%B0%5B%B3_%D9%BE%E00%E78%EB%F4%CA%F9%8D%CB'%D7%9F%EEd%0F.O)%2F%1Do%7B%9F%A0%1D%19%3B%0F%FB%B6%FA%8D%FA%BF%0Dd%0CR%0B%F6%0A%D9%13%DA%10v%2B%7C%3E%E2g%14k%B4H%8Cl%ACb%9C%02U%26%5E%94%C6%99%40N%F8%9E%B8%9C%CC%9Bb%9F%9A%9B%D6%9F%FEk%97%C5%EE%8A%CC7Y%F6%D9W%F7%AA%E7v%E7%5B%EF%9B%2F%DCW%2C%B2%FFb%89q%E9LYY%85%E7a%83%23%D6GSjn%1D%E7%3B%C1X%8F6%7C%3B%FD%B1%F1%5D%D3j%F3%EA%85%F7-%EB%97~%5E!u%F0u)%F5%98%F7z%F5E%0C%24%0Ff%DE%CC%1A%DA%7D'%F9n%F4%3D%FF%D1%E2%B1%AE%F1%95%09%91%C7%3B%9F%D6%3D%7B%FDBe%26%7BnbAn%B1%60yq%D5%EA%DD%B9%0F%CC%9F2%D6%DFn%84~_%FCI%DD%DA%02%00%26P%04'H%82j%E8%87W%08%3D%A2%8A%F8%20%B9H%132%82%BCG%D9Q%5D%D4%1F-%40%5B%D1%A78%1CN%01%E7%85%CB%C3%5D%C2%BD%C4(%98%3E%16%85%D5%60%7Fa%BF%F0*%F8%60%7C-~%82%C0D%B0%23%14%12%EE%10%E9%88%F6%C4r%E2%14I%82D%23%0D%929%C9%D1%E4!%3A1%BA%1C%BA%05z%1B%FA%1E%069%86%3A%0A%07e%3F%23%811%87%09%98%B2%99q%CC%05%2C%8C%2CGXEY%5B%D8%8C%D9%26%D8c8%08%1C%F5%9C%26%9Cs%5C%F9%DC%0A%DC%93%3C%D9%BC%CA%BC3%7C%15%FC%DB%040%81A%C1%BDB%96%C2%0C%C2%93%22%F5%A2%09b%96%E2%82%E2%1B%12%93%92%9DR'%A4%8F%C8%94%C9%96%C8%95%C8%97%2BT%2B%9EQjW%BE%A3%F2B%F5%AB%3A%87%86%AEf%90V%89%F65%9D%F7z%12%FA~%065%86%CF%8C%05M%82M%5B%CC~XXX%16%5B%8DX%E3m%B4l%03%ED%F2%ED%CFl%BF%EE0%E5%B8%E6%8C%B9p%BA%CA%BA%19%BB%7By%24x%96z%5D%F4%1E%F5%F9%B0%93%D3%D7%C0%2F%D4%BF%2C%A0%2F%F0%5D%B0X%88ghi%D8P%F8%CFH%F5%A8%88%E8%E31%0F%E2P%AAj%BC%3F%AD%24%E1j%E2R2S%8AV%AA%7FZqzW%C6%E2n%AEL%EB%3D%BB%B3%DA%B2W%F6%8A%E5%EE%CC%AB%CE%7FR%C0U%E8Ut%BC%F8%D5%01%85%92%D4%D2%A12%EE%F2%B8%8A%7B%87%95%2Bk%AA%18%8F%16%D60%D4%1E%3E.Uw%FBdD%03%C3%A9%B63%DEg%B1%A6%D6f%BF%0B%CC%17o%B4%A6%B6)%5D%5Ejo%EC%8C%E8V%E8%F9%D8%DB%D3%973%607%C8uc%FEV%EB%ED%5D%C36%23%3C%F7%C6F%DD%EE%CF%3FH%7F(%F8ht%B2%F8%89%CB%94%E44%F2%7C%EE%E5%D0l%F3%7C%E9%02m%D1e%99o%A5nU%EA%ED%A5%F7%86k%A3%1F%FD%3E%BD_%CF%FA%CA%B4q%F4%BB%E0%8F%BA%9F%BC%BFJ%B7%B6%00%80%0BL%80%0Aup%1F%B6%10U%24%149%8A%DCB%3E%A1%A2%A83%9A%8Bv%A2%AB8%11%9C'%EE%20n%18%C3a%86X%3A%D6%89%AD%E35%F0%C9%F8k%04%3C%C1%81PCX!%EA%11%0F%12%97H%E6%A4Sd%12%99J%9E%A6%B3%A3%1B%A0%D7%A2%EFa0e%B8G%F1%A2%AC0f2q0%B52%3B0%7F%60%A9d5d%5Df%3B%C6%EE%C2A%E1%B8%CBY%C8e%C7%CD%CA%3D%C5s%9A%97%C6g%C2%CF%C6%FFF%60H%F0%94P%BEp%94%88%AB%A8%89%98%AA%B8%94%84%90%24%9F%14%AF%B4%B0%8C%9C%AC%8E%9C%AD%7C%80%C2.%C5j%A5k%CA%AFT%19%D5%F4%D5i%1A%175%DFkk%E8d%EB%8E%EBK%1B%E4%1A%BE6%B63%E94%933%3Fe)b%D5%60-c%D3ngn%FF%C4%81%EA%C4%E0%DC%EA%EA%E3N%F6%B8%E6%95%EC%A3%BEc%C3w%C0%FF%40%A0o%B0f(C%D8%D3%88%EA(%EB%E8%E5%D8%B4%B8%CD%F8D%DAB%A2c%D2%E5%14%96TZ%DA%A3%0C%DD%5D'3%E9%F7%A4f-%E6x%EE%BD%97g%9A%DFS%A0%5E%D8Ql%B0%7F%B8%C4%AB%F4MYf%05%CB%A1%FAJ%A5%23%DDG%0D%AB%FBk%F5%8Fu%D4%E1O%D8%9D%3C%5C%FF%F2%94%EC%E9%943%B7%CEr4%85%9E%EB9%CFx!%F8bo%2B%C7%25j%DB%C8%15%E9%F6%A2%8E%B7%5DN%DD%9DW%05%7B%F3%AF%BD%EB%F7%18%B8%3E(w%E3%F0%CD%AD%A1%C8%DB%8F%86%8D%EF6%DF%E3%FC%2Ba%F4%EE%18%DF%83%F0%F1%F3%0FW%26%C4%26%3D%1E%E7%3C9%FB%F4%EE%D4%C2%B3%CD%E7%CC%2F%84%5E%CA%CDh%CC%EA%CE%19%CE%1B%BF2%5E0%7C%AD%BB%A8%B5%A4%B2%2C%BB%22%FA%86%F1%CD%F2j%F7%DB%94w%1A%EFV%DF%9F%5E%F3%FA%40%F7%A1%F7c%E8'%E6O%5D%9Fw%AC%C3z%FD%17%D3%2Fs_%F7l%F0ot%7Fs%FB%B6%F6%7D%FF%0F%A9%1F%83%9B%BE%9B%1B%3F%2B~)%FD%1A%DE%0A%DE%DA%02H%08US%05%00%00%84%C1%14%00%FFbk%EB%93%24%00%B1%1C%E0g%D9%D6%D6%8F%FA%AD%AD%9F%0D%00%B8i%80%81%E8%DF%FF%15%00%00%04f%80%DA%86%FF%ED%8D%F4%3F%00%BD%06~%C6%80N%5E%00%00%00%00%06bKGD%00%FF%00%FF%00%FF%A0%BD%A7%93%00%00%00%09pHYs%00%00%0B%13%00%00%0B%13%01%00%9A%9C%18%00%00%00%07tIME%07%DA%0B%08%17%01%07S%03%9D%00%00%00%01%26IDATx%DA%ED%DD%B1%8D%830%14%80%E1%97%13%DD%93%92-n%00f%A0K%16%40d%CCd%09%06%B1%90%97%C8%B5)9%05%9D%7C%F2%F7%D7%C8%85%3Fl%8B%06%9F%22%5E%AFP3%7D%99%02%20%02%02D%40%80%08%08%10%01%E9%BBa%EF%83%8F%C7%D3l%7D%D0%EDv%B5BlY%02%02D%40%80%08%88%80%FC%EF%0F%C3%3D%8D%E3%18%99%19%DB%B6u1y%A5%94%A8%B5Ff%B6%09%92%99q%B9%9C%23%E2%DC%C9%FB%FC%1D%CBr%8Fy%9E%DB%DC%B2zY%19%EF%AD%EB%EA%0Cq%A8%0B%08%10%01%11%10%20%02%02D%40%80%08%08%10%01%11%10%20%02%02D%40%80%08%08%10%01%11%10%20%02%02D%40%80%08%08%10%01%11%10%20%02%02D%40%80%08%08%10%01%11%10%20%02%02D%40%80%08%08%10%01%11%10%20%02%02D%40%80%08%08%90_WJ%E9n%02%87a8v%BC%23%07%AB%B5%C6%B2%DC%0F%FF%FDv%CB%18%D34%1D%3A%E6i%EF%05%F7%AE%CD%FB%2C%D7%E69C%04%04%88%80%00%11%10%01i%B5%DD%1F%86%B2B%80%08%88%80%00%11%10%20%02%02D%7F%D0%0F%E2%40'%40%A42%A5Z%00%00%00%00IEND%AEB%60%82"/>
+  <image width='100' height='100' xlink:href="data:image/png,%89PNG%0D%0A%1A%0A%00%00%00%0DIHDR%00%00%00d%00%00%00d%08%06%00%00%00p%E2%95T%00%00%17DiCCPICC%20Profile%00%00x%DA%D5yWTUK%B0m%AD%B5%D7N%C0%26%E7%9Cs%CE9%07I%92%B3%92s%DCl2(%02%02%12%14%04%14%11P%14TDT%10%25%8A%80%A8(%E2ADAET%82H%10%15%03%8A%8Ar%3F%F4%9Cs%C3%BB%1Fo%8C%F7%F3%E6G%8F9fU%CF%AA%FA%EA%D1%DD%00%3C%AB%01Tj4%CA%0C%10%13%9BHs%B62%15%F6%F4%F2%16%26N%01%3D%E0%80%0C8%40%02%82%12%A8%26%8E%8Ev%F0%BF%E2%CB%24%20%00%00%0F%15%02%A8%D4h%F8%BF%03KpHB%10%00%E2%08%00%81%C1%09A1%00%C8%15%00%D44%88JK%04%C0m%00%C0XJ%225%11%00%BB%03%00%EC4O%2Fo%00l%1A%00%D8%C3~%F35%00%60%0F%F4%F4%F2%06%C0c%00%C0Nsu6%03%C0s%03%90%18%02%02ha%00%14q%00%10N%0E%0AK%04%A0%98%03%10Xc%83%23b%01%D8%3C%01%08%86A%E1%01%C1%00%3CU%00%20%1F%13%13%17%0C%C0s%13%00%A4%03%FF%93O%D8%7F%F1%0C%FC%C73%20%20%EC%1F%FE%7B%16%00%00%20%99G%24P%A3%03%D2%E0%FF5b%A2%93%FE%AE%C1%0A%00%0C%B1%D1%DB%ED%00%80%13%00%96%82%03%CCm%01%80%1F%00~Q%A3%1D%ED~%E7%20%BC!%B1n.%7F%B8%7Cl%E0v%87%3F%DC0%94f%E9%FC%7B%2F%E2HM4u%06%00n%00%24%94%9A%E8%E8%FAG%CFL%0F7%DB%0E%00%0C%00%C8%A1%90%04%8B%BF%7DND%06%D88%02%00%23%00%D2FKrv%03%00q%00d%20!%D9%C5%02%00%98%01%90W%E9%E1%AE%1E%7Fr%3E%07%87%98%FF%D1Q44%C2%D2%FA%0Fg%8DH%B4v%05%00v%00T4*%CE%D6%F9w-T%13l!%1AB%20%09h%10%02%B1%A0%00v%60%06%E6%7FV%05%08%85%00%A0A2%84%40%02D%C1k%A0A%0C%D8B%1CDC%1C%D0%40%F8O%9E%D9%FFP%2C!%00h%10%06!%FF%CDQ%18%82%20%0E%92%FE%A9%F9%B7%FA%AFC%04%04C%DC%3Fz%C0%9F%18%0DB%20%C1%2F%22%E7%DF%0A%FF%D9%2F%1A%E2%80%A6%DC%AC%BC%AC%BC%F9w%1C%93%C4T1%0D%CC%143%C0%0C1%1D%10%C681%5EP%C0%D41m%CC%043%C2%F40%0DL%07%2C%E1%15%D0%20%EC%EF%1E%FD%22rh1m%A1%C9Uqi%BA%EE%E1%7Ff%08%FCg%02wx%054%88%F8%3FN%F4%A7%F7%D1%D5%CE%D5%7F%3A%84%C4%90%D4D%00%00%B38j%1A-%22%2C%3CQ%D8%84J%8D%0E%91%17%B6%8E%0DR%94%17VUVQ%86%FF%9F%E0%E9%E5-%FC%9B%7Dr%06%04%00%10%CE%FB%FFjq*%00%3AA%00%C8%DE%7F5%FFw%00%9D%91%00%24%D6%7F5%C9N%00%26U%80%E1%23AI%B4%E4%DF%1A%06%00%80%07%3A%60%02v%E0%01A%10%03iP%00U%D0%04%3D0%06%0B%B0%01%07p%05%2F%F0%85%20%08%87%18%A0A%0A%EC%82l%C8%87b8%08%87%A1%1A%EA%A0%01%CE%C2%05h%83N%E8%85%EB0%04%230%06%13%F0%0Cf%60%01%DE%C0%1A%7C%81%1F%08%82%10%11%0A%C2%86%F0%20B%88%04%22%87%A8%22%DA%88!b%81%D8!%CE%88%17%E2%8F%84!%B1H%12%B2%0B%D9%8B%14%23%E5H5r%12iB.!%DD%C8ud%18y%80%3CEf%91e%E4%23%F2%1D%C5%A1%0C(%3B*%80J%A2J%A86j%82%DA%A2%AE%E8N4%0C%8DG%D3%D1%5C%B4%04%ADB%EB%D1%F3h%07z%1D%1DA'%D0%19%F4%0D%BA%8E%03%1C%3D%8E%13'%82S%C0i%E3%CCp%0E8o%5C(%8E%86%CB%C4%15%E1*q%F5%B8%8B%B8%1E%DCm%DCC%DC%0Cn%15%F7%0D%23%60l%980%A6%80%E9a%DB07%2C%08%8B%C72%B1%FDX5v%16%EB%C0nb%0F%B1Yl%0D%FB%85%A7%E0%F9%F1rx%5D%BC5%DE%13%1F%86O%C1%E7%E3%2B%F1g%F0%ED%F8%5B%F8%09%FC%02%FE%0B%81%40%E0%24H%11%B4%08%DB%08%5E%84HB%06a%3F%E1%18%A1%850%40x%40%98'%AC%13%89D%1E%A2%1C%D1%80%E8%40%0C%20%26%12%F3%89G%89%E7%89%FD%C4q%E2%02q%83DO%12%22%A9%92%2CI%DE%A4XR%0E%A9%92t%8E%D4G%1A'-%92~%90%99%C9%12d%5D%B2%039%98%9CF.%25%9F%22%F7%90%EF%93%17%C8%3F%E8X%E8%A4%E8%0C%E8%5C%E9%22%E9%B2%E9%AA%E8.%D2%DD%A2%9B%A6%FBDOO%2FJ%AFC%EFD%1FA%9FE_E%DFJ%7F%87~%96%FE%1B%03%2B%83%2C%83%19%C3%0E%86%24%86%12%86F%86%01%86%A7%0C%9F(%14%8A%24%C5%98%E2MI%A4%94P%9A(7(%2F(%1B%8Cl%8C%8A%8C%D6%8C%C1%8C%7B%18k%18%3B%18%C7%19%DF1%91%99%24%98L%98%7C%99%D2%99*%99.3%DDgZe%263K2%9B1%070g2%D70w3%3Ff%5EgacQaq%60%89a%D9%CFr%8Ee%98e%89%95%C8*%C9j%C1%1A%CC%9A%CB%DA%C0z%83u%9E%0D%C7%26%C6f%C6%16%C4%B6%97%ED%14%DB-%B6%05v%02%BB%14%BB5%7B%24%7B1%FB%05%F6Q%F65%0EV%0Eu%0Ew%8ET%8E%1A%8Ek%1C3%9C8NINk%CEh%CER%CE6%CEI%CE%EF%5C%02%5C%26%5C!%5C%85%5C%17%B9%C6%B9%BEr%F3q%1Bs%87p%17q%B7pOp%7F%E7%11%E6%B1%E0%89%E2)%E3%E9%E4y%CE%8B%F1%CA%F2%3A%F1%A6%F0%1E%E7%BD%C5%BB%CA%C7%CE%A7%C7%17%C4W%C4%D7%C67%C5%8F%F2%CB%F2%3B%F3g%F07%F0%DF%E3_%17%10%14%B0%12%A0%0A%1C%15%B8!%B0*%C8)h%2C%18)xH%B0OpY%88M%C8P(B%E8%90P%BF%D0%8A0%87%B0%89p%B4p%95%F0M%E15%11~%91m%22I%22'EFE~%88J%89%BA%89%E6%88%B6%88%3E%17%A3%13%D3%16%0B%15%3B%246(%B6%26.%24n%2F%BEK%BCY%7CJ%82%2C%A1-%11.qD%E2%B6%C4WI)I%0F%C9%7D%92%9D%92KR%DCR%D6R%E9R%CDR%D3%D2%14i%23%E9x%E9z%E9G2%04%19m%99(%99c2c%B2%A8%AC%86l%B8l%8D%EC%7D9TNS.B%EE%98%DC%03y%BC%BC%8E%7C%AC%7C%BD%FCc%05%06%05%13%85d%85f%85YENE%3B%C5%1C%C5N%C5wJ%E2J%DEJeJ%B7%95~)k(G%2B%9FR~%A6%C2%AAb%A3%92%A3%D2%A3%F2QUV5H%B5F%F5%91%1AE%CDRm%8FZ%97%DA%07u9%F5%10%F5%E3%EAO4%D84%EC5%F6i%0Cj%FC%D4%D4%D2%A4i%5E%D4%5C%D6%12%D7%F2%D7%AA%D5z%AC%CD%AE%ED%A8%BD_%FB%8E%0E%5E%C7Tg%8FN%AF%CE7%5DM%DDD%DD6%DD%F7z%0AzQz%E7%F4%96%F4%A5%F4C%F4O%E9%CF%1B%88%1A%04%18%9C4%981%146%F47%3Ca8c%24b%14%60To4g%2Cf%1Cl%7C%C6x%D1D%C6%24%D2%E4%BC%C9%3BSeS%9Ai%BB%E9W3%5D%B3%DDf%03%E68s%2B%F3%22%F3Q%0BV%0B7%8Bj%8B%17%96%A2%96a%96%CD%96kV%1AV%19V%03%DB%F0%DBl%B7%95m%7Bl-%60%1Dd%DDd%BDf%A3e%B3%DB%E6%A6-%83%AD%8Bm%B5%ED%9C%9D%AC%1D%CD%AE%C7%1E%B5%B7%B1%AF%B0%9F%DE.%B1%3Dv%7B%A7%038X%3BT8%3Cw%94r%8Cw%BC%EADprt%AAqz%ED%AC%E2%BC%CB%F9%B6%0B%9B%8B%9F%CB9%97%2F%AE%A6%AE%A5%AE%CF%DC%A4%DD%92%DC%06%DD%99%DCw%B87%B9%7F%F50%F7(%F7%98%F1T%F2%DC%ED9%E2%C5%EB%15%E1%D5%E5M%F4v%F7%3E%E3%BD%EEc%E1s%D8ga%87%C6%8E%FC%1D%93%3B%A5v%A6%EE%1C%F6%E5%F5%8D%F6%BD%E6%C7%E4%17%E0w%D9%1F%EF%EF%E1%7F%CE%7F3%C0!%A0%3E%60%3D%D0%3A%B06p-%C8%2C%E8H%D0%9B%60%E3%E0C%C1%CB!%06!%E5!%8B%A1%06%A1%E5%A1Ka%06a%15a%CB%E1F%E1%95%E1%AB%11f%11%D5%11%1F%22%B7E%D6E~%8Dr%88j%8C%DA%8A%F6%88n%89!%C5%F8%C7t%C7%B2%C6F%C5%DE%8C%13%8CK%8D%7B%40%95%A3%E6Sg%E2u%E3%0F%C7%AF%D1lig%12%90%84%9D%09%5D%89%EC%89%D4%C4%7BI%D2IyI%B3%C9%86%C95%C9%1B)%EE)%97SYRcS%EF%A5%C9%A6%15%A6-%A6%5B%A6%9F%CE%C02%822%06w%89%EC%CA%DE5%BB%DBd%F7%C9L%2430sp%8F%D8%9E%DC%3D%0BYVYg%B3%E9%B2%A3%B2%FF%CAQ%CE)%CF%F9%BC%D7coO%AE%40nV%EE%7C%9EU%5Es%3Ec%3E-%FF%F1%3E%BD%7Du%05XAD%C1h%A1Z%E1%D1%C2_E%C1Ew%8B%95%8B%2B%8B7%F7%07%ED%BF%7B%40%E5%40%D5%81%AD%92%D0%92%D1R%CD%D2%E3%07%09%07c%0FN%96%19%95%9D-g)O%2F%9F%AF%B0%AF%E88%24%7C%A8%E8%D0%E7%C3~%87%87%2B%D5%2B%EB%8E%D0%1DI%3A2SeW%D5uT%FC%E8%C1%A3%9B%D5%E1%D5%135%A65-%B5%FC%B5%85%B5_%8F%05%1F%1B%3Fn%7C%FCb%9D%40%5Dq%DD%F7%13%11'%9E%9C%B4%3A%D9Q%2FY_%D9%40hHnx%7D%CA%FD%D4%ED%D3%DA%A7%9B%CE%F0%9E)%3E%F3%B31%B6q%E6%AC%F3%D9%9BMZMM%E7%F8%CF%956%A3%CDI%CD%CB%E7w%9C%1F%BB%60~%A1%EB%A2%C2%C5%93-%9C-%C5%AD%D0%9A%D4%BAr%C9%FF%D2d%9Bm%DB%E0e%ED%CB%17%AFH%5C%A9mgk%2F%EA%40%3A%D2%3A%D6%3A%C3%3Bg%BA%BC%BA%1Et%DBt%0F%F6%E8%F5%B4_U%BC%DA%D8%2B%D2%5Bs%8D%E3Zi%1F%5D_n%DFV%7Fz%FF%FA%00u%60%F5z%D8%F5%F9A%BF%C1g7%3Co%3C%BA%E9ts%F4%96%ED%AD%3BC%96C7n%9B%DC%EE%BFcp%A7wXw%B8%FB%AE%F6%DD%CE%11%CD%91%8E%7B%1A%F7%DA%FF%D2%F8%AB%7DTs%B4%E3%BE%D6%FD%AE1%9D%B1%9E%07%FA%0F%FA%C6%8D%C6%AF%3F4%7F8%F4%C8%FA%D1%C8%C4%F6%89%07%93n%93O%1E%EFx%3C%F3%24%F8%C9%D2%D3%E8%A7%1F%A6%92%A7~%3C%CB%9A%C6O%17%3Dg~%5E%F9%82%FFE%FDK%99%97-3%9A3%D7f%CDg%EF%CD%B9%CC%3D%9B%0F%9A%7F%F3*%E1%D5%E6B%EEk%CA%EB%CAE%A1%C5%A6%25%D5%A5%DEe%CB%E5%B1%15%9F%95%857%D47%3FV%F3%DF%B2%BC%AD%7D'%FD%EE%CA%7B%E3%F7%F7%D6%3C%D7%16%3E%D0%3El%7D%DC%FF%89%E7S%E3g%F5%CF%83%EB%8E%EB%2F%BE%C4%7C%F9%F1%B5h%83g%E3%EC7%EDo%B7%BF%7B%7C_%FC%91%B2I%DC%AC%FA)%F3%B3%E7%97%ED%AF%E9%AD%98%AD-j%00-%00%00%00p%00%80%86%86%02%7Cl%04%A0x%01%B0%8D%01%D0%0D%FC%BES%FC%01%0E%01%40%01%80%08%82%60%03%C50%8F%C8%22%B1%C8%00%CA%83%26%A2S8k%DC%0D%CC%0A%7B%84%8F!%B0%10%06%89%BBH%86d%22%F99%5D7%7D-C)%A5%91q%9A%99%99%C5%96%B5%90m%98%83%85s%07%D7y%1E%8C7%80%EF%9A%80%B0%E0~%A1%0D%91%60%D1)%F1%ED%12%C3RJ%D2%252o%E4%AC%E5%EB%14%BE(%99)%1FP%19S%A3%A8%9Bj%24h%D6j%0Dh%CF%E8%FC%D4%E3%D2%973%D01%B40r6%0E2I0%CD5%3Bb%DEl%D1o%F9%D0jy%DB%96%0D%87%AD%BC%9D%99%BD%CF%F6%08%87d%C7%3C%A7r%E7%3A%97f%D7N%B7A%F7%11%8Fq%CF%A7%5E%2F%BD%E7%7D%96v%BC%DD%B9%E4%3B%ED7%EA%DF%1F%D0%12x%3C%E8%40pzHh%A8S%98%5E%B8x%04c%C4%97%C8%97QC%D1M1%07b%A9q.T%ADx%DE%F8M%DA%8B%84%81%C4%86%A4%BC%E4%D0%14%EBT%B94%BA%B4%95%F4%7B%19%AD%BB%AAv%E7f%A6%EC%89%CF%A2e%A7%E7%14%ED%3D%99%7B-%EF%E5%3Er%81~!%B5%A8%A1x%F2%00%5D%89~i%CC%C1%E3e%A3%E5%3F%0F%C9%1F%F6%A9%2C%3A%D2Q5SM_%A3Q%EBw%AC%F0x%5B%DD%B3%93X%BDB%83%FB%A9%3D%A7%CF%9Ey%D0%B8%D1%24%7C%CE%AEy%D7%F9%B6%0B%1FZt%5BK%2F%BD%BF%ECs%E5~%87C%E7%A3n%FD%9E%C4%ABM%BD%D3%7D%F4%FDj%03%EE%D7%E3%07%F3n%94%DD%AC%BCU9Tv%BB%E0%CE%DE%E1%7Dw%0F%8C%1C%B8%97%F7W%E2%A8%C7%7D%C5%FB%3F%C6%06%1Ed%8Ck%8E%7Fy%F8%F8Q%F7D%F5%E4%EE%C7~OL%9FJL%91%A7%DE%3E%7B0%DD%FE%BC%FA%C5%EE%97%FE3%E6%B32s%CCs%DF%E6_%BF%9A%5C%18~%7D%7D%F1%EAR%F7r%F7%CA%E97%25%AB%C9o%7D%DFY%BC%97%5Bc%5E%5B%FF0%F5%B1%EF%D3%C9%CFy%EB%E1_l%BF*m%B0m%7C%FD6%FD%7D%E0G%FDf%EE%CF%90_%E6%5B%A2%5B%5B%00%40%00%5E0%86T%B8%85%B0!v%C8A%E4%25%AA%86%96%A0%9Fp~%B8I%CC%0D%7B%8E%A7%12%18%09%9D%C4%10%12%2Fi%8A%5CK%17Fo%CA%60%40qe%0Cg%CAb%3E%C1r%9Du%99%9D%83%C3%9C3%8D%AB%85%FB%3D%AF%22%1F%8D%BFW%90%5E%C8%5D%F8%9C%C8%96%98%89x%B6D%BF%E4%A6%B4%96L%A4%EC1%B9%11%F9%8F%8A%1CJj%CA%DBT%7CT%C3%D4%E2%D5%D34vk%A6kEj%FB%E8%D8%E9%1A%E8)%EB%8B%1Ap%18%92%0C%BF%1B%BD5%9E5%990%BDk%D6g~%D9%A2%D1%B2%CA%AA%60%5B%8Au%B8%8D%97%ED6%3Bm%7B%A9%ED%1C%0E%98%C3g%C79%A7%07%CE%03.%AD%AE%C7%DD%0A%DC%13%3C%7C%3D%AD%BD%D4%BC%05%7C%08%3E%EFvL%EE%BC%E6%DB%E0W%E4%1F%17%E0%1A%A8%1E%C4%104%17%DC%1DR%1A%1A%1A%A6%1F%CE%12%FE%3A%E2jdYTH%B4n%0CS%CC%7Clg%5C%01%D5%2B%5E.~%936%9Ap%22%91%96d%96%CC%91%BC%98%D2%9D%BA%3F%CD7%5D9%03%CDx%BC%ABewqf%CC%1E%B7%2C%F3l%DD%1C%9D%BD%06%B9%DB%F2%3C%F3c%F7%ED%2B8%5Dx%A3h%B6%F8%D7%01%FE%12%9DR%F7%83%09e%07%CB%CFW%0C%1Fz%5D%89%1E%E1%AF%D2%3C%EAT%1DSS%5C%7B%FE%D8%D8%F1%2F'DO%3A%D6%EFm%E8%3E%F5%E1%8Cbc%FC%D9%2BM_%9Bu%CE%EF%BA%D0%D7%02%AD%26%97%F6%B6%DD%BA%82o%B7%EA(%E8%BC%DDM%EC%B1%B8%9A%D3%7B%ED%DA%E7~%C9%01%97%EB%19%83%C7o%5C%BD9qky%E8%EB%1Dl%98%ED%AE%C8%88%D2%3D%83%BF%ECF%BD%EF%87%8F%A5%3C%C8%1F%3F%FC%B0%FEQ%CBD%EF%E4%F0%E3%C9'%0BO%3F%3F%C3M%B3%3F%97x%A1%FD%D2n%26l%B6an%F9%95%D4%82%F7%EB%FC%C5sK%B7%97gW6V%19%DFJ%BC3z%EF%B3%96%F5a%EC%93%DA%E7%8A%F5O_%9D7%AE%7C%E7%FE%91%B7%B9%F1%2Bek%0B%000%60%01Y%D8%0EY0%80%10%11%5D%24%11%E9DQ%D4%1E%3D%81%FE%C0%F9%E2%EEb%FAX%07%5E%1B%3FHp%24%CC%133H%7C%A4%DB%E4%03tA%F4%FA%0C%7C%0C%BF(s%8C%23L%ED%CC%A7Y%AAXK%D8%0A%D8%F38%F29%8B%B9*%B8%EBx%9Ay%BB%F8%AE%F1_%13%E8%13%EC%17%EA%13%BE*%D2.%DA%2CvL%BCX%22Ir%87%94%B1%B4%A8%0C%C8%3C%93%ED%94%2B%96wW%10VXQlW%CAR%B6U%E1T%99UmVKR7%D2%20k%3C%D4%3C%A6%15%AE%AD%AE%BD%A1%D3%A7%9B%A7g%AB%CF%AA%3FePo%18i%A4j%B4i%3CdRf%BA%D3L%D6%EC%AB%F9%0D%8BRK%1F%2B)%AB%8F%DB%FA%AC%8Bl%DCmEl%DF%D8u%D8gm%B7s%E0t%98ulvJp%D6sA%5D%EE%BA%96%BBy%BB%0B%BB%2Fz%5C%F4L%F2%D2%F3F%BD%87%7DJw%B8%EC%E4%DC%F9%D4%B7%C6o%A7%BF%80%FF%F3%80c%81%3B%83%F8%83%A6%82%ABB%DCC%D9B%EF%87%15%87%5BD%40%C4%D5%C8%E4(%95%A8%D5%E8%C6%98%C0X%FE%D8%C7q%15%D4%ED%F1%A4%F8%EB%B4%F4%04%B5%84%D5%C4%D3I%BE%C9%5C%C9%F7S%F6%A5%1A%A5n%A4%B5%A6Gd%08g%3C%DDuh%B7k%26O%E6%C2%9E%AE%ACC%D9i9%A1%7Bw%E4z%E5%F9%E4%87%ECK*%C8%2B%AC%2C%3AS%DC%B1%7F%E8%C0D%C9B%E9%E72%5C9%5B%85%E8!%E5%C3%BA%95fGl%AA%9C%8EzU%07%D6%C4%D5%EE9Vq%FC%7C%DD%C8%89%F7%F5%12%0Di%A7%C6%CEH5f%9E%9D%3C%A7%D0%9C%7B%FE%D9E%95%96%82%D6%17m%9A%97%8B%AF%BC%ECP%EB%DC%D75%DD%A3v%B5%A8w%AEO%BF%BFj%E0%CB%A0%EB%8D%F6%5BRC%A7%EE(%0C%DF%1A%89%FAK%7Ctu%EC%F6%F8%A5GM%93%ADO%AEO%3D%7F%0E%2F%95g%1B_%E5%2F%16%ADt%BEc%FAP%B0%CE%BD%D1%BE%E9%B1%B5%05%F0%FBm%09%00%80%A0%09pz%1E%C0%FD%24%80%93%0F%40%A3%1C%80D%0D%00%23%3B%80%23%05%C0U%07P%D3R%40%9E%1E%05%C4%EA%E2%3F%E7%07%05%A4%C0%12Ba%1F%9C%85ax%830%22*%88%1B%92%8E%1CCz%91g%C8%26*%80%1A%A1%81h%3Ez%0E%BD%8F~%C6%F1%E1Lp%E1%B8%83%B8n%DC%1CF%8Fi%60%FE%D8~%AC%0B%7B%85g%C5%1B%E1c%F1'%F1%13%04%3A%82%09!%95%D0FX%25J%13%C3%88%8D%C4e%92%22)%89%D4O%A6'%7B%93%CF%D3!t%9Etm%F4%8C%F4%B1%F4%E3%0C%DA%0C'(%24%0A%8D%F2%82%D1%86%B1%9BI%9A%A9%9A%99%C2%9C%CD%FC%95%25%8Ee%895%88%F5%25%5B%20%DB%22%7B%0C%FB%17%8ElNF%CEc%5CJ%5C7%B8%7D%B8%D7y%CAxUx%1F%F2%A5%F0%0B%F0%8F%09%EC%134%15%02%A1%EB%C2y%22%F6%A2%3C%A2KbW%C5%CB%24%22%25-%A5%24%A4%19%A4%D7e%E6d%C7%E5n%CA%F7(%5CVlUjQnS%E9R%1DP%1BQ%7F%A1%F1A%0B%D3%E6%D0%11%D3U%D0S%D1W6%905%146b5F%8D%DF%9B%3C3%ED7%AB7%2F%B0%88%B3%F4%B42%DD%A6d-h%C3d%8B%B3%DD%B0%5B%B3_%D9%BE%E00%E78%EB%F4%CA%F9%8D%CB'%D7%9F%EEd%0F.O)%2F%1Do%7B%9F%A0%1D%19%3B%0F%FB%B6%FA%8D%FA%BF%0Dd%0CR%0B%F6%0A%D9%13%DA%10v%2B%7C%3E%E2g%14k%B4H%8Cl%ACb%9C%02U%26%5E%94%C6%99%40N%F8%9E%B8%9C%CC%9Bb%9F%9A%9B%D6%9F%FEk%97%C5%EE%8A%CC7Y%F6%D9W%F7%AA%E7v%E7%5B%EF%9B%2F%DCW%2C%B2%FFb%89q%E9LYY%85%E7a%83%23%D6GSjn%1D%E7%3B%C1X%8F6%7C%3B%FD%B1%F1%5D%D3j%F3%EA%85%F7-%EB%97~%5E!u%F0u)%F5%98%F7z%F5E%0C%24%0Ff%DE%CC%1A%DA%7D'%F9n%F4%3D%FF%D1%E2%B1%AE%F1%95%09%91%C7%3B%9F%D6%3D%7B%FDBe%26%7BnbAn%B1%60yq%D5%EA%DD%B9%0F%CC%9F2%D6%DFn%84~_%FCI%DD%DA%02%00%26P%04'H%82j%E8%87W%08%3D%A2%8A%F8%20%B9H%132%82%BCG%D9Q%5D%D4%1F-%40%5B%D1%A78%1CN%01%E7%85%CB%C3%5D%C2%BD%C4(%98%3E%16%85%D5%60%7Fa%BF%F0*%F8%60%7C-~%82%C0D%B0%23%14%12%EE%10%E9%88%F6%C4r%E2%14I%82D%23%0D%929%C9%D1%E4!%3A1%BA%1C%BA%05z%1B%FA%1E%069%86%3A%0A%07e%3F%23%811%87%09%98%B2%99q%CC%05%2C%8C%2CGXEY%5B%D8%8C%D9%26%D8c8%08%1C%F5%9C%26%9Cs%5C%F9%DC%0A%DC%93%3C%D9%BC%CA%BC3%7C%15%FC%DB%040%81A%C1%BDB%96%C2%0C%C2%93%22%F5%A2%09b%96%E2%82%E2%1B%12%93%92%9DR'%A4%8F%C8%94%C9%96%C8%95%C8%97%2BT%2B%9EQjW%BE%A3%F2B%F5%AB%3A%87%86%AEf%90V%89%F65%9D%F7z%12%FA~%065%86%CF%8C%05M%82M%5B%CC~XXX%16%5B%8DX%E3m%B4l%03%ED%F2%ED%CFl%BF%EE0%E5%B8%E6%8C%B9p%BA%CA%BA%19%BB%7By%24x%96z%5D%F4%1E%F5%F9%B0%93%D3%D7%C0%2F%D4%BF%2C%A0%2F%F0%5D%B0X%88ghi%D8P%F8%CFH%F5%A8%88%E8%E31%0F%E2P%AAj%BC%3F%AD%24%E1j%E2R2S%8AV%AA%7FZqzW%C6%E2n%AEL%EB%3D%BB%B3%DA%B2W%F6%8A%E5%EE%CC%AB%CE%7FR%C0U%E8Ut%BC%F8%D5%01%85%92%D4%D2%A12%EE%F2%B8%8A%7B%87%95%2Bk%AA%18%8F%16%D60%D4%1E%3E.Uw%FBdD%03%C3%A9%B63%DEg%B1%A6%D6f%BF%0B%CC%17o%B4%A6%B6)%5D%5Ejo%EC%8C%E8V%E8%F9%D8%DB%D3%973%607%C8uc%FEV%EB%ED%5D%C36%23%3C%F7%C6F%DD%EE%CF%3FH%7F(%F8ht%B2%F8%89%CB%94%E44%F2%7C%EE%E5%D0l%F3%7C%E9%02m%D1e%99o%A5nU%EA%ED%A5%F7%86k%A3%1F%FD%3E%BD_%CF%FA%CA%B4q%F4%BB%E0%8F%BA%9F%BC%BFJ%B7%B6%00%80%0BL%80%0Aup%1F%B6%10U%24%149%8A%DCB%3E%A1%A2%A83%9A%8Bv%A2%AB8%11%9C'%EE%20n%18%C3a%86X%3A%D6%89%AD%E35%F0%C9%F8k%04%3C%C1%81PCX!%EA%11%0F%12%97H%E6%A4Sd%12%99J%9E%A6%B3%A3%1B%A0%D7%A2%EFa0e%B8G%F1%A2%AC0f2q0%B52%3B0%7F%60%A9d5d%5Df%3B%C6%EE%C2A%E1%B8%CBY%C8e%C7%CD%CA%3D%C5s%9A%97%C6g%C2%CF%C6%FFF%60H%F0%94P%BEp%94%88%AB%A8%89%98%AA%B8%94%84%90%24%9F%14%AF%B4%B0%8C%9C%AC%8E%9C%AD%7C%80%C2.%C5j%A5k%CA%AFT%19%D5%F4%D5i%1A%175%DFkk%E8d%EB%8E%EBK%1B%E4%1A%BE6%B63%E94%933%3Fe)b%D5%60-c%D3ngn%FF%C4%81%EA%C4%E0%DC%EA%EA%E3N%F6%B8%E6%95%EC%A3%BEc%C3w%C0%FF%40%A0o%B0f(C%D8%D3%88%EA(%EB%E8%E5%D8%B4%B8%CD%F8D%DAB%A2c%D2%E5%14%96TZ%DA%A3%0C%DD%5D'3%E9%F7%A4f-%E6x%EE%BD%97g%9A%DFS%A0%5E%D8Ql%B0%7F%B8%C4%AB%F4MYf%05%CB%A1%FAJ%A5%23%DDG%0D%AB%FBk%F5%8Fu%D4%E1O%D8%9D%3C%5C%FF%F2%94%EC%E9%943%B7%CEr4%85%9E%EB9%CFx!%F8bo%2B%C7%25j%DB%C8%15%E9%F6%A2%8E%B7%5DN%DD%9DW%05%7B%F3%AF%BD%EB%F7%18%B8%3E(w%E3%F0%CD%AD%A1%C8%DB%8F%86%8D%EF6%DF%E3%FC%2Ba%F4%EE%18%DF%83%F0%F1%F3%0FW%26%C4%26%3D%1E%E7%3C9%FB%F4%EE%D4%C2%B3%CD%E7%CC%2F%84%5E%CA%CDh%CC%EA%CE%19%CE%1B%BF2%5E0%7C%AD%BB%A8%B5%A4%B2%2C%BB%22%FA%86%F1%CD%F2j%F7%DB%94w%1A%EFV%DF%9F%5E%F3%FA%40%F7%A1%F7c%E8'%E6O%5D%9Fw%AC%C3z%FD%17%D3%2Fs_%F7l%F0ot%7Fs%FB%B6%F6%7D%FF%0F%A9%1F%83%9B%BE%9B%1B%3F%2B~)%FD%1A%DE%0A%DE%DA%02H%08US%05%00%00%84%C1%14%00%FFbk%EB%93%24%00%B1%1C%E0g%D9%D6%D6%8F%FA%AD%AD%9F%0D%00%B8i%80%81%E8%DF%FF%15%00%00%04f%80%DA%86%FF%ED%8D%F4%3F%00%BD%06~%C6%80N%5E%00%00%00%00%06bKGD%00%FF%00%FF%00%FF%A0%BD%A7%93%00%00%00%09pHYs%00%00%0B%13%00%00%0B%13%01%00%9A%9C%18%00%00%00%07tIME%07%DA%0B%0F%12%004n%D47%05%00%00%01%1BIDATx%DA%ED%DC%B1%11%820%14%80%E1%87G%97%3B%98%22%0E%C0%0Ct%B2%1B%CB%E0Nl%11%0B%3B*%3D9%89%F2%FD5U%3E%1E%B9P%A4%89(%25TM%17K%00D%40%80%08%08%10%01%01%22%20%E7%AE%7D%F5%C1e%B9%5B%AD%0F%9A%A6%9B%09%F1%C9%12%10%20%02%02D%40%F4%E69D%DBs%C5%B49%A7-%F5%81%0C%C3%10)%A5X%D7%95X%0D%20)%A5%E8%FB.%22%3A%2B%5B%C3%1Eb2l%EA%07V%22%A2D%CEy%B7%FD%03%88%09%11%10%20%02%02D%40%80%08%88%80%00%11%10%20%02%02D%40%80%08%08%10%01%11%10%20%02%02D%40%80%08%08%10%01%11%10%20%02%02D%40%80%08%08%10%01%11%10%20%02%02D%40%80%08%08%10%01%11%10%20%02%02D%40%80%08%08%10%1D%DEn7%5Bo%EFB%7F%DEk%2B%13%F2%ED7%BAm%EB%9C%90m9_O%811%8E%E3o%80%CC%F3l%7C%8E%04%D9%F3%FEs%7B%88%80%08%08%10%01%01%22%20%7F%5D%13Q%FCt2!%02%02D%40%80%08%08%10%01%01%A2Zz%00g%F8%1C%DE%87%AF%C0%09%00%00%00%00IEND%AEB%60%82"/>
 </svg>
diff --git a/layout/reftests/svg/filters/feSpecularLighting-1.svg b/layout/reftests/svg/filters/feSpecularLighting-1.svg
index 7492bc68bc42..6af384832097 100644
--- a/layout/reftests/svg/filters/feSpecularLighting-1.svg
+++ b/layout/reftests/svg/filters/feSpecularLighting-1.svg
@@ -17,4 +17,9 @@
   </filter>
   <rect width='100' height='100' fill='blue'/>
   <path d='M0,0 h100 v100 h-100 z M20,20 v60 h60 v-60 z' filter='url(#f)'/>
+
+  <!-- Cover two spots in the test whose rendering differs in opt builds
+       vs. debug builds (see Bug 610945). -->
+  <rect x='78' y='18' width='4' height='4'/>
+  <rect x='18' y='78' width='4' height='4'/>
 </svg>
diff --git a/layout/reftests/svg/filters/reftest.list b/layout/reftests/svg/filters/reftest.list
index 71adc9d16f07..42cc51fdf7b7 100644
--- a/layout/reftests/svg/filters/reftest.list
+++ b/layout/reftests/svg/filters/reftest.list
@@ -86,5 +86,5 @@ fails == filter-marked-line-01.svg pass.svg # bug 477704
 
 == feDiffuseLighting-1.svg feDiffuseLighting-1-ref.svg
 
-random-if(gtk2Widget) == feSpecularLighting-1.svg feSpecularLighting-1-ref.svg # bug 610945
+== feSpecularLighting-1.svg feSpecularLighting-1-ref.svg
 
diff --git a/layout/reftests/svg/smil/anim-rect-rxry-1-ref.svg b/layout/reftests/svg/smil/anim-rect-rxry-1-ref.svg
new file mode 100644
index 000000000000..dbc4fdabd818
--- /dev/null
+++ b/layout/reftests/svg/smil/anim-rect-rxry-1-ref.svg
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+  <g fill="blue" stroke="red" stroke-width="10" transform="translate(10 10)">
+    <!-- Squares -->
+    <rect x="0" width="40" height="40"/>
+    <rect x="60" width="40" height="40"/>
+    <rect x="120" width="40" height="40"/>
+    <rect x="180" width="40" height="40"/>
+
+    <!-- rx=0 ry=20 -->
+    <rect x="0" y="60" width="40" height="40" rx="0" ry="20"/>
+    <rect x="60" y="60" width="40" height="40" rx="0" ry="20"/>
+    <rect x="120" y="60" width="40" height="40" rx="0" ry="20"/>
+    <rect x="180" y="60" width="40" height="40" rx="0" ry="20"/>
+    <rect x="240" y="60" width="40" height="40" rx="0" ry="20"/>
+
+    <!-- rx=20 (hence ry=20) -->
+    <rect x="0" y="120" width="40" height="40" rx="20"/>
+    <rect x="60" y="120" width="40" height="40" rx="20"/>
+    <rect x="120" y="120" width="40" height="40" rx="20"/>
+    <rect x="180" y="120" width="40" height="40" rx="20"/>
+    <rect x="240" y="120" width="40" height="40" rx="20"/>
+    <rect x="300" y="120" width="40" height="40" rx="20"/>
+  </g>
+</svg>
diff --git a/layout/reftests/svg/smil/anim-rect-rxry-1.svg b/layout/reftests/svg/smil/anim-rect-rxry-1.svg
new file mode 100644
index 000000000000..71d18d6005ee
--- /dev/null
+++ b/layout/reftests/svg/smil/anim-rect-rxry-1.svg
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     class="reftest-wait">
+  <g fill="blue" stroke="red" stroke-width="10" transform="translate(10 10)">
+    <!-- Squares -->
+    <rect x="0" width="40" height="40"/>
+    <rect x="60" width="40" height="40">
+      <set attributeName="rx" to="0"/>
+    </rect>
+    <rect x="120" width="40" height="40" rx="20">
+      <set attributeName="rx" to="0"/>
+    </rect>
+    <rect x="180" width="40" height="40" rx="20" ry="20">
+      <set attributeName="rx" to="0"/>
+      <set attributeName="ry" to="0"/>
+    </rect>
+
+    <!-- rx=0 ry=20 -->
+    <rect x="0" y="60" width="40" height="40" rx="0" ry="20"/>
+    <rect x="60" y="60" width="40" height="40" ry="20">
+      <set attributeName="rx" to="0"/>
+    </rect>
+    <rect x="120" y="60" width="40" height="40" rx="20" ry="20">
+      <set attributeName="rx" to="0"/>
+    </rect>
+    <rect x="180" y="60" width="40" height="40">
+      <set attributeName="rx" to="0"/>
+      <set attributeName="ry" to="20"/>
+    </rect>
+    <rect x="240" y="60" width="40" height="40" id="a">
+      <set attributeName="ry" to="20"/>
+      <!-- rx.baseVal will be set to 0 by script -->
+    </rect>
+
+    <!-- rx=20 (hence ry=20) -->
+    <rect x="0" y="120" width="40" height="40" rx="20"/>
+    <rect x="60" y="120" width="40" height="40">
+      <set attributeName="rx" to="20"/>
+    </rect>
+    <rect x="120" y="120" width="40" height="40" rx="0">
+      <set attributeName="rx" to="20"/>
+    </rect>
+    <rect x="180" y="120" width="40" height="40" rx="10">
+      <set attributeName="rx" to="20"/>
+    </rect>
+    <rect x="240" y="120" width="40" height="40" ry="0" id="b">
+      <set attributeName="rx" to="20"/>
+      <!-- ry attribute will be removed by script -->
+    </rect>
+    <!-- rx.baseVal attribute will be set by script -->
+    <rect x="300" y="120" width="40" height="40" id="c"/>
+  </g>
+  <script xlink:href="smil-util.js" type="text/javascript"/>
+  <script type="text/javascript">
+    document.getElementById('a').rx.baseVal.value = 0;
+    document.getElementById('b').removeAttribute('ry');
+    document.getElementById('c').rx.baseVal.value = 20;
+    // We can get very minor rendering differences on Windows due to the
+    // presence of animation in the document, even on un-animated content.
+    // This is most likely due to interaction with layers so we forcibly seek
+    // the animation timeline to try to produce a steady state for snapshot.
+    setTimeAndSnapshot(0.0, true);
+  </script>
+</svg>
diff --git a/layout/reftests/svg/smil/reftest.list b/layout/reftests/svg/smil/reftest.list
index 79014fdf332b..cbd502532716 100644
--- a/layout/reftests/svg/smil/reftest.list
+++ b/layout/reftests/svg/smil/reftest.list
@@ -176,6 +176,8 @@ random == anim-text-x-y-dx-dy-01.svg anim-text-x-y-dx-dy-01-ref.svg # bug 579588
 == anim-y-interp-5.svg anim-y-interp-5-ref.svg
 == anim-y-interp-6.svg anim-y-interp-6-ref.svg
 
+== anim-rect-rxry-1.svg anim-rect-rxry-1-ref.svg
+
 == api-sanity-1.svg lime.svg
 
 == freeze-applied-late-1.svg anim-standard-ref.svg
diff --git a/layout/style/forms.css b/layout/style/forms.css
index ea9be1101837..27bb1004ec5f 100644
--- a/layout/style/forms.css
+++ b/layout/style/forms.css
@@ -624,14 +624,15 @@ input[type="file"] > input[type="text"] {
 
 /**
  * Set default style for invalid elements.
- * <output> is the only element which may not follow this rule (but color: red).
- * However it is barred from constraint validation per the specifications so, at
- * least for now, it will not be affected by :invalid.
  */
-:invalid {
+:not(output):invalid {
   box-shadow: 0 0 1.5px 1px red;
 }
 
+output:invalid {
+  color: red;
+}
+
 @media print {
   input, textarea, select, button {
     -moz-user-input: none !important;
diff --git a/layout/style/nsRuleNode.cpp b/layout/style/nsRuleNode.cpp
index e7e5d59c7fdb..c6c84b2540e9 100644
--- a/layout/style/nsRuleNode.cpp
+++ b/layout/style/nsRuleNode.cpp
@@ -1358,7 +1358,6 @@ CheckFontCallback(const nsRuleDataStruct& aData,
   // and 'narrower' values of 'font-stretch' depend on the parent.
   const nsCSSValue& size = fontData.mSize;
   const nsCSSValue& weight = fontData.mWeight;
-  const nsCSSValue& stretch = fontData.mStretch;
   if (size.IsRelativeLengthUnit() ||
       size.GetUnit() == eCSSUnit_Percent ||
       (size.GetUnit() == eCSSUnit_Enumerated &&
diff --git a/layout/style/nsStyleAnimation.cpp b/layout/style/nsStyleAnimation.cpp
index 779dff339f76..3ce441985e60 100644
--- a/layout/style/nsStyleAnimation.cpp
+++ b/layout/style/nsStyleAnimation.cpp
@@ -590,7 +590,6 @@ nsStyleAnimation::ComputeDistance(nsCSSProperty aProperty,
                           "unexpected unit");
         NS_ABORT_IF_FALSE(a1->Item(0) == a2->Item(0),
                           "unexpected function mismatch");
-        nsCSSKeyword tfunc = nsStyleTransformMatrix::TransformFunctionOf(a1);
         NS_ABORT_IF_FALSE(a1->Count() == a2->Count(),
                           "unexpected count mismatch");
         for (size_t i = 1, iEnd = NS_MIN(a1->Count(), a2->Count());
@@ -623,15 +622,7 @@ nsStyleAnimation::ComputeDistance(nsCSSProperty aProperty,
             squareDistance += diff * diff;
           } else {
             NS_ABORT_IF_FALSE(v1.GetUnit() == v2.GetUnit(), "unit mismatch");
-            double diff;
-            if (tfunc == eCSSKeyword_skewx ||
-                tfunc == eCSSKeyword_skewy ||
-                tfunc == eCSSKeyword_skew) {
-              NS_ABORT_IF_FALSE(v1.GetUnit() == eCSSUnit_Radian, "unexpected unit");
-              diff = tan(v2.GetFloatValue()) - tan(v1.GetFloatValue());
-            } else {
-              diff = v2.GetFloatValue() - v1.GetFloatValue();
-            }
+            double diff = v2.GetFloatValue() - v1.GetFloatValue();
             squareDistance += diff * diff;
           }
         }
@@ -881,21 +872,6 @@ AddTransformScale(const nsCSSValue &aValue1, double aCoeff1,
   aResult.SetFloatValue(result + 1.0f, eCSSUnit_Number);
 }
 
-// FIXME: The spec still says skew should animate in angle space,
-// although I think we at least sort of agreed that it should animate
-// in tangent space.  So here I animate in in tangent space.
-// Animating in angle space would mean just using AddCSSValueAngle.
-static void
-AddTransformSkew(const nsCSSValue &aValue1, double aCoeff1,
-                 const nsCSSValue &aValue2, double aCoeff2,
-                 nsCSSValue &aResult)
-{
-  aResult.SetFloatValue(atan(aCoeff1 * tan(aValue1.GetAngleValueInRadians()) +
-                             aCoeff2 * tan(aValue2.GetAngleValueInRadians())),
-                        eCSSUnit_Radian);
-}
-
-
 static already_AddRefed<nsCSSValue::Array>
 AppendTransformFunction(nsCSSKeyword aTransformFunction,
                         nsCSSValueList**& aListTail)
@@ -1156,10 +1132,7 @@ AddTransformMatrix(const nsStyleTransformMatrix &aMatrix1, double aCoeff1,
 
   float rotate = rotate1 * aCoeff1 + rotate2 * aCoeff2;
 
-  // FIXME: The spec still says skew should animate in angle space,
-  // although I think we at least sort of agreed that it should animate
-  // in tangent space.  So here I animate in in tangent space.
-  float skewX = atanf(XYshear1 * aCoeff1 + XYshear2 * aCoeff2);
+  float skewX = atanf(XYshear1) * aCoeff1 + atanf(XYshear2) * aCoeff2;
 
   // Handle scale, and the two matrix components where identity is 1, by
   // subtracting 1, multiplying by the coefficients, and then adding 1
@@ -1280,6 +1253,11 @@ AddTransformLists(const nsCSSValueList* aList1, double aCoeff1,
 
         break;
       }
+      // It would probably be nicer to animate skew in tangent space
+      // rather than angle space.  However, it's easy to specify
+      // skews with infinite tangents, and behavior changes pretty
+      // drastically when crossing such skews (since the direction of
+      // animation flips), so interop is probably more important here.
       case eCSSKeyword_skew: {
         NS_ABORT_IF_FALSE(a1->Count() == 2 || a1->Count() == 3,
                           "unexpected count");
@@ -1288,7 +1266,7 @@ AddTransformLists(const nsCSSValueList* aList1, double aCoeff1,
 
         nsCSSValue zero(0.0f, eCSSUnit_Radian);
         // Add Y component of skew.
-        AddTransformSkew(a1->Count() == 3 ? a1->Item(2) : zero,
+        AddCSSValueAngle(a1->Count() == 3 ? a1->Item(2) : zero,
                          aCoeff1,
                          a2->Count() == 3 ? a2->Item(2) : zero,
                          aCoeff2,
@@ -1296,21 +1274,13 @@ AddTransformLists(const nsCSSValueList* aList1, double aCoeff1,
 
         // Add X component of skew (which can be merged with case below
         // in non-DEBUG).
-        AddTransformSkew(a1->Item(1), aCoeff1, a2->Item(1), aCoeff2,
+        AddCSSValueAngle(a1->Item(1), aCoeff1, a2->Item(1), aCoeff2,
                          arr->Item(1));
 
         break;
       }
       case eCSSKeyword_skewx:
-      case eCSSKeyword_skewy: {
-        NS_ABORT_IF_FALSE(a1->Count() == 2, "unexpected count");
-        NS_ABORT_IF_FALSE(a2->Count() == 2, "unexpected count");
-
-        AddTransformSkew(a1->Item(1), aCoeff1, a2->Item(1), aCoeff2,
-                         arr->Item(1));
-
-        break;
-      }
+      case eCSSKeyword_skewy:
       case eCSSKeyword_rotate: {
         NS_ABORT_IF_FALSE(a1->Count() == 2, "unexpected count");
         NS_ABORT_IF_FALSE(a2->Count() == 2, "unexpected count");
diff --git a/layout/style/test/test_transitions_per_property.html b/layout/style/test/test_transitions_per_property.html
index dab7bc13f751..3a1e4cfbb4d6 100644
--- a/layout/style/test/test_transitions_per_property.html
+++ b/layout/style/test/test_transitions_per_property.html
@@ -959,25 +959,26 @@ function test_transform_transition(prop) {
 
     // skew
     { start: 'skewX(45deg)', end: 'none',
-      expected: 'matrix(1, 0, 0.75, 1, 0px, 0px)' },
+      expected_uncomputed: 'skewX(33.75deg)' },
     { start: 'skewY(45deg)', end: 'none',
-      expected: 'matrix(1, 0.75, 0, 1, 0px, 0px)' },
+      expected_uncomputed: 'skewY(33.75deg)' },
     { start: 'skew(45deg)', end: 'none',
-      expected: 'matrix(1, 0, 0.75, 1, 0px, 0px)' },
+      expected_uncomputed: 'skew(33.75deg)' },
     { start: 'skew(45deg, 45deg)', end: 'none',
-      expected: 'matrix(1, 0.75, 0.75, 1, 0px, 0px)' },
+      expected_uncomputed: 'skew(33.75deg, 33.75deg)' },
     { start: 'skewX(45deg)', end: 'skewX(-45deg)',
-      expected: 'matrix(1, 0, 0.5, 1, 0px, 0px)' },
+      expected_uncomputed: 'skewX(22.5deg)' },
     { start: 'skewX(0)', end: 'skewX(-45deg)',
-      expected: 'matrix(1, 0, -0.25, 1, 0px, 0px)' },
+      expected_uncomputed: 'skewX(-11.25deg)' },
     { start: 'skewY(45deg)', end: 'skewY(-45deg)',
-      expected: 'matrix(1, 0.5, 0, 1, 0px, 0px)' },
+      expected_uncomputed: 'skewY(22.5deg)' },
 
     // matrix : skewX
     { start: 'matrix(1, 0, 3, 1, 0px, 0px)', end: 'none',
-      expected_uncomputed: 'matrix(1, 0, 2.25, 1, 0px, 0px)' },
+      force_compute: true,
+      expected_uncomputed: 'matrix(1, 0, ' + Math.tan(Math.atan(3) * 0.75) + ', 1, 0px, 0px)' },
     { start: 'skewX(0)', end: 'skewX(-45deg) translate(0)',
-      expected: 'matrix(1, 0, -0.25, 1, 0px, 0px)' },
+      expected_uncomputed: 'skewX(-11.25deg)' },
     // matrix : rotate
     { start: 'rotate(-30deg)', end: 'matrix(0, 1, -1, 0, 0px, 0px)',
       expected_uncomputed: 'matrix(1, 0, 0, 1, 0px, 0px)' },
@@ -986,7 +987,7 @@ function test_transform_transition(prop) {
       expected: c('rotate(-45deg)') },
     // matrix decomposition of skewY
     { start: 'skewY(60deg)', end: 'skewY(-60deg) translateX(0)',
-      expected: c('rotate(30deg) skewX(' + Math.atan(Math.tan(Math.PI / 3) / 2) + 'rad) scale(2, 0.5)') },
+      expected: c('rotate(30deg) skewX(30deg) scale(2, 0.5)') },
 
     // matrix decomposition
 
@@ -1041,56 +1042,54 @@ function test_transform_transition(prop) {
     { start: 'none',
       end: 'matrix(1, 0, 1.5, 1, 0pt, 0pt)',
               /* skewX(atan(1.5)) */
-      expected: c('matrix(1, 0, 0.375, 1, 0, 0)') },
+      expected_uncomputed: 'matrix(1, 0, ' + Math.tan(Math.atan(1.5) * 0.25).toFixed(6) + ', 1, 0px, 0px)' },
     { start: 'none',
       end: 'matrix(-1, 0, 2, -1, 0pt, 0pt)',
               /* rotate(180deg) skewX(atan(-2)) */
-      expected: c('rotate(45deg) matrix(1, 0, -0.5, 1, 0, 0)') },
+      expected: c('rotate(45deg) matrix(1, 0, ' + Math.tan(Math.atan(-2) * 0.25) + ', 1, 0px, 0px)') },
     { start: 'none',
       end: 'matrix(0, -1, 1, -3, 0pt, 0pt)',
               /* rotate(-90deg) skewX(atan(3)) */
-      expected: c('rotate(-22.5deg) matrix(1, 0, 0.75, 1, 0, 0)') },
+      expected: c('rotate(-22.5deg) matrix(1, 0, ' + Math.tan(Math.atan(3) * 0.25) + ', 1, 0px, 0px)') },
     { start: 'none',
       end: 'matrix(0, 1, -1, 4, 0pt, 0pt)',
               /* rotate(90deg) skewX(atan(4)) */
-      expected: c('rotate(22.5deg) matrix(1, 0, 1, 1, 0, 0)') },
+      expected: c('rotate(22.5deg) matrix(1, 0, ' + Math.tan(Math.atan(4) * 0.25) + ', 1, 0px, 0px)') },
     // and then four with negative determinants
     { start: 'none',
       end: 'matrix(1, 0, 1, -1, 0pt, 0pt)',
               /* rotate(-180deg) skewX(atan(-1)) scaleX(-1) */
-      expected: c('rotate(-45deg) matrix(1, 0, -0.25, 1, 0, 0) scaleX(0.5)'),
-      round_error_ok: true },
+      expected: c('rotate(-45deg) matrix(1, 0, ' + Math.tan(Math.atan(-1) * 0.25) + ', 1, 0px, 0px) scaleX(0.5)') },
     { start: 'none',
       end: 'matrix(-1, 0, -1, 1, 0pt, 0pt)',
               /* skewX(atan(-1)) scaleX(-1) */
-      expected: c('matrix(1, 0, -0.25, 1, 0, 0) scaleX(0.5)') },
+      expected: c('matrix(1, 0, ' + Math.tan(Math.atan(-1) * 0.25) + ', 1, 0px, 0px) scaleX(0.5)') },
     { start: 'none',
       end: 'matrix(0, 1, 1, -2, 0pt, 0pt)',
               /* rotate(-90deg) skewX(atan(2)) scaleX(-1) */
-      expected: c('rotate(-22.5deg) matrix(1, 0, 0.5, 1, 0, 0) scaleX(0.5)') },
+      expected: c('rotate(-22.5deg) matrix(1, 0, ' + Math.tan(Math.atan(2) * 0.25) + ', 1, 0px, 0px) scaleX(0.5)') },
     { start: 'none',
       end: 'matrix(0, -1, -1, 0.5, 0pt, 0pt)',
               /* rotate(90deg) skewX(atan(0.5)) scaleX(-1) */
-      expected: c('rotate(22.5deg) matrix(1, 0, 0.125, 1, 0, 0) scaleX(0.5)') },
+      expected: c('rotate(22.5deg) matrix(1, 0, ' + Math.tan(Math.atan(0.5) * 0.25) + ', 1, 0px, 0px) scaleX(0.5)') },
 
     // lists vs. matrix decomposition
     { start: 'translate(10px) skewY(45deg)',
       end: 'translate(30px) skewY(-45deg)',
-      expected: 'matrix(1, 0.5, 0, 1, 15px, 0px)' },
+      expected_uncomputed: 'translate(15px) skewY(22.5deg)' },
     { start: 'skewY(45deg) rotate(90deg)',
       end: 'skewY(-45deg) rotate(90deg)',
-      expected: c('matrix(1, 0.5, 0, 1, 0px, 0px) rotate(90deg)') },
+      expected_uncomputed: 'skewY(22.5deg) rotate(90deg)' },
     { start: 'skewY(45deg) rotate(90deg) translate(0)',
       end: 'skewY(-45deg) rotate(90deg)',
-      expected: c('matrix(1, 0.5, 0, 1, 0px, 0px) rotate(90deg)') },
+      expected: c('rotate(90deg) skewX(-22.5deg)') },
     { start: 'skewX(45deg) rotate(90deg)',
       end: 'skewX(-45deg) rotate(90deg)',
-      expected: c('matrix(1, 0, 0.5, 1, 0px, 0px) rotate(90deg)') },
+      expected_uncomputed: 'skewX(22.5deg) rotate(90deg)' },
     { start: 'skewX(-60deg) rotate(90deg) translate(0)',
       end: 'skewX(60deg) rotate(90deg)',
-      expected: c('rotate(120deg) skewX(' +
-                   Math.atan(Math.tan(Math.PI / 3) / 2) +
-                  'rad) scale(2, 0.5)') },
+      expected: c('rotate(120deg) skewX(30deg) scale(2, 0.5)'),
+      round_error_ok: true },
   ];
 
   var matrix_re = /^matrix\(([^,]*), ([^,]*), ([^,]*), ([^,]*), ([^,]*)px, ([^,]*)px\)$/;
@@ -1098,7 +1097,7 @@ function test_transform_transition(prop) {
     var test = tests[i];
     if (!("expected" in test)) {
       var v = test.expected_uncomputed;
-      if (v.match(matrix_re)) {
+      if (v.match(matrix_re) && !test.force_compute) {
         test.expected = v;
       } else {
         test.expected = c(v);
diff --git a/layout/svg/base/src/nsSVGEffects.cpp b/layout/svg/base/src/nsSVGEffects.cpp
index ebd06f330742..34bfc582d165 100644
--- a/layout/svg/base/src/nsSVGEffects.cpp
+++ b/layout/svg/base/src/nsSVGEffects.cpp
@@ -192,6 +192,13 @@ nsSVGRenderingObserver::InvalidateViaReferencedElement()
   DoUpdate();
 }
 
+void
+nsSVGRenderingObserver::NotifyEvictedFromRenderingObserverList()
+{
+  mInObserverList = PR_FALSE; // We've been removed from rendering-obs. list.
+  StopListening();            // Remove ourselves from mutation-obs. list.
+}
+
 void
 nsSVGRenderingObserver::AttributeChanged(nsIDocument* aDocument,
                                          dom::Element* aElement,
@@ -542,6 +549,21 @@ nsSVGRenderingObserverList::InvalidateAll()
   }
 }
 
+void
+nsSVGRenderingObserverList::RemoveAll()
+{
+  nsAutoTArray<nsSVGRenderingObserver*,10> observers;
+
+  // The PL_DHASH_REMOVE in GatherEnumerator drops all our observers here:
+  mObservers.EnumerateEntries(GatherEnumerator, &observers);
+
+  // Our list is now cleared.  We need to notify the observers we've removed,
+  // so they can update their state & remove themselves as mutation-observers.
+  for (PRUint32 i = 0; i < observers.Length(); ++i) {
+    observers[i]->NotifyEvictedFromRenderingObserverList();
+  }
+}
+
 static void
 DestroyObservers(void *aObject, nsIAtom *aPropertyName,
                  void *aPropertyValue, void *aData)
@@ -577,6 +599,16 @@ nsSVGEffects::RemoveRenderingObserver(Element *aElement, nsSVGRenderingObserver
   }
 }
 
+void
+nsSVGEffects::RemoveAllRenderingObservers(Element *aElement)
+{
+  nsSVGRenderingObserverList *observerList = GetObserverList(aElement);
+  if (observerList) {
+    observerList->RemoveAll();
+    aElement->SetHasRenderingObservers(false);
+  }
+}
+
 void
 nsSVGEffects::InvalidateRenderingObservers(nsIFrame *aFrame)
 {
diff --git a/layout/svg/base/src/nsSVGEffects.h b/layout/svg/base/src/nsSVGEffects.h
index fa7f22933a56..59ba97a1e60f 100644
--- a/layout/svg/base/src/nsSVGEffects.h
+++ b/layout/svg/base/src/nsSVGEffects.h
@@ -80,6 +80,12 @@ public:
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTREMOVED
 
   void InvalidateViaReferencedElement();
+
+  // When a nsSVGRenderingObserver list gets forcibly cleared, it uses this
+  // callback to notify every observer that's cleared from it, so they can
+  // react.
+  void NotifyEvictedFromRenderingObserverList();
+
   nsIFrame* GetReferencedFrame();
   PRBool IsInObserverList() const { return mInObserverList; }
 
@@ -256,6 +262,12 @@ public:
    */
   void InvalidateAll();
 
+  /**
+   * Drop all our observers, and notify them that we have dropped our reference
+   * to them.
+   */
+  void RemoveAll();
+
 private:
   nsTHashtable<nsVoidPtrHashKey> mObservers;
 };
@@ -350,6 +362,12 @@ public:
    * @param aFrame must be a first-continuation.
    */
   static void RemoveRenderingObserver(Element *aElement, nsSVGRenderingObserver *aObserver);
+
+  /**
+   * Removes all rendering observers from aElement.
+   */
+  static void RemoveAllRenderingObservers(Element *aElement);
+
   /**
    * This can be called on any frame. We invalidate the observers of aFrame's
    * element, if any, or else walk up to the nearest observable SVG parent
diff --git a/layout/svg/crashtests/612662-1.svg b/layout/svg/crashtests/612662-1.svg
new file mode 100644
index 000000000000..73dc98ed1990
--- /dev/null
+++ b/layout/svg/crashtests/612662-1.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" style="background: url(#a); direction: rtl; margin: -32944px;"></svg>
diff --git a/layout/svg/crashtests/612662-2.svg b/layout/svg/crashtests/612662-2.svg
new file mode 100644
index 000000000000..b46841132f76
--- /dev/null
+++ b/layout/svg/crashtests/612662-2.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     style="direction: rtl; margin: -32944px;
+            background: url(data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3C%2Fsvg%3E)"></svg>
diff --git a/layout/svg/crashtests/crashtests.list b/layout/svg/crashtests/crashtests.list
index b919f335d7d2..b386331f89bd 100644
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -97,3 +97,5 @@ load 590291-1.svg
 load 601999-1.html
 load 605626-1.svg
 load 610954-1.html
+load 612662-1.svg
+load 612662-2.svg
diff --git a/layout/tools/reftest/reftest.js b/layout/tools/reftest/reftest.js
index e807742755e3..b45352b1dba7 100644
--- a/layout/tools/reftest/reftest.js
+++ b/layout/tools/reftest/reftest.js
@@ -1341,8 +1341,13 @@ function DocumentLoaded()
 
             var result = "REFTEST " + output.s + " | " +
                          gURLs[0].prettyPath + " | "; // the URL being tested
-            if (gURLs[0].type == TYPE_REFTEST_NOTEQUAL) {
-                result += "(!=) ";
+            switch (gURLs[0].type) {
+                case TYPE_REFTEST_NOTEQUAL:
+                    result += "image comparison (!=) ";
+                    break;
+                case TYPE_REFTEST_EQUAL:
+                    result += "image comparison (==) ";
+                    break;
             }
             gDumpLog(result + "\n");
 
diff --git a/layout/xul/base/src/tree/src/nsTreeContentView.cpp b/layout/xul/base/src/tree/src/nsTreeContentView.cpp
index 113260680c06..53aa33cf780c 100644
--- a/layout/xul/base/src/tree/src/nsTreeContentView.cpp
+++ b/layout/xul/base/src/tree/src/nsTreeContentView.cpp
@@ -1091,11 +1091,14 @@ nsTreeContentView::ContentInserted(nsIDocument *aDocument,
   }
   else if (childTag == nsGkAtoms::option) {
     PRInt32 parentIndex = FindContent(aContainer);
-    PRInt32 index = 0;
-    GetIndexInSubtree(aContainer, aChild, &index);
-    PRInt32 count = InsertRow(parentIndex, index, aChild);
-    if (mBoxObject)
-      mBoxObject->RowCountChanged(parentIndex + index + 1, count);
+
+    if (parentIndex >= 0) {
+      PRInt32 index = 0;
+      GetIndexInSubtree(aContainer, aChild, &index);
+      PRInt32 count = InsertRow(parentIndex, index, aChild);
+      if (mBoxObject)
+        mBoxObject->RowCountChanged(parentIndex + index + 1, count);
+    }
   }
 }
 
diff --git a/media/libsydneyaudio/src/sydney_audio_android.c b/media/libsydneyaudio/src/sydney_audio_android.c
index c4b8cad319d1..bb7e488effff 100644
--- a/media/libsydneyaudio/src/sydney_audio_android.c
+++ b/media/libsydneyaudio/src/sydney_audio_android.c
@@ -35,11 +35,25 @@
  */
 
 #include <stdlib.h>
+#include <time.h>
 #include <jni.h>
 #include "sydney_audio.h"
 
+#include "android/log.h"
+
+#ifndef ALOG
+#if defined(DEBUG) || defined(FORCE_ALOG)
+#define ALOG(args...)  __android_log_print(ANDROID_LOG_INFO, "Gecko - SYDNEY_AUDIO" , ## args)
+#else
+#define ALOG(args...)
+#endif
+#endif 
+
 /* Android implementation based on sydney_audio_mac.c */
 
+#define NANOSECONDS_IN_MILLISECOND 1000000
+#define MILLISECONDS_PER_SECOND    1000
+
 /* android.media.AudioTrack */
 struct AudioTrack {
   jclass    class;
@@ -85,6 +99,13 @@ struct sa_stream {
 
   unsigned int rate;
   unsigned int channels;
+  unsigned int isPaused;
+
+  int64_t lastStartTime;
+  int64_t timePlaying;
+  int64_t amountWritten;
+  unsigned int bufferSize;
+
   jclass at_class;
 };
 
@@ -107,7 +128,7 @@ init_jni_bindings(JNIEnv *jenv) {
   at.getpos      = (*jenv)->GetMethodID(jenv, class, "getPlaybackHeadPosition", "()I");
 
   return class;
-};
+}
 
 /*
  * -----------------------------------------------------------------------------
@@ -154,6 +175,13 @@ sa_stream_create_pcm(
   s->output_unit = NULL;
   s->rate        = rate;
   s->channels    = channels;
+  s->isPaused    = 0;
+
+  s->lastStartTime = 0;
+  s->timePlaying = 0;
+  s->amountWritten = 0;
+
+  s->bufferSize = rate * channels;
 
   *_s = s;
   return SA_SUCCESS;
@@ -180,14 +208,16 @@ sa_stream_open(sa_stream_t *s) {
 
   s->at_class = init_jni_bindings(jenv);
 
+  int32_t chanConfig = s->channels == 1 ?
+    CHANNEL_OUT_MONO : CHANNEL_OUT_STEREO;
+
   jobject obj =
     (*jenv)->NewObject(jenv, s->at_class, at.constructor,
                        STREAM_MUSIC,
                        s->rate,
-                       s->channels == 1 ?
-                         CHANNEL_OUT_MONO : CHANNEL_OUT_STEREO,
+                       chanConfig,
                        ENCODING_PCM_16BIT,
-                       (s->channels * s->rate) / 2,
+                       s->bufferSize,
                        MODE_STREAM);
 
   if (!obj) {
@@ -199,6 +229,7 @@ sa_stream_open(sa_stream_t *s) {
   s->output_unit = (*jenv)->NewGlobalRef(jenv, obj);
   (*jenv)->PopLocalFrame(jenv, NULL);
 
+  ALOG("%x - New stream %d %d", s,  s->rate, s->channels);
   return SA_SUCCESS;
 }
 
@@ -218,11 +249,11 @@ sa_stream_destroy(sa_stream_t *s) {
   (*jenv)->DeleteGlobalRef(jenv, s->at_class);
   free(s);
 
+  ALOG("%x - Stream destroyed", s);
   return SA_SUCCESS;
 }
 
 
-
 /*
  * -----------------------------------------------------------------------------
  * Data read and write functions
@@ -257,9 +288,38 @@ sa_stream_write(sa_stream_t *s, const void *data, size_t nbytes) {
   }
 
   memcpy(byte, data, nbytes);
+
+  size_t wroteSoFar = 0;
+  jint retval;
+
+  do {
+    retval = (*jenv)->CallIntMethod(jenv,
+                                    s->output_unit,
+                                    at.write,
+                                    bytearray,
+                                    wroteSoFar,
+                                    nbytes - wroteSoFar);
+    if (retval < 0) {
+      ALOG("%x - Write failed %d", s, retval);
+      break;
+    }
+
+    wroteSoFar += retval;
+
+    if (wroteSoFar != nbytes) {
+
+      /* android doesn't start playing until we explictly call play. */
+      if (!s->isPaused)
+	sa_stream_resume(s);
+
+      struct timespec ts = {0, 100000000}; /* .10s */
+      nanosleep(&ts, NULL);
+    }
+  } while(wroteSoFar < nbytes);
+
+  s->amountWritten += nbytes;
+
   (*jenv)->ReleaseByteArrayElements(jenv, bytearray, byte, 0);
-  jint retval = (*jenv)->CallIntMethod(jenv, s->output_unit, at.write,
-                                       bytearray, 0, nbytes);
 
   (*jenv)->PopLocalFrame(jenv, NULL);
 
@@ -280,9 +340,13 @@ sa_stream_get_write_size(sa_stream_t *s, size_t *size) {
     return SA_ERROR_NO_INIT;
   }
 
-  // XXX AudioTrack doesn't block on writes but it might not write everything.
-  //     Needs investigation.
-  *size = (s->rate * s->channels) / 2;
+  /* No android API for this, so estimate based on how much we have played and
+   * how much we have written.
+   */
+  *size = s->bufferSize - ((s->timePlaying * s->channels * s->rate /
+			    MILLISECONDS_PER_SECOND) - s->amountWritten);
+  ALOG("%x - Write Size %d", s, *size);
+
   return SA_SUCCESS;
 }
 
@@ -294,9 +358,15 @@ sa_stream_get_position(sa_stream_t *s, sa_position_t position, int64_t *pos) {
     return SA_ERROR_NO_INIT;
   }
 
+  ALOG("%x - get position", s);
+
   JNIEnv *jenv = GetJNIForThread();
   *pos  = (*jenv)->CallIntMethod(jenv, s->output_unit, at.getpos);
-  *pos *= s->channels * 2;
+
+  /* android returns number of frames, so:
+     position = frames * (PCM_16_BIT == 2 bytes) * channels
+  */
+  *pos *= s->channels * sizeof(int16_t);
   return SA_SUCCESS;
 }
 
@@ -309,6 +379,18 @@ sa_stream_pause(sa_stream_t *s) {
   }
 
   JNIEnv *jenv = GetJNIForThread();
+  s->isPaused = 1;
+
+  /* Update stats */
+  if (s->lastStartTime != 0) {
+    /* if lastStartTime is not zero, so playback has started */
+    struct timespec current_time;
+    clock_gettime(CLOCK_REALTIME, &current_time);
+    int64_t ticker = current_time.tv_sec * 1000 + current_time.tv_nsec / 1000000;
+    s->timePlaying += ticker - s->lastStartTime;
+  }
+  ALOG("%x - Pause total time playing: %lld total written: %lld", s,  s->timePlaying, s->amountWritten);
+
   (*jenv)->CallVoidMethod(jenv, s->output_unit, at.pause);
   return SA_SUCCESS;
 }
@@ -321,7 +403,17 @@ sa_stream_resume(sa_stream_t *s) {
     return SA_ERROR_NO_INIT;
   }
 
+  ALOG("%x - resume", s);
+
   JNIEnv *jenv = GetJNIForThread();
+  s->isPaused = 0;
+
+  /* Update stats */
+  struct timespec current_time;
+  clock_gettime(CLOCK_REALTIME, &current_time);
+  int64_t ticker = current_time.tv_sec * 1000 + current_time.tv_nsec / 1000000;
+  s->lastStartTime = ticker;
+
   (*jenv)->CallVoidMethod(jenv, s->output_unit, at.play);
   return SA_SUCCESS;
 }
@@ -334,13 +426,23 @@ sa_stream_drain(sa_stream_t *s)
     return SA_ERROR_NO_INIT;
   }
 
-  JNIEnv *jenv = GetJNIForThread();
-  (*jenv)->CallVoidMethod(jenv, s->output_unit, at.flush);
+  /* There is no way with the Android SDK to determine exactly how
+     long to playback.  So estimate and sleep for the long.
+  */
+
+  size_t available;
+  sa_stream_get_write_size(s, &available);
+
+  long x = (s->bufferSize - available) * 1000 / s->channels / s->rate / sizeof(int16_t) * NANOSECONDS_IN_MILLISECOND;
+  ALOG("%x - Drain - sleep for %f ns", s, x);
+
+  struct timespec ts = {0, x};
+  nanosleep(&ts, NULL);
+
   return SA_SUCCESS;
 }
 
 
-
 /*
  * -----------------------------------------------------------------------------
  * Extension functions
diff --git a/media/libsydneyaudio/sydney_android.patch b/media/libsydneyaudio/sydney_android.patch
index 7631a789132b..bf4e1ba6123d 100644
--- a/media/libsydneyaudio/sydney_android.patch
+++ b/media/libsydneyaudio/sydney_android.patch
@@ -18,7 +18,7 @@ diff --git a/media/libsydneyaudio/src/sydney_audio_android.c b/media/libsydneyau
 new file mode 100644
 --- /dev/null
 +++ b/media/libsydneyaudio/src/sydney_audio_android.c
-@@ -0,0 +1,422 @@
+@@ -0,0 +1,530 @@
 +/* ***** BEGIN LICENSE BLOCK *****
 + * Version: MPL 1.1/GPL 2.0/LGPL 2.1
 + *
@@ -56,11 +56,25 @@ new file mode 100644
 + */
 +
 +#include <stdlib.h>
++#include <time.h>
 +#include <jni.h>
 +#include "sydney_audio.h"
 +
++#include "android/log.h"
++
++#ifndef ALOG
++#if defined(DEBUG) || defined(FORCE_ALOG)
++#define ALOG(args...)  __android_log_print(ANDROID_LOG_INFO, "Gecko - SYDNEY_AUDIO" , ## args)
++#else
++#define ALOG(args...)
++#endif
++#endif 
++
 +/* Android implementation based on sydney_audio_mac.c */
 +
++#define NANOSECONDS_IN_MILLISECOND 1000000
++#define MILLISECONDS_PER_SECOND    1000
++
 +/* android.media.AudioTrack */
 +struct AudioTrack {
 +  jclass    class;
@@ -106,6 +120,13 @@ new file mode 100644
 +
 +  unsigned int rate;
 +  unsigned int channels;
++  unsigned int isPaused;
++
++  int64_t lastStartTime;
++  int64_t timePlaying;
++  int64_t amountWritten;
++  unsigned int bufferSize;
++
 +  jclass at_class;
 +};
 +
@@ -128,7 +149,7 @@ new file mode 100644
 +  at.getpos      = (*jenv)->GetMethodID(jenv, class, "getPlaybackHeadPosition", "()I");
 +
 +  return class;
-+};
++}
 +
 +/*
 + * -----------------------------------------------------------------------------
@@ -175,6 +196,13 @@ new file mode 100644
 +  s->output_unit = NULL;
 +  s->rate        = rate;
 +  s->channels    = channels;
++  s->isPaused    = 0;
++
++  s->lastStartTime = 0;
++  s->timePlaying = 0;
++  s->amountWritten = 0;
++
++  s->bufferSize = rate * channels;
 +
 +  *_s = s;
 +  return SA_SUCCESS;
@@ -192,20 +220,25 @@ new file mode 100644
 +  }
 +
 +  JNIEnv *jenv = GetJNIForThread();
++  if (!jenv)
++    return SA_ERROR_NO_DEVICE;
++
 +  if ((*jenv)->PushLocalFrame(jenv, 4)) {
 +    return SA_ERROR_OOM;
 +  }
 +
 +  s->at_class = init_jni_bindings(jenv);
 +
++  int32_t chanConfig = s->channels == 1 ?
++    CHANNEL_OUT_MONO : CHANNEL_OUT_STEREO;
++
 +  jobject obj =
 +    (*jenv)->NewObject(jenv, s->at_class, at.constructor,
 +                       STREAM_MUSIC,
 +                       s->rate,
-+                       s->channels == 1 ?
-+                         CHANNEL_OUT_MONO : CHANNEL_OUT_STEREO,
++                       chanConfig,
 +                       ENCODING_PCM_16BIT,
-+                       (s->channels * s->rate) / 2,
++                       s->bufferSize,
 +                       MODE_STREAM);
 +
 +  if (!obj) {
@@ -217,6 +250,7 @@ new file mode 100644
 +  s->output_unit = (*jenv)->NewGlobalRef(jenv, obj);
 +  (*jenv)->PopLocalFrame(jenv, NULL);
 +
++  ALOG("%x - New stream %d %d", s,  s->rate, s->channels);
 +  return SA_SUCCESS;
 +}
 +
@@ -229,15 +263,18 @@ new file mode 100644
 +  }
 +
 +  JNIEnv *jenv = GetJNIForThread();
++  if (!jenv)
++    return SA_SUCCESS;
++
 +  (*jenv)->DeleteGlobalRef(jenv, s->output_unit);
 +  (*jenv)->DeleteGlobalRef(jenv, s->at_class);
 +  free(s);
 +
++  ALOG("%x - Stream destroyed", s);
 +  return SA_SUCCESS;
 +}
 +
 +
-+
 +/*
 + * -----------------------------------------------------------------------------
 + * Data read and write functions
@@ -272,9 +309,38 @@ new file mode 100644
 +  }
 +
 +  memcpy(byte, data, nbytes);
++
++  size_t wroteSoFar = 0;
++  jint retval;
++
++  do {
++    retval = (*jenv)->CallIntMethod(jenv,
++                                    s->output_unit,
++                                    at.write,
++                                    bytearray,
++                                    wroteSoFar,
++                                    nbytes - wroteSoFar);
++    if (retval < 0) {
++      ALOG("%x - Write failed %d", s, retval);
++      break;
++    }
++
++    wroteSoFar += retval;
++
++    if (wroteSoFar != nbytes) {
++
++      /* android doesn't start playing until we explictly call play. */
++      if (!s->isPaused)
++	sa_stream_resume(s);
++
++      struct timespec ts = {0, 100000000}; /* .10s */
++      nanosleep(&ts, NULL);
++    }
++  } while(wroteSoFar < nbytes);
++
++  s->amountWritten += nbytes;
++
 +  (*jenv)->ReleaseByteArrayElements(jenv, bytearray, byte, 0);
-+  jint retval = (*jenv)->CallIntMethod(jenv, s->output_unit, at.write,
-+                                       bytearray, 0, nbytes);
 +
 +  (*jenv)->PopLocalFrame(jenv, NULL);
 +
@@ -295,9 +361,13 @@ new file mode 100644
 +    return SA_ERROR_NO_INIT;
 +  }
 +
-+  // XXX AudioTrack doesn't block on writes but it might not write everything.
-+  //     Needs investigation.
-+  *size = (s->rate * s->channels) / 2;
++  /* No android API for this, so estimate based on how much we have played and
++   * how much we have written.
++   */
++  *size = s->bufferSize - ((s->timePlaying * s->channels * s->rate /
++			    MILLISECONDS_PER_SECOND) - s->amountWritten);
++  ALOG("%x - Write Size %d", s, *size);
++
 +  return SA_SUCCESS;
 +}
 +
@@ -309,9 +379,15 @@ new file mode 100644
 +    return SA_ERROR_NO_INIT;
 +  }
 +
++  ALOG("%x - get position", s);
++
 +  JNIEnv *jenv = GetJNIForThread();
 +  *pos  = (*jenv)->CallIntMethod(jenv, s->output_unit, at.getpos);
-+  *pos *= s->channels * 2;
++
++  /* android returns number of frames, so:
++     position = frames * (PCM_16_BIT == 2 bytes) * channels
++  */
++  *pos *= s->channels * sizeof(int16_t);
 +  return SA_SUCCESS;
 +}
 +
@@ -324,6 +400,18 @@ new file mode 100644
 +  }
 +
 +  JNIEnv *jenv = GetJNIForThread();
++  s->isPaused = 1;
++
++  /* Update stats */
++  if (s->lastStartTime != 0) {
++    /* if lastStartTime is not zero, so playback has started */
++    struct timespec current_time;
++    clock_gettime(CLOCK_REALTIME, &current_time);
++    int64_t ticker = current_time.tv_sec * 1000 + current_time.tv_nsec / 1000000;
++    s->timePlaying += ticker - s->lastStartTime;
++  }
++  ALOG("%x - Pause total time playing: %lld total written: %lld", s,  s->timePlaying, s->amountWritten);
++
 +  (*jenv)->CallVoidMethod(jenv, s->output_unit, at.pause);
 +  return SA_SUCCESS;
 +}
@@ -336,7 +424,17 @@ new file mode 100644
 +    return SA_ERROR_NO_INIT;
 +  }
 +
++  ALOG("%x - resume", s);
++
 +  JNIEnv *jenv = GetJNIForThread();
++  s->isPaused = 0;
++
++  /* Update stats */
++  struct timespec current_time;
++  clock_gettime(CLOCK_REALTIME, &current_time);
++  int64_t ticker = current_time.tv_sec * 1000 + current_time.tv_nsec / 1000000;
++  s->lastStartTime = ticker;
++
 +  (*jenv)->CallVoidMethod(jenv, s->output_unit, at.play);
 +  return SA_SUCCESS;
 +}
@@ -349,13 +447,23 @@ new file mode 100644
 +    return SA_ERROR_NO_INIT;
 +  }
 +
-+  JNIEnv *jenv = GetJNIForThread();
-+  (*jenv)->CallVoidMethod(jenv, s->output_unit, at.flush);
++  /* There is no way with the Android SDK to determine exactly how
++     long to playback.  So estimate and sleep for the long.
++  */
++
++  size_t available;
++  sa_stream_get_write_size(s, &available);
++
++  long x = (s->bufferSize - available) * 1000 / s->channels / s->rate / sizeof(int16_t) * NANOSECONDS_IN_MILLISECOND;
++  ALOG("%x - Drain - sleep for %f ns", s, x);
++
++  struct timespec ts = {0, x};
++  nanosleep(&ts, NULL);
++
 +  return SA_SUCCESS;
 +}
 +
 +
-+
 +/*
 + * -----------------------------------------------------------------------------
 + * Extension functions
diff --git a/modules/freetype2/ChangeLog b/modules/freetype2/ChangeLog
index a69b77958938..7a32679871cd 100644
--- a/modules/freetype2/ChangeLog
+++ b/modules/freetype2/ChangeLog
@@ -1,3 +1,17 @@
+2010-10-12  Werner Lemberg  <wl@gnu.org>
+
+	Fix Savannah bug #31310.
+
+	* src/truetype/ttgxvar.c (ft_var_readpackedpoints): Protect against
+	invalid `runcnt' values.
+
+2010-10-06  Werner Lemberg  <wl@gnu.org>
+
+	[truetype] Improve error handling of `SHZ' bytecode instruction.
+	Problem reported by Chris Evans <scarybeasts@gmail.com>.
+
+	* src/truetype/ttinterp.c (Ins_SHZ): Check `last_point'.
+
 2010-10-03  Werner Lemberg  <wl@gnu.org>
 
 	* Version 2.4.3 released.
diff --git a/modules/freetype2/src/truetype/ttgxvar.c b/modules/freetype2/src/truetype/ttgxvar.c
index 653d9d5cf35c..47bb9fcca441 100644
--- a/modules/freetype2/src/truetype/ttgxvar.c
+++ b/modules/freetype2/src/truetype/ttgxvar.c
@@ -130,7 +130,7 @@
     FT_Int     j;
     FT_Int     first;
     FT_Memory  memory = stream->memory;
-    FT_Error   error = TT_Err_Ok;
+    FT_Error   error  = TT_Err_Ok;
 
     FT_UNUSED( error );
 
@@ -154,7 +154,7 @@
         runcnt = runcnt & GX_PT_POINT_RUN_COUNT_MASK;
         first  = points[i++] = FT_GET_USHORT();
 
-        if ( runcnt < 1 )
+        if ( runcnt < 1 || i + runcnt >= n )
           goto Exit;
 
         /* first point not included in runcount */
@@ -165,7 +165,7 @@
       {
         first = points[i++] = FT_GET_BYTE();
 
-        if ( runcnt < 1 )
+        if ( runcnt < 1 || i + runcnt >= n )
           goto Exit;
 
         for ( j = 0; j < runcnt; ++j )
diff --git a/modules/freetype2/src/truetype/ttinterp.c b/modules/freetype2/src/truetype/ttinterp.c
index bf9189c395fe..e196dcea0897 100644
--- a/modules/freetype2/src/truetype/ttinterp.c
+++ b/modules/freetype2/src/truetype/ttinterp.c
@@ -5795,7 +5795,16 @@
     if ( CUR.GS.gep2 == 0 && CUR.zp2.n_points > 0 )
       last_point = (FT_UShort)( CUR.zp2.n_points - 1 );
     else if ( CUR.GS.gep2 == 1 && CUR.zp2.n_contours > 0 )
+    {
       last_point = (FT_UShort)( CUR.zp2.contours[CUR.zp2.n_contours - 1] );
+
+      if ( BOUNDS( last_point, CUR.zp2.n_points ) )
+      {
+        if ( CUR.pedantic_hinting )
+          CUR.error = TT_Err_Invalid_Reference;
+        return;
+      }
+    }
     else
       last_point = 0;
 
diff --git a/modules/libpr0n/src/Image.cpp b/modules/libpr0n/src/Image.cpp
index cc4a21d2a63f..f4f1b7761859 100644
--- a/modules/libpr0n/src/Image.cpp
+++ b/modules/libpr0n/src/Image.cpp
@@ -43,6 +43,7 @@ namespace imagelib {
 // Constructor
 Image::Image(imgStatusTracker* aStatusTracker) :
   mAnimationConsumers(0),
+  mAnimationMode(kNormalAnimMode),
   mInitialized(PR_FALSE),
   mAnimating(PR_FALSE),
   mError(PR_FALSE)
@@ -125,6 +126,40 @@ Image::DecrementAnimationConsumers()
   EvaluateAnimation();
 }
 
+//******************************************************************************
+/* attribute unsigned short animationMode; */
+NS_IMETHODIMP
+Image::GetAnimationMode(PRUint16* aAnimationMode)
+{
+  if (mError)
+    return NS_ERROR_FAILURE;
+
+  NS_ENSURE_ARG_POINTER(aAnimationMode);
+  
+  *aAnimationMode = mAnimationMode;
+  return NS_OK;
+}
+
+//******************************************************************************
+/* attribute unsigned short animationMode; */
+NS_IMETHODIMP
+Image::SetAnimationMode(PRUint16 aAnimationMode)
+{
+  if (mError)
+    return NS_ERROR_FAILURE;
+
+  NS_ASSERTION(aAnimationMode == kNormalAnimMode ||
+               aAnimationMode == kDontAnimMode ||
+               aAnimationMode == kLoopOnceAnimMode,
+               "Wrong Animation Mode is being set!");
+  
+  mAnimationMode = aAnimationMode;
+
+  EvaluateAnimation();
+
+  return NS_OK;
+}
+
 void
 Image::EvaluateAnimation()
 {
diff --git a/modules/libpr0n/src/Image.h b/modules/libpr0n/src/Image.h
index f1cc8c920772..67b6d8be61b8 100644
--- a/modules/libpr0n/src/Image.h
+++ b/modules/libpr0n/src/Image.h
@@ -48,6 +48,10 @@ namespace imagelib {
 class Image : public imgIContainer
 {
 public:
+  // From NS_DECL_IMGICONTAINER:
+  NS_SCRIPTABLE NS_IMETHOD GetAnimationMode(PRUint16 *aAnimationMode);
+  NS_SCRIPTABLE NS_IMETHOD SetAnimationMode(PRUint16 aAnimationMode);
+
   imgStatusTracker& GetStatusTracker() { return *mStatusTracker; }
 
   /**
@@ -134,15 +138,18 @@ protected:
   // Member data shared by all implementations of this abstract class
   nsAutoPtr<imgStatusTracker> mStatusTracker;
   PRUint32                    mAnimationConsumers;
-  PRPackedBool                mInitialized;   // Have we been initalized?
-  PRPackedBool                mAnimating;
-  PRPackedBool                mError;         // Error handling
+  PRUint16                    mAnimationMode;   // Enum values in imgIContainer
+  PRPackedBool                mInitialized:1;   // Have we been initalized?
+  PRPackedBool                mAnimating:1;     // Are we currently animating?
+  PRPackedBool                mError:1;         // Error handling
 
   /**
    * Extended by child classes, if they have additional
    * conditions for being able to animate
    */
-  virtual PRBool ShouldAnimate() { return mAnimationConsumers > 0; }
+  virtual PRBool ShouldAnimate() {
+    return mAnimationConsumers > 0 && mAnimationMode != kDontAnimMode;
+  }
 };
 
 } // namespace imagelib
diff --git a/modules/libpr0n/src/RasterImage.cpp b/modules/libpr0n/src/RasterImage.cpp
index 7b7b3f343e3c..5c269d993d93 100644
--- a/modules/libpr0n/src/RasterImage.cpp
+++ b/modules/libpr0n/src/RasterImage.cpp
@@ -179,7 +179,6 @@ RasterImage::RasterImage(imgStatusTracker* aStatusTracker) :
   Image(aStatusTracker), // invoke superclass's constructor
   mSize(0,0),
   mAnim(nsnull),
-  mAnimationMode(kNormalAnimMode),
   mLoopCount(-1),
   mObserver(nsnull),
   mLockCount(0),
@@ -1051,40 +1050,6 @@ RasterImage::DecodingComplete()
   return NS_OK;
 }
 
-//******************************************************************************
-/* attribute unsigned short animationMode; */
-NS_IMETHODIMP
-RasterImage::GetAnimationMode(PRUint16 *aAnimationMode)
-{
-  if (mError)
-    return NS_ERROR_FAILURE;
-
-  NS_ENSURE_ARG_POINTER(aAnimationMode);
-  
-  *aAnimationMode = mAnimationMode;
-  return NS_OK;
-}
-
-//******************************************************************************
-/* attribute unsigned short animationMode; */
-NS_IMETHODIMP
-RasterImage::SetAnimationMode(PRUint16 aAnimationMode)
-{
-  if (mError)
-    return NS_ERROR_FAILURE;
-
-  NS_ASSERTION(aAnimationMode == kNormalAnimMode ||
-               aAnimationMode == kDontAnimMode ||
-               aAnimationMode == kLoopOnceAnimMode,
-               "Wrong Animation Mode is being set!");
-  
-  mAnimationMode = aAnimationMode;
-
-  EvaluateAnimation();
-
-  return NS_OK;
-}
-
 //******************************************************************************
 /* void StartAnimation () */
 nsresult
@@ -2707,7 +2672,7 @@ PRBool
 RasterImage::ShouldAnimate()
 {
   return Image::ShouldAnimate() && mFrames.Length() >= 2 &&
-         mAnimationMode != kDontAnimMode && !mAnimationFinished;
+         !mAnimationFinished;
 }
 
 //******************************************************************************
diff --git a/modules/libpr0n/src/RasterImage.h b/modules/libpr0n/src/RasterImage.h
index 04a47ae47667..2b477f46abc7 100644
--- a/modules/libpr0n/src/RasterImage.h
+++ b/modules/libpr0n/src/RasterImage.h
@@ -158,13 +158,30 @@ class RasterImage : public mozilla::imagelib::Image
 {
 public:
   NS_DECL_ISUPPORTS
-  NS_DECL_IMGICONTAINER
   NS_DECL_NSITIMERCALLBACK
   NS_DECL_NSIPROPERTIES
 #ifdef DEBUG
   NS_DECL_IMGICONTAINERDEBUG
 #endif
 
+  // BEGIN NS_DECL_IMGICONTAINER (minus GetAnimationMode/SetAnimationMode)
+  // ** Don't edit this chunk except to mirror changes in imgIContainer.idl **
+  NS_SCRIPTABLE NS_IMETHOD GetWidth(PRInt32 *aWidth);
+  NS_SCRIPTABLE NS_IMETHOD GetHeight(PRInt32 *aHeight);
+  NS_SCRIPTABLE NS_IMETHOD GetType(PRUint16 *aType);
+  NS_SCRIPTABLE NS_IMETHOD GetAnimated(PRBool *aAnimated);
+  NS_SCRIPTABLE NS_IMETHOD GetCurrentFrameIsOpaque(PRBool *aCurrentFrameIsOpaque);
+  NS_IMETHOD GetFrame(PRUint32 aWhichFrame, PRUint32 aFlags, gfxASurface **_retval NS_OUTPARAM);
+  NS_IMETHOD CopyFrame(PRUint32 aWhichFrame, PRUint32 aFlags, gfxImageSurface **_retval NS_OUTPARAM);
+  NS_IMETHOD ExtractFrame(PRUint32 aWhichFrame, const nsIntRect & aRect, PRUint32 aFlags, imgIContainer **_retval NS_OUTPARAM);
+  NS_IMETHOD Draw(gfxContext *aContext, gfxPattern::GraphicsFilter aFilter, const gfxMatrix & aUserSpaceToImageSpace, const gfxRect & aFill, const nsIntRect & aSubimage, const nsIntSize & aViewportSize, PRUint32 aFlags);
+  NS_IMETHOD_(nsIFrame *) GetRootLayoutFrame(void);
+  NS_SCRIPTABLE NS_IMETHOD RequestDecode(void);
+  NS_SCRIPTABLE NS_IMETHOD LockImage(void);
+  NS_SCRIPTABLE NS_IMETHOD UnlockImage(void);
+  NS_SCRIPTABLE NS_IMETHOD ResetAnimation(void);
+  // END NS_DECL_IMGICONTAINER
+
   RasterImage(imgStatusTracker* aStatusTracker = nsnull);
   virtual ~RasterImage();
 
@@ -449,9 +466,6 @@ private: // data
   // we maybe decoding on draw).
   RasterImage::Anim*        mAnim;
   
-  //! See imgIContainer for mode constants
-  PRUint16                   mAnimationMode;
-  
   //! # loops remaining before animation stops (-1 no stop)
   PRInt32                    mLoopCount;
   
diff --git a/modules/libpr0n/src/SVGDocumentWrapper.cpp b/modules/libpr0n/src/SVGDocumentWrapper.cpp
index ef34cd2e415a..801cd8173c3e 100644
--- a/modules/libpr0n/src/SVGDocumentWrapper.cpp
+++ b/modules/libpr0n/src/SVGDocumentWrapper.cpp
@@ -60,6 +60,7 @@
 #include "gfxRect.h"
 #include "nsSVGSVGElement.h"
 #include "nsSVGLength2.h"
+#include "nsSVGEffects.h"
 
 using namespace mozilla::dom;
 
@@ -251,6 +252,8 @@ SVGDocumentWrapper::OnStartRequest(nsIRequest* aRequest, nsISupports* ctxt)
   if (NS_SUCCEEDED(rv) &&
       NS_SUCCEEDED(mListener->OnStartRequest(aRequest, nsnull))) {
     mViewer->GetDocument()->SetIsBeingUsedAsImage();
+    StopAnimation(); // otherwise animations start automatically in helper doc
+
     rv = mViewer->Init(nsnull, nsIntRect(0, 0, 0, 0));
     if (NS_SUCCEEDED(rv)) {
       rv = mViewer->Open(nsnull, nsnull);
@@ -296,6 +299,19 @@ SVGDocumentWrapper::Observe(nsISupports* aSubject,
                             const PRUnichar *aData)
 {
   if (!strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID)) {
+    // Sever ties from rendering observers to helper-doc's root SVG node
+    nsSVGSVGElement* svgElem = GetRootSVGElem();
+    if (svgElem) {
+#ifdef MOZ_ENABLE_LIBXUL
+      nsSVGEffects::RemoveAllRenderingObservers(svgElem);
+#else
+      // XXXdholbert Can't call static nsSVGEffects functions from imagelib in
+      // non-libxul builds -- so, this is a hack using a virtual function to
+      // have the SVG element call the method on our behalf.
+      svgElem->RemoveAllRenderingObservers();
+#endif // MOZ_ENABLE_LIBXUL
+    }
+
     // Clean up at XPCOM shutdown time.
     DestroyViewer();
     if (mListener)
diff --git a/modules/libpr0n/src/VectorImage.cpp b/modules/libpr0n/src/VectorImage.cpp
index 245f2c442a15..62758f8e9ce0 100644
--- a/modules/libpr0n/src/VectorImage.cpp
+++ b/modules/libpr0n/src/VectorImage.cpp
@@ -210,9 +210,9 @@ VectorImage::VectorImage(imgStatusTracker* aStatusTracker) :
   Image(aStatusTracker), // invoke superclass's constructor
   mRestrictedRegion(0, 0, 0, 0),
   mLastRenderedSize(0, 0),
-  mAnimationMode(kNormalAnimMode),
   mIsInitialized(PR_FALSE),
   mIsFullyLoaded(PR_FALSE),
+  mIsDrawing(PR_FALSE),
   mHaveAnimations(PR_FALSE),
   mHaveRestrictedRegion(PR_FALSE)
 {
@@ -275,14 +275,9 @@ VectorImage::StartAnimation()
   if (mError)
     return NS_ERROR_FAILURE;
 
-  if (mAnimationMode == kDontAnimMode ||
-      !mIsFullyLoaded || !mHaveAnimations) {
-    // Animation disabled, or helper-document not finished or lacks animations.
-    return NS_OK;
-  }
+  NS_ABORT_IF_FALSE(ShouldAnimate(), "Should not animate!");
 
   mSVGDocumentWrapper->StartAnimation();
-
   return NS_OK;
 }
 
@@ -292,15 +287,19 @@ VectorImage::StopAnimation()
   if (mError)
     return NS_ERROR_FAILURE;
 
-  if (!mIsFullyLoaded || !mHaveAnimations) {
-    return NS_OK;
-  }
+  NS_ABORT_IF_FALSE(mIsFullyLoaded && mHaveAnimations,
+                    "Should not have been animating!");
 
   mSVGDocumentWrapper->StopAnimation();
-
   return NS_OK;
 }
 
+PRBool
+VectorImage::ShouldAnimate()
+{
+  return Image::ShouldAnimate() && mIsFullyLoaded && mHaveAnimations;
+}
+
 //------------------------------------------------------------------------------
 // imgIContainer methods
 
@@ -516,10 +515,15 @@ VectorImage::Draw(gfxContext* aContext,
                   const nsIntSize& aViewportSize,
                   PRUint32 aFlags)
 {
+  NS_ENSURE_ARG_POINTER(aContext);
   if (mError || !mIsFullyLoaded)
     return NS_ERROR_FAILURE;
 
-  NS_ENSURE_ARG_POINTER(aContext);
+  if (mIsDrawing) {
+    NS_WARNING("Refusing to make re-entrant call to VectorImage::Draw");
+    return NS_ERROR_FAILURE;
+  }
+  mIsDrawing = PR_TRUE;
 
   if (aViewportSize != mLastRenderedSize) {
     mSVGDocumentWrapper->UpdateViewportBounds(aViewportSize);
@@ -554,6 +558,7 @@ VectorImage::Draw(gfxContext* aContext,
                              subimage, sourceRect, imageRect, aFill,
                              gfxASurface::ImageFormatARGB32, aFilter);
 
+  mIsDrawing = PR_FALSE;
   return NS_OK;
 }
 
@@ -592,46 +597,6 @@ VectorImage::UnlockImage()
   return NS_OK;
 }
 
-//******************************************************************************
-/* attribute unsigned short animationMode; */
-NS_IMETHODIMP
-VectorImage::GetAnimationMode(PRUint16* aAnimationMode)
-{
-  if (mError)
-    return NS_ERROR_FAILURE;
-
-  NS_ENSURE_ARG_POINTER(aAnimationMode);
-  
-  *aAnimationMode = mAnimationMode;
-  return NS_OK;
-}
-
-//******************************************************************************
-/* attribute unsigned short animationMode; */
-NS_IMETHODIMP
-VectorImage::SetAnimationMode(PRUint16 aAnimationMode)
-{
-  // NOTE: This is just a simpler form of RasterImage::SetAnimationMode.
-  // (Simpler because SVG animations don't have a concept of "loop once" mode)
-  if (mError)
-    return NS_ERROR_FAILURE;
-
-  NS_ASSERTION(aAnimationMode == kNormalAnimMode ||
-               aAnimationMode == kDontAnimMode ||
-               aAnimationMode == kLoopOnceAnimMode,
-               "An unrecognized Animation Mode is being set!");
-
-  mAnimationMode = aAnimationMode;
-
-  if (mAnimationMode == kDontAnimMode) {
-    StopAnimation();
-  } else { // kNormalAnimMode or kLoopOnceAnimMode (treated the same here)
-    StartAnimation();
-  }
-
-  return NS_OK;
-}
-
 //******************************************************************************
 /* void resetAnimation (); */
 NS_IMETHODIMP
@@ -696,12 +661,6 @@ VectorImage::OnStopRequest(nsIRequest* aRequest, nsISupports* aCtxt,
   mIsFullyLoaded = PR_TRUE;
   mHaveAnimations = mSVGDocumentWrapper->IsAnimated();
 
-  if (mHaveAnimations && mAnimationMode == kDontAnimMode) {
-    // We're not supposed to be animating -- stop any animation before our
-    // SVG document's timeline gets a chance to progress.
-    mSVGDocumentWrapper->StopAnimation();
-  }
-
 #ifdef MOZ_ENABLE_LIBXUL
   // Start listening to our image for rendering updates
   mRenderingObserver = new SVGRootRenderingObserver(mSVGDocumentWrapper, this);
diff --git a/modules/libpr0n/src/VectorImage.h b/modules/libpr0n/src/VectorImage.h
index bfe155d9ba58..0a36098c49c8 100644
--- a/modules/libpr0n/src/VectorImage.h
+++ b/modules/libpr0n/src/VectorImage.h
@@ -56,10 +56,27 @@ class VectorImage : public Image,
 {
 public:
   NS_DECL_ISUPPORTS
-  NS_DECL_IMGICONTAINER
   NS_DECL_NSIREQUESTOBSERVER
   NS_DECL_NSISTREAMLISTENER
 
+  // BEGIN NS_DECL_IMGICONTAINER (minus GetAnimationMode/SetAnimationMode)
+  // ** Don't edit this chunk except to mirror changes in imgIContainer.idl **
+  NS_SCRIPTABLE NS_IMETHOD GetWidth(PRInt32 *aWidth);
+  NS_SCRIPTABLE NS_IMETHOD GetHeight(PRInt32 *aHeight);
+  NS_SCRIPTABLE NS_IMETHOD GetType(PRUint16 *aType);
+  NS_SCRIPTABLE NS_IMETHOD GetAnimated(PRBool *aAnimated);
+  NS_SCRIPTABLE NS_IMETHOD GetCurrentFrameIsOpaque(PRBool *aCurrentFrameIsOpaque);
+  NS_IMETHOD GetFrame(PRUint32 aWhichFrame, PRUint32 aFlags, gfxASurface **_retval NS_OUTPARAM);
+  NS_IMETHOD CopyFrame(PRUint32 aWhichFrame, PRUint32 aFlags, gfxImageSurface **_retval NS_OUTPARAM);
+  NS_IMETHOD ExtractFrame(PRUint32 aWhichFrame, const nsIntRect & aRect, PRUint32 aFlags, imgIContainer **_retval NS_OUTPARAM);
+  NS_IMETHOD Draw(gfxContext *aContext, gfxPattern::GraphicsFilter aFilter, const gfxMatrix & aUserSpaceToImageSpace, const gfxRect & aFill, const nsIntRect & aSubimage, const nsIntSize & aViewportSize, PRUint32 aFlags);
+  NS_IMETHOD_(nsIFrame *) GetRootLayoutFrame(void);
+  NS_SCRIPTABLE NS_IMETHOD RequestDecode(void);
+  NS_SCRIPTABLE NS_IMETHOD LockImage(void);
+  NS_SCRIPTABLE NS_IMETHOD UnlockImage(void);
+  NS_SCRIPTABLE NS_IMETHOD ResetAnimation(void);
+  // END NS_DECL_IMGICONTAINER
+
   VectorImage(imgStatusTracker* aStatusTracker = nsnull);
   virtual ~VectorImage();
 
@@ -81,6 +98,7 @@ public:
 protected:
   virtual nsresult StartAnimation();
   virtual nsresult StopAnimation();
+  virtual PRBool   ShouldAnimate();
 
 private:
   nsWeakPtr                          mObserver;   //! imgIDecoderObserver
@@ -99,10 +117,9 @@ private:
                                           // mSVGDocumentWrapper as its
                                           // viewport-bounds.
 
-  PRUint16       mAnimationMode;          // Are we allowed to animate?
-
   PRPackedBool   mIsInitialized:1;        // Have we been initalized?
   PRPackedBool   mIsFullyLoaded:1;        // Has OnStopRequest been called?
+  PRPackedBool   mIsDrawing:1;            // Are we currently drawing?
   PRPackedBool   mHaveAnimations:1;       // Is our SVG content SMIL-animated?
                                           // (Only set after mIsFullyLoaded.)
   PRPackedBool   mHaveRestrictedRegion:1; // Are we a restricted-region clone
diff --git a/modules/plugin/base/src/nsNPAPIPlugin.cpp b/modules/plugin/base/src/nsNPAPIPlugin.cpp
index b2990a2677ff..57b97a879970 100644
--- a/modules/plugin/base/src/nsNPAPIPlugin.cpp
+++ b/modules/plugin/base/src/nsNPAPIPlugin.cpp
@@ -106,6 +106,8 @@
 #include "nsIHttpAuthManager.h"
 #include "nsICookieService.h"
 
+#include "nsNetUtil.h"
+
 #include "mozilla/PluginLibrary.h"
 using mozilla::PluginLibrary;
 
@@ -1706,7 +1708,92 @@ _getproperty(NPP npp, NPObject* npobj, NPIdentifier property,
                  ("NPN_GetProperty(npp %p, npobj %p, property %p) called\n",
                   npp, npobj, property));
 
-  return npobj->_class->getProperty(npobj, property, result);
+  if (!npobj->_class->getProperty(npobj, property, result))
+    return false;
+
+  // If a Java plugin tries to get the document.URL or document.documentURI
+  // property from us, don't pass back a value that Java won't be able to
+  // understand -- one that will make the URL(String) constructor throw a
+  // MalformedURL exception.  Passing such a value causes Java Plugin2 to
+  // crash (to throw a RuntimeException in Plugin2Manager.getDocumentBase()).
+  // Also don't pass back a value that Java is likely to mishandle.
+
+  nsNPAPIPluginInstance* inst = (nsNPAPIPluginInstance*) npp->ndata;
+  if (!inst)
+    return false;
+  nsNPAPIPlugin* plugin = inst->GetPlugin();
+  if (!plugin)
+    return false;
+  nsRefPtr<nsPluginHost> host = dont_AddRef(nsPluginHost::GetInst());
+  nsPluginTag* pluginTag = host->TagForPlugin(plugin);
+  if (!pluginTag->mIsJavaPlugin)
+    return true;
+
+  if (!NPVARIANT_IS_STRING(*result))
+    return true;
+
+  NPUTF8* propertyName = _utf8fromidentifier(property);
+  if (!propertyName)
+    return true;
+  bool notURL =
+    (PL_strcasecmp(propertyName, "URL") &&
+     PL_strcasecmp(propertyName, "documentURI"));
+  _memfree(propertyName);
+  if (notURL)
+    return true;
+
+  NPObject* window_obj = _getwindowobject(npp);
+  if (!window_obj)
+    return true;
+
+  NPVariant doc_v;
+  NPObject* document_obj = nsnull;
+  NPIdentifier doc_id = _getstringidentifier("document");
+  bool ok = npobj->_class->getProperty(window_obj, doc_id, &doc_v);
+  _releaseobject(window_obj);
+  if (ok) {
+    if (NPVARIANT_IS_OBJECT(doc_v)) {
+      document_obj = NPVARIANT_TO_OBJECT(doc_v);
+    } else {
+      _releasevariantvalue(&doc_v);
+      return true;
+    }
+  } else {
+    return true;
+  }
+  _releaseobject(document_obj);
+  if (document_obj != npobj)
+    return true;
+
+  NPString urlnp = NPVARIANT_TO_STRING(*result);
+  nsXPIDLCString url;
+  url.Assign(urlnp.UTF8Characters, urlnp.UTF8Length);
+
+  PRBool javaCompatible = PR_FALSE;
+  if (NS_FAILED(NS_CheckIsJavaCompatibleURLString(url, &javaCompatible)))
+    javaCompatible = PR_FALSE;
+  if (javaCompatible)
+    return true;
+
+  // If Java won't be able to interpret the original value of document.URL or
+  // document.documentURI, or is likely to mishandle it, pass back something
+  // that Java will understand but won't be able to use to access the network,
+  // and for which same-origin checks will always fail.
+
+  if (inst->mFakeURL.IsVoid()) {
+    // Abort (do an error return) if NS_MakeRandomInvalidURLString() fails.
+    if (NS_FAILED(NS_MakeRandomInvalidURLString(inst->mFakeURL))) {
+      _releasevariantvalue(result);
+      return false;
+    }
+  }
+
+  _releasevariantvalue(result);
+  char* fakeurl = (char *) _memalloc(inst->mFakeURL.Length() + 1);
+  strcpy(fakeurl, inst->mFakeURL);
+  STRINGZ_TO_NPVARIANT(fakeurl, *result);
+
+  return true;
 }
 
 bool NP_CALLBACK
diff --git a/modules/plugin/base/src/nsNPAPIPluginInstance.h b/modules/plugin/base/src/nsNPAPIPluginInstance.h
index c00af5f7a53f..a0b47a148898 100644
--- a/modules/plugin/base/src/nsNPAPIPluginInstance.h
+++ b/modules/plugin/base/src/nsNPAPIPluginInstance.h
@@ -177,6 +177,8 @@ public:
   // True while creating the plugin, or calling NPP_SetWindow() on it.
   PRPackedBool mInPluginInitCall;
 
+  nsXPIDLCString mFakeURL;
+
 private:
   nsNPAPIPlugin* mPlugin;
 
diff --git a/modules/plugin/base/src/nsPluginHost.cpp b/modules/plugin/base/src/nsPluginHost.cpp
index c8e7f5ea07d1..69255a600efb 100644
--- a/modules/plugin/base/src/nsPluginHost.cpp
+++ b/modules/plugin/base/src/nsPluginHost.cpp
@@ -2891,24 +2891,12 @@ nsresult nsPluginHost::NewPluginURLStream(const nsString& aURL,
   if (NS_FAILED(rv))
     return rv;
 
-  nsCOMPtr<nsIInterfaceRequestor> callbacks;
-  if (doc) {
-    // Get the script global object owner and use that as the
-    // notification callback.
-    nsIScriptGlobalObject* global = doc->GetScriptGlobalObject();
-    if (global) {
-      nsCOMPtr<nsIWebNavigation> webNav = do_GetInterface(global);
-      callbacks = do_QueryInterface(webNav);
-    }
-  }
-
   nsCOMPtr<nsIChannel> channel;
-
   rv = NS_NewChannel(getter_AddRefs(channel), url, nsnull,
     nsnull, /* do not add this internal plugin's channel
             on the load group otherwise this channel could be canceled
             form |nsDocShell::OnLinkClickSync| bug 166613 */
-    callbacks);
+    listenerPeer);
   if (NS_FAILED(rv))
     return rv;
 
diff --git a/modules/plugin/base/src/nsPluginHost.h b/modules/plugin/base/src/nsPluginHost.h
index e086b62bb46e..532a4f9099c9 100644
--- a/modules/plugin/base/src/nsPluginHost.h
+++ b/modules/plugin/base/src/nsPluginHost.h
@@ -181,6 +181,9 @@ public:
                                        nsIPluginInstanceOwner* aOwner,
                                        PRBool aAllowOpeningStreams);
 
+  // Does not accept NULL and should never fail.
+  nsPluginTag* TagForPlugin(nsNPAPIPlugin* aPlugin);
+
 private:
   nsresult
   TrySetUpPluginInstance(const char *aMimeType, nsIURI *aURL, nsIPluginInstanceOwner *aOwner);
@@ -206,9 +209,6 @@ private:
   nsPluginTag*
   FindPluginEnabledForExtension(const char* aExtension, const char* &aMimeType);
 
-  // Does not accept NULL and should never fail.
-  nsPluginTag* TagForPlugin(nsNPAPIPlugin* aPlugin);
-
   nsresult
   FindStoppedPluginForURL(nsIURI* aURL, nsIPluginInstanceOwner *aOwner);
 
diff --git a/modules/plugin/base/src/nsPluginStreamListenerPeer.cpp b/modules/plugin/base/src/nsPluginStreamListenerPeer.cpp
index a38338c36b55..361cf66b3a4d 100644
--- a/modules/plugin/base/src/nsPluginStreamListenerPeer.cpp
+++ b/modules/plugin/base/src/nsPluginStreamListenerPeer.cpp
@@ -53,6 +53,10 @@
 #include "nsIByteRangeRequest.h"
 #include "nsIInputStreamTee.h"
 #include "nsPrintfCString.h"
+#include "nsIContentUtils.h"
+#include "nsIScriptGlobalObject.h"
+#include "nsIDocument.h"
+#include "nsIWebNavigation.h"
 
 #define MAGIC_REQUEST_CONTEXT 0x01020304
 
@@ -241,13 +245,15 @@ public:
 
 // nsPluginStreamListenerPeer
 
-NS_IMPL_ISUPPORTS6(nsPluginStreamListenerPeer,
+NS_IMPL_ISUPPORTS8(nsPluginStreamListenerPeer,
                    nsIStreamListener,
                    nsIRequestObserver,
                    nsIHttpHeaderVisitor,
                    nsISupportsWeakReference,
                    nsIPluginStreamInfo,
-                   nsINPAPIPluginStreamInfo)
+                   nsINPAPIPluginStreamInfo,
+                   nsIInterfaceRequestor,
+                   nsIChannelEventSink)
 
 nsPluginStreamListenerPeer::nsPluginStreamListenerPeer()
 {
@@ -1241,3 +1247,81 @@ nsPluginStreamListenerPeer::VisitHeader(const nsACString &header, const nsACStri
   return listener->NewResponseHeader(PromiseFlatCString(header).get(),
                                      PromiseFlatCString(value).get());
 }
+
+nsresult
+nsPluginStreamListenerPeer::GetInterfaceGlobal(const nsIID& aIID, void** result)
+{
+  if (!mPluginInstance) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsCOMPtr<nsIPluginInstanceOwner> owner;
+  mPluginInstance->GetOwner(getter_AddRefs(owner));
+  if (owner) {
+    nsCOMPtr<nsIDocument> doc;
+    nsresult rv = owner->GetDocument(getter_AddRefs(doc));
+    if (NS_SUCCEEDED(rv) && doc) {
+      nsPIDOMWindow *window = doc->GetWindow();
+      if (window) {
+        nsCOMPtr<nsIWebNavigation> webNav = do_GetInterface(window);
+        nsCOMPtr<nsIInterfaceRequestor> ir = do_QueryInterface(webNav);
+        return ir->GetInterface(aIID, result);
+      }
+    }
+  }
+
+  return NS_ERROR_FAILURE;
+}
+
+NS_IMETHODIMP
+nsPluginStreamListenerPeer::GetInterface(const nsIID& aIID, void** result)
+{
+  // Provide nsIChannelEventSink ourselves, otherwise let our document's
+  // script global object owner provide the interface.
+  if (aIID.Equals(NS_GET_IID(nsIChannelEventSink))) {
+    return QueryInterface(aIID, result);
+  }
+
+  return GetInterfaceGlobal(aIID, result);
+}
+
+NS_IMETHODIMP
+nsPluginStreamListenerPeer::AsyncOnChannelRedirect(nsIChannel *oldChannel, nsIChannel *newChannel,
+                                                   PRUint32 flags, nsIAsyncVerifyRedirectCallback* callback)
+{
+  // Don't allow cross-origin 307 POST redirects. Fall back to channel event sink for window.
+
+  nsCOMPtr<nsIHttpChannel> oldHttpChannel(do_QueryInterface(oldChannel));
+  if (oldHttpChannel) {
+    PRUint32 responseStatus;
+    nsresult rv = oldHttpChannel->GetResponseStatus(&responseStatus);
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+    if (responseStatus == 307) {
+      nsCAutoString method;
+      rv = oldHttpChannel->GetRequestMethod(method);
+      if (NS_FAILED(rv)) {
+        return rv;
+      }
+      if (method.EqualsLiteral("POST")) {
+        nsCOMPtr<nsIContentUtils2> contentUtils2 = do_GetService("@mozilla.org/content/contentutils2;1");
+        NS_ENSURE_TRUE(contentUtils2, NS_ERROR_FAILURE);
+
+        nsCOMPtr<nsIInterfaceRequestor> sameOriginChecker = contentUtils2->GetSameOriginChecker();
+        nsCOMPtr<nsIChannelEventSink> sameOriginChannelEventSink = do_GetInterface(sameOriginChecker);
+        NS_ENSURE_TRUE(sameOriginChannelEventSink, NS_ERROR_FAILURE);
+        
+        return sameOriginChannelEventSink->AsyncOnChannelRedirect(oldChannel, newChannel, flags, callback);        
+      }
+    }
+  }
+
+  nsCOMPtr<nsIChannelEventSink> channelEventSink;
+  nsresult rv = GetInterfaceGlobal(NS_GET_IID(nsIChannelEventSink), getter_AddRefs(channelEventSink));
+  if (NS_FAILED(rv)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  return channelEventSink->AsyncOnChannelRedirect(oldChannel, newChannel, flags, callback);
+}
diff --git a/modules/plugin/base/src/nsPluginStreamListenerPeer.h b/modules/plugin/base/src/nsPluginStreamListenerPeer.h
index ebd01934c48f..e54869bc795a 100644
--- a/modules/plugin/base/src/nsPluginStreamListenerPeer.h
+++ b/modules/plugin/base/src/nsPluginStreamListenerPeer.h
@@ -47,6 +47,8 @@
 #include "nsNPAPIPluginStreamListener.h"
 #include "nsHashtable.h"
 #include "nsNPAPIPluginInstance.h"
+#include "nsIInterfaceRequestor.h"
+#include "nsIChannelEventSink.h"
 
 class nsIChannel;
 
@@ -76,7 +78,9 @@ class nsPluginStreamListenerPeer : public nsIStreamListener,
 public nsIProgressEventSink,
 public nsIHttpHeaderVisitor,
 public nsSupportsWeakReference,
-public nsINPAPIPluginStreamInfo
+public nsINPAPIPluginStreamInfo,
+public nsIInterfaceRequestor,
+public nsIChannelEventSink
 {
 public:
   nsPluginStreamListenerPeer();
@@ -87,7 +91,9 @@ public:
   NS_DECL_NSIREQUESTOBSERVER
   NS_DECL_NSISTREAMLISTENER
   NS_DECL_NSIHTTPHEADERVISITOR
-  
+  NS_DECL_NSIINTERFACEREQUESTOR
+  NS_DECL_NSICHANNELEVENTSINK
+
   // nsINPAPIPluginStreamInfo interface
   NS_DECL_NSIPLUGINSTREAMINFO
   
@@ -118,7 +124,8 @@ public:
 private:
   nsresult SetUpStreamListener(nsIRequest* request, nsIURI* aURL);
   nsresult SetupPluginCacheFile(nsIChannel* channel);
-  
+  nsresult GetInterfaceGlobal(const nsIID& aIID, void** result);
+
   nsCOMPtr<nsIURI> mURL;
   nsCString mURLSpec; // Have to keep this member because GetURL hands out char*
   nsCOMPtr<nsIPluginInstanceOwner> mOwner;
diff --git a/modules/plugin/test/testplugin/nptest.cpp b/modules/plugin/test/testplugin/nptest.cpp
index 213ba523ffdc..5da451a36b5f 100644
--- a/modules/plugin/test/testplugin/nptest.cpp
+++ b/modules/plugin/test/testplugin/nptest.cpp
@@ -36,6 +36,8 @@
 #include "nptest_utils.h"
 #include "nptest_platform.h"
 
+#include "mozilla/IntentionalCrash.h"
+
 #include <stdlib.h>
 #include <string.h>
 #include <stdio.h>
@@ -53,7 +55,7 @@
 #include <pthread.h>
 #endif
 
- using namespace std;
+using namespace std;
 
 #define PLUGIN_NAME        "Test Plug-in"
 #define PLUGIN_DESCRIPTION "Plug-in for testing purposes."
@@ -73,26 +75,6 @@ static char sPluginVersion[] = PLUGIN_VERSION;
 
 int gCrashCount = 0;
 
-void
-NoteIntentionalCrash()
-{
-  char* bloatLog = getenv("XPCOM_MEM_BLOAT_LOG");
-  if (bloatLog) {
-    char* logExt = strstr(bloatLog, ".log");
-    if (logExt) {
-      bloatLog[strlen(bloatLog) - strlen(logExt)] = '\0';
-    }
-    ostringstream bloatName;
-    bloatName << bloatLog << "_plugin_pid" << getpid();
-    if (logExt) {
-      bloatName << ".log";
-    }
-    FILE* processfd = fopen(bloatName.str().c_str(), "a");
-    fprintf(processfd, "==> process %d will purposefully crash\n", getpid());
-    fclose(processfd);
-  }
-}
-
 static void Crash()
 {
   int *pi = NULL;
@@ -103,7 +85,7 @@ static void Crash()
 static void
 IntentionalCrash()
 {
-  NoteIntentionalCrash();
+  mozilla::NoteIntentionalCrash("plugin");
   Crash();
 }
 
@@ -2843,7 +2825,7 @@ bool
 hangPlugin(NPObject* npobj, const NPVariant* args, uint32_t argCount,
            NPVariant* result)
 {
-  NoteIntentionalCrash();
+  mozilla::NoteIntentionalCrash("plugin");
 
 #ifdef XP_WIN
   Sleep(100000000);
diff --git a/modules/plugin/test/testplugin/nptest.h b/modules/plugin/test/testplugin/nptest.h
index eb7c21a8a1b1..4babae1cf535 100644
--- a/modules/plugin/test/testplugin/nptest.h
+++ b/modules/plugin/test/testplugin/nptest.h
@@ -141,6 +141,4 @@ typedef struct InstanceData {
 
 void notifyDidPaint(InstanceData* instanceData);
 
-void NoteIntentionalCrash();
-
 #endif // nptest_h_
diff --git a/modules/plugin/test/testplugin/nptest_gtk2.cpp b/modules/plugin/test/testplugin/nptest_gtk2.cpp
index 9e1da20ee6dc..b5adb5a20f7f 100644
--- a/modules/plugin/test/testplugin/nptest_gtk2.cpp
+++ b/modules/plugin/test/testplugin/nptest_gtk2.cpp
@@ -45,6 +45,8 @@
 #include <gtk/gtk.h>
 #include <unistd.h>
 
+#include "mozilla/IntentionalCrash.h"
+
  using namespace std;
 
 struct _PlatformData {
@@ -699,7 +701,7 @@ pluginCrashInNestedLoop(InstanceData* instanceData)
 
   // we'll be crashing soon, note that fact now to avoid messing with
   // timing too much
-  NoteIntentionalCrash();
+  mozilla::NoteIntentionalCrash("plugin");
 
   // schedule the crasher thread ...
   pthread_t crasherThread;
@@ -728,7 +730,7 @@ pluginCrashInNestedLoop(InstanceData* instanceData)
 static int
 SleepThenDie(Display* display)
 {
-  NoteIntentionalCrash();
+  mozilla::NoteIntentionalCrash("plugin");
   fprintf(stderr, "[testplugin:%d] SleepThenDie: sleeping\n", getpid());
   sleep(1);
 
diff --git a/netwerk/base/public/nsNetUtil.h b/netwerk/base/public/nsNetUtil.h
index 6eaaf9cab687..2ed15a2f6da8 100644
--- a/netwerk/base/public/nsNetUtil.h
+++ b/netwerk/base/public/nsNetUtil.h
@@ -52,6 +52,8 @@
 #include "nsCRT.h"
 #include "nsIURI.h"
 #include "nsIStandardURL.h"
+#include "nsIURLParser.h"
+#include "nsIUUIDGenerator.h"
 #include "nsIInputStream.h"
 #include "nsIOutputStream.h"
 #include "nsISafeOutputStream.h"
@@ -1776,4 +1778,81 @@ NS_IsInternalSameURIRedirect(nsIChannel *aOldChannel,
   return NS_SUCCEEDED(oldURI->Equals(newURI, &res)) && res;
 }
 
+/**
+ * Helper function to create a random URL string that's properly formed
+ * but guaranteed to be invalid.
+ */  
+#define NS_FAKE_SCHEME "http://"
+#define NS_FAKE_TLD ".invalid"
+inline nsresult
+NS_MakeRandomInvalidURLString(nsCString& result)
+{
+  nsresult rv;
+  nsCOMPtr<nsIUUIDGenerator> uuidgen =
+    do_GetService("@mozilla.org/uuid-generator;1", &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsID idee;
+  rv = uuidgen->GenerateUUIDInPlace(&idee);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  char chars[NSID_LENGTH];
+  idee.ToProvidedString(chars);
+
+  result.AssignLiteral(NS_FAKE_SCHEME);
+  // Strip off the '{' and '}' at the beginning and end of the UUID
+  result.Append(chars + 1, NSID_LENGTH - 3);
+  result.AppendLiteral(NS_FAKE_TLD);
+
+  return NS_OK;
+}
+#undef NS_FAKE_SCHEME
+#undef NS_FAKE_TLD
+
+/**
+ * Helper function to determine whether urlString is Java-compatible --
+ * whether it can be passed to the Java URL(String) constructor without the
+ * latter throwing a MalformedURLException, or without Java otherwise
+ * mishandling it.
+ */  
+inline nsresult
+NS_CheckIsJavaCompatibleURLString(nsCString& urlString, PRBool *result)
+{
+  *result = PR_FALSE; // Default to "no"
+
+  nsresult rv = NS_OK;
+  nsCOMPtr<nsIURLParser> urlParser =
+    do_GetService(NS_STDURLPARSER_CONTRACTID, &rv);
+  if (NS_FAILED(rv) || !urlParser)
+    return NS_ERROR_FAILURE;
+
+  PRBool compatible = PR_TRUE;
+  PRUint32 schemePos = 0;
+  PRInt32 schemeLen = 0;
+  urlParser->ParseURL(urlString.get(), -1, &schemePos, &schemeLen,
+                      nsnull, nsnull, nsnull, nsnull);
+  if (schemeLen != -1) {
+    nsCString scheme;
+    scheme.Assign(urlString.get() + schemePos, schemeLen);
+    // By default Java only understands a small number of URL schemes, and of
+    // these only some are likely to represent user input (for example from a
+    // link or the location bar) that Java can legitimately be expected to
+    // handle.  (Besides those listed below, Java also understands the "jar",
+    // "mailto" and "netdoc" schemes.  But it probably doesn't expect these
+    // from a browser, and is therefore likely to mishandle them.)
+    if (PL_strcasecmp(scheme.get(), "http") &&
+        PL_strcasecmp(scheme.get(), "https") &&
+        PL_strcasecmp(scheme.get(), "file") &&
+        PL_strcasecmp(scheme.get(), "ftp") &&
+        PL_strcasecmp(scheme.get(), "gopher"))
+      compatible = PR_FALSE;
+  } else {
+    compatible = PR_FALSE;
+  }
+
+  *result = compatible;
+
+  return NS_OK;
+}
+
 #endif // !nsNetUtil_h__
diff --git a/netwerk/protocol/wyciwyg/PWyciwygChannel.ipdl b/netwerk/protocol/wyciwyg/PWyciwygChannel.ipdl
index 44e370031776..1c51eb1fb1f1 100644
--- a/netwerk/protocol/wyciwyg/PWyciwygChannel.ipdl
+++ b/netwerk/protocol/wyciwyg/PWyciwygChannel.ipdl
@@ -61,6 +61,7 @@ parent:
   CloseCacheEntry(nsresult reason);
   SetCharsetAndSource(PRInt32 source, nsCString charset);
   SetSecurityInfo(nsCString securityInfo);
+  Cancel(nsresult status);
 
 child:
   OnStartRequest(nsresult  statusCode,
@@ -73,6 +74,8 @@ child:
                   PRUint32  offset);
 
   OnStopRequest(nsresult statusCode);
+
+  CancelEarly(nsresult statusCode);
 };
 
 
diff --git a/netwerk/protocol/wyciwyg/WyciwygChannelChild.cpp b/netwerk/protocol/wyciwyg/WyciwygChannelChild.cpp
index 291b8db55e6f..1ca78209d8ec 100644
--- a/netwerk/protocol/wyciwyg/WyciwygChannelChild.cpp
+++ b/netwerk/protocol/wyciwyg/WyciwygChannelChild.cpp
@@ -60,6 +60,7 @@ WyciwygChannelChild::WyciwygChannelChild()
   : ChannelEventQueue<WyciwygChannelChild>(this)
   , mStatus(NS_OK)
   , mIsPending(PR_FALSE)
+  , mCanceled(false)
   , mLoadFlags(LOAD_NORMAL)
   , mContentLength(-1)
   , mCharsetSource(kCharsetUninitialized)
@@ -169,12 +170,8 @@ WyciwygChannelChild::OnStartRequest(const nsresult& statusCode,
   AutoEventEnqueuer ensureSerialDispatch(this);
 
   nsresult rv = mListener->OnStartRequest(this, mListenerContext);
-  if (NS_FAILED(rv)) {
-    // TODO: Cancel request:
-    //  - Send Cancel msg to parent
-    //  - drop any in flight OnDataAvail msgs we receive
-    //  - make sure we do call OnStopRequest eventually
-  }
+  if (NS_FAILED(rv))
+    Cancel(rv);
 }
 
 class WyciwygDataAvailableEvent : public ChannelEvent
@@ -209,6 +206,9 @@ WyciwygChannelChild::OnDataAvailable(const nsCString& data,
 {
   LOG(("WyciwygChannelChild::RecvOnDataAvailable [this=%x]\n", this));
 
+  if (mCanceled)
+    return;
+
   mState = WCC_ONDATA;
 
   // NOTE: the OnDataAvailable contract requires the client to read all the data
@@ -222,16 +222,16 @@ WyciwygChannelChild::OnDataAvailable(const nsCString& data,
                                       data.Length(),
                                       NS_ASSIGNMENT_DEPEND);
   if (NS_FAILED(rv)) {
-    // TODO:  what to do here?  Cancel request?  Very unlikely to fail.
+    Cancel(rv);
+    return;
   }
 
   AutoEventEnqueuer ensureSerialDispatch(this);
   
   rv = mListener->OnDataAvailable(this, mListenerContext,
                                   stringStream, offset, data.Length());
-  if (NS_FAILED(rv)) {
-    // TODO: Cancel request: see notes in OnStartRequest
-  }
+  if (NS_FAILED(rv))
+    Cancel(rv);
 
   if (mProgressSink && NS_SUCCEEDED(rv) && !(mLoadFlags & LOAD_BACKGROUND))
     mProgressSink->OnProgress(this, nsnull, PRUint64(offset + data.Length()),
@@ -274,7 +274,9 @@ WyciwygChannelChild::OnStopRequest(const nsresult& statusCode)
     mState = WCC_ONSTOP;
 
     mIsPending = PR_FALSE;
-    mStatus = statusCode;
+
+    if (!mCanceled)
+      mStatus = statusCode;
 
     mListener->OnStopRequest(this, mListenerContext, statusCode);
 
@@ -292,6 +294,54 @@ WyciwygChannelChild::OnStopRequest(const nsresult& statusCode)
     PWyciwygChannelChild::Send__delete__(this);
 }
 
+class WyciwygCancelEvent : public ChannelEvent
+{
+ public:
+  WyciwygCancelEvent(WyciwygChannelChild* child, const nsresult& status)
+  : mChild(child)
+  , mStatus(status) {}
+
+  void Run() { mChild->CancelEarly(mStatus); }
+ private:
+  WyciwygChannelChild* mChild;
+  nsresult mStatus;
+};
+
+bool
+WyciwygChannelChild::RecvCancelEarly(const nsresult& statusCode)
+{
+  if (ShouldEnqueue()) {
+    EnqueueEvent(new WyciwygCancelEvent(this, statusCode));
+  } else {
+    CancelEarly(statusCode);
+  }
+  return true;
+}
+
+void WyciwygChannelChild::CancelEarly(const nsresult& statusCode)
+{
+  LOG(("WyciwygChannelChild::CancelEarly [this=%x]\n", this));
+  
+  if (mCanceled)
+    return;
+
+  mCanceled = true;
+  mStatus = statusCode;
+  
+  mIsPending = false;
+  if (mLoadGroup)
+    mLoadGroup->RemoveRequest(this, nsnull, mStatus);
+
+  if (mListener) {
+    mListener->OnStartRequest(this, mListenerContext);
+    mListener->OnStopRequest(this, mListenerContext, mStatus);
+  }
+  mListener = nsnull;
+  mListenerContext = nsnull;
+
+  if (mIPCOpen)
+    PWyciwygChannelChild::Send__delete__(this);
+}
 
 //-----------------------------------------------------------------------------
 // nsIRequest
@@ -324,7 +374,14 @@ WyciwygChannelChild::GetStatus(nsresult *aStatus)
 NS_IMETHODIMP
 WyciwygChannelChild::Cancel(nsresult aStatus)
 {
-  return NS_ERROR_NOT_IMPLEMENTED;
+  if (mCanceled)
+    return NS_OK;
+
+  mCanceled = true;
+  mStatus = aStatus;
+  if (mIPCOpen)
+    SendCancel(aStatus);
+  return NS_OK;
 }
 
 /* void suspend (); */
diff --git a/netwerk/protocol/wyciwyg/WyciwygChannelChild.h b/netwerk/protocol/wyciwyg/WyciwygChannelChild.h
index a4eeadbb612c..e44a69f0daa6 100644
--- a/netwerk/protocol/wyciwyg/WyciwygChannelChild.h
+++ b/netwerk/protocol/wyciwyg/WyciwygChannelChild.h
@@ -94,6 +94,7 @@ protected:
   bool RecvOnDataAvailable(const nsCString& data,
                            const PRUint32& offset);
   bool RecvOnStopRequest(const nsresult& statusCode);
+  bool RecvCancelEarly(const nsresult& statusCode);
 
   void OnStartRequest(const nsresult& statusCode,
                       const PRInt32& contentLength,
@@ -103,10 +104,12 @@ protected:
   void OnDataAvailable(const nsCString& data,
                        const PRUint32& offset);
   void OnStopRequest(const nsresult& statusCode);
+  void CancelEarly(const nsresult& statusCode);
 
 private:
   nsresult                          mStatus;
   PRBool                            mIsPending;
+  bool                              mCanceled;
   PRUint32                          mLoadFlags;
   PRInt32                           mContentLength;
   PRInt32                           mCharsetSource;
@@ -129,6 +132,7 @@ private:
   friend class WyciwygStartRequestEvent;
   friend class WyciwygDataAvailableEvent;
   friend class WyciwygStopRequestEvent;
+  friend class WyciwygCancelEvent;
 };
 
 inline bool
diff --git a/netwerk/protocol/wyciwyg/WyciwygChannelParent.cpp b/netwerk/protocol/wyciwyg/WyciwygChannelParent.cpp
index 38e541f50df1..f98e9cfe56ee 100644
--- a/netwerk/protocol/wyciwyg/WyciwygChannelParent.cpp
+++ b/netwerk/protocol/wyciwyg/WyciwygChannelParent.cpp
@@ -90,21 +90,21 @@ WyciwygChannelParent::RecvInit(const IPC::URI& aURI)
 
   nsCString uriSpec;
   uri->GetSpec(uriSpec);
-  LOG(("WyciwygChannelParent RecvAsyncOpen [this=%x uri=%s]\n",
+  LOG(("WyciwygChannelParent RecvInit [this=%x uri=%s]\n",
        this, uriSpec.get()));
 
   nsCOMPtr<nsIIOService> ios(do_GetIOService(&rv));
   if (NS_FAILED(rv))
-    return false;       // TODO: send fail msg to child, return true
+    return SendCancelEarly(rv);
 
   nsCOMPtr<nsIChannel> chan;
   rv = NS_NewChannel(getter_AddRefs(chan), uri, ios);
   if (NS_FAILED(rv))
-    return false;       // TODO: send fail msg to child, return true
+    return SendCancelEarly(rv);
 
   mChannel = do_QueryInterface(chan, &rv);
   if (NS_FAILED(rv))
-    return false;       // TODO: send fail msg to child, return true
+    return SendCancelEarly(rv);
 
   return true;
 }
@@ -115,19 +115,21 @@ WyciwygChannelParent::RecvAsyncOpen(const IPC::URI& aOriginal,
 {
   nsCOMPtr<nsIURI> original(aOriginal);
 
+  LOG(("WyciwygChannelParent RecvAsyncOpen [this=%x]\n", this));
+
   nsresult rv;
 
   rv = mChannel->SetOriginalURI(original);
   if (NS_FAILED(rv))
-    return false;       // TODO: send fail msg to child, return true
+    return SendCancelEarly(rv);
 
   rv = mChannel->SetLoadFlags(aLoadFlags);
   if (NS_FAILED(rv))
-    return false;       // TODO: send fail msg to child, return true
+    return SendCancelEarly(rv);
 
   rv = mChannel->AsyncOpen(this, nsnull);
   if (NS_FAILED(rv))
-    return false;       // TODO: send fail msg to child, return true
+    return SendCancelEarly(rv);
 
   return true;
 }
@@ -163,6 +165,14 @@ WyciwygChannelParent::RecvSetSecurityInfo(const nsCString& aSecurityInfo)
   return true;
 }
 
+bool
+WyciwygChannelParent::RecvCancel(const nsresult& aStatusCode)
+{
+  if (mChannel)
+    mChannel->Cancel(aStatusCode);
+  return true;
+}
+
 //-----------------------------------------------------------------------------
 // WyciwygChannelParent::nsIRequestObserver
 //-----------------------------------------------------------------------------
diff --git a/netwerk/protocol/wyciwyg/WyciwygChannelParent.h b/netwerk/protocol/wyciwyg/WyciwygChannelParent.h
index 4d0cf967600e..02776f435b9b 100644
--- a/netwerk/protocol/wyciwyg/WyciwygChannelParent.h
+++ b/netwerk/protocol/wyciwyg/WyciwygChannelParent.h
@@ -67,6 +67,7 @@ protected:
   virtual bool RecvSetCharsetAndSource(const PRInt32& source,
                                        const nsCString& charset);
   virtual bool RecvSetSecurityInfo(const nsCString& securityInfo);
+  virtual bool RecvCancel(const nsresult& statusCode);
 
   virtual void ActorDestroy(ActorDestroyReason why);
 
diff --git a/parser/html/javasrc/TreeBuilder.java b/parser/html/javasrc/TreeBuilder.java
index a4a4c296630e..bf4408393d7e 100644
--- a/parser/html/javasrc/TreeBuilder.java
+++ b/parser/html/javasrc/TreeBuilder.java
@@ -1802,7 +1802,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                         case XMP:
                         case IFRAME:
                         case SELECT:
-                            if (mode == FRAMESET_OK) {
+                            if (mode == FRAMESET_OK
+                                    && !(group == INPUT && Portability.lowerCaseLiteralEqualsIgnoreAsciiCaseString(
+                                            "hidden",
+                                            attributes.getValue(AttributeName.TYPE)))) {
                                 framesetOk = false;
                                 mode = IN_BODY;
                             }
diff --git a/parser/html/nsHtml5Parser.cpp b/parser/html/nsHtml5Parser.cpp
index bf2c0cd018f0..fecdfe81abb0 100644
--- a/parser/html/nsHtml5Parser.cpp
+++ b/parser/html/nsHtml5Parser.cpp
@@ -100,6 +100,9 @@ nsHtml5Parser::nsHtml5Parser()
 nsHtml5Parser::~nsHtml5Parser()
 {
   mTokenizer->end();
+  if (mDocWriteSpeculativeTokenizer) {
+    mDocWriteSpeculativeTokenizer->end();
+  }
 }
 
 NS_IMETHODIMP_(void)
@@ -378,10 +381,49 @@ nsHtml5Parser::Parse(const nsAString& aSourceBuffer,
   }
 
   if (!mBlocked) { // buffer was tokenized to completion
-    NS_ASSERTION(!buffer->hasMore(), "Buffer wasn't tokenized to completion?");  
+    NS_ASSERTION(!buffer->hasMore(), "Buffer wasn't tokenized to completion?");
     // Scripting semantics require a forced tree builder flush here
     mTreeBuilder->Flush(); // Move ops to the executor
-    mExecutor->FlushDocumentWrite(); // run the ops    
+    mExecutor->FlushDocumentWrite(); // run the ops
+  } else if (buffer->hasMore()) {
+    // The buffer wasn't tokenized to completion. Tokenize the untokenized
+    // content in order to preload stuff. This content will be retokenized
+    // later for normal parsing.
+    if (!mDocWriteSpeculatorActive) {
+      mDocWriteSpeculatorActive = PR_TRUE;
+      if (!mDocWriteSpeculativeTreeBuilder) {
+        // Lazily initialize if uninitialized
+        mDocWriteSpeculativeTreeBuilder =
+            new nsHtml5TreeBuilder(nsnull, mExecutor->GetStage());
+        mDocWriteSpeculativeTokenizer =
+            new nsHtml5Tokenizer(mDocWriteSpeculativeTreeBuilder);
+        mDocWriteSpeculativeTokenizer->setInterner(&mAtomTable);
+        mDocWriteSpeculativeTokenizer->start();
+      }
+      mDocWriteSpeculativeTokenizer->resetToDataState();
+      mDocWriteSpeculativeTreeBuilder->loadState(mTreeBuilder, &mAtomTable);
+      mDocWriteSpeculativeLastWasCR = PR_FALSE;
+    }
+
+    // Note that with multilevel document.write if we didn't just activate the
+    // speculator, it's possible that the speculator is now in the wrong state.
+    // That's OK for the sake of simplicity. The worst that can happen is
+    // that the speculative loads aren't exactly right. The content will be
+    // reparsed anyway for non-preload purposes.
+
+    PRInt32 originalStart = buffer->getStart();
+    while (buffer->hasMore()) {
+      buffer->adjust(mDocWriteSpeculativeLastWasCR);
+      if (buffer->hasMore()) {
+        mDocWriteSpeculativeLastWasCR =
+            mDocWriteSpeculativeTokenizer->tokenizeBuffer(buffer);
+      }
+    }
+    buffer->setStart(originalStart);
+
+    mDocWriteSpeculativeTreeBuilder->Flush();
+    mDocWriteSpeculativeTreeBuilder->DropHandles();
+    mExecutor->FlushSpeculativeLoads();
   }
 
   return NS_OK;
@@ -498,6 +540,7 @@ nsHtml5Parser::ParseHtml5Fragment(const nsAString& aSourceBuffer,
   mTokenizer->end();
   mExecutor->DropParserAndPerfHint();
   mExecutor->DropHeldElements();
+  mTreeBuilder->DropHandles();
   mAtomTable.Clear();
   return NS_OK;
 }
@@ -519,6 +562,8 @@ nsHtml5Parser::CancelParsingEvents()
 void
 nsHtml5Parser::Reset()
 {
+  NS_PRECONDITION(mExecutor->IsFragmentMode(),
+                  "Reset called on a non-fragment parser.");
   mExecutor->Reset();
   mLastWasCR = PR_FALSE;
   UnblockParser();
@@ -593,6 +638,8 @@ nsHtml5Parser::ParseUntilBlocked()
   }
   NS_ASSERTION(mExecutor->HasStarted(), "Bad life cycle.");
 
+  mDocWriteSpeculatorActive = PR_FALSE;
+
   for (;;) {
     if (!mFirstBuffer->hasMore()) {
       if (mFirstBuffer == mLastBuffer) {
diff --git a/parser/html/nsHtml5Parser.h b/parser/html/nsHtml5Parser.h
index 38e42d8e64aa..b94dad9385c6 100644
--- a/parser/html/nsHtml5Parser.h
+++ b/parser/html/nsHtml5Parser.h
@@ -343,6 +343,12 @@ class nsHtml5Parser : public nsAHtml5FragmentParser, // inherits nsIParser
      */
     PRBool                        mLastWasCR;
 
+    /**
+     * Whether the last character tokenized was a carriage return (for CRLF)
+     * when preparsing document.write.
+     */
+    PRBool                        mDocWriteSpeculativeLastWasCR;
+
     /**
      * The parser is in the fragment mode
      */
@@ -352,6 +358,11 @@ class nsHtml5Parser : public nsAHtml5FragmentParser, // inherits nsIParser
      * The parser is blocking on a script
      */
     PRBool                        mBlocked;
+
+    /**
+     * Whether the document.write() speculator is already active.
+     */
+    PRBool                        mDocWriteSpeculatorActive;
     
     /**
      * The number of parser-inserted script currently being evaluated.
@@ -393,6 +404,16 @@ class nsHtml5Parser : public nsAHtml5FragmentParser, // inherits nsIParser
      */
     const nsAutoPtr<nsHtml5Tokenizer>   mTokenizer;
 
+    /**
+     * Another HTML5 tree builder for preloading document.written content.
+     */
+    nsAutoPtr<nsHtml5TreeBuilder> mDocWriteSpeculativeTreeBuilder;
+
+    /**
+     * Another HTML5 tokenizer for preloading document.written content.
+     */
+    nsAutoPtr<nsHtml5Tokenizer>   mDocWriteSpeculativeTokenizer;
+
     /**
      * The stream parser.
      */
diff --git a/parser/html/nsHtml5TreeBuilder.cpp b/parser/html/nsHtml5TreeBuilder.cpp
index cad1a20e2dcf..3dadd5333f12 100644
--- a/parser/html/nsHtml5TreeBuilder.cpp
+++ b/parser/html/nsHtml5TreeBuilder.cpp
@@ -896,7 +896,7 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
           case NS_HTML5TREE_BUILDER_XMP:
           case NS_HTML5TREE_BUILDER_IFRAME:
           case NS_HTML5TREE_BUILDER_SELECT: {
-            if (mode == NS_HTML5TREE_BUILDER_FRAMESET_OK) {
+            if (mode == NS_HTML5TREE_BUILDER_FRAMESET_OK && !(group == NS_HTML5TREE_BUILDER_INPUT && nsHtml5Portability::lowerCaseLiteralEqualsIgnoreAsciiCaseString("hidden", attributes->getValue(nsHtml5AttributeName::ATTR_TYPE)))) {
               framesetOk = PR_FALSE;
               mode = NS_HTML5TREE_BUILDER_IN_BODY;
             }
diff --git a/parser/html/nsHtml5TreeBuilderCppSupplement.h b/parser/html/nsHtml5TreeBuilderCppSupplement.h
index 99dbe5d0eceb..f12f1004615b 100644
--- a/parser/html/nsHtml5TreeBuilderCppSupplement.h
+++ b/parser/html/nsHtml5TreeBuilderCppSupplement.h
@@ -604,11 +604,16 @@ nsHtml5TreeBuilder::Flush()
 {
   flushCharacters();
   FlushLoads();
-  PRBool hasOps = !mOpQueue.IsEmpty();
-  if (hasOps) {
-    mOpSink->MoveOpsFrom(mOpQueue);
+  if (mOpSink) {
+    PRBool hasOps = !mOpQueue.IsEmpty();
+    if (hasOps) {
+      mOpSink->MoveOpsFrom(mOpQueue);
+    }
+    return hasOps;
   }
-  return hasOps;
+  // no op sink: throw away ops
+  mOpQueue.Clear();
+  return PR_FALSE;
 }
 
 void
@@ -667,6 +672,13 @@ nsHtml5TreeBuilder::IsDiscretionaryFlushSafe()
            stack[currentPtr]->fosterParenting);
 }
 
+void
+nsHtml5TreeBuilder::DropHandles()
+{
+  mOldHandles.Clear();
+  mHandlesUsed = 0;
+}
+
 // DocumentModeHandler
 void
 nsHtml5TreeBuilder::documentMode(nsHtml5DocumentMode m)
diff --git a/parser/html/nsHtml5TreeBuilderHSupplement.h b/parser/html/nsHtml5TreeBuilderHSupplement.h
index eeb36d180b95..99eac944cecd 100644
--- a/parser/html/nsHtml5TreeBuilderHSupplement.h
+++ b/parser/html/nsHtml5TreeBuilderHSupplement.h
@@ -95,3 +95,5 @@
     void NeedsCharsetSwitchTo(const nsACString& aEncoding);
 
     void AddSnapshotToScript(nsAHtml5TreeBuilderState* aSnapshot, PRInt32 aLine);
+
+    void DropHandles();
diff --git a/parser/html/nsHtml5TreeOpStage.h b/parser/html/nsHtml5TreeOpStage.h
index 05e35191d3e8..29fc121cafd5 100644
--- a/parser/html/nsHtml5TreeOpStage.h
+++ b/parser/html/nsHtml5TreeOpStage.h
@@ -49,7 +49,7 @@ class nsHtml5TreeOpStage : public nsAHtml5TreeOpSink {
   
     nsHtml5TreeOpStage();
     
-    ~nsHtml5TreeOpStage();
+    virtual ~nsHtml5TreeOpStage();
   
     /**
      * Flush the operations from the tree operations from the argument
diff --git a/parser/htmlparser/tests/mochitest/Makefile.in b/parser/htmlparser/tests/mochitest/Makefile.in
index 5dff3e9f78bd..d3f7aa5df12c 100644
--- a/parser/htmlparser/tests/mochitest/Makefile.in
+++ b/parser/htmlparser/tests/mochitest/Makefile.in
@@ -63,6 +63,8 @@ _TEST_FILES =	parser_datreader.js \
 		test_bug460437.xhtml \
 		test_bug502091.html \
 		bug_502091_iframe.html \
+		test_bug543062.html \
+		file_bug543062.sjs \
 		test_bug552938.html \
 		test_bug552938-2.html \
 		test_bug566879.html \
diff --git a/parser/htmlparser/tests/mochitest/file_bug543062.sjs b/parser/htmlparser/tests/mochitest/file_bug543062.sjs
new file mode 100644
index 000000000000..94a4afa9241b
--- /dev/null
+++ b/parser/htmlparser/tests/mochitest/file_bug543062.sjs
@@ -0,0 +1,30 @@
+function armTimer(response) {
+  var timer = Components.classes["@mozilla.org/timer;1"]
+    .createInstance(Components.interfaces.nsITimer);
+  timer.initWithCallback(function() {
+      if (getState("docwritepreloadssecond") == "second" && getState("docwritepreloadsthird") == "third") {
+        response.write("ok(true, 'Second and third scripts should have started loading while the first one is loading');");
+        response.finish();
+      } else {
+        armTimer(response);
+      }
+    }, 20, Components.interfaces.nsITimer.TYPE_ONE_SHOT);
+}
+
+function handleRequest(request, response)
+{
+  response.setHeader("Cache-Control", "no-cache", false);
+  response.setHeader("Content-Type", "text/javascript", false);
+  if (request.queryString.indexOf("first") != -1) {
+    response.write("// first\n");
+    response.processAsync();
+    armTimer(response);
+  } else if (request.queryString.indexOf("second") != -1) {
+    response.write("// second\n");
+    setState("docwritepreloadssecond", "second");
+  } else {
+    response.write("// third\n");
+    setState("docwritepreloadsthird", "third");
+  }
+}
+
diff --git a/parser/htmlparser/tests/mochitest/html5_tree_construction_exceptions.js b/parser/htmlparser/tests/mochitest/html5_tree_construction_exceptions.js
index a73a28d614f8..f61c20856e10 100644
--- a/parser/htmlparser/tests/mochitest/html5_tree_construction_exceptions.js
+++ b/parser/htmlparser/tests/mochitest/html5_tree_construction_exceptions.js
@@ -8,4 +8,13 @@ var html5Exceptions = {
   "<!doctype html><keygen><frameset>" : true, // Bug 101019
   "<select><keygen>" : true, // Bug 101019
   "<math><mi><div><object><div><span></span></div></object></div></mi><mi>" : true, // Bug 606925
+  "<plaintext>\u0000filler\u0000text\u0000" : true, // Bug 612527
+  "<body><svg><foreignObject>\u0000filler\u0000text" : true, // Bug 612527
+  "<svg>\u0000</svg><frameset>" : true, // Bug 612527
+  "<svg>\u0000 </svg><frameset>" : true, // Bug 612527
+  "<option><span><option>" : true, // Bug 612528
+  "<math><annotation-xml encoding=\"application/xhtml+xml\"><div>" : true, // Bug 612529
+  "<math><annotation-xml encoding=\"aPPlication/xhtmL+xMl\"><div>" : true, // Bug 612529
+  "<math><annotation-xml encoding=\"text/html\"><div>" : true, // Bug 612529
+  "<math><annotation-xml encoding=\"Text/htmL\"><div>" : true, // Bug 612529
 }
diff --git a/parser/htmlparser/tests/mochitest/html5lib_tree_construction/Makefile.in b/parser/htmlparser/tests/mochitest/html5lib_tree_construction/Makefile.in
index aa108ddc87f8..736a1b2f5264 100644
--- a/parser/htmlparser/tests/mochitest/html5lib_tree_construction/Makefile.in
+++ b/parser/htmlparser/tests/mochitest/html5lib_tree_construction/Makefile.in
@@ -75,6 +75,8 @@ _TEST_FILES =	adoption01.dat \
 		tests1.dat \
 		tests20.dat \
 		tests21.dat \
+		tests22.dat \
+		tests23.dat \
 		tests2.dat \
 		tests3.dat \
 		tests4.dat \
diff --git a/parser/htmlparser/tests/mochitest/html5lib_tree_construction/pending-spec-changes-plain-text-unsafe.dat b/parser/htmlparser/tests/mochitest/html5lib_tree_construction/pending-spec-changes-plain-text-unsafe.dat
index af00e9d1f79e..b0bc45c717bb 100644
Binary files a/parser/htmlparser/tests/mochitest/html5lib_tree_construction/pending-spec-changes-plain-text-unsafe.dat and b/parser/htmlparser/tests/mochitest/html5lib_tree_construction/pending-spec-changes-plain-text-unsafe.dat differ
diff --git a/parser/htmlparser/tests/mochitest/html5lib_tree_construction/pending-spec-changes.dat b/parser/htmlparser/tests/mochitest/html5lib_tree_construction/pending-spec-changes.dat
index b933025a00b3..8f539825e81c 100644
--- a/parser/htmlparser/tests/mochitest/html5lib_tree_construction/pending-spec-changes.dat
+++ b/parser/htmlparser/tests/mochitest/html5lib_tree_construction/pending-spec-changes.dat
@@ -1,8 +1,10 @@
 #data
-Placeholder
+<input type="hidden"><frameset>
 #errors
+21: Start tag seen without seeing a doctype first. Expected “<!DOCTYPE html>”.
+31: “frameset” start tag seen.
+31: End of file seen and there were open elements.
 #document
 | <html>
 |   <head>
-|   <body>
-|     "Placeholder"
+|   <frameset>
diff --git a/parser/htmlparser/tests/mochitest/html5lib_tree_construction/plain-text-unsafe.dat b/parser/htmlparser/tests/mochitest/html5lib_tree_construction/plain-text-unsafe.dat
index 2f40e83babcd..6fa3fa72b397 100644
Binary files a/parser/htmlparser/tests/mochitest/html5lib_tree_construction/plain-text-unsafe.dat and b/parser/htmlparser/tests/mochitest/html5lib_tree_construction/plain-text-unsafe.dat differ
diff --git a/parser/htmlparser/tests/mochitest/html5lib_tree_construction/tests1.dat b/parser/htmlparser/tests/mochitest/html5lib_tree_construction/tests1.dat
index 6962f959b82f..cbf8bdda6385 100644
--- a/parser/htmlparser/tests/mochitest/html5lib_tree_construction/tests1.dat
+++ b/parser/htmlparser/tests/mochitest/html5lib_tree_construction/tests1.dat
@@ -833,71 +833,6 @@ Line: 1 Col: 22 Expected closing tag. Unexpected end of file.
 |         "C"
 |       "D"
 
-#data
-<cite><b><cite><i><cite><i><cite><i><div>X</b>TEST
-#errors
-Line: 1 Col: 6 Unexpected start tag (cite). Expected DOCTYPE.
-Line: 1 Col: 46 End tag (b) violates step 1, paragraph 3 of the adoption agency algorithm.
-Line: 1 Col: 50 Expected closing tag. Unexpected end of file.
-#document
-| <html>
-|   <head>
-|   <body>
-|     <cite>
-|       <b>
-|         <cite>
-|           <i>
-|             <cite>
-|               <i>
-|                 <cite>
-|                   <i>
-|       <i>
-|         <i>
-|           <div>
-|             <b>
-|               "X"
-|             "TEST"
-
-#data
-<p><font size=4><font color=red><font size=4><font size=4><font size=4><font size=4><font size=4><font color=red><p>X
-#errors
-3: Start tag seen without seeing a doctype first. Expected “<!DOCTYPE html>”.
-116: Unclosed elements.
-117: End of file seen and there were open elements.
-#document
-| <html>
-|   <head>
-|   <body>
-|     <p>
-|       <font>
-|         size="4"
-|         <font>
-|           color="red"
-|           <font>
-|             size="4"
-|             <font>
-|               size="4"
-|               <font>
-|                 size="4"
-|                 <font>
-|                   size="4"
-|                   <font>
-|                     size="4"
-|                     <font>
-|                       color="red"
-|     <p>
-|       <font>
-|         color="red"
-|         <font>
-|           size="4"
-|           <font>
-|             size="4"
-|             <font>
-|               size="4"
-|               <font>
-|                 color="red"
-|                 "X"
-
 #data
 
 #errors
diff --git a/parser/htmlparser/tests/mochitest/html5lib_tree_construction/tests20.dat b/parser/htmlparser/tests/mochitest/html5lib_tree_construction/tests20.dat
index 31e7b13a988a..115c3b1e6334 100644
--- a/parser/htmlparser/tests/mochitest/html5lib_tree_construction/tests20.dat
+++ b/parser/htmlparser/tests/mochitest/html5lib_tree_construction/tests20.dat
@@ -349,3 +349,114 @@
 |     <svg svg>
 |       <svg title>
 |         "abc"
+
+#data
+<option><span><option>
+#errors
+#document
+| <html>
+|   <head>
+|   <body>
+|     <option>
+|       <span>
+|         <option>
+
+#data
+<option><option>
+#errors
+#document
+| <html>
+|   <head>
+|   <body>
+|     <option>
+|     <option>
+
+#data
+<math><annotation-xml><div>
+#errors
+#document
+#document
+| <html>
+|   <head>
+|   <body>
+|     <math math>
+|       <math annotation-xml>
+|     <div>
+
+#data
+<math><annotation-xml encoding="application/svg+xml"><div>
+#errors
+#document
+#document
+| <html>
+|   <head>
+|   <body>
+|     <math math>
+|       <math annotation-xml>
+|         encoding="application/svg+xml"
+|     <div>
+
+#data
+<math><annotation-xml encoding="application/xhtml+xml"><div>
+#errors
+#document
+#document
+| <html>
+|   <head>
+|   <body>
+|     <math math>
+|       <math annotation-xml>
+|         encoding="application/xhtml+xml"
+|         <div>
+
+#data
+<math><annotation-xml encoding="aPPlication/xhtmL+xMl"><div>
+#errors
+#document
+#document
+| <html>
+|   <head>
+|   <body>
+|     <math math>
+|       <math annotation-xml>
+|         encoding="aPPlication/xhtmL+xMl"
+|         <div>
+
+#data
+<math><annotation-xml encoding="text/html"><div>
+#errors
+#document
+#document
+| <html>
+|   <head>
+|   <body>
+|     <math math>
+|       <math annotation-xml>
+|         encoding="text/html"
+|         <div>
+
+#data
+<math><annotation-xml encoding="Text/htmL"><div>
+#errors
+#document
+#document
+| <html>
+|   <head>
+|   <body>
+|     <math math>
+|       <math annotation-xml>
+|         encoding="Text/htmL"
+|         <div>
+
+#data
+<math><annotation-xml encoding=" text/html "><div>
+#errors
+#document
+#document
+| <html>
+|   <head>
+|   <body>
+|     <math math>
+|       <math annotation-xml>
+|         encoding=" text/html "
+|     <div>
diff --git a/parser/htmlparser/tests/mochitest/html5lib_tree_construction/tests22.dat b/parser/htmlparser/tests/mochitest/html5lib_tree_construction/tests22.dat
new file mode 100644
index 000000000000..aab27b2e904b
--- /dev/null
+++ b/parser/htmlparser/tests/mochitest/html5lib_tree_construction/tests22.dat
@@ -0,0 +1,157 @@
+#data
+<a><b><big><em><strong><div>X</a>
+#errors
+#document
+| <html>
+|   <head>
+|   <body>
+|     <a>
+|       <b>
+|         <big>
+|           <em>
+|             <strong>
+|     <big>
+|       <em>
+|         <strong>
+|           <div>
+|             <a>
+|               "X"
+
+#data
+<a><b><div id=1><div id=2><div id=3><div id=4><div id=5><div id=6><div id=7><div id=8>A</a>
+#errors
+#document
+| <html>
+|   <head>
+|   <body>
+|     <a>
+|       <b>
+|     <b>
+|       <div>
+|         id="1"
+|         <a>
+|         <div>
+|           id="2"
+|           <a>
+|           <div>
+|             id="3"
+|             <a>
+|             <div>
+|               id="4"
+|               <a>
+|               <div>
+|                 id="5"
+|                 <a>
+|                 <div>
+|                   id="6"
+|                   <a>
+|                   <div>
+|                     id="7"
+|                     <a>
+|                     <div>
+|                       id="8"
+|                       <a>
+|                         "A"
+
+#data
+<a><b><div id=1><div id=2><div id=3><div id=4><div id=5><div id=6><div id=7><div id=8><div id=9>A</a>
+#errors
+#document
+| <html>
+|   <head>
+|   <body>
+|     <a>
+|       <b>
+|     <b>
+|       <div>
+|         id="1"
+|         <a>
+|         <div>
+|           id="2"
+|           <a>
+|           <div>
+|             id="3"
+|             <a>
+|             <div>
+|               id="4"
+|               <a>
+|               <div>
+|                 id="5"
+|                 <a>
+|                 <div>
+|                   id="6"
+|                   <a>
+|                   <div>
+|                     id="7"
+|                     <a>
+|                     <div>
+|                       id="8"
+|                       <a>
+|                         <div>
+|                           id="9"
+|                           "A"
+
+#data
+<a><b><div id=1><div id=2><div id=3><div id=4><div id=5><div id=6><div id=7><div id=8><div id=9><div id=10>A</a>
+#errors
+#document
+| <html>
+|   <head>
+|   <body>
+|     <a>
+|       <b>
+|     <b>
+|       <div>
+|         id="1"
+|         <a>
+|         <div>
+|           id="2"
+|           <a>
+|           <div>
+|             id="3"
+|             <a>
+|             <div>
+|               id="4"
+|               <a>
+|               <div>
+|                 id="5"
+|                 <a>
+|                 <div>
+|                   id="6"
+|                   <a>
+|                   <div>
+|                     id="7"
+|                     <a>
+|                     <div>
+|                       id="8"
+|                       <a>
+|                         <div>
+|                           id="9"
+|                           <div>
+|                             id="10"
+|                             "A"
+
+#data
+<cite><b><cite><i><cite><i><cite><i><div>X</b>TEST
+#errors
+Line: 1 Col: 6 Unexpected start tag (cite). Expected DOCTYPE.
+Line: 1 Col: 46 End tag (b) violates step 1, paragraph 3 of the adoption agency algorithm.
+Line: 1 Col: 50 Expected closing tag. Unexpected end of file.
+#document
+| <html>
+|   <head>
+|   <body>
+|     <cite>
+|       <b>
+|         <cite>
+|           <i>
+|             <cite>
+|               <i>
+|                 <cite>
+|                   <i>
+|       <i>
+|         <i>
+|           <div>
+|             <b>
+|               "X"
+|             "TEST"
diff --git a/parser/htmlparser/tests/mochitest/html5lib_tree_construction/tests23.dat b/parser/htmlparser/tests/mochitest/html5lib_tree_construction/tests23.dat
new file mode 100644
index 000000000000..34d2a73f1c75
--- /dev/null
+++ b/parser/htmlparser/tests/mochitest/html5lib_tree_construction/tests23.dat
@@ -0,0 +1,155 @@
+#data
+<p><font size=4><font color=red><font size=4><font size=4><font size=4><font size=4><font size=4><font color=red><p>X
+#errors
+3: Start tag seen without seeing a doctype first. Expected “<!DOCTYPE html>”.
+116: Unclosed elements.
+117: End of file seen and there were open elements.
+#document
+| <html>
+|   <head>
+|   <body>
+|     <p>
+|       <font>
+|         size="4"
+|         <font>
+|           color="red"
+|           <font>
+|             size="4"
+|             <font>
+|               size="4"
+|               <font>
+|                 size="4"
+|                 <font>
+|                   size="4"
+|                   <font>
+|                     size="4"
+|                     <font>
+|                       color="red"
+|     <p>
+|       <font>
+|         color="red"
+|         <font>
+|           size="4"
+|           <font>
+|             size="4"
+|             <font>
+|               size="4"
+|               <font>
+|                 color="red"
+|                 "X"
+
+#data
+<p><font size=4><font size=4><font size=4><font size=4><p>X
+#errors
+#document
+| <html>
+|   <head>
+|   <body>
+|     <p>
+|       <font>
+|         size="4"
+|         <font>
+|           size="4"
+|           <font>
+|             size="4"
+|             <font>
+|               size="4"
+|     <p>
+|       <font>
+|         size="4"
+|         <font>
+|           size="4"
+|           <font>
+|             size="4"
+|             "X"
+
+#data
+<p><font size=4><font size=4><font size=4><font size="5"><font size=4><p>X
+#errors
+#document
+| <html>
+|   <head>
+|   <body>
+|     <p>
+|       <font>
+|         size="4"
+|         <font>
+|           size="4"
+|           <font>
+|             size="4"
+|             <font>
+|               size="5"
+|               <font>
+|                 size="4"
+|     <p>
+|       <font>
+|         size="4"
+|         <font>
+|           size="4"
+|           <font>
+|             size="5"
+|             <font>
+|               size="4"
+|               "X"
+
+#data
+<p><font size=4 id=a><font size=4 id=b><font size=4><font size=4><p>X
+#errors
+#document
+| <html>
+|   <head>
+|   <body>
+|     <p>
+|       <font>
+|         id="a"
+|         size="4"
+|         <font>
+|           id="b"
+|           size="4"
+|           <font>
+|             size="4"
+|             <font>
+|               size="4"
+|     <p>
+|       <font>
+|         id="a"
+|         size="4"
+|         <font>
+|           id="b"
+|           size="4"
+|           <font>
+|             size="4"
+|             <font>
+|               size="4"
+|               "X"
+
+#data
+<p><b id=a><b id=a><b id=a><b><object><b id=a><b id=a>X</object><p>Y
+#errors
+#document
+| <html>
+|   <head>
+|   <body>
+|     <p>
+|       <b>
+|         id="a"
+|         <b>
+|           id="a"
+|           <b>
+|             id="a"
+|             <b>
+|               <object>
+|                 <b>
+|                   id="a"
+|                   <b>
+|                     id="a"
+|                     "X"
+|     <p>
+|       <b>
+|         id="a"
+|         <b>
+|           id="a"
+|           <b>
+|             id="a"
+|             <b>
+|               "Y"
diff --git a/parser/htmlparser/tests/mochitest/test_bug543062.html b/parser/htmlparser/tests/mochitest/test_bug543062.html
new file mode 100644
index 000000000000..bb3f91e20ad7
--- /dev/null
+++ b/parser/htmlparser/tests/mochitest/test_bug543062.html
@@ -0,0 +1,26 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=543062
+-->
+<head>
+  <title>Test for Bug 543062</title>
+  <script type="text/javascript" src="/MochiKit/MochiKit.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=543062">Mozilla Bug 543062</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+document.write("\u003Cscript src='file_bug543062.sjs?first'>\u003C/script>\u003Cscript src='file_bug543062.sjs?second'>\u003C/script>");
+document.write("\u003Cscript src='file_bug543062.sjs?third'>\u003C/script>");
+</script>
+</pre>
+</body>
+</html>
+
diff --git a/parser/htmlparser/tests/mochitest/test_html5_tree_construction_part2.html b/parser/htmlparser/tests/mochitest/test_html5_tree_construction_part2.html
index c86b43d0b44a..f5bc8845f0e6 100644
--- a/parser/htmlparser/tests/mochitest/test_html5_tree_construction_part2.html
+++ b/parser/htmlparser/tests/mochitest/test_html5_tree_construction_part2.html
@@ -22,6 +22,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=366936
                          "tests1.dat",
                          "tests20.dat",
                          "tests21.dat",
+                         "tests22.dat",
+                         "tests23.dat",
                          "tests2.dat",
                          "tests3.dat",
                          "tests4.dat",
diff --git a/security/manager/ssl/src/nsCrypto.cpp b/security/manager/ssl/src/nsCrypto.cpp
index f1c11bb07e16..d08895013a8c 100644
--- a/security/manager/ssl/src/nsCrypto.cpp
+++ b/security/manager/ssl/src/nsCrypto.cpp
@@ -696,6 +696,10 @@ cryptojs_generateOneKeyPair(JSContext *cx, nsKeyPairInfo *keyPairInfo,
                                                      (params) ? strlen(params):0, 
                                                      keySize, keyPairInfo);
 
+  if (!keyGenParams) {
+    return NS_ERROR_INVALID_ARG;
+  }
+
   // Make sure the token has password already set on it before trying
   // to generate the key.
 
diff --git a/testing/crashtest/crashtests.list b/testing/crashtest/crashtests.list
index d5a128109e2c..f211bab466cf 100644
--- a/testing/crashtest/crashtests.list
+++ b/testing/crashtest/crashtests.list
@@ -26,11 +26,7 @@ include ../../dom/base/crashtests/crashtests.list
 include ../../dom/src/offline/crashtests/crashtests.list
 include ../../dom/src/jsurl/crashtests/crashtests.list
 
-include ../../editor/libeditor/html/crashtests/crashtests.list
-include ../../editor/libeditor/base/crashtests/crashtests.list
-include ../../editor/libeditor/text/crashtests/crashtests.list
-include ../../editor/composer/src/crashtests/crashtests.list
-include ../../editor/txmgr/tests/crashtests/crashtests.list
+include ../../editor/crashtests.list
 
 include ../../intl/lwbrk/src/crashtests/crashtests.list
 include ../../intl/uconv/crashtests/crashtests.list
diff --git a/testing/testsuite-targets.mk b/testing/testsuite-targets.mk
index 97ff52716622..62e22dbf804b 100644
--- a/testing/testsuite-targets.mk
+++ b/testing/testsuite-targets.mk
@@ -113,12 +113,12 @@ reftest:
 	$(call RUN_REFTEST,$(topsrcdir)/$(TEST_PATH))
 	$(CHECK_TEST_ERROR)
 
-crashtest: TEST_PATH=testing/crashtest/crashtests.list
+crashtest: TEST_PATH?=testing/crashtest/crashtests.list
 crashtest:
 	$(call RUN_REFTEST,$(topsrcdir)/$(TEST_PATH))
 	$(CHECK_TEST_ERROR)
 
-jstestbrowser: TEST_PATH=js/src/tests/jstests.list
+jstestbrowser: TEST_PATH?=js/src/tests/jstests.list
 jstestbrowser:
 	$(call RUN_REFTEST,$(topsrcdir)/$(TEST_PATH) --extra-profile-file=$(topsrcdir)/js/src/tests/user.js)
 	$(CHECK_TEST_ERROR)
diff --git a/toolkit/components/console/hudservice/HUDService.jsm b/toolkit/components/console/hudservice/HUDService.jsm
index 31969dd8de30..8e49aa67eb04 100644
--- a/toolkit/components/console/hudservice/HUDService.jsm
+++ b/toolkit/components/console/hudservice/HUDService.jsm
@@ -46,6 +46,8 @@ const Cc = Components.classes;
 const Ci = Components.interfaces;
 const Cu = Components.utils;
 
+const CONSOLEAPI_CLASS_ID = "{b49c18f8-3379-4fc0-8c90-d7772c1a9ff3}";
+
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
 
@@ -736,7 +738,7 @@ function NetworkPanel(aParent, aHttpActivity)
 
   // Set the document object and update the content once the panel is loaded.
   this.panel.addEventListener("load", function onLoad() {
-    self.panel.removeEventListener("load", onLoad, true)
+    self.panel.removeEventListener("load", onLoad, true);
     self.document = self.iframe.contentWindow.document;
     self.update();
   }, true);
@@ -1431,6 +1433,31 @@ HUD_SERVICE.prototype =
    */
   filterPrefs: {},
 
+  /**
+   * Gets the ID of the outer window of this DOM window
+   *
+   * @param nsIDOMWindow aWindow
+   * @returns integer
+   */
+  getWindowId: function HS_getWindowId(aWindow)
+  {
+    return aWindow.QueryInterface(Ci.nsIInterfaceRequestor).getInterface(Ci.nsIDOMWindowUtils).outerWindowID;
+  },
+
+  /**
+   * Gets the top level content window that has an outer window with
+   * the given ID or returns null if no such content window exists
+   *
+   * @param integer aId
+   * @returns nsIDOMWindow
+   */
+  getWindowByWindowId: function HS_getWindowByWindowId(aId)
+  {
+    let someWindow = Services.wm.getMostRecentWindow(null);
+    let windowUtils = someWindow.getInterface(Ci.nsIDOMWindowUtils);
+    return windowUtils.getOuterWindowWithId(aId);
+  },
+
   /**
    * Whether to save the bodies of network requests and responses. Disabled by
    * default to save memory.
@@ -1779,22 +1806,17 @@ HUD_SERVICE.prototype =
   },
 
   /**
-   * Keeps a weak reference for each HeadsUpDisplay that is created
-   *
+   * Keeps a reference for each HeadsUpDisplay that is created
    */
-  hudWeakReferences: {},
+  hudReferences: {},
 
   /**
-   * Register a weak reference of each HeadsUpDisplay that is created
-   *
-   * @param object aHUDRef
-   * @param string aHUDId
-   * @returns void
+   * Register a reference of each HeadsUpDisplay that is created
    */
-  registerHUDWeakReference:
-  function HS_registerHUDWeakReference(aHUDRef, aHUDId)
+  registerHUDReference:
+  function HS_registerHUDReference(aHUD)
   {
-    this.hudWeakReferences[aHUDId] = aHUDRef;
+    this.hudReferences[aHUD.hudId] = aHUD;
   },
 
   /**
@@ -1805,13 +1827,12 @@ HUD_SERVICE.prototype =
    */
   deleteHeadsUpDisplay: function HS_deleteHeadsUpDisplay(aHUDId)
   {
-    delete this.hudWeakReferences[aHUDId].get();
+    delete this.hudReferences[aHUDId];
   },
 
   /**
    * Register a new Heads Up Display
    *
-   * @param string aHUDId
    * @param nsIDOMWindow aContentWindow
    * @returns void
    */
@@ -1822,10 +1843,12 @@ HUD_SERVICE.prototype =
     if (!aHUDId || !aContentWindow){
       throw new Error(ERRORS.MISSING_ARGS);
     }
-    var URISpec = aContentWindow.document.location.href
+    var URISpec = aContentWindow.document.location.href;
     this.filterPrefs[aHUDId] = this.defaultFilterPrefs;
     this.displayRegistry[aHUDId] = URISpec;
-    this._headsUpDisplays[aHUDId] = { id: aHUDId, };
+
+    this._headsUpDisplays[aHUDId] = { id: aHUDId };
+
     this.registerActiveContext(aHUDId);
     // init storage objects:
     this.storage.createDisplay(aHUDId);
@@ -1897,12 +1920,6 @@ HUD_SERVICE.prototype =
     // remove the DOM Nodes
     parent.removeChild(outputNode);
 
-    this.windowRegistry[id].forEach(function(aContentWindow) {
-      if (aContentWindow.console instanceof HUDConsole) {
-        delete aContentWindow.console;
-      }
-    });
-
     // remove our record of the DOM Nodes from the registry
     delete this._headsUpDisplays[id];
     // remove the HeadsUpDisplay object from memory
@@ -1976,9 +1993,6 @@ HUD_SERVICE.prototype =
     let hudId = hudBox.id;
     this.windowRegistry[hudId].push(aContentWindow);
 
-    let wu = aContentWindow.QueryInterface(Ci.nsIInterfaceRequestor)
-                           .getInterface(Ci.nsIDOMWindowUtils);
-
     let uri = aContentWindow.document.location.href;
     if (!this.uriRegistry[uri]) {
       this.uriRegistry[uri] = [ hudId ];
@@ -2090,23 +2104,35 @@ HUD_SERVICE.prototype =
   },
 
   /**
-   * logs a message to the Heads Up Display that originates
-   * in the nsIConsoleService
+   * Logs a message to the Heads Up Display that originates
+   * from the window.console API
    *
-   * @param nsIConsoleMessage aMessage
-   * @param nsIDOMNode aConsoleNode
-   * @param nsIDOMNode aMessageNode
-   * @returns void
+   * @param aHudId
+   * @param string aLevel one of log/info/warn/error
+   * @param string aArguments
    */
-  logConsoleMessage: function HS_logConsoleMessage(aMessage,
-                                                   aConsoleNode,
-                                                   aMessageNode)
+  logConsoleAPIMessage: function HS_logConsoleAPIMessage(aHudId,
+                                                         aLevel,
+                                                         aArguments)
   {
-    aConsoleNode.appendChild(aMessageNode);
-    ConsoleUtils.scrollToVisible(aMessageNode);
+    let hud = this.hudReferences[aHudId];
+    let messageNode = hud.makeXULNode("label");
+    let klass = "hud-msg-node hud-" + aLevel;
+    messageNode.setAttribute("class", klass);
 
-    // store this message in the storage module:
-    this.storage.recordEntry(aMessage.hudId, aMessage);
+    let message = Array.join(aArguments, " ") + "\n";
+    let ts = ConsoleUtils.timestamp();
+    let timestampedMessage = ConsoleUtils.timestampString(ts) + ": " + message;
+    messageNode.appendChild(hud.chromeDocument.createTextNode(timestampedMessage));
+
+    let messageObject = {
+      logLevel: aLevel,
+      hudId: aHudId,
+      message: message,
+      timestamp: ts,
+      origin: "WebConsole"
+    };
+    this.logMessage(messageObject, hud.outputNode, messageNode);
   },
 
   /**
@@ -2125,10 +2151,9 @@ HUD_SERVICE.prototype =
       throw new Error(ERRORS.MISSING_ARGS);
     }
 
-    var hud = this.getHeadsUpDisplay(aMessage.hudId);
     switch (aMessage.origin) {
       case "network":
-      case "HUDConsole":
+      case "WebConsole":
       case "console-listener":
         this.logHUDMessage(aMessage, aConsoleNode, aMessageNode);
         break;
@@ -2177,22 +2202,6 @@ HUD_SERVICE.prototype =
     this.logMessage(messageObject.messageObject, outputNode, messageObject.messageNode);
   },
 
-  /**
-   * generates an nsIScriptError
-   *
-   * @param object aMessage
-   * @param integer flag
-   * @returns nsIScriptError
-   */
-  generateConsoleMessage:
-  function HS_generateConsoleMessage(aMessage, flag)
-  {
-    let message = scriptError; // nsIScriptError
-    message.init(aMessage.message, null, null, 0, 0, flag,
-                 "HUDConsole");
-    return message;
-  },
-
   /**
    * Register a Gecko app's specialized ApplicationHooks object
    *
@@ -2255,7 +2264,8 @@ HUD_SERVICE.prototype =
    *        NetworkPanel.
    * @returns NetworkPanel
    */
-  openNetworkPanel: function (aNode, aHttpActivity) {
+  openNetworkPanel: function HS_openNetworkPanel(aNode, aHttpActivity)
+  {
     let doc = aNode.ownerDocument;
     let parent = doc.getElementById("mainPopupSet");
     let netPanel = new NetworkPanel(parent, aHttpActivity);
@@ -2279,8 +2289,12 @@ HUD_SERVICE.prototype =
     var self = this;
     var httpObserver = {
       observeActivity :
-      function (aChannel, aActivityType, aActivitySubtype,
-                aTimestamp, aExtraSizeData, aExtraStringData)
+      function HS_SHO_observeActivity(aChannel,
+                                      aActivityType,
+                                      aActivitySubtype,
+                                      aTimestamp,
+                                      aExtraSizeData,
+                                      aExtraStringData)
       {
         if (aActivityType ==
               activityDistributor.ACTIVITY_TYPE_HTTP_TRANSACTION ||
@@ -2308,6 +2322,7 @@ HUD_SERVICE.prototype =
 
             // The httpActivity object will hold all information concerning
             // this request and later response.
+
             let httpActivity = {
               id: self.sequenceId(),
               hudId: hudId,
@@ -2613,7 +2628,7 @@ HUD_SERVICE.prototype =
                       lineCol + " " +
                       msgCategory + " " + aActivityObject.category;
 
-    let outputNode = this.hudWeakReferences[aHUDId].get().outputNode;
+    let outputNode = this.hudReferences[aHUDId].outputNode;
 
     var messageObject =
     this.messageFactory(message, message.level, outputNode, aActivityObject);
@@ -2855,25 +2870,13 @@ HUD_SERVICE.prototype =
       return;
     }
 
-    if (aContentWindow.document.location.href == "about:blank" &&
-        HUDWindowObserver.initialConsoleCreated == false) {
-      // TODO: need to make this work with about:blank in the future
-      // see bug 568661
-      return;
-    }
-
     xulWindow.addEventListener("unload", this.onWindowUnload, false);
 
     let gBrowser = xulWindow.gBrowser;
 
-
-    var container = gBrowser.tabContainer;
+    let container = gBrowser.tabContainer;
     container.addEventListener("TabClose", this.onTabClose, false);
 
-    if (gBrowser && !HUDWindowObserver.initialConsoleCreated) {
-      HUDWindowObserver.initialConsoleCreated = true;
-    }
-
     let _browser = gBrowser.
       getBrowserForDocument(aContentWindow.top.document);
     let nBox = gBrowser.getNotificationBox(_browser);
@@ -2903,27 +2906,27 @@ HUD_SERVICE.prototype =
     if (!hudNode) {
       // get nBox object and call new HUD
       let config = { parentNode: nBox,
-                     contentWindow: aContentWindow,
+                     contentWindow: aContentWindow
                    };
 
       hud = new HeadsUpDisplay(config);
 
-      let hudWeakRef = Cu.getWeakReference(hud);
-      HUDService.registerHUDWeakReference(hudWeakRef, hudId);
+      HUDService.registerHUDReference(hud);
     }
     else {
-      hud = this.hudWeakReferences[hudId].get();
-      hud.reattachConsole(aContentWindow.top);
+      hud = this.hudReferences[hudId];
+      if (aContentWindow == aContentWindow.top) {
+        // TODO: name change?? doesn't actually re-attach the console
+        hud.reattachConsole(aContentWindow);
+      }
     }
 
-    // Check if aContentWindow has a console object. If so, don't attach
-    // our console, but warn the user about this.
-    if (aContentWindow.wrappedJSObject.console) {
+    // need to detect that the console component has been paved over
+    // TODO: change how we detect our console: bug 612405
+    let consoleObject = aContentWindow.wrappedJSObject.console;
+    if (consoleObject && consoleObject.classID != CONSOLEAPI_CLASS_ID) {
       this.logWarningAboutReplacedAPI(hudId);
     }
-    else {
-      aContentWindow.wrappedJSObject.console = hud.console;
-    }
 
     // register the controller to handle "select all" properly
     this.createController(xulWindow);
@@ -3100,10 +3103,6 @@ function HeadsUpDisplay(aConfig)
                                     this.notificationBox.childNodes[1]);
 
   this.HUDBox.lastTimestamp = 0;
-
-  // Create the console object that is attached to the window later.
-  this._console = this.createConsole();
-
   // create the JSTerm input element
   try {
     this.createConsoleInput(this.contentWindow, this.consoleWrap, this.outputNode);
@@ -3115,6 +3114,7 @@ function HeadsUpDisplay(aConfig)
 }
 
 HeadsUpDisplay.prototype = {
+
   /**
    * L10N shortcut function
    *
@@ -3177,10 +3177,6 @@ HeadsUpDisplay.prototype = {
     this.contentDocument = this.contentWindow.document;
     this.uriSpec = this.contentWindow.location.href;
 
-    if (!this._console) {
-      this._console = this.createConsole();
-    }
-
     if (!this.jsterm) {
       this.createConsoleInput(this.contentWindow, this.consoleWrap, this.outputNode);
     }
@@ -3484,13 +3480,7 @@ HeadsUpDisplay.prototype = {
     }
   },
 
-  get console() {
-    if (!this._console) {
-      this._console = this.createConsole();
-    }
-
-    return this._console;
-  },
+  get console() { return this.contentWindow.wrappedJSObject.console; },
 
   getLogCount: function HUD_getLogCount()
   {
@@ -3502,18 +3492,6 @@ HeadsUpDisplay.prototype = {
     return this.outputNode.childNodes;
   },
 
-  /**
-   * This console will accept a message, get the tab's meta-data and send
-   * properly-formatted message object to the service identifying
-   * where it came from, etc...
-   *
-   * @returns console
-   */
-  createConsole: function HUD_createConsole()
-  {
-    return new HUDConsole(this);
-  },
-
   ERRORS: {
     HUD_BOX_DOES_NOT_EXIST: "Heads Up Display does not exist",
     TAB_ID_REQUIRED: "Tab DOM ID is required",
@@ -3523,79 +3501,43 @@ HeadsUpDisplay.prototype = {
 
 
 //////////////////////////////////////////////////////////////////////////////
-// HUDConsole factory function
+// ConsoleAPIObserver
 //////////////////////////////////////////////////////////////////////////////
 
-/**
- * The console object that is attached to each contentWindow
- *
- * @param object aHeadsUpDisplay
- * @returns object
- */
-function HUDConsole(aHeadsUpDisplay)
-{
-  let hud = aHeadsUpDisplay;
-  let hudId = hud.hudId;
-  let outputNode = hud.outputNode;
-  let chromeDocument = hud.chromeDocument;
+let ConsoleAPIObserver = {
 
-  let sendToHUDService = function console_send(aLevel, aArguments)
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsIObserver]),
+
+  init: function CAO_init()
   {
-    let ts = ConsoleUtils.timestamp();
-    let messageNode = hud.makeXULNode("label");
+    Services.obs.addObserver(this, "quit-application-granted", false);
+    Services.obs.addObserver(this, "console-api-log-event", false);
+  },
 
-    let klass = "hud-msg-node hud-" + aLevel;
+  observe: function CAO_observe(aMessage, aTopic, aData)
+  {
+    if (aTopic == "console-api-log-event") {
+      aMessage = aMessage.wrappedJSObject;
+      let windowId = parseInt(aData);
+      let win = HUDService.getWindowByWindowId(windowId);
+      if (!win)
+        return;
 
-    messageNode.setAttribute("class", klass);
+      // Find the HUD ID for the topmost window
+      let hudId = HUDService.getHudIdByWindow(win.top);
+      if (!hudId)
+        return;
 
-    let argumentArray = [];
-    for (var i = 0; i < aArguments.length; i++) {
-      argumentArray.push(aArguments[i]);
+      HUDService.logConsoleAPIMessage(hudId, aMessage.level, aMessage.arguments);
+    }
+    else if (aTopic == "quit-application-granted") {
+      this.shutdown();
     }
-
-    let message = argumentArray.join(' ');
-    let timestampedMessage = ConsoleUtils.timestampString(ts) + ": " +
-      message + "\n";
-
-    messageNode.appendChild(chromeDocument.createTextNode(timestampedMessage));
-
-    // need a constructor here to properly set all attrs
-    let messageObject = {
-      logLevel: aLevel,
-      hudId: hud.hudId,
-      message: message,
-      timestamp: ts,
-      origin: "HUDConsole",
-    };
-
-    HUDService.logMessage(messageObject, hud.outputNode, messageNode);
-  }
-
-  //////////////////////////////////////////////////////////////////////////////
-  // Console API.
-  this.log = function console_log()
-  {
-    sendToHUDService("log", arguments);
   },
 
-  this.info = function console_info()
+  shutdown: function CAO_shutdown()
   {
-    sendToHUDService("info", arguments);
-  },
-
-  this.warn = function console_warn()
-  {
-    sendToHUDService("warn", arguments);
-  },
-
-  this.error = function console_error()
-  {
-    sendToHUDService("error", arguments);
-  },
-
-  this.exception = function console_exception()
-  {
-    sendToHUDService("exception", arguments);
+    Services.obs.removeObserver(this, "console-api-log-event");
   }
 };
 
@@ -4098,6 +4040,7 @@ JSTerm.prototype = {
   {
     return this.context.get().QueryInterface(Ci.nsIDOMWindowInternal);
   },
+
   /**
    * Evaluates a string in the sandbox. The string is currently wrapped by a
    * with(window) { aString } construct, see bug 574033.
@@ -4109,7 +4052,7 @@ JSTerm.prototype = {
    */
   evalInSandbox: function JST_evalInSandbox(aString)
   {
-    return Cu.evalInSandbox(aString, this.sandbox, "1.8", "HUD Console", 1);
+    return Cu.evalInSandbox(aString, this.sandbox, "1.8", "Web Console", 1);
   },
 
 
@@ -4118,7 +4061,7 @@ JSTerm.prototype = {
     // attempt to execute the content of the inputNode
     aExecuteString = aExecuteString || this.inputNode.value;
     if (!aExecuteString) {
-      this.console.log("no value to execute");
+      this.writeOutput("no value to execute");
       return;
     }
 
@@ -4138,7 +4081,7 @@ JSTerm.prototype = {
       }
     }
     catch (ex) {
-      this.console.error(ex);
+      this.writeOutput(ex);
     }
 
     this.history.push(aExecuteString);
@@ -4638,7 +4581,7 @@ JSTerm.prototype = {
       }
       matches = completion.matches;
       matchIndexToUse = 0;
-      matchOffset = completion.matchProp.length
+      matchOffset = completion.matchProp.length;
       // Store this match;
       this.lastCompletion = {
         index: 0,
@@ -4827,6 +4770,7 @@ LogMessage.prototype = {
     this.messageNode.classList.add("hud-msg-node");
     this.messageNode.classList.add("hud-" + this.level);
 
+
     if (this.activityObject.category == "CSS Parser") {
       this.messageNode.classList.add("hud-cssparser");
     }
@@ -5391,11 +5335,6 @@ HUDWindowObserver = {
     HUDService.shutdown();
   },
 
-  /**
-   * once an initial console is created set this to true so we don't
-   * over initialize
-   */
-  initialConsoleCreated: false,
 };
 
 ///////////////////////////////////////////////////////////////////////////////
@@ -5484,31 +5423,32 @@ HUDConsoleObserver = {
   {
     if (aTopic == "xpcom-shutdown") {
       Services.console.unregisterListener(this);
+      return;
     }
 
-    if (aSubject instanceof Ci.nsIScriptError) {
-      let hudIds = ConsoleUtils.getHUDIdsForScriptError(aSubject);
+    if (!(aSubject instanceof Ci.nsIScriptError))
+      return;
 
-      switch (aSubject.category) {
-        // We ignore chrome-originating errors as we only
-        // care about content.
-        case "XPConnect JavaScript":
-        case "component javascript":
-        case "chrome javascript":
-        case "chrome registration":
-        case "XBL":
-        case "XBL Prototype Handler":
-        case "XBL Content Sink":
-        case "xbl javascript":
-        case "FrameConstructor":
-          return;
+    switch (aSubject.category) {
+      // We ignore chrome-originating errors as we only
+      // care about content.
+      case "XPConnect JavaScript":
+      case "component javascript":
+      case "chrome javascript":
+      case "chrome registration":
+      case "XBL":
+      case "XBL Prototype Handler":
+      case "XBL Content Sink":
+      case "xbl javascript":
+      case "FrameConstructor":
+        return;
 
-        default:
-          for (let i = 0; i < hudIds.length; i++) {
-            HUDService.logActivity("console-listener", hudIds[i], aSubject);
-          }
-          return;
-      }
+      default:
+        let hudIds = ConsoleUtils.getHUDIdsForScriptError(aSubject);
+        for (let i = 0; i < hudIds.length; i++) {
+          HUDService.logActivity("console-listener", hudIds[i], aSubject);
+        }
+        return;
     }
   }
 };
@@ -5552,6 +5492,7 @@ try {
   var HUDService = new HUD_SERVICE();
   HUDWindowObserver.init();
   HUDConsoleObserver.init();
+  ConsoleAPIObserver.init();
 }
 catch (ex) {
   Cu.reportError("HUDService failed initialization.\n" + ex);
diff --git a/toolkit/components/console/hudservice/tests/browser/Makefile.in b/toolkit/components/console/hudservice/tests/browser/Makefile.in
index 7f0fedb88ef3..a9878776ef48 100644
--- a/toolkit/components/console/hudservice/tests/browser/Makefile.in
+++ b/toolkit/components/console/hudservice/tests/browser/Makefile.in
@@ -100,12 +100,11 @@ _BROWSER_TEST_FILES = \
 	browser_webconsole_bug_595934_message_categories.js \
 	browser_webconsole_bug_601352_scroll.js \
 	browser_webconsole_bug_592442_closing_brackets.js \
+	browser_webconsole_bug_593003_iframe_wrong_hud.js \
+	browser_webconsole_bug_613013_console_api_iframe.js \
 	head.js \
 	$(NULL)
 
-# compartment-disabled
-#	browser_webconsole_bug_593003_iframe_wrong_hud.js \
-
 _BROWSER_TEST_PAGES = \
 	test-console.html \
 	test-network.html \
@@ -135,6 +134,7 @@ _BROWSER_TEST_PAGES = \
 	test-bug-595934-svg.xhtml \
 	test-bug-597136-external-script-errors.html \
 	test-bug-597136-external-script-errors.js \
+	test-bug-613013-console-api-iframe.html \
 	$(NULL)
 
 libs:: $(_BROWSER_TEST_FILES)
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_warn_user_about_replaced_api.js b/toolkit/components/console/hudservice/tests/browser/browser_warn_user_about_replaced_api.js
index 887b1f52efba..64ed38e42935 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_warn_user_about_replaced_api.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_warn_user_about_replaced_api.js
@@ -66,8 +66,9 @@ function testWarning()
   const successMsg = "Found the warning message";
   const errMsg = "Could not find the warning message about the replaced API";
 
-  outputNode = HUDService.hudWeakReferences[hudId].get().outputNode;
-  testLogEntry(outputNode, "disabled", { success: successMsg, err: errMsg });
+  testLogEntry(hud, "disabled",
+               { success: "Found disabled console error message",
+                 err: "disable msg not found"});
 
   finishTest();
 }
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_579412_input_focus.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_579412_input_focus.js
index b0c9c5da399a..0da6025d31ac 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_579412_input_focus.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_579412_input_focus.js
@@ -55,7 +55,6 @@ function testInputFocus() {
   let hudBox = HUDService.getHeadsUpDisplay(hudId);
 
   let inputNode = hudBox.querySelector(".jsterm-input-node");
-  log("focused: " + inputNode.getAttribute("focused"));
   ok(inputNode.getAttribute("focused"), "input node is focused");
 
   finishTest();
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_580030_errors_after_page_reload.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_580030_errors_after_page_reload.js
index 5ab09546888b..ea796fb0074e 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_580030_errors_after_page_reload.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_580030_errors_after_page_reload.js
@@ -96,13 +96,12 @@ var consoleObserver = {
     const errMsg = "Could not get the error message after page reload";
 
     hudId = HUDService.displaysIndex()[0];
-    hud = HUDService.hudWeakReferences[hudId].get();
+    hud = HUDService.hudReferences[hudId];
     outputNode = hud.outputNode;
 
     executeSoon(function() {
       testLogEntry(outputNode, "fooBazBaz",
                    { success: successMsg, err: errMsg });
-
       finishTest();
     });
   }
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_580400_groups.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_580400_groups.js
index 872cc8672ae1..350c33246741 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_580400_groups.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_580400_groups.js
@@ -54,7 +54,7 @@ function testGroups() {
 
   let hudId = HUDService.displaysIndex()[0];
 
-  let HUD = HUDService.hudWeakReferences[hudId].get();
+  let HUD = HUDService.hudReferences[hudId];
   let jsterm = HUD.jsterm;
   let outputNode = jsterm.outputNode;
 
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_582201_duplicate_errors.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_582201_duplicate_errors.js
index 04a7c3527e65..14a056dc6c2d 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_582201_duplicate_errors.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_582201_duplicate_errors.js
@@ -75,7 +75,7 @@ var consoleObserver = {
     Services.console.unregisterListener(this);
 
     hudId = HUDService.displaysIndex()[0];
-    hud = HUDService.hudWeakReferences[hudId].get();
+    hud = HUDService.hudReferences[hudId];
     outputNode = hud.outputNode;
 
     executeSoon(function () {
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_583816_tab_focus.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_583816_tab_focus.js
index 201ee12461a4..abacfd0b3c9b 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_583816_tab_focus.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_583816_tab_focus.js
@@ -19,7 +19,7 @@ function tabLoad(aEvent) {
     openConsole();
 
     let hudId = HUDService.getHudIdByWindow(content);
-    HUD = HUDService.hudWeakReferences[hudId].get();
+    HUD = HUDService.hudReferences[hudId];
 
     let display = HUDService.getOutputNodeById(hudId);
     inputNode = display.querySelector(".jsterm-input-node");
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_586388_select_all.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_586388_select_all.js
index 79f9932ebaec..77216b538147 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_586388_select_all.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_586388_select_all.js
@@ -22,7 +22,7 @@ function testSelectionWhenMovingBetweenBoxes() {
   openConsole();
 
   let hudId = HUDService.displaysIndex()[0];
-  let jsterm = HUDService.hudWeakReferences[hudId].get().jsterm;
+  let jsterm = HUDService.hudReferences[hudId].jsterm;
 
   // Fill the console with some output.
   jsterm.clearOutput();
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_587617_output_copy.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_587617_output_copy.js
index da58a1f2b73f..764568f2207f 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_587617_output_copy.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_587617_output_copy.js
@@ -22,7 +22,7 @@ function tabLoaded() {
   // See bugs 574036, 586386 and 587617.
 
   hudId = HUDService.displaysIndex()[0];
-  let HUD = HUDService.hudWeakReferences[hudId].get().HUDBox;
+  let HUD = HUDService.hudReferences[hudId].HUDBox;
   let filterBox = HUD.querySelector(".hud-filter-box");
   outputNode = HUD.querySelector(".hud-output-node");
   let selection = getSelection();
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_588342_document_focus.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_588342_document_focus.js
index c1782befaa84..3cfd266eb4ed 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_588342_document_focus.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_588342_document_focus.js
@@ -25,7 +25,6 @@ function tabLoad(aEvent) {
   let DOMNodeInserted = false;
 
   document.addEventListener("DOMNodeInserted", function(aEvent) {
-    log("DOMNodeInserted");
     input = notificationBox.querySelector(".jsterm-input-node");
     if (input && !DOMNodeInserted) {
       DOMNodeInserted = true;
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_589162_css_filter.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_589162_css_filter.js
index 47c25a009f5b..011471e81b7e 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_589162_css_filter.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_589162_css_filter.js
@@ -10,14 +10,14 @@
  * ***** END LICENSE BLOCK ***** */
 
 const TEST_URI = "data:text/html,<div style='font-size:3em;" +
-  "foobarCssParser:baz'>test CSS parser filter</div>"
+  "foobarCssParser:baz'>test CSS parser filter</div>";
 
 function onContentLoaded()
 {
   browser.removeEventListener("load", arguments.callee, true);
 
   hudId = HUDService.displaysIndex()[0];
-  HUD = HUDService.hudWeakReferences[hudId].get().HUDBox;
+  HUD = HUDService.hudReferences[hudId].HUDBox;
   let filterBox = HUD.querySelector(".hud-filter-box");
   let outputNode = HUD.querySelector(".hud-output-node");
 
@@ -25,17 +25,24 @@ function onContentLoaded()
   let warningNotFound = "could not find the unknown CSS property warning";
 
   testLogEntry(outputNode, "foobarCssParser",
-    { success: warningFound, err: warningNotFound }, true);
+               { success: warningFound, err: warningNotFound }, true);
 
   HUDService.setFilterState(hudId, "cssparser", false);
+  let nodes = HUD.querySelectorAll(".hud-msg-node");
 
-  warningNotFound = "the unknown CSS property warning is not displayed, " +
-    "after filtering";
-  warningFound = "the unknown CSS property warning is still displayed, " +
-    "after filtering";
+  executeSoon(
+    function (){
+      HUDService.setFilterState(hudId, "cssparser", false);
 
-  testLogEntry(outputNode, "foobarCssParser",
-    { success: warningNotFound, err: warningFound }, true, true);
+      warningNotFound = "the unknown CSS property warning is not displayed, " +
+        "after filtering";
+      warningFound = "the unknown CSS property warning is still displayed, " +
+        "after filtering";
+
+      testLogEntry(outputNode, "foobarCssParser",
+                   { success: warningNotFound, err: warningFound }, true, true);
+    }
+  );
 
   finishTest();
 }
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_592442_closing_brackets.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_592442_closing_brackets.js
index 74ee2155835c..4f81df3fb800 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_592442_closing_brackets.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_592442_closing_brackets.js
@@ -23,7 +23,7 @@ function testExtraneousClosingBrackets(aEvent) {
 
   openConsole();
   let hudId = HUDService.displaysIndex()[0];
-  let jsterm = HUDService.hudWeakReferences[hudId].get().jsterm;
+  let jsterm = HUDService.hudReferences[hudId].jsterm;
 
   jsterm.setInputValue("document.getElementById)");
 
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_593003_iframe_wrong_hud.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_593003_iframe_wrong_hud.js
index b2d58e1049a8..add677693e3e 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_593003_iframe_wrong_hud.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_593003_iframe_wrong_hud.js
@@ -60,65 +60,37 @@ function test() {
  * @param {boolean} [aFailIfFound=false] fail the test if the string is found in
  * the output node.
  */
-function testLogEntry(aOutputNode, aMatchString, aSuccessErrObj, aOnlyVisible, aFailIfFound)
-{
-  let found = true;
-  let notfound = false;
-  let foundMsg = aSuccessErrObj.success;
-  let notfoundMsg = aSuccessErrObj.err;
-
-  if (aFailIfFound) {
-    found = false;
-    notfound = true;
-    foundMsg = aSuccessErrObj.err;
-    notfoundMsg = aSuccessErrObj.success;
-  }
-
-  let selector = ".hud-group > *";
-
-  // Skip entries that are hidden by the filter.
-  if (aOnlyVisible) {
-    selector += ":not(.hud-filtered-by-type)";
-  }
-
-  let msgs = aOutputNode.querySelectorAll(selector);
-  for (let i = 0, n = msgs.length; i < n; i++) {
-    let message = msgs[i].textContent.indexOf(aMatchString);
-    if (message > -1) {
-      ok(found, foundMsg);
-      return;
-    }
-  }
-
-  ok(notfound, notfoundMsg);
-}
 
 function tab1Loaded(aEvent) {
   browser.removeEventListener(aEvent.type, arguments.callee, true);
-
-  waitForFocus(function () {
+  browser.contentWindow.wrappedJSObject.console.log("FOO");
+  try {
     openConsole();
-    tab2 = gBrowser.addTab(TEST_DUMMY_URI);
-    gBrowser.selectedTab = tab2;
-    gBrowser.selectedBrowser.addEventListener("load", tab2Loaded, true);
-  }, content);
+  }
+  catch (ex) {
+    log(ex);
+    log(ex.stack);
+  }
+
+  tab2 = gBrowser.addTab(TEST_DUMMY_URI);
+  gBrowser.selectedTab = tab2;
+  gBrowser.selectedBrowser.addEventListener("load", tab2Loaded, true);
 }
 
 function tab2Loaded(aEvent) {
   tab2.linkedBrowser.removeEventListener(aEvent.type, arguments.callee, true);
 
-  waitForFocus(function () {
-    HUDService.activateHUDForContext(gBrowser.selectedTab);
+  HUDService.activateHUDForContext(gBrowser.selectedTab);
 
-    tab1.linkedBrowser.addEventListener("load", tab1Reloaded, true);
-    tab1.linkedBrowser.contentWindow.location.reload();
-  }, content);
+  tab1.linkedBrowser.addEventListener("load", tab1Reloaded, true);
+  tab1.linkedBrowser.contentWindow.location.reload();
 }
 
 function tab1Reloaded(aEvent) {
   tab1.linkedBrowser.removeEventListener(aEvent.type, arguments.callee, true);
 
   let hudId1 = HUDService.getHudIdByWindow(tab1.linkedBrowser.contentWindow);
+
   let display1 = HUDService.getOutputNodeById(hudId1);
   let outputNode1 = display1.querySelector(".hud-output-node");
 
@@ -126,7 +98,7 @@ function tab1Reloaded(aEvent) {
   const errorMsg1 = "Failed to find the iframe network request in tab1";
 
   testLogEntry(outputNode1, TEST_IFRAME_URI,
-    { success: successMsg1, err: errorMsg1}, true);
+               { success: successMsg1, err: errorMsg1}, true);
 
   let hudId2 = HUDService.getHudIdByWindow(tab2.linkedBrowser.contentWindow);
   let display2 = HUDService.getOutputNodeById(hudId2);
@@ -134,7 +106,7 @@ function tab1Reloaded(aEvent) {
 
   isnot(display1, display2, "the two HUD displays must be different");
   isnot(outputNode1, outputNode2,
-    "the two HUD outputNodes must be different");
+        "the two HUD outputNodes must be different");
 
   const successMsg2 = "The iframe network request is not in tab2";
   const errorMsg2 = "Found the iframe network request in tab2";
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_594477_clickable_output.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_594477_clickable_output.js
index ef36f646c177..efc614c61921 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_594477_clickable_output.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_594477_clickable_output.js
@@ -9,6 +9,7 @@
  * ***** END LICENSE BLOCK ***** */
 
 const TEST_URI = "http://example.com/browser/toolkit/components/console/hudservice/tests/browser/test-console.html";
+let HUD;
 
 let outputItem;
 
@@ -17,8 +18,8 @@ function tabLoad1(aEvent) {
 
   openConsole();
 
-  let hudId = HUDService.getHudIdByWindow(content);
-  HUD = HUDService.hudWeakReferences[hudId].get();
+  let hudId = HUDService.getHudIdByWindow(browser.contentWindow);
+  HUD = HUDService.hudReferences[hudId];
 
   let display = HUDService.getOutputNodeById(hudId);
   outputNode = display.querySelector(".hud-output-node");
@@ -26,7 +27,8 @@ function tabLoad1(aEvent) {
   browser.addEventListener("load", tabLoad2, true);
 
   // Reload so we get some output in the console.
-  content.location.reload();
+  browser.contentWindow.location.reload();
+  log(document);
 }
 
 function tabLoad2(aEvent) {
@@ -34,7 +36,6 @@ function tabLoad2(aEvent) {
 
   outputItem = outputNode.querySelector(".hud-network");
   ok(outputItem, "found a network message");
-
   document.addEventListener("popupshown", networkPanelShown, false);
 
   // Send the mousedown and click events such that the network panel opens.
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_594497_history_arrow_keys.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_594497_history_arrow_keys.js
index eed470be2061..b09d0db9bf0e 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_594497_history_arrow_keys.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_594497_history_arrow_keys.js
@@ -19,7 +19,7 @@ function tabLoad(aEvent) {
     openConsole();
 
     let hudId = HUDService.getHudIdByWindow(content);
-    HUD = HUDService.hudWeakReferences[hudId].get();
+    HUD = HUDService.hudReferences[hudId];
 
     let display = HUDService.getOutputNodeById(hudId);
     inputNode = display.querySelector(".jsterm-input-node");
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_595350_multiple_windows_and_tabs.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_595350_multiple_windows_and_tabs.js
index dc7fb2ea3e17..5d00770ae917 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_595350_multiple_windows_and_tabs.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_595350_multiple_windows_and_tabs.js
@@ -58,7 +58,7 @@ function performTest() {
     HUDService.activateHUDForContext(tab);
     let hudId = HUDService.getHudIdByWindow(tab.linkedBrowser.contentWindow);
     ok(hudId, "HUD is open for tab " + i);
-    let HUD = HUDService.hudWeakReferences[hudId].get();
+    let HUD = HUDService.hudReferences[hudId];
     HUD.console.log("message for tab " + i);
   }
 
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_595934_message_categories.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_595934_message_categories.js
index 3fe606091ba3..904e7063240b 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_595934_message_categories.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_595934_message_categories.js
@@ -80,7 +80,7 @@ function tabLoad(aEvent) {
   openConsole();
 
   let hudId = HUDService.getHudIdByWindow(content);
-  hud = HUDService.hudWeakReferences[hudId].get();
+  hud = HUDService.hudReferences[hudId];
 
   Services.console.registerListener(TestObserver);
 
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_601352_scroll.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_601352_scroll.js
index c3994d7b4134..8d483ef5e05c 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_601352_scroll.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_601352_scroll.js
@@ -14,20 +14,20 @@ function tabLoad(aEvent) {
   openConsole();
 
   let hudId = HUDService.getHudIdByWindow(content);
-  let HUD = HUDService.hudWeakReferences[hudId].get();
+  let HUD = HUDService.hudReferences[hudId];
 
   let longMessage = "";
-  for (let i = 0; i < 20; i++) {
+  for (let i = 0; i < 50; i++) {
     longMessage += "LongNonwrappingMessage";
   }
 
-  for (let i = 0; i < 100; i++) {
+  for (let i = 0; i < 50; i++) {
     HUD.console.log("test message " + i);
   }
 
   HUD.console.log(longMessage);
 
-  for (let i = 0; i < 100; i++) {
+  for (let i = 0; i < 50; i++) {
     HUD.console.log("test message " + i);
   }
 
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_613013_console_api_iframe.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_613013_console_api_iframe.js
new file mode 100644
index 000000000000..0bbe1edcb88f
--- /dev/null
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_613013_console_api_iframe.js
@@ -0,0 +1,49 @@
+/* vim:set ts=2 sw=2 sts=2 et: */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ *
+ * Contributor(s):
+ *  Mihai Șucan <mihai.sucan@gmail.com>
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+const TEST_URI = "http://example.com/browser/toolkit/components/console/hudservice/tests/browser/test-bug-613013-console-api-iframe.html";
+
+let TestObserver = {
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsIObserver]),
+
+  observe: function test_observe(aMessage, aTopic, aData)
+  {
+    if (aTopic == "console-api-log-event") {
+      executeSoon(performTest);
+    }
+  }
+};
+
+function tabLoad(aEvent) {
+  browser.removeEventListener(aEvent.type, arguments.callee, true);
+
+  openConsole();
+
+  let hudId = HUDService.getHudIdByWindow(content);
+  hud = HUDService.hudReferences[hudId];
+
+  Services.obs.addObserver(TestObserver, "console-api-log-event", false);
+  content.location.reload();
+}
+
+function performTest() {
+  isnot(hud.outputNode.textContent.indexOf("foobarBug613013"), -1,
+        "console.log() message found");
+
+  Services.obs.removeObserver(TestObserver, "console-api-log-event");
+  TestObserver = null;
+  finishTest();
+}
+
+function test() {
+  addTab(TEST_URI);
+  browser.addEventListener("load", tabLoad, true);
+}
+
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_chrome.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_chrome.js
index 17c401f2d474..a496b2236961 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_chrome.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_chrome.js
@@ -52,7 +52,7 @@ function testChrome() {
   openConsole();
 
   hudId = HUDService.displaysIndex()[0];
-  hud = HUDService.hudWeakReferences[hudId].get();
+  hud = HUDService.hudReferences[hudId];
   ok(hud, "we have a console");
   
   hudBox = HUDService.getHeadsUpDisplay(hudId);
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_completion.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_completion.js
index da130e230f9c..6c1097de4855 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_completion.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_completion.js
@@ -54,7 +54,7 @@ function testCompletion() {
 
   hudId = HUDService.displaysIndex()[0];
 
-  var HUD = HUDService.hudWeakReferences[hudId].get();
+  var HUD = HUDService.hudReferences[hudId];
   var jsterm = HUD.jsterm;
   var input = jsterm.inputNode;
 
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_console_logging_api.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_console_logging_api.js
index e7109a4615e0..41489bc08644 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_console_logging_api.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_console_logging_api.js
@@ -56,7 +56,6 @@ function onLoad() {
   testConsoleLoggingAPI("info");
   testConsoleLoggingAPI("warn");
   testConsoleLoggingAPI("error");
-  testConsoleLoggingAPI("exception");
 
   finishTest();
 }
@@ -69,26 +68,37 @@ function testConsoleLoggingAPI(aMethod) {
 
   HUDService.clearDisplay(hudId);
 
-  setStringFilter("foo");
+  setStringFilter(hudId, "foo");
   console[aMethod]("foo-bar-baz");
   console[aMethod]("bar-baz");
-  var count = outputNode.querySelectorAll(".hud-filtered-by-string").length;
-  ok(count == 1, "1 hidden " + aMethod  + " node found");
+
+  var nodes = outputNode.querySelectorAll(".hud-filtered-by-string");
+
+  is(nodes.length, 1, "1 hidden " + aMethod  + " node found (via classList)");
+
   HUDService.clearDisplay(hudId);
 
   // now toggle the current method off - make sure no visible message
-  // nodes are logged
-  setStringFilter("");
+
+  // TODO: move all filtering tests into a separate test file: see bug 608135
+  setStringFilter(hudId, "");
   HUDService.setFilterState(hudId, aMethod, false);
   console[aMethod]("foo-bar-baz");
-  count = outputNode.querySelectorAll(".hud-filtered-by-type").length;
-  is(count, 1, aMethod + " logging turned off, 1 message hidden");
-  HUDService.clearDisplay(hudId);
-  setStringFilter("");
+  nodes = outputNode.querySelectorAll("label");
+
+  is(nodes.length, 1,  aMethod + " logging turned off, 1 message hidden");
 
-  // test for multiple arguments.
   HUDService.clearDisplay(hudId);
   HUDService.setFilterState(hudId, aMethod, true);
+  console[aMethod]("foo-bar-baz");
+  nodes = outputNode.querySelectorAll("label");
+
+  is(nodes.length, 1, aMethod + " logging turned on, 1 message shown");
+
+  HUDService.clearDisplay(hudId);
+  setStringFilter(hudId, "");
+
+  // test for multiple arguments.
   console[aMethod]("foo", "bar");
 
   let node = outputNode.querySelectorAll(".hud-msg-node")[0];
@@ -96,10 +106,9 @@ function testConsoleLoggingAPI(aMethod) {
     "Emitted both console arguments");
 }
 
-function setStringFilter(aValue) {
-  let hudId = HUDService.displaysIndex()[0];
-  let hudBox = HUDService.getHeadsUpDisplay(hudId);
+function setStringFilter(aId, aValue) {
+  let hudBox = HUDService.getHeadsUpDisplay(aId);
   hudBox.querySelector(".hud-filter-box").value = aValue;
-  HUDService.adjustVisibilityOnSearchStringChange(hudId, aValue);
+  HUDService.adjustVisibilityOnSearchStringChange(aId, aValue);
 }
 
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_consoleonpage.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_consoleonpage.js
index ebf3c4874edd..dc88ace59b30 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_consoleonpage.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_consoleonpage.js
@@ -26,13 +26,12 @@ function testOpenWebConsole()
   is(HUDService.displaysIndex().length, 1, "WebConsole was opened");
 
   hudId = HUDService.displaysIndex()[0];
-  hud = HUDService.hudWeakReferences[hudId].get();
+  hud = HUDService.hudReferences[hudId];
 
   testOwnConsole();
 }
 
 function testConsoleOnPage(console) {
-  // let console = browser.contentWindow.wrappedJSObject.console;
   isnot(console, undefined, "Console object defined on page");
   is(console.foo, "bar", "Custom console is not overwritten");
 }
@@ -47,41 +46,5 @@ function testOwnConsole()
   // Check that the console object is set on the jsterm object although there
   // is no console object added to the page.
   ok(hud.jsterm.console, "JSTerm console is defined");
-  ok(hud.jsterm.console === hud._console, "JSTerm console is same as HUD console");
-
-  let iframe =
-    browser.contentWindow.document.querySelector("iframe");
-
-  function consoleTester()
-  {
-    testIFrameConsole(iframe);
-  }
-
-  iframe.contentWindow.
-    addEventListener("load", consoleTester ,false);
-
-  iframe.contentWindow.document.location = "http://example.com/";
-
-  function testIFrameConsole(iFrame)
-  {
-    iFrame.contentWindow.removeEventListener("load", consoleTester, true);
-
-    // Test the console in the iFrame.
-    let consoleIFrame = iFrame.wrappedJSObject.contentWindow.console;
-    // TODO: Fix this test. Not sure what it is intending, and this will
-    // change drastically once the lazy console lands
-    // ok(browser.contentWindow.wrappedJSObject.console === hud._console, "Console on the page is hud console");
-
-    // Close the hud and see which console is still around.
-    HUDService.deactivateHUDForContext(tab);
-
-    executeSoon(function () {
-      consoleIFrame = iFrame.contentWindow.console;
-      is(consoleIFrame, undefined, "Console object was removed from iFrame");
-      testConsoleOnPage(browser.contentWindow.wrappedJSObject.console);
-      finishTest();
-  });
-}
-
-  browser.contentWindow.wrappedJSObject.loadIFrame();
+  finishTest();
 }
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_execution_scope.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_execution_scope.js
index e407edf44269..c1b31d4a78f8 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_execution_scope.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_execution_scope.js
@@ -55,14 +55,13 @@ function testExecutionScope() {
 
   let hudId = HUDService.displaysIndex()[0];
 
-  let HUD = HUDService.hudWeakReferences[hudId].get();
+  let HUD = HUDService.hudReferences[hudId];
   let jsterm = HUD.jsterm;
 
   jsterm.clearOutput();
   jsterm.execute("location;");
 
   let nodes = jsterm.outputNode.querySelectorAll(".hud-msg-node");
-  log(nodes[0].textContent);
   is(nodes.length, 1, "Three children in output");
 
   is(/location;/.test(nodes[0].textContent), true,
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_history.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_history.js
index d43f149353b6..28fecdf9a422 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_history.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_history.js
@@ -57,7 +57,7 @@ function testHistory() {
   openConsole();
 
   hudId = HUDService.displaysIndex()[0];
-  let HUD = HUDService.hudWeakReferences[hudId].get();
+  let HUD = HUDService.hudReferences[hudId];
   let jsterm = HUD.jsterm;
   let input = jsterm.inputNode;
 
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_hud_getters.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_hud_getters.js
index e8771232ffa9..f7362ca1210a 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_hud_getters.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_hud_getters.js
@@ -38,7 +38,7 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
-// Tests that the HUD can be accessed via the HUD weak references in the HUD
+// Tests that the HUD can be accessed via the HUD references in the HUD
 // service.
 
 const TEST_URI = "http://example.com/browser/toolkit/components/console/hudservice/tests/browser/test-console.html";
@@ -55,7 +55,7 @@ function testHUDGetters() {
 
   hudId = HUDService.displaysIndex()[0];
 
-  var HUD = HUDService.hudWeakReferences[hudId].get();
+  var HUD = HUDService.hudReferences[hudId];
   var jsterm = HUD.jsterm;
   var klass = jsterm.inputNode.getAttribute("class");
   ok(klass == "jsterm-input-node", "We have the input node.");
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_js_input_and_output_styling.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_js_input_and_output_styling.js
index 230bf780aeb7..b7419488e48f 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_js_input_and_output_styling.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_js_input_and_output_styling.js
@@ -57,7 +57,7 @@ function testJSInputAndOutputStyling() {
 
   hudId = HUDService.displaysIndex()[0];
 
-  let jsterm = HUDService.hudWeakReferences[hudId].get().jsterm;
+  let jsterm = HUDService.hudReferences[hudId].jsterm;
 
   jsterm.clearOutput();
   jsterm.execute("2 + 2");
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_js_input_expansion.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_js_input_expansion.js
index bac8f49f91e1..ce5e24880e66 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_js_input_expansion.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_js_input_expansion.js
@@ -55,7 +55,7 @@ function testJSInputExpansion() {
 
   hudId = HUDService.displaysIndex()[0];
 
-  let HUD = HUDService.hudWeakReferences[hudId].get();
+  let HUD = HUDService.hudReferences[hudId];
   let jsterm = HUD.jsterm;
   let input = jsterm.inputNode;
   input.focus();
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_jsterm.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_jsterm.js
index 3c5fad525e2a..84133bb33ab0 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_jsterm.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_jsterm.js
@@ -62,7 +62,7 @@ function testJSTerm()
 
   hudId = HUDService.displaysIndex()[0];
   let hudBox = HUDService.getHeadsUpDisplay(hudId);
-  hud = HUDService.hudWeakReferences[hudId].get();
+  hud = HUDService.hudReferences[hudId];
   jsterm = hud.jsterm;
   let outputNode = hudBox.querySelector(".hud-output-node");
 
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_null_and_undefined_output.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_null_and_undefined_output.js
index 3f6fd8efdb55..0dcc7ef866ee 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_null_and_undefined_output.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_null_and_undefined_output.js
@@ -57,7 +57,7 @@ function testNullAndUndefinedOutput() {
 
   hudId = HUDService.displaysIndex()[0];
 
-  let HUD = HUDService.hudWeakReferences[hudId].get();
+  let HUD = HUDService.hudReferences[hudId];
   let jsterm = HUD.jsterm;
   outputNode = jsterm.outputNode;
 
@@ -66,7 +66,6 @@ function testNullAndUndefinedOutput() {
 
   let nodes = outputNode.querySelectorAll(".hud-msg-node");
   is(nodes.length, 2, "2 nodes in output");
-  log(nodes[1].textContent.toString());
   ok(nodes[1].textContent.indexOf("null") > -1, "'null' printed to output");
 
   jsterm.clearOutput();
@@ -74,7 +73,6 @@ function testNullAndUndefinedOutput() {
 
   nodes = outputNode.querySelectorAll(".hud-msg-node");
   is(nodes.length, 2, "2 nodes in output");
-  log(nodes[1].textContent.toString());
   ok(nodes[1].textContent.indexOf("undefined") > -1, "'undefined' printed to output");
 
   jsterm.clearOutput();
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_output_order.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_output_order.js
index aeecf00ba9b2..31f00a2a07e3 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_output_order.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_output_order.js
@@ -55,7 +55,7 @@ function testOutputOrder() {
 
   hudId = HUDService.displaysIndex()[0];
 
-  let HUD = HUDService.hudWeakReferences[hudId].get();
+  let HUD = HUDService.hudReferences[hudId];
   let jsterm = HUD.jsterm;
   outputNode = jsterm.outputNode;
 
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_property_panel.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_property_panel.js
index 904c2e16f31a..668173e28c9e 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_property_panel.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_property_panel.js
@@ -55,7 +55,7 @@ function testPropertyPanel() {
 
   hudId = HUDService.displaysIndex()[0];
 
-  var HUD = HUDService.hudWeakReferences[hudId].get();
+  var HUD = HUDService.hudReferences[hudId];
   var jsterm = HUD.jsterm;
 
   let propPanel = jsterm.openPropertyPanel("Test", [
diff --git a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_property_provider.js b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_property_provider.js
index 4b11122d604c..01b2e9b1c229 100644
--- a/toolkit/components/console/hudservice/tests/browser/browser_webconsole_property_provider.js
+++ b/toolkit/components/console/hudservice/tests/browser/browser_webconsole_property_provider.js
@@ -56,7 +56,7 @@ function testPropertyProvider() {
 
   hudId = HUDService.displaysIndex()[0];
 
-  var HUD = HUDService.hudWeakReferences[hudId].get();
+  var HUD = HUDService.hudReferences[hudId];
   var jsterm = HUD.jsterm;
   var context = jsterm.sandbox.window;
   var completion;
diff --git a/toolkit/components/console/hudservice/tests/browser/head.js b/toolkit/components/console/hudservice/tests/browser/head.js
index da9a7e6c5169..c1369d495b8d 100644
--- a/toolkit/components/console/hudservice/tests/browser/head.js
+++ b/toolkit/components/console/hudservice/tests/browser/head.js
@@ -58,6 +58,18 @@ function log(aMsg)
   dump("*** WebConsoleTest: " + aMsg + "\n");
 }
 
+function pprint(aObj)
+{
+  for (let prop in aObj) {
+    if (typeof aObj[prop] == "function") {
+      log("function " + prop);
+    }
+    else {
+      log(prop + ": " + aObj[prop]);
+    }
+  }
+}
+
 let tab, browser, hudId, hud, hudBox, filterBox, outputNode, cs;
 
 let win = gBrowser.selectedBrowser;
@@ -93,12 +105,11 @@ function testLogEntry(aOutputNode, aMatchString, aSuccessErrObj, aOnlyVisible,
   if (aFailIfFound) {
     found = false;
     notfound = true;
-    foundMsg = aSuccessErrObj.err;
-    notfoundMsg = aSuccessErrObj.success;
+    foundMsg = aSuccessErrObj.success;
+    notfoundMsg = aSuccessErrObj.err;
   }
 
-  let selector = ".hud-group > *";
-
+  let selector = ".hud-msg-node";
   // Skip entries that are hidden by the filter.
   if (aOnlyVisible) {
     selector += ":not(.hud-filtered-by-type)";
@@ -107,12 +118,11 @@ function testLogEntry(aOutputNode, aMatchString, aSuccessErrObj, aOnlyVisible,
   let msgs = aOutputNode.querySelectorAll(selector);
   for (let i = 0, n = msgs.length; i < n; i++) {
     let message = msgs[i].textContent.indexOf(aMatchString);
-  if (message > -1) {
+    if (message > -1) {
       ok(found, foundMsg);
-    return;
+      return;
+    }
   }
-  }
-
   ok(notfound, notfoundMsg);
 }
 
diff --git a/toolkit/components/console/hudservice/tests/browser/test-bug-613013-console-api-iframe.html b/toolkit/components/console/hudservice/tests/browser/test-bug-613013-console-api-iframe.html
new file mode 100644
index 000000000000..d17c0342da38
--- /dev/null
+++ b/toolkit/components/console/hudservice/tests/browser/test-bug-613013-console-api-iframe.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <title>test for bug 613013</title>
+    <!-- Any copyright is dedicated to the Public Domain.
+         http://creativecommons.org/publicdomain/zero/1.0/ -->
+  </head>
+  <body>
+    <p>test for bug 613013</p>
+    <script type="text/javascript"><!--
+      (function () {
+        var iframe = document.createElement('iframe');
+        iframe.src = 'data:text/html,little iframe';
+        document.body.appendChild(iframe);
+
+        console.log("foobarBug613013");
+      })();
+    // --></script>
+  </body>
+</html>
diff --git a/toolkit/components/console/hudservice/tests/browser/test-console.html b/toolkit/components/console/hudservice/tests/browser/test-console.html
index 64a605f25c7c..134963dabb93 100644
--- a/toolkit/components/console/hudservice/tests/browser/test-console.html
+++ b/toolkit/components/console/hudservice/tests/browser/test-console.html
@@ -2,7 +2,6 @@
 <html dir="ltr" xml:lang="en-US" lang="en-US"><head>
     <title>Console test</title>
     <script type="text/javascript">
-      dump("i am dumping this");
       function test() {
         var str = "Dolske Digs Bacon, Now and Forevermore."
         for (var i=0; i < 5; i++) {
diff --git a/toolkit/components/console/hudservice/tests/browser/test-own-console.html b/toolkit/components/console/hudservice/tests/browser/test-own-console.html
index b79675764c48..4934fd4fd90b 100644
--- a/toolkit/components/console/hudservice/tests/browser/test-own-console.html
+++ b/toolkit/components/console/hudservice/tests/browser/test-own-console.html
@@ -2,15 +2,16 @@
 <html dir="ltr" xml:lang="en-US" lang="en-US">
 <head>
 <script>
-  window.console = {
+  var _console = {
     foo: "bar"
   }
 
-  function loadIFrame(aCallback) {
+  window.console = _console;
+
+  function loadIFrame() {
     var iframe = document.body.querySelector("iframe");
     iframe.addEventListener("load", function() {
       iframe.removeEventListener("load", arguments.callee, true);
-      aCallback(iframe);
     }, true);
 
     iframe.setAttribute("src", "test-console.html");
diff --git a/toolkit/components/ctypes/tests/Makefile.in b/toolkit/components/ctypes/tests/Makefile.in
index dd8a4a46e9a2..a4e179149a67 100644
--- a/toolkit/components/ctypes/tests/Makefile.in
+++ b/toolkit/components/ctypes/tests/Makefile.in
@@ -84,6 +84,7 @@ libs:: unit/test_jsctypes.js.in
 	$(PYTHON) $(MOZILLA_DIR)/config/Preprocessor.py $(DEFINES) $(ACDEFINES) \
 	  $^ > $(xpctestdir)/test_jsctypes.js
 	$(TEST_INSTALLER) $(SHARED_LIBRARY) $(xpctestdir)
+	$(TEST_INSTALLER) $(SHARED_LIBRARY) $(DEPTH)/_tests/testing/mochitest/chrome/libraries
 	$(TEST_INSTALLER) $(xpctestdir)/test_jsctypes.js $(chrometestdir)
 	$(TEST_INSTALLER) $(xpctestdir)/$(SHARED_LIBRARY) $(chrometestdir)
 	$(RM) $(xpctestdir)/test_jsctypes.js.in
diff --git a/toolkit/components/downloads/test/unit/head_download_manager.js b/toolkit/components/downloads/test/unit/head_download_manager.js
index 8f9b7eea5c28..bde77eafcc6f 100644
--- a/toolkit/components/downloads/test/unit/head_download_manager.js
+++ b/toolkit/components/downloads/test/unit/head_download_manager.js
@@ -173,6 +173,10 @@ function getDownloadListener()
   };
 }
 
+XPCOMUtils.defineLazyGetter(this, "Services", function() {
+  Cu.import("resource://gre/modules/Services.jsm");
+  return Services;
+});
+
 // Disable alert service notifications
-let ps = Cc['@mozilla.org/preferences-service;1'].getService(Ci.nsIPrefBranch);
-ps.setBoolPref("browser.download.manager.showAlertOnComplete", false);
+Services.prefs.setBoolPref("browser.download.manager.showAlertOnComplete", false);
diff --git a/toolkit/components/downloads/test/unit/test_history_expiration.js b/toolkit/components/downloads/test/unit/test_history_expiration.js
index 502547202366..5d1c89ffb987 100644
--- a/toolkit/components/downloads/test/unit/test_history_expiration.js
+++ b/toolkit/components/downloads/test/unit/test_history_expiration.js
@@ -46,6 +46,9 @@ function run_test()
   if (!("@mozilla.org/browser/nav-history-service;1" in Cc))
     return;
 
+  // Ensure places is enabled.
+  Services.prefs.setBoolPref("places.history.enabled", true);
+
   let dm = Cc["@mozilla.org/download-manager;1"].
            getService(Ci.nsIDownloadManager);
   let db = dm.DBConnection;
@@ -119,9 +122,7 @@ function run_test()
   obs.addObserver(testObs, kRemoveTopic, false);
 
   // Set expiration stuff to 0 to make the download expire
-  let prefs = Cc["@mozilla.org/preferences-service;1"].
-              getService(Ci.nsIPrefBranch);
-  prefs.setIntPref("places.history.expiration.max_pages", 0);
+  Services.prefs.setIntPref("places.history.expiration.max_pages", 0);
 
   // Force a history expiration.
   let expire = Cc["@mozilla.org/places/expiration;1"].getService(Ci.nsIObserver);
diff --git a/toolkit/components/places/src/nsNavHistoryResult.cpp b/toolkit/components/places/src/nsNavHistoryResult.cpp
index 1b7df4e15b8a..b7e85e0ab9cd 100644
--- a/toolkit/components/places/src/nsNavHistoryResult.cpp
+++ b/toolkit/components/places/src/nsNavHistoryResult.cpp
@@ -4627,11 +4627,15 @@ nsNavHistoryResult::requestRefresh(nsNavHistoryContainerResultNode* aContainer)
 NS_IMETHODIMP
 nsNavHistoryResult::OnBeginUpdateBatch()
 {
-  mBatchInProgress = PR_TRUE;
-  ENUMERATE_HISTORY_OBSERVERS(OnBeginUpdateBatch());
-  ENUMERATE_ALL_BOOKMARKS_OBSERVERS(OnBeginUpdateBatch());
+  // Since we could be observing both history and bookmarks, it's possible both
+  // notify the batch.  We can safely ignore nested calls.
+  if (!mBatchInProgress) {
+    mBatchInProgress = PR_TRUE;
+    ENUMERATE_HISTORY_OBSERVERS(OnBeginUpdateBatch());
+    ENUMERATE_ALL_BOOKMARKS_OBSERVERS(OnBeginUpdateBatch());
 
-  NOTIFY_RESULT_OBSERVERS(this, Batching(PR_TRUE));
+    NOTIFY_RESULT_OBSERVERS(this, Batching(PR_TRUE));
+  }
 
   return NS_OK;
 }
@@ -4640,6 +4644,11 @@ nsNavHistoryResult::OnBeginUpdateBatch()
 NS_IMETHODIMP
 nsNavHistoryResult::OnEndUpdateBatch()
 {
+  // Since we could be observing both history and bookmarks, it's possible both
+  // notify the batch.  We can safely ignore nested calls.
+  // Notice it's possible we are notified OnEndUpdateBatch more times than
+  // onBeginUpdateBatch, since the result could be created in the middle of
+  // nested batches.
   if (mBatchInProgress) {
     ENUMERATE_HISTORY_OBSERVERS(OnEndUpdateBatch());
     ENUMERATE_ALL_BOOKMARKS_OBSERVERS(OnEndUpdateBatch());
@@ -4651,9 +4660,7 @@ nsNavHistoryResult::OnEndUpdateBatch()
     NOTIFY_REFRESH_PARTICIPANTS();
     NOTIFY_RESULT_OBSERVERS(this, Batching(PR_FALSE));
   }
-  else {
-    NS_WARNING("EndUpdateBatch without a begin");
-  }
+
   return NS_OK;
 }
 
diff --git a/toolkit/components/places/tests/head_common.js b/toolkit/components/places/tests/head_common.js
index 6fc816669435..c6964ecb4aab 100644
--- a/toolkit/components/places/tests/head_common.js
+++ b/toolkit/components/places/tests/head_common.js
@@ -77,6 +77,8 @@ function LOG(aMsg) {
 
 let gTestDir = do_get_cwd();
 
+// Ensure history is enabled.
+Services.prefs.setBoolPref("places.history.enabled", true);
 
 // Initialize profile.
 let gProfD = do_get_profile();
diff --git a/toolkit/components/places/tests/unit/test_doSetAndLoadFaviconForPage.js b/toolkit/components/places/tests/unit/test_doSetAndLoadFaviconForPage.js
index f8d5460d9861..9011b110bb16 100644
--- a/toolkit/components/places/tests/unit/test_doSetAndLoadFaviconForPage.js
+++ b/toolkit/components/places/tests/unit/test_doSetAndLoadFaviconForPage.js
@@ -109,9 +109,7 @@ var tests = [
 
       iconsvc.setAndLoadFaviconForPage(this.pageURI, this.favicon.uri, true);
 
-      try {
-        prefs.clearUserPref("places.history.enabled");
-      } catch (ex) {}
+      prefs.setBoolPref("places.history.enabled", true);
     },
     check: function check5() {
       checkAddSucceeded(this.pageURI, this.favicon.mimetype, this.favicon.data);
diff --git a/toolkit/components/places/tests/unit/test_doSetAndLoadFaviconForPage_failures.js b/toolkit/components/places/tests/unit/test_doSetAndLoadFaviconForPage_failures.js
index d1ea2d67f866..dd4bb1ea6292 100644
--- a/toolkit/components/places/tests/unit/test_doSetAndLoadFaviconForPage_failures.js
+++ b/toolkit/components/places/tests/unit/test_doSetAndLoadFaviconForPage_failures.js
@@ -85,9 +85,7 @@ let tests = [
       PlacesUtils.favicons.setAndLoadFaviconForPage(this.pageURI, favicons[0].uri, true);
     },
     clean: function clean2() {
-      try {
-        Services.prefs.clearUserPref("places.history.enabled");
-      } catch (ex) {}
+      Services.prefs.setBoolPref("places.history.enabled", true);
     }
   },
 
diff --git a/toolkit/components/places/tests/unit/test_nsINavHistoryViewer.js b/toolkit/components/places/tests/unit/test_nsINavHistoryViewer.js
index 35347bce8a1a..a09c12ed18dd 100644
--- a/toolkit/components/places/tests/unit/test_nsINavHistoryViewer.js
+++ b/toolkit/components/places/tests/unit/test_nsINavHistoryViewer.js
@@ -112,6 +112,7 @@ var resultObserver = {
   },
   inBatchMode: false,
   batching: function(aToggleMode) {
+    do_check_neq(this.inBatchMode, aToggleMode);
     this.inBatchMode = aToggleMode;
   },
   result: null,
@@ -129,10 +130,18 @@ var resultObserver = {
   }
 };
 
+var testURI = uri("http://mozilla.com");
+
 // main
 function run_test() {
+  check_history_query();
+  resultObserver.reset();
+  check_bookmarks_query();
+  resultObserver.reset();
+  check_mixed_query();
+}
 
-  // history query
+function check_history_query() {
   var options = histsvc.getNewQueryOptions();
   options.sortingMode = options.SORT_BY_DATE_DESCENDING;
   options.resultType = options.RESULTS_AS_VISIT;
@@ -147,7 +156,6 @@ function run_test() {
 
   // nsINavHistoryResultObserver.nodeInserted
   // add a visit
-  var testURI = uri("http://mozilla.com");
   add_visit(testURI);
   do_check_eq(testURI.spec, resultObserver.insertedNode.uri);
 
@@ -197,12 +205,9 @@ function run_test() {
   root.containerOpen = false;
   do_check_eq(resultObserver.closedContainer, resultObserver.openedContainer);
   result.removeObserver(resultObserver);
+}
 
-  // bookmarks query
-  
-  // Reset the result observer.
-  resultObserver.reset();
-
+function check_bookmarks_query() {
   var options = histsvc.getNewQueryOptions();
   var query = histsvc.getNewQuery();
   query.setFolders([bmsvc.bookmarksMenuFolder], 1);
@@ -268,3 +273,36 @@ function run_test() {
   do_check_eq(resultObserver.closedContainer, resultObserver.openedContainer);
   result.removeObserver(resultObserver);
 }
+
+function check_mixed_query() {
+  var options = histsvc.getNewQueryOptions();
+  var query = histsvc.getNewQuery();
+  query.onlyBookmarked = true;
+  var result = histsvc.executeQuery(query, options);
+  result.addObserver(resultObserver, false);
+  var root = result.root;
+  root.containerOpen = true;
+
+  // nsINavHistoryResultObserver.containerOpened
+  do_check_neq(resultObserver.openedContainer, null);
+
+  // nsINavHistoryResultObserver.batching
+  do_check_false(resultObserver.inBatchMode);
+  histsvc.runInBatchMode({
+    runBatched: function (aUserData) {
+      do_check_true(resultObserver.inBatchMode);
+    }
+  }, null);
+  do_check_false(resultObserver.inBatchMode);
+  bmsvc.runInBatchMode({
+    runBatched: function (aUserData) {
+      do_check_true(resultObserver.inBatchMode);
+    }
+  }, null);
+  do_check_false(resultObserver.inBatchMode);
+
+  // nsINavHistoryResultObserver.containerClosed
+  root.containerOpen = false;
+  do_check_eq(resultObserver.closedContainer, resultObserver.openedContainer);
+  result.removeObserver(resultObserver);
+}
diff --git a/toolkit/components/prompts/test/Makefile.in b/toolkit/components/prompts/test/Makefile.in
index f71dedae3e97..6efd221fff66 100644
--- a/toolkit/components/prompts/test/Makefile.in
+++ b/toolkit/components/prompts/test/Makefile.in
@@ -48,6 +48,7 @@ MODULE = test_prompter
 
 # Mochitest tests
 MOCHI_TESTS = \
+    test_modal_select.html \
     test_modal_prompts.html \
     $(NULL)
 
diff --git a/toolkit/components/prompts/test/prompt_common.js b/toolkit/components/prompts/test/prompt_common.js
index 3c46821bf37b..1ec450abe1b8 100644
--- a/toolkit/components/prompts/test/prompt_common.js
+++ b/toolkit/components/prompts/test/prompt_common.js
@@ -7,6 +7,10 @@ ok(Cc != null, "Access Cc");
 
 var didDialog;
 
+var isSelectDialog = false;
+var isTabModal = false;
+var usePromptService = true;
+
 var timer; // keep in outer scope so it's not GC'd before firing
 function startCallbackTimer() {
     didDialog = false;
@@ -34,17 +38,58 @@ var observer = {
         netscape.security.PrivilegeManager
                          .enablePrivilege('UniversalXPConnect');
 
-        var doc = getDialogDoc();
-        if (doc)
-            handleDialog(doc, testNum);
-        else
-            startCallbackTimer(); // try again in a bit
+        if (isTabModal) {
+          var promptBox = getTabModalPromptBox(window);
+          ok(promptBox, "got tabmodal promptbox");
+          var prompts = promptBox.listPrompts();
+          if (prompts.length)
+              handleDialog(prompts[0].Dialog.ui, testNum);
+          else
+              startCallbackTimer(); // try again in a bit
+        } else {
+          var doc = getDialogDoc();
+          if (isSelectDialog && doc)
+              handleDialog(doc, testNum);
+          else if (doc)
+              handleDialog(doc.defaultView.Dialog.ui, testNum);
+          else
+              startCallbackTimer(); // try again in a bit
+        }
     }
 };
 
+function getTabModalPromptBox(domWin) {
+    var promptBox = null;
+
+    // Given a content DOM window, returns the chrome window it's in.
+    function getChromeWindow(aWindow) {
+        var chromeWin = aWindow.QueryInterface(Ci.nsIInterfaceRequestor)
+                               .getInterface(Ci.nsIWebNavigation)
+                               .QueryInterface(Ci.nsIDocShell)
+                               .chromeEventHandler.ownerDocument.defaultView;
+        return chromeWin;
+    }
+
+    try {
+        // Get topmost window, in case we're in a frame.
+        var promptWin = domWin.top
+
+        // Get the chrome window for the content window we're using.
+        // .wrappedJSObject needed here -- see bug 422974 comment 5.
+        var chromeWin = getChromeWindow(promptWin).wrappedJSObject;
+
+        if (chromeWin.getTabModalPromptBox)
+            promptBox = chromeWin.getTabModalPromptBox(promptWin);
+    } catch (e) {
+        // If any errors happen, just assume no tabmodal prompter.
+    }
+
+    return promptBox;
+}
+
 function getDialogDoc() {
-  // Find the <browser> which contains notifyWindow, by looking
-  // through all the open windows and all the <browsers> in each.
+  // Trudge through all the open windows, until we find the one
+  // that has either commonDialog.xul or selectDialog.xul loaded.
   var wm = Cc["@mozilla.org/appshell/window-mediator;1"].
            getService(Ci.nsIWindowMediator);
   //var enumerator = wm.getEnumerator("navigator:browser");
diff --git a/toolkit/components/prompts/test/test_modal_prompts.html b/toolkit/components/prompts/test/test_modal_prompts.html
index 4e93586373c9..de3922f710ec 100644
--- a/toolkit/components/prompts/test/test_modal_prompts.html
+++ b/toolkit/components/prompts/test/test_modal_prompts.html
@@ -20,67 +20,33 @@ Prompter tests: modal prompts
 
 netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
 
-let prompter = Cc["@mozilla.org/embedcomp/prompt-service;1"].
-               getService(Ci.nsIPromptService2);
-let ioService = Cc["@mozilla.org/network/io-service;1"].
-                getService(Ci.nsIIOService);
-let pollTimer;
-
-function pollDialog(dialog) {
+function pollDialog(okButton) {
     netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
 
-    if (dialog.getButton("accept").disabled)
+    if (okButton.disabled)
         return;
 
     ok(true, "dialog button is enabled now");
     pollTimer.cancel();
     pollTimer = null;
-    dialog.acceptDialog();
+    okButton.click();
     didDialog = true;
 }
 
-function checkExpectedState(doc, state) {
-    let msg        = doc.getElementById("info.body").textContent;
-    let icon       = doc.getElementById("info.icon");
-    let textOuter  = doc.getElementById("loginContainer");
-    let passOuter  = doc.getElementById("password1Container");
-    let checkOuter = doc.getElementById("checkboxContainer");
-    let textField  = doc.getElementById("loginTextbox");
-    let passField  = doc.getElementById("password1Textbox");
-    let checkbox   = doc.getElementById("checkbox");
-    let textValue  = textField.getAttribute("value");
-    let passValue  = passField.getAttribute("value");
-
-    is(msg, state.msg, "Checking expected message");
+function checkExpectedState(ui, state) {
     // XXX check title? OS X has title in content
-    is(icon.className,    "spaced " + state.iconClass, "Checking expected icon CSS class");
-    is(textOuter.hidden,  state.textHidden,  "Checking textbox visibility");
-    is(passOuter.hidden,  state.passHidden,  "Checking passbox visibility");
-    is(checkOuter.hidden, state.checkHidden, "Checking checkbox visibility");
-    is(textValue,         state.textValue,   "Checking textbox value");
-    is(passValue,         state.passValue,   "Checking passbox value");
-    is(checkbox.label,    state.checkMsg,    "Checking checkbox label");
-    is(checkbox.checked,  state.checked,     "Checking checkbox checked");
+    var iconClassPrefix = (isTabModal ? "info.icon " : "spaced ");
+    is(ui.infoBody.textContent,       state.msg,         "Checking expected message");
+    is(ui.loginContainer.hidden,      state.textHidden,  "Checking textbox visibility");
+    is(ui.password1Container.hidden,  state.passHidden,  "Checking passbox visibility");
+    is(ui.checkboxContainer.hidden,   state.checkHidden, "Checking checkbox visibility");
+    is(ui.checkbox.label,             state.checkMsg,    "Checking checkbox label");
+    is(ui.checkbox.checked,           state.checked,     "Checking checkbox checked");
+    is(ui.infoIcon.className,         iconClassPrefix + state.iconClass, "Checking expected icon CSS class");
+    is(ui.loginTextbox.getAttribute("value"),     state.textValue, "Checking textbox value");
+    is(ui.password1Textbox.getAttribute("value"), state.passValue, "Checking passbox value");
 }
 
-function checkExpectedSelectState(doc, state) {
-    let msg = doc.getElementById("info.txt").value;
-    // XXX check title? OS X has title in content
-    let listbox = doc.getElementById("list");
-
-    is(msg, state.msg, "Checking expected message");
-    // XXX check title? OS X has title in content
-    // Compare listbox contents
-    let count = listbox.itemCount;
-    is(count, state.items.length, "Checking listbox length");
-    if (count)
-        is(listbox.selectedIndex, 0, "Checking selected index");
-
-    for (let i = 0; i < count; i++) {
-        let item = listbox.getItemAtIndex(i).label;
-        is(item, items[i], "Checking item #" + i + " label");
-    }
-}
 
 /*
  * handleDialog
@@ -90,15 +56,14 @@ function checkExpectedSelectState(doc, state) {
  * should call startCallbackTimer() each time the auth dialog is expected (the
  * timer is a one-shot).
  */
-function handleDialog(doc, testNum) {
+function handleDialog(ui, testNum) {
     netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
-    ok(true, "--- handleDialog for test " + testNum + " ---");
+    ok(true, "--- handleDialog for test " + testNum + 
+             " --- (isTabModal=" + isTabModal + ", usePromptService=" + usePromptService + ")");
 
-    let textField = doc.getElementById("loginTextbox");
-    let passField = doc.getElementById("password1Textbox");
-    let checkbox  = doc.getElementById("checkbox");
-    let dialog    = doc.getElementsByTagName("dialog")[0];
-    let listbox   = doc.getElementById("list"); // only relevant for selectDialog
+    let textField = ui.loginTextbox;
+    let passField = ui.password1Textbox;
+    let checkbox  = ui.checkbox;
     let clickOK   = true;
     let state;
 
@@ -121,7 +86,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
 
         //is(doc.activeElement, userfield.inputField, "focus correct for test" + testNum);
         //doc.commandDispatcher.rewindFocus();
@@ -142,7 +107,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
         break;
 
       case 3:
@@ -159,7 +124,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "Check me out!",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
 
         // XXX dumb. old code driven by oncommand.
         checkbox.setChecked(true);
@@ -180,7 +145,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
         break;
 
       case 5:
@@ -197,7 +162,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
         clickOK = false;
         break;
 
@@ -215,7 +180,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
         break;
 
       case 7:
@@ -232,7 +197,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
         clickOK = false;
         break;
 
@@ -250,7 +215,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "Check me out!",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
 
         // XXX dumb. old code driven by oncommand.
         checkbox.setChecked(true);
@@ -271,7 +236,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "Check me out!",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
 
         clickOK = false;
         // XXX dumb. old code driven by oncommand.
@@ -293,7 +258,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
         textField.setAttribute("value", "bacon");
         break;
 
@@ -311,7 +276,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
         break;
 
       case 12:
@@ -328,7 +293,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
         clickOK = false;
         break;
 
@@ -346,7 +311,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
         textField.setAttribute("value", "bacon");
         clickOK = false;
         break;
@@ -365,7 +330,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "Check me out!",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
 
         // XXX dumb. old code driven by oncommand.
         checkbox.setChecked(true);
@@ -386,7 +351,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "Check me out!",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
 
         clickOK = false;
         // XXX dumb. old code driven by oncommand.
@@ -408,7 +373,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "Check me out!",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
 
         textField.setAttribute("value", "newusr");
         passField.setAttribute("value", "newssh");
@@ -431,7 +396,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "Check me out!",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
 
         textField.setAttribute("value", "newusr");
         passField.setAttribute("value", "newssh");
@@ -456,7 +421,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "Check me out!",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
 
         passField.setAttribute("value", "newssh");
         // XXX dumb. old code driven by oncommand.
@@ -478,7 +443,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "Check me out!",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
 
         passField.setAttribute("value", "newssh");
         // XXX dumb. old code driven by oncommand.
@@ -489,51 +454,6 @@ function handleDialog(doc, testNum) {
         break;
 
       case 20:
-        // Select (0 items)
-        state = {
-            msg   : "This is the select text.",
-            title : "TestTitle",
-            items : [],
-        };
-        checkExpectedSelectState(doc, state);
-        break;
-
-      case 21:
-        // Select (3 items, default ok)
-        state = {
-            msg   : "This is the select text.",
-            title : "TestTitle",
-            items : ["one", "two", "three"],
-        };
-        checkExpectedSelectState(doc, state);
-        break;
-
-      case 22:
-        // Select (3 items, change selection, ok)
-        state = {
-            msg   : "This is the select text.",
-            title : "TestTitle",
-            items : ["one", "two", "three"],
-        };
-        checkExpectedSelectState(doc, state);
-        // XXX need to trigger old code's click listener
-        listbox.selectedIndex = 1;
-        //listbox.getItemAtIndex(1).click();
-        break;
-
-      case 23:
-        // Select (3 items, cancel)
-        state = {
-            msg   : "This is the select text.",
-            title : "TestTitle",
-            items : ["one", "two", "three"],
-        };
-        checkExpectedSelectState(doc, state);
-        clickOK = false;
-        break;
-
-
-      case 24:
         // ConfirmEx (ok/cancel, ok)
         state = {
             msg   : "This is the confirmEx text.",
@@ -547,12 +467,12 @@ function handleDialog(doc, testNum) {
             checkMsg    : "",
             checked     : false,
         };
-        is(dialog.getButton("accept").label, "OK",     "Checking accept-button label");
-        is(dialog.getButton("cancel").label, "Cancel", "Checking cancel-button label");
-        checkExpectedState(doc, state);
+        is(ui.button0.label, "OK",     "Checking accept-button label");
+        is(ui.button1.label, "Cancel", "Checking cancel-button label");
+        checkExpectedState(ui, state);
         break;
 
-      case 25:
+      case 21:
         // ConfirmEx (yes/no, cancel)
         state = {
             msg   : "This is the confirmEx text.",
@@ -566,13 +486,13 @@ function handleDialog(doc, testNum) {
             checkMsg    : "",
             checked     : false,
         };
-        is(dialog.getButton("accept").label, "Yes", "Checking accept-button label");
-        is(dialog.getButton("cancel").label, "No",  "Checking cancel-button label");
-        checkExpectedState(doc, state);
+        is(ui.button0.label, "Yes", "Checking accept-button label");
+        is(ui.button1.label, "No",  "Checking cancel-button label");
+        checkExpectedState(ui, state);
         clickOK = false;
         break;
 
-      case 26:
+      case 22:
         // ConfirmEx (buttons from args, checkbox, ok)
         state = {
             msg   : "This is the confirmEx text.",
@@ -586,17 +506,17 @@ function handleDialog(doc, testNum) {
             checkMsg    : "Check me out!",
             checked     : false,
         };
-        is(dialog.getButton("accept").label, "butt0", "Checking accept-button label");
-        is(dialog.getButton("cancel").label, "butt1", "Checking cancel-button label");
-        is(dialog.getButton("extra1").label, "butt2", "Checking extra1-button label");
-        checkExpectedState(doc, state);
+        is(ui.button0.label, "butt0", "Checking accept-button label");
+        is(ui.button1.label, "butt1", "Checking cancel-button label");
+        is(ui.button2.label, "butt2", "Checking extra1-button label");
+        checkExpectedState(ui, state);
 
         // XXX dumb. old code driven by oncommand.
         checkbox.setChecked(true);
         checkbox.doCommand();
         break;
 
-      case 27:
+      case 23:
         // ConfirmEx (buttons from args, checkbox, cancel)
         state = {
             msg   : "This is the confirmEx text.",
@@ -611,10 +531,10 @@ function handleDialog(doc, testNum) {
             checked     : false,
         };
         // XXX check button1 is default
-        is(dialog.getButton("accept").label, "butt0", "Checking accept-button label");
-        is(dialog.getButton("cancel").label, "butt1", "Checking cancel-button label");
-        is(dialog.getButton("extra1").label, "butt2", "Checking extra1-button label");
-        checkExpectedState(doc, state);
+        is(ui.button0.label, "butt0", "Checking accept-button label");
+        is(ui.button1.label, "butt1", "Checking cancel-button label");
+        is(ui.button2.label, "butt2", "Checking extra1-button label");
+        checkExpectedState(ui, state);
 
         // XXX dumb. old code driven by oncommand.
         checkbox.setChecked(true);
@@ -623,7 +543,7 @@ function handleDialog(doc, testNum) {
         clickOK = false;
         break;
 
-      case 28:
+      case 24:
         // ConfirmEx (buttons from args, checkbox, button3)
         state = {
             msg   : "This is the confirmEx text.",
@@ -638,10 +558,10 @@ function handleDialog(doc, testNum) {
             checked     : false,
         };
         // XXX check button2 is default
-        is(dialog.getButton("accept").label, "butt0", "Checking accept-button label");
-        is(dialog.getButton("cancel").label, "butt1", "Checking cancel-button label");
-        is(dialog.getButton("extra1").label, "butt2", "Checking extra1-button label");
-        checkExpectedState(doc, state);
+        is(ui.button0.label, "butt0", "Checking accept-button label");
+        is(ui.button1.label, "butt1", "Checking cancel-button label");
+        is(ui.button2.label, "butt2", "Checking extra1-button label");
+        checkExpectedState(ui, state);
 
         // XXX dumb. old code driven by oncommand.
         checkbox.setChecked(true);
@@ -651,7 +571,7 @@ function handleDialog(doc, testNum) {
         clickOK = false;
         break;
 
-      case 29:
+      case 25:
         // Alert, null window
         state = {
             msg   : "This is the alert text.",
@@ -665,10 +585,10 @@ function handleDialog(doc, testNum) {
             checkMsg    : "",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
         break;
 
-      case 30:
+      case 26:
         // ConfirmEx (with delay, ok)
         state = {
             msg   : "This is the confirmEx delay text.",
@@ -682,11 +602,11 @@ function handleDialog(doc, testNum) {
             checkMsg    : "",
             checked     : false,
         };
-        is(dialog.getButton("accept").label, "OK",     "Checking accept-button label");
-        is(dialog.getButton("cancel").label, "Cancel", "Checking cancel-button label");
-        is(dialog.getButton("accept").disabled, true,  "Checking accept-button is disabled");
-        is(dialog.getButton("cancel").disabled, false, "Checking cancel-button isn't disabled ");
-        checkExpectedState(doc, state);
+        is(ui.button0.label, "OK",     "Checking accept-button label");
+        is(ui.button1.label, "Cancel", "Checking cancel-button label");
+        is(ui.button0.disabled, true,  "Checking accept-button is disabled");
+        is(ui.button1.disabled, false, "Checking cancel-button isn't disabled ");
+        checkExpectedState(ui, state);
         break;
 
 
@@ -704,7 +624,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "Check me out!",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
 
         textField.setAttribute("value", "username");
         passField.setAttribute("value", "password");
@@ -730,7 +650,7 @@ function handleDialog(doc, testNum) {
             checkMsg    : "Check me out!",
             checked     : false,
         };
-        checkExpectedState(doc, state);
+        checkExpectedState(ui, state);
 
         textField.setAttribute("value", "username");
         passField.setAttribute("value", "password");
@@ -744,407 +664,497 @@ function handleDialog(doc, testNum) {
         break;
     }
 
-    if (testNum == 28) {
-        dialog._doButtonCommand("extra1");
-    } else if (testNum == 30) {
+    if (testNum == 24) {
+        ui.button2.click();
+    } else if (testNum == 26) {
         // Buttons are disabled at the moment, poll until they're reenabled.
         // Can't use setInterval here, because the window's in a modal state
         // and thus DOM events are suppressed.
         pollTimer = Cc["@mozilla.org/timer;1"].createInstance(Ci.nsITimer);
-        pollTimer.initWithCallback(function() { pollDialog(dialog); },
+        pollTimer.initWithCallback(function() { pollDialog(ui.button0); },
                                    100, Ci.nsITimer.TYPE_REPEATING_SLACK);
         return;
     } else {
         if (clickOK)
-            dialog.acceptDialog();
+            ui.button0.click();
         else
-            dialog.cancelDialog();
+            ui.button1.click();
     }
 
     ok(true, "handleDialog done");
     didDialog = true;
 }
 
-let testNum   = 0;
-let checkVal  = {};
-let textVal   = {};
-let passVal   = {};
-let selectVal = {};
-let flags;
-let isOK, clickedButton;
 
-// ===== test 1 =====
-// Alert
-testNum++;
-startCallbackTimer();
-prompter.alert(window, "TestTitle", "This is the alert text.");
+function runTests() {
+    let ioService = Cc["@mozilla.org/network/io-service;1"].
+                    getService(Ci.nsIIOService);
+    ok(true, "Running tests (isTabModal=" + isTabModal + ", usePromptService=" + usePromptService + ")");
 
-ok(didDialog, "handleDialog was invoked");
+    let prompter, promptArgs;
+    if (usePromptService) {
+        prompter = Cc["@mozilla.org/embedcomp/prompt-service;1"].
+                   getService(Ci.nsIPromptService2);
+    } else {
+        prompter = Cc["@mozilla.org/prompter;1"].
+                   getService(Ci.nsIPromptFactory).
+                   getPrompt(window, Ci.nsIPrompt);
+        if (isTabModal) {
+            let bag = prompter.QueryInterface(Ci.nsIWritablePropertyBag2);
+            bag.setPropertyAsBool("allowTabModal", true);
+        }
+    }
+
+    let checkVal  = {};
+    let textVal   = {};
+    let passVal   = {};
+    let flags;
+    let isOK, clickedButton;
+
+    testNum = 0;
+
+    // ===== test 1 =====
+    // Alert
+    testNum++;
+    startCallbackTimer();
+    promptArgs = ["TestTitle", "This is the alert text."];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    prompter.alert.apply(null, promptArgs);
+
+    ok(didDialog, "handleDialog was invoked");
+
+    // ===== test 2 =====
+    // AlertCheck (null checkbox label)
+    testNum++;
+    startCallbackTimer();
+    promptArgs = ["TestTitle", "This is the alertCheck text.", null, {}];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    prompter.alertCheck.apply(null, promptArgs);
+    ok(didDialog, "handleDialog was invoked");
 
 
-// ===== test 2 =====
-// AlertCheck (null checkbox label)
-testNum++;
-startCallbackTimer();
-prompter.alertCheck(window, "TestTitle", "This is the alertCheck text.", null, {});
-ok(didDialog, "handleDialog was invoked");
+    // ===== test 3 =====
+    // AlertCheck
+    testNum++;
+    startCallbackTimer();
+    checkVal.value = false;
+    promptArgs = ["TestTitle", "This is the alertCheck text.", "Check me out!", checkVal];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    prompter.alertCheck.apply(null, promptArgs);
+    ok(didDialog, "handleDialog was invoked");
+    is(checkVal.value, true, "checkbox was checked");
 
 
-// ===== test 3 =====
-// AlertCheck
-testNum++;
-startCallbackTimer();
-checkVal.value = false;
-prompter.alertCheck(window, "TestTitle", "This is the alertCheck text.", "Check me out!", checkVal);
-ok(didDialog, "handleDialog was invoked");
-is(checkVal.value, true, "checkbox was checked");
+    // ===== test 4 =====
+    // Confirm (ok)
+    testNum++;
+    startCallbackTimer();
+    promptArgs = ["TestTitle", "This is the confirm text."];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    isOK = prompter.confirm.apply(null, promptArgs);
+    is(isOK, true, "checked expected retval");
+    ok(didDialog, "handleDialog was invoked");
+
+    // ===== test 5 =====
+    // Confirm (cancel)
+    testNum++;
+    startCallbackTimer();
+    promptArgs = ["TestTitle", "This is the confirm text."];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    isOK = prompter.confirm.apply(null, promptArgs);
+    is(isOK, false, "checked expected retval");
+    ok(didDialog, "handleDialog was invoked");
 
 
-// ===== test 4 =====
-// Confirm (ok)
-testNum++;
-startCallbackTimer();
-isOK = prompter.confirm(window, "TestTitle", "This is the confirm text.");
-is(isOK, true, "checked expected retval");
-ok(didDialog, "handleDialog was invoked");
+    // ===== test 6 =====
+    // ConfirmCheck (ok, null checkbox label)
+    testNum++;
+    startCallbackTimer();
+    promptArgs = ["TestTitle", "This is the confirmCheck text.", null, {}];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    isOK = prompter.confirmCheck.apply(null, promptArgs);
+    is(isOK, true, "checked expected retval");
+    ok(didDialog, "handleDialog was invoked");
 
-// ===== test 5 =====
-// Confirm (cancel)
-testNum++;
-startCallbackTimer();
-isOK = prompter.confirm(window, "TestTitle", "This is the confirm text.");
-is(isOK, false, "checked expected retval");
-ok(didDialog, "handleDialog was invoked");
+    // ===== test 7 =====
+    // ConfirmCheck (cancel, null checkbox label)
+    testNum++;
+    startCallbackTimer();
+    promptArgs = ["TestTitle", "This is the confirmCheck text.", null, {}];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    isOK = prompter.confirmCheck.apply(null, promptArgs);
+    is(isOK, false, "checked expected retval");
+    ok(didDialog, "handleDialog was invoked");
+
+    // ===== test 8 =====
+    // ConfirmCheck (ok)
+    testNum++;
+    startCallbackTimer();
+    checkVal.value = false;
+    promptArgs = ["TestTitle", "This is the confirmCheck text.", "Check me out!", checkVal];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    isOK = prompter.confirmCheck.apply(null, promptArgs);
+    is(isOK, true, "checked expected retval");
+    is(checkVal.value, true, "expected checkbox setting");
+    ok(didDialog, "handleDialog was invoked");
+
+    // ===== test 9 =====
+    // ConfirmCheck (cancel)
+    testNum++;
+    startCallbackTimer();
+    checkVal.value = false;
+    promptArgs = ["TestTitle", "This is the confirmCheck text.", "Check me out!", checkVal];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    isOK = prompter.confirmCheck.apply(null, promptArgs);
+    is(isOK, false, "checked expected retval");
+    is(checkVal.value, true, "expected checkbox setting");
+    ok(didDialog, "handleDialog was invoked");
 
 
-// ===== test 6 =====
-// ConfirmCheck (ok, null checkbox label)
-testNum++;
-startCallbackTimer();
-isOK = prompter.confirmCheck(window, "TestTitle", "This is the confirmCheck text.", null, {});
-is(isOK, true, "checked expected retval");
-ok(didDialog, "handleDialog was invoked");
+    // ===== test 10 =====
+    // Prompt (ok, no default text)
+    testNum++;
+    startCallbackTimer();
+    textVal.value = "";
+    promptArgs = ["TestTitle", "This is the prompt text.", textVal, null, {}];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    isOK = prompter.prompt.apply(null, promptArgs);
+    is(isOK, true, "checked expected retval");
+    is(textVal.value, "bacon", "checking expected text value");
+    ok(didDialog, "handleDialog was invoked");
 
-// ===== test 7 =====
-// ConfirmCheck (cancel, null checkbox label)
-testNum++;
-startCallbackTimer();
-isOK = prompter.confirmCheck(window, "TestTitle", "This is the confirmCheck text.", null, {});
-is(isOK, false, "checked expected retval");
-ok(didDialog, "handleDialog was invoked");
+    // ===== test 11 =====
+    // Prompt (ok, default text)
+    testNum++;
+    startCallbackTimer();
+    textVal.value = "kittens";
+    promptArgs = ["TestTitle", "This is the prompt text.", textVal, null, {}];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    isOK = prompter.prompt.apply(null, promptArgs);
+    is(isOK, true, "checked expected retval");
+    is(textVal.value, "kittens", "checking expected text value");
+    ok(didDialog, "handleDialog was invoked");
 
-// ===== test 8 =====
-// ConfirmCheck (ok)
-testNum++;
-startCallbackTimer();
-checkVal.value = false;
-isOK = prompter.confirmCheck(window, "TestTitle", "This is the confirmCheck text.", "Check me out!", checkVal);
-is(isOK, true, "checked expected retval");
-is(checkVal.value, true, "expected checkbox setting");
-ok(didDialog, "handleDialog was invoked");
+    // ===== test 12 =====
+    // Prompt (cancel, default text)
+    testNum++;
+    startCallbackTimer();
+    textVal.value = "puppies";
+    promptArgs = ["TestTitle", "This is the prompt text.", textVal, null, {}];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    isOK = prompter.prompt.apply(null, promptArgs);
+    is(isOK, false, "checked expected retval");
+    is(textVal.value, "puppies", "checking expected text value");
+    ok(didDialog, "handleDialog was invoked");
 
-// ===== test 9 =====
-// ConfirmCheck (cancel)
-testNum++;
-startCallbackTimer();
-checkVal.value = false;
-isOK = prompter.confirmCheck(window, "TestTitle", "This is the confirmCheck text.", "Check me out!", checkVal);
-is(isOK, false, "checked expected retval");
-is(checkVal.value, true, "expected checkbox setting");
-ok(didDialog, "handleDialog was invoked");
+    // ===== test 13 =====
+    // Prompt (cancel, default text modified)
+    testNum++;
+    startCallbackTimer();
+    textVal.value = "puppies";
+    promptArgs = ["TestTitle", "This is the prompt text.", textVal, null, {}];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    isOK = prompter.prompt.apply(null, promptArgs);
+    is(isOK, false, "checked expected retval");
+    is(textVal.value, "puppies", "checking expected text value");
+    ok(didDialog, "handleDialog was invoked");
+
+    // ===== test 14 =====
+    // Prompt (ok, with checkbox)
+    testNum++;
+    startCallbackTimer();
+    textVal.value  = "tribbles";
+    checkVal.value = false;
+    promptArgs = ["TestTitle", "This is the prompt text.", textVal, "Check me out!", checkVal];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    isOK = prompter.prompt.apply(null, promptArgs);
+    is(isOK, true, "checked expected retval");
+    is(textVal.value, "tribbles", "checking expected text value");
+    is(checkVal.value, true, "expected checkbox setting");
+    ok(didDialog, "handleDialog was invoked");
+
+    // ===== test 15 =====
+    // Prompt (cancel, with checkbox)
+    testNum++;
+    startCallbackTimer();
+    textVal.value  = "tribbles";
+    checkVal.value = false;
+    promptArgs = ["TestTitle", "This is the prompt text.", textVal, "Check me out!", checkVal];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    isOK = prompter.prompt.apply(null, promptArgs);
+    is(isOK, false, "checked expected retval");
+    is(textVal.value, "tribbles", "checking expected text value");
+    is(checkVal.value, false, "expected checkbox setting");
+    ok(didDialog, "handleDialog was invoked");
 
 
-// ===== test 10 =====
-// Prompt (ok, no default text)
-testNum++;
-startCallbackTimer();
-textVal.value = "";
-isOK = prompter.prompt(window, "TestTitle", "This is the prompt text.", textVal, null, {});
-is(isOK, true, "checked expected retval");
-is(textVal.value, "bacon", "checking expected text value");
-ok(didDialog, "handleDialog was invoked");
+    // ===== test 16 =====
+    // PromptUsernameAndPassword (ok)
+    // Just two tests for this, since password manager already tests this extensively.
+    testNum++;
+    startCallbackTimer();
+    textVal.value  = "usr";
+    passVal.value  = "ssh";
+    checkVal.value = false;
+    promptArgs = ["TestTitle", "This is the pUAP text.", textVal, passVal, "Check me out!", checkVal];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    isOK = prompter.promptUsernameAndPassword.apply(null, promptArgs);
+    is(isOK, true, "checked expected retval");
+    is(textVal.value, "newusr", "checking expected text value");
+    is(passVal.value, "newssh", "checking expected pass value");
+    is(checkVal.value, true, "expected checkbox setting");
+    ok(didDialog, "handleDialog was invoked");
 
-// ===== test 11 =====
-// Prompt (ok, default text)
-testNum++;
-startCallbackTimer();
-textVal.value = "kittens";
-isOK = prompter.prompt(window, "TestTitle", "This is the prompt text.", textVal, null, {});
-is(isOK, true, "checked expected retval");
-is(textVal.value, "kittens", "checking expected text value");
-ok(didDialog, "handleDialog was invoked");
-
-// ===== test 12 =====
-// Prompt (cancel, default text)
-testNum++;
-startCallbackTimer();
-textVal.value = "puppies";
-isOK = prompter.prompt(window, "TestTitle", "This is the prompt text.", textVal, null, {});
-is(isOK, false, "checked expected retval");
-is(textVal.value, "puppies", "checking expected text value");
-ok(didDialog, "handleDialog was invoked");
-
-// ===== test 13 =====
-// Prompt (cancel, default text modified)
-testNum++;
-startCallbackTimer();
-textVal.value = "puppies";
-isOK = prompter.prompt(window, "TestTitle", "This is the prompt text.", textVal, null, {});
-is(isOK, false, "checked expected retval");
-is(textVal.value, "puppies", "checking expected text value");
-ok(didDialog, "handleDialog was invoked");
-
-// ===== test 14 =====
-// Prompt (ok, with checkbox)
-testNum++;
-startCallbackTimer();
-textVal.value  = "tribbles";
-checkVal.value = false;
-isOK = prompter.prompt(window, "TestTitle", "This is the prompt text.", textVal, "Check me out!", checkVal);
-is(isOK, true, "checked expected retval");
-is(textVal.value, "tribbles", "checking expected text value");
-is(checkVal.value, true, "expected checkbox setting");
-ok(didDialog, "handleDialog was invoked");
-
-// ===== test 15 =====
-// Prompt (cancel, with checkbox)
-testNum++;
-startCallbackTimer();
-textVal.value  = "tribbles";
-checkVal.value = false;
-isOK = prompter.prompt(window, "TestTitle", "This is the prompt text.", textVal, "Check me out!", checkVal);
-is(isOK, false, "checked expected retval");
-is(textVal.value, "tribbles", "checking expected text value");
-is(checkVal.value, false, "expected checkbox setting");
-ok(didDialog, "handleDialog was invoked");
+    // ===== test 17 =====
+    // PromptUsernameAndPassword (cancel)
+    testNum++;
+    startCallbackTimer();
+    textVal.value  = "usr";
+    passVal.value  = "ssh";
+    checkVal.value = false;
+    promptArgs = ["TestTitle", "This is the pUAP text.", textVal, passVal, "Check me out!", checkVal];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    isOK = prompter.promptUsernameAndPassword.apply(null, promptArgs);
+    is(isOK, false, "checked expected retval");
+    is(textVal.value, "usr", "checking expected text value");
+    is(passVal.value, "ssh", "checking expected pass value");
+    is(checkVal.value, false, "expected checkbox setting");
+    ok(didDialog, "handleDialog was invoked");
 
 
-// ===== test 16 =====
-// PromptUsernameAndPassword (ok)
-// Just two tests for this, since password manager already tests this extensively.
-testNum++;
-startCallbackTimer();
-textVal.value  = "usr";
-passVal.value  = "ssh";
-checkVal.value = false;
-isOK = prompter.promptUsernameAndPassword(window, "TestTitle", "This is the pUAP text.", textVal, passVal, "Check me out!", checkVal);
-is(isOK, true, "checked expected retval");
-is(textVal.value, "newusr", "checking expected text value");
-is(passVal.value, "newssh", "checking expected pass value");
-is(checkVal.value, true, "expected checkbox setting");
-ok(didDialog, "handleDialog was invoked");
+    // ===== test 18 =====
+    // PromptPassword (ok)
+    testNum++;
+    startCallbackTimer();
+    passVal.value  = "ssh";
+    checkVal.value = false;
+    promptArgs = ["TestTitle", "This is the promptPassword text.", passVal, "Check me out!", checkVal];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    isOK = prompter.promptPassword.apply(null, promptArgs);
+    is(isOK, true, "checked expected retval");
+    is(passVal.value, "newssh", "checking expected pass value");
+    is(checkVal.value, true, "expected checkbox setting");
+    ok(didDialog, "handleDialog was invoked");
 
-// ===== test 17 =====
-// PromptUsernameAndPassword (cancel)
-testNum++;
-startCallbackTimer();
-textVal.value  = "usr";
-passVal.value  = "ssh";
-checkVal.value = false;
-isOK = prompter.promptUsernameAndPassword(window, "TestTitle", "This is the pUAP text.", textVal, passVal, "Check me out!", checkVal);
-is(isOK, false, "checked expected retval");
-is(textVal.value, "usr", "checking expected text value");
-is(passVal.value, "ssh", "checking expected pass value");
-is(checkVal.value, false, "expected checkbox setting");
-ok(didDialog, "handleDialog was invoked");
+    // ===== test 19 =====
+    // PromptPassword (cancel)
+    testNum++;
+    startCallbackTimer();
+    passVal.value  = "ssh";
+    checkVal.value = false;
+    promptArgs = ["TestTitle", "This is the promptPassword text.", passVal, "Check me out!", checkVal];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    isOK = prompter.promptPassword.apply(null, promptArgs);
+    is(isOK, false, "checked expected retval");
+    is(passVal.value, "ssh", "checking expected pass value");
+    is(checkVal.value, false, "expected checkbox setting");
+    ok(didDialog, "handleDialog was invoked");
+
+    // ===== test 20 =====
+    // ConfirmEx (ok/cancel, ok)
+    testNum++;
+    startCallbackTimer();
+    flags = Ci.nsIPromptService.STD_OK_CANCEL_BUTTONS;
+    promptArgs = ["TestTitle", "This is the confirmEx text.", flags, null, null, null, null, {}];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    clickedButton = prompter.confirmEx.apply(null, promptArgs);
+    is(clickedButton, 0, "checked expected button num click");
+    ok(didDialog, "handleDialog was invoked");
+
+    // ===== test 21 =====
+    // ConfirmEx (yes/no, cancel)
+    testNum++;
+    startCallbackTimer();
+    flags = Ci.nsIPromptService.STD_YES_NO_BUTTONS;
+    promptArgs = ["TestTitle", "This is the confirmEx text.", flags, null, null, null, null, {}];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    clickedButton = prompter.confirmEx.apply(null, promptArgs);
+    is(clickedButton, 1, "checked expected button num click");
+    ok(didDialog, "handleDialog was invoked");
+
+    // ===== test 22 =====
+    // ConfirmEx (buttons from args, checkbox, ok)
+    testNum++;
+    startCallbackTimer();
+    let b = Ci.nsIPromptService.BUTTON_TITLE_IS_STRING;
+    flags = b * Ci.nsIPromptService.BUTTON_POS_2 +
+            b * Ci.nsIPromptService.BUTTON_POS_1 +
+            b * Ci.nsIPromptService.BUTTON_POS_0;
+    checkVal.value = false;
+    promptArgs = ["TestTitle", "This is the confirmEx text.", flags,
+                  "butt0", "butt1", "butt2", "Check me out!", checkVal];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    clickedButton = prompter.confirmEx.apply(null, promptArgs);
+    is(clickedButton, 0, "checked expected button num click");
+    is(checkVal.value, true, "expected checkbox setting");
+    ok(didDialog, "handleDialog was invoked");
+
+    // ===== test 23 =====
+    // ConfirmEx (buttons from args, checkbox, cancel)
+    testNum++;
+    startCallbackTimer();
+    let b = Ci.nsIPromptService.BUTTON_TITLE_IS_STRING;
+    flags = b * Ci.nsIPromptService.BUTTON_POS_2 +
+            b * Ci.nsIPromptService.BUTTON_POS_1 +
+            b * Ci.nsIPromptService.BUTTON_POS_0;
+    flags ^= Ci.nsIPromptService.BUTTON_POS_1_DEFAULT;
+    checkVal.value = false;
+    promptArgs = ["TestTitle", "This is the confirmEx text.", flags,
+                  "butt0", "butt1", "butt2", "Check me out!", checkVal];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    clickedButton = prompter.confirmEx.apply(null, promptArgs);
+    is(clickedButton, 1, "checked expected button num click");
+    is(checkVal.value, true, "expected checkbox setting");
+    ok(didDialog, "handleDialog was invoked");
+
+    // ===== test 24 =====
+    // ConfirmEx (buttons from args, checkbox, button3)
+    testNum++;
+    startCallbackTimer();
+    let b = Ci.nsIPromptService.BUTTON_TITLE_IS_STRING;
+    flags = b * Ci.nsIPromptService.BUTTON_POS_2 +
+            b * Ci.nsIPromptService.BUTTON_POS_1 +
+            b * Ci.nsIPromptService.BUTTON_POS_0;
+    flags ^= Ci.nsIPromptService.BUTTON_POS_2_DEFAULT;
+    checkVal.value = false;
+    promptArgs = ["TestTitle", "This is the confirmEx text.", flags,
+                  "butt0", "butt1", "butt2", "Check me out!", checkVal];
+    if (usePromptService)
+        promptArgs.unshift(window);
+    clickedButton = prompter.confirmEx.apply(null, promptArgs);
+    is(clickedButton, 2, "checked expected button num click");
+    is(checkVal.value, true, "expected checkbox setting");
+    ok(didDialog, "handleDialog was invoked");
+
+    // ===== test 25  =====
+    // Alert, no window
+    // (skipped for tabmodal tests: window is required)
+    testNum++;
+    if (!isTabModal) {
+        startCallbackTimer();
+    promptArgs = ["TestTitle", "This is the alert text."];
+    if (usePromptService)
+        promptArgs.unshift(null);
+        prompter.alert.apply(null, promptArgs);
+        ok(didDialog, "handleDialog was invoked");
+    }
 
 
-// ===== test 18 =====
-// PromptPassword (ok)
-testNum++;
-startCallbackTimer();
-passVal.value  = "ssh";
-checkVal.value = false;
-isOK = prompter.promptPassword(window, "TestTitle", "This is the promptPassword text.", passVal, "Check me out!", checkVal);
-is(isOK, true, "checked expected retval");
-is(passVal.value, "newssh", "checking expected pass value");
-is(checkVal.value, true, "expected checkbox setting");
-ok(didDialog, "handleDialog was invoked");
+    // ===== test 26 =====
+    // ConfirmEx (delay, ok)
+    // (skipped for tabmodal tests: delay not supported)
+    testNum++;
+    if (!isTabModal) {
+        startCallbackTimer();
+        flags = (Ci.nsIPromptService.STD_OK_CANCEL_BUTTONS | Ci.nsIPromptService.BUTTON_DELAY_ENABLE);
+        promptArgs = ["TestTitle", "This is the confirmEx delay text.", flags, null, null, null, null, {}];
+        if (usePromptService)
+            promptArgs.unshift(window);
+        clickedButton = prompter.confirmEx.apply(null, promptArgs);
+        is(clickedButton, 0, "checked expected button num click");
+        ok(didDialog, "handleDialog was invoked");
+    }
 
-// ===== test 19 =====
-// PromptPassword (cancel)
-testNum++;
-startCallbackTimer();
-passVal.value  = "ssh";
-checkVal.value = false;
-isOK = prompter.promptPassword(window, "TestTitle", "This is the promptPassword text.", passVal, "Check me out!", checkVal);
-is(isOK, false, "checked expected retval");
-is(passVal.value, "ssh", "checking expected pass value");
-is(checkVal.value, false, "expected checkbox setting");
-ok(didDialog, "handleDialog was invoked");
+    // promptAuth already tested via password manager but do a few specific things here.
 
 
-// ===== test 20 =====
-// Select (0 items, ok)
-testNum++;
-startCallbackTimer();
-items = [];
-selectVal.value = null; // outparam, just making sure.
-isOK = prompter.select(window, "TestTitle", "This is the select text.", items.length, items, selectVal);
-is(isOK, true, "checked expected retval");
-is(selectVal.value, -1, "checking selected index");
-ok(didDialog, "handleDialog was invoked");
+    var channel = ioService.newChannel("http://example.com", null, null);
+    var level = Ci.nsIAuthPrompt2.LEVEL_NONE;
+    var authinfo = {
+        username : "",
+        password : "",
+        domain   : "",
+        flags : Ci.nsIAuthInformation.AUTH_HOST,
+        authenticationScheme : "basic",
+        realm : ""
+    };
 
-// ===== test 21 =====
-// Select (3 items, ok)
-testNum++;
-startCallbackTimer();
-items = ["one", "two", "three"];
-selectVal.value = null; // outparam, just making sure.
-isOK = prompter.select(window, "TestTitle", "This is the select text.", items.length, items, selectVal);
-is(isOK, true, "checked expected retval");
-is(selectVal.value, 0, "checking selected index");
-ok(didDialog, "handleDialog was invoked");
+    // ===== test 100 =====
+    // promptAuth with empty realm
+    // (promptAuth is only accessible from the prompt service)
+    testNum = 100;
+    if (usePromptService) {
+        startCallbackTimer();
+        checkVal.value = false;
+        promptArgs = [channel, level, authinfo, "Check me out!", checkVal];
+        if (usePromptService)
+            promptArgs.unshift(window);
+        isOK = prompter.promptAuth.apply(null, promptArgs);
+        is(isOK, true, "checked expected retval");
+        is(authinfo.username, "username", "checking filled username");
+        is(authinfo.password, "password", "checking filled password");
+        is(checkVal.value, true, "expected checkbox setting");
+        ok(didDialog, "handleDialog was invoked");
+    }
 
-// ===== test 22 =====
-// Select (3 items, selection changed, ok)
-testNum++;
-startCallbackTimer();
-items = ["one", "two", "three"];
-selectVal.value = null; // outparam, just making sure.
-isOK = prompter.select(window, "TestTitle", "This is the select text.", items.length, items, selectVal);
-is(isOK, true, "checked expected retval");
-is(selectVal.value, 1, "checking selected index");
-ok(didDialog, "handleDialog was invoked");
+    // ===== test 101 =====
+    // promptAuth with long realm
+    // (promptAuth is only accessible from the prompt service)
+    testNum++;
+    if (usePromptService) {
+        startCallbackTimer();
+        checkVal.value = false;
+        var longString = "";
+        for (var i = 0; i < 20; i++)
+            longString += "abcdefghi "; // 200 chars long
+        authinfo.realm = longString;
+        authinfo.username = "";
+        authinfo.password = "";
+        promptArgs = [channel, level, authinfo, "Check me out!", checkVal];
+        if (usePromptService)
+            promptArgs.unshift(window);
+        isOK = prompter.promptAuth.apply(null, promptArgs);
+        is(isOK, true, "checked expected retval");
+        is(authinfo.username, "username", "checking filled username");
+        is(authinfo.password, "password", "checking filled password");
+        is(checkVal.value, true, "expected checkbox setting");
+        ok(didDialog, "handleDialog was invoked");
+    }
+}
 
-// ===== test 23 =====
-// Select (3 items, cancel)
-testNum++;
-startCallbackTimer();
-items = ["one", "two", "three"];
-selectVal.value = null; // outparam, just making sure.
-isOK = prompter.select(window, "TestTitle", "This is the select text.", items.length, items, selectVal);
-is(isOK, false, "checked expected retval");
-is(selectVal.value, 0, "checking selected index");
-ok(didDialog, "handleDialog was invoked");
+let testNum;
+let pollTimer;
 
+/*
+ * Run the body of the 3 times:
+ * - 1st pass: with window-modal prompts, using nsIPromptService
+ * - 2nd pass: still window-modal, using nsIPrompt directly (via nsIPromptFactory)
+ * - 3rd pass: with tab-modal prompts. Can't opt into these via * nsIPromptService.
+ */
 
-// ===== test 24 =====
-// ConfirmEx (ok/cancel, ok)
-testNum++;
-startCallbackTimer();
-flags = Ci.nsIPromptService.STD_OK_CANCEL_BUTTONS;
-clickedButton = prompter.confirmEx(window, "TestTitle", "This is the confirmEx text.", flags, null, null, null, null, {});
-is(clickedButton, 0, "checked expected button num click");
-ok(didDialog, "handleDialog was invoked");
+isTabModal = false; usePromptService = true;
+runTests();
 
-// ===== test 25 =====
-// ConfirmEx (yes/no, cancel)
-testNum++;
-startCallbackTimer();
-flags = Ci.nsIPromptService.STD_YES_NO_BUTTONS;
-clickedButton = prompter.confirmEx(window, "TestTitle", "This is the confirmEx text.", flags, null, null, null, null, {});
-is(clickedButton, 1, "checked expected button num click");
-ok(didDialog, "handleDialog was invoked");
+isTabModal = false; usePromptService = false;
+runTests();
 
-// ===== test 26 =====
-// ConfirmEx (buttons from args, checkbox, ok)
-testNum++;
-startCallbackTimer();
-let b = Ci.nsIPromptService.BUTTON_TITLE_IS_STRING;
-flags = b * Ci.nsIPromptService.BUTTON_POS_2 +
-        b * Ci.nsIPromptService.BUTTON_POS_1 +
-        b * Ci.nsIPromptService.BUTTON_POS_0;
-checkVal.value = false;
-clickedButton = prompter.confirmEx(window, "TestTitle", "This is the confirmEx text.", flags,
-                                   "butt0", "butt1", "butt2", "Check me out!", checkVal);
-is(clickedButton, 0, "checked expected button num click");
-is(checkVal.value, true, "expected checkbox setting");
-ok(didDialog, "handleDialog was invoked");
-
-// ===== test 27 =====
-// ConfirmEx (buttons from args, checkbox, cancel)
-testNum++;
-startCallbackTimer();
-let b = Ci.nsIPromptService.BUTTON_TITLE_IS_STRING;
-flags = b * Ci.nsIPromptService.BUTTON_POS_2 +
-        b * Ci.nsIPromptService.BUTTON_POS_1 +
-        b * Ci.nsIPromptService.BUTTON_POS_0;
-flags ^= Ci.nsIPromptService.BUTTON_POS_1_DEFAULT;
-checkVal.value = false;
-clickedButton = prompter.confirmEx(window, "TestTitle", "This is the confirmEx text.", flags,
-                                   "butt0", "butt1", "butt2", "Check me out!", checkVal);
-is(clickedButton, 1, "checked expected button num click");
-is(checkVal.value, true, "expected checkbox setting");
-ok(didDialog, "handleDialog was invoked");
-
-// ===== test 28 =====
-// ConfirmEx (buttons from args, checkbox, button3)
-testNum++;
-startCallbackTimer();
-let b = Ci.nsIPromptService.BUTTON_TITLE_IS_STRING;
-flags = b * Ci.nsIPromptService.BUTTON_POS_2 +
-        b * Ci.nsIPromptService.BUTTON_POS_1 +
-        b * Ci.nsIPromptService.BUTTON_POS_0;
-flags ^= Ci.nsIPromptService.BUTTON_POS_2_DEFAULT;
-checkVal.value = false;
-clickedButton = prompter.confirmEx(window, "TestTitle", "This is the confirmEx text.", flags,
-                                   "butt0", "butt1", "butt2", "Check me out!", checkVal);
-is(clickedButton, 2, "checked expected button num click");
-is(checkVal.value, true, "expected checkbox setting");
-ok(didDialog, "handleDialog was invoked");
-
-// ===== test 29  =====
-// Alert, no window
-testNum++;
-startCallbackTimer();
-prompter.alert(null, "TestTitle", "This is the alert text.");
-ok(didDialog, "handleDialog was invoked");
-
-
-// ===== test 30 =====
-// ConfirmEx (delay, ok)
-testNum++;
-startCallbackTimer();
-flags = (Ci.nsIPromptService.STD_OK_CANCEL_BUTTONS | Ci.nsIPromptService.BUTTON_DELAY_ENABLE);
-clickedButton = prompter.confirmEx(window, "TestTitle", "This is the confirmEx delay text.", flags, null, null, null, null, {});
-is(clickedButton, 0, "checked expected button num click");
-ok(didDialog, "handleDialog was invoked");
-
-// promptAuth already tested via password manager but do a few specific things here.
-
-
-var channel = ioService.newChannel("http://example.com", null, null);
-var level = Ci.nsIAuthPrompt2.LEVEL_NONE;
-var authinfo = {
-    username : "",
-    password : "",
-    domain   : "",
-
-    flags : Ci.nsIAuthInformation.AUTH_HOST,
-    authenticationScheme : "basic",
-    realm : ""
-};
-
-// ===== test 100 =====
-// promptAuth with empty realm
-testNum = 100;
-startCallbackTimer();
-checkVal.value = false;
-isOK = prompter.promptAuth(window, channel, level, authinfo, "Check me out!", checkVal);
-is(isOK, true, "checked expected retval");
-is(authinfo.username, "username", "checking filled username");
-is(authinfo.password, "password", "checking filled password");
-is(checkVal.value, true, "expected checkbox setting");
-ok(didDialog, "handleDialog was invoked");
-
-// ===== test 101 =====
-// promptAuth with long realm
-testNum++;
-startCallbackTimer();
-checkVal.value = false;
-var longString = "";
-for (var i = 0; i < 20; i++)
-    longString += "abcdefghi "; // 200 chars long
-authinfo.realm = longString;
-authinfo.username = "";
-authinfo.password = "";
-isOK = prompter.promptAuth(window, channel, level, authinfo, "Check me out!", checkVal);
-is(isOK, true, "checked expected retval");
-is(authinfo.username, "username", "checking filled username");
-is(authinfo.password, "password", "checking filled password");
-is(checkVal.value, true, "expected checkbox setting");
-ok(didDialog, "handleDialog was invoked");
+if (getTabModalPromptBox(window)) {
+    isTabModal = true; usePromptService = false;
+    runTests();
+}
 
 </script>
 </pre>
diff --git a/toolkit/components/prompts/test/test_modal_select.html b/toolkit/components/prompts/test/test_modal_select.html
new file mode 100644
index 000000000000..fbb0929a149a
--- /dev/null
+++ b/toolkit/components/prompts/test/test_modal_select.html
@@ -0,0 +1,198 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Modal Prompts Test</title>
+  <script type="text/javascript" src="/MochiKit/packed.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="prompt_common.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+Prompter tests: modal prompts
+<p id="display"></p>
+
+<div id="content" style="display: none">
+  <iframe id="iframe"></iframe>
+</div>
+
+<pre id="test">
+<script class="testbody" type="text/javascript;version=1.8">
+
+netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
+
+let prompter = Cc["@mozilla.org/embedcomp/prompt-service;1"].
+               getService(Ci.nsIPromptService2);
+let ioService = Cc["@mozilla.org/network/io-service;1"].
+                getService(Ci.nsIIOService);
+let pollTimer;
+
+function pollDialog(dialog) {
+    netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
+
+    if (dialog.getButton("accept").disabled)
+        return;
+
+    ok(true, "dialog button is enabled now");
+    pollTimer.cancel();
+    pollTimer = null;
+    dialog.acceptDialog();
+    didDialog = true;
+}
+
+function checkExpectedSelectState(doc, state) {
+    let msg = doc.getElementById("info.txt").value;
+    // XXX check title? OS X has title in content
+    let listbox = doc.getElementById("list");
+
+    is(msg, state.msg, "Checking expected message");
+    // XXX check title? OS X has title in content
+    // Compare listbox contents
+    let count = listbox.itemCount;
+    is(count, state.items.length, "Checking listbox length");
+    if (count)
+        is(listbox.selectedIndex, 0, "Checking selected index");
+
+    for (let i = 0; i < count; i++) {
+        let item = listbox.getItemAtIndex(i).label;
+        is(item, items[i], "Checking item #" + i + " label");
+    }
+}
+
+/*
+ * handleDialog
+ *
+ * Invoked a short period of time after calling startCallbackTimer(), and
+ * allows testing the actual prompt dialog while it's being displayed. Tests
+ * should call startCallbackTimer() each time the auth dialog is expected (the
+ * timer is a one-shot).
+ */
+function handleDialog(doc, testNum) {
+    netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
+    ok(true, "--- handleDialog for test " + testNum + " ---");
+
+    let dialog    = doc.getElementsByTagName("dialog")[0];
+    let listbox   = doc.getElementById("list");
+    let clickOK   = true;
+    let state;
+
+    // XXX check focused element
+    // XXX check text/passbox labels?
+    // XXX check button labels?
+
+    switch(testNum) {
+      case 1:
+        // Select (0 items)
+        state = {
+            msg   : "This is the select text.",
+            title : "TestTitle",
+            items : [],
+        };
+        checkExpectedSelectState(doc, state);
+        break;
+
+      case 2:
+        // Select (3 items, default ok)
+        state = {
+            msg   : "This is the select text.",
+            title : "TestTitle",
+            items : ["one", "two", "three"],
+        };
+        checkExpectedSelectState(doc, state);
+        break;
+
+      case 3:
+        // Select (3 items, change selection, ok)
+        state = {
+            msg   : "This is the select text.",
+            title : "TestTitle",
+            items : ["one", "two", "three"],
+        };
+        checkExpectedSelectState(doc, state);
+        // XXX need to trigger old code's click listener
+        listbox.selectedIndex = 1;
+        //listbox.getItemAtIndex(1).click();
+        break;
+
+      case 4:
+        // Select (3 items, cancel)
+        state = {
+            msg   : "This is the select text.",
+            title : "TestTitle",
+            items : ["one", "two", "three"],
+        };
+        checkExpectedSelectState(doc, state);
+        clickOK = false;
+        break;
+
+      default:
+        ok(false, "Uhh, unhandled switch for testNum #" + testNum);
+        break;
+    }
+
+
+    if (clickOK)
+        dialog.acceptDialog();
+    else
+        dialog.cancelDialog();
+
+    ok(true, "handleDialog done");
+    didDialog = true;
+}
+
+let testNum   = 0;
+let selectVal = {};
+let isOK;
+
+isSelectDialog = true;
+isTabModal = false;
+usePromptService = true;
+
+// ===== test 1 =====
+// Select (0 items, ok)
+testNum++;
+startCallbackTimer();
+items = [];
+selectVal.value = null; // outparam, just making sure.
+isOK = prompter.select(window, "TestTitle", "This is the select text.", items.length, items, selectVal);
+is(isOK, true, "checked expected retval");
+is(selectVal.value, -1, "checking selected index");
+ok(didDialog, "handleDialog was invoked");
+
+// ===== test 2 =====
+// Select (3 items, ok)
+testNum++;
+startCallbackTimer();
+items = ["one", "two", "three"];
+selectVal.value = null; // outparam, just making sure.
+isOK = prompter.select(window, "TestTitle", "This is the select text.", items.length, items, selectVal);
+is(isOK, true, "checked expected retval");
+is(selectVal.value, 0, "checking selected index");
+ok(didDialog, "handleDialog was invoked");
+
+// ===== test 3 =====
+// Select (3 items, selection changed, ok)
+testNum++;
+startCallbackTimer();
+items = ["one", "two", "three"];
+selectVal.value = null; // outparam, just making sure.
+isOK = prompter.select(window, "TestTitle", "This is the select text.", items.length, items, selectVal);
+is(isOK, true, "checked expected retval");
+is(selectVal.value, 1, "checking selected index");
+ok(didDialog, "handleDialog was invoked");
+
+// ===== test 4 =====
+// Select (3 items, cancel)
+testNum++;
+startCallbackTimer();
+items = ["one", "two", "three"];
+selectVal.value = null; // outparam, just making sure.
+isOK = prompter.select(window, "TestTitle", "This is the select text.", items.length, items, selectVal);
+is(isOK, false, "checked expected retval");
+is(selectVal.value, 0, "checking selected index");
+ok(didDialog, "handleDialog was invoked");
+
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp b/toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp
index 90c9f4ba3461..c445e06507c3 100644
--- a/toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp
+++ b/toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp
@@ -3184,12 +3184,14 @@ nsUrlClassifierDBServiceWorker::ApplyUpdate()
 {
   LOG(("nsUrlClassifierDBServiceWorker::ApplyUpdate"));
 
-  if (NS_FAILED(mUpdateStatus)) {
-    mConnection->RollbackTransaction();
-  } else {
-    mUpdateStatus = FlushChunkLists();
-    if (NS_SUCCEEDED(mUpdateStatus)) {
-      mUpdateStatus = mConnection->CommitTransaction();
+  if (mConnection) {
+    if (NS_FAILED(mUpdateStatus)) {
+      mConnection->RollbackTransaction();
+    } else {
+      mUpdateStatus = FlushChunkLists();
+      if (NS_SUCCEEDED(mUpdateStatus)) {
+        mUpdateStatus = mConnection->CommitTransaction();
+      }
     }
   }
 
@@ -3226,7 +3228,8 @@ nsUrlClassifierDBServiceWorker::FinishUpdate()
   // We need to get the error code before ApplyUpdate, because it might
   // close/open the connection.
   PRInt32 errcode = SQLITE_OK;
-  mConnection->GetLastError(&errcode);
+  if (mConnection)
+    mConnection->GetLastError(&errcode);
 
   ApplyUpdate();
 
diff --git a/toolkit/content/widgets/videocontrols.xml b/toolkit/content/widgets/videocontrols.xml
index be28c269c968..54ca242cac26 100644
--- a/toolkit/content/widgets/videocontrols.xml
+++ b/toolkit/content/widgets/videocontrols.xml
@@ -378,7 +378,7 @@
                         this.bufferBar.setAttribute("value", 0);
 
                     // Set the current status icon.
-                    if (this.video.error) {
+                    if (this.video.error || this.video.networkState == this.video.NETWORK_NO_SOURCE) {
                         this.statusIcon.setAttribute("type", "error");
                         this.setupStatusFader(true);
                     } else {
@@ -397,7 +397,7 @@
 
                     // If the video hits an error, suppress controls if it
                     // hasn't managed to do anything else yet.
-                    if (!this.firstFrameShown && this.video.error)
+                    if (!this.firstFrameShown && (this.video.error || this.video.networkState == this.video.NETWORK_NO_SOURCE))
                         enabled = false;
 
                     return enabled;
diff --git a/toolkit/mozapps/extensions/content/extensions.xul b/toolkit/mozapps/extensions/content/extensions.xul
index 64cfd26d21dd..cd6b8d5ae8ff 100644
--- a/toolkit/mozapps/extensions/content/extensions.xul
+++ b/toolkit/mozapps/extensions/content/extensions.xul
@@ -264,20 +264,28 @@
           <hbox class="view-header global-warning-container" align="center">
             <!-- global warnings -->
             <hbox class="global-warning" flex="1">
-              <image class="warning-icon"/>
-              <label class="global-warning-safemode" flex="1">
-                &warning.safemode.label;
-              </label>
-              <label class="global-warning-checkcompatibility" flex="1">
-                &warning.checkcompatibility.label;
-              </label>
+              <hbox class="global-warning-safemode" flex="1" align="center"
+                    tooltiptext="&warning.safemode.label;">
+                <image class="warning-icon"/>
+                <label class="global-warning-text" flex="1" crop="end"
+                       value="&warning.safemode.label;"/>
+              </hbox>
+              <hbox class="global-warning-checkcompatibility" flex="1" align="center"
+                    tooltiptext="&warning.checkcompatibility.label;">
+                <image class="warning-icon"/>
+                <label class="global-warning-text" flex="1" crop="end"
+                       value="&warning.checkcompatibility.label;"/>
+              </hbox>
               <button class="button-link global-warning-checkcompatibility"
                       label="&warning.checkcompatibility.enable.label;"
                       tooltiptext="&warning.checkcompatibility.enable.tooltip;"
                       command="cmd_enableCheckCompatibility"/>
-              <label class="global-warning-updatesecurity" flex="1">
-                &warning.updatesecurity.label;
-              </label>
+              <hbox class="global-warning-updatesecurity" flex="1" align="center"
+                    tooltiptext="&warning.updatesecurity.label;">
+                <image class="warning-icon"/>
+                <label class="global-warning-text" flex="1" crop="end"
+                       value="&warning.updatesecurity.label;"/>
+              </hbox>
               <button class="button-link global-warning-updatesecurity"
                       label="&warning.updatesecurity.enable.label;"
                       tooltiptext="&warning.updatesecurity.enable.tooltip;"
@@ -304,24 +312,32 @@
         </vbox>
 
         <!-- list view -->
-        <vbox id="list-view" flex="1" class="view-pane">
-          <hbox class="view-header global-warning-container" align="center">
+        <vbox id="list-view" flex="1" class="view-pane" align="stretch">
+          <hbox class="view-header global-warning-container">
             <!-- global warnings -->
             <hbox class="global-warning" flex="1">
-              <image class="warning-icon"/>
-              <label class="global-warning-safemode" flex="1">
-                &warning.safemode.label;
-              </label>
-              <label class="global-warning-checkcompatibility" flex="1">
-                &warning.checkcompatibility.label;
-              </label>
+              <hbox class="global-warning-safemode" flex="1" align="center"
+                    tooltiptext="&warning.safemode.label;">
+                <image class="warning-icon"/>
+                <label class="global-warning-text" flex="1" crop="end"
+                       value="&warning.safemode.label;"/>
+              </hbox>
+              <hbox class="global-warning-checkcompatibility" flex="1" align="center"
+                    tooltiptext="&warning.checkcompatibility.label;">
+                <image class="warning-icon"/>
+                <label class="global-warning-text" flex="1" crop="end"
+                       value="&warning.checkcompatibility.label;"/>
+              </hbox>
               <button class="button-link global-warning-checkcompatibility"
                       label="&warning.checkcompatibility.enable.label;"
                       tooltiptext="&warning.checkcompatibility.enable.tooltip;"
                       command="cmd_enableCheckCompatibility"/>
-              <label class="global-warning-updatesecurity" flex="1">
-                &warning.updatesecurity.label;
-              </label>
+              <hbox class="global-warning-updatesecurity" flex="1" align="center"
+                    tooltiptext="&warning.updatesecurity.label;">
+                <image class="warning-icon"/>
+                <label class="global-warning-text" flex="1" crop="end"
+                       value="&warning.updatesecurity.label;"/>
+              </hbox>
               <button class="button-link global-warning-updatesecurity"
                       label="&warning.updatesecurity.enable.label;"
                       tooltiptext="&warning.updatesecurity.enable.tooltip;"
@@ -348,20 +364,28 @@
           <hbox class="view-header global-warning-container" align="center">
             <!-- global warnings -->
             <hbox class="global-warning" flex="1">
-              <image class="warning-icon"/>
-              <label class="global-warning-safemode" flex="1">
-                &warning.safemode.label;
-              </label>
-              <label class="global-warning-checkcompatibility" flex="1">
-                &warning.checkcompatibility.label;
-              </label>
+              <hbox class="global-warning-safemode" flex="1" align="center"
+                    tooltiptext="&warning.safemode.label;">
+                <image class="warning-icon"/>
+                <label class="global-warning-text" flex="1" crop="end"
+                       value="&warning.safemode.label;"/>
+              </hbox>
+              <hbox class="global-warning-checkcompatibility" flex="1" align="center"
+                    tooltiptext="&warning.checkcompatibility.label;">
+                <image class="warning-icon"/>
+                <label class="global-warning-text" flex="1" crop="end"
+                       value="&warning.checkcompatibility.label;"/>
+              </hbox>
               <button class="button-link global-warning-checkcompatibility"
                       label="&warning.checkcompatibility.enable.label;"
                       tooltiptext="&warning.checkcompatibility.enable.tooltip;"
                       command="cmd_enableCheckCompatibility"/>
-              <label class="global-warning-updatesecurity" flex="1">
-                &warning.updatesecurity.label;
-              </label>
+              <hbox class="global-warning-updatesecurity" flex="1" align="center"
+                    tooltiptext="&warning.updatesecurity.label;">
+                <image class="warning-icon"/>
+                <label class="global-warning-text" flex="1" crop="end"
+                       value="&warning.updatesecurity.label;"/>
+              </hbox>
               <button class="button-link global-warning-updatesecurity"
                       label="&warning.updatesecurity.enable.label;"
                       tooltiptext="&warning.updatesecurity.enable.tooltip;"
@@ -393,20 +417,28 @@
         <scrollbox id="detail-view" flex="1" class="view-pane addon-view" orient="vertical">
           <!-- global warnings -->
           <hbox class="global-warning-container global-warning">
-            <image class="warning-icon"/>
-            <label class="global-warning-safemode" flex="1">
-              &warning.safemode.label;
-            </label>
-            <label class="global-warning-checkcompatibility" flex="1">
-              &warning.checkcompatibility.label;
-            </label>
+            <hbox class="global-warning-safemode" flex="1" align="center"
+                  tooltiptext="&warning.safemode.label;">
+              <image class="warning-icon"/>
+              <label class="global-warning-text" flex="1" crop="end"
+                     value="&warning.safemode.label;"/>
+            </hbox>
+            <hbox class="global-warning-checkcompatibility" flex="1" align="center"
+                  tooltiptext="&warning.checkcompatibility.label;">
+              <image class="warning-icon"/>
+              <label class="global-warning-text" flex="1" crop="end"
+                     value="&warning.checkcompatibility.label;"/>
+            </hbox>
             <button class="button-link global-warning-checkcompatibility"
                     label="&warning.checkcompatibility.enable.label;"
                     tooltiptext="&warning.checkcompatibility.enable.tooltip;"
                     command="cmd_enableCheckCompatibility"/>
-            <label class="global-warning-updatesecurity" flex="1">
-              &warning.updatesecurity.label;
-            </label>
+            <hbox class="global-warning-updatesecurity" flex="1" align="center"
+                  tooltiptext="&warning.updatesecurity.label;">
+              <image class="warning-icon"/>
+              <label class="global-warning-text" flex="1" crop="end"
+                     value="&warning.updatesecurity.label;"/>
+            </hbox>
             <button class="button-link global-warning-updatesecurity"
                     label="&warning.updatesecurity.enable.label;"
                     tooltiptext="&warning.updatesecurity.enable.tooltip;"
diff --git a/toolkit/mozapps/extensions/test/browser/browser_globalwarnings.js b/toolkit/mozapps/extensions/test/browser/browser_globalwarnings.js
index 4c9b852dad97..a0a7fdaacd9d 100644
--- a/toolkit/mozapps/extensions/test/browser/browser_globalwarnings.js
+++ b/toolkit/mozapps/extensions/test/browser/browser_globalwarnings.js
@@ -22,15 +22,15 @@ add_test(function() {
   Services.prefs.setBoolPref(pref, false);
 
   open_manager("addons://list/extension", function(aWindow) {
-    var label = aWindow.document.querySelector("#list-view label.global-warning-checkcompatibility");
-    is_element_visible(label, "Check Compatibility warning label should be visible");
+    var hbox = aWindow.document.querySelector("#list-view hbox.global-warning-checkcompatibility");
+    is_element_visible(hbox, "Check Compatibility warning hbox should be visible");
     var button = aWindow.document.querySelector("#list-view button.global-warning-checkcompatibility");
     is_element_visible(button, "Check Compatibility warning button should be visible");
 
     info("Clicking 'Enable' button");
     EventUtils.synthesizeMouse(button, 2, 2, { }, aWindow);
     is(Services.prefs.prefHasUserValue(pref), false, "Check Compatability pref should be cleared");
-    is_element_hidden(label, "Check Compatibility warning label should be hidden");
+    is_element_hidden(hbox, "Check Compatibility warning hbox should be hidden");
     is_element_hidden(button, "Check Compatibility warning button should be hidden");
 
     close_manager(aWindow, function() {
@@ -47,15 +47,15 @@ add_test(function() {
   Services.prefs.setBoolPref(pref, false);
 
   open_manager(null, function(aWindow) {
-    var label = aWindow.document.querySelector("#list-view label.global-warning-updatesecurity");
-    is_element_visible(label, "Check Update Security warning label should be visible");
+    var hbox = aWindow.document.querySelector("#list-view hbox.global-warning-updatesecurity");
+    is_element_visible(hbox, "Check Update Security warning hbox should be visible");
     var button = aWindow.document.querySelector("#list-view button.global-warning-updatesecurity");
     is_element_visible(button, "Check Update Security warning button should be visible");
 
     info("Clicking 'Enable' button");
     EventUtils.synthesizeMouse(button, 2, 2, { }, aWindow);
     is(Services.prefs.prefHasUserValue(pref), false, "Check Update Security pref should be cleared");
-    is_element_hidden(label, "Check Update Security warning label should be hidden");
+    is_element_hidden(hbox, "Check Update Security warning hbox should be hidden");
     is_element_hidden(button, "Check Update Security warning button should be hidden");
 
     close_manager(aWindow, function() {
diff --git a/toolkit/mozapps/installer/windows/nsis/common.nsh b/toolkit/mozapps/installer/windows/nsis/common.nsh
index 1c439ad55fbf..a64df8424a47 100755
--- a/toolkit/mozapps/installer/windows/nsis/common.nsh
+++ b/toolkit/mozapps/installer/windows/nsis/common.nsh
@@ -4752,6 +4752,13 @@
         ${SetBrandNameVars} "$INSTDIR\distribution\setup.ini"
       !endif
 
+      ; Application update uses a directory named tobedeleted in the $INSTDIR to
+      ; delete files on OS reboot when they are in use. Try to delete this
+      ; directory if it exists.
+      ${If} ${FileExists} "$INSTDIR\tobedeleted"
+        RmDir /r "$INSTDIR\tobedeleted"
+      ${EndIf}
+
       ; Prevent all operations (e.g. set as default, postupdate, etc.) when a
       ; reboot is required and the executable launched is helper.exe
       IfFileExists "$INSTDIR\${FileMainEXE}.moz-upgrade" +1 +4
@@ -5178,6 +5185,13 @@
       IfFileExists "$INSTDIR\uninstall" +2 +1
       CreateDirectory "$INSTDIR\uninstall"
 
+      ; Application update uses a directory named tobedeleted in the $INSTDIR to
+      ; delete files on OS reboot when they are in use. Try to delete this
+      ; directory if it exists.
+      ${If} ${FileExists} "$INSTDIR\tobedeleted"
+        RmDir /r "$INSTDIR\tobedeleted"
+      ${EndIf}
+
       ; Remove files that may be left behind by the application in the
       ; VirtualStore directory.
       ${CleanVirtualStore}
diff --git a/toolkit/mozapps/update/nsUpdateService.js b/toolkit/mozapps/update/nsUpdateService.js
index 84f329232012..311128fd0960 100644
--- a/toolkit/mozapps/update/nsUpdateService.js
+++ b/toolkit/mozapps/update/nsUpdateService.js
@@ -91,10 +91,17 @@ const CATEGORY_UPDATE_TIMER               = "update-timer";
 
 const KEY_APPDIR          = "XCurProcD";
 const KEY_GRED            = "GreD";
+
 #ifdef XP_WIN
 #ifndef WINCE
-const KEY_UPDROOT         = "UpdRootD";
+#define USE_UPDROOT
 #endif
+#elifdef ANDROID
+#define USE_UPDROOT
+#endif
+
+#ifdef USE_UPDROOT
+const KEY_UPDROOT         = "UpdRootD";
 #endif
 
 const DIR_UPDATES         = "updates";
@@ -373,14 +380,12 @@ function binaryToHex(input) {
 #  @return  nsIFile object for the location specified.
  */
 function getUpdateDirCreate(pathArray) {
-#ifdef XP_WIN
-#ifndef WINCE
+#ifdef USE_UPDROOT
   try {
     let dir = FileUtils.getDir(KEY_UPDROOT, pathArray, true);
     return dir;
   } catch (e) {
   }
-#endif
 #endif
   return FileUtils.getDir(KEY_APPDIR, pathArray, true);
 }
@@ -2639,14 +2644,6 @@ Downloader.prototype = {
         if (this.background)
           shouldShowPrompt = true;
 
-#ifdef ANDROID
-        // Give read permissions to everyone so the .APK file is accessible by
-        // the system installer (bug 596662).
-        let patchFile = getUpdatesDir().QueryInterface(Ci.nsILocalFile);
-        patchFile.append(FILE_UPDATE_ARCHIVE);
-        patchFile.permissions = FileUtils.PERMS_FILE;
-#endif
-
         // Tell the updater.exe we're ready to apply.
         writeStatusFile(getUpdatesDir(), state);
         writeVersionFile(getUpdatesDir(), this._update.appVersion);
diff --git a/toolkit/mozapps/update/nsUpdateServiceStub.js b/toolkit/mozapps/update/nsUpdateServiceStub.js
index 654adc32f57f..d249904b1d26 100644
--- a/toolkit/mozapps/update/nsUpdateServiceStub.js
+++ b/toolkit/mozapps/update/nsUpdateServiceStub.js
@@ -45,10 +45,17 @@ const DIR_UPDATES         = "updates";
 const FILE_UPDATE_STATUS  = "update.status";
 
 const KEY_APPDIR          = "XCurProcD";
+
 #ifdef XP_WIN
 #ifndef WINCE
-const KEY_UPDROOT         = "UpdRootD";
+#define USE_UPDROOT
 #endif
+#elifdef ANDROID
+#define USE_UPDROOT
+#endif
+
+#ifdef USE_UPDROOT
+const KEY_UPDROOT         = "UpdRootD";
 #endif
 
 /**
@@ -60,14 +67,12 @@ const KEY_UPDROOT         = "UpdRootD";
 #  @return  nsIFile object for the location specified.
  */
 function getUpdateDirNoCreate(pathArray) {
-#ifdef XP_WIN
-#ifndef WINCE
+#ifdef USE_UPDROOT
   try {
     let dir = FileUtils.getDir(KEY_UPDROOT, pathArray, false);
     return dir;
   } catch (e) {
   }
-#endif
 #endif
   return FileUtils.getDir(KEY_APPDIR, pathArray, false);
 }
diff --git a/toolkit/mozapps/update/test/TestAUSHelper.cpp b/toolkit/mozapps/update/test/TestAUSHelper.cpp
index 92b8f7ed52d1..9119304650af 100644
--- a/toolkit/mozapps/update/test/TestAUSHelper.cpp
+++ b/toolkit/mozapps/update/test/TestAUSHelper.cpp
@@ -14,6 +14,8 @@
     _snwprintf(dest, _count, fmt, ##__VA_ARGS__); \
     dest[_count] = L'\0';
 # define NS_tfopen _wfopen
+# define NS_tstrcmp wcscmp
+# define NS_ttoi _wtoi
 # define LOG_S "%S"
 #else
 # include <unistd.h>
@@ -22,10 +24,14 @@
 # define NS_T(str) str
 # define NS_tsnprintf snprintf
 # define NS_tfopen fopen
+# define NS_tstrcmp strcmp
+# define NS_ttoi atoi
 # define LOG_S "%s"
 #endif
 
+#include <stdlib.h>
 #include <stdio.h>
+#include <string.h>
 
 #ifndef MAXPATHLEN
 # ifdef PATH_MAX
@@ -43,18 +49,64 @@
 
 int NS_main(int argc, NS_tchar **argv)
 {
+
+  if (argc < 2) {
+    fprintf(stderr, \
+            "\n" \
+            "Application Update Service Test Helper\n" \
+            "\n" \
+            "Usage: -s SECONDS [LOCKTYPE FILETOLOCK]\n"  \
+            "   or: LOGFILE [ARG2 ARG3...]\n" \
+            "\n" \
+            "  SECONDS     \tThe number of seconds to sleep.\n" \
+            "  FILETOLOCK  \tThe relative path to an existing file to open exlusively.\n" \
+            "              \tOnly available on Windows platforms and silently ignored on" \
+            "              \tother platforms.\n" \
+            "  LOGFILE     \tThe file path relative to the working directory to log the\n" \
+            "              \targuments passed to.\n" \
+            "  ARG2 ARG3...\tArguments to write to the log file.\n" \
+            "\n" \
+            "All paths should be relative since paths in a build environment can have a\n" \
+            "path length that is larger than the maximum path length on Windows.\n" \
+            "\n");
+    return 1;
+  }
+
+  // File in use test helper section
+  if (NS_tstrcmp(argv[1], NS_T("-s")) == 0) {
+#ifdef XP_WIN
+    int milliseconds = NS_ttoi(argv[2]) * 1000;
+    HANDLE hFile = INVALID_HANDLE_VALUE;
+    if (argc == 4) {
+      hFile = CreateFileW(argv[3],
+#ifdef WINCE
+                          GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE,
+#else
+                          DELETE | GENERIC_WRITE, 0,
+#endif
+                          NULL, OPEN_EXISTING, 0, NULL);
+      if (hFile == INVALID_HANDLE_VALUE) {
+        return 1;
+      }
+    }
+
+    Sleep(milliseconds);
+
+    if (argc == 5) {
+      CloseHandle(hFile);
+    }
+#else
+    int seconds = NS_ttoi(argv[2]);
+    sleep(seconds);
+#endif
+    return 0;
+  }
+
+  // Command line argument test helper section
   NS_tchar logFilePath[MAXPATHLEN];
 
-#ifdef XP_WIN
-  NS_tchar exePath[MAXPATHLEN];
-
-  ::GetModuleFileNameW(0, exePath, MAXPATHLEN);
   NS_tsnprintf(logFilePath, sizeof(logFilePath)/sizeof(logFilePath[0]),
-               NS_T("%s.log"), exePath);
-#else
-  NS_tsnprintf(logFilePath, sizeof(logFilePath)/sizeof(logFilePath[0]),
-               NS_T("%s.log"), argv[0]);
-#endif
+               NS_T("%s"), argv[1]);
 
   FILE* logFP = NS_tfopen(logFilePath, NS_T("w"));
 
diff --git a/toolkit/mozapps/update/test/shared.js b/toolkit/mozapps/update/test/shared.js
index 25ede2ed1a41..276c486b3247 100644
--- a/toolkit/mozapps/update/test/shared.js
+++ b/toolkit/mozapps/update/test/shared.js
@@ -315,7 +315,7 @@ function readFileBytes(aFile) {
     data.push(String.fromCharCode.apply(null, bytes));
     count -= bytes.length;
     if (bytes.length == 0)
-      do_throw("Nothing read from input stream!");
+      throw "Nothing read from input stream!";
   }
   data.join('');
   fis.close();
@@ -432,7 +432,8 @@ function cleanUpdatesDir(aDir) {
  * Deletes a directory and its children. First it tries nsIFile::Remove(true).
  * If that fails it will fall back to recursing, setting the appropriate
  * permissions, and deleting the current entry.
- * @param   dir
+ *
+ * @param   aDir
  *          A nsIFile for the directory to be deleted
  */
 function removeDirRecursive(aDir) {
diff --git a/toolkit/mozapps/update/test/unit/data/aus-0110_general.mar b/toolkit/mozapps/update/test/unit/data/complete.mar
similarity index 100%
rename from toolkit/mozapps/update/test/unit/data/aus-0110_general.mar
rename to toolkit/mozapps/update/test/unit/data/complete.mar
diff --git a/toolkit/mozapps/update/test/unit/data/aus-0110_general_ref_image.png b/toolkit/mozapps/update/test/unit/data/complete.png
similarity index 100%
rename from toolkit/mozapps/update/test/unit/data/aus-0110_general_ref_image.png
rename to toolkit/mozapps/update/test/unit/data/complete.png
diff --git a/toolkit/mozapps/update/test/unit/data/aus-0111_general.mar b/toolkit/mozapps/update/test/unit/data/partial.mar
similarity index 100%
rename from toolkit/mozapps/update/test/unit/data/aus-0111_general.mar
rename to toolkit/mozapps/update/test/unit/data/partial.mar
diff --git a/toolkit/mozapps/update/test/unit/data/aus-0111_general_ref_image.png b/toolkit/mozapps/update/test/unit/data/partial.png
similarity index 100%
rename from toolkit/mozapps/update/test/unit/data/aus-0111_general_ref_image.png
rename to toolkit/mozapps/update/test/unit/data/partial.png
diff --git a/toolkit/mozapps/update/test/unit/data/partial_in_use_win.mar b/toolkit/mozapps/update/test/unit/data/partial_in_use_win.mar
new file mode 100644
index 000000000000..e4d1e27d2e8e
Binary files /dev/null and b/toolkit/mozapps/update/test/unit/data/partial_in_use_win.mar differ
diff --git a/toolkit/mozapps/update/test/unit/data/partial_in_use_win_after.exe b/toolkit/mozapps/update/test/unit/data/partial_in_use_win_after.exe
new file mode 100644
index 000000000000..b8a25fab6613
Binary files /dev/null and b/toolkit/mozapps/update/test/unit/data/partial_in_use_win_after.exe differ
diff --git a/toolkit/mozapps/update/test/unit/data/partial_in_use_win_before.exe b/toolkit/mozapps/update/test/unit/data/partial_in_use_win_before.exe
new file mode 100644
index 000000000000..fe74dddc81b3
Binary files /dev/null and b/toolkit/mozapps/update/test/unit/data/partial_in_use_win_before.exe differ
diff --git a/toolkit/mozapps/update/test/unit/head_update.js.in b/toolkit/mozapps/update/test/unit/head_update.js.in
index ef3c689bb7a5..290d7ea04fda 100644
--- a/toolkit/mozapps/update/test/unit/head_update.js.in
+++ b/toolkit/mozapps/update/test/unit/head_update.js.in
@@ -35,9 +35,66 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
+const INSTALL_LOCALE = "@AB_CD@";
+const APP_BIN_NAME = "@MOZ_APP_NAME@";
+const BIN_SUFFIX = "@BIN_SUFFIX@";
+
+#ifdef XP_UNIX
+const APP_BIN_SUFFIX = "-bin";
+#else
+const APP_BIN_SUFFIX = "@BIN_SUFFIX@";
+#endif
+
+#ifdef XP_WIN
+const IS_WIN = true;
+#else
+const IS_WIN = false;
+#endif
+
+#ifdef WINCE
+const IS_WINCE = true;
+#else
+const IS_WINCE = false;
+#endif
+
+#ifdef XP_OS2
+const IS_OS2 = true;
+#else
+const IS_OS2 = false;
+#endif
+
+#ifdef XP_MACOSX
+const IS_MACOSX = true;
+#else
+const IS_MACOSX = false;
+#endif
+
+#ifdef XP_UNIX
+const IS_UNIX = true;
+#else
+const IS_UNIX = false;
+#endif
+
+#ifdef ANDROID
+const IS_ANDROID = true;
+#else
+const IS_ANDROID = false;
+#endif
+
 const URL_HOST = "http://localhost:4444/";
 const URL_PATH = "data";
 
+const AFTER_APPLY_DIR = "afterApplyDir";
+const APPLY_TO_DIR_SUFFIX = "_applyToDir";
+const HELPER_BIN_FILE = "TestAUSHelper" + BIN_SUFFIX;
+const MAR_COMPLETE_FILE = "data/complete.mar";
+const MAR_PARTIAL_FILE = "data/partial.mar";
+const UPDATER_BIN_FILE = "updater" + BIN_SUFFIX;
+const UPDATES_DIR_SUFFIX = "_mar";
+
+const CALLBACK_BIN_FILE = "callback_app" + BIN_SUFFIX;
+const CALLBACK_ARGS = [AFTER_APPLY_DIR + "/output.log", "Test Arg 2", "Test Arg 3"];
+
 var gTestserver;
 
 var gXHR;
@@ -124,29 +181,30 @@ function pathHandler(metadata, response) {
 }
 
 /**
- * Launches the updater binary to apply a mar file using the current working
- * directory for the location to apply the mar.
+ * Helper function for updater tests for launching the updater binary to apply
+ * a mar file.
  *
- * @param   aUpdater
- *          The updater binary binary to copy to aUpdatesDir.
- * @param   aUpdatesDir
- *          The directory to copy the update mar, binary, etc.
- * @param   aApplyToDir
- *          The directory where the update will be applied.
- * @param   aCallbackApp (optional)
- *          The application to launch after the update.
- * @param   aAppArgs (optional)
- *          The arguments to pass to the callback application.
+ * @param   aTestID
+ *          A string used to identify the name of directories for a test.
  * @return  The exit value returned from the updater binary.
  */
-function runUpdate(aUpdater, aUpdatesDir, aApplyToDir, aCallbackApp, aAppArgs) {
-  // Copy the updater binary to the update directory so the updater.ini is not
-  // in the same directory as it is. This prevents the PostUpdate executable
-  // which is defined in the updater.ini from launching and the updater ui from
-  // displaying.
-  aUpdater.copyTo(aUpdatesDir, aUpdater.leafName);
-  var updateBin = aUpdatesDir.clone();
-  updateBin.append(aUpdater.leafName);
+function runUpdate(aTestID) {
+  // Copy the updater binary to the updates directory.
+  let binDir = getGREDir();
+  let updater = binDir.clone();
+  updater.append("updater.app");
+  if (!updater.exists()) {
+    updater = binDir.clone();
+    updater.append(UPDATER_BIN_FILE);
+    if (!updater.exists()) {
+      do_throw("Unable to find updater binary!");
+    }
+  }
+
+  let updatesDir = do_get_file(aTestID + UPDATES_DIR_SUFFIX, true);
+  updater.copyTo(updatesDir, updater.leafName);
+  let updateBin = updatesDir.clone();
+  updateBin.append(updater.leafName);
   if (updateBin.leafName == "updater.app") {
     updateBin.append("Contents");
     updateBin.append("MacOS");
@@ -155,36 +213,359 @@ function runUpdate(aUpdater, aUpdatesDir, aApplyToDir, aCallbackApp, aAppArgs) {
       do_throw("Unable to find the updater executable!");
   }
 
-  var updatesDirPath = aUpdatesDir.path;
+  let updatesDirPath = updatesDir.path;
   if (/ /.test(updatesDirPath))
     updatesDirPath = '"' + updatesDirPath + '"';
 
-  var applyToPath = aApplyToDir.path;
-  if (/ /.test(applyToPath))
-    applyToPath = '"' + applyToPath + '"';
+  let applyToDir = do_get_file(aTestID + APPLY_TO_DIR_SUFFIX, true);
+  let applyToDirPath = applyToDir.path;
+  if (/ /.test(applyToDirPath))
+    applyToDirPath = '"' + applyToDirPath + '"';
 
-  var args;
-  if (aCallbackApp) {
-    var cwdPath = aCallbackApp.parent.parent.path;
-    if (/ /.test(cwdPath))
-      cwdPath = '"' + cwdPath + '"';
+  let callbackApp = applyToDir.clone();
+  callbackApp.append(AFTER_APPLY_DIR);
+  callbackApp.append(CALLBACK_BIN_FILE);
+  callbackApp.permissions = PERMS_DIRECTORY;
 
-    var testAppPath = aCallbackApp.path;
-    if (/ /.test(testAppPath))
-      testAppPath = '"' + testAppPath + '"';
-    args = [updatesDirPath, applyToPath, 0, cwdPath, testAppPath].
-           concat(aAppArgs);
-  }
-  else {
-    args = [updatesDirPath, applyToPath];
-  }
-  var process = AUS_Cc["@mozilla.org/process/util;1"].
+  let cwdPath = callbackApp.parent.parent.path;
+  if (/ /.test(cwdPath))
+    cwdPath = '"' + cwdPath + '"';
+
+  let callbackAppPath = callbackApp.path;
+  if (/ /.test(callbackAppPath))
+    callbackAppPath = '"' + callbackAppPath + '"';
+
+  let args = [updatesDirPath, applyToDirPath, 0, cwdPath, callbackAppPath].
+             concat(CALLBACK_ARGS);
+  let process = AUS_Cc["@mozilla.org/process/util;1"].
                 createInstance(AUS_Ci.nsIProcess);
   process.init(updateBin);
   process.run(true, args, args.length);
   return process.exitValue;
 }
 
+/**
+ * Helper function for updater tests for setting up the files and directories
+ * used by the updater tests.
+ *
+ * @param   aTestID
+ *          A string used to identify the name of directories for a test.
+ * @param   aMarFile
+ *          The mar file to copy the update mar to.
+ * @param   aTestFiles
+ *          An array of JavaScript objects representing the test files to create
+ *          for the test.
+ */
+function setupUpdaterTest(aTestID, aMarFile, aTestFiles) {
+  // Remove the directory where the updater, mar file, etc. will be copied to
+  let updatesDir = do_get_file(aTestID + UPDATES_DIR_SUFFIX, true);
+  try {
+    removeDirRecursive(updatesDir);
+  }
+  catch (e) {
+    dump("Unable to remove directory\n" +
+         "path: " + updatesDir.path + "\n" +
+         "Exception: " + e + "\n");
+  }
+  if (!updatesDir.exists()) {
+    updatesDir.create(AUS_Ci.nsIFile.DIRECTORY_TYPE, PERMS_DIRECTORY);
+  }
+
+  // Remove the directory where the update will be applied if it exists.
+  let applyToDir = do_get_file(aTestID + APPLY_TO_DIR_SUFFIX, true);
+  try {
+    removeDirRecursive(applyToDir);
+  }
+  catch (e) {
+    dump("Unable to remove directory\n" +
+         "path: " + applyToDir.path + "\n" +
+         "Exception: " + e + "\n");
+  }
+  logTestInfo("testing successful removal of the directory used to apply the " +
+              "mar file");
+  do_check_false(applyToDir.exists());
+
+  // Add the test files that will be updated for a successful update or left in
+  // the initial state for a failed update.
+  for (let i = 0; i < aTestFiles.length; i++) {
+    let f = aTestFiles[i];
+    if (f.originalFile || f.originalContents) {
+      let testDir = do_get_file(f.destinationDir, true);
+      if (!testDir.exists())
+        testDir.create(AUS_Ci.nsIFile.DIRECTORY_TYPE, PERMS_DIRECTORY);
+
+      let testFile;
+      if (f.originalFile) {
+        testFile = do_get_file(f.originalFile);
+        testFile.copyTo(testDir, f.fileName);
+        testFile = do_get_file(f.destinationDir + f.fileName);
+      }
+      else {
+        testFile = do_get_file(f.destinationDir + f.fileName, true);
+        writeFile(testFile, f.originalContents);
+      }
+
+      // Skip these tests on Windows (includes WinCE) and OS/2 since their
+      // implementaions of chmod doesn't really set permissions.
+      if (!IS_WIN && !IS_OS2 && f.originalPerms) {
+        testFile.permissions = f.originalPerms;
+        // Store the actual permissions on the file for reference later after
+        // setting the permissions.
+        if (!f.comparePerms)
+          f.comparePerms = testFile.permissions;
+      }
+    }
+  }
+
+  let afterApplyBinDir = applyToDir.clone();
+  afterApplyBinDir.append(AFTER_APPLY_DIR);
+
+  let helperBin = do_get_file(HELPER_BIN_FILE);
+  helperBin.copyTo(afterApplyBinDir, CALLBACK_BIN_FILE);
+
+  let updaterIniContents = "[Strings]\n" +
+                           "Title=Update XPCShell Test\n" +
+                           "Info=Application Update Test - " + aTestID + "\n";
+  let updaterIni = updatesDir.clone();
+  updaterIni.append(FILE_UPDATER_INI);
+  writeFile(updaterIni, updaterIniContents);
+  updaterIni.copyTo(afterApplyBinDir, FILE_UPDATER_INI);
+
+  // Copy the mar that will be applied
+  let mar = do_get_file(aMarFile);
+  mar.copyTo(updatesDir, FILE_UPDATE_ARCHIVE);
+}
+
+/**
+ * Helper function for updater tests for cleaning up the state after an updater
+ * test has finished.
+ *
+ * @param   aTestID
+ *          A string used to identify the name of directories for a test.
+ */
+function cleanupUpdaterTest(aTestID) {
+  let updatesDir = do_get_file(aTestID + UPDATES_DIR_SUFFIX, true);
+  try {
+    removeDirRecursive(updatesDir);
+  }
+  catch (e) {
+    dump("Unable to remove directory\n" +
+         "path: " + updatesDir.path + "\n" +
+         "Exception: " + e + "\n");
+  }
+
+  // Try to remove the updates and the apply to directories.
+  let applyToDir = do_get_file(aTestID + APPLY_TO_DIR_SUFFIX, true);
+  try {
+    removeDirRecursive(applyToDir);
+  }
+  catch (e) {
+    dump("Unable to remove directory\n" +
+         "path: " + applyToDir.path + "\n" +
+         "Exception: " + e + "\n");
+  }
+
+  cleanUp();
+}
+
+/**
+ * Helper function for updater tests for verifying the state of files and
+ * directories after a successful update.
+ *
+ * @param   aTestID
+ *          A string used to identify the name of directories for a test.
+ * @param   aTestFiles
+ *          An array of JavaScript objects representing the test files to create
+ *          for the test.
+ */
+function checkFilesAfterUpdateSuccess(aTestID, aTestFiles) {
+  logTestInfo("testing contents of files after a successful update");
+  for (let i = 0; i < aTestFiles.length; i++) {
+    let f = aTestFiles[i];
+    let testFile = do_get_file(f.destinationDir + f.fileName, true);
+    logTestInfo("testing file: " + testFile.path);
+    if (f.compareFile || f.compareContents) {
+      do_check_true(testFile.exists());
+
+      // Skip these tests on Windows (includes WinCE) and OS/2 since their
+      // implementaions of chmod doesn't really set permissions.
+      if (!IS_WIN && !IS_OS2 && f.comparePerms) {
+        // Check if the permssions as set in the complete mar file are correct.
+        let logPerms = "testing file permissions - ";
+        if (f.originalPerms) {
+          logPerms += "original permissions: " + f.originalPerms.toString(8) + ", ";
+        }
+        logPerms += "compare permissions : " + f.comparePerms.toString(8) + ", ";
+        logPerms += "updated permissions : " + testFile.permissions.toString(8);
+        logTestInfo(logPerms);
+        do_check_eq(testFile.permissions & 0xfff, f.comparePerms & 0xfff);
+      }
+
+      if (f.compareFile) {
+        do_check_eq(readFileBytes(testFile),
+                    readFileBytes(do_get_file(f.compareFile)));
+        if (f.originalFile) {
+          // Verify that readFileBytes returned the entire contents by checking
+          // the contents against the original file.
+          do_check_neq(readFileBytes(testFile),
+                       readFileBytes(do_get_file(f.originalFile)));
+        }
+      }
+      else {
+        do_check_eq(readFileBytes(testFile), f.compareContents);
+      }
+    }
+    else {
+      do_check_false(testFile.exists());
+    }
+  }
+
+  checkFilesAfterUpdateCommon(aTestID);
+}
+
+/**
+ * Helper function for updater tests for verifying the state of files and
+ * directories after a failed update.
+ *
+ * @param   aTestID
+ *          A string used to identify the name of directories for a test.
+ * @param   aTestFiles
+ *          An array of JavaScript objects representing the test files to create
+ *          for the test.
+ */
+function checkFilesAfterUpdateFailure(aTestID, aTestFiles) {
+  logTestInfo("testing contents of files after a failed update");
+  for (let i = 0; i < aTestFiles.length; i++) {
+    let f = aTestFiles[i];
+    let testFile = do_get_file(f.destinationDir + f.fileName, true);
+    logTestInfo("testing file: " + testFile.path);
+    if (f.compareFile || f.compareContents) {
+      do_check_true(testFile.exists());
+
+      // Skip these tests on Windows (includes WinCE) and OS/2 since their
+      // implementaions of chmod doesn't really set permissions.
+      if (!IS_WIN && !IS_OS2 && f.comparePerms) {
+        // Check the original permssions are retained on the file.
+        let logPerms = "testing file permissions - ";
+        if (f.originalPerms) {
+          logPerms += "original permissions: " + f.originalPerms.toString(8) + ", ";
+        }
+        logPerms += "compare permissions : " + f.comparePerms.toString(8) + ", ";
+        logPerms += "updated permissions : " + testFile.permissions.toString(8);
+        logTestInfo(logPerms);
+        do_check_eq(testFile.permissions & 0xfff, f.comparePerms & 0xfff);
+      }
+
+      if (f.compareFile) {
+        do_check_eq(readFileBytes(testFile),
+                    readFileBytes(do_get_file(f.compareFile)));
+      }
+      else {
+        do_check_eq(readFileBytes(testFile), f.compareContents);
+      }
+    }
+    else {
+      do_check_false(testFile.exists());
+    }
+  }
+
+  checkFilesAfterUpdateCommon(aTestID);
+}
+
+/**
+ * Helper function for updater tests for verifying patch files and moz-backup
+ * files aren't left behind after a successful or failed update.
+ *
+ * @param   aTestID
+ *          A string used to identify the name of directories for a test.
+ */
+function checkFilesAfterUpdateCommon(aTestID) {
+  logTestInfo("testing patch files should not be left behind");
+  let updatesDir = do_get_file(aTestID + UPDATES_DIR_SUFFIX, true);
+  let entries = updatesDir.QueryInterface(AUS_Ci.nsIFile).directoryEntries;
+  while (entries.hasMoreElements()) {
+    let entry = entries.getNext().QueryInterface(AUS_Ci.nsIFile);
+    do_check_neq(getFileExtension(entry), "patch");
+  }
+
+  logTestInfo("testing backup files should not be left behind");
+  let applyToDir = do_get_file(aTestID + APPLY_TO_DIR_SUFFIX, true);
+  checkFilesInDirRecursive(applyToDir, checkForBackupFiles);
+}
+
+/**
+ * Helper function for updater tests for verifying the contents of the updater
+ * callback application log which should contain the string executed and the
+ * arguments passed to the callback application.
+ */
+function checkCallbackAppLog(aTestID) {
+  let appLaunchLog = do_get_file(aTestID + APPLY_TO_DIR_SUFFIX + "/" +
+                                 CALLBACK_ARGS[0], true);
+  if (!appLaunchLog.exists()) {
+    do_timeout(0, function() {
+      checkCallbackAppLog(aTestID);
+    });
+    return;
+  }
+
+  let expectedLogContents = "executed\n" + CALLBACK_ARGS.join("\n") + "\n";
+  let logContents = readFile(appLaunchLog).replace(/\r\n/g, "\n");
+  // It is possible for the log file contents check to occur before the log file
+  // contents are completely written so wait until the contents are the expected
+  // value. If the contents are never the expected value then the test will
+  // fail by timing out.
+  if (logContents != expectedLogContents) {
+    do_timeout(0, function() {
+      checkCallbackAppLog(aTestID);
+    });
+    return;
+  }
+
+  logTestInfo("testing that the callback application successfully launched " +
+              "and the expected command line arguments passed to it");
+  do_check_eq(logContents, expectedLogContents);
+
+  do_test_finished();
+}
+
+/**
+ * Helper function for updater tests for verifying there are no update backup
+ * files left behind after an update.
+ *
+ * @param   aFile
+ *          An nsIFile to check if it has moz-backup for its extension.
+ */
+function checkForBackupFiles(aFile) {
+  do_check_neq(getFileExtension(aFile), "moz-backup");
+}
+
+/**
+ * Helper function for updater tests for recursively enumerating a directory and
+ * calls a callback function with the file as a parameter for each file found.
+ *
+ * @param   aDir
+ *          A nsIFile for the directory to be deleted
+ * @param   aCallback
+ *          A callback function that will be called with the file as a
+ *          parameter for each file found.
+ */
+function checkFilesInDirRecursive(aDir, aCallback) {
+  if (!aDir.exists())
+    do_throw("Directory must exist!");
+
+  let dirEntries = aDir.directoryEntries;
+  while (dirEntries.hasMoreElements()) {
+    let entry = dirEntries.getNext().QueryInterface(AUS_Ci.nsIFile);
+
+    if (entry.isDirectory()) {
+      checkFilesInDirRecursive(entry, aCallback);
+    }
+    else {
+      aCallback(entry);
+    }
+  }
+}
+
 /**
  * Sets up the bare bones XMLHttpRequest implementation below. 
  *
@@ -400,53 +781,3 @@ var gDirProvider = {
   }
 };
 Services.dirsvc.QueryInterface(AUS_Ci.nsIDirectoryService).registerProvider(gDirProvider);
-
-const INSTALL_LOCALE = "@AB_CD@";
-
-// These are placed at the end so they don't mess up line numbering
-
-const APP_BIN_NAME = "@MOZ_APP_NAME@";
-
-#ifdef XP_UNIX
-const APP_BIN_SUFFIX = "-bin";
-#else
-const APP_BIN_SUFFIX = "@BIN_SUFFIX@";
-#endif
-
-const BIN_SUFFIX = "@BIN_SUFFIX@";
-
-#ifdef XP_WIN
-const IS_WIN = true;
-#else
-const IS_WIN = false;
-#endif
-
-#ifdef WINCE
-const IS_WINCE = true;
-#else
-const IS_WINCE = false;
-#endif
-
-#ifdef XP_OS2
-const IS_OS2 = true;
-#else
-const IS_OS2 = false;
-#endif
-
-#ifdef XP_MACOSX
-const IS_MACOSX = true;
-#else
-const IS_MACOSX = false;
-#endif
-
-#ifdef XP_UNIX
-const IS_UNIX = true;
-#else
-const IS_UNIX = false;
-#endif
-
-#ifdef ANDROID
-const IS_ANDROID = true;
-#else
-const IS_ANDROID = false;
-#endif
diff --git a/toolkit/mozapps/update/test/unit/test_0110_general.js b/toolkit/mozapps/update/test/unit/test_0110_general.js
index 2f8b37c57f19..4c9702a8c8e0 100644
--- a/toolkit/mozapps/update/test/unit/test_0110_general.js
+++ b/toolkit/mozapps/update/test/unit/test_0110_general.js
@@ -11,15 +11,15 @@
  * for the specific language governing rights and limitations under the
  * License.
  *
- * The Original Code is the Application Update Service.
+ * The Original Code is mozilla.org code.
  *
  * The Initial Developer of the Original Code is
- * Robert Strong <robert.bugzilla@gmail.com>.
- *
+ * the Mozilla Foundation.
  * Portions created by the Initial Developer are Copyright (C) 2008
- * the Mozilla Foundation <http://www.mozilla.org/>. All Rights Reserved.
+ * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
+ *   Robert Strong <robert.bugzilla@gmail.com> (Original Author)
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -38,40 +38,26 @@
 
 /* General Complete MAR File Patch Apply Test */
 
-const APPLY_TO_DIR = "applyToDir_0110";
-const UPDATES_DIR  = "0110_mar";
-const AFTER_APPLY_DIR = "afterApplyDir";
-const UPDATER_BIN_FILE = "updater" + BIN_SUFFIX;
-const AFTER_APPLY_BIN_FILE = "TestAUSHelper" + BIN_SUFFIX;
-const RELAUNCH_BIN_FILE = "relaunch_app" + BIN_SUFFIX;
-const RELAUNCH_ARGS = ["Test Arg 1", "Test Arg 2", "Test Arg 3"];
+const TEST_ID = "0110";
 // All we care about is that the last modified time has changed so that Mac OS
 // X Launch Services invalidates its cache so the test allows up to one minute
 // difference in the last modified time.
 const MAX_TIME_DIFFERENCE = 60000;
 
-var gTestFiles = [
+// The files are in the same order as they are applied from the mar
+const TEST_FILES = [
 {
-  fileName         : "1_exe1.exe",
-  destinationDir   : APPLY_TO_DIR + "/mar_test/1/",
-  originalContents : null,
-  compareContents  : null,
-  originalFile     : "data/aus-0111_general_ref_image.png",
-  compareFile      : "data/aus-0110_general_ref_image.png",
-  originalPerms    : 0777,
-  comparePerms     : 0755
-}, {
   fileName         : "1_1_image1.png",
-  destinationDir   : APPLY_TO_DIR + "/mar_test/1/1_1/",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
   originalContents : null,
   compareContents  : null,
   originalFile     : null,
-  compareFile      : "data/aus-0110_general_ref_image.png",
+  compareFile      : "data/complete.png",
   originalPerms    : 0776,
   comparePerms     : 0644
 }, {
   fileName         : "1_1_text1",
-  destinationDir   : APPLY_TO_DIR + "/mar_test/1/1_1/",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
   originalContents : "ToBeReplacedWithToBeModified\n",
   compareContents  : "ToBeModified\n",
   originalFile     : null,
@@ -80,16 +66,25 @@ var gTestFiles = [
   comparePerms     : 0644
 }, {
   fileName         : "1_1_text2",
-  destinationDir   : APPLY_TO_DIR + "/mar_test/1/1_1/",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
   originalContents : "ToBeReplacedWithToBeDeleted\n",
   compareContents  : "ToBeDeleted\n",
   originalFile     : null,
   compareFile      : null,
   originalPerms    : 0677,
   comparePerms     : 0644
+}, {
+  fileName         : "1_exe1.exe",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/",
+  originalContents : null,
+  compareContents  : null,
+  originalFile     : "data/partial.png",
+  compareFile      : "data/complete.png",
+  originalPerms    : 0777,
+  comparePerms     : 0755
 }, {
   fileName         : "2_1_text1",
-  destinationDir   : APPLY_TO_DIR + "/mar_test/2/2_1/",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/2/2_1/",
   originalContents : "ToBeReplacedWithToBeDeleted\n",
   compareContents  : "ToBeDeleted\n",
   originalFile     : null,
@@ -107,119 +102,32 @@ function run_test() {
   do_test_pending();
   do_register_cleanup(end_test);
 
-  var testDir, testFile;
+  setupUpdaterTest(TEST_ID, MAR_COMPLETE_FILE, TEST_FILES);
 
-  // The directory the updates will be applied to is the directory name stored
-  // in the APPLY_TO_DIR constant located in the current working directory and
-  // not dist/bin.
-  var applyToDir = do_get_file(APPLY_TO_DIR, true);
+  // The testUpdate function is used for consistency with the tests that require
+  // a timeout before continuing the test.
+  testUpdate();
+}
 
-  // Remove the directory where the update will be applied if it exists.
-  try {
-    removeDirRecursive(applyToDir);
-  }
-  catch (e) {
-    dump("Unable to remove directory\n" +
-         "path: " + applyToDir.path + "\n" +
-         "Exception: " + e + "\n");
-  }
-  logTestInfo("testing successful removal of the directory used to apply the " +
-              "mar file");
-  do_check_false(applyToDir.exists());
+function end_test() {
+  cleanupUpdaterTest(TEST_ID);
+}
 
-  // Use a directory outside of dist/bin to lessen the garbage in dist/bin
-  var updatesDir = do_get_file(UPDATES_DIR, true);
-  try {
-    // Mac OS X intermittently fails when removing the dir where the updater
-    // binary was launched.
-    removeDirRecursive(updatesDir);
-  }
-  catch (e) {
-    dump("Unable to remove directory\n" +
-         "path: " + updatesDir.path + "\n" +
-         "Exception: " + e + "\n");
-  }
-  if (!updatesDir.exists()) {
-    updatesDir.create(AUS_Ci.nsIFile.DIRECTORY_TYPE, PERMS_DIRECTORY);
-  }
-
-  // Create the files to test the complete mar's ability to replace files.
-  for (var i = 0; i < gTestFiles.length; i++) {
-    var f = gTestFiles[i];
-    if (f.originalFile || f.originalContents) {
-      testDir = do_get_file(f.destinationDir, true);
-      if (!testDir.exists())
-        testDir.create(AUS_Ci.nsIFile.DIRECTORY_TYPE, PERMS_DIRECTORY);
-
-      if (f.originalFile) {
-        testFile = do_get_file(f.originalFile);
-        testFile.copyTo(testDir, f.fileName);
-        testFile = do_get_file(f.destinationDir + f.fileName);
-      }
-      else {
-        testFile = do_get_file(f.destinationDir + f.fileName, true);
-        writeFile(testFile, f.originalContents);
-      }
-
-      // Skip these tests on Windows (includes WinCE) and OS/2 since their
-      // implementaions of chmod doesn't really set permissions.
-      if (!IS_WIN && !IS_OS2 && f.originalPerms) {
-        testFile.permissions = f.originalPerms;
-        // Store the actual permissions on the file for reference later after
-        // setting the permissions.
-        if (!f.comparePerms)
-          f.comparePerms = testFile.permissions;
-      }
-    }
-  }
-
-  var afterApplyBinDir = applyToDir.clone();
-  afterApplyBinDir.append(AFTER_APPLY_DIR);
-
-  var afterApplyBin = do_get_file(AFTER_APPLY_BIN_FILE);
-  afterApplyBin.copyTo(afterApplyBinDir, RELAUNCH_BIN_FILE);
-
-  var relaunchApp = afterApplyBinDir.clone();
-  relaunchApp.append(RELAUNCH_BIN_FILE);
-  relaunchApp.permissions = PERMS_DIRECTORY;
-
-  let updaterIniContents = "[Strings]\n" +
-                           "Title=Update Test\n" +
-                           "Info=Application Update XPCShell Test - " +
-                           "test_0110_general.js\n";
-  var updaterIni = updatesDir.clone();
-  updaterIni.append(FILE_UPDATER_INI);
-  writeFile(updaterIni, updaterIniContents);
-  updaterIni.copyTo(afterApplyBinDir, FILE_UPDATER_INI);
+function testUpdate() {
+  let updatesDir = do_get_file(TEST_ID + UPDATES_DIR_SUFFIX);
+  let applyToDir = do_get_file(TEST_ID + APPLY_TO_DIR_SUFFIX);
 
   // For Mac OS X set the last modified time for the root directory to a date in
   // the past to test that the last modified time is updated on a successful
   // update (bug 600098).
   if (IS_MACOSX) {
-    var now = Date.now();
-    var yesterday = now - (1000 * 60 * 60 * 24);
+    let now = Date.now();
+    let yesterday = now - (1000 * 60 * 60 * 24);
     applyToDir.lastModifiedTime = yesterday;
   }
 
-  var binDir = getGREDir();
-
-  // The updater binary file
-  var updater = binDir.clone();
-  updater.append("updater.app");
-  if (!updater.exists()) {
-    updater = binDir.clone();
-    updater.append(UPDATER_BIN_FILE);
-    if (!updater.exists()) {
-      do_throw("Unable to find updater binary!");
-    }
-  }
-
-  var mar = do_get_file("data/aus-0110_general.mar");
-  mar.copyTo(updatesDir, FILE_UPDATE_ARCHIVE);
-
-  // apply the complete mar and check the innards of the files
-  var exitValue = runUpdate(updater, updatesDir, applyToDir, relaunchApp,
-                            RELAUNCH_ARGS);
+  // apply the complete mar
+  let exitValue = runUpdate(TEST_ID);
   logTestInfo("testing updater binary process exitValue for success when " +
               "applying a complete mar");
   do_check_eq(exitValue, 0);
@@ -232,110 +140,17 @@ function run_test() {
   if (IS_MACOSX) {
     logTestInfo("testing last modified time on the apply to directory has " +
                 "changed after a successful update (bug 600098)");
-    now = Date.now();
-    var timeDiff = Math.abs(applyToDir.lastModifiedTime - now);
+    let now = Date.now();
+    let timeDiff = Math.abs(applyToDir.lastModifiedTime - now);
     do_check_true(timeDiff < MAX_TIME_DIFFERENCE);
   }
 
-  logTestInfo("testing contents of files added by a complete mar");
-  for (i = 0; i < gTestFiles.length; i++) {
-    f = gTestFiles[i];
-    testFile = do_get_file(f.destinationDir + f.fileName, true);
-    logTestInfo("testing file: " + testFile.path);
-    if (f.compareFile || f.compareContents) {
-      do_check_true(testFile.exists());
+  checkFilesAfterUpdateSuccess(TEST_ID, TEST_FILES);
 
-      // Skip these tests on Windows (includes WinCE) and OS/2 since their
-      // implementaions of chmod doesn't really set permissions.
-      if (!IS_WIN && !IS_OS2 && f.comparePerms) {
-        // Check if the permssions as set in the complete mar file are correct.
-        let logPerms = "testing file permissions - ";
-        if (f.originalPerms) {
-          logPerms += "original permissions: " + f.originalPerms.toString(8) + ", ";
-        }
-        logPerms += "compare permissions : " + f.comparePerms.toString(8) + ", ";
-        logPerms += "updated permissions : " + testFile.permissions.toString(8);
-        logTestInfo(logPerms);
-        do_check_eq(testFile.permissions & 0xfff, f.comparePerms & 0xfff);
-      }
+  logTestInfo("testing tobedeleted directory doesn't exist");
+  let toBeDeletedDir = applyToDir.clone();
+  toBeDeletedDir.append("tobedeleted");
+  do_check_false(toBeDeletedDir.exists());
 
-      if (f.compareFile) {
-        do_check_eq(readFileBytes(testFile),
-                    readFileBytes(do_get_file(f.compareFile)));
-        if (f.originalFile) {
-          // Verify that readFileBytes returned the entire contents by checking
-          // the contents against the original file.
-          do_check_neq(readFileBytes(testFile),
-                       readFileBytes(do_get_file(f.originalFile)));
-        }
-      }
-      else {
-        do_check_eq(readFileBytes(testFile), f.compareContents);
-      }
-    }
-    else {
-      do_check_false(testFile.exists());
-    }
-  }
-
-  logTestInfo("testing patch files should not be left behind");
-  var entries = updatesDir.QueryInterface(AUS_Ci.nsIFile).directoryEntries;
-  while (entries.hasMoreElements()) {
-    var entry = entries.getNext().QueryInterface(AUS_Ci.nsIFile);
-    do_check_neq(getFileExtension(entry), "patch");
-  }
-
-  check_app_launch_log();
-}
-
-function end_test() {
-  // Try to remove the updates and the apply to directories.
-  var applyToDir = do_get_file(APPLY_TO_DIR, true);
-  try {
-    removeDirRecursive(applyToDir);
-  }
-  catch (e) {
-    dump("Unable to remove directory\n" +
-         "path: " + applyToDir.path + "\n" +
-         "Exception: " + e + "\n");
-  }
-
-  var updatesDir = do_get_file(UPDATES_DIR, true);
-  try {
-    removeDirRecursive(updatesDir);
-  }
-  catch (e) {
-    dump("Unable to remove directory\n" +
-         "path: " + updatesDir.path + "\n" +
-         "Exception: " + e + "\n");
-  }
-
-  cleanUp();
-}
-
-function check_app_launch_log() {
-  var appLaunchLog = do_get_file(APPLY_TO_DIR);
-  appLaunchLog.append(AFTER_APPLY_DIR);
-  appLaunchLog.append(RELAUNCH_BIN_FILE + ".log");
-  if (!appLaunchLog.exists()) {
-    do_timeout(0, check_app_launch_log);
-    return;
-  }
-
-  var expectedLogContents = "executed\n" + RELAUNCH_ARGS.join("\n") + "\n";
-  var logContents = readFile(appLaunchLog).replace(/\r\n/g, "\n");
-  // It is possible for the log file contents check to occur before the log file
-  // contents are completely written so wait until the contents are the expected
-  // value. If the contents are never the expected value then the test will
-  // fail by timing out.
-  if (logContents != expectedLogContents) {
-    do_timeout(0, check_app_launch_log);
-    return;
-  }
-
-  logTestInfo("testing that the callback application successfully launched " +
-              "and the expected command line arguments passed to it");
-  do_check_eq(logContents, expectedLogContents);
-
-  do_test_finished();
+  checkCallbackAppLog(TEST_ID);
 }
diff --git a/toolkit/mozapps/update/test/unit/test_0111_general.js b/toolkit/mozapps/update/test/unit/test_0111_general.js
index 55f9828a79a9..04973e779153 100644
--- a/toolkit/mozapps/update/test/unit/test_0111_general.js
+++ b/toolkit/mozapps/update/test/unit/test_0111_general.js
@@ -11,15 +11,15 @@
  * for the specific language governing rights and limitations under the
  * License.
  *
- * The Original Code is the Application Update Service.
+ * The Original Code is mozilla.org code.
  *
  * The Initial Developer of the Original Code is
- * Robert Strong <robert.bugzilla@gmail.com>.
- *
+ * the Mozilla Foundation.
  * Portions created by the Initial Developer are Copyright (C) 2008
- * the Mozilla Foundation <http://www.mozilla.org/>. All Rights Reserved.
+ * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
+ *   Robert Strong <robert.bugzilla@gmail.com> (Original Author)
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -38,40 +38,26 @@
 
 /* General Partial MAR File Patch Apply Test */
 
-const APPLY_TO_DIR = "applyToDir_0111";
-const UPDATES_DIR  = "0111_mar";
-const AFTER_APPLY_DIR = "afterApplyDir";
-const UPDATER_BIN_FILE = "updater" + BIN_SUFFIX;
-const AFTER_APPLY_BIN_FILE = "TestAUSHelper" + BIN_SUFFIX;
-const RELAUNCH_BIN_FILE = "relaunch_app" + BIN_SUFFIX;
-const RELAUNCH_ARGS = ["Test Arg 1", "Test Arg 2", "Test Arg 3"];
+const TEST_ID = "0111";
 // All we care about is that the last modified time has changed so that Mac OS
 // X Launch Services invalidates its cache so the test allows up to one minute
 // difference in the last modified time.
 const MAX_TIME_DIFFERENCE = 60000;
 
-var gTestFiles = [
+// The files are in the same order as they are applied from the mar
+const TEST_FILES = [
 {
-  fileName         : "1_exe1.exe",
-  destinationDir   : APPLY_TO_DIR + "/mar_test/1/",
-  originalContents : null,
-  compareContents  : null,
-  originalFile     : "data/aus-0110_general_ref_image.png",
-  compareFile      : "data/aus-0111_general_ref_image.png",
-  originalPerms    : 0755,
-  comparePerms     : null
-}, {
   fileName         : "1_1_image1.png",
-  destinationDir   : APPLY_TO_DIR + "/mar_test/1/1_1/",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
   originalContents : null,
   compareContents  : null,
-  originalFile     : "data/aus-0110_general_ref_image.png",
-  compareFile      : "data/aus-0111_general_ref_image.png",
+  originalFile     : "data/complete.png",
+  compareFile      : "data/partial.png",
   originalPerms    : 0644,
   comparePerms     : null
 }, {
   fileName         : "1_1_text1",
-  destinationDir   : APPLY_TO_DIR + "/mar_test/1/1_1/",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
   originalContents : "ToBeModified\n",
   compareContents  : "Modified\n",
   originalFile     : null,
@@ -80,7 +66,25 @@ var gTestFiles = [
   comparePerms     : null
 }, {
   fileName         : "1_1_text2",
-  destinationDir   : APPLY_TO_DIR + "/mar_test/1/1_1/",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
+  originalContents : "ToBeDeleted\n",
+  compareContents  : null,
+  originalFile     : null,
+  compareFile      : null,
+  originalPerms    : null,
+  comparePerms     : null
+}, {
+  fileName         : "1_exe1.exe",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/",
+  originalContents : null,
+  compareContents  : null,
+  originalFile     : "data/complete.png",
+  compareFile      : "data/partial.png",
+  originalPerms    : 0755,
+  comparePerms     : null
+}, {
+  fileName         : "2_1_text1",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/2/2_1/",
   originalContents : "ToBeDeleted\n",
   compareContents  : null,
   originalFile     : null,
@@ -89,25 +93,16 @@ var gTestFiles = [
   comparePerms     : null
 }, {
   fileName         : "1_1_text3",
-  destinationDir   : APPLY_TO_DIR + "/mar_test/1/1_1/",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
   originalContents : null,
   compareContents  : "Added\n",
   originalFile     : null,
   compareFile      : null,
   originalPerms    : null,
   comparePerms     : 0644
-}, {
-  fileName         : "2_1_text1",
-  destinationDir   : APPLY_TO_DIR + "/mar_test/2/2_1/",
-  originalContents : "ToBeDeleted\n",
-  compareContents  : null,
-  originalFile     : null,
-  compareFile      : null,
-  originalPerms    : null,
-  comparePerms     : null
 }, {
   fileName         : "3_1_text1",
-  destinationDir   : APPLY_TO_DIR + "/mar_test/3/3_1/",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/3/3_1/",
   originalContents : null,
   compareContents  : "Added\n",
   originalFile     : null,
@@ -125,120 +120,32 @@ function run_test() {
   do_test_pending();
   do_register_cleanup(end_test);
 
-  var testDir, testFile;
+  setupUpdaterTest(TEST_ID, MAR_PARTIAL_FILE, TEST_FILES);
 
-  // The directory the updates will be applied to is the directory name stored
-  // in the APPLY_TO_DIR constant located in the current working directory and
-  // not dist/bin.
-  var applyToDir = do_get_file(APPLY_TO_DIR, true);
+  // The testUpdate function is used for consistency with the tests that require
+  // a timeout before continuing the test.
+  testUpdate();
+}
 
-  // Remove the directory where the update will be applied if it exists.
-  try {
-    removeDirRecursive(applyToDir);
-  }
-  catch (e) {
-    dump("Unable to remove directory\n" +
-         "path: " + applyToDir.path + "\n" +
-         "Exception: " + e + "\n");
-  }
-  logTestInfo("testing successful removal of the directory used to apply the " +
-              "mar file");
-  do_check_false(applyToDir.exists());
+function end_test() {
+  cleanupUpdaterTest(TEST_ID);
+}
 
-  // Use a directory outside of dist/bin to lessen the garbage in dist/bin
-  var updatesDir = do_get_file(UPDATES_DIR, true);
-  try {
-    // Mac OS X intermittently fails when removing the dir where the updater
-    // binary was launched.
-    removeDirRecursive(updatesDir);
-  }
-  catch (e) {
-    dump("Unable to remove directory\n" +
-         "path: " + updatesDir.path + "\n" +
-         "Exception: " + e + "\n");
-  }
-  if (!updatesDir.exists()) {
-    updatesDir.create(AUS_Ci.nsIFile.DIRECTORY_TYPE, PERMS_DIRECTORY);
-  }
-
-  // Create the files to test the partial mar's ability to modify and delete
-  // files.
-  for (var i = 0; i < gTestFiles.length; i++) {
-    var f = gTestFiles[i];
-    if (f.originalFile || f.originalContents) {
-      testDir = do_get_file(f.destinationDir, true);
-      if (!testDir.exists())
-        testDir.create(AUS_Ci.nsIFile.DIRECTORY_TYPE, PERMS_DIRECTORY);
-
-      if (f.originalFile) {
-        testFile = do_get_file(f.originalFile);
-        testFile.copyTo(testDir, f.fileName);
-        testFile = do_get_file(f.destinationDir + f.fileName);
-      }
-      else {
-        testFile = do_get_file(f.destinationDir + f.fileName, true);
-        writeFile(testFile, f.originalContents);
-      }
-
-      // Skip these tests on Windows (includes WinCE) and OS/2 since their
-      // implementaions of chmod doesn't really set permissions.
-      if (!IS_WIN && !IS_OS2 && f.originalPerms) {
-        testFile.permissions = f.originalPerms;
-        // Store the actual permissions on the file for reference later after
-        // setting the permissions.
-        if (!f.comparePerms)
-          f.comparePerms = testFile.permissions;
-      }
-    }
-  }
-
-  var afterApplyBinDir = applyToDir.clone();
-  afterApplyBinDir.append(AFTER_APPLY_DIR);
-
-  var afterApplyBin = do_get_file(AFTER_APPLY_BIN_FILE);
-  afterApplyBin.copyTo(afterApplyBinDir, RELAUNCH_BIN_FILE);
-
-  var relaunchApp = afterApplyBinDir.clone();
-  relaunchApp.append(RELAUNCH_BIN_FILE);
-  relaunchApp.permissions = PERMS_DIRECTORY;
-
-  let updaterIniContents = "[Strings]\n" +
-                           "Title=Update Test\n" +
-                           "Info=Application Update XPCShell Test - " +
-                           "test_0111_general.js\n";
-  var updaterIni = updatesDir.clone();
-  updaterIni.append(FILE_UPDATER_INI);
-  writeFile(updaterIni, updaterIniContents);
-  updaterIni.copyTo(afterApplyBinDir, FILE_UPDATER_INI);
+function testUpdate() {
+  let updatesDir = do_get_file(TEST_ID + UPDATES_DIR_SUFFIX);
+  let applyToDir = do_get_file(TEST_ID + APPLY_TO_DIR_SUFFIX);
 
   // For Mac OS X set the last modified time for the root directory to a date in
   // the past to test that the last modified time is updated on a successful
   // update (bug 600098).
   if (IS_MACOSX) {
-    var now = Date.now();
-    var yesterday = now - (1000 * 60 * 60 * 24);
+    let now = Date.now();
+    let yesterday = now - (1000 * 60 * 60 * 24);
     applyToDir.lastModifiedTime = yesterday;
   }
 
-  var binDir = getGREDir();
-
-  // The updater binary file
-  var updater = binDir.clone();
-  updater.append("updater.app");
-  if (!updater.exists()) {
-    updater = binDir.clone();
-    updater.append(UPDATER_BIN_FILE);
-    if (!updater.exists()) {
-      do_throw("Unable to find updater binary!");
-    }
-  }
-
-  var mar = do_get_file("data/aus-0111_general.mar");
-  mar.copyTo(updatesDir, FILE_UPDATE_ARCHIVE);
-
-  // apply the partial mar and check the innards of the files
-  var exitValue = runUpdate(updater, updatesDir, applyToDir, relaunchApp,
-                            RELAUNCH_ARGS);
+  // apply the partial mar
+  let exitValue = runUpdate(TEST_ID);
   logTestInfo("testing updater binary process exitValue for success when " +
               "applying a partial mar");
   do_check_eq(exitValue, 0);
@@ -251,115 +158,23 @@ function run_test() {
   if (IS_MACOSX) {
     logTestInfo("testing last modified time on the apply to directory has " +
                 "changed after a successful update (bug 600098)");
-    now = Date.now();
-    var timeDiff = Math.abs(applyToDir.lastModifiedTime - now);
+    let now = Date.now();
+    let timeDiff = Math.abs(applyToDir.lastModifiedTime - now);
     do_check_true(timeDiff < MAX_TIME_DIFFERENCE);
   }
 
-  logTestInfo("testing the removal of files and the contents of added / " +
-              "modified files by a partial mar");
-  for (i = 0; i < gTestFiles.length; i++) {
-    f = gTestFiles[i];
-    testFile = do_get_file(f.destinationDir + f.fileName, true);
-    logTestInfo("testing file: " + testFile.path);
-    if (f.compareFile || f.compareContents) {
-      do_check_true(testFile.exists());
-
-      // Skip these tests on Windows (includes WinCE) and OS/2 since their
-      // implementaions of chmod doesn't really set permissions.
-      if (!IS_WIN && !IS_OS2 && f.comparePerms) {
-        // Check the original permssions are retained on the file.
-        let logPerms = "testing file permissions - ";
-        if (f.originalPerms) {
-          logPerms += "original permissions: " + f.originalPerms.toString(8) + ", ";
-        }
-        logPerms += "compare permissions : " + f.comparePerms.toString(8) + ", ";
-        logPerms += "updated permissions : " + testFile.permissions.toString(8);
-        logTestInfo(logPerms);
-        do_check_eq(testFile.permissions & 0xfff, f.comparePerms & 0xfff);
-      }
-
-      if (f.compareFile) {
-        do_check_eq(readFileBytes(testFile),
-                    readFileBytes(do_get_file(f.compareFile)));
-        if (f.originalFile) {
-          // Verify that readFileBytes returned the entire contents by checking
-          // the contents against the original file.
-          do_check_neq(readFileBytes(testFile),
-                       readFileBytes(do_get_file(f.originalFile)));
-        }
-      }
-      else {
-        do_check_eq(readFileBytes(testFile), f.compareContents);
-      }
-    }
-    else {
-      do_check_false(testFile.exists());
-    }
-  }
+  checkFilesAfterUpdateSuccess(TEST_ID, TEST_FILES);
 
   logTestInfo("testing directory still exists after removal of the last file " +
               "in the directory (bug 386760)");
-  do_check_true(do_get_file(APPLY_TO_DIR + "/mar_test/2/2_1/", true).exists());
+  let testDir = do_get_file(TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/2/2_1/",
+                            true);
+  do_check_true(testDir.exists());
 
-  logTestInfo("testing patch files should not be left behind");
-  var entries = updatesDir.QueryInterface(AUS_Ci.nsIFile).directoryEntries;
-  while (entries.hasMoreElements()) {
-    var entry = entries.getNext().QueryInterface(AUS_Ci.nsIFile);
-    do_check_neq(getFileExtension(entry), "patch");
-  }
+  logTestInfo("testing tobedeleted directory doesn't exist");
+  let toBeDeletedDir = applyToDir.clone();
+  toBeDeletedDir.append("tobedeleted");
+  do_check_false(toBeDeletedDir.exists());
 
-  check_app_launch_log();
-}
-
-function end_test() {
-  // Try to remove the updates and the apply to directories.
-  var applyToDir = do_get_file(APPLY_TO_DIR, true);
-  try {
-    removeDirRecursive(applyToDir);
-  }
-  catch (e) {
-    dump("Unable to remove directory\n" +
-         "path: " + applyToDir.path + "\n" +
-         "Exception: " + e + "\n");
-  }
-
-  var updatesDir = do_get_file(UPDATES_DIR, true);
-  try {
-    removeDirRecursive(updatesDir);
-  }
-  catch (e) {
-    dump("Unable to remove directory\n" +
-         "path: " + updatesDir.path + "\n" +
-         "Exception: " + e + "\n");
-  }
-
-  cleanUp();
-}
-
-function check_app_launch_log() {
-  var appLaunchLog = do_get_file(APPLY_TO_DIR);
-  appLaunchLog.append(AFTER_APPLY_DIR);
-  appLaunchLog.append(RELAUNCH_BIN_FILE + ".log");
-  if (!appLaunchLog.exists()) {
-    do_timeout(0, check_app_launch_log);
-    return;
-  }
-
-  var expectedLogContents = "executed\n" + RELAUNCH_ARGS.join("\n") + "\n";
-  var logContents = readFile(appLaunchLog).replace(/\r\n/g, "\n");
-  // It is possible for the log file contents check to occur before the log file
-  // contents are completely written so wait until the contents are the expected
-  // value. If the contents are never the expected value then the test will
-  // fail by timing out.
-  if (logContents != expectedLogContents) {
-    do_timeout(0, check_app_launch_log);
-    return;
-  }
-
-  logTestInfo("testing that the callback application successfully launched " +
-              "and the expected command line arguments passed to it");
-  do_check_eq(logContents, expectedLogContents);
-
-  do_test_finished();
+  checkCallbackAppLog(TEST_ID);
 }
diff --git a/toolkit/mozapps/update/test/unit/test_0112_general.js b/toolkit/mozapps/update/test/unit/test_0112_general.js
index 349f97447749..e12a847ecc70 100644
--- a/toolkit/mozapps/update/test/unit/test_0112_general.js
+++ b/toolkit/mozapps/update/test/unit/test_0112_general.js
@@ -11,15 +11,15 @@
  * for the specific language governing rights and limitations under the
  * License.
  *
- * The Original Code is the Application Update Service.
+ * The Original Code is mozilla.org code.
  *
  * The Initial Developer of the Original Code is
- * Robert Strong <robert.bugzilla@gmail.com>.
- *
+ * the Mozilla Foundation.
  * Portions created by the Initial Developer are Copyright (C) 2008
- * the Mozilla Foundation <http://www.mozilla.org/>. All Rights Reserved.
+ * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
+ *   Robert Strong <robert.bugzilla@gmail.com> (Original Author)
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -38,36 +38,22 @@
 
 /* General Partial MAR File Patch Apply Failure Test */
 
-const APPLY_TO_DIR = "applyToDir_0112";
-const UPDATES_DIR  = "0112_mar";
-const AFTER_APPLY_DIR = "afterApplyDir";
-const UPDATER_BIN_FILE = "updater" + BIN_SUFFIX;
-const AFTER_APPLY_BIN_FILE = "TestAUSHelper" + BIN_SUFFIX;
-const RELAUNCH_BIN_FILE = "relaunch_app" + BIN_SUFFIX;
-const RELAUNCH_ARGS = ["Test Arg 1", "Test Arg 2", "Test Arg 3"];
+const TEST_ID = "0112";
 
-var gTestFiles = [
+// The files are in the same order as they are applied from the mar
+const TEST_FILES = [
 {
-  fileName         : "1_exe1.exe",
-  destinationDir   : APPLY_TO_DIR + "/mar_test/1/",
-  originalContents : null,
-  compareContents  : null,
-  originalFile     : "data/aus-0111_general_ref_image.png",
-  compareFile      : "data/aus-0111_general_ref_image.png",
-  originalPerms    : 0755,
-  comparePerms     : null
-}, {
   fileName         : "1_1_image1.png",
-  destinationDir   : APPLY_TO_DIR + "/mar_test/1/1_1/",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
   originalContents : null,
   compareContents  : null,
-  originalFile     : "data/aus-0110_general_ref_image.png",
-  compareFile      : "data/aus-0110_general_ref_image.png",
+  originalFile     : "data/complete.png",
+  compareFile      : "data/complete.png",
   originalPerms    : 0644,
   comparePerms     : null
 }, {
   fileName         : "1_1_text1",
-  destinationDir   : APPLY_TO_DIR + "/mar_test/1/1_1/",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
   originalContents : "ShouldNotBeDeleted\n",
   compareContents  : "ShouldNotBeDeleted\n",
   originalFile     : null,
@@ -76,16 +62,25 @@ var gTestFiles = [
   comparePerms     : null
 }, {
   fileName         : "1_1_text2",
-  destinationDir   : APPLY_TO_DIR + "/mar_test/1/1_1/",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
   originalContents : "ShouldNotBeDeleted\n",
   compareContents  : "ShouldNotBeDeleted\n",
   originalFile     : null,
   compareFile      : null,
   originalPerms    : 0644,
   comparePerms     : null
+}, {
+  fileName         : "1_exe1.exe",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/",
+  originalContents : null,
+  compareContents  : null,
+  originalFile     : "data/partial.png",
+  compareFile      : "data/partial.png",
+  originalPerms    : 0755,
+  comparePerms     : null
 }, {
   fileName         : "2_1_text1",
-  destinationDir   : APPLY_TO_DIR + "/mar_test/2/2_1/",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/2/2_1/",
   originalContents : "ShouldNotBeDeleted\n",
   compareContents  : "ShouldNotBeDeleted\n",
   originalFile     : null,
@@ -103,125 +98,38 @@ function run_test() {
   do_test_pending();
   do_register_cleanup(end_test);
 
-  var testDir, testFile;
+  setupUpdaterTest(TEST_ID, MAR_PARTIAL_FILE, TEST_FILES);
 
-  // The directory the updates will be applied to is the directory name stored
-  // in the APPLY_TO_DIR constant located in the current working directory and
-  // not dist/bin.
-  var applyToDir = do_get_file(APPLY_TO_DIR, true);
+  // The testUpdate function is used for consistency with the tests that require
+  // a timeout before continuing the test.
+  testUpdate();
+}
 
-  // Remove the directory where the update will be applied if it exists.
-  try {
-    removeDirRecursive(applyToDir);
-  }
-  catch (e) {
-    dump("Unable to remove directory\n" +
-         "path: " + applyToDir.path + "\n" +
-         "Exception: " + e + "\n");
-  }
-  logTestInfo("testing successful removal of the directory used to apply the " +
-              "mar file");
-  do_check_false(applyToDir.exists());
+function end_test() {
+  cleanupUpdaterTest(TEST_ID);
+}
 
-  // Use a directory outside of dist/bin to lessen the garbage in dist/bin
-  var updatesDir = do_get_file(UPDATES_DIR, true);
-  try {
-    // Mac OS X intermittently fails when removing the dir where the updater
-    // binary was launched.
-    removeDirRecursive(updatesDir);
-  }
-  catch (e) {
-    dump("Unable to remove directory\n" +
-         "path: " + updatesDir.path + "\n" +
-         "Exception: " + e + "\n");
-  }
-  if (!updatesDir.exists()) {
-    updatesDir.create(AUS_Ci.nsIFile.DIRECTORY_TYPE, PERMS_DIRECTORY);
-  }
-
-  // Create the files to test the partial mar's ability to rollback to the
-  // original files.
-  for (var i = 0; i < gTestFiles.length; i++) {
-    var f = gTestFiles[i];
-    if (f.originalFile || f.originalContents) {
-      testDir = do_get_file(f.destinationDir, true);
-      if (!testDir.exists())
-        testDir.create(AUS_Ci.nsIFile.DIRECTORY_TYPE, PERMS_DIRECTORY);
-
-      if (f.originalFile) {
-        testFile = do_get_file(f.originalFile);
-        testFile.copyTo(testDir, f.fileName);
-        testFile = do_get_file(f.destinationDir + f.fileName);
-      }
-      else {
-        testFile = do_get_file(f.destinationDir + f.fileName, true);
-        writeFile(testFile, f.originalContents);
-      }
-
-      // Skip these tests on Windows (includes WinCE) and OS/2 since their
-      // implementaions of chmod doesn't really set permissions.
-      if (!IS_WIN && !IS_OS2 && f.originalPerms) {
-        testFile.permissions = f.originalPerms;
-        // Store the actual permissions on the file for reference later after
-        // setting the permissions.
-        if (!f.comparePerms)
-          f.comparePerms = testFile.permissions;
-      }
-    }
-  }
-
-  var afterApplyBinDir = applyToDir.clone();
-  afterApplyBinDir.append(AFTER_APPLY_DIR);
-
-  var afterApplyBin = do_get_file(AFTER_APPLY_BIN_FILE);
-  afterApplyBin.copyTo(afterApplyBinDir, RELAUNCH_BIN_FILE);
-
-  var relaunchApp = afterApplyBinDir.clone();
-  relaunchApp.append(RELAUNCH_BIN_FILE);
-  relaunchApp.permissions = PERMS_DIRECTORY;
-
-  let updaterIniContents = "[Strings]\n" +
-                           "Title=Update Test\n" +
-                           "Info=Application Update XPCShell Test - " +
-                           "test_0112_general.js\n";
-  var updaterIni = updatesDir.clone();
-  updaterIni.append(FILE_UPDATER_INI);
-  writeFile(updaterIni, updaterIniContents);
-  updaterIni.copyTo(afterApplyBinDir, FILE_UPDATER_INI);
+function testUpdate() {
+  let updatesDir = do_get_file(TEST_ID + UPDATES_DIR_SUFFIX);
+  let applyToDir = do_get_file(TEST_ID + APPLY_TO_DIR_SUFFIX);
 
   // For Mac OS X set the last modified time for a directory to a date in the
   // past to test that the last modified time on the directories in not updated
   // when an update fails (bug 600098).
+  let lastModTime;
   if (IS_MACOSX) {
     // All we care about is that the last modified time has not changed when an
     // update has failed.
-    var now = Date.now();
-    var lastModTime = now - (1000 * 60 * 60 * 24);
+    let now = Date.now();
+    lastModTime = now - (1000 * 60 * 60 * 24);
     applyToDir.lastModifiedTime = lastModTime;
     // Set lastModTime to the value the OS returns in case it is different than
     // the value stored by the OS.
     lastModTime = applyToDir.lastModifiedTime;
   }
 
-  var binDir = getGREDir();
-
-  // The updater binary file
-  var updater = binDir.clone();
-  updater.append("updater.app");
-  if (!updater.exists()) {
-    updater = binDir.clone();
-    updater.append(UPDATER_BIN_FILE);
-    if (!updater.exists()) {
-      do_throw("Unable to find updater binary!");
-    }
-  }
-
-  var mar = do_get_file("data/aus-0111_general.mar");
-  mar.copyTo(updatesDir, FILE_UPDATE_ARCHIVE);
-
-  // apply the partial mar and check the innards of the files
-  var exitValue = runUpdate(updater, updatesDir, applyToDir, relaunchApp,
-                            RELAUNCH_ARGS);
+  // apply the partial mar
+  let exitValue = runUpdate(TEST_ID);
   logTestInfo("testing updater binary process exitValue for success when " +
               "applying a partial mar");
   do_check_eq(exitValue, 0);
@@ -239,100 +147,12 @@ function run_test() {
     do_check_eq(applyToDir.lastModifiedTime, lastModTime);
   }
 
-  logTestInfo("testing files should not be modified or deleted when an " +
-              "update fails");
-  for (i = 0; i < gTestFiles.length; i++) {
-    f = gTestFiles[i];
-    testFile = do_get_file(f.destinationDir + f.fileName, true);
-    logTestInfo("testing file: " + testFile.path);
-    if (f.compareFile || f.compareContents) {
-      do_check_true(testFile.exists());
+  checkFilesAfterUpdateFailure(TEST_ID, TEST_FILES);
 
-      // Skip these tests on Windows (includes WinCE) and OS/2 since their
-      // implementaions of chmod doesn't really set permissions.
-      if (!IS_WIN && !IS_OS2 && f.comparePerms) {
-        // Check the original permssions are retained on the file.
-        let logPerms = "testing file permissions - ";
-        if (f.originalPerms) {
-          logPerms += "original permissions: " + f.originalPerms.toString(8) + ", ";
-        }
-        logPerms += "compare permissions : " + f.comparePerms.toString(8) + ", ";
-        logPerms += "updated permissions : " + testFile.permissions.toString(8);
-        logTestInfo(logPerms);
-        do_check_eq(testFile.permissions & 0xfff, f.comparePerms & 0xfff);
-      }
+  logTestInfo("testing tobedeleted directory doesn't exist");
+  let toBeDeletedDir = applyToDir.clone();
+  toBeDeletedDir.append("tobedeleted");
+  do_check_false(toBeDeletedDir.exists());
 
-      if (f.compareFile) {
-        do_check_eq(readFileBytes(testFile),
-                    readFileBytes(do_get_file(f.compareFile)));
-      }
-      else {
-        do_check_eq(readFileBytes(testFile), f.compareContents);
-      }
-    }
-    else {
-      do_check_false(testFile.exists());
-    }
-  }
-
-  logTestInfo("testing patch files should not be left behind");
-  var entries = updatesDir.QueryInterface(AUS_Ci.nsIFile).directoryEntries;
-  while (entries.hasMoreElements()) {
-    var entry = entries.getNext().QueryInterface(AUS_Ci.nsIFile);
-    do_check_neq(getFileExtension(entry), "patch");
-  }
-
-  check_app_launch_log();
-}
-
-function end_test() {
-  // Try to remove the updates and the apply to directories.
-  var applyToDir = do_get_file(APPLY_TO_DIR, true);
-  try {
-    removeDirRecursive(applyToDir);
-  }
-  catch (e) {
-    dump("Unable to remove directory\n" +
-         "path: " + applyToDir.path + "\n" +
-         "Exception: " + e + "\n");
-  }
-
-  var updatesDir = do_get_file(UPDATES_DIR, true);
-  try {
-    removeDirRecursive(updatesDir);
-  }
-  catch (e) {
-    dump("Unable to remove directory\n" +
-         "path: " + updatesDir.path + "\n" +
-         "Exception: " + e + "\n");
-  }
-
-  cleanUp();
-}
-
-function check_app_launch_log() {
-  var appLaunchLog = do_get_file(APPLY_TO_DIR);
-  appLaunchLog.append(AFTER_APPLY_DIR);
-  appLaunchLog.append(RELAUNCH_BIN_FILE + ".log");
-  if (!appLaunchLog.exists()) {
-    do_timeout(0, check_app_launch_log);
-    return;
-  }
-
-  var expectedLogContents = "executed\n" + RELAUNCH_ARGS.join("\n") + "\n";
-  var logContents = readFile(appLaunchLog).replace(/\r\n/g, "\n");
-  // It is possible for the log file contents check to occur before the log file
-  // contents are completely written so wait until the contents are the expected
-  // value. If the contents are never the expected value then the test will
-  // fail by timing out.
-  if (logContents != expectedLogContents) {
-    do_timeout(0, check_app_launch_log);
-    return;
-  }
-
-  logTestInfo("testing that the callback application successfully launched " +
-              "and the expected command line arguments passed to it");
-  do_check_eq(logContents, expectedLogContents);
-
-  do_test_finished();
+  checkCallbackAppLog(TEST_ID);
 }
diff --git a/toolkit/mozapps/update/test/unit/test_0160_appInUse_xp_unix_complete.js b/toolkit/mozapps/update/test/unit/test_0160_appInUse_xp_unix_complete.js
new file mode 100644
index 000000000000..a08c3310cfa4
--- /dev/null
+++ b/toolkit/mozapps/update/test/unit/test_0160_appInUse_xp_unix_complete.js
@@ -0,0 +1,133 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ */
+
+/* Application in use complete MAR file patch apply success test */
+
+const TEST_ID = "0160";
+// All we care about is that the last modified time has changed so that Mac OS
+// X Launch Services invalidates its cache so the test allows up to one minute
+// difference in the last modified time.
+const MAX_TIME_DIFFERENCE = 60000;
+
+// The files are in the same order as they are applied from the mar
+const TEST_FILES = [
+{
+  fileName         : "1_1_image1.png",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
+  originalContents : null,
+  compareContents  : null,
+  originalFile     : null,
+  compareFile      : "data/complete.png",
+  originalPerms    : 0776,
+  comparePerms     : 0644
+}, {
+  fileName         : "1_1_text1",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
+  originalContents : "ToBeReplacedWithToBeModified\n",
+  compareContents  : "ToBeModified\n",
+  originalFile     : null,
+  compareFile      : null,
+  originalPerms    : 0775,
+  comparePerms     : 0644
+}, {
+  fileName         : "1_1_text2",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
+  originalContents : "ToBeReplacedWithToBeDeleted\n",
+  compareContents  : "ToBeDeleted\n",
+  originalFile     : null,
+  compareFile      : null,
+  originalPerms    : 0677,
+  comparePerms     : 0644
+}, {
+  fileName         : "1_exe1.exe",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/",
+  originalContents : null,
+  compareContents  : null,
+  originalFile     : "data/partial.png",
+  compareFile      : "data/complete.png",
+  originalPerms    : 0777,
+  comparePerms     : 0755
+}, {
+  fileName         : "2_1_text1",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/2/2_1/",
+  originalContents : "ToBeReplacedWithToBeDeleted\n",
+  compareContents  : "ToBeDeleted\n",
+  originalFile     : null,
+  compareFile      : null,
+  originalPerms    : 0767,
+  comparePerms     : 0644
+}];
+
+let gCallbackAppProcess;
+
+function run_test() {
+  if (!IS_UNIX || IS_ANDROID) {
+    logTestInfo("this test is only applicable to XP_UNIX platforms except " +
+                "for Android... returning early");
+    return;
+  }
+
+  do_test_pending();
+  do_register_cleanup(end_test);
+
+  setupUpdaterTest(TEST_ID, MAR_COMPLETE_FILE, TEST_FILES);
+
+  // Launch the callback helper application so it is in use during the update
+  let callbackApp = do_get_file(TEST_ID + APPLY_TO_DIR_SUFFIX);
+  callbackApp.append(AFTER_APPLY_DIR);
+  callbackApp.append(CALLBACK_BIN_FILE);
+  callbackApp.permissions = PERMS_DIRECTORY;
+  let args = ["-s", "20"];
+  gCallbackAppProcess = AUS_Cc["@mozilla.org/process/util;1"].
+                        createInstance(AUS_Ci.nsIProcess);
+  gCallbackAppProcess.init(callbackApp);
+  gCallbackAppProcess.run(false, args, args.length);
+
+  // Give the lock file process time to lock the file before updating otherwise
+  // this test can fail intermittently on Windows debug builds.
+  do_timeout(100, testUpdate);
+}
+
+function end_test() {
+  cleanupUpdaterTest(TEST_ID);
+}
+
+function testUpdate() {
+  let updatesDir = do_get_file(TEST_ID + UPDATES_DIR_SUFFIX);
+  let applyToDir = do_get_file(TEST_ID + APPLY_TO_DIR_SUFFIX);
+
+  // For Mac OS X set the last modified time for the root directory to a date in
+  // the past to test that the last modified time is updated on a successful
+  // update (bug 600098).
+  if (IS_MACOSX) {
+    let now = Date.now();
+    let yesterday = now - (1000 * 60 * 60 * 24);
+    applyToDir.lastModifiedTime = yesterday;
+  }
+
+  // apply the complete mar
+  let exitValue = runUpdate(TEST_ID);
+  logTestInfo("testing updater binary process exitValue for success when " +
+              "applying a complete mar");
+  do_check_eq(exitValue, 0);
+
+  gCallbackAppProcess.kill();
+
+  logTestInfo("testing update.status should be " + STATE_SUCCEEDED);
+  do_check_eq(readStatusFile(updatesDir), STATE_SUCCEEDED);
+
+  // For Mac OS X check that the last modified time for a directory has been
+  // updated after a successful update (bug 600098).
+  if (IS_MACOSX) {
+    logTestInfo("testing last modified time on the apply to directory has " +
+                "changed after a successful update (bug 600098)");
+    let now = Date.now();
+    let timeDiff = Math.abs(applyToDir.lastModifiedTime - now);
+    do_check_true(timeDiff < MAX_TIME_DIFFERENCE);
+  }
+
+  checkFilesAfterUpdateSuccess(TEST_ID, TEST_FILES);
+
+  checkCallbackAppLog(TEST_ID);
+}
diff --git a/toolkit/mozapps/update/test/unit/test_0160_appInUse_xp_win_complete.js b/toolkit/mozapps/update/test/unit/test_0160_appInUse_xp_win_complete.js
new file mode 100644
index 000000000000..0a94cd3d0c10
--- /dev/null
+++ b/toolkit/mozapps/update/test/unit/test_0160_appInUse_xp_win_complete.js
@@ -0,0 +1,105 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ */
+
+/* Application in use complete MAR file patch apply failure test */
+
+const TEST_ID = "0160";
+
+// The files are in the same order as they are applied from the mar
+const TEST_FILES = [
+{
+  fileName         : "1_1_image1.png",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
+  originalContents : null,
+  compareContents  : null,
+  originalFile     : "data/partial.png",
+  compareFile      : "data/partial.png"
+}, {
+  fileName         : "1_1_text1",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
+  originalContents : "ShouldNotBeReplaced\n",
+  compareContents  : "ShouldNotBeReplaced\n",
+  originalFile     : null,
+  compareFile      : null
+}, {
+  fileName         : "1_1_text2",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
+  originalContents : "ShouldNotBeReplaced\n",
+  compareContents  : "ShouldNotBeReplaced\n",
+  originalFile     : null,
+  compareFile      : null
+}, {
+  fileName         : "1_exe1.exe",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/",
+  originalContents : null,
+  compareContents  : null,
+  originalFile     : "data/partial.png",
+  compareFile      : "data/partial.png"
+}, {
+  fileName         : "2_1_text1",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/2/2_1/",
+  originalContents : "ShouldNotBeReplaced\n",
+  compareContents  : "ShouldNotBeReplaced\n",
+  originalFile     : null,
+  compareFile      : null
+}];
+
+let gCallbackAppProcess;
+
+function run_test() {
+  if (!IS_WIN || IS_WINCE) {
+    logTestInfo("this test is only applicable to Windows... returning early");
+    return;
+  }
+
+  do_test_pending();
+  do_register_cleanup(end_test);
+
+  setupUpdaterTest(TEST_ID, MAR_COMPLETE_FILE, TEST_FILES);
+
+  // Launch the callback helper application so it is in use during the update
+  let callbackApp = do_get_file(TEST_ID + APPLY_TO_DIR_SUFFIX);
+  callbackApp.append(AFTER_APPLY_DIR);
+  callbackApp.append(CALLBACK_BIN_FILE);
+  let args = ["-s", "20"];
+  gCallbackAppProcess = AUS_Cc["@mozilla.org/process/util;1"].
+                        createInstance(AUS_Ci.nsIProcess);
+  gCallbackAppProcess.init(callbackApp);
+  gCallbackAppProcess.run(false, args, args.length);
+
+  // Give the lock file process time to lock the file before updating otherwise
+  // this test can fail intermittently on Windows debug builds.
+  do_timeout(100, testUpdate);
+}
+
+function end_test() {
+  cleanupUpdaterTest(TEST_ID);
+}
+
+function testUpdate() {
+  let updatesDir = do_get_file(TEST_ID + UPDATES_DIR_SUFFIX);
+  let applyToDir = do_get_file(TEST_ID + APPLY_TO_DIR_SUFFIX);
+
+  // apply the complete mar
+  let exitValue = runUpdate(TEST_ID);
+  logTestInfo("testing updater binary process exitValue for success when " +
+              "applying a complete mar");
+  do_check_eq(exitValue, 1);
+
+  gCallbackAppProcess.kill();
+
+  logTestInfo("testing update.status should be " + STATE_FAILED);
+  // The update status format for a failure is failed: # where # is the error
+  // code for the failure.
+  do_check_eq(readStatusFile(updatesDir).split(": ")[0], STATE_FAILED);
+
+  checkFilesAfterUpdateFailure(TEST_ID, TEST_FILES);
+
+  logTestInfo("testing tobedeleted directory doesn't exist");
+  let toBeDeletedDir = applyToDir.clone();
+  toBeDeletedDir.append("tobedeleted");
+  do_check_false(toBeDeletedDir.exists());
+
+  checkCallbackAppLog(TEST_ID);
+}
diff --git a/toolkit/mozapps/update/test/unit/test_0170_fileLocked_xp_win_complete.js b/toolkit/mozapps/update/test/unit/test_0170_fileLocked_xp_win_complete.js
new file mode 100644
index 000000000000..c14c48442eb9
--- /dev/null
+++ b/toolkit/mozapps/update/test/unit/test_0170_fileLocked_xp_win_complete.js
@@ -0,0 +1,104 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ */
+
+/* File locked complete MAR file patch apply failure test */
+
+const TEST_ID = "0170";
+
+// The files are in the same order as they are applied from the mar
+const TEST_FILES = [
+{
+  fileName         : "1_1_image1.png",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
+  originalContents : null,
+  compareContents  : null,
+  originalFile     : "data/partial.png",
+  compareFile      : "data/partial.png"
+}, {
+  fileName         : "1_1_text1",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
+  originalContents : "ShouldNotBeReplaced\n",
+  compareContents  : "ShouldNotBeReplaced\n",
+  originalFile     : null,
+  compareFile      : null
+}, {
+  fileName         : "1_1_text2",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
+  originalContents : "ShouldNotBeReplaced\n",
+  compareContents  : "ShouldNotBeReplaced\n",
+  originalFile     : null,
+  compareFile      : null
+}, {
+  fileName         : "1_exe1.exe",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/",
+  originalContents : null,
+  compareContents  : null,
+  originalFile     : "data/partial.png",
+  compareFile      : "data/partial.png"
+}, {
+  fileName         : "2_1_text1",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/2/2_1/",
+  originalContents : "ShouldNotBeReplaced\n",
+  compareContents  : "ShouldNotBeReplaced\n",
+  originalFile     : null,
+  compareFile      : null
+}];
+
+let gLockFileProcess;
+
+function run_test() {
+  if (!IS_WIN || IS_WINCE) {
+    logTestInfo("this test is only applicable to Windows... returning early");
+    return;
+  }
+
+  do_test_pending();
+  do_register_cleanup(end_test);
+
+  setupUpdaterTest(TEST_ID, MAR_COMPLETE_FILE, TEST_FILES);
+
+  // Exclusively lock an existing file so it is in use during the update
+  let helperBin = do_get_file(HELPER_BIN_FILE);
+  let lockFileRelPath = TEST_FILES[3].destinationDir + TEST_FILES[3].fileName;
+  let args = ["-s", "20", lockFileRelPath];
+  gLockFileProcess = AUS_Cc["@mozilla.org/process/util;1"].
+                     createInstance(AUS_Ci.nsIProcess);
+  gLockFileProcess.init(helperBin);
+  gLockFileProcess.run(false, args, args.length);
+
+  // Give the lock file process time to lock the file before updating otherwise
+  // this test can fail intermittently on Windows debug builds.
+  do_timeout(100, testUpdate);
+}
+
+function end_test() {
+  cleanupUpdaterTest(TEST_ID);
+}
+
+function testUpdate() {
+  let updatesDir = do_get_file(TEST_ID + UPDATES_DIR_SUFFIX);
+  let applyToDir = do_get_file(TEST_ID + APPLY_TO_DIR_SUFFIX);
+
+  // apply the complete mar
+  let exitValue = runUpdate(TEST_ID);
+  logTestInfo("testing updater binary process exitValue for success when " +
+              "applying a complete mar");
+  do_check_eq(exitValue, 0);
+
+  gLockFileProcess.kill();
+
+  logTestInfo("testing update.status should be " + STATE_FAILED);
+  // The update status format for a failure is failed: # where # is the error
+  // code for the failure.
+  do_check_eq(readStatusFile(updatesDir).split(": ")[0], STATE_FAILED);
+
+  checkFilesAfterUpdateFailure(TEST_ID, TEST_FILES);
+
+  logTestInfo("testing tobedeleted directory doesn't exist");
+  let toBeDeletedDir = applyToDir.clone();
+  toBeDeletedDir.append("tobedeleted");
+  do_check_false(toBeDeletedDir.exists());
+
+  checkCallbackAppLog(TEST_ID);
+}
diff --git a/toolkit/mozapps/update/test/unit/test_0171_fileLocked_xp_win_partial.js b/toolkit/mozapps/update/test/unit/test_0171_fileLocked_xp_win_partial.js
new file mode 100644
index 000000000000..4090291af52f
--- /dev/null
+++ b/toolkit/mozapps/update/test/unit/test_0171_fileLocked_xp_win_partial.js
@@ -0,0 +1,104 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ */
+
+/* File locked partial MAR file patch apply failure test */
+
+const TEST_ID = "0171";
+
+// The files are in the same order as they are applied from the mar
+const TEST_FILES = [
+{
+  fileName         : "1_1_image1.png",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
+  originalContents : null,
+  compareContents  : null,
+  originalFile     : "data/partial.png",
+  compareFile      : "data/partial.png"
+}, {
+  fileName         : "1_1_text1",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
+  originalContents : "ShouldNotBeModified\n",
+  compareContents  : "ShouldNotBeModified\n",
+  originalFile     : null,
+  compareFile      : null
+}, {
+  fileName         : "1_1_text2",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
+  originalContents : "ShouldNotBeDeleted\n",
+  compareContents  : "ShouldNotBeDeleted\n",
+  originalFile     : null,
+  compareFile      : null
+}, {
+  fileName         : "1_exe1.exe",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/",
+  originalContents : null,
+  compareContents  : null,
+  originalFile     : "data/complete.png",
+  compareFile      : "data/complete.png"
+}, {
+  fileName         : "2_1_text1",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/2/2_1/",
+  originalContents : "ShouldNotBeDeleted\n",
+  compareContents  : "ShouldNotBeDeleted\n",
+  originalFile     : null,
+  compareFile      : null
+}];
+
+let gLockFileProcess;
+
+function run_test() {
+  if (!IS_WIN || IS_WINCE) {
+    logTestInfo("this test is only applicable to Windows... returning early");
+    return;
+  }
+
+  do_test_pending();
+  do_register_cleanup(end_test);
+
+  setupUpdaterTest(TEST_ID, MAR_PARTIAL_FILE, TEST_FILES);
+
+  // Exclusively lock an existing file so it is in use during the update
+  let helperBin = do_get_file(HELPER_BIN_FILE);
+  let lockFileRelPath = TEST_FILES[3].destinationDir + TEST_FILES[3].fileName;
+  let args = ["-s", "20", lockFileRelPath];
+  gLockFileProcess = AUS_Cc["@mozilla.org/process/util;1"].
+                     createInstance(AUS_Ci.nsIProcess);
+  gLockFileProcess.init(helperBin);
+  gLockFileProcess.run(false, args, args.length);
+
+  // Give the lock file process time to lock the file before updating otherwise
+  // this test can fail intermittently on Windows debug builds.
+  do_timeout(100, testUpdate);
+}
+
+function end_test() {
+  cleanupUpdaterTest(TEST_ID);
+}
+
+function testUpdate() {
+  let updatesDir = do_get_file(TEST_ID + UPDATES_DIR_SUFFIX);
+  let applyToDir = do_get_file(TEST_ID + APPLY_TO_DIR_SUFFIX);
+
+  // apply the partial mar
+  let exitValue = runUpdate(TEST_ID);
+  logTestInfo("testing updater binary process exitValue for success when " +
+              "applying a partial mar");
+  do_check_eq(exitValue, 0);
+
+  gLockFileProcess.kill();
+
+  logTestInfo("testing update.status should be " + STATE_FAILED);
+  // The update status format for a failure is failed: # where # is the error
+  // code for the failure.
+  do_check_eq(readStatusFile(updatesDir).split(": ")[0], STATE_FAILED);
+
+  checkFilesAfterUpdateFailure(TEST_ID, TEST_FILES);
+
+  logTestInfo("testing tobedeleted directory doesn't exist");
+  let toBeDeletedDir = applyToDir.clone();
+  toBeDeletedDir.append("tobedeleted");
+  do_check_false(toBeDeletedDir.exists());
+
+  checkCallbackAppLog(TEST_ID);
+}
diff --git a/toolkit/mozapps/update/test/unit/test_0180_fileInUse_xp_win_complete.js b/toolkit/mozapps/update/test/unit/test_0180_fileInUse_xp_win_complete.js
new file mode 100644
index 000000000000..beccdc2b8d79
--- /dev/null
+++ b/toolkit/mozapps/update/test/unit/test_0180_fileInUse_xp_win_complete.js
@@ -0,0 +1,102 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ */
+
+/* File in use complete MAR file patch apply success test */
+
+const TEST_ID = "0180";
+
+// The files are in the same order as they are applied from the mar
+const TEST_FILES = [
+{
+  fileName         : "1_1_image1.png",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
+  originalContents : null,
+  compareContents  : null,
+  originalFile     : null,
+  compareFile      : "data/complete.png"
+}, {
+  fileName         : "1_1_text1",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
+  originalContents : "ToBeReplacedWithToBeModified\n",
+  compareContents  : "ToBeModified\n",
+  originalFile     : null,
+  compareFile      : null
+}, {
+  fileName         : "1_1_text2",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
+  originalContents : "ToBeReplacedWithToBeDeleted\n",
+  compareContents  : "ToBeDeleted\n",
+  originalFile     : null,
+  compareFile      : null
+}, {
+  fileName         : "1_exe1.exe",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/",
+  originalContents : null,
+  compareContents  : null,
+  originalFile     : HELPER_BIN_FILE,
+  compareFile      : "data/complete.png"
+}, {
+  fileName         : "2_1_text1",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/2/2_1/",
+  originalContents : "ToBeReplacedWithToBeDeleted\n",
+  compareContents  : "ToBeDeleted\n",
+  originalFile     : null,
+  compareFile      : null
+}];
+
+let gFileInUseProcess;
+
+function run_test() {
+  if (!IS_WIN || IS_WINCE) {
+    logTestInfo("this test is only applicable to Windows... returning early");
+    return;
+  }
+
+  do_test_pending();
+  do_register_cleanup(end_test);
+
+  setupUpdaterTest(TEST_ID, MAR_COMPLETE_FILE, TEST_FILES);
+
+  // Launch an existing file so it is in use during the update
+  let fileInUseBin = do_get_file(TEST_FILES[3].destinationDir +
+                                 TEST_FILES[3].fileName);
+  let args = ["-s", "20"];
+  gFileInUseProcess = AUS_Cc["@mozilla.org/process/util;1"].
+                      createInstance(AUS_Ci.nsIProcess);
+  gFileInUseProcess.init(fileInUseBin);
+  gFileInUseProcess.run(false, args, args.length);
+
+  // Give the file in use process time to launch before updating otherwise this
+  // test can fail intermittently on Windows debug builds.
+  do_timeout(100, testUpdate);
+}
+
+function end_test() {
+  cleanupUpdaterTest(TEST_ID);
+}
+
+function testUpdate() {
+  let updatesDir = do_get_file(TEST_ID + UPDATES_DIR_SUFFIX);
+  let applyToDir = do_get_file(TEST_ID + APPLY_TO_DIR_SUFFIX);
+
+  // apply the complete mar
+  let exitValue = runUpdate(TEST_ID);
+  logTestInfo("testing updater binary process exitValue for success when " +
+              "applying a complete mar");
+  do_check_eq(exitValue, 0);
+
+  gFileInUseProcess.kill();
+
+  logTestInfo("testing update.status should be " + STATE_SUCCEEDED);
+  do_check_eq(readStatusFile(updatesDir), STATE_SUCCEEDED);
+
+  checkFilesAfterUpdateSuccess(TEST_ID, TEST_FILES);
+
+  logTestInfo("testing tobedeleted directory exists");
+  let toBeDeletedDir = applyToDir.clone();
+  toBeDeletedDir.append("tobedeleted");
+  do_check_true(toBeDeletedDir.exists());
+
+  checkCallbackAppLog(TEST_ID);
+}
diff --git a/toolkit/mozapps/update/test/unit/test_0181_fileInUse_xp_win_partial.js b/toolkit/mozapps/update/test/unit/test_0181_fileInUse_xp_win_partial.js
new file mode 100644
index 000000000000..e9e0937dc72d
--- /dev/null
+++ b/toolkit/mozapps/update/test/unit/test_0181_fileInUse_xp_win_partial.js
@@ -0,0 +1,119 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ */
+
+/* File in use partial MAR file patch apply success test */
+
+const TEST_ID = "0181";
+const MAR_IN_USE_WIN_FILE = "data/partial_in_use_win.mar";
+
+// The files are in the same order as they are applied from the mar
+var TEST_FILES = [
+{
+  fileName         : "1_1_image1.png",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
+  originalContents : null,
+  compareContents  : null,
+  originalFile     : "data/complete.png",
+  compareFile      : "data/partial.png"
+}, {
+  fileName         : "1_1_text1",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
+  originalContents : "ToBeModified\n",
+  compareContents  : "Modified\n",
+  originalFile     : null,
+  compareFile      : null
+}, {
+  fileName         : "1_1_text2",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
+  originalContents : "ToBeDeleted\n",
+  compareContents  : null,
+  originalFile     : null,
+  compareFile      : null
+}, {
+  fileName         : "1_exe1.exe",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/",
+  originalContents : null,
+  compareContents  : null,
+  originalFile     : "data/partial_in_use_win_before.exe",
+  compareFile      : "data/partial_in_use_win_after.exe"
+}, {
+  fileName         : "2_1_text1",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/2/2_1/",
+  originalContents : "ToBeDeleted\n",
+  compareContents  : null,
+  originalFile     : null,
+  compareFile      : null
+}, {
+  fileName         : "1_1_text3",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/1/1_1/",
+  originalContents : null,
+  compareContents  : "Added\n",
+  originalFile     : null,
+  compareFile      : null
+}, {
+  fileName         : "3_1_text1",
+  destinationDir   : TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/3/3_1/",
+  originalContents : null,
+  compareContents  : "Added\n",
+  originalFile     : null,
+  compareFile      : null
+}];
+
+let gFileInUseProcess;
+
+function run_test() {
+  if (!IS_WIN || IS_WINCE) {
+    logTestInfo("this test is only applicable to Windows... returning early");
+    return;
+  }
+
+  do_test_pending();
+  do_register_cleanup(end_test);
+
+  setupUpdaterTest(TEST_ID, MAR_IN_USE_WIN_FILE, TEST_FILES);
+
+  // Launch an existing file so it is in use during the update
+  let fileInUseBin = do_get_file(TEST_FILES[3].destinationDir +
+                                 TEST_FILES[3].fileName);
+  let args = ["-s", "20"];
+  gFileInUseProcess = AUS_Cc["@mozilla.org/process/util;1"].
+                      createInstance(AUS_Ci.nsIProcess);
+  gFileInUseProcess.init(fileInUseBin);
+  gFileInUseProcess.run(false, args, args.length);
+
+  // Give the file in use process time to launch before updating otherwise this
+  // test can fail intermittently on Windows debug builds.
+  do_timeout(100, testUpdate);
+}
+
+function end_test() {
+  cleanupUpdaterTest(TEST_ID);
+}
+
+function testUpdate() {
+  let updatesDir = do_get_file(TEST_ID + UPDATES_DIR_SUFFIX);
+  let applyToDir = do_get_file(TEST_ID + APPLY_TO_DIR_SUFFIX);
+
+  // apply the partial mar
+  let exitValue = runUpdate(TEST_ID);
+  logTestInfo("testing updater binary process exitValue for success when " +
+              "applying a partial mar");
+  do_check_eq(exitValue, 0);
+
+  gFileInUseProcess.kill();
+
+  checkFilesAfterUpdateSuccess(TEST_ID, TEST_FILES);
+
+  logTestInfo("testing directory still exists after removal of the last file " +
+              "in the directory (bug 386760)");
+  let testDir = do_get_file(TEST_ID + APPLY_TO_DIR_SUFFIX + "/mar_test/2/2_1/", true);
+  do_check_true(testDir.exists());
+
+  logTestInfo("testing tobedeleted directory exists");
+  let toBeDeletedDir = applyToDir.clone();
+  toBeDeletedDir.append("tobedeleted");
+  do_check_true(toBeDeletedDir.exists());
+
+  checkCallbackAppLog(TEST_ID);
+}
diff --git a/toolkit/mozapps/update/updater/progressui_win.cpp b/toolkit/mozapps/update/updater/progressui_win.cpp
index 364f651a401a..ee4c91435362 100644
--- a/toolkit/mozapps/update/updater/progressui_win.cpp
+++ b/toolkit/mozapps/update/updater/progressui_win.cpp
@@ -303,7 +303,7 @@ InitDialog(HWND hDlg)
   SetTimer(hDlg, TIMER_ID, TIMER_INTERVAL, NULL);
 }
 
-// Message handler for about box.
+// Message handler for update dialog.
 static LRESULT CALLBACK
 DialogProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)
 {
diff --git a/toolkit/mozapps/update/updater/updater.cpp b/toolkit/mozapps/update/updater/updater.cpp
index 76053789b02e..5da7ec19f768 100644
--- a/toolkit/mozapps/update/updater/updater.cpp
+++ b/toolkit/mozapps/update/updater/updater.cpp
@@ -85,6 +85,8 @@
 # define NS_tchmod _wchmod
 # define NS_tmkdir(path, perms) _wmkdir(path)
 # define NS_tremove _wremove
+// _wrename is used instead of MoveFileW to avoid the link tracking service.
+# define NS_trename _wrename
 # define NS_tfopen _wfopen
 #ifndef WINCE
 # define stat _stat
@@ -92,6 +94,9 @@
 # define NS_tstat _wstat
 # define BACKUP_EXT L".moz-backup"
 # define CALLBACK_BACKUP_EXT L".moz-callback"
+#ifndef WINCE
+# define DELETE_DIR L"tobedeleted"
+#endif
 # define LOG_S "%S"
 #else
 # include <sys/wait.h>
@@ -108,6 +113,7 @@
 # define NS_tchmod chmod
 # define NS_tmkdir mkdir
 # define NS_tremove remove
+# define NS_trename rename
 # define NS_tfopen fopen
 # define NS_tstat stat
 # define BACKUP_EXT ".moz-backup"
@@ -198,9 +204,6 @@ void LaunchMacPostProcess(const char* aAppExe);
 #endif
 #endif
 
-char *BigBuffer = NULL;
-int BigBufferSize = 262144;
-
 //-----------------------------------------------------------------------------
 
 // This variable lives in libbz2.  It's declared in bzlib_private.h, so we just
@@ -511,8 +514,8 @@ static int ensure_remove(const NS_tchar *path)
   ensure_write_permissions(path);
   int rv = NS_tremove(path);
   if (rv)
-    LOG(("ensure_remove: failed to remove file: " LOG_S ",%d,%d\n", path, rv,
-         errno));
+    LOG(("ensure_remove: failed to remove file: " LOG_S ", rv: %d, err: %d\n",
+         path, rv, errno));
   return rv;
 }
 
@@ -550,8 +553,8 @@ static int ensure_parent_dir(const NS_tchar *path)
       // If the directory already exists, then ignore the error. On WinCE rv
       // will equal 0 if the directory already exists.
       if (rv < 0 && errno != EEXIST) {
-        LOG(("ensure_parent_dir: failed to create directory: " LOG_S ",%d\n",
-             path, errno));
+        LOG(("ensure_parent_dir: failed to create directory: " LOG_S ", " \
+             "err: %d\n", path, errno));
         rv = WRITE_ERROR;
       } else {
         rv = OK;
@@ -562,44 +565,31 @@ static int ensure_parent_dir(const NS_tchar *path)
   return rv;
 }
 
-static int copy_file(const NS_tchar *spath, const NS_tchar *dpath)
+// Renames the specified file to the new file specified. If the destination file
+// exists it is removed.
+static int rename_file(const NS_tchar *spath, const NS_tchar *dpath)
 {
   int rv = ensure_parent_dir(dpath);
   if (rv)
     return rv;
 
-  struct stat ss;
-
-  AutoFile sfile = NS_tfopen(spath, NS_T("rb"));
-  if (sfile == NULL || fstat(fileno((FILE*)sfile), &ss)) {
-    LOG(("copy_file: failed to open or stat: %p," LOG_S ",%d\n", sfile.get(),
-         spath, errno));
+  if (NS_taccess(spath, F_OK)) {
+    LOG(("rename_file: source file doesn't exist: " LOG_S "\n", spath));
     return READ_ERROR;
   }
 
-  AutoFile dfile = ensure_open(dpath, NS_T("wb+"), ss.st_mode); 
-  if (dfile == NULL) {
-    LOG(("copy_file: failed to open: " LOG_S ",%d\n", dpath, errno));
-    return WRITE_ERROR;
-  }
-
-  size_t sc;
-  while ((sc = fread(BigBuffer, 1, BigBufferSize, sfile)) > 0) {
-    size_t dc;
-    char *bp = BigBuffer;
-    while ((dc = fwrite(bp, 1, (unsigned int) sc, dfile)) > 0) {
-      if ((sc -= dc) == 0)
-        break;
-      bp += dc;
-    }
-    if (dc < 0) {
-      LOG(("copy_file: failed to write: %d\n", errno));
+  if (!NS_taccess(dpath, F_OK)) {
+    if (ensure_remove(dpath)) {
+      LOG(("rename_file: destination file exists and could not be " \
+           "removed: " LOG_S "\n", dpath));
       return WRITE_ERROR;
     }
   }
-  if (sc < 0) {
-    LOG(("copy_file: failed to read: %d\n", errno));
-    return READ_ERROR;
+
+  if (NS_trename(spath, dpath) != 0) {
+    LOG(("rename_file: failed to rename file - src: " LOG_S ", " \
+         "dst:" LOG_S ", err: %d\n", spath, dpath, errno));
+    return WRITE_ERROR;
   }
 
   return OK;
@@ -607,51 +597,73 @@ static int copy_file(const NS_tchar *spath, const NS_tchar *dpath)
 
 //-----------------------------------------------------------------------------
 
-// Create a backup copy of the specified file alongside it.
+// Create a backup of the specified file by renaming it.
 static int backup_create(const NS_tchar *path)
 {
   NS_tchar backup[MAXPATHLEN];
   NS_tsnprintf(backup, sizeof(backup)/sizeof(backup[0]),
                NS_T("%s" BACKUP_EXT), path);
 
-  return copy_file(path, backup);
+  return rename_file(path, backup);
 }
 
-// Copy the backup copy of the specified file back overtop
-// the specified file.
-// XXX should be a file move instead
+// Rename the backup of the specified file that was created by renaming it back
+// to the original file.
 static int backup_restore(const NS_tchar *path)
 {
   NS_tchar backup[MAXPATHLEN];
   NS_tsnprintf(backup, sizeof(backup)/sizeof(backup[0]),
                NS_T("%s" BACKUP_EXT), path);
 
-  int rv = copy_file(backup, path);
-  if (rv) {
-    ensure_remove(backup);
-    return rv;
+  if (NS_taccess(backup, F_OK)) {
+    LOG(("backup_restore: backup file doesn't exist: " LOG_S "\n", backup));
+    return OK;
   }
 
-  rv = ensure_remove(backup);
-  if (rv) {
-    LOG(("backup_restore: failed to remove backup file: " LOG_S ",%d\n", backup,
-         errno));
-    return WRITE_ERROR;
-  }
-
-  return OK;
+  return rename_file(backup, path);
 }
 
-// Discard the backup copy of the specified file.
+// Discard the backup of the specified file that was created by renaming it.
 static int backup_discard(const NS_tchar *path)
 {
   NS_tchar backup[MAXPATHLEN];
   NS_tsnprintf(backup, sizeof(backup)/sizeof(backup[0]),
                NS_T("%s" BACKUP_EXT), path);
 
+  // Nothing to discard
+  if (NS_taccess(backup, F_OK)) {
+    LOG(("backup_discard: backup file doesn't exist: " LOG_S "\n", backup));
+    return OK;
+  }
+
   int rv = ensure_remove(backup);
+#if defined(XP_WIN) && !defined(WINCE)
+  if (rv) {
+    LOG(("backup_discard: unable to remove: " LOG_S "\n", backup));
+    NS_tchar path[MAXPATHLEN];
+    GetTempFileNameW(DELETE_DIR, L"moz", 0, path);
+    if (rename_file(backup, path)) {
+      LOG(("backup_discard: failed to rename file:" LOG_S ", dst:" LOG_S "\n",
+           backup, path));
+      return WRITE_ERROR;
+    }
+    // The MoveFileEx call to remove the file on OS reboot will fail if the
+    // process doesn't have write access to the HKEY_LOCAL_MACHINE registry key
+    // but this is ok since the installer / uninstaller will delete the
+    // directory containing the file along with its contents after an update is
+    // applied, on reinstall, and on uninstall.
+    if (MoveFileEx(path, NULL, MOVEFILE_DELAY_UNTIL_REBOOT)) {
+      LOG(("backup_discard: file renamed and will be removed on OS " \
+           "reboot: " LOG_S "\n", path));
+    } else {
+      LOG(("backup_discard: failed to schedule OS reboot removal of " \
+           "file: " LOG_S "\n", path));
+    }
+  }
+#else
   if (rv)
     return WRITE_ERROR;
+#endif
 
   return OK;
 }
@@ -795,10 +807,6 @@ RemoveFile::Execute()
     return rv;
   }
 
-  rv = ensure_remove(mDestFile);
-  if (rv)
-    return WRITE_ERROR;
-
   return OK;
 }
 
@@ -869,10 +877,6 @@ AddFile::Execute()
     rv = backup_create(mDestFile);
     if (rv)
       return rv;
-
-    rv = ensure_remove(mDestFile);
-    if (rv)
-      return WRITE_ERROR;
   } else {
     rv = ensure_parent_dir(mDestFile);
     if (rv)
@@ -933,8 +937,8 @@ PatchFile::LoadSourceFile(FILE* ofile)
   struct stat os;
   int rv = fstat(fileno((FILE*)ofile), &os);
   if (rv) {
-    LOG(("LoadSourceFile: unable to stat destination file: " LOG_S ",%d\n",
-         mDestFile, errno));
+    LOG(("LoadSourceFile: unable to stat destination file: " LOG_S ", " \
+         "err: %d\n", mDestFile, errno));
     return READ_ERROR;
   }
 
@@ -1045,7 +1049,8 @@ PatchFile::Execute()
 
   FILE *origfile = NS_tfopen(mDestFile, NS_T("rb"));
   if (!origfile) {
-    LOG(("unable to open destination file: " LOG_S ",%d\n", mDestFile, errno));
+    LOG(("unable to open destination file: " LOG_S ", err: %d\n", mDestFile,
+         errno));
     return READ_ERROR;
   }
 
@@ -1056,8 +1061,8 @@ PatchFile::Execute()
     return rv;
   }
 
-  // Create backup copy of the destination file before proceeding.
-
+  // Rename the destination file if it exists before proceeding so it can be
+  // used to restore the file to its original state if there is an error.
   struct stat ss;
   if (NS_tstat(mDestFile, &ss))
     return READ_ERROR;
@@ -1066,15 +1071,10 @@ PatchFile::Execute()
   if (rv)
     return rv;
 
-  rv = ensure_remove(mDestFile);
-  if (rv) {
-    LOG(("unable to remove original file: " LOG_S ",%d\n", mDestFile, errno));
-    return WRITE_ERROR;
-  }
-
   AutoFile ofile = ensure_open(mDestFile, NS_T("wb+"), ss.st_mode);
   if (ofile == NULL) {
-    LOG(("unable to create new file: " LOG_S ",%d\n", mDestFile, errno));
+    LOG(("unable to create new file: " LOG_S ", err: %d\n", mDestFile,
+         errno));
     return WRITE_ERROR;
   }
 
@@ -1510,10 +1510,6 @@ int NS_main(int argc, NS_tchar **argv)
         if (result != WAIT_OBJECT_0)
           return 1;
       }
-
-      // The process may be signaled before it releases the executable image.
-      // This is a terrible hack, but it'll have to do for now :-(
-      Sleep(50);
 #else
       waitpid(pid, NULL, 0);
 #endif
@@ -1655,17 +1651,28 @@ int NS_main(int argc, NS_tchar **argv)
     NS_tremove(callbackBackupPath);
     CopyFileW(argv[callbackIndex], callbackBackupPath, FALSE);
 
-    // By opening a file handle to the callback executable, the OS will prevent
-    // launching the process while it is being updated. 
-    callbackFile = CreateFileW(argv[callbackIndex],
+    // Since the process may be signaled as exited by WaitForSingleObject before
+    // the release of the executable image try to lock the main executable file
+    // multiple times before giving up.
+    int retries = 5;
+    do {
+      // By opening a file handle to the callback executable, the OS will prevent
+      // launching the process while it is being updated. 
+      callbackFile = CreateFileW(argv[callbackIndex],
 #ifdef WINCE
-                               GENERIC_WRITE,
-                               FILE_SHARE_READ | FILE_SHARE_WRITE,
+                                 GENERIC_WRITE,
+                                 FILE_SHARE_READ | FILE_SHARE_WRITE,
 #else
-                               DELETE | GENERIC_WRITE,
-                               0, // no sharing!
+                                 DELETE | GENERIC_WRITE,
+                                 0, // no sharing!
 #endif
-                               NULL, OPEN_EXISTING, 0, NULL);
+                                 NULL, OPEN_EXISTING, 0, NULL);
+      if (callbackFile != INVALID_HANDLE_VALUE)
+        break;
+
+      Sleep(50);
+    } while (--retries);
+
     // CreateFileW will fail if the callback executable is already in use. Since
     // it isn't possible to update write the status file and return.
     if (callbackFile == INVALID_HANDLE_VALUE) {
@@ -1681,28 +1688,14 @@ int NS_main(int argc, NS_tchar **argv)
   }
 #endif
 
-  BigBuffer = (char *)malloc(BigBufferSize);
-  if (!BigBuffer) {
-    LOG(("NS_main: failed to allocate default buffer of %i. Trying 1K " \
-         "buffer\n", BigBufferSize));
-
-    // Try again with a smaller size.
-    BigBufferSize = 1024;
-    BigBuffer = (char *)malloc(BigBufferSize);
-    if (!BigBuffer) {
-      LOG(("NS_main: failed to allocate 1K buffer - exiting\n"));
-      LogFinish();
-      WriteStatusFile(MEM_ERROR);
-#ifdef XP_WIN
-      CloseHandle(callbackFile);
-      NS_tremove(callbackBackupPath);
-      EXIT_WHEN_ELEVATED(elevatedLockFilePath, updateLockFileHandle, 1);
-#endif
-      if (argc > callbackIndex)
-        LaunchCallbackApp(argv[4], argc - callbackIndex, argv + callbackIndex);
-      return 1;
-    }
+#if defined(XP_WIN) && !defined(WINCE)
+  // The directory to move files that are in use to on Windows. This directory
+  // will be deleted after the update is finished or on on OS reboot using
+  // MoveFileEx if it contains files that are in use.
+  if (NS_taccess(DELETE_DIR, F_OK)) {
+    NS_tmkdir(DELETE_DIR, 0755);
   }
+#endif
 
   // Run update process on a background thread.  ShowProgressUI may return
   // before QuitProgressUI has been called, so wait for UpdateThreadFunc to
@@ -1722,11 +1715,32 @@ int NS_main(int argc, NS_tchar **argv)
       NS_tremove(callbackBackupPath);
     }
   }
+
+#ifndef WINCE
+  if (_wrmdir(DELETE_DIR)) {
+    LOG(("NS_main: unable to remove directory: " LOG_S ", err: %d\n",
+         DELETE_DIR, errno));
+    // The directory probably couldn't be removed due to it containing files
+    // that are in use and will be removed on OS reboot. The call to remove the
+    // directory on OS reboot is done after the calls to remove the files so the
+    // files are removed first on OS reboot since the directory must be empty
+    // for the directory removal to be successful. The MoveFileEx call to remove
+    // the directory on OS reboot will fail if the process doesn't have write
+    // access to the HKEY_LOCAL_MACHINE registry key but this is ok since the
+    // installer / uninstaller will delete the directory along with its contents
+    // after an update is applied, on reinstall, and on uninstall.
+    if (MoveFileEx(DELETE_DIR, NULL, MOVEFILE_DELAY_UNTIL_REBOOT)) {
+      LOG(("NS_main: directory will be removed on OS reboot: " LOG_S "\n",
+           DELETE_DIR));
+    } else {
+      LOG(("NS_main: failed to schedule OS reboot removal of " \
+           "directory: " LOG_S "\n", DELETE_DIR));
+    }
+  }
 #endif
+#endif /* XP_WIN */
 
   LogFinish();
-  free(BigBuffer);
-  BigBuffer = NULL;
 
   if (argc > callbackIndex) {
 #if defined(XP_WIN) && !defined(WINCE)
diff --git a/toolkit/themes/gnomestripe/mozapps/extensions/extensions.css b/toolkit/themes/gnomestripe/mozapps/extensions/extensions.css
index 1cf9844baba6..de3cd4df70d4 100644
--- a/toolkit/themes/gnomestripe/mozapps/extensions/extensions.css
+++ b/toolkit/themes/gnomestripe/mozapps/extensions/extensions.css
@@ -87,6 +87,10 @@
 
 /*** global warnings ***/
 
+.global-warning-container {
+  overflow-x: hidden;
+}
+
 .global-warning {
   -moz-box-align: center;
   margin: 0 8px;
@@ -101,6 +105,12 @@
   background-repeat: repeat-x;
 }
 
+@media all and (max-width: 700px) {
+  .global-warning-text {
+    display: none;
+  }
+}
+
 /*** notification icons ***/
 
 .warning-icon {
@@ -491,6 +501,7 @@
 #search-filter {
   padding: 5px 20px;
   font-size: 120%;
+  overflow-x: hidden;
 }
 
 #search-filter-label {
diff --git a/toolkit/themes/pinstripe/global/notification.css b/toolkit/themes/pinstripe/global/notification.css
index aaebf20c9bde..05c293713ce0 100644
--- a/toolkit/themes/pinstripe/global/notification.css
+++ b/toolkit/themes/pinstripe/global/notification.css
@@ -93,10 +93,12 @@ notification[type="critical"] .messageImage {
   -moz-margin-start: 5px;
 }
 
-.popup-notification-menubutton[type="menu-button"] {
+.popup-notification-menubutton {
   -moz-appearance: none;
+  margin-top: 17px;
 }
 
+.popup-notification-menubutton:not([type="menu-button"]),
 .popup-notification-menubutton > .button-menubutton-button,
 .popup-notification-menubutton > .button-menubutton-dropmarker {
   color: #fff;
@@ -112,6 +114,10 @@ notification[type="critical"] .messageImage {
   background-origin: padding-box;
 }
 
+.popup-notification-menubutton:not([type="menu-button"]) {
+  padding: 2px 9px;
+}
+
 .popup-notification-menubutton > .button-menubutton-button {
   padding-top: 2px;
   padding-bottom: 2px;
@@ -141,6 +147,7 @@ notification[type="critical"] .messageImage {
   border-bottom-left-radius: 0;
 }
 
+.popup-notification-menubutton:not([type="menu-button"]):hover:active,
 .popup-notification-menubutton > .button-menubutton-button:hover:active,
 .popup-notification-menubutton[open="true"] > .button-menubutton-dropmarker {
   background: -moz-linear-gradient(rgba(40,40,40,.9), rgba(70,70,70,.9));
diff --git a/toolkit/themes/pinstripe/mozapps/extensions/extensions.css b/toolkit/themes/pinstripe/mozapps/extensions/extensions.css
index a231116eaa23..64f0b0969fc5 100644
--- a/toolkit/themes/pinstripe/mozapps/extensions/extensions.css
+++ b/toolkit/themes/pinstripe/mozapps/extensions/extensions.css
@@ -100,6 +100,10 @@
 
 /*** global warnings ***/
 
+.global-warning-container {
+  overflow-x: hidden;
+}
+
 .global-warning {
   -moz-box-align: center;
   margin: 0 8px;
@@ -114,6 +118,12 @@
   background-repeat: repeat-x;
 }
 
+@media all and (max-width: 700px) {
+  .global-warning-text {
+    display: none;
+  }
+}
+
 /*** notification icons ***/
 
 .warning-icon {
@@ -521,6 +531,7 @@
 #search-filter {
   padding: 5px 20px;
   font-size: 120%;
+  overflow-x: hidden;
 }
 
 #search-filter-label {
diff --git a/toolkit/themes/winstripe/mozapps/extensions/extensions.css b/toolkit/themes/winstripe/mozapps/extensions/extensions.css
index 5f03e5099478..cfc0512f0462 100644
--- a/toolkit/themes/winstripe/mozapps/extensions/extensions.css
+++ b/toolkit/themes/winstripe/mozapps/extensions/extensions.css
@@ -71,6 +71,10 @@
 
 /*** global warnings ***/
 
+.global-warning-container {
+  overflow-x: hidden;
+}
+
 .global-warning {
   -moz-box-align: center;
   padding: 0 8px;
@@ -94,6 +98,12 @@
   border-bottom: 1px solid #A8A8A8;  
 }
 
+@media all and (max-width: 700px) {
+  .global-warning-text {
+    display: none;
+  }
+}
+
 /*** notification icons ***/
 
 .warning-icon {
@@ -501,6 +511,7 @@
 #search-filter {
   padding: 5px 20px;
   font-size: 120%;
+  overflow-x: hidden;
 }
 
 #search-filter-label {
diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp
index 3ea7638c458f..bbb7df1ed283 100644
--- a/toolkit/xre/nsAppRunner.cpp
+++ b/toolkit/xre/nsAppRunner.cpp
@@ -3058,6 +3058,15 @@ XRE_main(int argc, char* argv[], const nsXREAppData* aAppData)
     gSafeMode = PR_TRUE;
   }
 
+#ifdef XP_WIN
+  // If the shift key is pressed during startup start in safe mode. GetKeyState
+  // returns a short and the high order bit will be 1 if the shift key is
+  // pressed. By masking the returned short with 0x8000 the result will be 0 if
+  // the key is not pressed and non-zero otherwise.
+  if (GetKeyState(VK_SHIFT) & 0x8000)
+    gSafeMode = PR_TRUE;
+#endif
+
 #ifdef XP_MACOSX
   if (GetCurrentEventKeyModifiers() & optionKey)
     gSafeMode = PR_TRUE;
diff --git a/widget/public/Makefile.in b/widget/public/Makefile.in
index 84009a23a924..d82f71b6598d 100644
--- a/widget/public/Makefile.in
+++ b/widget/public/Makefile.in
@@ -82,6 +82,12 @@ ifeq ($(MOZ_WIDGET_TOOLKIT),beos)
 EXPORTS		+= nsIDragSessionBeOS.h
 endif
 
+ifeq ($(MOZ_WIDGET_TOOLKIT),android)
+EXPORTS		+= \
+		nsIPrintDialogService.h \
+		$(NULL)
+endif
+
 ifneq (,$(filter qt gtk2,$(MOZ_WIDGET_TOOLKIT)))
 EXPORTS		+= \
 		nsIDragSessionGTK.h \
diff --git a/widget/public/nsGUIEvent.h b/widget/public/nsGUIEvent.h
index 1d6cf0e82dc7..ec3c87b5089b 100644
--- a/widget/public/nsGUIEvent.h
+++ b/widget/public/nsGUIEvent.h
@@ -236,6 +236,9 @@ class nsHashKey;
 #define NS_OFFLINE                       (NS_WINDOW_START + 64)
 #define NS_ONLINE                        (NS_WINDOW_START + 65)
 
+// Indicates a resize will occur
+#define NS_BEFORERESIZE_EVENT            (NS_WINDOW_START + 66)
+
 #define NS_MOUSE_MESSAGE_START          300
 #define NS_MOUSE_MOVE                   (NS_MOUSE_MESSAGE_START)
 #define NS_MOUSE_BUTTON_UP              (NS_MOUSE_MESSAGE_START + 1)
diff --git a/widget/src/android/AndroidBridge.cpp b/widget/src/android/AndroidBridge.cpp
index 728ae68c74ed..f0c20d1120b2 100644
--- a/widget/src/android/AndroidBridge.cpp
+++ b/widget/src/android/AndroidBridge.cpp
@@ -522,7 +522,7 @@ AndroidBridge::ShowFilePicker(nsAString& aFilePath, nsAString& aFilters)
 void
 AndroidBridge::SetFullScreen(PRBool aFullScreen)
 {
-    mJNIEnv->CallStaticIntMethod(mGeckoAppShellClass, jSetFullScreen, aFullScreen);
+    mJNIEnv->CallStaticVoidMethod(mGeckoAppShellClass, jSetFullScreen, aFullScreen);
 }
 
 void
diff --git a/widget/src/android/Makefile.in b/widget/src/android/Makefile.in
index 018fa602eb5f..383e98936aac 100644
--- a/widget/src/android/Makefile.in
+++ b/widget/src/android/Makefile.in
@@ -65,6 +65,8 @@ CPPSRCS	= \
 	nsClipboard.cpp \
 	nsFilePicker.cpp \
 	nsIMEPicker.cpp \
+	nsDeviceContextAndroid.cpp \
+	nsPrintOptionsAndroid.cpp \
 	$(NULL)
 
 NOT_THERE_YET_CPPSRCS = \
diff --git a/widget/src/android/nsDeviceContextAndroid.cpp b/widget/src/android/nsDeviceContextAndroid.cpp
new file mode 100644
index 000000000000..e18092fc0232
--- /dev/null
+++ b/widget/src/android/nsDeviceContextAndroid.cpp
@@ -0,0 +1,126 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ *   Mozilla Foundation
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Brad Lassey <blassey@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+#include "nsDeviceContextAndroid.h"
+#include "nsString.h"
+#include "nsILocalFile.h"
+#include "nsIFileStreams.h"
+#include "nsAutoPtr.h"
+#include "gfxPDFSurface.h"
+#include "nsIPrintSettings.h"
+#include "nsDirectoryServiceDefs.h"
+
+NS_IMPL_ISUPPORTS1(nsDeviceContextSpecAndroid, nsIDeviceContextSpec)
+
+NS_IMETHODIMP
+nsDeviceContextSpecAndroid::GetSurfaceForPrinter(gfxASurface** aSurface)
+{
+  nsCAutoString tmpDir(getenv("TMPDIR"));
+  nsresult rv = 
+    NS_GetSpecialDirectory(NS_OS_TEMP_DIR, getter_AddRefs(mTempFile));
+  NS_ENSURE_SUCCESS(rv, rv);
+  
+  nsCAutoString filename("tmp-printing.pdf");  
+  mTempFile->AppendNative(filename);
+  rv = mTempFile->CreateUnique(nsIFile::NORMAL_FILE_TYPE, 0660);
+  NS_ENSURE_SUCCESS(rv, rv);  
+  
+  nsCOMPtr<nsIFileOutputStream> stream = do_CreateInstance("@mozilla.org/network/file-output-stream;1");
+  rv = stream->Init(mTempFile, -1, -1, 0);
+  NS_ENSURE_SUCCESS(rv, rv);  
+
+  nsRefPtr<gfxASurface> surface;
+
+  // XXX: what should we do hear for size? screen size?
+  gfxSize surfaceSize(480, 800);
+
+  surface = new gfxPDFSurface(stream, surfaceSize);
+  
+  
+  NS_ABORT_IF_FALSE(surface, "valid address expected");
+  surface.swap(*aSurface);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsDeviceContextSpecAndroid::Init(nsIWidget* aWidget,
+                             nsIPrintSettings* aPS,
+                             PRBool aIsPrintPreview)
+{
+  mPrintSettings = aPS;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsDeviceContextSpecAndroid::BeginDocument(PRUnichar* aTitle,
+                                      PRUnichar* aPrintToFileName,
+                                      PRInt32 aStartPage,
+                                      PRInt32 aEndPage)
+{
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsDeviceContextSpecAndroid::EndDocument()
+{
+  nsXPIDLString targetPath;
+  nsCOMPtr<nsILocalFile> destFile;
+  mPrintSettings->GetToFileName(getter_Copies(targetPath));
+  
+  nsresult rv = NS_NewNativeLocalFile(NS_ConvertUTF16toUTF8(targetPath),
+                                      PR_FALSE, getter_AddRefs(destFile));
+  NS_ENSURE_SUCCESS(rv, rv);
+  
+  nsAutoString destLeafName;
+  rv = destFile->GetLeafName(destLeafName);
+  NS_ENSURE_SUCCESS(rv, rv);
+  
+  nsCOMPtr<nsIFile> destDir;
+  rv = destFile->GetParent(getter_AddRefs(destDir));
+  NS_ENSURE_SUCCESS(rv, rv);
+  
+  rv = mTempFile->MoveTo(destDir, destLeafName);
+  NS_ENSURE_SUCCESS(rv, rv);
+  
+  destFile->SetPermissions(0666);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsDeviceContextSpecAndroid::GetPath (const char** aPath)
+{
+  return NS_OK;
+}
diff --git a/widget/src/android/nsDeviceContextAndroid.h b/widget/src/android/nsDeviceContextAndroid.h
new file mode 100644
index 000000000000..a25896d5ad67
--- /dev/null
+++ b/widget/src/android/nsDeviceContextAndroid.h
@@ -0,0 +1,63 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ *   Mozilla Foundation
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Brad Lassey <blassey@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+#include "nsIDeviceContextSpec.h"
+#include "nsCOMPtr.h"
+
+class nsDeviceContextSpecAndroid : public nsIDeviceContextSpec
+{
+public:
+    NS_DECL_ISUPPORTS
+    
+    NS_IMETHOD GetSurfaceForPrinter(gfxASurface** surface);
+
+    NS_IMETHOD Init(nsIWidget* aWidget,
+                    nsIPrintSettings* aPS,
+                    PRBool aIsPrintPreview);
+    NS_IMETHOD BeginDocument(PRUnichar* aTitle,
+                             PRUnichar* aPrintToFileName,
+                             PRInt32 aStartPage,
+                             PRInt32 aEndPage);
+    NS_IMETHOD EndDocument();
+    NS_IMETHOD BeginPage() { return NS_OK; }
+    NS_IMETHOD EndPage() { return NS_OK; }
+
+    NS_IMETHOD GetPath (const char** aPath);
+private:
+    nsCOMPtr<nsIPrintSettings> mPrintSettings;
+    nsCOMPtr<nsIFile> mTempFile;
+};
diff --git a/widget/src/android/nsPrintOptionsAndroid.cpp b/widget/src/android/nsPrintOptionsAndroid.cpp
new file mode 100644
index 000000000000..2d215c7e239a
--- /dev/null
+++ b/widget/src/android/nsPrintOptionsAndroid.cpp
@@ -0,0 +1,69 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ *   Mozilla Foundation
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Matt Brubeck <mbrubeck@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+#include "nsPrintOptionsAndroid.h"
+
+#include "nsPrintSettingsImpl.h"
+
+class nsPrintSettingsAndroid : public nsPrintSettings {
+public:
+  nsPrintSettingsAndroid()
+  {
+    // The aim here is to set up the objects enough that silent printing works
+    SetOutputFormat(nsIPrintSettings::kOutputFormatPDF);
+    SetPrinterName(NS_LITERAL_STRING("PDF printer").get());
+    
+  }
+};
+
+nsPrintOptionsAndroid::nsPrintOptionsAndroid()
+{
+}
+
+nsPrintOptionsAndroid::~nsPrintOptionsAndroid()
+{
+}
+
+NS_IMETHODIMP nsPrintOptionsAndroid::CreatePrintSettings(nsIPrintSettings **_retval)
+{
+  nsPrintSettings * printSettings = new nsPrintSettingsAndroid();
+  NS_ENSURE_TRUE(printSettings, NS_ERROR_OUT_OF_MEMORY);
+  NS_ADDREF(*_retval = printSettings);
+  (void)InitPrintSettingsFromPrefs(*_retval, PR_FALSE,
+                                   nsIPrintSettings::kInitSaveAll);
+  return NS_OK;
+}
diff --git a/widget/src/android/nsPrintOptionsAndroid.h b/widget/src/android/nsPrintOptionsAndroid.h
new file mode 100644
index 000000000000..6615f8a3c4a2
--- /dev/null
+++ b/widget/src/android/nsPrintOptionsAndroid.h
@@ -0,0 +1,56 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ *   Mozilla Foundation
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Matt Brubeck <mbrubeck@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+#ifndef nsPrintOptionsAndroid_h__
+#define nsPrintOptionsAndroid_h__
+
+#include "nsPrintOptionsImpl.h"
+#include "nsIPrintSettings.h"
+
+//*****************************************************************************
+//***    nsPrintOptions
+//*****************************************************************************
+class nsPrintOptionsAndroid : public nsPrintOptions
+{
+public:
+  nsPrintOptionsAndroid();
+  virtual ~nsPrintOptionsAndroid();
+
+  NS_IMETHOD CreatePrintSettings(nsIPrintSettings **_retval);
+};
+
+#endif /* nsPrintOptionsAndroid_h__ */
diff --git a/widget/src/android/nsWidgetFactory.cpp b/widget/src/android/nsWidgetFactory.cpp
index 88943af4baac..996c647fd595 100644
--- a/widget/src/android/nsWidgetFactory.cpp
+++ b/widget/src/android/nsWidgetFactory.cpp
@@ -52,6 +52,9 @@
 #include "nsClipboard.h"
 #include "nsClipboardHelper.h"
 #include "nsTransferable.h"
+#include "nsPrintOptionsAndroid.h"
+#include "nsPrintSession.h"
+#include "nsDeviceContextAndroid.h"
 #include "nsFilePicker.h"
 #include "nsHTMLFormatConverter.h"
 #include "nsIMEPicker.h"
@@ -68,6 +71,9 @@ NS_GENERIC_FACTORY_CONSTRUCTOR(nsIdleServiceAndroid)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsTransferable)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsClipboard)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsClipboardHelper)
+NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(nsPrintOptionsAndroid, Init)
+NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(nsPrintSession, Init)
+NS_GENERIC_FACTORY_CONSTRUCTOR(nsDeviceContextSpecAndroid)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsHTMLFormatConverter)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsIMEPicker)
 
@@ -101,6 +107,9 @@ NS_DEFINE_NAMED_CID(NS_IDLE_SERVICE_CID);
 NS_DEFINE_NAMED_CID(NS_TRANSFERABLE_CID);
 NS_DEFINE_NAMED_CID(NS_CLIPBOARD_CID);
 NS_DEFINE_NAMED_CID(NS_CLIPBOARDHELPER_CID);
+NS_DEFINE_NAMED_CID(NS_PRINTSETTINGSSERVICE_CID);
+NS_DEFINE_NAMED_CID(NS_PRINTSESSION_CID);
+NS_DEFINE_NAMED_CID(NS_DEVICE_CONTEXT_SPEC_CID);
 NS_DEFINE_NAMED_CID(NS_FILEPICKER_CID);
 NS_DEFINE_NAMED_CID(NS_HTMLFORMATCONVERTER_CID);
 NS_DEFINE_NAMED_CID(NS_IMEPICKER_CID);
@@ -116,6 +125,9 @@ static const mozilla::Module::CIDEntry kWidgetCIDs[] = {
   { &kNS_TRANSFERABLE_CID, false, NULL, nsTransferableConstructor },
   { &kNS_CLIPBOARD_CID, false, NULL, nsClipboardConstructor },
   { &kNS_CLIPBOARDHELPER_CID, false, NULL, nsClipboardHelperConstructor },
+  { &kNS_PRINTSETTINGSSERVICE_CID, false, NULL, nsPrintOptionsAndroidConstructor },
+  { &kNS_PRINTSESSION_CID, false, NULL, nsPrintSessionConstructor },
+  { &kNS_DEVICE_CONTEXT_SPEC_CID, false, NULL, nsDeviceContextSpecAndroidConstructor },
   { &kNS_FILEPICKER_CID, false, NULL, nsFilePickerConstructor },
   { &kNS_HTMLFORMATCONVERTER_CID, false, NULL, nsHTMLFormatConverterConstructor },
   { &kNS_IMEPICKER_CID, false, NULL, nsIMEPickerConstructor },
@@ -133,6 +145,9 @@ static const mozilla::Module::ContractIDEntry kWidgetContracts[] = {
   { "@mozilla.org/widget/transferable;1", &kNS_TRANSFERABLE_CID },
   { "@mozilla.org/widget/clipboard;1", &kNS_CLIPBOARD_CID },
   { "@mozilla.org/widget/clipboardhelper;1", &kNS_CLIPBOARDHELPER_CID },
+  { "@mozilla.org/gfx/printsettings-service;1", &kNS_PRINTSETTINGSSERVICE_CID },
+  { "@mozilla.org/gfx/printsession;1", &kNS_PRINTSESSION_CID },
+  { "@mozilla.org/gfx/devicecontextspec;1", &kNS_DEVICE_CONTEXT_SPEC_CID },
   { "@mozilla.org/filepicker;1", &kNS_FILEPICKER_CID },
   { "@mozilla.org/widget/htmlformatconverter;1", &kNS_HTMLFORMATCONVERTER_CID },
   { "@mozilla.org/imepicker;1", &kNS_IMEPICKER_CID },
diff --git a/widget/src/android/nsWindow.cpp b/widget/src/android/nsWindow.cpp
index d6626510c648..58798df39405 100644
--- a/widget/src/android/nsWindow.cpp
+++ b/widget/src/android/nsWindow.cpp
@@ -88,9 +88,9 @@ static nsWindow* gFocusedWindow = nsnull;
 static nsRefPtr<gl::GLContext> sGLContext;
 static bool sFailedToCreateGLContext = false;
 
-// Multitouch swipe thresholds (in screen pixels)
-static const double SWIPE_MAX_PINCH_DELTA = 100;
-static const double SWIPE_MIN_DISTANCE = 150;
+// Multitouch swipe thresholds in inches
+static const double SWIPE_MAX_PINCH_DELTA_INCHES = 0.4;
+static const double SWIPE_MIN_DISTANCE_INCHES = 0.6;
 
 static nsWindow*
 TopWindow()
@@ -199,6 +199,10 @@ nsWindow::Create(nsIWidget *aParent,
         mParent = parent;
     }
 
+    float dpi = GetDPI();
+    mSwipeMaxPinchDelta = SWIPE_MAX_PINCH_DELTA_INCHES * dpi;
+    mSwipeMinDistance = SWIPE_MIN_DISTANCE_INCHES * dpi;
+
     return NS_OK;
 }
 
@@ -522,7 +526,7 @@ nsWindow::BringToFront()
     gTopLevelWindows.InsertElementAt(0, this);
 
     if (oldTop) {
-        nsGUIEvent event(PR_TRUE, NS_DEACTIVATE, gTopLevelWindows[0]);
+        nsGUIEvent event(PR_TRUE, NS_DEACTIVATE, oldTop);
         DispatchEvent(&event);
     }
 
@@ -1103,14 +1107,14 @@ void nsWindow::OnMultitouchEvent(AndroidGeckoEvent *ae)
 
         // If the cumulative pinch delta goes past the threshold, treat this
         // as a pinch only, and not a swipe.
-        if (fabs(pinchDist - mStartDist) > SWIPE_MAX_PINCH_DELTA)
+        if (fabs(pinchDist - mStartDist) > mSwipeMaxPinchDelta)
             mStartPoint = nsnull;
 
         // If we have traveled more than SWIPE_MIN_DISTANCE from the start
         // point, stop the pinch gesture and fire a swipe event.
         if (mStartPoint) {
             double swipeDistance = getDistance(midPoint, *mStartPoint);
-            if (swipeDistance > SWIPE_MIN_DISTANCE) {
+            if (swipeDistance > mSwipeMinDistance) {
                 PRUint32 direction = 0;
                 nsIntPoint motion = midPoint - *mStartPoint;
 
diff --git a/widget/src/android/nsWindow.h b/widget/src/android/nsWindow.h
index a3cbb1200813..a9860394d575 100644
--- a/widget/src/android/nsWindow.h
+++ b/widget/src/android/nsWindow.h
@@ -186,6 +186,10 @@ protected:
     double mLastDist;
     nsAutoPtr<nsIntPoint> mStartPoint;
 
+    // Multitouch swipe thresholds in screen pixels
+    double mSwipeMaxPinchDelta;
+    double mSwipeMinDistance;
+
     nsCOMPtr<nsIdleService> mIdleService;
 
     PRUint32 mIMEEnabled;
diff --git a/widget/src/cocoa/nsChildView.mm b/widget/src/cocoa/nsChildView.mm
index c3fabdae5c3a..6d3b25848751 100644
--- a/widget/src/cocoa/nsChildView.mm
+++ b/widget/src/cocoa/nsChildView.mm
@@ -2647,6 +2647,9 @@ NSEvent* gLastDragMouseDownEvent = nil;
 
 - (void)drawRect:(NSRect)aRect inTitlebarContext:(CGContextRef)aContext
 {
+  if (!mGeckoChild)
+    return;
+
   // Title bar drawing only works if we really draw into aContext, which only
   // the basic layer manager will do.
   nsBaseWidget::AutoUseBasicLayerManager setupLayerManager(mGeckoChild);
diff --git a/widget/src/cocoa/nsClipboard.h b/widget/src/cocoa/nsClipboard.h
index c812049a0c8f..298d5d2fd650 100644
--- a/widget/src/cocoa/nsClipboard.h
+++ b/widget/src/cocoa/nsClipboard.h
@@ -59,7 +59,7 @@ public:
 
   // Helper methods, used also by nsDragService
   static NSDictionary* PasteboardDictFromTransferable(nsITransferable *aTransferable);
-  static PRBool IsStringType(const nsCString& aMIMEType, const NSString** aPasteboardType);
+  static PRBool IsStringType(const nsCString& aMIMEType, NSString** aPasteboardType);
   static NSString* WrapHtmlForSystemPasteboard(NSString* aString);
   static nsresult TransferableFromPasteboard(nsITransferable *aTransferable, NSPasteboard *pboard);
 
diff --git a/widget/src/cocoa/nsClipboard.mm b/widget/src/cocoa/nsClipboard.mm
index 9d08152a4cae..a6c9e1cc63da 100644
--- a/widget/src/cocoa/nsClipboard.mm
+++ b/widget/src/cocoa/nsClipboard.mm
@@ -159,7 +159,7 @@ nsClipboard::TransferableFromPasteboard(nsITransferable *aTransferable, NSPasteb
 
     // printf("looking for clipboard data of type %s\n", flavorStr.get());
 
-    const NSString *pboardType;
+    NSString *pboardType = nil;
     if (nsClipboard::IsStringType(flavorStr, &pboardType)) {
       NSString* pString = [cocoaPasteboard stringForType:pboardType];
       if (!pString)
@@ -359,7 +359,7 @@ nsClipboard::HasDataMatchingFlavors(const char** aFlavorList, PRUint32 aLength,
 
   for (PRUint32 i = 0; i < aLength; i++) {
     nsDependentCString mimeType(aFlavorList[i]);
-    const NSString *pboardType;
+    NSString *pboardType = nil;
 
     if (nsClipboard::IsStringType(mimeType, &pboardType)) {
       NSString* availableType = [generalPBoard availableTypeFromArray:[NSArray arrayWithObject:pboardType]];
@@ -416,7 +416,7 @@ nsClipboard::PasteboardDictFromTransferable(nsITransferable* aTransferable)
 
     PR_LOG(sCocoaLog, PR_LOG_ALWAYS, ("writing out clipboard data of type %s (%d)\n", flavorStr.get(), i));
 
-    const NSString *pboardType;
+    NSString *pboardType = nil;
 
     if (nsClipboard::IsStringType(flavorStr, &pboardType)) {
       void* data = nsnull;
@@ -537,7 +537,7 @@ nsClipboard::PasteboardDictFromTransferable(nsITransferable* aTransferable)
   NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
 }
 
-PRBool nsClipboard::IsStringType(const nsCString& aMIMEType, const NSString** aPasteboardType)
+PRBool nsClipboard::IsStringType(const nsCString& aMIMEType, NSString** aPasteboardType)
 {
   if (aMIMEType.EqualsLiteral(kUnicodeMime) ||
       aMIMEType.EqualsLiteral(kHTMLMime)) {
diff --git a/widget/src/cocoa/nsCocoaWindow.h b/widget/src/cocoa/nsCocoaWindow.h
index d95b12e1a9a0..b9673af41b7e 100644
--- a/widget/src/cocoa/nsCocoaWindow.h
+++ b/widget/src/cocoa/nsCocoaWindow.h
@@ -135,7 +135,11 @@ typedef struct _nsCocoaWindowList {
 
 @end
 
+#if defined( MAC_OS_X_VERSION_10_6 ) && ( MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 )
+@interface WindowDelegate : NSObject <NSWindowDelegate>
+#else
 @interface WindowDelegate : NSObject
+#endif
 {
   nsCocoaWindow* mGeckoWindow; // [WEAK] (we are owned by the window)
   // Used to avoid duplication when we send NS_ACTIVATE and
diff --git a/widget/src/cocoa/nsCocoaWindow.mm b/widget/src/cocoa/nsCocoaWindow.mm
index 48daa647f588..0b1fd44688af 100644
--- a/widget/src/cocoa/nsCocoaWindow.mm
+++ b/widget/src/cocoa/nsCocoaWindow.mm
@@ -2282,8 +2282,9 @@ static const NSString* kStateShowsToolbarButton = @"showsToolbarButton";
 {
   BOOL stateChanged = ([self drawsContentsIntoWindowFrame] != aState);
   [super setDrawsContentsIntoWindowFrame:aState];
-  if (stateChanged) {
-    nsCocoaWindow *geckoWindow = [[self delegate] geckoWidget];
+  if (stateChanged && [[self delegate] isKindOfClass:[WindowDelegate class]]) {
+    WindowDelegate *windowDelegate = (WindowDelegate *)[self delegate];
+    nsCocoaWindow *geckoWindow = [windowDelegate geckoWidget];
     if (geckoWindow) {
       // Re-layout our contents.
       geckoWindow->ReportSizeEvent();
@@ -2306,13 +2307,16 @@ static const NSString* kStateShowsToolbarButton = @"showsToolbarButton";
 
   RollUpPopups();
 
-  nsCocoaWindow *geckoWindow = [[self delegate] geckoWidget];
-  if (!geckoWindow)
-    return;
-  nsEventStatus status = nsEventStatus_eIgnore;
-  nsGUIEvent guiEvent(PR_TRUE, NS_OS_TOOLBAR, geckoWindow);
-  guiEvent.time = PR_IntervalNow();
-  geckoWindow->DispatchEvent(&guiEvent, status);
+  if ([[self delegate] isKindOfClass:[WindowDelegate class]]) {
+    WindowDelegate *windowDelegate = (WindowDelegate *)[self delegate];
+    nsCocoaWindow *geckoWindow = [windowDelegate geckoWidget];
+    if (!geckoWindow)
+      return;
+    nsEventStatus status = nsEventStatus_eIgnore;
+    nsGUIEvent guiEvent(PR_TRUE, NS_OS_TOOLBAR, geckoWindow);
+    guiEvent.time = PR_IntervalNow();
+    geckoWindow->DispatchEvent(&guiEvent, status);
+  }
 
   NS_OBJC_END_TRY_ABORT_BLOCK;
 }
diff --git a/widget/src/cocoa/nsDragService.mm b/widget/src/cocoa/nsDragService.mm
index d78889d4cb95..9709ed5ed057 100644
--- a/widget/src/cocoa/nsDragService.mm
+++ b/widget/src/cocoa/nsDragService.mm
@@ -412,7 +412,7 @@ nsDragService::GetData(nsITransferable* aTransferable, PRUint32 aItemIndex)
       break;
     }
 
-    const NSString *pboardType = NSStringPboardType;
+    NSString *pboardType = NSStringPboardType;
 
     if (nsClipboard::IsStringType(flavorStr, &pboardType) ||
         flavorStr.EqualsLiteral(kURLMime) ||
@@ -514,7 +514,7 @@ nsDragService::IsDataFlavorSupported(const char *aDataFlavor, PRBool *_retval)
     }
   }
 
-  const NSString *pboardType;
+  NSString *pboardType = nil;
 
   if (dataFlavor.EqualsLiteral(kFileMime)) {
     NSString* availableType = [globalDragPboard availableTypeFromArray:[NSArray arrayWithObject:NSFilenamesPboardType]];
diff --git a/widget/src/gtk2/nsFilePicker.cpp b/widget/src/gtk2/nsFilePicker.cpp
index 897eeeb77154..f70b617a1bb2 100644
--- a/widget/src/gtk2/nsFilePicker.cpp
+++ b/widget/src/gtk2/nsFilePicker.cpp
@@ -194,6 +194,7 @@ NS_IMPL_ISUPPORTS1(nsFilePicker, nsIFilePicker)
 
 nsFilePicker::nsFilePicker()
   : mMode(nsIFilePicker::modeOpen),
+    mAllowURLs(PR_FALSE),
     mSelectedType(0)
 {
 }
diff --git a/widget/src/gtk2/nsGtkIMModule.cpp b/widget/src/gtk2/nsGtkIMModule.cpp
index d88a76f4c6f6..f0f2d4a1ab91 100644
--- a/widget/src/gtk2/nsGtkIMModule.cpp
+++ b/widget/src/gtk2/nsGtkIMModule.cpp
@@ -599,7 +599,7 @@ nsGtkIMModule::SetIMEEnabled(nsWindow* aCaller, PRUint32 aState)
         gdk_window_get_size(aCaller->GetGdkWindow(), &w, &h);
         rectBuf.Assign(NS_LITERAL_STRING("{\"left\": "));
         rectBuf.AppendInt(x);
-        rectBuf.Append(NS_LITERAL_STRING(" \"top\": "));
+        rectBuf.Append(NS_LITERAL_STRING(", \"top\": "));
         rectBuf.AppendInt(y);
         rectBuf.Append(NS_LITERAL_STRING(", \"right\": "));
         rectBuf.AppendInt(w);
diff --git a/widget/src/gtk2/nsWindow.cpp b/widget/src/gtk2/nsWindow.cpp
index bdffbc01806e..ba696fd98775 100644
--- a/widget/src/gtk2/nsWindow.cpp
+++ b/widget/src/gtk2/nsWindow.cpp
@@ -825,6 +825,29 @@ nsWindow::GetParent(void)
 float
 nsWindow::GetDPI()
 {
+
+#ifdef MOZ_PLATFORM_MAEMO
+    static float sDPI = 0;
+
+    if (!sDPI) {
+        // X on Maemo does not report true DPI: https://bugs.maemo.org/show_bug.cgi?id=4825
+        nsCOMPtr<nsIPropertyBag2> infoService = do_GetService("@mozilla.org/system-info;1");
+        NS_ASSERTION(infoService, "Could not find a system info service");
+
+        nsCString deviceType;
+        infoService->GetPropertyAsACString(NS_LITERAL_STRING("device"), deviceType);
+        if (deviceType.EqualsLiteral("Nokia N900")) {
+            sDPI = 265.0f;
+        } else if (deviceType.EqualsLiteral("Nokia N8xx")) {
+            sDPI = 225.0f;
+        } else {
+            // Fall back to something sane.
+            NS_WARNING("Unknown device - using default DPI");
+            sDPI = 96.0f;
+        }
+    }
+    return sDPI;
+#else
     Display *dpy = GDK_DISPLAY();
     int defaultScreen = DefaultScreen(dpy);
     double heightInches = DisplayHeightMM(dpy, defaultScreen)/MM_PER_INCH_FLOAT;
@@ -833,6 +856,7 @@ nsWindow::GetDPI()
         return 96.0f;
     }
     return float(DisplayHeight(dpy, defaultScreen)/heightInches);
+#endif
 }
 
 NS_IMETHODIMP
diff --git a/widget/src/qt/mozqwidget.cpp b/widget/src/qt/mozqwidget.cpp
index b66959cab89d..1956ffe8b527 100644
--- a/widget/src/qt/mozqwidget.cpp
+++ b/widget/src/qt/mozqwidget.cpp
@@ -238,6 +238,12 @@ bool MozQWidget::event ( QEvent * event )
         mReceiver->OnGestureEvent(static_cast<QGestureEvent*>(event),handled);
         return handled;
     }
+    case QEvent::InputMethod:
+    {
+        PRBool handled = PR_FALSE;
+        mReceiver->imComposeEvent(static_cast<QInputMethodEvent*>(event),handled);
+        return handled;
+    }
 
     default:
         break;
diff --git a/widget/src/qt/nsWindow.cpp b/widget/src/qt/nsWindow.cpp
index f24b084667f2..364b891d4a30 100644
--- a/widget/src/qt/nsWindow.cpp
+++ b/widget/src/qt/nsWindow.cpp
@@ -2659,20 +2659,18 @@ nsWindow::contextMenuEvent(QGraphicsSceneContextMenuEvent *)
 }
 
 nsEventStatus
-nsWindow::imStartEvent(QEvent *)
+nsWindow::imComposeEvent(QInputMethodEvent *event, PRBool &handled)
 {
-    return nsEventStatus_eIgnore;
-}
+    nsCompositionEvent start(PR_TRUE, NS_COMPOSITION_START, this);
+    DispatchEvent(&start);
 
-nsEventStatus
-nsWindow::imComposeEvent(QEvent *)
-{
-    return nsEventStatus_eIgnore;
-}
+    nsTextEvent text(PR_TRUE, NS_TEXT_TEXT, this);
+    text.theText.Assign(event->commitString().utf16());
+    DispatchEvent(&text);
+
+    nsCompositionEvent end(PR_TRUE, NS_COMPOSITION_END, this);
+    DispatchEvent(&end);
 
-nsEventStatus
-nsWindow::imEndEvent(QEvent * )
-{
     return nsEventStatus_eIgnore;
 }
 
diff --git a/widget/src/qt/nsWindow.h b/widget/src/qt/nsWindow.h
index 9cddee5807b0..06189f2f9790 100644
--- a/widget/src/qt/nsWindow.h
+++ b/widget/src/qt/nsWindow.h
@@ -277,9 +277,7 @@ protected:
     virtual nsEventStatus OnScrollEvent(QGraphicsSceneWheelEvent *);
 
     virtual nsEventStatus contextMenuEvent(QGraphicsSceneContextMenuEvent *);
-    virtual nsEventStatus imStartEvent(QEvent *);
-    virtual nsEventStatus imComposeEvent(QEvent *);
-    virtual nsEventStatus imEndEvent(QEvent *);
+    virtual nsEventStatus imComposeEvent(QInputMethodEvent *, PRBool &handled);
     virtual nsEventStatus OnDragEnter (QGraphicsSceneDragDropEvent *);
     virtual nsEventStatus OnDragMotionEvent(QGraphicsSceneDragDropEvent *);
     virtual nsEventStatus OnDragLeaveEvent(QGraphicsSceneDragDropEvent *);
diff --git a/widget/src/windows/nsUXThemeData.cpp b/widget/src/windows/nsUXThemeData.cpp
index 521101f4366d..99650888d991 100644
--- a/widget/src/windows/nsUXThemeData.cpp
+++ b/widget/src/windows/nsUXThemeData.cpp
@@ -146,7 +146,7 @@ nsUXThemeData::Initialize()
     dwmSetWindowAttributePtr = (DwmSetWindowAttributeProc)::GetProcAddress(sDwmDLL, "DwmSetWindowAttribute");
     dwmInvalidateIconicBitmapsPtr = (DwmInvalidateIconicBitmapsProc)::GetProcAddress(sDwmDLL, "DwmInvalidateIconicBitmaps");
     dwmDwmDefWindowProcPtr = (DwmDefWindowProcProc)::GetProcAddress(sDwmDLL, "DwmDefWindowProc");
-    CheckForCompositor();
+    CheckForCompositor(PR_TRUE);
   }
 #endif
 
diff --git a/widget/src/windows/nsUXThemeData.h b/widget/src/windows/nsUXThemeData.h
index de10512ccdf6..b021e7a02d6b 100644
--- a/widget/src/windows/nsUXThemeData.h
+++ b/widget/src/windows/nsUXThemeData.h
@@ -232,13 +232,20 @@ public:
   static DwmDefWindowProcProc dwmDwmDefWindowProcPtr;
 #endif // MOZ_WINSDK_TARGETVER >= MOZ_NTDDI_LONGHORN
 
-  static PRBool CheckForCompositor() {
-    BOOL compositionIsEnabled = FALSE;
+  // This method returns the cached compositor state. Most
+  // callers should call without the argument. The cache
+  // should be modified only when the application receives
+  // WM_DWMCOMPOSITIONCHANGED. This rule prevents inconsistent
+  // results for two or more calls which check the state during
+  // composition transition.
+  static PRBool CheckForCompositor(PRBool aUpdateCache = PR_FALSE) {
+    static BOOL sCachedValue = FALSE;
 #if MOZ_WINSDK_TARGETVER >= MOZ_NTDDI_LONGHORN
-    if(dwmIsCompositionEnabledPtr)
-      dwmIsCompositionEnabledPtr(&compositionIsEnabled);
+    if(aUpdateCache && dwmIsCompositionEnabledPtr) {
+      dwmIsCompositionEnabledPtr(&sCachedValue);
+    }
 #endif // MOZ_WINSDK_TARGETVER >= MOZ_NTDDI_LONGHORN
-    return (compositionIsEnabled != FALSE);
+    return (sCachedValue != FALSE);
   }
 };
 #endif // __UXThemeData_h__
diff --git a/widget/src/windows/nsWindow.cpp b/widget/src/windows/nsWindow.cpp
index cb5bd30255e7..55f3e9849b8c 100644
--- a/widget/src/windows/nsWindow.cpp
+++ b/widget/src/windows/nsWindow.cpp
@@ -3171,6 +3171,22 @@ nsWindow::GetLayerManager(bool* aAllowRetaining)
   }
 
 #ifndef WINCE
+#ifdef MOZ_ENABLE_D3D10_LAYER
+  if (mLayerManager) {
+    if (mLayerManager->GetBackendType() ==
+        mozilla::layers::LayerManager::LAYERS_D3D10)
+    {
+      mozilla::layers::LayerManagerD3D10 *layerManagerD3D10 =
+        static_cast<mozilla::layers::LayerManagerD3D10*>(mLayerManager.get());
+      if (layerManagerD3D10->device() !=
+          gfxWindowsPlatform::GetPlatform()->GetD3D10Device())
+      {
+        mLayerManager = nsnull;
+      }
+    }
+  }
+#endif
+
   if (!mLayerManager) {
     nsCOMPtr<nsIPrefBranch2> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID);
 
@@ -5299,6 +5315,10 @@ PRBool nsWindow::ProcessMessage(UINT msg, WPARAM &wParam, LPARAM &lParam,
 #ifndef WINCE
 #if MOZ_WINSDK_TARGETVER >= MOZ_NTDDI_LONGHORN
   case WM_DWMCOMPOSITIONCHANGED:
+    // First, update the compositor state to latest one. All other methods
+    // should use same state as here for consistency painting.
+    nsUXThemeData::CheckForCompositor(PR_TRUE);
+
     UpdateNonClientMargins();
     RemovePropW(mWnd, kManageWindowInfoProperty);
     BroadcastMsg(mWnd, WM_DWMCOMPOSITIONCHANGED);
diff --git a/widget/src/windows/nsWindowGfx.cpp b/widget/src/windows/nsWindowGfx.cpp
index c49b10a6b2f1..4fcebf883cc7 100644
--- a/widget/src/windows/nsWindowGfx.cpp
+++ b/widget/src/windows/nsWindowGfx.cpp
@@ -732,7 +732,6 @@ DDRAW_FAILED:
           gfxWindowsPlatform::GetPlatform()->UpdateRenderMode();
           LayerManagerD3D10 *layerManagerD3D10 = static_cast<mozilla::layers::LayerManagerD3D10*>(GetLayerManager());
           if (layerManagerD3D10->device() != gfxWindowsPlatform::GetPlatform()->GetD3D10Device()) {
-            mLayerManager = nsnull;
             Invalidate(PR_FALSE);
           } else {
             result = DispatchWindowEvent(&event, eventStatus);
diff --git a/xpcom/base/nsMemoryReporterManager.cpp b/xpcom/base/nsMemoryReporterManager.cpp
index 72d72c099f89..03694bdfbe35 100644
--- a/xpcom/base/nsMemoryReporterManager.cpp
+++ b/xpcom/base/nsMemoryReporterManager.cpp
@@ -59,10 +59,6 @@
 // with it.  So if we tried to use jemalloc_stats directly here, it
 // wouldn't be defined.  Instead, we don't include the jemalloc header
 // and weakly link against jemalloc_stats.
-//
-// NB: we don't null-check this symbol at runtime because we expect it
-// to have been resolved.  If it hasn't, the crash jumping to NULL
-// will indicate the bug.
 extern "C" {
 extern void jemalloc_stats(jemalloc_stats_t* stats)
   NS_VISIBILITY_DEFAULT __attribute__((weak));
@@ -219,6 +215,10 @@ NS_IMPL_ISUPPORTS1(nsMemoryReporterManager, nsIMemoryReporterManager)
 NS_IMETHODIMP
 nsMemoryReporterManager::Init()
 {
+#if HAVE_JEMALLOC_STATS && defined(XP_LINUX)
+    if (!jemalloc_stats)
+        return NS_ERROR_FAILURE;
+#endif
     /*
      * Register our core reporters
      */
diff --git a/xpcom/base/nsSystemInfo.cpp b/xpcom/base/nsSystemInfo.cpp
index 6a40b44be32d..028d941fa37a 100644
--- a/xpcom/base/nsSystemInfo.cpp
+++ b/xpcom/base/nsSystemInfo.cpp
@@ -96,7 +96,7 @@ nsSystemInfo::Init()
     // This must be done here because NSPR can only separate OS's when compiled, not libraries.
     char* gtkver = PR_smprintf("GTK %u.%u.%u", gtk_major_version, gtk_minor_version, gtk_micro_version);
     if (gtkver) {
-      rv = SetPropertyAsACString(NS_ConvertASCIItoUTF16("secondaryLibrary"),
+      rv = SetPropertyAsACString(NS_LITERAL_STRING("secondaryLibrary"),
                                  nsDependentCString(gtkver));
       PR_smprintf_free(gtkver);
       NS_ENSURE_SUCCESS(rv, rv);
@@ -113,12 +113,17 @@ nsSystemInfo::Init()
       while ((read = getline(&line, &len, fp)) != -1) {
         if (line) {
           if (strstr(line, "RX-51")) {
-            SetPropertyAsACString(NS_ConvertASCIItoUTF16("device"), NS_LITERAL_CSTRING("Nokia N900"));
+            SetPropertyAsACString(NS_LITERAL_STRING("device"), NS_LITERAL_CSTRING("Nokia N900"));
+            SetPropertyAsACString(NS_LITERAL_STRING("manufacturer"), NS_LITERAL_CSTRING("Nokia"));
+            SetPropertyAsACString(NS_LITERAL_STRING("hardware"), NS_LITERAL_CSTRING("RX-51"));
             break;
           } else if (strstr(line, "RX-44") ||
                      strstr(line, "RX-48") ||
                      strstr(line, "RX-32") ) {
-            SetPropertyAsACString(NS_ConvertASCIItoUTF16("device"), NS_LITERAL_CSTRING("Nokia N8xx"));
+            /* not as accurate as we can be, but these devices are deprecated */
+            SetPropertyAsACString(NS_LITERAL_STRING("device"), NS_LITERAL_CSTRING("Nokia N8xx"));
+            SetPropertyAsACString(NS_LITERAL_STRING("manufacturer"), NS_LITERAL_CSTRING("Nokia"));
+            SetPropertyAsACString(NS_LITERAL_STRING("hardware"), NS_LITERAL_CSTRING("N8xx"));
             break;
           }
         }
@@ -134,6 +139,10 @@ nsSystemInfo::Init()
         nsAutoString str;
         if (mozilla::AndroidBridge::Bridge()->GetStaticStringField("android/os/Build", "MODEL", str))
             SetPropertyAsAString(NS_LITERAL_STRING("device"), str);
+        if (mozilla::AndroidBridge::Bridge()->GetStaticStringField("android/os/Build", "MANUFACTURER", str))
+            SetPropertyAsAString(NS_LITERAL_STRING("manufacturer"), str);
+        if (mozilla::AndroidBridge::Bridge()->GetStaticStringField("android/os/Build", "HARDWARE", str))
+            SetPropertyAsAString(NS_LITERAL_STRING("hardware"), str);
     }
 #endif
     return NS_OK;
diff --git a/xpcom/glue/IntentionalCrash.h b/xpcom/glue/IntentionalCrash.h
new file mode 100644
index 000000000000..d2768a63a6ef
--- /dev/null
+++ b/xpcom/glue/IntentionalCrash.h
@@ -0,0 +1,49 @@
+#include <string>
+#include <sstream>
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifdef XP_WIN
+#include <process.h>
+#define getpid _getpid
+#else
+#include <unistd.h>
+#endif
+
+#ifndef mozilla_IntentionalCrash_h
+#define mozilla_IntentionalCrash_h
+
+namespace mozilla {
+
+inline void
+NoteIntentionalCrash(const char* processType)
+{
+  char* f = getenv("XPCOM_MEM_BLOAT_LOG");
+  fprintf(stderr, "XPCOM_MEM_BLOAT_LOG: %s\n", f);
+  if (!f)
+    return;
+
+  std::string bloatLog(f);
+  
+  bool hasExt = false;
+  if (bloatLog.size() >= 4 &&
+      0 == bloatLog.compare(bloatLog.size() - 4, 4, ".log", 4)) {
+    hasExt = true;
+    bloatLog.erase(bloatLog.size() - 4, 4);
+  }
+
+  std::ostringstream bloatName;
+  bloatName << bloatLog << "_" << processType << "_pid" << getpid();
+  if (hasExt)
+    bloatName << ".log";
+
+  fprintf(stderr, "Writing to log: %s\n", bloatName.str().c_str());
+
+  FILE* processfd = fopen(bloatName.str().c_str(), "a");
+  fprintf(processfd, "==> process %d will purposefully crash\n", getpid());
+  fclose(processfd);
+}
+
+} // namespace mozilla
+
+#endif // mozilla_IntentionalCrash_h
diff --git a/xpcom/glue/Makefile.in b/xpcom/glue/Makefile.in
index 4eb723388777..37687125d75e 100644
--- a/xpcom/glue/Makefile.in
+++ b/xpcom/glue/Makefile.in
@@ -129,12 +129,13 @@ EXPORTS_mozilla = \
   BlockingResourceBase.h \
   CondVar.h \
   DeadlockDetector.h \
+  FileUtils.h \
   GenericFactory.h \
+  IntentionalCrash.h \
   Monitor.h \
   Mutex.h \
   SSE.h \
   unused.h \
-  FileUtils.h \
   $(NULL)
 
 EXPORTS_mozilla/threads = \
diff --git a/xpcom/glue/nsTArray.h b/xpcom/glue/nsTArray.h
index 158a0eae4a3d..07323974aeab 100644
--- a/xpcom/glue/nsTArray.h
+++ b/xpcom/glue/nsTArray.h
@@ -525,7 +525,7 @@ public:
     const elem_type* iter = Elements() + start, *end = Elements() + Length();
     for (; iter != end; ++iter) {
       if (comp.Equals(*iter, item))
-        return iter - Elements();
+        return index_type(iter - Elements());
     }
     return NoIndex;
   }
diff --git a/xpcom/threads/nsIThreadInternal.idl b/xpcom/threads/nsIThreadInternal.idl
index 577aceab24a3..560fa7c7f2f3 100644
--- a/xpcom/threads/nsIThreadInternal.idl
+++ b/xpcom/threads/nsIThreadInternal.idl
@@ -102,6 +102,10 @@ interface nsIThreadInternal : nsIThread
  * 
  * NOTE: It is valid to change the thread's observer during a call to an
  *       observer method.
+ *
+ * NOTE: Will be split into two interfaces soon: one for onProcessNextEvent and
+ *       afterProcessNextEvent, then another that inherits the first and adds
+ *       onDispatchedEvent.
  */
 [scriptable, uuid(81D0B509-F198-4417-8020-08EB4271491F)]
 interface nsIThreadObserver : nsISupports
@@ -166,12 +170,28 @@ interface nsIThreadEventFilter : nsISupports
 /**
  * Temporary interface, will be merged into nsIThreadInternal.
  */
-[scriptable, uuid(718e9346-74cb-4859-8bcc-c9ec37bfb668)]
+[scriptable, uuid(4531f101-fddc-4d36-80e7-35260a2f3afe)]
 interface nsIThreadInternal2 : nsIThreadInternal
 {
   /**
    * The current recursion depth, 0 when no events are running, 1 when a single
-   * event is running, and higher when nested events are running.
+   * event is running, and higher when nested events are running. Must only be
+   * called on the target thread.
    */
   readonly attribute unsigned long recursionDepth;
+
+  /**
+   * Add an observer that will *only* receive onProcessNextEvent and
+   * afterProcessNextEvent callbacks. Always called on the target thread, and
+   * the implementation does not have to be threadsafe. Order of callbacks is
+   * not guaranteed (i.e. afterProcessNextEvent may be called first depending on
+   * whether or not the observer is added in a nested loop). Holds a strong ref.
+   */
+  void addObserver(in nsIThreadObserver observer);
+
+  /**
+   * Remove an observer added via the addObserver call. Once removed the
+   * observer will never be called again by the thread.
+   */
+  void removeObserver(in nsIThreadObserver observer);
 };
diff --git a/xpcom/threads/nsThread.cpp b/xpcom/threads/nsThread.cpp
index f45b8350daa4..a2a95282ecce 100644
--- a/xpcom/threads/nsThread.cpp
+++ b/xpcom/threads/nsThread.cpp
@@ -426,7 +426,7 @@ nsThread::Dispatch(nsIRunnable *event, PRUint32 flags)
 
     while (wrapper->IsPending())
       NS_ProcessNextEvent(thread);
-    return rv;
+    return wrapper->Result();
   }
 
   NS_ASSERTION(flags == NS_DISPATCH_NORMAL, "unexpected dispatch flags");
@@ -560,6 +560,19 @@ void canary_alarm_handler (int signum)
 
 #endif
 
+#define NOTIFY_EVENT_OBSERVERS(func_, params_)                                 \
+  PR_BEGIN_MACRO                                                               \
+    if (!mEventObservers.IsEmpty()) {                                          \
+      nsAutoTObserverArray<nsCOMPtr<nsIThreadObserver>, 2>::ForwardIterator    \
+        iter_(mEventObservers);                                                \
+      nsCOMPtr<nsIThreadObserver> obs_;                                        \
+      while (iter_.HasMore()) {                                                \
+        obs_ = iter_.GetNext();                                                \
+        obs_ -> func_ params_ ;                                                \
+      }                                                                        \
+    }                                                                          \
+  PR_END_MACRO
+
 NS_IMETHODIMP
 nsThread::ProcessNextEvent(PRBool mayWait, PRBool *result)
 {
@@ -576,6 +589,9 @@ nsThread::ProcessNextEvent(PRBool mayWait, PRBool *result)
   if (obs)
     obs->OnProcessNextEvent(this, mayWait && !ShuttingDown(), mRunningEvent);
 
+  NOTIFY_EVENT_OBSERVERS(OnProcessNextEvent,
+                         (this, mayWait && !ShuttingDown(), mRunningEvent));
+
   ++mRunningEvent;
 
 #ifdef MOZ_CANARY
@@ -616,6 +632,9 @@ nsThread::ProcessNextEvent(PRBool mayWait, PRBool *result)
   }
 
   --mRunningEvent;
+
+  NOTIFY_EVENT_OBSERVERS(AfterProcessNextEvent, (this, mRunningEvent));
+
   if (obs)
     obs->AfterProcessNextEvent(this, mRunningEvent);
 
@@ -745,17 +764,48 @@ NS_IMETHODIMP
 nsThread::GetRecursionDepth(PRUint32 *depth)
 {
   NS_ENSURE_ARG_POINTER(depth);
+  NS_ENSURE_STATE(PR_GetCurrentThread() == mThread);
+
   *depth = mRunningEvent;
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsThread::AddObserver(nsIThreadObserver *observer)
+{
+  NS_ENSURE_ARG_POINTER(observer);
+  NS_ENSURE_STATE(PR_GetCurrentThread() == mThread);
+
+  NS_WARN_IF_FALSE(!mEventObservers.Contains(observer),
+                   "Adding an observer twice!");
+
+  if (!mEventObservers.AppendElement(observer)) {
+    NS_WARNING("Out of memory!");
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsThread::RemoveObserver(nsIThreadObserver *observer)
+{
+  NS_ENSURE_STATE(PR_GetCurrentThread() == mThread);
+
+  if (observer && !mEventObservers.RemoveElement(observer)) {
+    NS_WARNING("Removing an observer that was never added!");
+  }
+
+  return NS_OK;
+}
+
 //-----------------------------------------------------------------------------
 
 NS_IMETHODIMP
 nsThreadSyncDispatch::Run()
 {
   if (mSyncTask) {
-    mSyncTask->Run();
+    mResult = mSyncTask->Run();
     mSyncTask = nsnull;
     // unblock the origin thread
     mOrigin->Dispatch(this, NS_DISPATCH_NORMAL);
diff --git a/xpcom/threads/nsThread.h b/xpcom/threads/nsThread.h
index b932dc310751..2a435fdcb525 100644
--- a/xpcom/threads/nsThread.h
+++ b/xpcom/threads/nsThread.h
@@ -46,6 +46,7 @@
 #include "nsString.h"
 #include "nsAutoLock.h"
 #include "nsAutoPtr.h"
+#include "nsTObserverArray.h"
 
 // A native thread
 class nsThread : public nsIThreadInternal2, public nsISupportsPriority
@@ -134,6 +135,9 @@ private:
 
   nsCOMPtr<nsIThreadObserver> mObserver;
 
+  // Only accessed on the target thread.
+  nsAutoTObserverArray<nsCOMPtr<nsIThreadObserver>, 2> mEventObservers;
+
   nsChainedEventQueue *mEvents;   // never null
   nsChainedEventQueue  mEventsRoot;
 
@@ -154,18 +158,23 @@ private:
 class nsThreadSyncDispatch : public nsRunnable {
 public:
   nsThreadSyncDispatch(nsIThread *origin, nsIRunnable *task)
-    : mOrigin(origin), mSyncTask(task) {
+    : mOrigin(origin), mSyncTask(task), mResult(NS_ERROR_NOT_INITIALIZED) {
   }
 
   PRBool IsPending() {
     return mSyncTask != nsnull;
   }
 
+  nsresult Result() {
+    return mResult;
+  }
+
 private:
   NS_DECL_NSIRUNNABLE
 
   nsCOMPtr<nsIThread> mOrigin;
   nsCOMPtr<nsIRunnable> mSyncTask;
+  nsresult mResult;
 };
 
 #endif  // nsThread_h__