diff --git a/b2g/installer/package-manifest.in b/b2g/installer/package-manifest.in
index f5dc5cbf0347..a463c201dc7d 100644
--- a/b2g/installer/package-manifest.in
+++ b/b2g/installer/package-manifest.in
@@ -195,7 +195,6 @@
 @BINPATH@/components/dom_indexeddb.xpt
 @BINPATH@/components/dom_offline.xpt
 @BINPATH@/components/dom_payment.xpt
-@BINPATH@/components/dom_push.xpt
 @BINPATH@/components/dom_json.xpt
 @BINPATH@/components/dom_browserelement.xpt
 @BINPATH@/components/dom_messages.xpt
diff --git a/browser/app/blocklist.xml b/browser/app/blocklist.xml
index c28da7cd33c1..c9dc6eaeddab 100644
--- a/browser/app/blocklist.xml
+++ b/browser/app/blocklist.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0"?>
-<blocklist xmlns="http://www.mozilla.org/2006/addons-blocklist" lastupdate="1374187152000">
+<blocklist xmlns="http://www.mozilla.org/2006/addons-blocklist" lastupdate="1375219877000">
   <emItems>
       <emItem  blockID="i350" id="sqlmoz@facebook.com">
                         <versionRange  minVersion="0" maxVersion="*" severity="3">
@@ -135,6 +135,10 @@
                         <versionRange  minVersion="0" maxVersion="*" severity="1">
                     </versionRange>
                   </emItem>
+      <emItem  blockID="i429" id="{B40794A0-7477-4335-95C5-8CB9BBC5C4A5}">
+                        <versionRange  minVersion="0" maxVersion="*" severity="3">
+                    </versionRange>
+                  </emItem>
       <emItem  blockID="i11" id="yslow@yahoo-inc.com">
                         <versionRange  minVersion="2.0.5" maxVersion="2.0.5">
                       <targetApplication  id="{ec8030f7-c20a-464f-9b0e-13a3a9e97384}">
diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
index 091c4c5fa5c3..2a143c12d6a6 100644
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -335,6 +335,9 @@ pref("browser.download.manager.quitBehavior", 0);
 pref("browser.download.manager.scanWhenDone", true);
 pref("browser.download.manager.resumeOnWakeDelay", 10000);
 
+// Enables the asynchronous Downloads API in the Downloads Panel.
+pref("browser.download.useJSTransfer", false);
+
 // This allows disabling the Downloads Panel in favor of the old interface.
 pref("browser.download.useToolkitUI", false);
 
diff --git a/browser/base/content/browser-sets.inc b/browser/base/content/browser-sets.inc
index e17d5252e879..57d0356c0e4e 100644
--- a/browser/base/content/browser-sets.inc
+++ b/browser/base/content/browser-sets.inc
@@ -96,7 +96,7 @@
     <command id="Tools:DevToolbar" oncommand="DeveloperToolbar.toggle();" disabled="true" hidden="true"/>
     <command id="Tools:DevToolbarFocus" oncommand="DeveloperToolbar.focusToggle();" disabled="true"/>
     <command id="Tools:ChromeDebugger" oncommand="BrowserDebuggerProcess.init();" disabled="true" hidden="true"/>
-    <command id="Tools:BrowserConsole" oncommand="HUDConsoleUI.toggleBrowserConsole();"/>
+    <command id="Tools:BrowserConsole" oncommand="HUDService.toggleBrowserConsole();"/>
     <command id="Tools:Scratchpad" oncommand="Scratchpad.openScratchpad();" disabled="true" hidden="true"/>
     <command id="Tools:ResponsiveUI" oncommand="ResponsiveUI.toggle();" disabled="true" hidden="true"/>
     <command id="Tools:Addons" oncommand="BrowserOpenAddonsMgr();"/>
@@ -176,7 +176,8 @@
     <broadcaster id="devtoolsMenuBroadcaster_DevToolbox"
                  label="&devToolboxMenuItem.label;"
                  type="checkbox" autocheck="false"
-                 command="Tools:DevToolbox"/>
+                 command="Tools:DevToolbox"
+                 key="key_devToolboxMenuItem"/>
     <broadcaster id="devtoolsMenuBroadcaster_DevToolbar"
                  label="&devToolbarMenu.label;"
                  type="checkbox" autocheck="false"
@@ -261,6 +262,7 @@
     <key id="key_openDownloads" key="&downloads.commandkey;" command="Tools:Downloads" modifiers="accel"/>
 #endif
     <key id="key_openAddons" key="&addons.commandkey;" command="Tools:Addons" modifiers="accel,shift"/>
+    <key id="key_devToolboxMenuItemF12" keycode="&devToolsCmd.keycode;" keytext="&devToolsCmd.keytext;" command="Tools:DevToolbox"/>
     <key id="key_browserConsole" key="&browserConsoleCmd.commandkey;" command="Tools:BrowserConsole" modifiers="accel,shift"/>
     <key id="key_devToolbar" keycode="&devToolbar.keycode;" modifiers="shift"
          keytext="&devToolbar.keytext;" command="Tools:DevToolbarFocus"/>
@@ -271,6 +273,16 @@
         modifiers="accel,shift"
 #endif
     />
+
+    <key id="key_devToolboxMenuItem" keycode="&devToolboxMenuItem.keycode;"
+         keytext="&devToolboxMenuItem.keytext;" command="Tools:DevToolbox" key="&devToolboxMenuItem.keytext;"
+#ifdef XP_MACOSX
+        modifiers="accel,alt"
+#else
+        modifiers="accel,shift"
+#endif
+    />
+
     <key id="key_scratchpad" keycode="&scratchpad.keycode;" modifiers="shift"
          keytext="&scratchpad.keytext;" command="Tools:Scratchpad"/>
     <key id="openFileKb" key="&openFileCmd.commandkey;" command="Browser:OpenFile"  modifiers="accel"/>
diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index 0a1ed4177bdd..dd016964b1aa 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -1106,7 +1106,15 @@ var gBrowserInit = {
     // If the user manually opens the download manager before the timeout, the
     // downloads will start right away, and getting the service again won't hurt.
     setTimeout(function() {
-      Services.downloads;
+      let DownloadsCommon =
+        Cu.import("resource:///modules/DownloadsCommon.jsm", {}).DownloadsCommon;
+      if (DownloadsCommon.useJSTransfer) {
+        // Open the data link without initalizing nsIDownloadManager.
+        DownloadsCommon.initializeAllDataLinks();
+      } else {
+        // Initalizing nsIDownloadManager will trigger the data link.
+        Services.downloads;
+      }
       let DownloadTaskbarProgress =
         Cu.import("resource://gre/modules/DownloadTaskbarProgress.jsm", {}).DownloadTaskbarProgress;
       DownloadTaskbarProgress.onBrowserWindowLoad(window);
@@ -7153,8 +7161,13 @@ XPCOMUtils.defineLazyModuleGetter(this, "gDevTools",
 XPCOMUtils.defineLazyModuleGetter(this, "gDevToolsBrowser",
                                   "resource:///modules/devtools/gDevTools.jsm");
 
-XPCOMUtils.defineLazyGetter(this, "HUDConsoleUI", function () {
-  return Cu.import("resource:///modules/HUDService.jsm", {}).HUDService.consoleUI;
+Object.defineProperty(this, "HUDService", {
+  get: function HUDService_getter() {
+    let devtools = Cu.import("resource://gre/modules/devtools/Loader.jsm", {}).devtools;
+    return devtools.require("devtools/webconsole/hudservice");
+  },
+  configurable: true,
+  enumerable: true
 });
 
 // Prompt user to restart the browser in safe mode
diff --git a/browser/base/content/browser.xul b/browser/base/content/browser.xul
index 8aab2b82aa63..bd57a700f5a1 100644
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -1052,16 +1052,24 @@
     <hbox style="width: 100%;" pack="center"> <!-- Inner hbox needed due to bug 579776. -->
       <vbox id="full-screen-warning-message" align="center">
         <description id="full-screen-domain-text"/>
-        <description class="full-screen-description" value="&fullscreenExitHint.value;"/>
+        <description class="full-screen-description" value="&fullscreenExitHint2.value;"/>
         <vbox id="full-screen-approval-pane" align="center">
-          <description class="full-screen-description" value="&fullscreenApproval.value;"/>
           <hbox>
+#ifdef XP_UNIX
+            <button label="&fullscreenExitButton.label;"
+                    oncommand="FullScreen.setFullscreenAllowed(false);"
+                    class="full-screen-approval-button"/>
+            <button label="&fullscreenAllowButton.label;"
+                    oncommand="FullScreen.setFullscreenAllowed(true);"
+                    class="full-screen-approval-button"/>
+#else
             <button label="&fullscreenAllowButton.label;"
                     oncommand="FullScreen.setFullscreenAllowed(true);"
                     class="full-screen-approval-button"/>
             <button label="&fullscreenExitButton.label;"
                     oncommand="FullScreen.setFullscreenAllowed(false);"
                     class="full-screen-approval-button"/>
+#endif
           </hbox>
           <checkbox id="full-screen-remember-decision"/>
         </vbox>
diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 5642adfc6f56..75d9525ddd0a 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -9,6 +9,11 @@
 %tabBrowserDTD;
 ]>
 
+# MAKE_E10S_WORK surrounds code needed to have the front-end try to be smart
+# about using non-remote browsers for loading certain URIs when remote tabs
+# (browser.tabs.remote) are enabled.
+#define MAKE_E10S_WORK 1
+
 <bindings id="tabBrowserBindings"
           xmlns="http://www.mozilla.org/xbl"
           xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
@@ -1300,6 +1305,73 @@
         ]]></body>
       </method>
 
+#ifdef MAKE_E10S_WORK
+      <method name="_updateBrowserRemoteness">
+        <parameter name="aBrowser"/>
+        <parameter name="aRemote"/>
+        <body>
+          <![CDATA[
+            let isRemote = aBrowser.getAttribute("remote") == "true";
+            if (isRemote == aRemote)
+              return;
+
+            // Unhook our progress listener.
+            let tab = this._getTabForBrowser(aBrowser);
+            let index = tab._tPos;
+            let filter = this.mTabFilters[index];
+            aBrowser.webProgress.removeProgressListener(filter);
+
+            // Change the "remote" attribute.
+            let parent = aBrowser.parentNode;
+            parent.removeChild(aBrowser);
+            aBrowser.setAttribute("remote", aRemote ? "true" : "false");
+            parent.appendChild(aBrowser);
+
+            // Restore the progress listener.
+            aBrowser.webProgress.addProgressListener(filter, Ci.nsIWebProgress.NOTIFY_ALL);
+
+            if (aRemote)
+              tab.setAttribute("remote", "true");
+            else
+              tab.removeAttribute("remote");
+          ]]>
+        </body>
+      </method>
+
+      <!--
+        Returns true if we want to load the content for this URL in a
+        remote process. Eventually this should just check whether aURL
+        is unprivileged. Right now, though, we would like to load
+        some unprivileged URLs (like about:neterror) in the main
+        process since they interact with chrome code through
+        BrowserOnClick.
+      -->
+      <method name="_shouldBrowserBeRemote">
+        <parameter name="aURL"/>
+        <body>
+          <![CDATA[
+            if (!gMultiProcessBrowser)
+              return false;
+
+            // loadURI in browser.xml treats null as about:blank
+            if (!aURL)
+              aURL = "about:blank";
+
+            if (aURL.startsWith("about:") &&
+                aURL.toLowerCase() != "about:home" &&
+                aURL.toLowerCase() != "about:blank") {
+              return false;
+            }
+
+            if (aURL.startsWith("chrome:"))
+              return false;
+
+            return true;
+          ]]>
+        </body>
+      </method>
+#endif
+
       <method name="addTab">
         <parameter name="aURI"/>
         <parameter name="aReferrerURI"/>
@@ -1344,6 +1416,8 @@
 
             t.setAttribute("crop", "end");
             t.setAttribute("onerror", "this.removeAttribute('image');");
+            if (remote)
+              t.setAttribute("remote", "true");
             t.className = "tabbrowser-tab";
 
             this.tabContainer._unlockTabSizing();
@@ -1379,10 +1453,13 @@
             b.setAttribute("contextmenu", this.getAttribute("contentcontextmenu"));
             b.setAttribute("tooltip", this.getAttribute("contenttooltip"));
 
-            if (Services.prefs.getPrefType("browser.tabs.remote") == Services.prefs.PREF_BOOL &&
-                Services.prefs.getBoolPref("browser.tabs.remote")) {
+#ifdef MAKE_E10S_WORK
+            let remote = this._shouldBrowserBeRemote(aURI);
+#else
+            let remote = gMultiProcessBrowser;
+#endif
+            if (remote)
               b.setAttribute("remote", "true");
-            }
 
             if (window.gShowPageResizers && document.getElementById("addon-bar").collapsed &&
                 window.windowState == window.STATE_NORMAL) {
@@ -2554,7 +2631,17 @@
         <parameter name="aCharset"/>
         <body>
           <![CDATA[
+#ifdef MAKE_E10S_WORK
+            this._updateBrowserRemoteness(this.mCurrentBrowser, this._shouldBrowserBeRemote(aURI));
+            try {
+#endif
             return this.mCurrentBrowser.loadURI(aURI, aReferrerURI, aCharset);
+#ifdef MAKE_E10S_WORK
+            } catch (e) {
+              let url = this.mCurrentBrowser.currentURI.spec;
+              this._updateBrowserRemoteness(this.mCurrentBrowser, this._shouldBrowserBeRemote(url));
+            }
+#endif
           ]]>
         </body>
       </method>
@@ -2568,7 +2655,17 @@
         <parameter name="aPostData"/>
         <body>
           <![CDATA[
+#ifdef MAKE_E10S_WORK
+            this._updateBrowserRemoteness(this.mCurrentBrowser, this._shouldBrowserBeRemote(aURI));
+            try {
+#endif
             return this.mCurrentBrowser.loadURIWithFlags(aURI, aFlags, aReferrerURI, aCharset, aPostData);
+#ifdef MAKE_E10S_WORK
+            } catch (e) {
+              let url = this.mCurrentBrowser.currentURI.spec;
+              this._updateBrowserRemoteness(this.mCurrentBrowser, this._shouldBrowserBeRemote(url));
+            }
+#endif
           ]]>
         </body>
       </method>
@@ -2818,6 +2915,7 @@
             browserStack.removeChild(this.mCurrentBrowser);
             this.mCurrentBrowser.setAttribute("remote", true);
             browserStack.appendChild(this.mCurrentBrowser);
+            this.tabContainer.firstChild.setAttribute("remote", "true");
           }
 
           this.mCurrentTab = this.tabContainer.firstChild;
diff --git a/browser/components/downloads/src/DownloadsCommon.jsm b/browser/components/downloads/src/DownloadsCommon.jsm
index 2ceb4b0766af..992317704dd4 100644
--- a/browser/components/downloads/src/DownloadsCommon.jsm
+++ b/browser/components/downloads/src/DownloadsCommon.jsm
@@ -51,8 +51,12 @@ XPCOMUtils.defineLazyModuleGetter(this, "NetUtil",
                                   "resource://gre/modules/NetUtil.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "PluralForm",
                                   "resource://gre/modules/PluralForm.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "Downloads",
+                                  "resource://gre/modules/Downloads.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "DownloadUtils",
                                   "resource://gre/modules/DownloadUtils.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "OS",
+                                  "resource://gre/modules/osfile.jsm")
 XPCOMUtils.defineLazyModuleGetter(this, "PrivateBrowsingUtils",
                                   "resource://gre/modules/PrivateBrowsingUtils.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "RecentWindow",
@@ -582,6 +586,20 @@ XPCOMUtils.defineLazyGetter(DownloadsCommon, "isWinVistaOrHigher", function () {
   return parseFloat(sysInfo.getProperty("version")) >= 6;
 });
 
+/**
+ * Returns true if we should hook the panel to the JavaScript API for downloads
+ * instead of the nsIDownloadManager back-end.  In order for the logic to work
+ * properly, this value never changes during the execution of the application,
+ * even if the underlying preference value has changed.  A restart is required
+ * for the change to take effect.
+ */
+XPCOMUtils.defineLazyGetter(DownloadsCommon, "useJSTransfer", function () {
+  try {
+    return Services.prefs.getBoolPref("browser.download.useJSTransfer");
+  } catch (ex) { }
+  return false;
+});
+
 ////////////////////////////////////////////////////////////////////////////////
 //// DownloadsData
 
@@ -617,6 +635,11 @@ function DownloadsDataCtor(aPrivate) {
   // Array of view objects that should be notified when the available download
   // data changes.
   this._views = [];
+
+  if (DownloadsCommon.useJSTransfer) {
+    // Maps Download objects to DownloadDataItem objects.
+    this._downloadToDataItemMap = new Map();
+  }
 }
 
 DownloadsDataCtor.prototype = {
@@ -632,8 +655,15 @@ DownloadsDataCtor.prototype = {
   initializeDataLink: function DD_initializeDataLink(aDownloadManagerService)
   {
     // Start receiving real-time events.
-    aDownloadManagerService.addPrivacyAwareListener(this);
-    Services.obs.addObserver(this, "download-manager-remove-download-guid", false);
+    if (DownloadsCommon.useJSTransfer) {
+      let promiseList = this._isPrivate ? Downloads.getPrivateDownloadList()
+                                        : Downloads.getPublicDownloadList();
+      promiseList.then(list => list.addView(this)).then(null, Cu.reportError);
+    } else {
+      aDownloadManagerService.addPrivacyAwareListener(this);
+      Services.obs.addObserver(this, "download-manager-remove-download-guid",
+                               false);
+    }
   },
 
   /**
@@ -641,6 +671,11 @@ DownloadsDataCtor.prototype = {
    */
   terminateDataLink: function DD_terminateDataLink()
   {
+    if (DownloadsCommon.useJSTransfer) {
+      Cu.reportError("terminateDataLink not applicable with useJSTransfer");
+      return;
+    }
+
     this._terminateDataAccess();
 
     // Stop receiving real-time events.
@@ -648,6 +683,84 @@ DownloadsDataCtor.prototype = {
     Services.downloads.removeListener(this);
   },
 
+  //////////////////////////////////////////////////////////////////////////////
+  //// Integration with the asynchronous Downloads back-end
+
+  onDownloadAdded: function (aDownload)
+  {
+    let dataItem = new DownloadsDataItem(aDownload);
+    this._downloadToDataItemMap.set(aDownload, dataItem);
+    this.dataItems[dataItem.downloadGuid] = dataItem;
+
+    for (let view of this._views) {
+      view.onDataItemAdded(dataItem, true);
+    }
+
+    this._updateDataItemState(dataItem);
+  },
+
+  onDownloadChanged: function (aDownload)
+  {
+    let dataItem = this._downloadToDataItemMap.get(aDownload);
+    if (!dataItem) {
+      Cu.reportError("Download doesn't exist.");
+      return;
+    }
+
+    this._updateDataItemState(dataItem);
+  },
+
+  onDownloadRemoved: function (aDownload)
+  {
+    let dataItem = this._downloadToDataItemMap.get(aDownload);
+    if (!dataItem) {
+      Cu.reportError("Download doesn't exist.");
+      return;
+    }
+
+    this._downloadToDataItemMap.remove(aDownload);
+    this.dataItems[dataItem.downloadGuid] = null;
+    for (let view of this._views) {
+      view.onDataItemRemoved(dataItem);
+    }
+  },
+
+  /**
+   * Updates the given data item and sends related notifications.
+   */
+  _updateDataItemState: function (aDataItem)
+  {
+    let wasInProgress = aDataItem.inProgress;
+    let wasDone = aDataItem.done;
+
+    aDataItem.updateFromJSDownload();
+
+    if (wasInProgress && !aDataItem.inProgress) {
+      aDataItem.endTime = Date.now();
+    }
+
+    for (let view of this._views) {
+      try {
+        view.getViewItem(aDataItem).onStateChange({});
+      } catch (ex) {
+        Cu.reportError(ex);
+      }
+    }
+
+    if (!aDataItem.newDownloadNotified) {
+      aDataItem.newDownloadNotified = true;
+      this._notifyDownloadEvent("start");
+    }
+
+    if (!wasDone && aDataItem.done) {
+      this._notifyDownloadEvent("finish");
+    }
+
+    for (let view of this._views) {
+      view.getViewItem(aDataItem).onProgressChange();
+    }
+  },
+
   //////////////////////////////////////////////////////////////////////////////
   //// Registration of views
 
@@ -1160,11 +1273,14 @@ XPCOMUtils.defineLazyGetter(this, "DownloadsData", function() {
  *
  * @param aSource
  *        Object containing the data with which the item should be initialized.
- *        This should implement either nsIDownload or mozIStorageRow.
+ *        This should implement either nsIDownload or mozIStorageRow.  If the
+ *        JavaScript API for downloads is enabled, this is a Download object.
  */
 function DownloadsDataItem(aSource)
 {
-  if (aSource instanceof Ci.nsIDownload) {
+  if (DownloadsCommon.useJSTransfer) {
+    this._initFromJSDownload(aSource);
+  } else if (aSource instanceof Ci.nsIDownload) {
     this._initFromDownload(aSource);
   } else {
     this._initFromDataRow(aSource);
@@ -1172,6 +1288,66 @@ function DownloadsDataItem(aSource)
 }
 
 DownloadsDataItem.prototype = {
+  /**
+   * The JavaScript API does not need identifiers for Download objects, so they
+   * are generated sequentially for the corresponding DownloadDataItem.
+   */
+  get _autoIncrementId() ++DownloadsDataItem.prototype.__lastId,
+  __lastId: 0,
+
+  /**
+   * Initializes this object from the JavaScript API for downloads.
+   *
+   * The endTime property is initialized to the current date and time.
+   *
+   * @param aDownload
+   *        The Download object with the current state.
+   */
+  _initFromJSDownload: function (aDownload)
+  {
+    this._download = aDownload;
+
+    this.downloadGuid = "id:" + this._autoIncrementId;
+    this.file = aDownload.target.path;
+    this.target = OS.Path.basename(aDownload.target.path);
+    this.uri = aDownload.source.url;
+    this.endTime = Date.now();
+
+    this.updateFromJSDownload();
+  },
+
+  /**
+   * Updates this object from the JavaScript API for downloads.
+   */
+  updateFromJSDownload: function ()
+  {
+    // Collapse state using the correct priority.
+    if (this._download.succeeded) {
+      this.state = nsIDM.DOWNLOAD_FINISHED;
+    } else if (this._download.error &&
+               this._download.error.becauseBlockedByParentalControls) {
+      this.state = nsIDM.DOWNLOAD_BLOCKED_PARENTAL;
+    } else if (this._download.error) {
+      this.state = nsIDM.DOWNLOAD_FAILED;
+    } else if (this._download.canceled && this._download.hasPartialData) {
+      this.state = nsIDM.DOWNLOAD_PAUSED;
+    } else if (this._download.canceled) {
+      this.state = nsIDM.DOWNLOAD_CANCELED;
+    } else if (this._download.stopped) {
+      this.state = nsIDM.DOWNLOAD_NOTSTARTED;
+    } else {
+      this.state = nsIDM.DOWNLOAD_DOWNLOADING;
+    }
+
+    this.referrer = this._download.source.referrer;
+    this.startTime = this._download.startTime;
+    this.currBytes = this._download.currentBytes;
+    this.maxBytes = this._download.totalBytes;
+    this.resumable = this._download.hasPartialData;
+    this.speed = 0;
+    this.percentComplete = this._download.progress;
+  },
+
   /**
    * Initializes this object from a download object of the Download Manager.
    *
@@ -1408,6 +1584,11 @@ DownloadsDataItem.prototype = {
    * @throws if the file cannot be opened.
    */
   openLocalFile: function DDI_openLocalFile(aOwnerWindow) {
+    if (DownloadsCommon.useJSTransfer) {
+      this._download.launch().then(null, Cu.reportError);
+      return;
+    }
+
     this.getDownload(function(aDownload) {
       DownloadsCommon.openDownloadedFile(this.localFile,
                                          aDownload.MIMEInfo,
@@ -1427,6 +1608,15 @@ DownloadsDataItem.prototype = {
    * @throws if the download is not resumable or if has already done.
    */
   togglePauseResume: function DDI_togglePauseResume() {
+    if (DownloadsCommon.useJSTransfer) {
+      if (this._download.stopped) {
+        this._download.start();
+      } else {
+        this._download.cancel();
+      }
+      return;
+    }
+
     if (!this.inProgress || !this.resumable)
       throw new Error("The given download cannot be paused or resumed");
 
@@ -1445,8 +1635,13 @@ DownloadsDataItem.prototype = {
    * @throws if we cannot.
    */
   retry: function DDI_retry() {
+    if (DownloadsCommon.useJSTransfer) {
+      this._download.start();
+      return;
+    }
+
     if (!this.canRetry)
-      throw new Error("Cannot rerty this download");
+      throw new Error("Cannot retry this download");
 
     this.getDownload(function(aDownload) {
       aDownload.retry();
@@ -1473,6 +1668,12 @@ DownloadsDataItem.prototype = {
    * @throws if the download is already done.
    */
   cancel: function() {
+    if (DownloadsCommon.useJSTransfer) {
+      this._download.cancel();
+      this._download.removePartialData().then(null, Cu.reportError);
+      return;
+    }
+
     if (!this.inProgress)
       throw new Error("Cannot cancel this download");
 
@@ -1486,6 +1687,16 @@ DownloadsDataItem.prototype = {
    * Remove the download.
    */
   remove: function DDI_remove() {
+    if (DownloadsCommon.useJSTransfer) {
+      let promiseList = this._download.source.isPrivate
+                          ? Downloads.getPrivateDownloadList()
+                          : Downloads.getPublicDownloadList();
+      promiseList.then(list => list.remove(this._download))
+                 .then(() => this._download.finalize(true))
+                 .then(null, Cu.reportError);
+      return;
+    }
+
     this.getDownload(function (aDownload) {
       if (this.inProgress) {
         aDownload.cancel();
diff --git a/browser/components/downloads/src/DownloadsStartup.js b/browser/components/downloads/src/DownloadsStartup.js
index 5ed4a44e6a78..c46039d73956 100644
--- a/browser/components/downloads/src/DownloadsStartup.js
+++ b/browser/components/downloads/src/DownloadsStartup.js
@@ -86,10 +86,6 @@ DownloadsStartup.prototype = {
   {
     switch (aTopic) {
       case "profile-after-change":
-        kObservedTopics.forEach(
-          function (topic) Services.obs.addObserver(this, topic, true),
-          this);
-
         // Override Toolkit's nsIDownloadManagerUI implementation with our own.
         // This must be done at application startup and not in the manifest to
         // ensure that our implementation overrides the original one.
@@ -104,15 +100,21 @@ DownloadsStartup.prototype = {
         // when nsIDownloadManager will not be available anymore (bug 851471).
         let useJSTransfer = false;
         try {
+          // For performance reasons, we don't want to load the DownloadsCommon
+          // module during startup, so we read the preference value directly.
           useJSTransfer =
             Services.prefs.getBoolPref("browser.download.useJSTransfer");
-        } catch (ex) {
-          // This is a hidden preference that does not exist by default.
-        }
+        } catch (ex) { }
         if (useJSTransfer) {
           Components.manager.QueryInterface(Ci.nsIComponentRegistrar)
                             .registerFactory(kTransferCid, "",
                                              kTransferContractId, null);
+        } else {
+          // The other notifications are handled internally by the JavaScript
+          // API for downloads, no need to observe when that API is enabled.
+          for (let topic of kObservedTopics) {
+            Services.obs.addObserver(this, topic, true);
+          }
         }
         break;
 
diff --git a/browser/components/sessionstore/src/SessionStore.jsm b/browser/components/sessionstore/src/SessionStore.jsm
index 48285b1b3d09..1b56b56aad24 100644
--- a/browser/components/sessionstore/src/SessionStore.jsm
+++ b/browser/components/sessionstore/src/SessionStore.jsm
@@ -112,8 +112,6 @@ let gDocShellCapabilities = (function () {
   };
 })();
 
-XPCOMUtils.defineLazyModuleGetter(this, "NetUtil",
-  "resource://gre/modules/NetUtil.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "ScratchpadManager",
   "resource:///modules/devtools/scratchpad-manager.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "DocumentUtils",
@@ -349,16 +347,6 @@ let SessionStoreInternal = {
   // See bug 516755.
   _disabledForMultiProcess: false,
 
-  // The original "sessionstore.resume_session_once" preference value before it
-  // was modified by saveState.  saveState will set the
-  // "sessionstore.resume_session_once" to true when the
-  // the "sessionstore.resume_from_crash" preference is false (crash recovery
-  // is disabled) so that pinned tabs will be restored in the case of a
-  // crash.  This variable is used to restore the original value so the
-  // previous session is not always restored when
-  // "sessionstore.resume_from_crash" is true.
-  _resume_session_once_on_shutdown: null,
-
   /**
    * A promise fulfilled once initialization is complete.
    */
@@ -1057,15 +1045,6 @@ let SessionStoreInternal = {
       // browser is about to exit anyway.
       Services.obs.removeObserver(this, "browser:purge-session-history");
     }
-    else if (this._resume_session_once_on_shutdown != null) {
-      // if the sessionstore.resume_session_once preference was changed by
-      // saveState because crash recovery is disabled then restore the
-      // preference back to the value it was prior to that.  This will prevent
-      // SessionStore from always restoring the session when crash recovery is
-      // disabled.
-      this._prefBranch.setBoolPref("sessionstore.resume_session_once",
-                                   this._resume_session_once_on_shutdown);
-    }
 
     if (aData != "restart") {
       // Throw away the previous session on shutdown
@@ -1214,12 +1193,6 @@ let SessionStoreInternal = {
         break;
       case "sessionstore.resume_from_crash":
         this._resume_from_crash = this._prefBranch.getBoolPref("sessionstore.resume_from_crash");
-        // restore original resume_session_once preference if set in saveState
-        if (this._resume_session_once_on_shutdown != null) {
-          this._prefBranch.setBoolPref("sessionstore.resume_session_once",
-                                       this._resume_session_once_on_shutdown);
-          this._resume_session_once_on_shutdown = null;
-        }
         // either create the file with crash recovery information or remove it
         // (when _loadState is not STATE_RUNNING, that file is used for session resuming instead)
         if (!this._resume_from_crash)
@@ -3841,19 +3814,6 @@ let SessionStoreInternal = {
     }
 #endif
 
-    if (pinnedOnly) {
-      // Save original resume_session_once preference for when quiting browser,
-      // otherwise session will be restored next time browser starts and we
-      // only want it to be restored in the case of a crash.
-      if (this._resume_session_once_on_shutdown == null) {
-        this._resume_session_once_on_shutdown =
-          this._prefBranch.getBoolPref("sessionstore.resume_session_once");
-        this._prefBranch.setBoolPref("sessionstore.resume_session_once", true);
-        // flush the preference file so preference will be saved in case of a crash
-        Services.prefs.savePrefFile(null);
-      }
-    }
-
     // Persist the last session if we deferred restoring it
     if (this._lastSessionState)
       oState.lastSessionState = this._lastSessionState;
diff --git a/browser/devtools/commandline/BuiltinCommands.jsm b/browser/devtools/commandline/BuiltinCommands.jsm
index bd8b8e08e2d1..d56705d491a2 100644
--- a/browser/devtools/commandline/BuiltinCommands.jsm
+++ b/browser/devtools/commandline/BuiltinCommands.jsm
@@ -19,14 +19,12 @@ Cu.import("resource://gre/modules/osfile.jsm");
 Cu.import("resource://gre/modules/devtools/gcli.jsm");
 Cu.import("resource:///modules/devtools/shared/event-emitter.js");
 
-var require = Cu.import("resource://gre/modules/devtools/Loader.jsm", {}).devtools.require;
-let Telemetry = require("devtools/shared/telemetry");
+let devtools = Cu.import("resource://gre/modules/devtools/Loader.jsm", {}).devtools;
+let Telemetry = devtools.require("devtools/shared/telemetry");
 let telemetry = new Telemetry();
 
 XPCOMUtils.defineLazyModuleGetter(this, "gDevTools",
                                   "resource:///modules/devtools/gDevTools.jsm");
-XPCOMUtils.defineLazyModuleGetter(this, "devtools",
-                                  "resource://gre/modules/devtools/Loader.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "AppCacheUtils",
                                   "resource:///modules/devtools/AppCacheUtils.jsm");
 
@@ -799,8 +797,13 @@ XPCOMUtils.defineLazyModuleGetter(this, "AppCacheUtils",
 /* CmdConsole -------------------------------------------------------------- */
 
 (function(module) {
-  XPCOMUtils.defineLazyModuleGetter(this, "HUDService",
-                                    "resource:///modules/HUDService.jsm");
+  Object.defineProperty(this, "HUDService", {
+    get: function() {
+      return devtools.require("devtools/webconsole/hudservice");
+    },
+    configurable: true,
+    enumerable: true
+  });
 
   /**
    * 'console' command
diff --git a/browser/devtools/commandline/test/browser_cmd_calllog.js b/browser/devtools/commandline/test/browser_cmd_calllog.js
index 49a144652fad..582d690331ae 100644
--- a/browser/devtools/commandline/test/browser_cmd_calllog.js
+++ b/browser/devtools/commandline/test/browser_cmd_calllog.js
@@ -3,8 +3,6 @@
 
 // Tests that the calllog commands works as they should
 
-let HUDService = (Cu.import("resource:///modules/HUDService.jsm", {})).HUDService;
-
 const TEST_URI = "data:text/html;charset=utf-8,gcli-calllog";
 
 let tests = {};
@@ -55,7 +53,7 @@ tests.testCallLogExec = function(options) {
 
     subject.QueryInterface(Ci.nsISupportsString);
     let hud = HUDService.getHudReferenceById(subject.data);
-    ok(hud.hudId in HUDService.hudReferences, "console open");
+    ok(hud, "console open");
 
     helpers.audit(options, [
       {
diff --git a/browser/devtools/commandline/test/browser_cmd_calllog_chrome.js b/browser/devtools/commandline/test/browser_cmd_calllog_chrome.js
index 4caa47e6dff1..6a18e19e0c12 100644
--- a/browser/devtools/commandline/test/browser_cmd_calllog_chrome.js
+++ b/browser/devtools/commandline/test/browser_cmd_calllog_chrome.js
@@ -3,8 +3,6 @@
 
 // Tests that the calllog commands works as they should
 
-let HUDService = (Cu.import("resource:///modules/HUDService.jsm", {})).HUDService;
-
 const TEST_URI = "data:text/html;charset=utf-8,cmd-calllog-chrome";
 
 let tests = {};
@@ -56,7 +54,7 @@ tests.testCallLogExec = function(options) {
 
     subject.QueryInterface(Ci.nsISupportsString);
     let hud = HUDService.getHudReferenceById(subject.data);
-    ok(hud.hudId in HUDService.hudReferences, "console open");
+    ok(hud, "console open");
 
     helpers.audit(options, [
       {
diff --git a/browser/devtools/commandline/test/browser_cmd_commands.js b/browser/devtools/commandline/test/browser_cmd_commands.js
index 141baab05a5a..58aab987c543 100644
--- a/browser/devtools/commandline/test/browser_cmd_commands.js
+++ b/browser/devtools/commandline/test/browser_cmd_commands.js
@@ -3,8 +3,6 @@
 
 // Test various GCLI commands
 
-let HUDService = (Cu.import("resource:///modules/HUDService.jsm", {})).HUDService;
-
 const TEST_URI = "data:text/html;charset=utf-8,gcli-commands";
 
 let tests = {};
@@ -24,41 +22,46 @@ tests.testConsole = function(options) {
 
     subject.QueryInterface(Ci.nsISupportsString);
     hud = HUDService.getHudReferenceById(subject.data);
-    ok(hud.hudId in HUDService.hudReferences, "console open");
+    ok(hud, "console open");
 
     hud.jsterm.execute("pprint(window)", onExecute);
   }
   Services.obs.addObserver(onWebConsoleOpen, "web-console-created", false);
 
-  let onExecute = function() {
+  function onExecute () {
     let labels = hud.outputNode.querySelectorAll(".webconsole-msg-output");
     ok(labels.length > 0, "output for pprint(window)");
 
+    hud.jsterm.once("messages-cleared", onClear);
+
     helpers.audit(options, [
       {
         setup: "console clear",
         exec: {
           output: ""
         },
-        post: function() {
-          let labels = hud.outputNode.querySelectorAll(".webconsole-msg-output");
-          // Bug 845827 - The GCLI "console clear" command doesn't always work
-          // is(labels.length, 0, "no output in console");
-        }
-      },
+      }
+    ]);
+  }
+
+  function onClear() {
+    let labels = hud.outputNode.querySelectorAll(".webconsole-msg-output");
+    is(labels.length, 0, "no output in console");
+
+    helpers.audit(options, [
       {
         setup: "console close",
         exec: {
           output: ""
         },
         post: function() {
-          ok(!(hud.hudId in HUDService.hudReferences), "console closed");
+          ok(!HUDService.getHudReferenceById(hud.hudId), "console closed");
         }
       }
     ]).then(function() {
       deferred.resolve();
     });
-  };
+  }
 
   helpers.audit(options, [
     {
diff --git a/browser/devtools/debugger/CmdDebugger.jsm b/browser/devtools/debugger/CmdDebugger.jsm
index 0986b8f48888..82d981e06918 100644
--- a/browser/devtools/debugger/CmdDebugger.jsm
+++ b/browser/devtools/debugger/CmdDebugger.jsm
@@ -506,11 +506,12 @@ gcli.addCommand({
       const blackBoxed = [];
 
       for (let source of toBlackBox) {
+        let { url } = source;
         activeThread.source(source)[cmd.clientMethod](function ({ error }) {
           if (error) {
-            blackBoxed.push(lookup("ErrorDesc") + " " + source.url);
+            blackBoxed.push(lookup("ErrorDesc") + " " + url);
           } else {
-            blackBoxed.push(source.url);
+            blackBoxed.push(url);
           }
 
           if (toBlackBox.length === blackBoxed.length) {
diff --git a/browser/devtools/debugger/debugger-controller.js b/browser/devtools/debugger/debugger-controller.js
index fe15b590ff86..d36784105cba 100644
--- a/browser/devtools/debugger/debugger-controller.js
+++ b/browser/devtools/debugger/debugger-controller.js
@@ -29,8 +29,17 @@ Cu.import("resource:///modules/devtools/ViewHelpers.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "Parser",
   "resource:///modules/devtools/Parser.jsm");
 
-XPCOMUtils.defineLazyModuleGetter(this, "NetworkHelper",
-  "resource://gre/modules/devtools/NetworkHelper.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "devtools",
+  "resource://gre/modules/devtools/Loader.jsm");
+
+Object.defineProperty(this, "NetworkHelper", {
+  get: function() {
+    return devtools.require("devtools/toolkit/webconsole/network-helper");
+  },
+  configurable: true,
+  enumerable: true
+});
+
 
 /**
  * Object defining the debugger controller components.
@@ -438,6 +447,7 @@ StackFrames.prototype = {
   currentEvaluation: null,
   currentException: null,
   currentReturnedValue: null,
+  _dontSwitchSources: false,
 
   /**
    * Connect to the current thread client.
@@ -594,12 +604,24 @@ StackFrames.prototype = {
     // Make sure the debugger view panes are visible.
     DebuggerView.showInstrumentsPane();
 
+    this._refillFrames();
+  },
+
+  /**
+   * Fill the StackFrames view with the frames we have in the cache, compressing
+   * frames which have black boxed sources into single frames.
+   */
+  _refillFrames: function() {
     // Make sure all the previous stackframes are removed before re-adding them.
     DebuggerView.StackFrames.empty();
 
     let previousBlackBoxed = null;
     for (let frame of this.activeThread.cachedFrames) {
-      let { depth, where: { url, line }, isBlackBoxed } = frame;
+      let { depth, where: { url, line }, source } = frame;
+
+      let isBlackBoxed = source
+        ? this.activeThread.source(source).isBlackBoxed
+        : false;
       let frameLocation = NetworkHelper.convertToUnicode(unescape(url));
       let frameTitle = StackFrameUtils.getFrameTitle(frame);
 
@@ -612,8 +634,10 @@ StackFrames.prototype = {
         previousBlackBoxed = null;
       }
 
-      DebuggerView.StackFrames.addFrame(frameTitle, frameLocation, line, depth, isBlackBoxed);
+      DebuggerView.StackFrames.addFrame(
+        frameTitle, frameLocation, line, depth, isBlackBoxed);
     }
+
     if (this.currentFrame == null) {
       DebuggerView.StackFrames.selectedDepth = 0;
     }
@@ -644,10 +668,9 @@ StackFrames.prototype = {
    */
   _onBlackBoxChange: function() {
     if (this.activeThread.state == "paused") {
-      // We have to clear out the existing frames and refetch them to get their
-      // updated black boxed status.
-      this.activeThread._clearFrames();
-      this.activeThread.fillFrames(CALL_STACK_PAGE_SIZE);
+      this._dontSwitchSources = true;
+      this.currentFrame = null;
+      this._refillFrames();
     }
   },
 
@@ -672,8 +695,10 @@ StackFrames.prototype = {
    *
    * @param number aDepth
    *        The depth of the frame in the stack.
+   * @param boolean aDontSwitchSources
+   *        Flag on whether or not we want to switch the selected source.
    */
-  selectFrame: function(aDepth) {
+  selectFrame: function(aDepth, aDontSwitchSources) {
     // Make sure the frame at the specified depth exists first.
     let frame = this.activeThread.cachedFrames[this.currentFrame = aDepth];
     if (!frame) {
@@ -686,8 +711,11 @@ StackFrames.prototype = {
       return;
     }
 
+    let noSwitch = this._dontSwitchSources;
+    this._dontSwitchSources = false;
+
     // Move the editor's caret to the proper url and line.
-    DebuggerView.updateEditor(url, line);
+    DebuggerView.updateEditor(url, line, { noSwitch: noSwitch });
     // Highlight the breakpoint at the specified url and line if it exists.
     DebuggerView.Sources.highlightBreakpoint(url, line);
     // Don't display the watch expressions textbox inputs in the pane.
diff --git a/browser/devtools/debugger/debugger.xul b/browser/devtools/debugger/debugger.xul
index a0fb5d915ac2..8e6e52320fa6 100644
--- a/browser/devtools/debugger/debugger.xul
+++ b/browser/devtools/debugger/debugger.xul
@@ -193,18 +193,34 @@
          modifiers="accel alt"
          command="prevSourceCommand"/>
     <key id="resumeKey"
-         keycode="&debuggerUI.stepping.resume;"
+         keycode="&debuggerUI.stepping.resume1;"
+         command="resumeCommand"/>
+    <key id="resumeKey2"
+         keycode="&debuggerUI.stepping.resume2;"
+         modifiers="accel"
          command="resumeCommand"/>
     <key id="stepOverKey"
-         keycode="&debuggerUI.stepping.stepOver;"
+         keycode="&debuggerUI.stepping.stepOver1;"
+         command="stepOverCommand"/>
+    <key id="stepOverKey2"
+         keycode="&debuggerUI.stepping.stepOver2;"
+         modifiers="accel"
          command="stepOverCommand"/>
     <key id="stepInKey"
-         keycode="&debuggerUI.stepping.stepIn;"
+         keycode="&debuggerUI.stepping.stepIn1;"
+         command="stepInCommand"/>
+    <key id="stepInKey2"
+         keycode="&debuggerUI.stepping.stepIn2;"
+         modifiers="accel"
          command="stepInCommand"/>
     <key id="stepOutKey"
-         keycode="&debuggerUI.stepping.stepOut;"
+         keycode="&debuggerUI.stepping.stepOut1;"
          modifiers="shift"
          command="stepOutCommand"/>
+    <key id="stepOutKey2"
+         keycode="&debuggerUI.stepping.stepOut2;"
+         modifiers="accel shift"
+         command="stepOutCommand"/>
     <key id="fileSearchKey"
          key="&debuggerUI.searchFile.key;"
          modifiers="accel"
diff --git a/browser/devtools/debugger/test/Makefile.in b/browser/devtools/debugger/test/Makefile.in
index b4c8ecdce960..1420aed37d68 100644
--- a/browser/devtools/debugger/test/Makefile.in
+++ b/browser/devtools/debugger/test/Makefile.in
@@ -17,6 +17,8 @@ MOCHITEST_BROWSER_TESTS = \
 	browser_dbg_blackboxing-03.js \
 	browser_dbg_blackboxing-04.js \
 	browser_dbg_blackboxing-05.js \
+	browser_dbg_blackboxing-06.js \
+	browser_dbg_blackboxing-07.js \
 	browser_dbg_clean-exit.js \
 	browser_dbg_cmd.js \
 	browser_dbg_cmd_blackbox.js \
diff --git a/browser/devtools/debugger/test/browser_dbg_blackboxing-03.js b/browser/devtools/debugger/test/browser_dbg_blackboxing-03.js
index 573750a3c91e..bc6a22e5e0cd 100644
--- a/browser/devtools/debugger/test/browser_dbg_blackboxing-03.js
+++ b/browser/devtools/debugger/test/browser_dbg_blackboxing-03.js
@@ -57,17 +57,15 @@ function testBlackBoxSource() {
 
   const { activeThread } = gDebugger.DebuggerController;
   activeThread.addOneTimeListener("blackboxchange", function (event, sourceClient) {
-    activeThread.addOneTimeListener("framesadded", function () {
-      ok(sourceClient.isBlackBoxed, "The source should be black boxed now");
+    ok(sourceClient.isBlackBoxed, "The source should be black boxed now");
 
-      const frames = gDebugger.DebuggerView.StackFrames.widget._list;
-      is(frames.querySelectorAll(".dbg-stackframe").length, 3,
-         "Should only get 3 frames");
-      is(frames.querySelectorAll(".dbg-stackframe-black-boxed").length, 1,
-         "And one of them is the combined black boxed frames");
+    const frames = gDebugger.DebuggerView.StackFrames.widget._list;
+    is(frames.querySelectorAll(".dbg-stackframe").length, 3,
+       "Should only get 3 frames");
+    is(frames.querySelectorAll(".dbg-stackframe-black-boxed").length, 1,
+       "And one of them is the combined black boxed frames");
 
-      closeDebuggerAndFinish();
-    });
+    closeDebuggerAndFinish();
   });
 
   checkbox.click();
diff --git a/browser/devtools/debugger/test/browser_dbg_blackboxing-05.js b/browser/devtools/debugger/test/browser_dbg_blackboxing-05.js
index 3ee1eec27a86..fea5a014bfb6 100644
--- a/browser/devtools/debugger/test/browser_dbg_blackboxing-05.js
+++ b/browser/devtools/debugger/test/browser_dbg_blackboxing-05.js
@@ -41,7 +41,7 @@ function testSourceEditorShown() {
 function blackBoxSource() {
   const { activeThread } = gDebugger.DebuggerController;
   activeThread.addOneTimeListener("blackboxchange", testBlackBoxMessageShown);
-  getBlackBoxCheckbox().click();
+  getAnyBlackBoxCheckbox().click();
 }
 
 function testBlackBoxMessageShown() {
@@ -65,7 +65,7 @@ function testSourceEditorShownAgain() {
   closeDebuggerAndFinish();
 }
 
-function getBlackBoxCheckbox() {
+function getAnyBlackBoxCheckbox() {
   return gDebugger.document.querySelector(
     ".side-menu-widget-item .side-menu-widget-item-checkbox");
 }
diff --git a/browser/devtools/debugger/test/browser_dbg_blackboxing-06.js b/browser/devtools/debugger/test/browser_dbg_blackboxing-06.js
new file mode 100644
index 000000000000..1b2aa607f400
--- /dev/null
+++ b/browser/devtools/debugger/test/browser_dbg_blackboxing-06.js
@@ -0,0 +1,70 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/**
+ * Test that clicking the black box checkbox doesn't select that source.
+ */
+
+const TAB_URL = EXAMPLE_URL + "browser_dbg_blackboxing.html";
+
+var gPane = null;
+var gTab = null;
+var gDebuggee = null;
+var gDebugger = null;
+
+function test()
+{
+  let scriptShown = false;
+  let framesAdded = false;
+  let resumed = false;
+  let testStarted = false;
+
+  debug_tab_pane(TAB_URL, function(aTab, aDebuggee, aPane) {
+    resumed = true;
+    gTab = aTab;
+    gDebuggee = aDebuggee;
+    gPane = aPane;
+    gDebugger = gPane.panelWin;
+
+    once(gDebugger, "Debugger:SourceShown", testBlackBox);
+  });
+}
+
+function testBlackBox() {
+  const sources = gDebugger.DebuggerView.Sources;
+
+  const selectedUrl = sources.selectedItem.attachment.source.url;
+  const checkbox = getDifferentBlackBoxCheckbox(selectedUrl);
+  ok(checkbox, "We should be able to grab a checkbox");
+
+  const { activeThread } = gDebugger.DebuggerController;
+  activeThread.addOneTimeListener("blackboxchange", function () {
+    is(selectedUrl,
+       sources.selectedItem.attachment.source.url,
+       "The same source should be selected");
+    closeDebuggerAndFinish();
+  });
+
+  checkbox.click();
+}
+
+function getDifferentBlackBoxCheckbox(url) {
+  return gDebugger.document.querySelector(
+    ".side-menu-widget-item:not([tooltiptext=\""
+      + url + "\"]) .side-menu-widget-item-checkbox");
+}
+
+function once(target, event, callback) {
+  target.addEventListener(event, function _listener(...args) {
+    target.removeEventListener(event, _listener, false);
+    callback.apply(null, args);
+  }, false);
+}
+
+registerCleanupFunction(function() {
+  removeTab(gTab);
+  gPane = null;
+  gTab = null;
+  gDebuggee = null;
+  gDebugger = null;
+});
diff --git a/browser/devtools/debugger/test/browser_dbg_blackboxing-07.js b/browser/devtools/debugger/test/browser_dbg_blackboxing-07.js
new file mode 100644
index 000000000000..ed2bbd009111
--- /dev/null
+++ b/browser/devtools/debugger/test/browser_dbg_blackboxing-07.js
@@ -0,0 +1,86 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/**
+ * Test that clicking the black box checkbox when paused doesn't re-select the
+ * currently paused frame's source.
+ */
+
+const TAB_URL = EXAMPLE_URL + "browser_dbg_blackboxing.html";
+
+var gPane = null;
+var gTab = null;
+var gDebuggee = null;
+var gDebugger = null;
+
+function test()
+{
+  let scriptShown = false;
+  let framesAdded = false;
+  let resumed = false;
+  let testStarted = false;
+
+  debug_tab_pane(TAB_URL, function(aTab, aDebuggee, aPane) {
+    resumed = true;
+    gTab = aTab;
+    gDebuggee = aDebuggee;
+    gPane = aPane;
+    gDebugger = gPane.panelWin;
+
+    once(gDebugger, "Debugger:SourceShown", runTest);
+  });
+}
+
+function runTest() {
+  const { activeThread } = gDebugger.DebuggerController;
+  activeThread.addOneTimeListener("paused", function () {
+    const sources = gDebugger.DebuggerView.Sources;
+    const selectedUrl = sources.selectedItem.attachment.source.url;
+
+    once(gDebugger, "Debugger:SourceShown", function () {
+      const newSelectedUrl = sources.selectedItem.attachment.source.url;
+      isnot(selectedUrl, newSelectedUrl,
+            "Should not have the same url selected");
+
+      activeThread.addOneTimeListener("blackboxchange", function () {
+        isnot(sources.selectedItem.attachment.source.url,
+              selectedUrl,
+              "The selected source did not change");
+        closeDebuggerAndFinish();
+      });
+
+      getBlackBoxCheckbox(newSelectedUrl).click();
+    });
+
+    getDifferentSource(selectedUrl).click();
+  });
+
+  gDebuggee.runTest();
+}
+
+function getDifferentSource(url) {
+  return gDebugger.document.querySelector(
+    ".side-menu-widget-item:not([tooltiptext=\""
+      + url + "\"])");
+}
+
+function getBlackBoxCheckbox(url) {
+  return gDebugger.document.querySelector(
+    ".side-menu-widget-item[tooltiptext=\""
+      + url + "\"] .side-menu-widget-item-checkbox");
+}
+
+function once(target, event, callback) {
+  target.addEventListener(event, function _listener(...args) {
+    target.removeEventListener(event, _listener, false);
+    callback.apply(null, args);
+  }, false);
+}
+
+registerCleanupFunction(function() {
+  removeTab(gTab);
+  gPane = null;
+  gTab = null;
+  gDebuggee = null;
+  gDebugger = null;
+});
diff --git a/browser/devtools/debugger/test/browser_dbg_cmd_blackbox.js b/browser/devtools/debugger/test/browser_dbg_cmd_blackbox.js
index 8d704ad3a297..588dcd4198ac 100644
--- a/browser/devtools/debugger/test/browser_dbg_cmd_blackbox.js
+++ b/browser/devtools/debugger/test/browser_dbg_cmd_blackbox.js
@@ -20,7 +20,7 @@ let gClient;
 let gThreadClient;
 let gTab;
 
-function cmd(typed, expectedNumEvents=1) {
+function cmd(typed, expectedNumEvents=1, output=null) {
   const deferred = promise.defer();
 
   let timesFired = 0;
@@ -31,10 +31,16 @@ function cmd(typed, expectedNumEvents=1) {
     }
   });
 
-  helpers.audit(gOptions, [{
+  let audit = {
     setup: typed,
     exec: {}
-  }]);
+  };
+
+  if (output) {
+    audit.output = output;
+  }
+
+  helpers.audit(gOptions, [audit]);
 
   return deferred.promise;
 }
@@ -93,7 +99,8 @@ function testUnBlackBoxSource() {
 }
 
 function testBlackBoxGlob() {
-  return cmd("dbg blackbox --glob *blackboxing_t*.js", 2)
+  return cmd("dbg blackbox --glob *blackboxing_t*.js", 2,
+             [/blackboxing_three\.js/g, /blackboxing_two\.js/g])
     .then(function () {
       ok(getBlackBoxCheckbox(BLACKBOXME_URL).checked,
          "blackboxme should not be black boxed because it doesn't match the glob");
diff --git a/browser/devtools/framework/gDevTools.jsm b/browser/devtools/framework/gDevTools.jsm
index 5e1650cbd02c..d1a8756632e2 100644
--- a/browser/devtools/framework/gDevTools.jsm
+++ b/browser/devtools/framework/gDevTools.jsm
@@ -19,6 +19,7 @@ var ProfilerController = devtools.require("devtools/profiler/controller");
 const FORBIDDEN_IDS = new Set(["toolbox", ""]);
 const MAX_ORDINAL = 99;
 
+
 /**
  * DevTools is a class that represents a set of developer tools, it holds a
  * set of tools and keeps track of open toolboxes in the browser.
@@ -345,15 +346,24 @@ let gDevToolsBrowser = {
   selectToolCommand: function(gBrowser, toolId) {
     let target = devtools.TargetFactory.forTab(gBrowser.selectedTab);
     let toolbox = gDevTools.getToolbox(target);
+    let tools = gDevTools.getToolDefinitionMap();
+    let toolDefinition = tools.get(toolId);
 
     if (toolbox && toolbox.currentToolId == toolId) {
-      if (toolbox.hostType == devtools.Toolbox.HostType.WINDOW) {
+      toolbox.fireCustomKey(toolId);
+
+      if (toolDefinition.preventClosingOnKey || toolbox.hostType == devtools.Toolbox.HostType.WINDOW) {
         toolbox.raise();
       } else {
         toolbox.destroy();
       }
     } else {
-      gDevTools.showToolbox(target, toolId);
+      gDevTools.showToolbox(target, toolId).then(() => {
+        let target = devtools.TargetFactory.forTab(gBrowser.selectedTab);
+        let toolbox = gDevTools.getToolbox(target);
+
+        toolbox.fireCustomKey(toolId);
+      });
     }
   },
 
@@ -374,6 +384,11 @@ let gDevToolsBrowser = {
     gDevToolsBrowser._trackedBrowserWindows.add(win);
     gDevToolsBrowser._addAllToolsToMenu(win.document);
 
+    if (this._isFirebugInstalled()) {
+      let broadcaster = win.document.getElementById("devtoolsMenuBroadcaster_DevToolbox");
+      broadcaster.removeAttribute("key");
+    }
+
     let tabContainer = win.document.getElementById("tabbrowser-tabs")
     tabContainer.addEventListener("TabSelect",
                                   gDevToolsBrowser._updateMenuCheckbox, false);
@@ -392,6 +407,7 @@ let gDevToolsBrowser = {
    */
   attachKeybindingsToBrowser: function DT_attachKeybindingsToBrowser(doc, keys) {
     let devtoolsKeyset = doc.getElementById("devtoolsKeyset");
+
     if (!devtoolsKeyset) {
       devtoolsKeyset = doc.createElement("keyset");
       devtoolsKeyset.setAttribute("id", "devtoolsKeyset");
@@ -401,6 +417,17 @@ let gDevToolsBrowser = {
     mainKeyset.parentNode.insertBefore(devtoolsKeyset, mainKeyset);
   },
 
+
+  /**
+   * Detect the presence of a Firebug.
+   *
+   * @return promise
+   */
+  _isFirebugInstalled: function DT_isFirebugInstalled() {
+    let bootstrappedAddons = Services.prefs.getCharPref("extensions.bootstrappedAddons");
+    return bootstrappedAddons.indexOf("firebug@software.joehewitt.com") != -1;
+  },
+
   /**
    * Add the menuitem for a tool to all open browser windows.
    *
@@ -725,6 +752,7 @@ let gDevToolsBrowser = {
     Services.obs.removeObserver(gDevToolsBrowser.destroy, "quit-application");
   },
 }
+
 this.gDevToolsBrowser = gDevToolsBrowser;
 
 gDevTools.on("tool-registered", function(ev, toolId) {
diff --git a/browser/devtools/framework/test/Makefile.in b/browser/devtools/framework/test/Makefile.in
index 9d9ab0d9b2bb..c9618e248803 100644
--- a/browser/devtools/framework/test/Makefile.in
+++ b/browser/devtools/framework/test/Makefile.in
@@ -30,6 +30,7 @@ MOCHITEST_BROWSER_FILES = \
 		browser_toolbox_options_disablejs_iframe.html \
 		browser_toolbox_highlight.js \
 		browser_toolbox_raise.js \
+		browser_keybindings.js \
 		$(NULL)
 
 include $(topsrcdir)/config/rules.mk
diff --git a/browser/devtools/framework/test/browser_keybindings.js b/browser/devtools/framework/test/browser_keybindings.js
new file mode 100644
index 000000000000..b49a8f822a12
--- /dev/null
+++ b/browser/devtools/framework/test/browser_keybindings.js
@@ -0,0 +1,119 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+// Tests that the keybindings for opening and closing the inspector work as expected
+// Can probably make this a shared test that tests all of the tools global keybindings
+
+function test()
+{
+  waitForExplicitFinish();
+
+  let doc;
+  let node;
+  let inspector;
+  let keysetMap = { };
+
+  gBrowser.selectedTab = gBrowser.addTab();
+  gBrowser.selectedBrowser.addEventListener("load", function onload() {
+    gBrowser.selectedBrowser.removeEventListener("load", onload, true);
+    doc = content.document;
+    waitForFocus(setupKeyBindingsTest, content);
+  }, true);
+
+  content.location = "data:text/html,<html><head><title>Test for the " +
+                     "highlighter keybindings</title></head><body>" +
+                     "<h1>Keybindings!</h1></body></html>";
+
+  function buildDevtoolsKeysetMap(keyset) {
+    [].forEach.call(keyset.querySelectorAll("key"), function(key) {
+
+      if (!key.getAttribute("key")) {
+        return;
+      }
+
+      let modifiers = key.getAttribute("modifiers");
+
+      keysetMap[key.id.split("_")[1]] = {
+        key: key.getAttribute("key"),
+        modifiers: modifiers,
+        modifierOpt: {
+          shiftKey: modifiers.match("shift"),
+          ctrlKey: modifiers.match("ctrl"),
+          altKey: modifiers.match("alt"),
+          metaKey: modifiers.match("meta"),
+          accelKey: modifiers.match("accel")
+        },
+        synthesizeKey: function() {
+          EventUtils.synthesizeKey(this.key, this.modifierOpt);
+        }
+      }
+    });
+  }
+
+  function setupKeyBindingsTest()
+  {
+    for (let win of gDevToolsBrowser._trackedBrowserWindows) {
+      buildDevtoolsKeysetMap(win.document.getElementById("devtoolsKeyset"));
+    }
+
+    gDevTools.once("toolbox-ready", (e, toolbox) => {
+      inspectorShouldBeOpenAndHighlighting(toolbox.getCurrentPanel(), toolbox)
+    });
+
+    keysetMap.inspector.synthesizeKey();
+  }
+
+  function inspectorShouldBeOpenAndHighlighting(aInspector, aToolbox)
+  {
+    is (aToolbox.currentToolId, "inspector", "Correct tool has been loaded");
+    is (aInspector.highlighter.locked, true, "Highlighter should be locked");
+
+    aInspector.highlighter.once("unlocked", () => {
+      is (aInspector.highlighter.locked, false, "Highlighter should be unlocked");
+      keysetMap.inspector.synthesizeKey();
+      is (aInspector.highlighter.locked, true, "Highlighter should be locked");
+      keysetMap.inspector.synthesizeKey();
+      is (aInspector.highlighter.locked, false, "Highlighter should be unlocked");
+      keysetMap.inspector.synthesizeKey();
+      is (aInspector.highlighter.locked, true, "Highlighter should be locked");
+
+      aToolbox.once("webconsole-ready", (e, panel) => {
+        webconsoleShouldBeSelected(aToolbox, panel);
+      });
+      keysetMap.webconsole.synthesizeKey();
+    });
+  }
+
+  function webconsoleShouldBeSelected(aToolbox, panel)
+  {
+      is (aToolbox.currentToolId, "webconsole");
+
+      aToolbox.once("jsdebugger-ready", (e, panel) => {
+        jsdebuggerShouldBeSelected(aToolbox, panel);
+      });
+      keysetMap.jsdebugger.synthesizeKey();
+  }
+
+  function jsdebuggerShouldBeSelected(aToolbox, panel)
+  {
+      is (aToolbox.currentToolId, "jsdebugger");
+
+      aToolbox.once("netmonitor-ready", (e, panel) => {
+        netmonitorShouldBeSelected(aToolbox, panel);
+      });
+
+      keysetMap.netmonitor.synthesizeKey();
+  }
+
+  function netmonitorShouldBeSelected(aToolbox, panel)
+  {
+      is (aToolbox.currentToolId, "netmonitor");
+      finishUp();
+  }
+
+  function finishUp() {
+    doc = node = inspector = keysetMap = null;
+    gBrowser.removeCurrentTab();
+    finish();
+  }
+}
diff --git a/browser/devtools/framework/toolbox.js b/browser/devtools/framework/toolbox.js
index efece2c12257..37568fb72e1b 100644
--- a/browser/devtools/framework/toolbox.js
+++ b/browser/devtools/framework/toolbox.js
@@ -264,13 +264,30 @@ Toolbox.prototype = {
         key.setAttribute("modifiers", toolDefinition.modifiers);
         key.setAttribute("oncommand", "void(0);"); // needed. See bug 371900
         key.addEventListener("command", function(toolId) {
-          this.selectTool(toolId);
+          this.selectTool(toolId).then(() => {
+              this.fireCustomKey(toolId);
+          });
         }.bind(this, id), true);
         doc.getElementById("toolbox-keyset").appendChild(key);
       }
     }
   },
 
+
+  /**
+   * Handle any custom key events.  Returns true if there was a custom key binding run
+   * @param {string} toolId
+   *        Which tool to run the command on (skip if not current)
+   */
+  fireCustomKey: function TBOX_fireCustomKey(toolId) {
+    let tools = gDevTools.getToolDefinitionMap();
+    let activeToolDefinition = tools.get(toolId);
+
+    if (activeToolDefinition.onkey && this.currentToolId === toolId) {
+        activeToolDefinition.onkey(this.getCurrentPanel());
+    }
+  },
+
   /**
    * Build the buttons for changing hosts. Called every time
    * the host changes.
diff --git a/browser/devtools/inspector/highlighter.js b/browser/devtools/inspector/highlighter.js
index f50f99081e6c..02f07a1775e3 100644
--- a/browser/devtools/inspector/highlighter.js
+++ b/browser/devtools/inspector/highlighter.js
@@ -129,8 +129,6 @@ Highlighter.prototype = {
     this.transitionDisabler = null;
     this.pageEventsMuter = null;
 
-    this.unlockAndFocus();
-
     this.selection.on("new-node", this.highlight);
     this.selection.on("new-node", this.updateInfobar);
     this.selection.on("pseudoclass", this.updateInfobar);
diff --git a/browser/devtools/inspector/inspector-panel.js b/browser/devtools/inspector/inspector-panel.js
index bd2565ab13f6..ee446cacdfda 100644
--- a/browser/devtools/inspector/inspector-panel.js
+++ b/browser/devtools/inspector/inspector-panel.js
@@ -137,10 +137,6 @@ InspectorPanel.prototype = {
       // All the components are initialized. Let's select a node.
       this._selection.setNodeFront(defaultSelection);
 
-      if (this.highlighter) {
-        this.highlighter.unlock();
-      }
-
       this.markup.expandNode(this.selection.nodeFront);
 
       this.emit("ready");
diff --git a/browser/devtools/inspector/selector-search.js b/browser/devtools/inspector/selector-search.js
index 8279b7cf7053..1181d61411e0 100644
--- a/browser/devtools/inspector/selector-search.js
+++ b/browser/devtools/inspector/selector-search.js
@@ -4,13 +4,10 @@
 
 "use strict";
 
-const {Cu} = require("chrome");
 const EventEmitter = require("devtools/shared/event-emitter");
 const promise = require("sdk/core/promise");
 
-loader.lazyGetter(this, "AutocompletePopup", () => {
-  return Cu.import("resource:///modules/devtools/AutocompletePopup.jsm", {}).AutocompletePopup;
-});
+loader.lazyGetter(this, "AutocompletePopup", () => require("devtools/shared/autocomplete-popup").AutocompletePopup);
 
 // Maximum number of selector suggestions shown in the panel.
 const MAX_SUGGESTIONS = 15;
diff --git a/browser/devtools/inspector/test/browser_inspector_bug_665880.js b/browser/devtools/inspector/test/browser_inspector_bug_665880.js
index 6d990d5c8bbd..58ddcabeeb65 100644
--- a/browser/devtools/inspector/test/browser_inspector_bug_665880.js
+++ b/browser/devtools/inspector/test/browser_inspector_bug_665880.js
@@ -29,6 +29,7 @@ function test()
   function runObjectInspectionTest(inspector)
   {
     inspector.highlighter.once("locked", performTestComparison);
+    inspector.highlighter.unlock();
     inspector.selection.setNode(objectNode, "");
   }
 
diff --git a/browser/devtools/inspector/test/browser_inspector_bug_674871.js b/browser/devtools/inspector/test/browser_inspector_bug_674871.js
index ed448d8f161b..b4c0699879ea 100644
--- a/browser/devtools/inspector/test/browser_inspector_bug_674871.js
+++ b/browser/devtools/inspector/test/browser_inspector_bug_674871.js
@@ -50,6 +50,7 @@ function test()
 
   function runTests(inspector)
   {
+    inspector.highlighter.unlock();
     executeSoon(function() {
       inspector.highlighter.once("highlighting", isTheIframeSelected);
       moveMouseOver(iframeNode, 1, 1);
diff --git a/browser/devtools/inspector/test/browser_inspector_iframeTest.js b/browser/devtools/inspector/test/browser_inspector_iframeTest.js
index d95242a3daac..342028661ce4 100644
--- a/browser/devtools/inspector/test/browser_inspector_iframeTest.js
+++ b/browser/devtools/inspector/test/browser_inspector_iframeTest.js
@@ -51,6 +51,7 @@ function moveMouseOver(aElement)
 
 function runIframeTests()
 {
+  getActiveInspector().highlighter.unlock();
   getActiveInspector().selection.once("new-node", performTestComparisons1);
   moveMouseOver(div1)
 }
diff --git a/browser/devtools/inspector/test/browser_inspector_scrolling.js b/browser/devtools/inspector/test/browser_inspector_scrolling.js
index 9fa5ba431555..b2ef6e22601f 100644
--- a/browser/devtools/inspector/test/browser_inspector_scrolling.js
+++ b/browser/devtools/inspector/test/browser_inspector_scrolling.js
@@ -35,6 +35,7 @@ function inspectNode(aInspector)
 
   inspector.highlighter.once("locked", performScrollingTest);
   executeSoon(function() {
+    inspector.highlighter.unlock();
     inspector.selection.setNode(div, "");
   });
 }
diff --git a/browser/devtools/jar.mn b/browser/devtools/jar.mn
index 8d91a547e52f..e0ab285d1e3d 100644
--- a/browser/devtools/jar.mn
+++ b/browser/devtools/jar.mn
@@ -12,8 +12,7 @@ browser.jar:
     content/browser/devtools/netmonitor-controller.js                  (netmonitor/netmonitor-controller.js)
     content/browser/devtools/netmonitor-view.js                        (netmonitor/netmonitor-view.js)
     content/browser/devtools/NetworkPanel.xhtml                        (webconsole/NetworkPanel.xhtml)
-    content/browser/devtools/webconsole.js                             (webconsole/webconsole.js)
-*   content/browser/devtools/webconsole.xul                            (webconsole/webconsole.xul)
+    content/browser/devtools/webconsole.xul                            (webconsole/webconsole.xul)
 *   content/browser/devtools/scratchpad.xul                            (scratchpad/scratchpad.xul)
     content/browser/devtools/scratchpad.js                             (scratchpad/scratchpad.js)
     content/browser/devtools/splitview.css                             (shared/splitview.css)
diff --git a/browser/devtools/main.js b/browser/devtools/main.js
index 1ac06ed0f4e6..b5551ca4a929 100644
--- a/browser/devtools/main.js
+++ b/browser/devtools/main.js
@@ -19,10 +19,12 @@ Object.defineProperty(exports, "TargetFactory", {
 
 loader.lazyGetter(this, "osString", () => Cc["@mozilla.org/xre/app-info;1"].getService(Ci.nsIXULRuntime).OS);
 
+let events = require("sdk/system/events");
+
 // Panels
 loader.lazyGetter(this, "OptionsPanel", function() require("devtools/framework/toolbox-options").OptionsPanel);
 loader.lazyGetter(this, "InspectorPanel", function() require("devtools/inspector/inspector-panel").InspectorPanel);
-loader.lazyImporter(this, "WebConsolePanel", "resource:///modules/WebConsolePanel.jsm");
+loader.lazyGetter(this, "WebConsolePanel", function() require("devtools/webconsole/panel").WebConsolePanel);
 loader.lazyImporter(this, "DebuggerPanel", "resource:///modules/devtools/DebuggerPanel.jsm");
 loader.lazyImporter(this, "StyleEditorPanel", "resource:///modules/devtools/StyleEditorPanel.jsm");
 loader.lazyGetter(this, "ProfilerPanel", function() require("devtools/profiler/panel"));
@@ -95,6 +97,13 @@ Tools.inspector = {
   label: l10n("inspector.label", inspectorStrings),
   tooltip: l10n("inspector.tooltip", inspectorStrings),
 
+  preventClosingOnKey: true,
+  onkey: function(panel) {
+    if (panel.highlighter) {
+      panel.highlighter.toggleLockState();
+    }
+  },
+
   isTargetSupported: function(target) {
     return !target.isRemote;
   },
@@ -221,6 +230,8 @@ var unloadObserver = {
 };
 Services.obs.addObserver(unloadObserver, "sdk:loader:destroy", false);
 
+events.emit("devtools-loaded", {});
+
 /**
  * Lookup l10n string from a string bundle.
  *
diff --git a/browser/devtools/markupview/markup-view.js b/browser/devtools/markupview/markup-view.js
index 6e184d7d99b7..b944cd99c35e 100644
--- a/browser/devtools/markupview/markup-view.js
+++ b/browser/devtools/markupview/markup-view.js
@@ -21,9 +21,7 @@ Cu.import("resource:///modules/devtools/LayoutHelpers.jsm");
 Cu.import("resource://gre/modules/devtools/Templater.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
-XPCOMUtils.defineLazyGetter(this, "AutocompletePopup", function() {
-  return Cu.import("resource:///modules/devtools/AutocompletePopup.jsm", {}).AutocompletePopup;
-});
+loader.lazyGetter(this, "AutocompletePopup", () => require("devtools/shared/autocomplete-popup").AutocompletePopup);
 
 /**
  * Vocabulary for the purposes of this file:
@@ -161,6 +159,14 @@ MarkupView.prototype = {
     }
 
     switch(aEvent.keyCode) {
+      case Ci.nsIDOMKeyEvent.DOM_VK_H:
+        let node = this._selectedContainer.node;
+        if (node.hidden) {
+          this.walker.unhideNode(node).then(() => this.nodeChanged(node));
+        } else {
+          this.walker.hideNode(node).then(() => this.nodeChanged(node));
+        }
+        break;
       case Ci.nsIDOMKeyEvent.DOM_VK_DELETE:
       case Ci.nsIDOMKeyEvent.DOM_VK_BACK_SPACE:
         this.deleteNode(this._selectedContainer.node);
@@ -523,7 +529,7 @@ MarkupView.prototype = {
    */
   nodeChanged: function MT_nodeChanged(aNode)
   {
-    if (aNode === this._inspector.selection) {
+    if (aNode === this._inspector.selection.nodeFront) {
       this._inspector.change("markupview");
     }
   },
diff --git a/browser/devtools/netmonitor/netmonitor-controller.js b/browser/devtools/netmonitor/netmonitor-controller.js
index 09441b9f7c1d..b33c61ac8544 100644
--- a/browser/devtools/netmonitor/netmonitor-controller.js
+++ b/browser/devtools/netmonitor/netmonitor-controller.js
@@ -19,8 +19,16 @@ Cu.import("resource:///modules/devtools/ViewHelpers.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "PluralForm",
   "resource://gre/modules/PluralForm.jsm");
 
-XPCOMUtils.defineLazyModuleGetter(this, "NetworkHelper",
-  "resource://gre/modules/devtools/NetworkHelper.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "devtools",
+  "resource://gre/modules/devtools/Loader.jsm");
+
+Object.defineProperty(this, "NetworkHelper", {
+  get: function() {
+    return devtools.require("devtools/toolkit/webconsole/network-helper");
+  },
+  configurable: true,
+  enumerable: true
+});
 
 XPCOMUtils.defineLazyServiceGetter(this, "clipboardHelper",
   "@mozilla.org/widget/clipboardhelper;1", "nsIClipboardHelper");
diff --git a/browser/devtools/profiler/test/head.js b/browser/devtools/profiler/test/head.js
index cbbce3377e75..808ce3f19334 100644
--- a/browser/devtools/profiler/test/head.js
+++ b/browser/devtools/profiler/test/head.js
@@ -19,9 +19,6 @@ let TargetFactory = temp.devtools.TargetFactory;
 Cu.import("resource://gre/modules/devtools/dbg-server.jsm", temp);
 let DebuggerServer = temp.DebuggerServer;
 
-Cu.import("resource:///modules/HUDService.jsm", temp);
-let HUDService = temp.HUDService;
-
 // Import the GCLI test helper
 let testDir = gTestPath.substr(0, gTestPath.lastIndexOf("/"));
 Services.scriptloader.loadSubScript(testDir + "../../../commandline/test/helpers.js", this);
diff --git a/browser/devtools/scratchpad/test/browser_scratchpad_bug_661762_wrong_window_focus.js b/browser/devtools/scratchpad/test/browser_scratchpad_bug_661762_wrong_window_focus.js
index ce28eede500d..6d68f90db21a 100644
--- a/browser/devtools/scratchpad/test/browser_scratchpad_bug_661762_wrong_window_focus.js
+++ b/browser/devtools/scratchpad/test/browser_scratchpad_bug_661762_wrong_window_focus.js
@@ -2,10 +2,6 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
-let tempScope = {};
-Cu.import("resource:///modules/HUDService.jsm", tempScope);
-let HUDService = tempScope.HUDService;
-
 function test()
 {
   waitForExplicitFinish();
@@ -43,7 +39,7 @@ function test()
         Services.obs.
           addObserver(onWebConsoleOpen, "web-console-created", false);
 
-        HUDService.consoleUI.toggleHUD();
+        HUDService.toggleWebConsole();
       });
     });
   }, true);
diff --git a/browser/devtools/shared/DeveloperToolbar.jsm b/browser/devtools/shared/DeveloperToolbar.jsm
index f5b19139c947..ea853cb55e87 100644
--- a/browser/devtools/shared/DeveloperToolbar.jsm
+++ b/browser/devtools/shared/DeveloperToolbar.jsm
@@ -25,9 +25,6 @@ XPCOMUtils.defineLazyModuleGetter(this, "gcli",
 XPCOMUtils.defineLazyModuleGetter(this, "CmdCommands",
                                   "resource:///modules/devtools/BuiltinCommands.jsm");
 
-XPCOMUtils.defineLazyModuleGetter(this, "ConsoleServiceListener",
-                                  "resource://gre/modules/devtools/WebConsoleUtils.jsm");
-
 XPCOMUtils.defineLazyModuleGetter(this, "PluralForm",
                                   "resource://gre/modules/PluralForm.jsm");
 
@@ -55,6 +52,14 @@ let Telemetry = devtools.require("devtools/shared/telemetry");
 
 const converters = require("gcli/converters");
 
+Object.defineProperty(this, "ConsoleServiceListener", {
+  get: function() {
+    return devtools.require("devtools/toolkit/webconsole/utils").ConsoleServiceListener;
+  },
+  configurable: true,
+  enumerable: true
+});
+
 /**
  * A collection of utilities to help working with commands
  */
@@ -400,6 +405,10 @@ DeveloperToolbar.prototype._onload = function DT_onload(aFocus)
   tabbrowser.addEventListener("beforeunload", this, true);
 
   this._initErrorsCount(tabbrowser.selectedTab);
+  this._devtoolsUnloaded = this._devtoolsUnloaded.bind(this);
+  this._devtoolsLoaded = this._devtoolsLoaded.bind(this);
+  Services.obs.addObserver(this._devtoolsUnloaded, "devtools-unloaded", false);
+  Services.obs.addObserver(this._devtoolsLoaded, "devtools-loaded", false);
 
   this._element.hidden = false;
 
@@ -427,6 +436,26 @@ DeveloperToolbar.prototype._onload = function DT_onload(aFocus)
   }
 };
 
+/**
+ * The devtools-unloaded event handler.
+ * @private
+ */
+DeveloperToolbar.prototype._devtoolsUnloaded = function DT__devtoolsUnloaded()
+{
+  let tabbrowser = this._chromeWindow.getBrowser();
+  Array.prototype.forEach.call(tabbrowser.tabs, this._stopErrorsCount, this);
+};
+
+/**
+ * The devtools-loaded event handler.
+ * @private
+ */
+DeveloperToolbar.prototype._devtoolsLoaded = function DT__devtoolsLoaded()
+{
+  let tabbrowser = this._chromeWindow.getBrowser();
+  this._initErrorsCount(tabbrowser.selectedTab);
+};
+
 /**
  * Initialize the listeners needed for tracking the number of errors for a given
  * tab.
@@ -523,6 +552,8 @@ DeveloperToolbar.prototype.destroy = function DT_destroy()
   tabbrowser.removeEventListener("load", this, true);
   tabbrowser.removeEventListener("beforeunload", this, true);
 
+  Services.obs.removeObserver(this._devtoolsUnloaded, "devtools-unloaded");
+  Services.obs.removeObserver(this._devtoolsLoaded, "devtools-loaded");
   Array.prototype.forEach.call(tabbrowser.tabs, this._stopErrorsCount, this);
 
   this.display.focusManager.removeMonitoredElement(this.outputPanel._frame);
diff --git a/browser/devtools/shared/AutocompletePopup.jsm b/browser/devtools/shared/autocomplete-popup.js
similarity index 92%
rename from browser/devtools/shared/AutocompletePopup.jsm
rename to browser/devtools/shared/autocomplete-popup.js
index a42082ef22d0..be0a1500b5e6 100644
--- a/browser/devtools/shared/AutocompletePopup.jsm
+++ b/browser/devtools/shared/autocomplete-popup.js
@@ -3,20 +3,13 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-const Cu = Components.utils;
-const Ci = Components.interfaces;
+"use strict";
 
-// The XUL and XHTML namespace.
+const {Cc, Ci, Cu} = require("chrome");
 const XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
 
-Cu.import("resource://gre/modules/Services.jsm");
-Cu.import("resource://gre/modules/XPCOMUtils.jsm");
-
-XPCOMUtils.defineLazyGetter(this, "gDevTools", function() {
-  return Cu.import("resource:///modules/devtools/gDevTools.jsm", {}).gDevTools;
-});
-
-this.EXPORTED_SYMBOLS = ["AutocompletePopup"];
+loader.lazyImporter(this, "Services", "resource://gre/modules/Services.jsm");
+loader.lazyImporter(this, "gDevTools", "resource:///modules/devtools/gDevTools.jsm");
 
 /**
  * Autocomplete popup UI implementation.
@@ -38,7 +31,6 @@ this.EXPORTED_SYMBOLS = ["AutocompletePopup"];
  *        - onClick {String} The click event handler for the richlistbox.
  *        - onKeypress {String} The keypress event handler for the richlistitems.
  */
-this.AutocompletePopup =
 function AutocompletePopup(aDocument, aOptions = {})
 {
   this._document = aDocument;
@@ -117,6 +109,7 @@ function AutocompletePopup(aDocument, aOptions = {})
     this._list.addEventListener("keypress", this.onKeypress, false);
   }
 }
+exports.AutocompletePopup = AutocompletePopup;
 
 AutocompletePopup.prototype = {
   _document: null,
@@ -268,22 +261,28 @@ AutocompletePopup.prototype = {
    */
   _updateSize: function AP__updateSize()
   {
-    // We need the dispatch to allow the content to reflow. Attempting to
-    // update the richlistbox size too early does not work.
-    Services.tm.currentThread.dispatch({ run: () => {
-      if (!this._panel) {
-        return;
-      }
-      this._list.width = this._panel.clientWidth + this._scrollbarWidth;
-      // Height change is required, otherwise the panel is drawn at an offset
-      // the first time.
-      this._list.height = this._list.clientHeight;
-      // This brings the panel back at right position.
-      this._list.top = 0;
-      // Changing panel height might make the selected item out of view, so
-      // bring it back to view.
-      this._list.ensureIndexIsVisible(this._list.selectedIndex);
-    }}, 0);
+    if (!this._panel) {
+      return;
+    }
+    // Flush the layout so that we get the latest height.
+    this._panel.boxObject.height;
+    let height = {};
+    this._list.scrollBoxObject.getScrolledSize({}, height);
+    // Change the width of the popup only if the scrollbar is visible.
+    if (height.value > this._panel.clientHeight) {
+       this._list.width = this._panel.clientWidth + this._scrollbarWidth;
+    }
+    // Height change is required, otherwise the panel is drawn at an offset
+    // the first time.
+    this._list.height = this._list.clientHeight;
+    // This brings the panel back at right position.
+    this._list.top = 0;
+    // Move the panel to -1,-1 to realign the popup with its anchor node when
+    // decreasing the panel height.
+    this._panel.moveTo(-1, -1);
+    // Changing panel height might make the selected item out of view, so
+    // bring it back to view.
+    this._list.ensureIndexIsVisible(this._list.selectedIndex);
   },
 
   /**
diff --git a/browser/devtools/shared/test/browser_toolbar_webconsole_errors_count.js b/browser/devtools/shared/test/browser_toolbar_webconsole_errors_count.js
index aaf027451e14..51f6e2e58fb3 100644
--- a/browser/devtools/shared/test/browser_toolbar_webconsole_errors_count.js
+++ b/browser/devtools/shared/test/browser_toolbar_webconsole_errors_count.js
@@ -7,8 +7,6 @@ function test() {
   const TEST_URI = "http://example.com/browser/browser/devtools/shared/test/" +
                    "browser_toolbar_webconsole_errors_count.html";
 
-  let HUDService = Cu.import("resource:///modules/HUDService.jsm",
-                             {}).HUDService;
   let gDevTools = Cu.import("resource:///modules/devtools/gDevTools.jsm",
                              {}).gDevTools;
 
diff --git a/browser/devtools/shared/widgets/SideMenuWidget.jsm b/browser/devtools/shared/widgets/SideMenuWidget.jsm
index 7d741a10978c..c24e36f81ad2 100644
--- a/browser/devtools/shared/widgets/SideMenuWidget.jsm
+++ b/browser/devtools/shared/widgets/SideMenuWidget.jsm
@@ -14,8 +14,16 @@ Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource:///modules/devtools/ViewHelpers.jsm");
 Cu.import("resource:///modules/devtools/shared/event-emitter.js");
 
-XPCOMUtils.defineLazyModuleGetter(this, "NetworkHelper",
-  "resource://gre/modules/devtools/NetworkHelper.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "devtools",
+  "resource://gre/modules/devtools/Loader.jsm");
+
+Object.defineProperty(this, "NetworkHelper", {
+  get: function() {
+    return devtools.require("devtools/toolkit/webconsole/network-helper");
+  },
+  configurable: true,
+  enumerable: true
+});
 
 this.EXPORTED_SYMBOLS = ["SideMenuWidget"];
 
@@ -629,7 +637,12 @@ SideMenuItem.prototype = {
       checkbox.removeAttribute("checked");
     }
 
-    checkbox.addEventListener("command", function () {
+    // Stop the toggling of the checkbox from selecting the list item.
+    checkbox.addEventListener("mousedown", function (event) {
+      event.stopPropagation();
+    }, false);
+
+    checkbox.addEventListener("command", function (event) {
       ViewHelpers.dispatchEvent(checkbox, "check", {
         checked: checkbox.checked,
       });
diff --git a/browser/devtools/shared/widgets/VariablesView.jsm b/browser/devtools/shared/widgets/VariablesView.jsm
index fc32b33416e7..c4e90c0c6707 100644
--- a/browser/devtools/shared/widgets/VariablesView.jsm
+++ b/browser/devtools/shared/widgets/VariablesView.jsm
@@ -23,11 +23,24 @@ Cu.import("resource:///modules/devtools/ViewHelpers.jsm");
 Cu.import("resource:///modules/devtools/shared/event-emitter.js");
 let promise = Cu.import("resource://gre/modules/commonjs/sdk/core/promise.js").Promise;
 
-XPCOMUtils.defineLazyModuleGetter(this, "NetworkHelper",
-  "resource://gre/modules/devtools/NetworkHelper.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "devtools",
+  "resource://gre/modules/devtools/Loader.jsm");
 
-XPCOMUtils.defineLazyModuleGetter(this, "WebConsoleUtils",
-  "resource://gre/modules/devtools/WebConsoleUtils.jsm");
+Object.defineProperty(this, "WebConsoleUtils", {
+  get: function() {
+    return devtools.require("devtools/toolkit/webconsole/utils").Utils;
+  },
+  configurable: true,
+  enumerable: true
+});
+
+Object.defineProperty(this, "NetworkHelper", {
+  get: function() {
+    return devtools.require("devtools/toolkit/webconsole/network-helper");
+  },
+  configurable: true,
+  enumerable: true
+});
 
 this.EXPORTED_SYMBOLS = ["VariablesView"];
 
diff --git a/browser/devtools/shared/widgets/VariablesViewController.jsm b/browser/devtools/shared/widgets/VariablesViewController.jsm
index 732fe94e5552..35268faca1b4 100644
--- a/browser/devtools/shared/widgets/VariablesViewController.jsm
+++ b/browser/devtools/shared/widgets/VariablesViewController.jsm
@@ -12,7 +12,17 @@ Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 let promise = Cu.import("resource://gre/modules/commonjs/sdk/core/promise.js").Promise;
 Cu.import("resource:///modules/devtools/VariablesView.jsm");
 Cu.import("resource:///modules/devtools/ViewHelpers.jsm");
-Cu.import("resource://gre/modules/devtools/WebConsoleUtils.jsm");
+
+XPCOMUtils.defineLazyModuleGetter(this, "devtools",
+  "resource://gre/modules/devtools/Loader.jsm");
+
+Object.defineProperty(this, "WebConsoleUtils", {
+  get: function() {
+    return devtools.require("devtools/toolkit/webconsole/utils").Utils;
+  },
+  configurable: true,
+  enumerable: true
+});
 
 XPCOMUtils.defineLazyGetter(this, "VARIABLES_SORTING_ENABLED", () =>
   Services.prefs.getBoolPref("devtools.debugger.ui.variables-sorting-enabled")
diff --git a/browser/devtools/styleeditor/StyleEditorUI.jsm b/browser/devtools/styleeditor/StyleEditorUI.jsm
index 57c0e3a1c991..7e1f8dcdaf61 100644
--- a/browser/devtools/styleeditor/StyleEditorUI.jsm
+++ b/browser/devtools/styleeditor/StyleEditorUI.jsm
@@ -149,7 +149,7 @@ StyleEditorUI.prototype = {
    */
   _onStyleSheetsCleared: function() {
     // remember selected sheet and line number for next load
-    if (this.selectedEditor) {
+    if (this.selectedEditor && this.selectedEditor.sourceEditor) {
       let href = this.selectedEditor.styleSheet.href;
       let {line, col} = this.selectedEditor.sourceEditor.getCaretPosition();
       this.selectStyleSheet(href, line, col);
diff --git a/browser/devtools/styleinspector/rule-view.js b/browser/devtools/styleinspector/rule-view.js
index 7f99c7071186..dda9bb63356d 100644
--- a/browser/devtools/styleinspector/rule-view.js
+++ b/browser/devtools/styleinspector/rule-view.js
@@ -1891,6 +1891,4 @@ XPCOMUtils.defineLazyGetter(this, "domUtils", function() {
   return Cc["@mozilla.org/inspector/dom-utils;1"].getService(Ci.inIDOMUtils);
 });
 
-XPCOMUtils.defineLazyGetter(this, "AutocompletePopup", function() {
-  return Cu.import("resource:///modules/devtools/AutocompletePopup.jsm", {}).AutocompletePopup;
-});
+loader.lazyGetter(this, "AutocompletePopup", () => require("devtools/shared/autocomplete-popup").AutocompletePopup);
diff --git a/browser/devtools/webconsole/Makefile.in b/browser/devtools/webconsole/Makefile.in
index efe47b51c44d..e839f960f6bd 100644
--- a/browser/devtools/webconsole/Makefile.in
+++ b/browser/devtools/webconsole/Makefile.in
@@ -12,4 +12,4 @@ include $(DEPTH)/config/autoconf.mk
 include $(topsrcdir)/config/rules.mk
 
 libs::
-	$(NSINSTALL) $(srcdir)/*.js $(FINAL_TARGET)/modules/devtools/framework
+	$(NSINSTALL) $(srcdir)/*.js $(FINAL_TARGET)/modules/devtools/webconsole
diff --git a/browser/devtools/webconsole/console-output.js b/browser/devtools/webconsole/console-output.js
new file mode 100644
index 000000000000..4a11c88f1425
--- /dev/null
+++ b/browser/devtools/webconsole/console-output.js
@@ -0,0 +1,311 @@
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+const Heritage = require("sdk/core/heritage");
+const XHTML_NS = "http://www.w3.org/1999/xhtml";
+const XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+// Constants for compatibility with the Web Console output implementation before
+// bug 778766.
+// TODO: remove these once bug 778766 is fixed.
+const COMPAT = {
+  // The various categories of messages.
+  CATEGORIES: {
+    NETWORK: 0,
+    CSS: 1,
+    JS: 2,
+    WEBDEV: 3,
+    INPUT: 4,
+    OUTPUT: 5,
+    SECURITY: 6,
+  },
+
+  // The possible message severities.
+  SEVERITIES: {
+    ERROR: 0,
+    WARNING: 1,
+    INFO: 2,
+    LOG: 3,
+  },
+};
+
+/**
+ * The ConsoleOutput object is used to manage output of messages in the Web
+ * Console.
+ *
+ * @constructor
+ * @param object owner
+ *        The console output owner. This usually the WebConsoleFrame instance.
+ *        Any other object can be used, as long as it has the following
+ *        properties and methods:
+ *          - window
+ *          - document
+ *          - outputMessage(category, methodOrNode[, methodArguments])
+ *            TODO: this is needed temporarily, until bug 778766 is fixed.
+ */
+function ConsoleOutput(owner)
+{
+  this.owner = owner;
+  this._onFlushOutputMessage = this._onFlushOutputMessage.bind(this);
+}
+
+ConsoleOutput.prototype = {
+  /**
+   * The document that holds the output.
+   * @type DOMDocument
+   */
+  get document() this.owner.document,
+
+  /**
+   * The DOM window that holds the output.
+   * @type Window
+   */
+  get window() this.owner.window,
+
+  /**
+   * Add a message to output.
+   *
+   * @param object ...args
+   *        Any number of Message objects.
+   * @return this
+   */
+  addMessage: function(...args)
+  {
+    for (let msg of args) {
+      msg.init(this);
+      this.owner.outputMessage(msg._categoryCompat, this._onFlushOutputMessage,
+                               [msg]);
+    }
+    return this;
+  },
+
+  /**
+   * Message renderer used for compatibility with the current Web Console output
+   * implementation. This method is invoked for every message object that is
+   * flushed to output. The message object is initialized and rendered, then it
+   * is displayed.
+   *
+   * TODO: remove this method once bug 778766 is fixed.
+   *
+   * @private
+   * @param object message
+   *        The message object to render.
+   * @return DOMElement
+   *         The message DOM element that can be added to the console output.
+   */
+  _onFlushOutputMessage: function(message)
+  {
+    return message.render().element;
+  },
+
+  /**
+   * Destroy this ConsoleOutput instance.
+   */
+  destroy: function()
+  {
+    this.owner = null;
+  },
+}; // ConsoleOutput.prototype
+
+/**
+ * Message objects container.
+ * @type object
+ */
+let Messages = {};
+
+/**
+ * The BaseMessage object is used for all types of messages. Every kind of
+ * message should use this object as its base.
+ *
+ * @constructor
+ */
+Messages.BaseMessage = function()
+{
+  this.widgets = new Set();
+};
+
+Messages.BaseMessage.prototype = {
+  /**
+   * Reference to the ConsoleOutput owner.
+   *
+   * @type object|null
+   *       This is |null| if the message is not yet initialized.
+   */
+  output: null,
+
+  /**
+   * Reference to the parent message object, if this message is in a group or if
+   * it is otherwise owned by another message.
+   *
+   * @type object|null
+   */
+  parent: null,
+
+  /**
+   * Message DOM element.
+   *
+   * @type DOMElement|null
+   *       This is |null| if the message is not yet rendered.
+   */
+  element: null,
+
+  /**
+   * Tells if this message is visible or not.
+   * @type boolean
+   */
+  get visible() {
+    return this.element && this.element.parentNode;
+  },
+
+  /**
+   * Holds the text-only representation of the message.
+   * @type string
+   */
+  textContent: "",
+
+  /**
+   * Set of widgets included in this message.
+   * @type Set
+   */
+  widgets: null,
+
+  // Properties that allow compatibility with the current Web Console output
+  // implementation.
+  _elementClassCompat: "",
+  _categoryCompat: null,
+  _severityCompat: null,
+
+  /**
+   * Initialize the message.
+   *
+   * @param object output
+   *        The ConsoleOutput owner.
+   * @param object [parent=null]
+   *        Optional: a different message object that owns this instance.
+   * @return this
+   */
+  init: function(output, parent=null)
+  {
+    this.output = output;
+    this.parent = parent;
+    return this;
+  },
+
+  /**
+   * Render the message. After this method is invoked the |element| property
+   * will point to the DOM element of this message.
+   * @return this
+   */
+  render: function()
+  {
+    if (!this.element) {
+      this.element = this._renderCompat();
+    }
+    return this;
+  },
+
+  /**
+   * Prepare the message container for the Web Console, such that it is
+   * compatible with the current implementation.
+   * TODO: remove this once bug 778766.
+   */
+  _renderCompat: function()
+  {
+    let doc = this.output.document;
+    let container = doc.createElementNS(XUL_NS, "richlistitem");
+    container.setAttribute("id", "console-msg-" + gSequenceId());
+    container.setAttribute("class", "hud-msg-node " + this._elementClassCompat);
+    container.category = this._categoryCompat;
+    container.severity = this._severityCompat;
+    container.clipboardText = this.textContent;
+    container.timestamp = this.timestamp;
+    container._messageObject = this;
+
+    let body = doc.createElementNS(XUL_NS, "description");
+    body.flex = 1;
+    body.classList.add("webconsole-msg-body");
+    container.appendChild(body);
+
+    return container;
+  },
+}; // Messages.BaseMessage.prototype
+
+
+/**
+ * The NavigationMarker is used to show a page load event.
+ *
+ * @constructor
+ * @extends Messages.BaseMessage
+ * @param string url
+ *        The URL to display.
+ * @param number timestamp
+ *        The message date and time, milliseconds elapsed since 1 January 1970
+ *        00:00:00 UTC.
+ */
+Messages.NavigationMarker = function(url, timestamp)
+{
+  Messages.BaseMessage.apply(this, arguments);
+  this._url = url;
+  this.textContent = "------ " + url;
+  this.timestamp = timestamp;
+};
+
+Messages.NavigationMarker.prototype = Heritage.extend(Messages.BaseMessage.prototype,
+{
+  /**
+   * Message timestamp.
+   *
+   * @type number
+   *       Milliseconds elapsed since 1 January 1970 00:00:00 UTC.
+   */
+  timestamp: 0,
+
+  // Class names in order: category, severity then the class for the filter.
+  _elementClassCompat: "webconsole-msg-network webconsole-msg-info hud-networkinfo",
+  _categoryCompat: COMPAT.CATEGORIES.NETWORK,
+  _severityCompat: COMPAT.SEVERITIES.LOG,
+
+  /**
+   * Prepare the DOM element for this message.
+   * @return this
+   */
+  render: function()
+  {
+    if (this.element) {
+      return this;
+    }
+
+    let url = this._url;
+    let pos = url.indexOf("?");
+    if (pos > -1) {
+      url = url.substr(0, pos);
+    }
+
+    let doc = this.output.document;
+    let urlnode = doc.createElementNS(XHTML_NS, "span");
+    urlnode.className = "url";
+    urlnode.textContent = url;
+
+    // Add the text in the xul:description.webconsole-msg-body element.
+    let render = Messages.BaseMessage.prototype.render.bind(this);
+    render().element.firstChild.appendChild(urlnode);
+    this.element.classList.add("navigation-marker");
+    this.element.url = this._url;
+
+    return this;
+  },
+}); // Messages.NavigationMarker.prototype
+
+
+function gSequenceId()
+{
+  return gSequenceId.n++;
+}
+gSequenceId.n = 0;
+
+exports.ConsoleOutput = ConsoleOutput;
+exports.Messages = Messages;
diff --git a/browser/devtools/webconsole/HUDService.jsm b/browser/devtools/webconsole/hudservice.js
similarity index 84%
rename from browser/devtools/webconsole/HUDService.jsm
rename to browser/devtools/webconsole/hudservice.js
index b9ae7d42c99c..5973634874e0 100644
--- a/browser/devtools/webconsole/HUDService.jsm
+++ b/browser/devtools/webconsole/hudservice.js
@@ -6,37 +6,19 @@
 
 "use strict";
 
-const Cc = Components.classes;
-const Ci = Components.interfaces;
-const Cu = Components.utils;
+const {Cc, Ci, Cu} = require("chrome");
 
-Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+let WebConsoleUtils = require("devtools/toolkit/webconsole/utils").Utils;
+let Heritage = require("sdk/core/heritage");
 
-XPCOMUtils.defineLazyModuleGetter(this, "gDevTools",
-    "resource:///modules/devtools/gDevTools.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "devtools",
-    "resource://gre/modules/devtools/Loader.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "Services",
-    "resource://gre/modules/Services.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "DebuggerServer",
-  "resource://gre/modules/devtools/dbg-server.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "DebuggerClient",
-  "resource://gre/modules/devtools/dbg-client.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "WebConsoleUtils",
-    "resource://gre/modules/devtools/WebConsoleUtils.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "promise",
-    "resource://gre/modules/commonjs/sdk/core/promise.js", "Promise");
-
-XPCOMUtils.defineLazyModuleGetter(this, "Heritage",
-    "resource:///modules/devtools/ViewHelpers.jsm");
-
-let Telemetry = devtools.require("devtools/shared/telemetry");
+loader.lazyGetter(this, "promise", () => require("sdk/core/promise"));
+loader.lazyGetter(this, "Telemetry", () => require("devtools/shared/telemetry"));
+loader.lazyGetter(this, "WebConsoleFrame", () => require("devtools/webconsole/webconsole").WebConsoleFrame);
+loader.lazyImporter(this, "gDevTools", "resource:///modules/devtools/gDevTools.jsm");
+loader.lazyImporter(this, "devtools", "resource://gre/modules/devtools/Loader.jsm");
+loader.lazyImporter(this, "Services", "resource://gre/modules/Services.jsm");
+loader.lazyImporter(this, "DebuggerServer", "resource://gre/modules/devtools/dbg-server.jsm");
+loader.lazyImporter(this, "DebuggerClient", "resource://gre/modules/devtools/dbg-client.jsm");
 
 const STRINGS_URI = "chrome://browser/locale/devtools/webconsole.properties";
 let l10n = new WebConsoleUtils.l10n(STRINGS_URI);
@@ -46,32 +28,36 @@ const BROWSER_CONSOLE_WINDOW_FEATURES = "chrome,titlebar,toolbar,centerscreen,re
 // The preference prefix for all of the Browser Console filters.
 const BROWSER_CONSOLE_FILTER_PREFS_PREFIX = "devtools.browserconsole.filter.";
 
-this.EXPORTED_SYMBOLS = ["HUDService"];
-
 ///////////////////////////////////////////////////////////////////////////
 //// The HUD service
 
 function HUD_SERVICE()
 {
-  this.hudReferences = {};
+  this.consoles = new Map();
+  this.lastFinishedRequest = { callback: null };
 }
 
 HUD_SERVICE.prototype =
 {
-  /**
-   * Keeps a reference for each HeadsUpDisplay that is created
-   * @type object
-   */
-  hudReferences: null,
+  _browserConsoleID: null,
+  _browserConsoleDefer: null,
 
   /**
-   * getter for UI commands to be used by the frontend
-   *
-   * @returns object
+   * Keeps a reference for each Web Console / Browser Console that is created.
+   * @type Map
    */
-  get consoleUI() {
-    return HeadsUpDisplayUICommands;
-  },
+  consoles: null,
+
+  /**
+   * Assign a function to this property to listen for every request that
+   * completes. Used by unit tests. The callback takes one argument: the HTTP
+   * activity object as received from the remote Web Console.
+   *
+   * @type object
+   *       Includes a property named |callback|. Assign the function to the
+   *       |callback| property of this object.
+   */
+  lastFinishedRequest: null,
 
   /**
    * Firefox-specific current tab getter
@@ -100,14 +86,14 @@ HUD_SERVICE.prototype =
   function HS_openWebConsole(aTarget, aIframeWindow, aChromeWindow)
   {
     let hud = new WebConsole(aTarget, aIframeWindow, aChromeWindow);
-    this.hudReferences[hud.hudId] = hud;
+    this.consoles.set(hud.hudId, hud);
     return hud.init();
   },
 
   /**
    * Open a Browser Console for the given target.
    *
-   * @see devtools/framework/Target.jsm for details about targets.
+   * @see devtools/framework/target.js for details about targets.
    *
    * @param object aTarget
    *        The target that the browser console will connect to.
@@ -122,19 +108,19 @@ HUD_SERVICE.prototype =
   function HS_openBrowserConsole(aTarget, aIframeWindow, aChromeWindow)
   {
     let hud = new BrowserConsole(aTarget, aIframeWindow, aChromeWindow);
-    this.hudReferences[hud.hudId] = hud;
+    this.consoles.set(hud.hudId, hud);
     return hud.init();
   },
 
   /**
-   * Returns the HeadsUpDisplay object associated to a content window.
+   * Returns the Web Console object associated to a content window.
    *
    * @param nsIDOMWindow aContentWindow
    * @returns object
    */
   getHudByWindow: function HS_getHudByWindow(aContentWindow)
   {
-    for each (let hud in this.hudReferences) {
+    for (let [hudId, hud] of this.consoles) {
       let target = hud.target;
       if (target && target.tab && target.window === aContentWindow) {
         return hud;
@@ -144,37 +130,152 @@ HUD_SERVICE.prototype =
   },
 
   /**
-   * Returns the hudId that is corresponding to the hud activated for the
-   * passed aContentWindow. If there is no matching hudId null is returned.
-   *
-   * @param nsIDOMWindow aContentWindow
-   * @returns string or null
-   */
-  getHudIdByWindow: function HS_getHudIdByWindow(aContentWindow)
-  {
-    let hud = this.getHudByWindow(aContentWindow);
-    return hud ? hud.hudId : null;
-  },
-
-  /**
-   * Returns the hudReference for a given id.
+   * Returns the console instance for a given id.
    *
    * @param string aId
    * @returns Object
    */
   getHudReferenceById: function HS_getHudReferenceById(aId)
   {
-    return aId in this.hudReferences ? this.hudReferences[aId] : null;
+    return this.consoles.get(aId);
   },
 
   /**
-   * Assign a function to this property to listen for every request that
-   * completes. Used by unit tests. The callback takes one argument: the HTTP
-   * activity object as received from the remote Web Console.
+   * Toggle the Web Console for the current tab.
    *
-   * @type function
+   * @return object
+   *         A promise for either the opening of the toolbox that holds the Web
+   *         Console, or a Promise for the closing of the toolbox.
    */
-  lastFinishedRequestCallback: null,
+  toggleWebConsole: function HS_toggleWebConsole()
+  {
+    let window = this.currentContext();
+    let target = devtools.TargetFactory.forTab(window.gBrowser.selectedTab);
+    let toolbox = gDevTools.getToolbox(target);
+
+    return toolbox && toolbox.currentToolId == "webconsole" ?
+        toolbox.destroy() :
+        gDevTools.showToolbox(target, "webconsole");
+  },
+
+  /**
+   * Find if there is a Web Console open for the current tab and return the
+   * instance.
+   * @return object|null
+   *         The WebConsole object or null if the active tab has no open Web
+   *         Console.
+   */
+  getOpenWebConsole: function HS_getOpenWebConsole()
+  {
+    let tab = this.currentContext().gBrowser.selectedTab;
+    if (!tab || !devtools.TargetFactory.isKnownTab(tab)) {
+      return null;
+    }
+    let target = devtools.TargetFactory.forTab(tab);
+    let toolbox = gDevTools.getToolbox(target);
+    let panel = toolbox ? toolbox.getPanel("webconsole") : null;
+    return panel ? panel.hud : null;
+  },
+
+  /**
+   * Toggle the Browser Console.
+   */
+  toggleBrowserConsole: function HS_toggleBrowserConsole()
+  {
+    if (this._browserConsoleID) {
+      let hud = this.getHudReferenceById(this._browserConsoleID);
+      return hud.destroy();
+    }
+
+    if (this._browserConsoleDefer) {
+      return this._browserConsoleDefer.promise;
+    }
+
+    this._browserConsoleDefer = promise.defer();
+
+    function connect()
+    {
+      let deferred = promise.defer();
+
+      if (!DebuggerServer.initialized) {
+        DebuggerServer.init();
+        DebuggerServer.addBrowserActors();
+      }
+
+      let client = new DebuggerClient(DebuggerServer.connectPipe());
+      client.connect(() =>
+        client.listTabs((aResponse) => {
+          // Add Global Process debugging...
+          let globals = JSON.parse(JSON.stringify(aResponse));
+          delete globals.tabs;
+          delete globals.selected;
+          // ...only if there are appropriate actors (a 'from' property will
+          // always be there).
+          if (Object.keys(globals).length > 1) {
+            deferred.resolve({ form: globals, client: client, chrome: true });
+          } else {
+            deferred.reject("Global console not found!");
+          }
+        }));
+
+      return deferred.promise;
+    }
+
+    let target;
+    function getTarget(aConnection)
+    {
+      let options = {
+        form: aConnection.form,
+        client: aConnection.client,
+        chrome: true,
+      };
+
+      return devtools.TargetFactory.forRemoteTab(options);
+    }
+
+    function openWindow(aTarget)
+    {
+      target = aTarget;
+
+      let deferred = promise.defer();
+
+      let win = Services.ww.openWindow(null, devtools.Tools.webConsole.url, "_blank",
+                                       BROWSER_CONSOLE_WINDOW_FEATURES, null);
+      win.addEventListener("DOMContentLoaded", function onLoad() {
+        win.removeEventListener("DOMContentLoaded", onLoad);
+
+        // Set the correct Browser Console title.
+        let root = win.document.documentElement;
+        root.setAttribute("title", root.getAttribute("browserConsoleTitle"));
+
+        deferred.resolve(win);
+      });
+
+      return deferred.promise;
+    }
+
+    connect().then(getTarget).then(openWindow).then((aWindow) =>
+      this.openBrowserConsole(target, aWindow, aWindow)
+        .then((aBrowserConsole) => {
+          this._browserConsoleID = aBrowserConsole.hudId;
+          this._browserConsoleDefer.resolve(aBrowserConsole);
+          this._browserConsoleDefer = null;
+        }));
+
+    return this._browserConsoleDefer.promise;
+  },
+
+  /**
+   * Get the Browser Console instance, if open.
+   *
+   * @return object|null
+   *         A BrowserConsole instance or null if the Browser Console is not
+   *         open.
+   */
+  getBrowserConsole: function HS_getBrowserConsole()
+  {
+    return this.getHudReferenceById(this._browserConsoleID);
+  },
 };
 
 
@@ -209,7 +310,7 @@ function WebConsole(aTarget, aIframeWindow, aChromeWindow)
     this.browserWindow = HUDService.currentContext();
   }
 
-  this.ui = new this.iframeWindow.WebConsoleFrame(this);
+  this.ui = new WebConsoleFrame(this);
 }
 
 WebConsole.prototype = {
@@ -223,12 +324,13 @@ WebConsole.prototype = {
   _destroyer: null,
 
   /**
-   * Getter for HUDService.lastFinishedRequestCallback.
+   * Getter for a function to to listen for every request that completes. Used
+   * by unit tests. The callback takes one argument: the HTTP activity object as
+   * received from the remote Web Console.
    *
-   * @see HUDService.lastFinishedRequestCallback
    * @type function
    */
-  get lastFinishedRequestCallback() HUDService.lastFinishedRequestCallback,
+  get lastFinishedRequestCallback() HUDService.lastFinishedRequest.callback,
 
   /**
    * Getter for the xul:popupset that holds any popups we open.
@@ -471,7 +573,7 @@ WebConsole.prototype = {
       return this._destroyer.promise;
     }
 
-    delete HUDService.hudReferences[this.hudId];
+    HUDService.consoles.delete(this.hudId);
 
     this._destroyer = promise.defer();
 
@@ -592,7 +694,7 @@ BrowserConsole.prototype = Heritage.extend(WebConsole.prototype,
     let chromeWindow = this.chromeWindow;
     this.$destroy().then(() =>
       this.target.client.close(() => {
-        HeadsUpDisplayUICommands._browserConsoleID = null;
+        HUDService._browserConsoleID = null;
         chromeWindow.close();
         this._bc_destroyer.resolve(null);
       }));
@@ -601,144 +703,16 @@ BrowserConsole.prototype = Heritage.extend(WebConsole.prototype,
   },
 });
 
-
-//////////////////////////////////////////////////////////////////////////
-// HeadsUpDisplayUICommands
-//////////////////////////////////////////////////////////////////////////
-
-var HeadsUpDisplayUICommands = {
-  _browserConsoleID: null,
-  _browserConsoleDefer: null,
-
-  /**
-   * Toggle the Web Console for the current tab.
-   *
-   * @return object
-   *         A promise for either the opening of the toolbox that holds the Web
-   *         Console, or a promise for the closing of the toolbox.
-   */
-  toggleHUD: function UIC_toggleHUD()
-  {
-    let window = HUDService.currentContext();
-    let target = devtools.TargetFactory.forTab(window.gBrowser.selectedTab);
-    let toolbox = gDevTools.getToolbox(target);
-
-    return toolbox && toolbox.currentToolId == "webconsole" ?
-        toolbox.destroy() :
-        gDevTools.showToolbox(target, "webconsole");
-  },
-
-  /**
-   * Find if there is a Web Console open for the current tab and return the
-   * instance.
-   * @return object|null
-   *         The WebConsole object or null if the active tab has no open Web
-   *         Console.
-   */
-  getOpenHUD: function UIC_getOpenHUD()
-  {
-    let tab = HUDService.currentContext().gBrowser.selectedTab;
-    if (!tab || !devtools.TargetFactory.isKnownTab(tab)) {
-      return null;
-    }
-    let target = devtools.TargetFactory.forTab(tab);
-    let toolbox = gDevTools.getToolbox(target);
-    let panel = toolbox ? toolbox.getPanel("webconsole") : null;
-    return panel ? panel.hud : null;
-  },
-
-  /**
-   * Toggle the Browser Console.
-   */
-  toggleBrowserConsole: function UIC_toggleBrowserConsole()
-  {
-    if (this._browserConsoleID) {
-      let hud = HUDService.getHudReferenceById(this._browserConsoleID);
-      return hud.destroy();
-    }
-
-    if (this._browserConsoleDefer) {
-      return this._browserConsoleDefer.promise;
-    }
-
-    this._browserConsoleDefer = promise.defer();
-
-    function connect()
-    {
-      let deferred = promise.defer();
-
-      if (!DebuggerServer.initialized) {
-        DebuggerServer.init();
-        DebuggerServer.addBrowserActors();
-      }
-
-      let client = new DebuggerClient(DebuggerServer.connectPipe());
-      client.connect(() =>
-        client.listTabs((aResponse) => {
-          // Add Global Process debugging...
-          let globals = JSON.parse(JSON.stringify(aResponse));
-          delete globals.tabs;
-          delete globals.selected;
-          // ...only if there are appropriate actors (a 'from' property will
-          // always be there).
-          if (Object.keys(globals).length > 1) {
-            deferred.resolve({ form: globals, client: client, chrome: true });
-          } else {
-            deferred.reject("Global console not found!");
-          }
-        }));
-
-      return deferred.promise;
-    }
-
-    let target;
-    function getTarget(aConnection)
-    {
-      let options = {
-        form: aConnection.form,
-        client: aConnection.client,
-        chrome: true,
-      };
-
-      return devtools.TargetFactory.forRemoteTab(options);
-    }
-
-    function openWindow(aTarget)
-    {
-      target = aTarget;
-
-      let deferred = promise.defer();
-
-      let win = Services.ww.openWindow(null, devtools.Tools.webConsole.url, "_blank",
-                                       BROWSER_CONSOLE_WINDOW_FEATURES, null);
-      win.addEventListener("DOMContentLoaded", function onLoad() {
-        win.removeEventListener("DOMContentLoaded", onLoad);
-
-        // Set the correct Browser Console title.
-        let root = win.document.documentElement;
-        root.setAttribute("title", root.getAttribute("browserConsoleTitle"));
-
-        deferred.resolve(win);
-      });
-
-      return deferred.promise;
-    }
-
-    connect().then(getTarget).then(openWindow).then((aWindow) =>
-      HUDService.openBrowserConsole(target, aWindow, aWindow)
-        .then((aBrowserConsole) => {
-          this._browserConsoleID = aBrowserConsole.hudId;
-          this._browserConsoleDefer.resolve(aBrowserConsole);
-          this._browserConsoleDefer = null;
-        }));
-
-    return this._browserConsoleDefer.promise;
-  },
-
-  get browserConsole() {
-    return HUDService.getHudReferenceById(this._browserConsoleID);
-  },
-};
-
 const HUDService = new HUD_SERVICE();
 
+(() => {
+  let methods = ["openWebConsole", "openBrowserConsole", "toggleWebConsole",
+                 "toggleBrowserConsole", "getOpenWebConsole",
+                 "getBrowserConsole", "getHudByWindow", "getHudReferenceById"];
+  for (let method of methods) {
+    exports[method] = HUDService[method].bind(HUDService);
+  }
+
+  exports.consoles = HUDService.consoles;
+  exports.lastFinishedRequest = HUDService.lastFinishedRequest;
+})();
diff --git a/browser/devtools/webconsole/moz.build b/browser/devtools/webconsole/moz.build
index 5e52007dc97b..86ec4674859a 100644
--- a/browser/devtools/webconsole/moz.build
+++ b/browser/devtools/webconsole/moz.build
@@ -5,10 +5,3 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 TEST_DIRS += ['test']
-
-EXTRA_JS_MODULES += [
-    'HUDService.jsm',
-    'NetworkPanel.jsm',
-    'WebConsolePanel.jsm',
-]
-
diff --git a/browser/devtools/webconsole/NetworkPanel.jsm b/browser/devtools/webconsole/network-panel.js
similarity index 97%
rename from browser/devtools/webconsole/NetworkPanel.jsm
rename to browser/devtools/webconsole/network-panel.js
index 1ca0864a7618..424b3459c489 100644
--- a/browser/devtools/webconsole/NetworkPanel.jsm
+++ b/browser/devtools/webconsole/network-panel.js
@@ -6,28 +6,17 @@
 
 "use strict";
 
-const Cc = Components.classes;
-const Ci = Components.interfaces;
-const Cu = Components.utils;
+const {Cc, Ci, Cu} = require("chrome");
 
-Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+loader.lazyGetter(this, "NetworkHelper", () => require("devtools/toolkit/webconsole/network-helper"));
+loader.lazyImporter(this, "NetUtil", "resource://gre/modules/NetUtil.jsm");
+loader.lazyServiceGetter(this, "mimeService", "@mozilla.org/mime;1", "nsIMIMEService");
 
-XPCOMUtils.defineLazyServiceGetter(this, "mimeService", "@mozilla.org/mime;1",
-                                   "nsIMIMEService");
-
-XPCOMUtils.defineLazyModuleGetter(this, "NetworkHelper",
-                                  "resource://gre/modules/devtools/NetworkHelper.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "NetUtil",
-                                  "resource://gre/modules/NetUtil.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "WebConsoleUtils",
-                                  "resource://gre/modules/devtools/WebConsoleUtils.jsm");
+let WebConsoleUtils = require("devtools/toolkit/webconsole/utils").Utils;
 
 const STRINGS_URI = "chrome://browser/locale/devtools/webconsole.properties";
 let l10n = new WebConsoleUtils.l10n(STRINGS_URI);
 
-this.EXPORTED_SYMBOLS = ["NetworkPanel"];
 
 /**
  * Creates a new NetworkPanel.
@@ -41,7 +30,6 @@ this.EXPORTED_SYMBOLS = ["NetworkPanel"];
  *        The parent WebConsoleFrame object that owns this network panel
  *        instance.
  */
-this.NetworkPanel =
 function NetworkPanel(aParent, aHttpActivity, aWebConsoleFrame)
 {
   let doc = aParent.ownerDocument;
@@ -108,6 +96,7 @@ function NetworkPanel(aParent, aHttpActivity, aWebConsoleFrame)
 
   aParent.appendChild(this.panel);
 }
+exports.NetworkPanel = NetworkPanel;
 
 NetworkPanel.prototype =
 {
diff --git a/browser/devtools/webconsole/WebConsolePanel.jsm b/browser/devtools/webconsole/panel.js
similarity index 82%
rename from browser/devtools/webconsole/WebConsolePanel.jsm
rename to browser/devtools/webconsole/panel.js
index 03f421b427e1..48a71f576ec5 100644
--- a/browser/devtools/webconsole/WebConsolePanel.jsm
+++ b/browser/devtools/webconsole/panel.js
@@ -4,29 +4,22 @@
 
 "use strict";
 
-this.EXPORTED_SYMBOLS = [ "WebConsolePanel" ];
+const {Cc, Ci, Cu} = require("chrome");
 
-const { classes: Cc, interfaces: Ci, utils: Cu } = Components;
-
-Cu.import("resource://gre/modules/XPCOMUtils.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "promise",
-    "resource://gre/modules/commonjs/sdk/core/promise.js", "Promise");
-
-XPCOMUtils.defineLazyModuleGetter(this, "HUDService",
-    "resource:///modules/HUDService.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "EventEmitter",
-    "resource:///modules/devtools/shared/event-emitter.js");
+loader.lazyGetter(this, "promise", () => require("sdk/core/promise"));
+loader.lazyGetter(this, "HUDService", () => require("devtools/webconsole/hudservice"));
+loader.lazyGetter(this, "EventEmitter", () => require("devtools/shared/event-emitter"));
 
 /**
  * A DevToolPanel that controls the Web Console.
  */
-function WebConsolePanel(iframeWindow, toolbox) {
+function WebConsolePanel(iframeWindow, toolbox)
+{
   this._frameWindow = iframeWindow;
   this._toolbox = toolbox;
   EventEmitter.decorate(this);
 }
+exports.WebConsolePanel = WebConsolePanel;
 
 WebConsolePanel.prototype = {
   hud: null,
diff --git a/browser/devtools/webconsole/test/Makefile.in b/browser/devtools/webconsole/test/Makefile.in
index ef3265a21d75..3ba6dded23da 100644
--- a/browser/devtools/webconsole/test/Makefile.in
+++ b/browser/devtools/webconsole/test/Makefile.in
@@ -17,7 +17,6 @@ MOCHITEST_BROWSER_FILES = \
 	browser_webconsole_basic_net_logging.js \
 	browser_webconsole_bug_579412_input_focus.js \
 	browser_webconsole_bug_580001_closing_after_completion.js \
-	browser_webconsole_bug_580400_groups.js \
 	browser_webconsole_bug_588730_text_node_insertion.js \
 	browser_webconsole_bug_601667_filter_buttons.js \
 	browser_webconsole_bug_597136_external_script_errors.js \
@@ -145,6 +144,7 @@ MOCHITEST_BROWSER_FILES = \
 	browser_console_variables_view_while_debugging_and_inspecting.js \
 	browser_webconsole_bug_686937_autocomplete_JSTerm_helpers.js \
 	browser_webconsole_cached_autocomplete.js \
+	browser_console_navigation_marker.js \
 	head.js \
 	$(NULL)
 
diff --git a/browser/devtools/webconsole/test/browser_bug_871156_ctrlw_close_tab.js b/browser/devtools/webconsole/test/browser_bug_871156_ctrlw_close_tab.js
index a76bf2bfef75..96b7201ef7dd 100644
--- a/browser/devtools/webconsole/test/browser_bug_871156_ctrlw_close_tab.js
+++ b/browser/devtools/webconsole/test/browser_bug_871156_ctrlw_close_tab.js
@@ -10,6 +10,9 @@ function test()
 {
   const TEST_URI = "data:text/html;charset=utf8,<title>bug871156</title>\n" +
                    "<p>hello world";
+  let firstTab = gBrowser.selectedTab;
+  Services.prefs.setBoolPref("browser.tabs.animate", false);
+
   addTab(TEST_URI);
   browser.addEventListener("load", function onLoad() {
     browser.removeEventListener("load", onLoad, true);
@@ -20,47 +23,61 @@ function test()
   {
     ok(hud, "Web Console opened");
 
-    let tabClosed = false, toolboxDestroyed = false;
+    let tabClosed = promise.defer();
+    let toolboxDestroyed = promise.defer();
+    let tabSelected = promise.defer();
+
+    let pageWindow = firstTab.linkedBrowser.contentWindow;
+    let toolbox = gDevTools.getToolbox(hud.target);
 
     gBrowser.tabContainer.addEventListener("TabClose", function onTabClose() {
       gBrowser.tabContainer.removeEventListener("TabClose", onTabClose);
+      info("tab closed");
+      tabClosed.resolve(null);
+    });
 
-      ok(true, "tab closed");
-
-      tabClosed = true;
-      if (toolboxDestroyed) {
-        testBrowserConsole();
+    gBrowser.tabContainer.addEventListener("TabSelect", function onTabSelect() {
+      gBrowser.tabContainer.removeEventListener("TabSelect", onTabSelect);
+      if (gBrowser.selectedTab == firstTab) {
+        info("tab selected");
+        tabSelected.resolve(null);
       }
     });
 
-    let toolbox = gDevTools.getToolbox(hud.target);
     toolbox.once("destroyed", () => {
-      ok(true, "toolbox destroyed");
-
-      toolboxDestroyed = true;
-      if (tabClosed) {
-        testBrowserConsole();
-      }
+      info("toolbox destroyed");
+      toolboxDestroyed.resolve(null);
     });
 
-    EventUtils.synthesizeKey("w", { accelKey: true }, hud.iframeWindow);
+    promise.all([tabClosed.promise, toolboxDestroyed.promise, tabSelected.promise ]).then(() => {
+      info("promise.all resolved");
+      waitForFocus(testBrowserConsole, pageWindow, true);
+    });
+
+    // Get out of the web console initialization.
+    executeSoon(() => {
+      EventUtils.synthesizeKey("w", { accelKey: true });
+    });
   }
 
   function testBrowserConsole()
   {
     info("test the Browser Console");
 
-    HUDConsoleUI.toggleBrowserConsole().then((hud) => {
+    HUDService.toggleBrowserConsole().then((hud) => {
       ok(hud, "Browser Console opened");
 
       Services.obs.addObserver(function onDestroy() {
         Services.obs.removeObserver(onDestroy, "web-console-destroyed");
         ok(true, "the Browser Console closed");
 
-        executeSoon(finishTest);
+        Services.prefs.clearUserPref("browser.tabs.animate");
+        waitForFocus(finish, content, true);
       }, "web-console-destroyed", false);
 
-      EventUtils.synthesizeKey("w", { accelKey: true }, hud.iframeWindow);
+      waitForFocus(() => {
+        EventUtils.synthesizeKey("w", { accelKey: true }, hud.iframeWindow);
+      }, hud.iframeWindow);
     });
   }
 }
diff --git a/browser/devtools/webconsole/test/browser_console.js b/browser/devtools/webconsole/test/browser_console.js
index d204c1b2bbb9..f96bc57ba8c8 100644
--- a/browser/devtools/webconsole/test/browser_console.js
+++ b/browser/devtools/webconsole/test/browser_console.js
@@ -9,16 +9,21 @@ const TEST_URI = "http://example.com/browser/browser/devtools/webconsole/test/te
 
 function test()
 {
-  let oldFunction = HUDConsoleUI.toggleBrowserConsole;
-  let functionExecuted = false;
-  HUDConsoleUI.toggleBrowserConsole = () => functionExecuted = true;
+  Services.obs.addObserver(function observer(aSubject) {
+    Services.obs.removeObserver(observer, "web-console-created");
+    aSubject.QueryInterface(Ci.nsISupportsString);
+
+    let hud = HUDService.getBrowserConsole();
+    ok(hud, "browser console is open");
+    is(aSubject.data, hud.hudId, "notification hudId is correct");
+
+    executeSoon(() => consoleOpened(hud));
+  }, "web-console-created", false);
+
+  let hud = HUDService.getBrowserConsole();
+  ok(!hud, "browser console is not open");
+  info("wait for the browser console to open with ctrl-shift-j");
   EventUtils.synthesizeKey("j", { accelKey: true, shiftKey: true }, content);
-
-  ok(functionExecuted,
-     "toggleBrowserConsole() was executed by the Ctrl-Shift-J key shortcut");
-
-  HUDConsoleUI.toggleBrowserConsole = oldFunction;
-  HUDConsoleUI.toggleBrowserConsole().then(consoleOpened);
 }
 
 function consoleOpened(hud)
diff --git a/browser/devtools/webconsole/test/browser_console_addonsdk_loader_exception.js b/browser/devtools/webconsole/test/browser_console_addonsdk_loader_exception.js
index 7a4186761dd5..da563a5c7fa4 100644
--- a/browser/devtools/webconsole/test/browser_console_addonsdk_loader_exception.js
+++ b/browser/devtools/webconsole/test/browser_console_addonsdk_loader_exception.js
@@ -24,7 +24,7 @@ function test()
   {
     ok(hud, "web console opened");
     webconsole = hud;
-    HUDConsoleUI.toggleBrowserConsole().then(browserConsoleOpened);
+    HUDService.toggleBrowserConsole().then(browserConsoleOpened);
   }
 
   function browserConsoleOpened(hud)
diff --git a/browser/devtools/webconsole/test/browser_console_consolejsm_output.js b/browser/devtools/webconsole/test/browser_console_consolejsm_output.js
index 96b8ff42ec44..1eef18af617d 100644
--- a/browser/devtools/webconsole/test/browser_console_consolejsm_output.js
+++ b/browser/devtools/webconsole/test/browser_console_consolejsm_output.js
@@ -13,7 +13,7 @@ function test()
   let console = Cu.import("resource://gre/modules/devtools/Console.jsm", {}).console;
   console.log("bug861338-log-cached");
 
-  HUDConsoleUI.toggleBrowserConsole().then(consoleOpened);
+  HUDService.toggleBrowserConsole().then(consoleOpened);
   let hud = null;
 
   function consoleOpened(aHud)
diff --git a/browser/devtools/webconsole/test/browser_console_dead_objects.js b/browser/devtools/webconsole/test/browser_console_dead_objects.js
index 1d68df857e89..4f30ebe9249b 100644
--- a/browser/devtools/webconsole/test/browser_console_dead_objects.js
+++ b/browser/devtools/webconsole/test/browser_console_dead_objects.js
@@ -15,7 +15,7 @@ function test()
   browser.addEventListener("load", function onLoad() {
     browser.removeEventListener("load", onLoad, true);
     info("open the browser console");
-    HUDConsoleUI.toggleBrowserConsole().then(onBrowserConsoleOpen);
+    HUDService.toggleBrowserConsole().then(onBrowserConsoleOpen);
   }, true);
 
   function onBrowserConsoleOpen(aHud)
diff --git a/browser/devtools/webconsole/test/browser_console_error_source_click.js b/browser/devtools/webconsole/test/browser_console_error_source_click.js
index 98fe93dbc8b1..7c96521553ef 100644
--- a/browser/devtools/webconsole/test/browser_console_error_source_click.js
+++ b/browser/devtools/webconsole/test/browser_console_error_source_click.js
@@ -16,7 +16,7 @@ function test()
   addTab(TEST_URI);
   browser.addEventListener("load", function onLoad() {
     browser.removeEventListener("load", onLoad, true);
-    HUDConsoleUI.toggleBrowserConsole().then(browserConsoleOpened);
+    HUDService.toggleBrowserConsole().then(browserConsoleOpened);
   }, true);
 
   function browserConsoleOpened(aHud)
diff --git a/browser/devtools/webconsole/test/browser_console_filters.js b/browser/devtools/webconsole/test/browser_console_filters.js
index d9aa35c81515..6568cba91922 100644
--- a/browser/devtools/webconsole/test/browser_console_filters.js
+++ b/browser/devtools/webconsole/test/browser_console_filters.js
@@ -45,7 +45,7 @@ function consoleOpened(hud)
 function onWebConsoleClose()
 {
   info("web console closed");
-  HUDConsoleUI.toggleBrowserConsole().then(onBrowserConsoleOpen);
+  HUDService.toggleBrowserConsole().then(onBrowserConsoleOpen);
 }
 
 function onBrowserConsoleOpen(hud)
diff --git a/browser/devtools/webconsole/test/browser_console_iframe_messages.js b/browser/devtools/webconsole/test/browser_console_iframe_messages.js
index 8131f928bf2c..dfda0981a5f4 100644
--- a/browser/devtools/webconsole/test/browser_console_iframe_messages.js
+++ b/browser/devtools/webconsole/test/browser_console_iframe_messages.js
@@ -85,7 +85,7 @@ function consoleOpened(hud)
 function onWebConsoleClose()
 {
   info("web console closed");
-  HUDConsoleUI.toggleBrowserConsole().then(onBrowserConsoleOpen);
+  HUDService.toggleBrowserConsole().then(onBrowserConsoleOpen);
 }
 
 function onBrowserConsoleOpen(hud)
diff --git a/browser/devtools/webconsole/test/browser_console_keyboard_accessibility.js b/browser/devtools/webconsole/test/browser_console_keyboard_accessibility.js
index aca00bd5a39b..b0b189305cbd 100644
--- a/browser/devtools/webconsole/test/browser_console_keyboard_accessibility.js
+++ b/browser/devtools/webconsole/test/browser_console_keyboard_accessibility.js
@@ -54,16 +54,19 @@ function test()
        "filter input is focused");
 
     if (Services.appinfo.OS == "Darwin") {
+      ok(hud.ui.getFilterState("network"), "network category is enabled");
       EventUtils.synthesizeKey("t", { ctrlKey: true });
+      ok(!hud.ui.getFilterState("network"), "accesskey for Network works");
+      EventUtils.synthesizeKey("t", { ctrlKey: true });
+      ok(hud.ui.getFilterState("network"), "accesskey for Network works (again)");
     }
     else {
       EventUtils.synthesizeKey("N", { altKey: true });
+      let net = hud.ui.document.querySelector("toolbarbutton[category=net]");
+      is(hud.ui.document.activeElement, net,
+         "accesskey for Network category focuses the Net button");
     }
 
-    let net = hud.ui.document.querySelector("toolbarbutton[category=net]");
-    is(hud.ui.document.activeElement, net,
-       "accesskey for Network category focuses the Net button");
-
     finishTest();
   }
 }
diff --git a/browser/devtools/webconsole/test/browser_console_navigation_marker.js b/browser/devtools/webconsole/test/browser_console_navigation_marker.js
new file mode 100644
index 000000000000..6ec9d3432719
--- /dev/null
+++ b/browser/devtools/webconsole/test/browser_console_navigation_marker.js
@@ -0,0 +1,81 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ */
+
+// Check that the navigation marker shows on page reload - bug 793996.
+
+function test()
+{
+  const PREF = "devtools.webconsole.persistlog";
+  const TEST_URI = "http://example.com/browser/browser/devtools/webconsole/test/test-console.html";
+  let hud = null;
+  let Messages = require("devtools/webconsole/console-output").Messages;
+
+  Services.prefs.setBoolPref(PREF, true);
+  registerCleanupFunction(() => Services.prefs.clearUserPref(PREF));
+
+  addTab(TEST_URI);
+
+  browser.addEventListener("load", function onLoad() {
+    browser.removeEventListener("load", onLoad, true);
+    openConsole(null, consoleOpened);
+  }, true);
+
+  function consoleOpened(aHud)
+  {
+    hud = aHud;
+    ok(hud, "Web Console opened");
+
+    hud.jsterm.clearOutput();
+    content.console.log("foobarz1");
+    waitForMessages({
+      webconsole: hud,
+      messages: [{
+        text: "foobarz1",
+        category: CATEGORY_WEBDEV,
+        severity: SEVERITY_LOG,
+      }],
+    }).then(onConsoleMessage);
+  }
+
+  function onConsoleMessage()
+  {
+    browser.addEventListener("load", onReload, true);
+    content.location.reload();
+  }
+
+  function onReload()
+  {
+    browser.removeEventListener("load", onReload, true);
+
+    content.console.log("foobarz2");
+
+    waitForMessages({
+      webconsole: hud,
+      messages: [{
+        name: "page reload",
+        text: "test-console.html",
+        category: CATEGORY_NETWORK,
+        severity: SEVERITY_LOG,
+      },
+      {
+        text: "foobarz2",
+        category: CATEGORY_WEBDEV,
+        severity: SEVERITY_LOG,
+      },
+      {
+        name: "navigation marker",
+        text: "test-console.html",
+        type: Messages.NavigationMarker,
+      }],
+    }).then(onConsoleMessageAfterReload);
+  }
+
+  function onConsoleMessageAfterReload()
+  {
+    isnot(hud.outputNode.textContent.indexOf("foobarz1"), -1,
+          "foobarz1 is still in the output");
+    finishTest();
+  }
+}
diff --git a/browser/devtools/webconsole/test/browser_console_nsiconsolemessage.js b/browser/devtools/webconsole/test/browser_console_nsiconsolemessage.js
index dcfc19feedc0..7b3c75540efc 100644
--- a/browser/devtools/webconsole/test/browser_console_nsiconsolemessage.js
+++ b/browser/devtools/webconsole/test/browser_console_nsiconsolemessage.js
@@ -51,7 +51,7 @@ function consoleOpened(hud)
 function onWebConsoleClose()
 {
   info("web console closed");
-  HUDConsoleUI.toggleBrowserConsole().then(onBrowserConsoleOpen);
+  HUDService.toggleBrowserConsole().then(onBrowserConsoleOpen);
 }
 
 function onBrowserConsoleOpen(hud)
diff --git a/browser/devtools/webconsole/test/browser_console_private_browsing.js b/browser/devtools/webconsole/test/browser_console_private_browsing.js
index 3776bfd32669..61cfd51c6573 100644
--- a/browser/devtools/webconsole/test/browser_console_private_browsing.js
+++ b/browser/devtools/webconsole/test/browser_console_private_browsing.js
@@ -128,7 +128,7 @@ function test()
     info("testBrowserConsole()");
     closeConsole(privateTab, () => {
       info("web console closed");
-      privateWindow.HUDConsoleUI.toggleBrowserConsole().then(onBrowserConsoleOpen);
+      privateWindow.HUDService.toggleBrowserConsole().then(onBrowserConsoleOpen);
     });
   }
 
@@ -167,10 +167,10 @@ function test()
       checkNoPrivateMessages();
 
       info("close the browser console");
-      privateWindow.HUDConsoleUI.toggleBrowserConsole().then(() => {
+      privateWindow.HUDService.toggleBrowserConsole().then(() => {
         info("reopen the browser console");
         executeSoon(() =>
-          HUDConsoleUI.toggleBrowserConsole().then(onBrowserConsoleReopen));
+          HUDService.toggleBrowserConsole().then(onBrowserConsoleReopen));
       });
     });
     privateWindow.BrowserTryToCloseWindow();
diff --git a/browser/devtools/webconsole/test/browser_webconsole_bug_580400_groups.js b/browser/devtools/webconsole/test/browser_webconsole_bug_580400_groups.js
deleted file mode 100644
index 33fdc6e9e550..000000000000
--- a/browser/devtools/webconsole/test/browser_webconsole_bug_580400_groups.js
+++ /dev/null
@@ -1,78 +0,0 @@
-/* vim:set ts=2 sw=2 sts=2 et: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-// Tests that console groups behave properly.
-
-const TEST_URI = "http://example.com/browser/browser/devtools/webconsole/test/test-console.html";
-
-function test() {
-  addTab(TEST_URI);
-  browser.addEventListener("load", function onLoad() {
-    browser.removeEventListener("load", onLoad, true);
-    openConsole(null, testGroups);
-  }, true);
-}
-
-function testGroups(HUD) {
-  let jsterm = HUD.jsterm;
-  let outputNode = HUD.outputNode;
-  jsterm.clearOutput();
-
-  // We test for one group by testing for zero "new" groups. The
-  // "webconsole-new-group" class creates a divider. Thus one group is
-  // indicated by zero new groups, two groups are indicated by one new group,
-  // and so on.
-
-  let waitForSecondMessage = {
-    name: "second console message",
-    validatorFn: function()
-    {
-      return outputNode.querySelectorAll(".webconsole-msg-output").length == 2;
-    },
-    successFn: function()
-    {
-      let timestamp1 = Date.now();
-      if (timestamp1 - timestamp0 < 5000) {
-        is(outputNode.querySelectorAll(".webconsole-new-group").length, 0,
-           "no group dividers exist after the second console message");
-      }
-
-      for (let i = 0; i < outputNode.itemCount; i++) {
-        outputNode.getItemAtIndex(i).timestamp = 0;   // a "far past" value
-      }
-
-      jsterm.execute("2");
-      waitForSuccess(waitForThirdMessage);
-    },
-    failureFn: finishTest,
-  };
-
-  let waitForThirdMessage = {
-    name: "one group divider exists after the third console message",
-    validatorFn: function()
-    {
-      return outputNode.querySelectorAll(".webconsole-new-group").length == 1;
-    },
-    successFn: finishTest,
-    failureFn: finishTest,
-  };
-
-  let timestamp0 = Date.now();
-  jsterm.execute("0");
-
-  waitForSuccess({
-    name: "no group dividers exist after the first console message",
-    validatorFn: function()
-    {
-      return outputNode.querySelectorAll(".webconsole-new-group").length == 0;
-    },
-    successFn: function()
-    {
-      jsterm.execute("1");
-      waitForSuccess(waitForSecondMessage);
-    },
-    failureFn: finishTest,
-  });
-}
diff --git a/browser/devtools/webconsole/test/browser_webconsole_bug_585956_console_trace.js b/browser/devtools/webconsole/test/browser_webconsole_bug_585956_console_trace.js
index a062ebd99da1..d6aa25f9526f 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_bug_585956_console_trace.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_bug_585956_console_trace.js
@@ -6,45 +6,44 @@
 const TEST_URI = "http://example.com/browser/browser/devtools/webconsole/test/test-bug-585956-console-trace.html";
 
 function test() {
-  addTab(TEST_URI);
+  addTab("data:text/html;charset=utf8,<p>hello");
   browser.addEventListener("load", tabLoaded, true);
-}
 
-function tabLoaded() {
-  browser.removeEventListener("load", tabLoaded, true);
+  function tabLoaded() {
+    browser.removeEventListener("load", tabLoaded, true);
 
-  openConsole(null, function(hud) {
-    content.location.reload();
+    openConsole(null, function(hud) {
+      content.location = TEST_URI;
 
-    waitForSuccess({
-      name: "stacktrace message",
-      validatorFn: function()
-      {
-        return hud.outputNode.querySelector(".hud-log");
-      },
-      successFn: performChecks,
-      failureFn: finishTest,
+      waitForMessages({
+        webconsole: hud,
+        messages: [{
+          name: "console.trace output",
+          consoleTrace: {
+            file: "test-bug-585956-console-trace.html",
+            fn: "window.foobar585956c",
+          },
+        }],
+      }).then(performChecks);
     });
-  });
-}
-
-function performChecks() {
-  // The expected stack trace object.
-  let stacktrace = [
-    { filename: TEST_URI, lineNumber: 9, functionName: "window.foobar585956c", language: 2 },
-    { filename: TEST_URI, lineNumber: 14, functionName: "foobar585956b", language: 2 },
-    { filename: TEST_URI, lineNumber: 18, functionName: "foobar585956a", language: 2 },
-    { filename: TEST_URI, lineNumber: 21, functionName: null, language: 2 }
-  ];
-
-  let hudId = HUDService.getHudIdByWindow(content);
-  let HUD = HUDService.hudReferences[hudId];
-
-  let node = HUD.outputNode.querySelector(".hud-log");
-  ok(node, "found trace log node");
-  ok(node._stacktrace, "found stacktrace object");
-  is(node._stacktrace.toSource(), stacktrace.toSource(), "stacktrace is correct");
-  isnot(node.textContent.indexOf("bug-585956"), -1, "found file name");
-
-  finishTest();
+  }
+
+  function performChecks(results) {
+    let node = [...results[0].matched][0];
+
+    // The expected stack trace object.
+    let stacktrace = [
+      { filename: TEST_URI, lineNumber: 9, functionName: "window.foobar585956c", language: 2 },
+      { filename: TEST_URI, lineNumber: 14, functionName: "foobar585956b", language: 2 },
+      { filename: TEST_URI, lineNumber: 18, functionName: "foobar585956a", language: 2 },
+      { filename: TEST_URI, lineNumber: 21, functionName: null, language: 2 }
+    ];
+
+    ok(node, "found trace log node");
+    ok(node._stacktrace, "found stacktrace object");
+    is(node._stacktrace.toSource(), stacktrace.toSource(), "stacktrace is correct");
+    isnot(node.textContent.indexOf("bug-585956"), -1, "found file name");
+
+    finishTest();
+  }
 }
diff --git a/browser/devtools/webconsole/test/browser_webconsole_bug_597756_reopen_closed_tab.js b/browser/devtools/webconsole/test/browser_webconsole_bug_597756_reopen_closed_tab.js
index b6636a079bde..2842f066e320 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_bug_597756_reopen_closed_tab.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_bug_597756_reopen_closed_tab.js
@@ -25,33 +25,34 @@ function tabLoaded(aEvent) {
 function tabReloaded(aEvent) {
   gBrowser.selectedBrowser.removeEventListener(aEvent.type, tabReloaded, true);
 
-  let hudId = HUDService.getHudIdByWindow(content);
-  let HUD = HUDService.hudReferences[hudId];
+  let HUD = HUDService.getHudByWindow(content);
   ok(HUD, "Web Console is open");
 
-  waitForSuccess({
-    name: "error message displayed",
-    validatorFn: function() {
-      return HUD.outputNode.textContent.indexOf("fooBug597756_error") > -1;
-    },
-    successFn: function() {
-      if (newTabIsOpen) {
-        finishTest();
-        return;
-      }
-      closeConsole(gBrowser.selectedTab, function() {
-        gBrowser.removeCurrentTab();
+  waitForMessages({
+    webconsole: HUD,
+    messages: [{
+      name: "error message displayed",
+      text: "fooBug597756_error",
+      category: CATEGORY_JS,
+      severity: SEVERITY_ERROR,
+    }],
+  }).then(() => {
+    if (newTabIsOpen) {
+      finishTest();
+      return;
+    }
 
-        let newTab = gBrowser.addTab();
-        gBrowser.selectedTab = newTab;
+    closeConsole(gBrowser.selectedTab, () => {
+      gBrowser.removeCurrentTab();
 
-        newTabIsOpen = true;
-        gBrowser.selectedBrowser.addEventListener("load", tabLoaded, true);
-        expectUncaughtException();
-        content.location = TEST_URI;
-      });
-    },
-    failureFn: finishTest,
+      let newTab = gBrowser.addTab();
+      gBrowser.selectedTab = newTab;
+
+      newTabIsOpen = true;
+      gBrowser.selectedBrowser.addEventListener("load", tabLoaded, true);
+      expectUncaughtException();
+      content.location = TEST_URI;
+    });
   });
 }
 
diff --git a/browser/devtools/webconsole/test/browser_webconsole_bug_599725_response_headers.js b/browser/devtools/webconsole/test/browser_webconsole_bug_599725_response_headers.js
index a913f5e0ca1d..1c589f3f6233 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_bug_599725_response_headers.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_bug_599725_response_headers.js
@@ -53,7 +53,7 @@ function performTest(aRequest, aConsole)
       executeSoon(finishTest);
     });
 
-  HUDService.lastFinishedRequestCallback = null;
+  HUDService.lastFinishedRequest.callback = null;
 }
 
 function test()
@@ -63,7 +63,7 @@ function test()
   browser.addEventListener("load", function onLoad() {
     browser.removeEventListener("load", onLoad, true);
     openConsole(null, () => {
-      HUDService.lastFinishedRequestCallback = performTest;
+      HUDService.lastFinishedRequest.callback = performTest;
 
       browser.addEventListener("load", function onReload() {
         browser.removeEventListener("load", onReload, true);
diff --git a/browser/devtools/webconsole/test/browser_webconsole_bug_600183_charset.js b/browser/devtools/webconsole/test/browser_webconsole_bug_600183_charset.js
index 3dd67379d7ca..ef825dfa310b 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_bug_600183_charset.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_bug_600183_charset.js
@@ -13,7 +13,7 @@ const TEST_URI = "http://example.com/browser/browser/devtools/webconsole/test/te
 function performTest(lastFinishedRequest, aConsole)
 {
   ok(lastFinishedRequest, "charset test page was loaded and logged");
-  HUDService.lastFinishedRequestCallback = null;
+  HUDService.lastFinishedRequest.callback = null;
 
   executeSoon(() => {
     aConsole.webConsoleClient.getResponseContent(lastFinishedRequest.actor,
@@ -27,7 +27,7 @@ function performTest(lastFinishedRequest, aConsole)
         isnot(body.indexOf("<p>" + chars + "</p>"), -1,
           "found the chinese simplified string");
 
-        HUDService.lastFinishedRequestCallback = null;
+        HUDService.lastFinishedRequest.callback = null;
         executeSoon(finishTest);
       });
   });
@@ -45,7 +45,7 @@ function test()
         ok(hud.ui._saveRequestAndResponseBodies,
           "The saveRequestAndResponseBodies property was successfully set.");
 
-        HUDService.lastFinishedRequestCallback = performTest;
+        HUDService.lastFinishedRequest.callback = performTest;
         content.location = TEST_URI;
       });
     });
diff --git a/browser/devtools/webconsole/test/browser_webconsole_bug_601177_log_levels.js b/browser/devtools/webconsole/test/browser_webconsole_bug_601177_log_levels.js
index 5a3566a3e192..0fc843483ecf 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_bug_601177_log_levels.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_bug_601177_log_levels.js
@@ -10,44 +10,9 @@
 
 const TEST_URI = "http://example.com/browser/browser/devtools/webconsole/test/test-bug-601177-log-levels.html";
 
-function performTest()
-{
-  let hudId = HUDService.getHudIdByWindow(content);
-  let HUD = HUDService.hudReferences[hudId];
-
-  findEntry(HUD, "hud-networkinfo", "test-bug-601177-log-levels.html",
-            "found test-bug-601177-log-levels.html");
-
-  findEntry(HUD, "hud-networkinfo", "test-bug-601177-log-levels.js",
-            "found test-bug-601177-log-levels.js");
-
-  findEntry(HUD, "hud-networkinfo", "test-image.png", "found test-image.png");
-
-  findEntry(HUD, "hud-network", "foobar-known-to-fail.png",
-            "found foobar-known-to-fail.png");
-
-  findEntry(HUD, "hud-exception", "foobarBug601177exception",
-            "found exception");
-
-  findEntry(HUD, "hud-jswarn", "undefinedPropertyBug601177",
-            "found strict warning");
-
-  findEntry(HUD, "hud-jswarn", "foobarBug601177strictError",
-            "found strict error");
-
-  executeSoon(finishTest);
-}
-
-function findEntry(aHUD, aClass, aString, aMessage)
-{
-  return testLogEntry(aHUD.outputNode, aString, aMessage, false, false,
-                      aClass);
-}
-
 function test()
 {
   Services.prefs.setBoolPref("javascript.options.strict", true);
-
   registerCleanupFunction(function() {
     Services.prefs.clearUserPref("javascript.options.strict");
   });
@@ -56,27 +21,55 @@ function test()
 
   browser.addEventListener("load", function onLoad() {
     browser.removeEventListener("load", onLoad, true);
-
-    openConsole(null, function(hud) {
-      browser.addEventListener("load", function onLoad2() {
-        browser.removeEventListener("load", onLoad2, true);
-        waitForSuccess({
-          name: "all messages displayed",
-          validatorFn: function()
-          {
-            return hud.outputNode.itemCount >= 7;
-          },
-          successFn: performTest,
-          failureFn: function() {
-            info("itemCount: " + hud.outputNode.itemCount);
-            finishTest();
-          },
-        });
-      }, true);
-
-      expectUncaughtException();
-      content.location = TEST_URI;
-    });
+    openConsole(null, consoleOpened);
   }, true);
-}
 
+  function consoleOpened(hud)
+  {
+    expectUncaughtException();
+    content.location = TEST_URI;
+
+    info("waiting for messages");
+
+    waitForMessages({
+      webconsole: hud,
+      messages: [
+        {
+          text: "test-bug-601177-log-levels.html",
+          category: CATEGORY_NETWORK,
+          severity: SEVERITY_LOG,
+        },
+        {
+          text: "test-bug-601177-log-levels.js",
+          category: CATEGORY_NETWORK,
+          severity: SEVERITY_LOG,
+        },
+        {
+          text: "test-image.png",
+          category: CATEGORY_NETWORK,
+          severity: SEVERITY_LOG,
+        },
+        {
+          text: "foobar-known-to-fail.png",
+          category: CATEGORY_NETWORK,
+          severity: SEVERITY_ERROR,
+        },
+        {
+          text: "foobarBug601177exception",
+          category: CATEGORY_JS,
+          severity: SEVERITY_ERROR,
+        },
+        {
+          text: "undefinedPropertyBug601177",
+          category: CATEGORY_JS,
+          severity: SEVERITY_WARNING,
+        },
+        {
+          text: "foobarBug601177strictError",
+          category: CATEGORY_JS,
+          severity: SEVERITY_WARNING,
+        },
+      ],
+    }).then(finishTest);
+  }
+}
diff --git a/browser/devtools/webconsole/test/browser_webconsole_bug_602572_log_bodies_checkbox.js b/browser/devtools/webconsole/test/browser_webconsole_bug_602572_log_bodies_checkbox.js
index d4ed63916335..f9a5fa8fa747 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_bug_602572_log_bodies_checkbox.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_bug_602572_log_bodies_checkbox.js
@@ -43,8 +43,7 @@ function startTest()
 {
   // Find the relevant elements in the Web Console of tab 2.
   let win2 = tabs[runCount*2 + 1].linkedBrowser.contentWindow;
-  let hudId2 = HUDService.getHudIdByWindow(win2);
-  huds[1] = HUDService.hudReferences[hudId2];
+  huds[1] = HUDService.getHudByWindow(win2);
   info("startTest: iframe2 root height " + huds[1].ui.rootElement.clientHeight);
 
   if (runCount == 0) {
@@ -101,8 +100,7 @@ function testpopup2b(aEvent) {
     waitForFocus(function() {
       // Find the relevant elements in the Web Console of tab 1.
       let win1 = tabs[runCount*2].linkedBrowser.contentWindow;
-      let hudId1 = HUDService.getHudIdByWindow(win1);
-      huds[0] = HUDService.hudReferences[hudId1];
+      huds[0] = HUDService.getHudByWindow(win1);
 
       info("iframe1 root height " + huds[0].ui.rootElement.clientHeight);
 
diff --git a/browser/devtools/webconsole/test/browser_webconsole_bug_618078_network_exceptions.js b/browser/devtools/webconsole/test/browser_webconsole_bug_618078_network_exceptions.js
index 62085dd504c4..cdd616c72eae 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_bug_618078_network_exceptions.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_bug_618078_network_exceptions.js
@@ -3,68 +3,29 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-// Tests that network log messages bring up the network panel.
+// Tests that we report JS exceptions in event handlers coming from
+// network requests, like onreadystate for XHR. See bug 618078.
 
 const TEST_URI = "http://example.com/browser/browser/devtools/webconsole/test/test-bug-618078-network-exceptions.html";
 
-let testEnded = false;
-
-let TestObserver = {
-  QueryInterface: XPCOMUtils.generateQI([Ci.nsIObserver]),
-
-  observe: function test_observe(aSubject)
-  {
-    if (testEnded || !(aSubject instanceof Ci.nsIScriptError)) {
-      return;
-    }
-
-    is(aSubject.category, "content javascript", "error category");
-
-    testEnded = true;
-    if (aSubject.category == "content javascript") {
-      executeSoon(checkOutput);
-    }
-    else {
-      executeSoon(finishTest);
-    }
-  }
-};
-
-function checkOutput()
-{
-  waitForSuccess({
-    name: "exception message",
-    validatorFn: function()
-    {
-      return hud.outputNode.textContent.indexOf("bug618078exception") > -1;
-    },
-    successFn: finishTest,
-    failureFn: finishTest,
-  });
-}
-
-function testEnd()
-{
-  Services.console.unregisterListener(TestObserver);
-}
-
 function test()
 {
   addTab("data:text/html;charset=utf-8,Web Console test for bug 618078");
 
   browser.addEventListener("load", function onLoad() {
     browser.removeEventListener("load", onLoad, true);
+    openConsole(null, function(hud) {
+      expectUncaughtException();
+      content.location = TEST_URI;
 
-    openConsole(null, function(aHud) {
-      hud = aHud;
-      Services.console.registerListener(TestObserver);
-      registerCleanupFunction(testEnd);
-
-      executeSoon(function() {
-        expectUncaughtException();
-        content.location = TEST_URI;
-      });
+      waitForMessages({
+        webconsole: hud,
+        messages: [{
+          text: "bug618078exception",
+          category: CATEGORY_JS,
+          severity: SEVERITY_ERROR,
+        }],
+      }).then(finishTest);
     });
   }, true);
 }
-
diff --git a/browser/devtools/webconsole/test/browser_webconsole_bug_618311_close_panels.js b/browser/devtools/webconsole/test/browser_webconsole_bug_618311_close_panels.js
index b1bd90ffe005..8f1619be9214 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_bug_618311_close_panels.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_bug_618311_close_panels.js
@@ -25,12 +25,11 @@ function test() {
   }, true);
 }
 
-function performTest() {
-  let hudId = HUDService.getHudIdByWindow(content);
-  let HUD = HUDService.hudReferences[hudId];
+function performTest(results) {
+  let HUD = HUDService.getHudByWindow(content);
 
-  let networkMessage = HUD.outputNode.querySelector(".webconsole-msg-network");
-  ok(networkMessage, "found network message");
+  let networkMessage = [...results[0].matched][0];
+  ok(networkMessage, "network message element");
 
   let networkLink = networkMessage.querySelector(".webconsole-msg-link");
   ok(networkLink, "found network message link");
@@ -46,7 +45,7 @@ function performTest() {
     popupsShown++;
 
     executeSoon(function() {
-      let popups = popupset.querySelectorAll("panel[hudId=" + hudId + "]");
+      let popups = popupset.querySelectorAll("panel[hudId=" + HUD.hudId + "]");
       is(popups.length, 1, "found one popup");
 
       document.addEventListener("popuphidden", onpopuphidden, false);
@@ -67,7 +66,7 @@ function performTest() {
     hiddenPopups++;
 
     executeSoon(function() {
-      let popups = popupset.querySelectorAll("panel[hudId=" + hudId + "]");
+      let popups = popupset.querySelectorAll("panel[hudId=" + HUD.hudId + "]");
       is(popups.length, 0, "no popups found");
 
       executeSoon(finishTest);
diff --git a/browser/devtools/webconsole/test/browser_webconsole_bug_630733_response_redirect_headers.js b/browser/devtools/webconsole/test/browser_webconsole_bug_630733_response_redirect_headers.js
index 73870efab65a..b6cdae6596e9 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_bug_630733_response_redirect_headers.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_bug_630733_response_redirect_headers.js
@@ -25,7 +25,7 @@ function consoleOpened(hud)
     ok(hud.ui._saveRequestAndResponseBodies,
       "The saveRequestAndResponseBodies property was successfully set.");
 
-    HUDService.lastFinishedRequestCallback = requestDoneCallback;
+    HUDService.lastFinishedRequest.callback = requestDoneCallback;
     waitForSuccess(waitForResponses);
     content.location = TEST_URI;
   });
@@ -44,7 +44,7 @@ function consoleOpened(hud)
 
 function getHeaders()
 {
-  HUDService.lastFinishedRequestCallback = null;
+  HUDService.lastFinishedRequest.callback = null;
 
   ok("301" in lastFinishedRequests, "request 1: 301 Moved Permanently");
   ok("404" in lastFinishedRequests, "request 2: 404 Not found");
diff --git a/browser/devtools/webconsole/test/browser_webconsole_bug_632347_iterators_generators.js b/browser/devtools/webconsole/test/browser_webconsole_bug_632347_iterators_generators.js
index b14470aa749f..4e8a392df297 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_bug_632347_iterators_generators.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_bug_632347_iterators_generators.js
@@ -14,11 +14,8 @@ function test() {
 }
 
 function consoleOpened(HUD) {
-  let tmp = {};
-  Cu.import("resource://gre/modules/devtools/WebConsoleUtils.jsm", tmp);
-  let WCU = tmp.WebConsoleUtils;
-  let JSPropertyProvider = tmp.JSPropertyProvider;
-  tmp = null;
+  let tools = Cu.import("resource://gre/modules/devtools/Loader.jsm", {}).devtools;
+  let JSPropertyProvider = tools.require("devtools/toolkit/webconsole/utils").JSPropertyProvider;
 
   let jsterm = HUD.jsterm;
   let win = content.wrappedJSObject;
diff --git a/browser/devtools/webconsole/test/browser_webconsole_bug_632817.js b/browser/devtools/webconsole/test/browser_webconsole_bug_632817.js
index e8b20cde7d3a..2bfafd5373ce 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_bug_632817.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_bug_632817.js
@@ -28,7 +28,7 @@ function test()
     openConsole(null, function(aHud) {
       hud = aHud;
 
-      HUDService.lastFinishedRequestCallback = function(aRequest) {
+      HUDService.lastFinishedRequest.callback = function(aRequest) {
         lastRequest = aRequest;
         if (requestCallback) {
           requestCallback();
@@ -124,12 +124,20 @@ function testFormSubmission()
     // There should be 3 network requests pointing to the HTML file.
     waitForMessages({
       webconsole: hud,
-      messages: [{
-        text: "test-network-request.html",
-        category: CATEGORY_NETWORK,
-        severity: SEVERITY_LOG,
-        count: 3,
-      }],
+      messages: [
+        {
+          text: "test-network-request.html",
+          category: CATEGORY_NETWORK,
+          severity: SEVERITY_LOG,
+          count: 3,
+        },
+        {
+          text: "test-data.json",
+          category: CATEGORY_NETWORK,
+          severity: SEVERITY_LOG,
+          count: 2,
+        },
+      ],
     }).then(testLiveFilteringOnSearchStrings);
   };
 
@@ -170,7 +178,7 @@ function testLiveFilteringOnSearchStrings() {
   is(countMessageNodes(), 0, "the log nodes are hidden when searching for " +
     "the string \"foo\"bar'baz\"boo'\"");
 
-  HUDService.lastFinishedRequestCallback = null;
+  HUDService.lastFinishedRequest.callback = null;
   lastRequest = null;
   requestCallback = null;
   finishTest();
diff --git a/browser/devtools/webconsole/test/browser_webconsole_bug_651501_document_body_autocomplete.js b/browser/devtools/webconsole/test/browser_webconsole_bug_651501_document_body_autocomplete.js
index 8af19a2779c3..454b8ac983fb 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_bug_651501_document_body_autocomplete.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_bug_651501_document_body_autocomplete.js
@@ -22,11 +22,6 @@ function consoleOpened(aHud) {
   let popup = jsterm.autocompletePopup;
   let completeNode = jsterm.completeNode;
 
-  let tmp = {};
-  Cu.import("resource://gre/modules/devtools/WebConsoleUtils.jsm", tmp);
-  let WCU = tmp.WebConsoleUtils;
-  tmp = null;
-
   ok(!popup.isOpen, "popup is not open");
 
   popup._panel.addEventListener("popupshown", function onShown() {
diff --git a/browser/devtools/webconsole/test/browser_webconsole_bug_653531_highlighter_console_helper.js b/browser/devtools/webconsole/test/browser_webconsole_bug_653531_highlighter_console_helper.js
index c95163e6b24d..fb22eab8fb8c 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_bug_653531_highlighter_console_helper.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_bug_653531_highlighter_console_helper.js
@@ -84,46 +84,29 @@ function performWebConsoleTests(hud)
   outputNode = hud.outputNode;
 
   jsterm.clearOutput();
-  jsterm.execute("$0");
+  jsterm.execute("$0", onNodeOutput);
 
-  waitForSuccess({
-    name: "$0 output",
-    validatorFn: function()
-    {
-      return outputNode.querySelector(".webconsole-msg-output");
-    },
-    successFn: function()
-    {
-      let node = outputNode.querySelector(".webconsole-msg-output");
-      isnot(node.textContent.indexOf("[object HTMLHeadingElement"), -1,
-            "correct output for $0");
+  function onNodeOutput()
+  {
+    let node = outputNode.querySelector(".webconsole-msg-output");
+    isnot(node.textContent.indexOf("[object HTMLHeadingElement"), -1,
+          "correct output for $0");
 
-      jsterm.clearOutput();
-      jsterm.execute("$0.textContent = 'bug653531'");
-      waitForSuccess(waitForNodeUpdate);
-    },
-    failureFn: finishUp,
-  });
+    jsterm.clearOutput();
+    jsterm.execute("$0.textContent = 'bug653531'", onNodeUpdate);
+  }
 
-  let waitForNodeUpdate = {
-    name: "$0.textContent update",
-    validatorFn: function()
-    {
-      return outputNode.querySelector(".webconsole-msg-output");
-    },
-    successFn: function()
-    {
-      let node = outputNode.querySelector(".webconsole-msg-output");
-      isnot(node.textContent.indexOf("bug653531"), -1,
-            "correct output for $0.textContent");
-      let inspector = gDevTools.getToolbox(target).getPanel("inspector");
-      is(inspector.selection.node.textContent, "bug653531",
-         "node successfully updated");
+  function onNodeUpdate()
+  {
+    let node = outputNode.querySelector(".webconsole-msg-output");
+    isnot(node.textContent.indexOf("bug653531"), -1,
+          "correct output for $0.textContent");
+    let inspector = gDevTools.getToolbox(target).getPanel("inspector");
+    is(inspector.selection.node.textContent, "bug653531",
+       "node successfully updated");
 
-      executeSoon(finishUp);
-    },
-    failureFn: finishUp,
-  };
+    executeSoon(finishUp);
+  }
 }
 
 function finishUp() {
diff --git a/browser/devtools/webconsole/test/browser_webconsole_bug_658368_time_methods.js b/browser/devtools/webconsole/test/browser_webconsole_bug_658368_time_methods.js
index fac1f38960b5..cc76a4e9b507 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_bug_658368_time_methods.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_bug_658368_time_methods.js
@@ -59,8 +59,7 @@ function testTimerIndependenceInTabs(hud) {
 }
 
 function testTimerIndependenceInSameTab() {
-  let hudId = HUDService.getHudIdByWindow(content);
-  let hud = HUDService.hudReferences[hudId];
+  let hud = HUDService.getHudByWindow(content);
   outputNode = hud.outputNode;
 
   waitForSuccess({
@@ -87,8 +86,7 @@ function testTimerIndependenceInSameTab() {
 }
 
 function testTimerIndependenceInSameTabAgain() {
-  let hudId = HUDService.getHudIdByWindow(content);
-  let hud = HUDService.hudReferences[hudId];
+  let hud = HUDService.getHudByWindow(content);
   outputNode = hud.outputNode;
 
   executeSoon(function() {
diff --git a/browser/devtools/webconsole/test/browser_webconsole_netlogging.js b/browser/devtools/webconsole/test/browser_webconsole_netlogging.js
index 8bc835fa1f27..8d55ccf80a35 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_netlogging.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_netlogging.js
@@ -32,7 +32,7 @@ function test()
     openConsole(null, function(aHud) {
       hud = aHud;
 
-      HUDService.lastFinishedRequestCallback = requestCallbackWrapper;
+      HUDService.lastFinishedRequest.callback = requestCallbackWrapper;
 
       executeSoon(testPageLoad);
     });
@@ -204,7 +204,7 @@ function testNetworkPanel()
     // All tests are done. Shutdown.
     networkPanel.panel.hidePopup();
     lastRequest = null;
-    HUDService.lastFinishedRequestCallback = null;
+    HUDService.lastFinishedRequest.callback = null;
     executeSoon(finishTest);
   }, true);
 }
diff --git a/browser/devtools/webconsole/test/browser_webconsole_notifications.js b/browser/devtools/webconsole/test/browser_webconsole_notifications.js
index c70605635479..1c7f34fe2337 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_notifications.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_notifications.js
@@ -14,14 +14,14 @@ function test() {
 function webConsoleCreated(aID)
 {
   Services.obs.removeObserver(observer, "web-console-created");
-  ok(HUDService.hudReferences[aID], "We have a hud reference");
+  ok(HUDService.getHudReferenceById(aID), "We have a hud reference");
   content.wrappedJSObject.console.log("adding a log message");
 }
 
 function webConsoleDestroyed(aID)
 {
   Services.obs.removeObserver(observer, "web-console-destroyed");
-  ok(!HUDService.hudReferences[aID], "We do not have a hud reference");
+  ok(!HUDService.getHudReferenceById(aID), "We do not have a hud reference");
   executeSoon(finishTest);
 }
 
@@ -43,10 +43,10 @@ let observer = {
 
     switch(aTopic) {
       case "web-console-created":
-        webConsoleCreated(aSubject);
+        webConsoleCreated(aSubject.data);
         break;
       case "web-console-destroyed":
-        webConsoleDestroyed(aSubject);
+        webConsoleDestroyed(aSubject.data);
         break;
       case "web-console-message-created":
         webConsoleMessage(aSubject, aData);
diff --git a/browser/devtools/webconsole/test/browser_webconsole_property_provider.js b/browser/devtools/webconsole/test/browser_webconsole_property_provider.js
index 9d36a98ba9ae..463b1301a13e 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_property_provider.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_property_provider.js
@@ -15,11 +15,8 @@ function test() {
 
 function testPropertyProvider() {
   browser.removeEventListener("load", testPropertyProvider, true);
-
-  let tmp = {};
-  Cu.import("resource://gre/modules/devtools/WebConsoleUtils.jsm", tmp);
-  let JSPropertyProvider = tmp.JSPropertyProvider;
-  tmp = null;
+  let tools = Cu.import("resource://gre/modules/devtools/Loader.jsm", {}).devtools;
+  let JSPropertyProvider = tools.require("devtools/toolkit/webconsole/utils").JSPropertyProvider;
 
   let completion = JSPropertyProvider(content, "thisIsNotDefined");
   is (completion.matches.length, 0, "no match for 'thisIsNotDefined");
diff --git a/browser/devtools/webconsole/test/head.js b/browser/devtools/webconsole/test/head.js
index b7f1f4ce2cdc..9518e125df5f 100644
--- a/browser/devtools/webconsole/test/head.js
+++ b/browser/devtools/webconsole/test/head.js
@@ -3,18 +3,19 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-let tempScope = {};
-Cu.import("resource:///modules/HUDService.jsm", tempScope);
-let HUDService = tempScope.HUDService;
-Cu.import("resource://gre/modules/devtools/WebConsoleUtils.jsm", tempScope);
-let WebConsoleUtils = tempScope.WebConsoleUtils;
-Cu.import("resource:///modules/devtools/gDevTools.jsm", tempScope);
-let gDevTools = tempScope.gDevTools;
-Cu.import("resource://gre/modules/devtools/Loader.jsm", tempScope);
-let TargetFactory = tempScope.devtools.TargetFactory;
-Components.utils.import("resource://gre/modules/devtools/Console.jsm", tempScope);
-let console = tempScope.console;
-let promise = Cu.import("resource://gre/modules/commonjs/sdk/core/promise.js", {}).Promise;
+let WebConsoleUtils, gDevTools, TargetFactory, console, promise, require;
+
+(() => {
+  gDevTools = Cu.import("resource:///modules/devtools/gDevTools.jsm", {}).gDevTools;
+  console = Cu.import("resource://gre/modules/devtools/Console.jsm", {}).console;
+  promise = Cu.import("resource://gre/modules/commonjs/sdk/core/promise.js", {}).Promise;
+
+  let tools = Cu.import("resource://gre/modules/devtools/Loader.jsm", {}).devtools;
+  let utils = tools.require("devtools/toolkit/webconsole/utils");
+  TargetFactory = tools.TargetFactory;
+  WebConsoleUtils = utils.Utils;
+  require = tools.require;
+})();
 // promise._reportErrors = true; // please never leave me.
 
 let gPendingOutputTest = 0;
@@ -243,7 +244,7 @@ function dumpConsoles()
 {
   if (gPendingOutputTest) {
     console.log("dumpConsoles start");
-    for each (let hud in HUDService.hudReferences) {
+    for (let hud of HUDService.consoles) {
       if (!hud.outputNode) {
         console.debug("no output content for", hud.hudId);
         continue;
@@ -289,14 +290,12 @@ function finishTest()
 
   dumpConsoles();
 
-  if (HUDConsoleUI.browserConsole) {
-    let hud = HUDConsoleUI.browserConsole;
-
-    if (hud.jsterm) {
-      hud.jsterm.clearOutput(true);
+  let browserConsole = HUDService.getBrowserConsole();
+  if (browserConsole) {
+    if (browserConsole.jsterm) {
+      browserConsole.jsterm.clearOutput(true);
     }
-
-    HUDConsoleUI.toggleBrowserConsole().then(finishTest);
+    HUDService.toggleBrowserConsole().then(finishTest);
     return;
   }
 
@@ -319,8 +318,8 @@ function tearDown()
 {
   dumpConsoles();
 
-  if (HUDConsoleUI.browserConsole) {
-    HUDConsoleUI.toggleBrowserConsole();
+  if (HUDService.getBrowserConsole()) {
+    HUDService.toggleBrowserConsole();
   }
 
   let target = TargetFactory.forTab(gBrowser.selectedTab);
@@ -886,6 +885,9 @@ function getMessageElementText(aElement)
  *            message.
  *            - longString: boolean, set to |true} to match long strings in the
  *            message.
+ *            - type: match messages that are instances of the given object. For
+ *            example, you can point to Messages.NavigationMarker to match any
+ *            such message.
  *            - objects: boolean, set to |true| if you expect inspectable
  *            objects in the message.
  *            - source: object that can hold one property: url. This is used to
@@ -1065,8 +1067,25 @@ function waitForMessages(aOptions)
       return false;
     }
 
+    if (aRule.type) {
+      // The rule tries to match the newer types of messages, based on their
+      // object constructor.
+      if (!aElement._messageObject ||
+          !(aElement._messageObject instanceof aRule.type)) {
+        return false;
+      }
+    }
+    else if (aElement._messageObject) {
+      // If the message element holds a reference to its object, it means this
+      // is a newer message type. All of the older waitForMessages() rules do
+      // not expect this kind of messages. We return false here.
+      // TODO: we keep this behavior until bug 778766 is fixed. After that we
+      // will not require |type| to match newer types of messages.
+      return false;
+    }
+
     let partialMatch = !!(aRule.consoleTrace || aRule.consoleTime ||
-                          aRule.consoleTimeEnd);
+                          aRule.consoleTimeEnd || aRule.type);
 
     if (aRule.category && aElement.category != aRule.category) {
       if (partialMatch) {
diff --git a/browser/devtools/webconsole/webconsole.js b/browser/devtools/webconsole/webconsole.js
index c5dc3a2640ab..e7085c542830 100644
--- a/browser/devtools/webconsole/webconsole.js
+++ b/browser/devtools/webconsole/webconsole.js
@@ -6,45 +6,29 @@
 
 "use strict";
 
-const Cc = Components.classes;
-const Ci = Components.interfaces;
-const Cu = Components.utils;
+const {Cc, Ci, Cu} = require("chrome");
 
-Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+let WebConsoleUtils = require("devtools/toolkit/webconsole/utils").Utils;
 
-XPCOMUtils.defineLazyModuleGetter(this, "Services",
-                                  "resource://gre/modules/Services.jsm");
-
-XPCOMUtils.defineLazyServiceGetter(this, "clipboardHelper",
-                                   "@mozilla.org/widget/clipboardhelper;1",
-                                   "nsIClipboardHelper");
-
-XPCOMUtils.defineLazyModuleGetter(this, "GripClient",
-                                  "resource://gre/modules/devtools/dbg-client.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "NetworkPanel",
-                                  "resource:///modules/NetworkPanel.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "AutocompletePopup",
-                                  "resource:///modules/devtools/AutocompletePopup.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "WebConsoleUtils",
-                                  "resource://gre/modules/devtools/WebConsoleUtils.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "promise",
-                                  "resource://gre/modules/commonjs/sdk/core/promise.js", "Promise");
-
-XPCOMUtils.defineLazyModuleGetter(this, "VariablesView",
-                                  "resource:///modules/devtools/VariablesView.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "VariablesViewController",
-                                  "resource:///modules/devtools/VariablesViewController.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "EventEmitter",
-                                  "resource:///modules/devtools/shared/event-emitter.js");
-
-XPCOMUtils.defineLazyModuleGetter(this, "devtools",
-                                  "resource://gre/modules/devtools/Loader.jsm");
+loader.lazyServiceGetter(this, "clipboardHelper",
+                         "@mozilla.org/widget/clipboardhelper;1",
+                         "nsIClipboardHelper");
+loader.lazyImporter(this, "Services", "resource://gre/modules/Services.jsm");
+loader.lazyGetter(this, "promise", () => require("sdk/core/promise"));
+loader.lazyGetter(this, "EventEmitter", () => require("devtools/shared/event-emitter"));
+loader.lazyGetter(this, "AutocompletePopup",
+                  () => require("devtools/shared/autocomplete-popup").AutocompletePopup);
+loader.lazyGetter(this, "ToolSidebar",
+                  () => require("devtools/framework/sidebar").ToolSidebar);
+loader.lazyGetter(this, "NetworkPanel",
+                  () => require("devtools/webconsole/network-panel").NetworkPanel);
+loader.lazyGetter(this, "ConsoleOutput",
+                  () => require("devtools/webconsole/console-output").ConsoleOutput);
+loader.lazyGetter(this, "Messages",
+                  () => require("devtools/webconsole/console-output").Messages);
+loader.lazyImporter(this, "GripClient", "resource://gre/modules/devtools/dbg-client.jsm");
+loader.lazyImporter(this, "VariablesView", "resource:///modules/devtools/VariablesView.jsm");
+loader.lazyImporter(this, "VariablesViewController", "resource:///modules/devtools/VariablesViewController.jsm");
 
 const STRINGS_URI = "chrome://browser/locale/devtools/webconsole.properties";
 let l10n = new WebConsoleUtils.l10n(STRINGS_URI);
@@ -191,6 +175,7 @@ const PREF_PERSISTLOG = "devtools.webconsole.persistlog";
  * The WebConsoleFrame is responsible for the actual Web Console UI
  * implementation.
  *
+ * @constructor
  * @param object aWebConsoleOwner
  *        The WebConsole owner object.
  */
@@ -198,6 +183,7 @@ function WebConsoleFrame(aWebConsoleOwner)
 {
   this.owner = aWebConsoleOwner;
   this.hudId = this.owner.hudId;
+  this.window = this.owner.iframeWindow;
 
   this._repeatNodes = {};
   this._outputQueue = [];
@@ -205,6 +191,8 @@ function WebConsoleFrame(aWebConsoleOwner)
   this._networkRequests = {};
   this.filterPrefs = {};
 
+  this.output = new ConsoleOutput(this);
+
   this._toggleFilter = this._toggleFilter.bind(this);
   this._flushMessageQueue = this._flushMessageQueue.bind(this);
 
@@ -213,11 +201,12 @@ function WebConsoleFrame(aWebConsoleOwner)
 
   EventEmitter.decorate(this);
 }
+exports.WebConsoleFrame = WebConsoleFrame;
 
 WebConsoleFrame.prototype = {
   /**
    * The WebConsole instance that owns this frame.
-   * @see HUDService.jsm::WebConsole
+   * @see hudservice.js::WebConsole
    * @type object
    */
   owner: null,
@@ -341,6 +330,12 @@ WebConsoleFrame.prototype = {
    */
   outputNode: null,
 
+  /**
+   * The ConsoleOutput instance that manages all output.
+   * @type object
+   */
+  output: null,
+
   /**
    * The input element that allows the user to filter messages by string.
    * @type nsIDOMElement
@@ -471,9 +466,6 @@ WebConsoleFrame.prototype = {
    */
   _initUI: function WCF__initUI()
   {
-    // Remember that this script is loaded in the webconsole.xul context:
-    // |window| is the iframe global.
-    this.window = window;
     this.document = this.window.document;
     this.rootElement = this.document.documentElement;
 
@@ -483,6 +475,8 @@ WebConsoleFrame.prototype = {
     this._commandController = new CommandController(this);
     this.window.controllers.insertControllerAt(0, this._commandController);
 
+    this._contextMenuHandler = new ConsoleContextMenu(this);
+
     let doc = this.document;
 
     this.filterBox = doc.querySelector(".hud-filter-box");
@@ -626,6 +620,12 @@ WebConsoleFrame.prototype = {
       let jslog = this.document.querySelector("menuitem[prefKey=jslog]");
       jslog.hidden = true;
     }
+
+    if (Services.appinfo.OS == "Darwin") {
+      let net = this.document.querySelector("toolbarbutton[category=net]");
+      let accesskey = net.getAttribute("accesskeyMacOSX");
+      net.setAttribute("accesskey", accesskey);
+    }
   },
 
   /**
@@ -842,8 +842,6 @@ WebConsoleFrame.prototype = {
         node.classList.add("hud-filtered-by-type");
       }
     }
-
-    this.regroupOutput();
   },
 
   /**
@@ -870,8 +868,6 @@ WebConsoleFrame.prototype = {
         node.classList.add("hud-filtered-by-string");
       }
     }
-
-    this.regroupOutput();
   },
 
   /**
@@ -1762,6 +1758,35 @@ WebConsoleFrame.prototype = {
     }
   },
 
+  /**
+   * Handler for the tabNavigated notification.
+   *
+   * @param string aEvent
+   *        Event name.
+   * @param object aPacket
+   *        Notification packet received from the server.
+   */
+  handleTabNavigated: function WCF_handleTabNavigated(aEvent, aPacket)
+  {
+    if (aEvent == "will-navigate") {
+      if (this.persistLog) {
+        let marker = new Messages.NavigationMarker(aPacket.url, Date.now());
+        this.output.addMessage(marker);
+      }
+      else {
+        this.jsterm.clearOutput();
+      }
+    }
+
+    if (aPacket.url) {
+      this.onLocationChange(aPacket.url, aPacket.title);
+    }
+
+    if (aEvent == "navigate" && !aPacket.nativeConsoleAPI) {
+      this.logWarningAboutReplacedAPI();
+    }
+  },
+
   /**
    * Output a message node. This filters a node appropriately, then sends it to
    * the output, regrouping and pruning output as necessary.
@@ -1875,11 +1900,6 @@ WebConsoleFrame.prototype = {
       this._pruneCategoriesQueue = {};
     }
 
-    // Regroup messages at the end of the queue.
-    if (!this._outputQueue.length) {
-      this.regroupOutput();
-    }
-
     let isInputOutput = lastVisibleNode &&
       (lastVisibleNode.classList.contains("webconsole-msg-input") ||
        lastVisibleNode.classList.contains("webconsole-msg-output"));
@@ -2148,29 +2168,6 @@ WebConsoleFrame.prototype = {
     }
   },
 
-  /**
-   * Splits the given console messages into groups based on their timestamps.
-   */
-  regroupOutput: function WCF_regroupOutput()
-  {
-    // Go through the nodes and adjust the placement of "webconsole-new-group"
-    // classes.
-    let nodes = this.outputNode.querySelectorAll(".hud-msg-node" +
-      ":not(.hud-filtered-by-string):not(.hud-filtered-by-type)");
-    let lastTimestamp;
-    for (let i = 0, n = nodes.length; i < n; i++) {
-      let thisTimestamp = nodes[i].timestamp;
-      if (lastTimestamp != null &&
-          thisTimestamp >= lastTimestamp + NEW_GROUP_DELAY) {
-        nodes[i].classList.add("webconsole-new-group");
-      }
-      else {
-        nodes[i].classList.remove("webconsole-new-group");
-      }
-      lastTimestamp = thisTimestamp;
-    }
-  },
-
   /**
    * Given a category and message body, creates a DOM node to represent an
    * incoming message. The timestamp is automatically added.
@@ -2634,7 +2631,6 @@ WebConsoleFrame.prototype = {
 
     // Gather up the selected items and concatenate their clipboard text.
     let strings = [];
-    let newGroup = false;
 
     let children = this.outputNode.children;
 
@@ -2644,21 +2640,10 @@ WebConsoleFrame.prototype = {
         continue;
       }
 
-      // Add dashes between groups so that group boundaries show up in the
-      // copied output.
-      if (i > 0 && item.classList.contains("webconsole-new-group")) {
-        newGroup = true;
-      }
-
       // Ensure the selected item hasn't been filtered by type or string.
       if (!item.classList.contains("hud-filtered-by-type") &&
           !item.classList.contains("hud-filtered-by-string")) {
         let timestampString = l10n.timestampString(item.timestamp);
-        if (newGroup) {
-          strings.push("--");
-          newGroup = false;
-        }
-
         if (aOptions.linkOnly) {
           strings.push(item.url);
         }
@@ -2753,6 +2738,13 @@ WebConsoleFrame.prototype = {
       this.jsterm.destroy();
       this.jsterm = null;
     }
+    this.output.destroy();
+    this.output = null;
+
+    if (this._contextMenuHandler) {
+      this._contextMenuHandler.destroy();
+      this._contextMenuHandler = null;
+    }
 
     this._commandController = null;
 
@@ -3288,7 +3280,6 @@ JSTerm.prototype = {
   _createSidebar: function JST__createSidebar()
   {
     let tabbox = this.hud.document.querySelector("#webconsole-sidebar");
-    let ToolSidebar = devtools.require("devtools/framework/sidebar").ToolSidebar;
     this.sidebar = new ToolSidebar(tabbox, this, "webconsole");
     this.sidebar.show();
   },
@@ -4990,17 +4981,7 @@ WebConsoleConnectionProxy.prototype = {
       return;
     }
 
-    if (aEvent == "will-navigate" && !this.owner.persistLog) {
-      this.owner.jsterm.clearOutput();
-    }
-
-    if (aPacket.url) {
-      this.owner.onLocationChange(aPacket.url, aPacket.title);
-    }
-
-    if (aEvent == "navigate" && !aPacket.nativeConsoleAPI) {
-      this.owner.logWarningAboutReplacedAPI();
-    }
+    this.owner.handleTabNavigated(aEvent, aPacket);
   },
 
   /**
@@ -5063,40 +5044,35 @@ function gSequenceId()
 gSequenceId.n = 0;
 
 
-function goUpdateConsoleCommands() {
-  goUpdateCommand("consoleCmd_openURL");
-  goUpdateCommand("consoleCmd_copyURL");
-}
-
-
-
 ///////////////////////////////////////////////////////////////////////////////
 // Context Menu
 ///////////////////////////////////////////////////////////////////////////////
 
-const CONTEXTMENU_ID = "output-contextmenu";
-
 /*
- * ConsoleContextMenu: This handle to show/hide a context menu item.
+ * ConsoleContextMenu this used to handle the visibility of context menu items.
+ *
+ * @constructor
+ * @param object aOwner
+ *        The WebConsoleFrame instance that owns this object.
  */
-let ConsoleContextMenu = {
+function ConsoleContextMenu(aOwner)
+{
+  this.owner = aOwner;
+  this.popup = this.owner.document.getElementById("output-contextmenu");
+  this.build = this.build.bind(this);
+  this.popup.addEventListener("popupshowing", this.build);
+}
+
+ConsoleContextMenu.prototype = {
   /*
    * Handle to show/hide context menu item.
-   *
-   * @param nsIDOMEvent aEvent
    */
   build: function CCM_build(aEvent)
   {
-    let popup = aEvent.target;
-    if (popup.id !== CONTEXTMENU_ID) {
-      return;
-    }
-
-    let view = document.querySelector(".hud-output-node");
+    let view = this.owner.outputNode;
     let metadata = this.getSelectionMetadata(view);
 
-    for (let i = 0, l = popup.childNodes.length; i < l; ++i) {
-      let element = popup.childNodes[i];
+    for (let element of this.popup.children) {
       element.hidden = this.shouldHideMenuItem(element, metadata);
     }
   },
@@ -5173,4 +5149,15 @@ let ConsoleContextMenu = {
 
     return shouldHide;
   },
+
+  /**
+   * Destroy the ConsoleContextMenu object instance.
+   */
+  destroy: function CCM_destroy()
+  {
+    this.popup.removeEventListener("popupshowing", this.build);
+    this.popup = null;
+    this.owner = null;
+  },
 };
+
diff --git a/browser/devtools/webconsole/webconsole.xul b/browser/devtools/webconsole/webconsole.xul
index 16477771f627..eafb8955dd74 100644
--- a/browser/devtools/webconsole/webconsole.xul
+++ b/browser/devtools/webconsole/webconsole.xul
@@ -22,7 +22,12 @@
         width="900" height="350"
         persist="screenX screenY width height sizemode">
   <script type="text/javascript" src="chrome://global/content/globalOverlay.js"/>
-  <script type="text/javascript" src="webconsole.js"/>
+  <script type="text/javascript"><![CDATA[
+function goUpdateConsoleCommands() {
+  goUpdateCommand("consoleCmd_openURL");
+  goUpdateCommand("consoleCmd_copyURL");
+}
+  // ]]></script>
 
   <commandset id="editMenuCommands"/>
 
@@ -57,8 +62,7 @@
   <keyset id="editMenuKeys"/>
 
   <popupset id="mainPopupSet">
-    <menupopup id="output-contextmenu"
-               onpopupshowing="ConsoleContextMenu.build(event);">
+    <menupopup id="output-contextmenu">
       <menuitem id="saveBodiesContextMenu" type="checkbox" label="&saveBodies.label;"
                 accesskey="&saveBodies.accesskey;"/>
       <menuitem id="menu_openURL" label="&openURL.label;"
@@ -78,11 +82,8 @@
         <toolbarbutton label="&btnPageNet.label;" type="menu-button"
                        category="net" class="devtools-toolbarbutton webconsole-filter-button"
                        tooltiptext="&btnPageNet.tooltip;"
-#ifdef XP_MACOSX
-                       accesskey="&btnPageNet.accesskeyMacOSX;"
-#else
+                       accesskeyMacOSX="&btnPageNet.accesskeyMacOSX;"
                        accesskey="&btnPageNet.accesskey;"
-#endif
                        tabindex="3">
           <menupopup>
             <menuitem label="&btnConsoleErrors;" type="checkbox" autocheck="false"
diff --git a/browser/installer/package-manifest.in b/browser/installer/package-manifest.in
index d8ebfd38efdd..be663761d41f 100644
--- a/browser/installer/package-manifest.in
+++ b/browser/installer/package-manifest.in
@@ -190,7 +190,6 @@
 @BINPATH@/components/dom_canvas.xpt
 @BINPATH@/components/dom_contacts.xpt
 @BINPATH@/components/dom_alarm.xpt
-@BINPATH@/components/dom_push.xpt
 @BINPATH@/components/dom_core.xpt
 @BINPATH@/components/dom_css.xpt
 @BINPATH@/components/dom_devicestorage.xpt
diff --git a/browser/installer/removed-files.in b/browser/installer/removed-files.in
index 674d46a3574e..c8bbf93761db 100644
--- a/browser/installer/removed-files.in
+++ b/browser/installer/removed-files.in
@@ -1,1554 +1,96 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
-# Removed-files.in is processed at build time to create a list of files that
-# should be removed during an application update.
-# These files are in alphabetical order, except that files removed only on
-# certain platforms are after all of the regular files and obsolete Talkback and
-# Inspector files are at the very end.
-.autoreg
-@DLL_PREFIX@jsj@DLL_SUFFIX@
-@DLL_PREFIX@sqlite3@DLL_SUFFIX@
-@DLL_PREFIX@xpcom_compat@DLL_SUFFIX@
-@DLL_PREFIX@xpistub@DLL_SUFFIX@
-@DLL_PREFIX@zlib@DLL_SUFFIX@
-@DLL_PREFIX@jemalloc@DLL_SUFFIX@
-@DLL_PREFIX@mozutils@DLL_SUFFIX@
-#ifdef MOZ_STATIC_JS
-@DLL_PREFIX@mozjs@DLL_SUFFIX@
-#endif
-#ifdef MOZ_FOLD_LIBS
-@DLL_PREFIX@nspr4@DLL_SUFFIX@
-@DLL_PREFIX@plds4@DLL_SUFFIX@
-@DLL_PREFIX@plc4@DLL_SUFFIX@
-@DLL_PREFIX@ssl3@DLL_SUFFIX@
-@DLL_PREFIX@smime3@DLL_SUFFIX@
-@DLL_PREFIX@nssutil3@DLL_SUFFIX@
-@DLL_PREFIX@mozsqlite3@DLL_SUFFIX@
-#endif
-@DLL_PREFIX@xpcom@DLL_SUFFIX@
-LICENSE
-browserconfig.properties
-chrome/US.jar
-chrome/app-chrome.manifest
-chrome/browser.manifest
-chrome/chrome.rdf
-chrome/chromelist.txt
-chrome/classic.jar
-chrome/classic.manifest
-chrome/comm.jar
-chrome/comm.manifest
-chrome/en-win.jar
-chrome/help.jar
-chrome/installed-chrome.txt
-chrome/m3ffxtbr.jar
-chrome/m3ffxtbr.manifest
-chrome/overlayinfo/
-chrome/pippki.manifest
-chrome/reporter.jar
-chrome/reporter.manifest
-chrome/toolkit.manifest
-component.reg
-components/browser.manifest
-components/components.list
-components/@DLL_PREFIX@browserdirprovider@DLL_SUFFIX@
-components/@DLL_PREFIX@brwsrdir@DLL_SUFFIX@
-components/@DLL_PREFIX@myspell@DLL_SUFFIX@
-components/@DLL_PREFIX@spellchecker@DLL_SUFFIX@
-components/@DLL_PREFIX@spellchk@DLL_SUFFIX@
-#ifdef XP_MACOSX
-components/libalerts.dylib
-components/libalerts_s.dylib
-#endif
-components/aboutCertError.js
-components/aboutPrivateBrowsing.js
-components/aboutRights.js
-components/aboutRobots.js
-components/aboutSessionRestore.js
-components/autocomplete.xpt
-components/airbag.xpt
-components/bookmarks.xpt
-components/compreg.dat
-components/history.xpt
-components/microsummaries.xpt
-components/myspell/en-US.aff
-components/myspell/en-US.dic
-components/nsAddonRepository.js
-components/nsBackgroundUpdateService.js
-components/nsBookmarkTransactionManager.js
-components/nsCloseAllWindows.js
-components/nsDictionary.js
-components/nsExtensionManager.js
-components/nsInterfaceInfoToIDL.js
-components/nsScriptableIO.js
-components/nsUrlClassifierTable.js
-components/nsXmlRpcClient.js
-components/pluginGlue.js
-components/sidebar.xpt
-#ifdef MOZ_B2G_RIL
-components/dom_telephony.xpt
-components/dom_wifi.xpt
-components/dom_system_b2g.xpt
-#endif
-components/dom_sms.xpt
-components/dom_webspeech.xpt
-components/uconvd.dll
-components/WeaveCrypto.js
-components/WeaveCrypto.manifest
-components/xmlextras.xpt
-components/xpcom.xpt
-components/xpti.dat
-components/xptitemp.dat
-components/nsMicrosummaryService.js
-components/nsProxyAutoConfig.manifest
-components/nsProxyAutoConfig.js
-D3DCompiler_42.dll
-d3dx9_42.dll
-d3dx9_43.dll
-defaults/pref/all.js
-defaults/pref/bug259708.js
-defaults/pref/bug307259.js
-defaults/pref/reporter.js
-defaults/pref/security-prefs.js
-defaults/pref/services-aitc.js
-defaults/pref/winpref.js
-defaults/pref/xpinstall.js
-defaults/preferences/services-aitc.js
-defaults/preferences/services-notifications.js
-defaults/preferences/services-sync.js
-defaults/preferences/healthreport-prefs.js
-defaults/profile/US/
-defaults/profile/extensions/
-defaults/profile/extensions/Extensions.rdf
-defaults/profile/extensions/installed-extensions.txt
-defaults/profile/extensions/{972ce4c6-7e08-4474-a285-3208198ce6fd}/
-defaults/profile/extensions/{972ce4c6-7e08-4474-a285-3208198ce6fd}/install.rdf
-defaults/profile/search.rdf
-#ifndef SHIP_FEEDBACK
-# In the average case, this directory is only used by Test Pilot, and will get
-# removed by the updater. In some cases (eg, partner builds), distribution/
-# will have other files and/or directories in it. In these cases, the updater
-# will print a non-fatal error and continue on, because we're not appending
-# '*' to force a recursive removal.
-distribution/
-distribution/extensions/
+
+# The removed-files.in file specifies files and directories to be removed during
+# an application update that are not automatically removed by the application
+# update process. The application update process handles the vast majority of
+# file and directory removals automatically so this file should not be used in
+# the vast majority of cases.
+
+# When to use removed-files.in file to remove files and directories:
+# * Files and directories located in the installation's "distribution/" and
+#   "extensions/" directories that were added before Firefox 26. Files and
+#   directories located in these directories were not included in the
+#   application update file removals for a complete update prior to Firefox 26.
+# * Empty directories that were accidentally added to the installation
+#   directory.
+# * Third party files and directories that were added to the installation
+#   directory. Under normal circumstances this should only be done after release
+#   drivers have approved the removal of these third party files.
+
+# If you are not sure whether a file or directory should be removed using the
+# removed-files.in file please contact one of the developers that work on
+# application update.
+
+# Note: the "distribution/" and "browser/extensions/" directories should never
+# be removed recursively since these directories are used by Partner builds and
+# custom installations.
+
+# To specify a file to be removed add the path to the file.
+# * If the file doesn't exist the update will succeed.
+# * If the file exists and can't be removed (e.g. the file is locked) the
+#   update will fail.
+#
+# Example: path/to/file
+
+# To specify a directory to be removed only if it is empty add the path to the
+# directory with a trailing forward slash.
+# * If the directory doesn't exist the update will succeed.
+# * If the directory can't be removed (e.g. the directory is locked, contains
+#   files, etc.) the update will succeed.
+#
+# Example: path/to/dir/
+
+# To specify a directory that should be recursively removed add the path to the
+# directory with a trailing forward slash and "*".
+# * If the directory doesn't exist the update will succeed.
+# * If all of the files the directory contains can be removed but the directory
+#   or a subdirectory can't be removed (e.g. the directory is locked) the update
+#   will succeed.
+# * If a file within the directory can't be removed the update will fail.
+#
+# Example: path/to/dir/*
+
+# File Removals
+# This is located under the "distribution/" directory and it was added before
+# Firefox 26
 distribution/extensions/testpilot@labs.mozilla.com.xpi
-#endif
-extensions/talkback@mozilla.org/
-extensions/talkback@mozilla.org/chrome.manifest
-extensions/talkback@mozilla.org/components/@DLL_PREFIX@qfaservices@DLL_SUFFIX@
-extensions/talkback@mozilla.org/components/qfaservices.xpt
-extensions/talkback@mozilla.org/install.rdf
-extensions/{641d8d09-7dda-4850-8228-ac0ab65e2ac9}/
-extensions/{641d8d09-7dda-4850-8228-ac0ab65e2ac9}/install.rdf
-extensions/{972ce4c6-7e08-4474-a285-3208198ce6fd}/preview.png
-extensions/testpilot@labs.mozilla.com/chrome.manifest
-extensions/testpilot@labs.mozilla.com/components/TestPilot.js
-extensions/testpilot@labs.mozilla.com/content/all-studies-window.js
-extensions/testpilot@labs.mozilla.com/content/all-studies-window.xul
-extensions/testpilot@labs.mozilla.com/content/browser.css
-extensions/testpilot@labs.mozilla.com/content/browser.js
-extensions/testpilot@labs.mozilla.com/content/debug.html
-extensions/testpilot@labs.mozilla.com/content/experiment-page.js
-extensions/testpilot@labs.mozilla.com/content/feedback-browser.xul
-extensions/testpilot@labs.mozilla.com/content/flot/jquery.colorhelpers.js
-extensions/testpilot@labs.mozilla.com/content/flot/jquery.colorhelpers.min.js
-extensions/testpilot@labs.mozilla.com/content/flot/jquery.flot.crosshair.js
-extensions/testpilot@labs.mozilla.com/content/flot/jquery.flot.crosshair.min.js
-extensions/testpilot@labs.mozilla.com/content/flot/jquery.flot.image.js
-extensions/testpilot@labs.mozilla.com/content/flot/jquery.flot.image.min.js
-extensions/testpilot@labs.mozilla.com/content/flot/jquery.flot.js
-extensions/testpilot@labs.mozilla.com/content/flot/jquery.flot.min.js
-extensions/testpilot@labs.mozilla.com/content/flot/jquery.flot.navigate.js
-extensions/testpilot@labs.mozilla.com/content/flot/jquery.flot.navigate.min.js
-extensions/testpilot@labs.mozilla.com/content/flot/jquery.flot.selection.js
-extensions/testpilot@labs.mozilla.com/content/flot/jquery.flot.selection.min.js
-extensions/testpilot@labs.mozilla.com/content/flot/jquery.flot.stack.js
-extensions/testpilot@labs.mozilla.com/content/flot/jquery.flot.stack.min.js
-extensions/testpilot@labs.mozilla.com/content/flot/jquery.flot.threshold.js
-extensions/testpilot@labs.mozilla.com/content/flot/jquery.flot.threshold.min.js
-extensions/testpilot@labs.mozilla.com/content/flot/jquery.js
-extensions/testpilot@labs.mozilla.com/content/flot/jquery.min.js
-extensions/testpilot@labs.mozilla.com/content/raw-data-dialog.js
-extensions/testpilot@labs.mozilla.com/content/raw-data-dialog.xul
-extensions/testpilot@labs.mozilla.com/content/screen.css
-extensions/testpilot@labs.mozilla.com/content/status-quit.html
-extensions/testpilot@labs.mozilla.com/content/status.html
-extensions/testpilot@labs.mozilla.com/content/survey-generator.js
-extensions/testpilot@labs.mozilla.com/content/take-survey.html
-extensions/testpilot@labs.mozilla.com/content/tp-browser.xul
-extensions/testpilot@labs.mozilla.com/content/welcome-page.js
-extensions/testpilot@labs.mozilla.com/content/welcome.html
-extensions/testpilot@labs.mozilla.com/content/window-utils.js
-extensions/testpilot@labs.mozilla.com/defaults/preferences/preferences.js
-extensions/testpilot@labs.mozilla.com/install.rdf
-extensions/testpilot@labs.mozilla.com/instrument/chrome.manifest
-extensions/testpilot@labs.mozilla.com/instrument/install.rdf
-extensions/testpilot@labs.mozilla.com/instrument/instrument.jsm
-extensions/testpilot@labs.mozilla.com/instrument/instrument.xul
-extensions/testpilot@labs.mozilla.com/modules/dbutils.js
-extensions/testpilot@labs.mozilla.com/modules/experiment_data_store.js
-extensions/testpilot@labs.mozilla.com/modules/extension-update.js
-extensions/testpilot@labs.mozilla.com/modules/feedback.js
-extensions/testpilot@labs.mozilla.com/modules/jar-code-store.js
-extensions/testpilot@labs.mozilla.com/modules/lib/cuddlefish.js
-extensions/testpilot@labs.mozilla.com/modules/lib/memory.js
-extensions/testpilot@labs.mozilla.com/modules/lib/observer-service.js
-extensions/testpilot@labs.mozilla.com/modules/lib/plain-text-console.js
-extensions/testpilot@labs.mozilla.com/modules/lib/preferences-service.js
-extensions/testpilot@labs.mozilla.com/modules/lib/securable-module.js
-extensions/testpilot@labs.mozilla.com/modules/lib/timer.js
-extensions/testpilot@labs.mozilla.com/modules/lib/traceback.js
-extensions/testpilot@labs.mozilla.com/modules/lib/unit-test.js
-extensions/testpilot@labs.mozilla.com/modules/lib/unload.js
-extensions/testpilot@labs.mozilla.com/modules/lib/url.js
-extensions/testpilot@labs.mozilla.com/modules/log4moz.js
-extensions/testpilot@labs.mozilla.com/modules/metadata.js
-extensions/testpilot@labs.mozilla.com/modules/Observers.js
-extensions/testpilot@labs.mozilla.com/modules/remote-experiment-loader.js
-extensions/testpilot@labs.mozilla.com/modules/setup.js
-extensions/testpilot@labs.mozilla.com/modules/string_sanitizer.js
-extensions/testpilot@labs.mozilla.com/modules/tasks.js
-extensions/testpilot@labs.mozilla.com/skin/all/badge-default.png
-extensions/testpilot@labs.mozilla.com/skin/all/bg.jpg
-extensions/testpilot@labs.mozilla.com/skin/all/css/screen-standalone.css
-extensions/testpilot@labs.mozilla.com/skin/all/dino_32x32.png
-extensions/testpilot@labs.mozilla.com/skin/all/images/bg-status.jpg
-extensions/testpilot@labs.mozilla.com/skin/all/images/callout.png
-extensions/testpilot@labs.mozilla.com/skin/all/images/callout_continue.png
-extensions/testpilot@labs.mozilla.com/skin/all/images/data1.jpg
-extensions/testpilot@labs.mozilla.com/skin/all/images/data2.jpg
-extensions/testpilot@labs.mozilla.com/skin/all/images/home_comments.png
-extensions/testpilot@labs.mozilla.com/skin/all/images/home_computer.png
-extensions/testpilot@labs.mozilla.com/skin/all/images/home_continue.png
-extensions/testpilot@labs.mozilla.com/skin/all/images/home_quit.png
-extensions/testpilot@labs.mozilla.com/skin/all/images/home_results.png
-extensions/testpilot@labs.mozilla.com/skin/all/images/home_twitter.png
-extensions/testpilot@labs.mozilla.com/skin/all/images/home_upcoming.png
-extensions/testpilot@labs.mozilla.com/skin/all/logo.png
-extensions/testpilot@labs.mozilla.com/skin/all/mozilla-logo.png
-extensions/testpilot@labs.mozilla.com/skin/all/status-completed.png
-extensions/testpilot@labs.mozilla.com/skin/all/status-ejected.png
-extensions/testpilot@labs.mozilla.com/skin/all/status-missed.png
-extensions/testpilot@labs.mozilla.com/skin/all/testpilot_16x16.png
-extensions/testpilot@labs.mozilla.com/skin/all/testPilot_200x200.png
-extensions/testpilot@labs.mozilla.com/skin/all/testpilot_32x32.png
-extensions/testpilot@labs.mozilla.com/skin/all/tp-completedstudies-32x32.png
-extensions/testpilot@labs.mozilla.com/skin/all/tp-currentstudies-32x32.png
-extensions/testpilot@labs.mozilla.com/skin/all/tp-generic-32x32.png
-extensions/testpilot@labs.mozilla.com/skin/all/tp-learned-32x32.png
-extensions/testpilot@labs.mozilla.com/skin/all/tp-results-48x48.png
-extensions/testpilot@labs.mozilla.com/skin/all/tp-settings-32x32.png
-extensions/testpilot@labs.mozilla.com/skin/all/tp-study-48x48.png
-extensions/testpilot@labs.mozilla.com/skin/all/tp-submit-48x48.png
-extensions/testpilot@labs.mozilla.com/skin/linux/close_button.png
-extensions/testpilot@labs.mozilla.com/skin/linux/feedback-frown-16x16.png
-extensions/testpilot@labs.mozilla.com/skin/linux/feedback-smile-16x16.png
-extensions/testpilot@labs.mozilla.com/skin/linux/feedback.css
-extensions/testpilot@labs.mozilla.com/skin/mac/close_button.png
-extensions/testpilot@labs.mozilla.com/skin/mac/feedback-frown-16x16.png
-extensions/testpilot@labs.mozilla.com/skin/mac/feedback-smile-16x16.png
-extensions/testpilot@labs.mozilla.com/skin/mac/feedback.css
-extensions/testpilot@labs.mozilla.com/skin/mac/notification-tail-down.png
-extensions/testpilot@labs.mozilla.com/skin/mac/notification-tail-up.png
-extensions/testpilot@labs.mozilla.com/skin/win/close_button.png
-extensions/testpilot@labs.mozilla.com/skin/win/feedback-frown-16x16.png
-extensions/testpilot@labs.mozilla.com/skin/win/feedback-smile-16x16.png
-extensions/testpilot@labs.mozilla.com/skin/win/feedback.css
-extensions/testpilot@labs.mozilla.com/skin/win/notification-tail-down.png
-extensions/testpilot@labs.mozilla.com/skin/win/notification-tail-up.png
-extensions/testpilot@labs.mozilla.com/tests/test_data_store.js
-extensions/uriloader@pdf.js.xpi
-greprefs/all.js
-greprefs/security-prefs.js
-greprefs/xpinstall.js
-install.rdf
-modules/JSON.jsm
-modules/SpatialNavigation.js
-modules/utils.js
-mozilla-runtime@BIN_SUFFIX@
-old-homepage-default.properties
-README.txt
-res/arrow.gif
-res/arrowd.gif
-res/broken-image.gif
-res/broken-image.png
-res/charsetData.properties
-res/charsetalias.properties
-res/cmessage.txt
-res/fonts/fontEncoding.properties
-res/fonts/fontNameMap.properties
-res/fonts/mathfontCMEX10.properties
-res/fonts/mathfontCMSY10.properties
-res/fonts/mathfontMTExtra.properties
-res/fonts/mathfontMath1.properties
-res/fonts/mathfontMath2.properties
-res/fonts/mathfontMath4.properties
-res/fonts/mathfontPUA.properties
-res/fonts/pangoFontEncoding.properties
-res/forms.css
-res/full-screen-override.css
-res/hiddenWindow.html
-res/html.css
-res/html/gopher-audio.gif
-res/html/gopher-binary.gif
-res/html/gopher-find.gif
-res/html/gopher-image.gif
-res/html/gopher-menu.gif
-res/html/gopher-movie.gif
-res/html/gopher-sound.gif
-res/html/gopher-telnet.gif
-res/html/gopher-text.gif
-res/html/gopher-unknown.gif
-res/loading-image.gif
-res/loading-image.png
-res/maccharset.properties
-res/mathml.css
-res/os2charset.properties
-res/quirk.css
-res/ua.css
-res/unixcharset.properties
-res/viewsource.css
-res/wincharset.properties
-#ifdef XP_MACOSX
-run-mozilla.sh
-#endif
-searchplugins/DRAE.gif
-searchplugins/DRAE.png
-searchplugins/DRAE.src
-searchplugins/MediaDICO-fr.gif
-searchplugins/MediaDICO-fr.png
-searchplugins/MediaDICO-fr.src
-searchplugins/allegro-pl.gif
-searchplugins/allegro-pl.png
-searchplugins/allegro-pl.src
-searchplugins/amazon-de.gif
-searchplugins/amazon-de.png
-searchplugins/amazon-de.src
-searchplugins/amazon-en-GB.gif
-searchplugins/amazon-en-GB.png
-searchplugins/amazon-en-GB.src
-searchplugins/amazon-france.gif
-searchplugins/amazon-france.png
-searchplugins/amazon-france.src
-searchplugins/amazon-jp.gif
-searchplugins/amazon-jp.png
-searchplugins/amazon-jp.src
-searchplugins/amazondotcom-zh-TW.gif
-searchplugins/amazondotcom-zh-TW.png
-searchplugins/amazondotcom-zh-TW.src
-searchplugins/amazondotcom.gif
-searchplugins/amazondotcom.png
-searchplugins/amazondotcom.png
-searchplugins/amazondotcom.src
-searchplugins/amazondotcom.src
-searchplugins/answers.gif
-searchplugins/answers.png
-searchplugins/answers.png
-searchplugins/answers.src
-searchplugins/answers.src
-searchplugins/atlas-sk.gif
-searchplugins/atlas-sk.png
-searchplugins/atlas-sk.src
-searchplugins/baidu.gif
-searchplugins/baidu.png
-searchplugins/baidu.src
-searchplugins/bluu.xml
-searchplugins/bok-NO.gif
-searchplugins/bok-NO.png
-searchplugins/bok-NO.src
-searchplugins/bolcom-nl.gif
-searchplugins/bolcom-nl.png
-searchplugins/bolcom-nl.src
-searchplugins/bookplus-fi.gif
-searchplugins/bookplus-fi.png
-searchplugins/bookplus-fi.src
-searchplugins/caplex-NO.gif
-searchplugins/caplex-NO.png
-searchplugins/caplex-NO.src
-searchplugins/centrum-cz.gif
-searchplugins/centrum-cz.png
-searchplugins/centrum-cz.src
-searchplugins/centrum-cz.xml
-searchplugins/creativecommons-fi.gif
-searchplugins/creativecommons-fi.png
-searchplugins/creativecommons-fi.src
-searchplugins/creativecommons-it.gif
-searchplugins/creativecommons-it.png
-searchplugins/creativecommons-it.src
-searchplugins/creativecommons-zh-TW.gif
-searchplugins/creativecommons-zh-TW.png
-searchplugins/creativecommons-zh-TW.src
-searchplugins/creativecommons.gif
-searchplugins/creativecommons.png
-searchplugins/creativecommons.png
-searchplugins/creativecommons.src
-searchplugins/creativecommons.src
-searchplugins/daum-ko.gif
-searchplugins/daum-ko.png
-searchplugins/daum-ko.src
-searchplugins/demauro-it.gif
-searchplugins/demauro-it.png
-searchplugins/demauro-it.src
-searchplugins/dictionary-en-GB.gif
-searchplugins/dictionary-en-GB.png
-searchplugins/dictionary-en-GB.src
-searchplugins/dictionary.png
-searchplugins/dictionary.src
-searchplugins/dunaj-sk.gif
-searchplugins/dunaj-sk.png
-searchplugins/dunaj-sk.src
-searchplugins/eBay-de.gif
-searchplugins/eBay-de.png
-searchplugins/eBay-de.src
-searchplugins/eBay-en-GB.gif
-searchplugins/eBay-en-GB.png
-searchplugins/eBay-en-GB.src
-searchplugins/eBay-france.gif
-searchplugins/eBay-france.png
-searchplugins/eBay-france.src
-searchplugins/eBay-fy-NL.xml
-searchplugins/eBay-gu.gif
-searchplugins/eBay-gu.png
-searchplugins/eBay-gu.src
-searchplugins/eBay-nl.gif
-searchplugins/eBay-nl.png
-searchplugins/eBay-nl.src
-searchplugins/eBay-nl.xml
-searchplugins/eBay-zh-CN.gif
-searchplugins/eBay-zh-CN.png
-searchplugins/eBay-zh-CN.src
-searchplugins/eBay-zh-CN.xml
-searchplugins/eBay-zh-TW.gif
-searchplugins/eBay-zh-TW.png
-searchplugins/eBay-zh-TW.src
-searchplugins/eBay-zh-TW.xml
-searchplugins/eBay.gif
-searchplugins/eBay.gif
-searchplugins/eBay.png
-searchplugins/eBay.src
-searchplugins/eBay.src
-searchplugins/ebay-it.gif
-searchplugins/ebay-it.png
-searchplugins/ebay-it.src
-searchplugins/filesearchru.gif
-searchplugins/filesearchru.png
-searchplugins/filesearchru.src
-searchplugins/filesearchru.xml
-searchplugins/goo.gif
-searchplugins/goo.png
-searchplugins/goo.src
-searchplugins/goo.xml
-searchplugins/google-NO.gif
-searchplugins/google-NO.png
-searchplugins/google-NO.src
-searchplugins/google-ar.gif
-searchplugins/google-ar.png
-searchplugins/google-ar.src
-searchplugins/google-ar.xml
-searchplugins/google-bg.gif
-searchplugins/google-bg.png
-searchplugins/google-bg.src
-searchplugins/google-ca.gif
-searchplugins/google-ca.png
-searchplugins/google-ca.src
-searchplugins/google-de.gif
-searchplugins/google-de.png
-searchplugins/google-de.src
-searchplugins/google-dk.gif
-searchplugins/google-dk.png
-searchplugins/google-dk.src
-searchplugins/google-en-GB.gif
-searchplugins/google-en-GB.png
-searchplugins/google-en-GB.src
-searchplugins/google-es-ES.gif
-searchplugins/google-es-ES.png
-searchplugins/google-es-ES.src
-searchplugins/google-eu.gif
-searchplugins/google-eu.png
-searchplugins/google-eu.src
-searchplugins/google-fi.gif
-searchplugins/google-fi.png
-searchplugins/google-fi.src
-searchplugins/google-ga-IE.gif
-searchplugins/google-ga-IE.png
-searchplugins/google-ga-IE.src
-searchplugins/google-gu.gif
-searchplugins/google-gu.png
-searchplugins/google-gu.src
-searchplugins/google-it.gif
-searchplugins/google-it.png
-searchplugins/google-it.src
-searchplugins/google-jp.gif
-searchplugins/google-jp.png
-searchplugins/google-jp.src
-searchplugins/google-ko.gif
-searchplugins/google-ko.png
-searchplugins/google-ko.src
-searchplugins/google-lt.gif
-searchplugins/google-lt.png
-searchplugins/google-lt.src
-searchplugins/google-nl.gif
-searchplugins/google-nl.png
-searchplugins/google-nl.src
-searchplugins/google-pl.gif
-searchplugins/google-pl.png
-searchplugins/google-pl.src
-searchplugins/google-pt-BR.gif
-searchplugins/google-pt-BR.png
-searchplugins/google-pt-BR.src
-searchplugins/google-ro.gif
-searchplugins/google-ro.png
-searchplugins/google-ro.src
-searchplugins/google-ru.gif
-searchplugins/google-ru.png
-searchplugins/google-ru.src
-searchplugins/google-sl.gif
-searchplugins/google-sl.png
-searchplugins/google-sl.src
-searchplugins/google-zh-TW.gif
-searchplugins/google-zh-TW.png
-searchplugins/google-zh-TW.src
-searchplugins/google.gif
-searchplugins/google.gif
-searchplugins/google.png
-searchplugins/google.src
-searchplugins/google.src
-searchplugins/grandiccionari.gif
-searchplugins/grandiccionari.png
-searchplugins/grandiccionari.src
-searchplugins/grandiccionari.xml
-searchplugins/huuto-fi.gif
-searchplugins/huuto-fi.png
-searchplugins/huuto-fi.src
-searchplugins/jyxo-cz.gif
-searchplugins/jyxo-cz.png
-searchplugins/jyxo-cz.src
-searchplugins/lingvo.yandex.ru.gif
-searchplugins/lingvo.yandex.ru.png
-searchplugins/lingvo.yandex.ru.src
-searchplugins/lingvo.yandex.ru.xml
-searchplugins/llibres.gif
-searchplugins/llibres.png
-searchplugins/llibres.src
-searchplugins/mall-cz.gif
-searchplugins/mall-cz.png
-searchplugins/mall-cz.src
-searchplugins/mercadolivre-com-br.gif
-searchplugins/mercadolivre-com-br.png
-searchplugins/mercadolivre-com-br.src
-searchplugins/merlin-pl.gif
-searchplugins/merlin-pl.png
-searchplugins/merlin-pl.src
-searchplugins/najdi-si.gif
-searchplugins/najdi-si.png
-searchplugins/najdi-si.src
-searchplugins/nana.xml
-searchplugins/naver-ko.gif
-searchplugins/naver-ko.png
-searchplugins/naver-ko.src
-searchplugins/netex.xml
-searchplugins/nosaltres.gif
-searchplugins/nosaltres.png
-searchplugins/nosaltres.src
-searchplugins/nosaltres.xml
-searchplugins/pbi-pl.gif
-searchplugins/pbi-pl.png
-searchplugins/pbi-pl.src
-searchplugins/pbi-pl.xml
-searchplugins/priceru.gif
-searchplugins/priceru.png
-searchplugins/priceru.src
-searchplugins/pwn-pl.gif
-searchplugins/pwn-pl.png
-searchplugins/pwn-pl.src
-searchplugins/qxl-NO.gif
-searchplugins/qxl-NO.png
-searchplugins/qxl-NO.src
-searchplugins/rakuten.gif
-searchplugins/rakuten.png
-searchplugins/rakuten.src
-searchplugins/rambler.xml
-searchplugins/seznam-cz.gif
-searchplugins/seznam-cz.png
-searchplugins/seznam-cz.src
-searchplugins/sigov-gov-si.gif
-searchplugins/sigov-gov-si.png
-searchplugins/sigov-gov-si.src
-searchplugins/slunecnice-cz.gif
-searchplugins/slunecnice-cz.png
-searchplugins/slunecnice-cz.src
-searchplugins/submarino-com-br.gif
-searchplugins/submarino-com-br.png
-searchplugins/submarino-com-br.src
-searchplugins/taobao.gif
-searchplugins/taobao.png
-searchplugins/taobao.src
-searchplugins/taobao.xml
-searchplugins/telefonkatalogen-NO.gif
-searchplugins/telefonkatalogen-NO.png
-searchplugins/telefonkatalogen-NO.src
-searchplugins/termiadur.xml
-searchplugins/universal-pt.gif
-searchplugins/universal-pt.png
-searchplugins/universal-pt.src
-searchplugins/vandale-nl.gif
-searchplugins/vandale-nl.png
-searchplugins/vandale-nl.src
-searchplugins/walla_sites.gif
-searchplugins/walla_sites.png
-searchplugins/walla_sites.src
-searchplugins/wikipedia-bg.gif
-searchplugins/wikipedia-bg.png
-searchplugins/wikipedia-bg.src
-searchplugins/wikipedia-ca.gif
-searchplugins/wikipedia-ca.png
-searchplugins/wikipedia-ca.src
-searchplugins/wikipedia-de.gif
-searchplugins/wikipedia-de.png
-searchplugins/wikipedia-de.src
-searchplugins/wikipedia-en-CN.xml
-searchplugins/wikipedia-es-ES.gif
-searchplugins/wikipedia-es-ES.png
-searchplugins/wikipedia-es-ES.src
-searchplugins/wikipedia-eu.gif
-searchplugins/wikipedia-eu.png
-searchplugins/wikipedia-eu.src
-searchplugins/wikipedia-fi.gif
-searchplugins/wikipedia-fi.png
-searchplugins/wikipedia-fi.src
-searchplugins/wikipedia-fr.gif
-searchplugins/wikipedia-fr.png
-searchplugins/wikipedia-fr.src
-searchplugins/wikipedia-fy.gif
-searchplugins/wikipedia-fy.png
-searchplugins/wikipedia-fy.src
-searchplugins/wikipedia-he.gif
-searchplugins/wikipedia-he.png
-searchplugins/wikipedia-he.src
-searchplugins/wikipedia-it.gif
-searchplugins/wikipedia-it.png
-searchplugins/wikipedia-it.src
-searchplugins/wikipedia-lt.gif
-searchplugins/wikipedia-lt.png
-searchplugins/wikipedia-lt.src
-searchplugins/wikipedia-nl.gif
-searchplugins/wikipedia-nl.png
-searchplugins/wikipedia-nl.src
-searchplugins/wikipedia-pl.gif
-searchplugins/wikipedia-pl.png
-searchplugins/wikipedia-pl.src
-searchplugins/wikipedia-ru.gif
-searchplugins/wikipedia-ru.png
-searchplugins/wikipedia-ru.src
-searchplugins/wikipedia-sk.gif
-searchplugins/wikipedia-sk.png
-searchplugins/wikipedia-sk.src
-searchplugins/wikipedia-zh.xml
-searchplugins/wp-pl.gif
-searchplugins/wp-pl.png
-searchplugins/wp-pl.src
-searchplugins/yahoo-NO.gif
-searchplugins/yahoo-NO.png
-searchplugins/yahoo-NO.src
-searchplugins/yahoo-ar.gif
-searchplugins/yahoo-ar.png
-searchplugins/yahoo-ar.src
-searchplugins/yahoo-ca.gif
-searchplugins/yahoo-ca.png
-searchplugins/yahoo-ca.src
-searchplugins/yahoo-cn.gif
-searchplugins/yahoo-cn.png
-searchplugins/yahoo-cn.src
-searchplugins/yahoo-de.gif
-searchplugins/yahoo-de.png
-searchplugins/yahoo-de.src
-searchplugins/yahoo-dk.gif
-searchplugins/yahoo-dk.png
-searchplugins/yahoo-dk.src
-searchplugins/yahoo-en-GB.gif
-searchplugins/yahoo-en-GB.png
-searchplugins/yahoo-en-GB.src
-searchplugins/yahoo-es-ES.gif
-searchplugins/yahoo-es-ES.png
-searchplugins/yahoo-es-ES.src
-searchplugins/yahoo-fi.gif
-searchplugins/yahoo-fi.png
-searchplugins/yahoo-fi.src
-searchplugins/yahoo-france.gif
-searchplugins/yahoo-france.png
-searchplugins/yahoo-france.src
-searchplugins/yahoo-gu.gif
-searchplugins/yahoo-gu.png
-searchplugins/yahoo-gu.src
-searchplugins/yahoo-it.gif
-searchplugins/yahoo-it.png
-searchplugins/yahoo-it.src
-searchplugins/yahoo-jp-auctions.gif
-searchplugins/yahoo-jp-auctions.png
-searchplugins/yahoo-jp-auctions.src
-searchplugins/yahoo-jp-shopping.gif
-searchplugins/yahoo-jp-shopping.png
-searchplugins/yahoo-jp-shopping.src
-searchplugins/yahoo-jp-shopping.xml
-searchplugins/yahoo-jp.gif
-searchplugins/yahoo-jp.png
-searchplugins/yahoo-jp.src
-searchplugins/yahoo-kr.gif
-searchplugins/yahoo-kr.png
-searchplugins/yahoo-kr.src
-searchplugins/yahoo-nl.gif
-searchplugins/yahoo-nl.png
-searchplugins/yahoo-nl.src
-searchplugins/yahoo-pt-BR.gif
-searchplugins/yahoo-pt-BR.png
-searchplugins/yahoo-pt-BR.src
-searchplugins/yahoo-ru.xml
-searchplugins/yahoo-tw.gif
-searchplugins/yahoo-tw.png
-searchplugins/yahoo-tw.src
-searchplugins/yahoo-zh-CN.xml
-searchplugins/yahoo.gif
-searchplugins/yahoo.gif
-searchplugins/yahoo.png
-searchplugins/yahoo.src
-searchplugins/yahoo.src
-searchplugins/yandex.gif
-searchplugins/yandex.png
-searchplugins/yandex.src
-searchplugins/zoznam-sk.gif
-searchplugins/zoznam-sk.png
-searchplugins/zoznam-sk.src
-uninstall/UninstallDeerPark.exe
-uninstall/UninstallFirefox.exe
-uninstall/uninst.exe
-uninstall/uninstall.exe
-#ifndef MOZ_UPDATER
-  #ifdef XP_MACOSX
-    updater.app/
-  #else
-    updater@BIN_SUFFIX@
-  #endif
-  updater.ini
-#endif
-xpicleanup@BIN_SUFFIX@
-#ifdef MOZ_OMNIJAR
-  update.locale
-  omni.jar
-  chrome/af.jar
-  chrome/af.manifest
-  chrome/ar.jar
-  chrome/ar.manifest
-  chrome/as.jar
-  chrome/as.manifest
-  chrome/ast.jar
-  chrome/ast.manifest
-  chrome/be.jar
-  chrome/be.manifest
-  chrome/bg.jar
-  chrome/bg.manifest
-  chrome/bn-BD.jar
-  chrome/bn-BD.manifest
-  chrome/bn-IN.jar
-  chrome/bn-IN.manifest
-  chrome/ca.jar
-  chrome/ca.manifest
-  chrome/cs.jar
-  chrome/cs.manifest
-  chrome/cy.jar
-  chrome/cy.manifest
-  chrome/da.jar
-  chrome/da.manifest
-  chrome/de.jar
-  chrome/de.manifest
-  chrome/el.jar
-  chrome/el.manifest
-  chrome/en-GB.jar
-  chrome/en-GB.manifest
-  chrome/en-US.jar
-  chrome/en-US.manifest
-  chrome/eo.jar
-  chrome/eo.manifest
-  chrome/es-AR.jar
-  chrome/es-AR.manifest
-  chrome/es-CL.jar
-  chrome/es-CL.manifest
-  chrome/es-ES.jar
-  chrome/es-ES.manifest
-  chrome/es-MX.jar
-  chrome/es-MX.manifest
-  chrome/et.jar
-  chrome/et.manifest
-  chrome/eu.jar
-  chrome/eu.manifest
-  chrome/fa.jar
-  chrome/fa.manifest
-  chrome/fi.jar
-  chrome/fi.manifest
-  chrome/fr.jar
-  chrome/fr.manifest
-  chrome/fy-NL.jar
-  chrome/fy-NL.manifest
-  chrome/ga-IE.jar
-  chrome/ga-IE.manifest
-  chrome/gd.jar
-  chrome/gd.manifest
-  chrome/gl.jar
-  chrome/gl.manifest
-  chrome/gu-IN.jar
-  chrome/gu-IN.manifest
-  chrome/he.jar
-  chrome/he.manifest
-  chrome/hi-IN.jar
-  chrome/hi-IN.manifest
-  chrome/hr.jar
-  chrome/hr.manifest
-  chrome/hu.jar
-  chrome/hu.manifest
-  chrome/id.jar
-  chrome/id.manifest
-  chrome/is.jar
-  chrome/is.manifest
-  chrome/it.jar
-  chrome/it.manifest
-  chrome/ja-JP-mac.jar
-  chrome/ja-JP-mac.manifest
-  chrome/ja.jar
-  chrome/ja.manifest
-  chrome/ka.jar
-  chrome/ka.manifest
-  chrome/kk.jar
-  chrome/kk.manifest
-  chrome/kn.jar
-  chrome/kn.manifest
-  chrome/ko.jar
-  chrome/ko.manifest
-  chrome/ku.jar
-  chrome/ku.manifest
-  chrome/lt.jar
-  chrome/lt.manifest
-  chrome/lv.jar
-  chrome/lv.manifest
-  chrome/mk.jar
-  chrome/mk.manifest
-  chrome/ml.jar
-  chrome/ml.manifest
-  chrome/mn.jar
-  chrome/mn.manifest
-  chrome/mr.jar
-  chrome/mr.manifest
-  chrome/nb-NO.jar
-  chrome/nb-NO.manifest
-  chrome/nl.jar
-  chrome/nl.manifest
-  chrome/nn-NO.jar
-  chrome/nn-NO.manifest
-  chrome/oc.jar
-  chrome/oc.manifest
-  chrome/or.jar
-  chrome/or.manifest
-  chrome/pa-IN.jar
-  chrome/pa-IN.manifest
-  chrome/pl.jar
-  chrome/pl.manifest
-  chrome/pt-BR.jar
-  chrome/pt-BR.manifest
-  chrome/pt-PT.jar
-  chrome/pt-PT.manifest
-  chrome/rm.jar
-  chrome/rm.manifest
-  chrome/ro.jar
-  chrome/ro.manifest
-  chrome/ru.jar
-  chrome/ru.manifest
-  chrome/si.jar
-  chrome/si.manifest
-  chrome/sk.jar
-  chrome/sk.manifest
-  chrome/sl.jar
-  chrome/sl.manifest
-  chrome/sq.jar
-  chrome/sq.manifest
-  chrome/sr.jar
-  chrome/sr.manifest
-  chrome/sv-SE.jar
-  chrome/sv-SE.manifest
-  chrome/ta-LK.jar
-  chrome/ta-LK.manifest
-  chrome/ta.jar
-  chrome/ta.manifest
-  chrome/te.jar
-  chrome/te.manifest
-  chrome/th.jar
-  chrome/th.manifest
-  chrome/tr.jar
-  chrome/tr.manifest
-  chrome/uk.jar
-  chrome/uk.manifest
-  chrome/vi.jar
-  chrome/vi.manifest
-  chrome/zh-CN.jar
-  chrome/zh-CN.manifest
-  chrome/zh-TW.jar
-  chrome/zh-TW.manifest
-  chrome/browser.jar
-  chrome/localized.manifest
-  chrome/nonlocalized.manifest
-  chrome/pippki.jar
-  chrome/toolkit.jar
-  components/addonManager.js
-  components/Aitc.js
-  components/AitcComponents.manifest
-  components/amContentHandler.js
-  components/amWebInstallListener.js
-  components/binary.manifest
-  components/browser.xpt
-  components/BrowserElementParent.js
-  components/BrowserElementParent.manifest
-  components/BrowserElementPromptService.jsm
-  components/BrowserElementParent.jsm
-  components/contentAreaDropListener.js
-  components/contentSecurityPolicy.js
-  components/crypto-SDR.js
-  components/FeedConverter.js
-  components/FeedProcessor.js
-  components/FeedWriter.js
-  components/fuelApplication.js
-  components/GPSDGeolocationProvider.js
-  components/interfaces.manifest
-  components/jsconsole-clhandler.js
-  components/MetricsCollectionService.js
-  components/NetworkGeolocationProvider.js
-  components/NotificationsComponents.manifest
-  components/nsBadCertHandler.js
-  components/nsBlocklistService.js
-  components/nsBrowserContentHandler.js
-  components/nsBrowserGlue.js
-  components/nsContentDispatchChooser.js
-  components/nsContentPrefService.js
-  components/nsDefaultCLH.js
-  components/nsDownloadManagerUI.js
-  #ifdef XP_UNIX
-    #ifndef XP_MACOSX
-      components/nsFilePicker.js
-    #endif
-  #endif
-  components/nsFormAutoComplete.js
-  components/nsFormHistory.js
-  components/nsHandlerService.js
-  components/nsHelperAppDlg.js
-  components/nsINIProcessor.js
-  components/nsLivemarkService.js
-  components/nsLoginInfo.js
-  components/nsLoginManager.js
-  components/nsLoginManagerPrompter.js
-  components/nsPlacesAutoComplete.js
-  components/nsPlacesDBFlush.js
-  components/nsPlacesExpiration.js
-  components/nsPrivateBrowsingService.js
-  components/nsPrompter.js
-  components/nsProxyAutoConfig.manifest
-  components/nsProxyAutoConfig.js
-  components/nsSafebrowsingApplication.js
-  components/nsSearchService.js
-  components/nsSearchSuggestions.js
-  components/nsSessionStartup.js
-  components/nsSessionStore.js
-  components/nsSetDefaultBrowser.js
-  components/nsSidebar.js
-  components/nsTaggingService.js
-  components/nsTryToClose.js
-  components/nsUpdateService.js
-  components/nsUpdateServiceStub.js
-  components/nsUpdateTimerManager.js
-  components/nsUrlClassifierLib.js
-  components/nsUrlClassifierListManager.js
-  components/nsURLFormatter.js
-  components/nsWebHandlerApp.js
-  components/PlacesProtocolHandler.js
-  components/storage-Legacy.js
-  components/storage-mozStorage.js
-#ifdef MOZ_B2G_RIL
-  components/nsTelephonyWorker.manifest
-  components/nsTelephonyWorker.js
-  components/Telephony.manifest
-  components/Telephony.js
-  components/WifiWorker.js
-  components/WifiWorker.manifest
-  components/DOMWifiManager.js
-  components/DOMWifiManager.manifest
-#endif
-  components/txEXSLTRegExFunctions.js
-  components/Weave.js
-  components/Webapps.js
-  components/Webapps.manifest
-  components/WebContentConverter.js
-  defaults/autoconfig/platform.js
-  defaults/autoconfig/prefcalls.js
-  defaults/pref/firefox-branding.js
-  defaults/pref/firefox.js
-  defaults/pref/firefox-l10n.js
-  defaults/pref/services-sync.js
-  defaults/profile/bookmarks.html
-  defaults/profile/chrome/userChrome-example.css
-  defaults/profile/chrome/userContent-example.css
-  defaults/profile/localstore.rdf
-  defaults/profile/mimeTypes.rdf
-  defaults/profile/prefs.js
-  greprefs.js
-  hyphenation/
-  hyphenation/hyph_af.dic
-  hyphenation/hyph_bg.dic
-  hyphenation/hyph_ca.dic
-  hyphenation/hyph_cy.dic
-  hyphenation/hyph_da.dic
-  hyphenation/hyph_de-1901.dic
-  hyphenation/hyph_de-1996.dic
-  hyphenation/hyph_de-CH.dic
-  hyphenation/hyph_en_US.dic
-  hyphenation/hyph_eo.dic
-  hyphenation/hyph_es.dic
-  hyphenation/hyph_et.dic
-  hyphenation/hyph_fi.dic
-  hyphenation/hyph_fr.dic
-  hyphenation/hyph_gl.dic
-  hyphenation/hyph_hr.dic
-  hyphenation/hyph_hsb.dic
-  hyphenation/hyph_hu.dic
-  hyphenation/hyph_ia.dic
-  hyphenation/hyph_is.dic
-  hyphenation/hyph_it.dic
-  hyphenation/hyph_kmr.dic
-  hyphenation/hyph_la.dic
-  hyphenation/hyph_lt.dic
-  hyphenation/hyph_mn.dic
-  hyphenation/hyph_nb.dic
-  hyphenation/hyph_nl.dic
-  hyphenation/hyph_nn.dic
-  hyphenation/hyph_pt.dic
-  hyphenation/hyph_ru.dic
-  hyphenation/hyph_sh.dic
-  hyphenation/hyph_sl.dic
-  hyphenation/hyph_sv.dic
-  hyphenation/hyph_tr.dic
-  hyphenation/hyph_uk.dic
-  modules/AddonLogging.jsm
-  modules/AddonManager.jsm
-  modules/AddonRepository.jsm
-  modules/AddonUpdateChecker.jsm
-  modules/CertUtils.jsm
-  modules/CrashSubmit.jsm
-  modules/CSPUtils.jsm
-  modules/ctypes.jsm
-  modules/debug.js
-  modules/distribution.js
-  modules/DownloadLastDir.jsm
-  modules/DownloadPaths.jsm
-  #ifdef XP_WIN
-    modules/DownloadTaskbarProgress.jsm
-  #endif
-  modules/DownloadUtils.jsm
-  modules/FileUtils.jsm
-  modules/Geometry.jsm
-  modules/HUDService.jsm
-  modules/InlineSpellChecker.jsm
-  modules/ISO8601DateUtils.jsm
-  modules/LightweightThemeConsumer.jsm
-  modules/LightweightThemeManager.jsm
-  modules/Microformats.js
-  modules/NetUtil.jsm
-  modules/NetworkPrioritizer.jsm
-  modules/openLocationLastURL.jsm
-  modules/PerfMeasurement.jsm
-  modules/PlacesDBUtils.jsm
-  modules/PlacesUIUtils.jsm
-  modules/PlacesUtils.jsm
-  modules/PluginProvider.jsm
-  modules/PluralForm.jsm
-  modules/PopupNotifications.jsm
-  modules/reflect.jsm
-  modules/Services.jsm
-  modules/services-common/async.js
-  modules/services-common/log4moz.js
-  modules/services-common/observers.js
-  modules/services-common/preferences.js
-  modules/services-common/rest.js
-  modules/services-common/stringbundle.js
-  modules/services-common/utils.js
-  modules/services-notifications/service.js
-  modules/services-sync/auth.js
-  modules/services-sync/base_records/collection.js
-  modules/services-sync/base_records/crypto.js
-  modules/services-sync/base_records/keys.js
-  modules/services-sync/base_records/wbo.js
-  modules/services-sync/constants.js
-  modules/services-sync/engines/bookmarks.js
-  modules/services-sync/engines/clients.js
-  modules/services-sync/engines/forms.js
-  modules/services-sync/engines/history.js
-  modules/services-sync/engines.js
-  modules/services-sync/engines/passwords.js
-  modules/services-sync/engines/prefs.js
-  modules/services-sync/engines/tabs.js
-  modules/services-sync/ext/Observers.js
-  modules/services-sync/ext/Preferences.js
-  modules/services-sync/ext/StringBundle.js
-  modules/services-sync/ext/Sync.js
-  modules/services-sync/identity.js
-  modules/services-sync/log4moz.js
-  modules/services-sync/notifications.js
-  modules/services-sync/resource.js
-  modules/services-sync/service.js
-  modules/services-sync/status.js
-  modules/services-sync/stores.js
-  modules/services-sync/trackers.js
-  modules/services-sync/type_records/bookmark.js
-  modules/services-sync/type_records/clients.js
-  modules/services-sync/type_records/forms.js
-  modules/services-sync/type_records/history.js
-  modules/services-sync/type_records/passwords.js
-  modules/services-sync/type_records/prefs.js
-  modules/services-sync/type_records/tabs.js
-  modules/services-sync/util.js
-  modules/stylePanel.jsm
-  modules/tabview/AllTabs.jsm
-  modules/tabview/groups.jsm
-  modules/tabview/utils.jsm
-  modules/Webapps.jsm
-  modules/WindowDraggingUtils.jsm
-  #ifdef XP_WIN
-    modules/WindowsJumpLists.jsm
-    modules/WindowsPreviewPerTab.jsm
-  #endif
-  modules/XPCOMUtils.jsm
-  modules/XPIProvider.jsm
-  res/contenteditable.css
-  res/designmode.css
-  res/dtd/mathml.dtd
-  res/dtd/xhtml11.dtd
-  res/EditorOverride.css
-  res/entityTables/html40Latin1.properties
-  res/entityTables/html40Special.properties
-  res/entityTables/html40Symbols.properties
-  res/entityTables/htmlEntityVersions.properties
-  res/entityTables/mathml20.properties
-  res/entityTables/transliterate.properties
-  res/fonts/mathfont.properties
-  res/fonts/mathfontStandardSymbolsL.properties
-  res/fonts/mathfontSTIXNonUnicode.properties
-  res/fonts/mathfontSTIXSize1.properties
-  res/fonts/mathfontSTIXSizeOneSym.properties
-  #ifdef XP_WIN
-    res/fonts/mathfontSymbol.properties
-  #endif
-  res/fonts/mathfontUnicode.properties
-  res/grabber.gif
-  res/html/folder.png
-  res/langGroups.properties
-  res/language.properties
-  res/svg.css
-  res/table-add-column-after-active.gif
-  res/table-add-column-after.gif
-  res/table-add-column-after-hover.gif
-  res/table-add-column-before-active.gif
-  res/table-add-column-before.gif
-  res/table-add-column-before-hover.gif
-  res/table-add-row-after-active.gif
-  res/table-add-row-after.gif
-  res/table-add-row-after-hover.gif
-  res/table-add-row-before-active.gif
-  res/table-add-row-before.gif
-  res/table-add-row-before-hover.gif
-  res/table-remove-column-active.gif
-  res/table-remove-column.gif
-  res/table-remove-column-hover.gif
-  res/table-remove-row-active.gif
-  res/table-remove-row.gif
-  res/table-remove-row-hover.gif
-#else
-  components/binary.manifest
-  omni.jar
-  omni.ja
-#endif
-#ifdef XP_MACOSX
-  ../Plug-Ins/PrintPDE.plugin/Contents/Info.plist
-  ../Plug-Ins/PrintPDE.plugin/Contents/MacOS/PrintPDE
-  ../Plug-Ins/PrintPDE.plugin/Contents/Resources/English.lproj/Localizable.strings
-  ../Plug-Ins/PrintPDE.plugin/Contents/Resources/English.lproj/PrintPDE.nib/classes.nib
-  ../Plug-Ins/PrintPDE.plugin/Contents/Resources/English.lproj/PrintPDE.nib/info.nib
-  ../Plug-Ins/PrintPDE.plugin/Contents/Resources/English.lproj/PrintPDE.nib/objects.xib
-  ../Resources/firefox-bin.rsrc
-  components/accessibility.xpt
-  components/alerts.xpt
-  components/appshell.xpt
-  components/appstartup.xpt
-  components/autoconfig.xpt
-  components/browser-feeds.xpt
-  components/browsercompsbase.xpt
-  components/browsersearch.xpt
-  components/caps.xpt
-  components/chardet.xpt
-  components/chrome.xpt
-  components/commandhandler.xpt
-  components/commandlines.xpt
-  components/composer.xpt
-  components/content.xpt
-  components/content_base.xpt
-  components/content_html.xpt
-  components/content_htmldoc.xpt
-  components/content_xmldoc.xpt
-  components/content_xslt.xpt
-  components/content_xtf.xpt
-  components/contentprefs.xpt
-  components/cookie.xpt
-  components/crashreporter.xpt
-  components/directory.xpt
-  components/docshell.xpt
-  components/dom.xpt
-  components/dom_apps.xpt
-  components/dom_base.xpt
-#ifdef MOZ_B2G_RIL
-  components/dom_telephony.xpt
-  components/dom_wifi.xpt
-  components/dom_system_b2g.xpt
-#endif
-  components/dom_canvas.xpt
-  components/dom_core.xpt
-  components/dom_css.xpt
-  components/dom_events.xpt
-  components/dom_geolocation.xpt
-  components/dom_devicestorage.xpt
-  components/dom_html.xpt
-  components/dom_json.xpt
-  components/dom_loadsave.xpt
-  components/dom_offline.xpt
-  components/dom_push.xpt
-  components/dom_range.xpt
-  components/dom_sidebar.xpt
-  components/dom_smil.xpt
-  components/dom_storage.xpt
-  components/dom_stylesheets.xpt
-  components/dom_svg.xpt
-  components/dom_threads.xpt
-  components/dom_traversal.xpt
-  components/dom_views.xpt
-  components/dom_xbl.xpt
-  components/dom_xpath.xpt
-  components/dom_xul.xpt
-  components/downloads.xpt
-  components/editor.xpt
-  components/embed_base.xpt
-  components/extensions.xpt
-  components/exthandler.xpt
-  components/exthelper.xpt
-  components/fastfind.xpt
-  components/feeds.xpt
-  components/find.xpt
-  components/firefox.xpt
-  components/fuel.xpt
-  components/gfx.xpt
-  components/gksvgrenderer.xpt
-  components/html5.xpt
-  components/htmlparser.xpt
-  components/imgicon.xpt
-  components/imglib2.xpt
-  components/inspector.xpt
-  components/intl.xpt
-  components/jar.xpt
-  components/jsconsole.xpt
-  components/jsdservice.xpt
-  components/layout_base.xpt
-  components/layout_printing.xpt
-  components/layout_xul.xpt
-  components/layout_xul_tree.xpt
-  components/locale.xpt
-  components/loginmgr.xpt
-  components/lwbrk.xpt
-  components/migration.xpt
-  components/mimetype.xpt
-  components/mozbrwsr.xpt
-  components/mozfind.xpt
-  components/necko.xpt
-  components/necko_about.xpt
-  components/necko_cache.xpt
-  components/necko_cookie.xpt
-  components/necko_data.xpt
-  components/necko_dns.xpt
-  components/necko_file.xpt
-  components/necko_ftp.xpt
-  components/necko_http.xpt
-  components/necko_res.xpt
-  components/necko_socket.xpt
-  components/necko_strconv.xpt
-  components/necko_viewsource.xpt
-  components/necko_wifi.xpt
-  components/nsKillAll.js
-  components/nsProgressDialog.js
-  components/nsResetPref.js
-  components/oji.xpt
-  components/parentalcontrols.xpt
-  components/passwordmgr.xpt
-  components/pipboot.xpt
-  components/pipnss.xpt
-  components/pippki.xpt
-  components/places.xpt
-  components/plugin.xpt
-  components/pref.xpt
-  components/prefetch.xpt
-  components/profile.xpt
-  components/progressDlg.xpt
-  components/proxyObjInst.xpt
-  components/rdf.xpt
-  components/safebrowsing.xpt
-  components/satchel.xpt
-  components/saxparser.xpt
-  components/search.xpt
-  components/sessionstore.xpt
-  components/shellservice.xpt
-  components/shistory.xpt
-  components/spellchecker.xpt
-  components/storage.xpt
-  components/toolkitprofile.xpt
-  components/toolkitsearch.xpt
-  components/txmgr.xpt
-  components/txtsvc.xpt
-  components/uconv.xpt
-  components/unicharutil.xpt
-  components/update.xpt
-  components/uriloader.xpt
-  components/url-classifier.xpt
-  components/urlformatter.xpt
-  components/webBrowser_core.xpt
-  components/webbrowserpersist.xpt
-  components/webshell_idls.xpt
-  components/websrvcs.xpt
-  components/widget.xpt
-  components/widget_cocoa.xpt
-  components/widget_mac.xpt
-  components/windowds.xpt
-  components/windowwatcher.xpt
-  components/xml-rpc.xpt
-  components/xpcom_base.xpt
-  components/xpcom_components.xpt
-  components/xpcom_ds.xpt
-  components/xpcom_io.xpt
-  components/xpcom_obsolete.xpt
-  components/xpcom_system.xpt
-  components/xpcom_threads.xpt
-  components/xpcom_xpti.xpt
-  components/xpconnect.xpt
-  components/xpinstall.xpt
-  components/xulapp.xpt
-  components/xuldoc.xpt
-  components/xultmpl.xpt
-  components/zipwriter.xpt
-  extensions/inspector@mozilla.org/chrome/chromelist.txt
-  init.d/README
-  libwidget.rsrc
-  plugin-container
-  plugins/Default Plugin.plugin/Contents/Info.plist
-  plugins/Default Plugin.plugin/Contents/MacOS/Default Plugin
-  plugins/Default Plugin.plugin/Contents/PkgInfo
-  plugins/Default Plugin.plugin/Contents/Resources/Default Plugin.rsrc
-  plugins/Default Plugin.plugin/Contents/Resources/English.lproj/InfoPlist.strings
-  plugins/DefaultPlugin.plugin/Contents/Info.plist
-  plugins/DefaultPlugin.plugin/Contents/MacOS/DefaultPlugin
-  plugins/DefaultPlugin.plugin/Contents/Resources/English.lproj/InfoPlist.strings
-  plugins/DefaultPlugin.plugin/Contents/Resources/plugin.png
-  plugins/JavaEmbeddingPlugin.bundle/Contents/Info.plist
-  plugins/JavaEmbeddingPlugin.bundle/Contents/MacOS/JavaEmbeddingPlugin
-  plugins/JavaEmbeddingPlugin.bundle/Contents/MacOS/JavaEmbeddingPlugin.policy
-  plugins/JavaEmbeddingPlugin.bundle/Contents/PkgInfo
-  plugins/JavaEmbeddingPlugin.bundle/Contents/Resources/English.lproj/InfoPlist.strings
-  plugins/JavaEmbeddingPlugin.bundle/Contents/Resources/Java/JavaEmbeddingPlugin.jar
-  plugins/MRJPlugin.plugin/Contents/Info.plist
-  plugins/MRJPlugin.plugin/Contents/MacOS/MRJPlugin
-  plugins/MRJPlugin.plugin/Contents/MacOS/MRJPlugin.jar
-  plugins/MRJPlugin.plugin/Contents/MacOS/MRJPlugin.policy
-  plugins/MRJPlugin.plugin/Contents/MacOS/MRJPlugin.properties
-  plugins/MRJPlugin.plugin/Contents/PkgInfo
-  plugins/MRJPlugin.plugin/Contents/Resources/English.lproj/InfoPlist.strings
-  plugins/MRJPlugin.plugin/Contents/Resources/MRJPlugin.rsrc
-  redo-prebinding.sh
-  res/bloatcycle.html
-  res/cursors/arrowN.tiff
-  res/cursors/arrowS.tiff
-  res/cursors/colResize.tiff
-  res/cursors/help.tiff
-  res/cursors/rowResize.tiff
-  res/cursors/sizeNE.tiff
-  res/cursors/sizeNESW.tiff
-  res/cursors/sizeNS.tiff
-  res/cursors/sizeNW.tiff
-  res/cursors/sizeNWSE.tiff
-  res/cursors/sizeSE.tiff
-  res/cursors/sizeSW.tiff
-  res/cursors/spin1.tiff
-  res/cursors/spin2.tiff
-  res/cursors/spin3.tiff
-  res/cursors/spin4.tiff
-  res/cursors/vtIBeam.tiff
-  res/cursors/zoomIn.tiff
-  res/cursors/zoomOut.tiff
-  res/cursors/CVS/Entries
-  res/cursors/CVS/Repository
-  res/cursors/CVS/Root
-  res/cursors/CVS/Tag
-  res/viewer.properties
-  updater.app/Contents/MacOS/updater.ini
-#endif
+
+# Directory removals
+chrome/
 #ifdef XP_UNIX
   #ifndef XP_MACOSX
-    chrome/icons/default/default.xpm
-    components/libimgicon.so
-    dictionaries/PL.aff
-    dictionaries/PL.dic
-    icons/document.png
-    icons/mozicon16.xpm
-    icons/mozicon50.xpm
-    plugins/libnullplugin.so
-    readme.txt
+    chrome/icons/
+    chrome/icons/default/
   #endif
 #endif
-#ifndef XP_WIN
-  res/fonts/mathfontSymbol.properties
-#endif
-#ifdef XP_WIN
-  components/brwsrcmp.dll
-  components/jsd3250.dll
-  components/nsPostUpdateWin.js
-  js3250.dll
-  mozcpp19.dll
-  mozcrt19.dll
-  #if MOZ_MSVC_REDIST != 1400
-    Microsoft.VC80.CRT.manifest
-    msvcm80.dll
-    msvcp80.dll
-    msvcr80.dll
-  #endif
-  #if MOZ_MSVC_REDIST != 1500
-    Microsoft.VC90.CRT.manifest
-    msvcm90.dll
-    msvcp90.dll
-    msvcr90.dll
-  #endif
-  #if MOZ_MSVC_REDIST != 1600
-    msvcp100.dll
-    msvcr100.dll
-  #endif
-  #if MOZ_MSVC_REDIST != 1700
-    msvcp110.dll
-    msvcr110.dll
-    #ifdef MOZ_METRO
-      vccorlib110.dll
-    #endif
-  #endif
-  #if MOZ_MSVC_REDIST != 1800
-    msvcp120.dll
-    msvcr120.dll
-    #ifdef MOZ_METRO
-      vccorlib120.dll
-    #endif
-  #endif
-  plugins/npnul32.dll
-#endif
-@DLL_PREFIX@xpcom_core@DLL_SUFFIX@
-components/@DLL_PREFIX@jar50@DLL_SUFFIX@
-#ifdef XP_WIN
-  components/xpinstal.dll
-#else
-  components/@DLL_PREFIX@jsd@DLL_SUFFIX@
-  components/@DLL_PREFIX@xpinstall@DLL_SUFFIX@
-#endif
-#ifndef MOZ_UPDATER
-  components/nsUpdateService.js
-  components/nsUpdateServiceStub.js
-#endif
-#Talkback
-#ifdef XP_WIN
-  extensions/talkback@mozilla.org/components/BrandRes.dll
-  extensions/talkback@mozilla.org/components/fullsoft.dll
-  extensions/talkback@mozilla.org/components/master.ini
-  extensions/talkback@mozilla.org/components/talkback-l10n.ini
-  extensions/talkback@mozilla.org/components/talkback.cnt
-  extensions/talkback@mozilla.org/components/talkback.exe
-  extensions/talkback@mozilla.org/components/talkback.hlp
-  extensions/talkback@mozilla.org/InstallDisabled
-#else
-  #ifdef XP_MACOSX
-    extensions/talkback@mozilla.org/components/talkback/master.ini
-    extensions/talkback@mozilla.org/components/talkback/talkback@DLL_SUFFIX@
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Info.plist
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/MacOS/Talkback
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/pbdevelopment.plist
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/PkgInfo
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/delete.tiff
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/disable.tiff
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/enable.tiff
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/English.lproj/ArchivingSettings.nib/classes.nib
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/English.lproj/ArchivingSettings.nib/info.nib
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/English.lproj/ArchivingSettings.nib/objects.nib
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/English.lproj/InfoPlist.strings
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/English.lproj/IntroWizard.nib/classes.nib
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/English.lproj/IntroWizard.nib/info.nib
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/English.lproj/IntroWizard.nib/objects.nib
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/English.lproj/Localizable.strings
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/English.lproj/MainMenu.nib/classes.nib
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/English.lproj/MainMenu.nib/info.nib
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/English.lproj/MainMenu.nib/objects.nib
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/English.lproj/ProxySettings.nib/classes.nib
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/English.lproj/ProxySettings.nib/info.nib
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/English.lproj/ProxySettings.nib/objects.nib
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/English.lproj/SendingSettings.nib/classes.nib
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/English.lproj/SendingSettings.nib/info.nib
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/English.lproj/SendingSettings.nib/objects.nib
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/KeyInfoKeys.plist
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/KeyInfoSections.plist
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/send.tiff
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/sort_ascending.tiff
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/sort_descending.tiff
-    extensions/talkback@mozilla.org/components/talkback/Talkback.app/Contents/Resources/Talkback.icns
-  #else
-    extensions/talkback@mozilla.org/components/talkback/talkback
-    extensions/talkback@mozilla.org/components/talkback/XTalkback.ad
-    extensions/talkback@mozilla.org/components/talkback/master.ini
-    extensions/talkback@mozilla.org/components/talkback/talkback.so
-  #endif
-#endif
-#Remove Talkback files from old location (in case user updates from 1.0.x)
-components/BrandRes.dll
-components/fullsoft.dll
-components/master.ini
-components/qfaservices.dll
-components/qfaservices.xpt
-components/talkback-l10n.ini
-components/talkback.cnt
-components/talkback.exe
-components/talkback.hlp
-components/libqfaservices.so
-components/talkback/master.ini
-components/talkback/talkback
-components/talkback/talkback.so
-components/talkback/XTalkback.ad
-extensions/reporter@mozilla.org/install.rdf
-extensions/reporter@mozilla.org/chrome.manifest
-extensions/reporter@mozilla.org/chrome/reporter.jar
-extensions/reporter@mozilla.org/defaults/preferences/reporter.js
-#Remove Inspector (present from upgrades from Fx2/Fx3b3)
-extensions/inspector@mozilla.org/install.rdf
-extensions/inspector@mozilla.org/components/inspector-cmdline.js
-extensions/inspector@mozilla.org/chrome.manifest
-extensions/inspector@mozilla.org/chrome/inspector.jar
-extensions/inspector@mozilla.org/defaults/preferences/inspector.js
-extensions/inspector@mozilla.org/platform/WINNT/chrome/icons/default/winInspectorMain.ico
-extensions/inspector@mozilla.org/components/inspector.xpt
-extensions/inspector@mozilla.org/components/@DLL_PREFIX@inspector@DLL_SUFFIX@
-extensions/inspector@mozilla.org/chrome/icons/default/winInspectorMain.ico
-components/nsPlacesTransactionsService.js
-components/browserplaces.xpt
-components/nsPlacesDBFlush.js
-#ifndef MOZ_MAINTENANCE_SERVICE
-maintenanceservice.exe
-maintenanceservice_installer.exe
-#endif
+chrome/overlayinfo/
+components/
+defaults/autoconfig/
+defaults/profile/
+defaults/profile/chrome/
+defaults/profile/US/*
+defaults/profile/extensions/
+defaults/profile/extensions/{972ce4c6-7e08-4474-a285-3208198ce6fd}/*
+distribution/
+distribution/extensions/
+extensions/
+extensions/inspector@mozilla.org/*
+extensions/reporter@mozilla.org/*
+extensions/talkback@mozilla.org/*
+extensions/testpilot@labs.mozilla.com/*
+extensions/{641d8d09-7dda-4850-8228-ac0ab65e2ac9}/*
+extensions/{972ce4c6-7e08-4474-a285-3208198ce6fd}/*
+greprefs/
 jssubloader/
+modules/
+#ifdef XP_MACOSX
+  plugins/Default Plugin.plugin/*
+  plugins/JavaEmbeddingPlugin.bundle/*
+  plugins/MRJPlugin.plugin/*
+  ../Plug-Ins/PrintPDE.plugin/*
+#endif
+res/*
+searchplugins/*
+webapprt/components/
diff --git a/browser/locales/en-US/chrome/browser/browser.dtd b/browser/locales/en-US/chrome/browser/browser.dtd
index c43f37ed5ed7..7e28bdf62cda 100644
--- a/browser/locales/en-US/chrome/browser/browser.dtd
+++ b/browser/locales/en-US/chrome/browser/browser.dtd
@@ -109,9 +109,8 @@ These should match what Safari and other Apple applications use on OS X Lion. --
 <!ENTITY fullScreenExit.accesskey "F">
 <!ENTITY fullscreenAllowButton.label "Allow">
 <!ENTITY fullscreenExitButton.label "Deny">
-<!ENTITY fullscreenApproval.value "Allow fullscreen?">
 
-<!ENTITY fullscreenExitHint.value "Press ESC at any time to exit fullscreen.">
+<!ENTITY fullscreenExitHint2.value "Press ESC at any time to exit.">
 <!ENTITY leaveDOMFullScreen.label "Exit Full Screen">
 <!ENTITY leaveDOMFullScreen.accesskey "u">
 
@@ -207,6 +206,9 @@ These should match what Safari and other Apple applications use on OS X Lion. --
 <!ENTITY webDeveloperMenu.label       "Web Developer">
 <!ENTITY webDeveloperMenu.accesskey   "W">
 
+<!ENTITY devToolsCmd.keycode          "VK_F12">
+<!ENTITY devToolsCmd.keytext          "F12">
+
 <!ENTITY devtoolsConnect.label        "Connect…">
 <!ENTITY devtoolsConnect.accesskey    "e">
 
@@ -252,6 +254,8 @@ These should match what Safari and other Apple applications use on OS X Lion. --
 <!ENTITY devToolbar.keytext                "F2">
 <!ENTITY devToolboxMenuItem.label          "Toggle Tools">
 <!ENTITY devToolboxMenuItem.accesskey      "T">
+<!ENTITY devToolboxMenuItem.keycode        "I">
+<!ENTITY devToolboxMenuItem.keytext        "I">
 
 <!ENTITY devToolbarToolsButton.tooltip     "Toggle developer tools">
 <!ENTITY devToolbarOtherToolsButton.label  "More Tools">
diff --git a/browser/locales/en-US/chrome/browser/devtools/debugger.dtd b/browser/locales/en-US/chrome/browser/devtools/debugger.dtd
index b02878f59ec1..2763cf6b465d 100644
--- a/browser/locales/en-US/chrome/browser/devtools/debugger.dtd
+++ b/browser/locales/en-US/chrome/browser/devtools/debugger.dtd
@@ -134,7 +134,11 @@
 <!-- LOCALIZATION NOTE (debuggerUI.stepping): These are the keycodes that
   -  control the stepping commands in the debugger (continue, step over,
   -  step in and step out). -->
-<!ENTITY debuggerUI.stepping.resume     "VK_F6">
-<!ENTITY debuggerUI.stepping.stepOver   "VK_F7">
-<!ENTITY debuggerUI.stepping.stepIn     "VK_F8">
-<!ENTITY debuggerUI.stepping.stepOut    "VK_F8">
+<!ENTITY debuggerUI.stepping.resume1    "VK_F8">
+<!ENTITY debuggerUI.stepping.resume2    "VK_SLASH">
+<!ENTITY debuggerUI.stepping.stepOver1  "VK_F10">
+<!ENTITY debuggerUI.stepping.stepOver2  "VK_QUOTE">
+<!ENTITY debuggerUI.stepping.stepIn1    "VK_F11">
+<!ENTITY debuggerUI.stepping.stepIn2    "VK_SEMICOLON">
+<!ENTITY debuggerUI.stepping.stepOut1   "VK_F11">
+<!ENTITY debuggerUI.stepping.stepOut2   "VK_SEMICOLON">
diff --git a/browser/locales/en-US/chrome/browser/devtools/inspector.properties b/browser/locales/en-US/chrome/browser/devtools/inspector.properties
index 692d73f0f514..cb46aafced01 100644
--- a/browser/locales/en-US/chrome/browser/devtools/inspector.properties
+++ b/browser/locales/en-US/chrome/browser/devtools/inspector.properties
@@ -35,7 +35,7 @@ nodeMenu.tooltiptext=Node operations
 # LOCALIZATION NOTE (inspector.*)
 # Used for the menuitem in the tool menu
 inspector.label=Inspector
-inspector.commandkey=I
+inspector.commandkey=C
 inspector.accesskey=I
 
 # LOCALIZATION NOTE (markupView.more.*)
diff --git a/browser/metro/base/content/appbar.js b/browser/metro/base/content/appbar.js
index 153b0bb4be5b..db1f45087624 100644
--- a/browser/metro/base/content/appbar.js
+++ b/browser/metro/base/content/appbar.js
@@ -39,7 +39,7 @@ var Appbar = {
         if (this.activeTileset && ('isBound' in this.activeTileset)) {
           this.activeTileset.clearSelection();
         }
-        this.clearContextualActions();
+        this._clearContextualActions();
         this.activeTileset = null;
         break;
 
@@ -174,8 +174,6 @@ var Appbar = {
 
     if (aVerbs.length) {
       Elements.contextappbar.show();
-    } else {
-      Elements.contextappbar.hide();
     }
 
     // Look up all of the buttons for the verbs that should be visible.
@@ -227,7 +225,7 @@ var Appbar = {
     });
   },
 
-  clearContextualActions: function() {
+  _clearContextualActions: function() {
     this.showContextualActions([]);
   },
 
diff --git a/browser/metro/base/content/bindings/appbar.xml b/browser/metro/base/content/bindings/appbar.xml
index b2869b1914b6..5e11962ef9ec 100644
--- a/browser/metro/base/content/bindings/appbar.xml
+++ b/browser/metro/base/content/bindings/appbar.xml
@@ -73,5 +73,10 @@
         </body>
       </method>
     </implementation>
+
+    <handlers>
+      <!-- Work around for bug 835175 -->
+      <handler event="click">false;</handler>
+    </handlers>
   </binding>
 </bindings>
diff --git a/browser/metro/base/content/bindings/flyoutpanel.xml b/browser/metro/base/content/bindings/flyoutpanel.xml
index f09ea165cee2..83449cb00522 100644
--- a/browser/metro/base/content/bindings/flyoutpanel.xml
+++ b/browser/metro/base/content/bindings/flyoutpanel.xml
@@ -99,5 +99,10 @@
         document.getAnonymousElementByAttribute(this, "class", "flyoutpanel-contents");
       ]]></field>
     </implementation>
+
+    <handlers>
+      <!-- Work around for bug 835175 -->
+      <handler event="click">false;</handler>
+    </handlers>
   </binding>
 </bindings>
diff --git a/browser/metro/base/content/browser.xul b/browser/metro/base/content/browser.xul
index 1e18e4e78180..18d54d05fa5f 100644
--- a/browser/metro/base/content/browser.xul
+++ b/browser/metro/base/content/browser.xul
@@ -181,7 +181,8 @@
     <vbox id="page">
       <vbox id="tray" class="tray-toolbar" observes="bcast_windowState" >
         <!-- Tabs -->
-        <hbox id="tabs-container" observes="bcast_windowState">
+        <!-- onclick handler to work around bug 837242 -->
+        <hbox id="tabs-container" observes="bcast_windowState" onclick="void(0);">
           <box id="tabs" flex="1"
                 observes="bcast_preciseInput"
                 onselect="BrowserUI.selectTabAndDismiss(this);"
@@ -242,7 +243,8 @@
         <box id="horizontal-scroller" class="scroller" orient="horizontal" left="0" bottom="0"/>
 
         <!-- Content touch selection overlay -->
-        <box class="selection-overlay-hidden" id="content-selection-overlay"/>
+        <!-- onclick addresses dom bug 835175 -->
+        <box onclick="false" class="selection-overlay-hidden" id="content-selection-overlay"/>
       </stack>
     </vbox>
 
@@ -736,9 +738,11 @@
     </flyoutpanel>
 
     <!-- Chrome touch selection overlay -->
-    <box class="selection-overlay-hidden" id="chrome-selection-overlay"/>
+    <!-- onclick addresses dom bug 835175 -->
+    <box onclick="false" class="selection-overlay-hidden" id="chrome-selection-overlay"/>
 
     <box onclick="event.stopPropagation();" id="context-container" class="menu-container" hidden="true">
+      <!-- onclick is dom bug 835175 -->
       <vbox id="context-popup" class="menu-popup">
         <richlistbox id="context-commands" bindingType="contextmenu" flex="1">
           <!-- priority="low" items are hidden by default when a context is being displayed
diff --git a/browser/metro/base/content/pages/aboutAddons.xhtml b/browser/metro/base/content/pages/aboutAddons.xhtml
new file mode 100644
index 000000000000..7ce4d8a1af56
--- /dev/null
+++ b/browser/metro/base/content/pages/aboutAddons.xhtml
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html [
+  <!ENTITY % htmlDTD PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "DTD/xhtml1-strict.dtd">
+  %htmlDTD;
+  <!ENTITY % brandDTD SYSTEM "chrome://branding/locale/brand.dtd">
+  %brandDTD;
+  <!ENTITY % aboutAddonsDTD SYSTEM "chrome://browser/locale/aboutAddons.dtd">
+  %aboutAddonsDTD;
+]>
+
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+  <title> &aboutAddons.title; </title>
+  <link rel="stylesheet" href="chrome://browser/skin/aboutAddons.css" type="text/css"/>
+</head>
+
+<body>
+  <div id="fox">
+    <div id="floatingTextBox">
+      <div id="aboutAddonsTextTitle">
+        &aboutAddons.messageTitle;
+      </div>
+      <div id="aboutAddonsTextBody">
+        &aboutAddons.message;
+        &aboutAddons.goBackToStart;
+        <a href="about:start">&aboutAddons.startPageLinkTitle;</a>
+      </div>
+    </div>
+  </div>
+</body>
+</html>
diff --git a/browser/metro/base/jar.mn b/browser/metro/base/jar.mn
index 5573f4ffd06f..6dd754f25534 100644
--- a/browser/metro/base/jar.mn
+++ b/browser/metro/base/jar.mn
@@ -10,6 +10,7 @@ chrome.jar:
   content/aboutRights.xhtml                    (content/pages/aboutRights.xhtml)
   content/blockedSite.xhtml                    (content/pages/blockedSite.xhtml)
   content/netError.xhtml                       (content/pages/netError.xhtml)
+  content/aboutAddons.xhtml                    (content/pages/aboutAddons.xhtml)
 
   content/bindings/bindings.xml                (content/bindings/bindings.xml)
   content/bindings/tabs.xml                    (content/bindings/tabs.xml)
@@ -101,3 +102,4 @@ chrome.jar:
 
 % override chrome://global/content/config.xul chrome://browser/content/config.xul
 % override chrome://global/content/netError.xhtml chrome://browser/content/netError.xhtml
+% override chrome://mozapps/content/extensions/extensions.xul chrome://browser/content/aboutAddons.xhtml
diff --git a/browser/metro/base/tests/mochitest/Makefile.in b/browser/metro/base/tests/mochitest/Makefile.in
index 77d89eb0c4ab..4add0ea6a61d 100644
--- a/browser/metro/base/tests/mochitest/Makefile.in
+++ b/browser/metro/base/tests/mochitest/Makefile.in
@@ -16,9 +16,6 @@ include $(DEPTH)/config/autoconf.mk
 #  browser_context_menu_tests_01.html \
 #  browser_context_menu_tests_02.html \
 #  browser_context_menu_tests_03.html \
-# Bug 897175
-#  browser_findbar.js \
-#  browser_findbar.html \
 
 MOCHITEST_METRO_FILES = \
   head.js \
@@ -28,6 +25,8 @@ MOCHITEST_METRO_FILES = \
   browser_circular_progress_indicator.js \
   browser_context_ui.js \
   browser_downloads.js \
+  browser_findbar.js \
+  browser_findbar.html \
   browser_history.js \
   browser_onscreen_keyboard.js \
   browser_onscreen_keyboard.html \
diff --git a/browser/metro/base/tests/mochitest/browser_findbar.js b/browser/metro/base/tests/mochitest/browser_findbar.js
index 80d8662bff0b..c845e65967bb 100644
--- a/browser/metro/base/tests/mochitest/browser_findbar.js
+++ b/browser/metro/base/tests/mochitest/browser_findbar.js
@@ -47,11 +47,13 @@ gTests.push({
     is(Elements.findbar.isShowing, false, "Find bar is still hidden");
 
     EventUtils.synthesizeKey("f", { accelKey: true });
-    yield waitForEvent(Elements.navbar, "transitionend");
+    yield Promise.all(waitForEvent(Elements.navbar, "transitionend"),
+                      waitForEvent(Elements.findbar, "transitionend"));
     is(ContextUI.navbarVisible, false, "Navbar is hidden");
     is(Elements.findbar.isShowing, true, "Findbar is visible");
 
-    yield showNavBar();
+    yield Promise.all(showNavBar(),
+                      waitForEvent(Elements.findbar, "transitionend"));
     is(ContextUI.navbarVisible, true, "Navbar is visible again");
     is(Elements.findbar.isShowing, false, "Find bar is hidden again");
 
diff --git a/browser/metro/locales/en-US/chrome/aboutAddons.dtd b/browser/metro/locales/en-US/chrome/aboutAddons.dtd
new file mode 100644
index 000000000000..46b71d330d5e
--- /dev/null
+++ b/browser/metro/locales/en-US/chrome/aboutAddons.dtd
@@ -0,0 +1,13 @@
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<!ENTITY % brandDTD
+     SYSTEM "chrome://branding/locale/brand.dtd">
+   %brandDTD;
+
+<!ENTITY aboutAddons.title              "Addons are a Work In Progress">
+<!ENTITY aboutAddons.messageTitle       "Uh-Oh!">
+<!ENTITY aboutAddons.message            "Sorry, &brandShortName; is busy working on supporting Add-ons for you!">
+<!ENTITY aboutAddons.goBackToStart      "Go back to the ">
+<!ENTITY aboutAddons.startPageLinkTitle "&brandShortName; Start Page.">
diff --git a/browser/metro/locales/jar.mn b/browser/metro/locales/jar.mn
index 359377f48558..197364249fdd 100644
--- a/browser/metro/locales/jar.mn
+++ b/browser/metro/locales/jar.mn
@@ -23,6 +23,7 @@
   locale/browser/phishing.dtd             (%chrome/phishing.dtd)
   locale/browser/crashprompt.dtd          (%chrome/crashprompt.dtd)
   locale/browser/crashprompt.properties   (%chrome/crashprompt.properties)
+  locale/browser/aboutAddons.dtd          (%chrome/aboutAddons.dtd)
 
 @AB_CD@.jar:
 % locale browser @AB_CD@ %locale/browser/
diff --git a/browser/metro/theme/aboutAddons.css b/browser/metro/theme/aboutAddons.css
new file mode 100644
index 000000000000..1f03f5426d2a
--- /dev/null
+++ b/browser/metro/theme/aboutAddons.css
@@ -0,0 +1,52 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+html, body {
+  height: 100%;
+  padding: 0;
+  margin: 0;
+}
+
+body {
+  display: flex;
+}
+
+#aboutAddonsTextTitle {
+  font-weight: bold;
+}
+
+#floatingTextBox {
+  flex: 1;
+  
+  position: relative;
+  top: 20%;
+  left: 60%;
+
+  width: 375px;
+  padding: 20px;
+  font-family: "Segoe UI", sans-serif;
+  font-size: 25px;
+  text-align: left;
+  word-wrap: normal;
+}
+
+#fox {
+  flex: 1;
+  background-image:url('chrome://browser/skin/images/aboutAddonsBackground.png'), url('chrome://browser/skin/images/aboutAddonsBackgroundFillSlice.png');
+  background-size: contain;
+  background-position: bottom center;
+  background-repeat: no-repeat, repeat-x;
+  background-color: rgb(230, 230, 230); /*color hand sampled from image*/
+
+}
+
+/* Snapped-view variation */
+@media (max-width: 330px) {
+  #floatingTextBox {
+    top: 20%;
+    left: 5%;
+    width: 90%;
+    padding: 0;
+  }
+}
diff --git a/browser/metro/theme/images/aboutAddonsBackground.png b/browser/metro/theme/images/aboutAddonsBackground.png
new file mode 100644
index 000000000000..5f265200dd14
Binary files /dev/null and b/browser/metro/theme/images/aboutAddonsBackground.png differ
diff --git a/browser/metro/theme/images/aboutAddonsBackgroundFillSlice.png b/browser/metro/theme/images/aboutAddonsBackgroundFillSlice.png
new file mode 100644
index 000000000000..17000f0578ad
Binary files /dev/null and b/browser/metro/theme/images/aboutAddonsBackgroundFillSlice.png differ
diff --git a/browser/metro/theme/jar.mn b/browser/metro/theme/jar.mn
index f120710fe1dd..a4056a1d9a27 100644
--- a/browser/metro/theme/jar.mn
+++ b/browser/metro/theme/jar.mn
@@ -7,6 +7,7 @@
 chrome.jar:
 % skin browser classic/1.0 %skin/
   skin/aboutPage.css                        (aboutPage.css)
+  skin/aboutAddons.css                      (aboutAddons.css)
   skin/about.css                            (about.css)
 * skin/flyoutpanel.css                      (flyoutpanel.css)
 * skin/cssthrobber.css                      (cssthrobber.css)
@@ -60,6 +61,8 @@ chrome.jar:
   skin/images/infobar-key.png               (images/infobar-key.png)
   skin/images/infobar-popup.png             (images/infobar-popup.png)
   skin/images/firefox-watermark.png         (images/firefox-watermark.png)
+  skin/images/aboutAddonsBackground.png     (images/aboutAddonsBackground.png)
+  skin/images/aboutAddonsBackgroundFillSlice.png     (images/aboutAddonsBackgroundFillSlice.png)
   skin/images/flyout-back-button.png        (images/flyout-back-button.png)
   skin/images/about-footer.png              (images/about-footer.png)
   skin/images/button-bg.png                 (images/button-bg.png)
diff --git a/browser/themes/linux/browser.css b/browser/themes/linux/browser.css
index 84fd9f22a97a..d643bf896af0 100644
--- a/browser/themes/linux/browser.css
+++ b/browser/themes/linux/browser.css
@@ -1662,6 +1662,10 @@ richlistitem[type~="action"][actiontype="switchtab"] > .ac-url-box > .ac-action-
   color: -moz-dialogtext;
 }
 
+.tabbrowser-tab[remote] {
+  text-decoration: underline;
+}
+
 #main-window[tabsontop=false]:not([disablechrome]) .tabbrowser-tab[selected=true]:not(:-moz-lwtheme) {
   background-image: linear-gradient(to top, rgba(0,0,0,.3) 1px, transparent 1px),
                     linear-gradient(@selectedTabHighlight@, @toolbarHighlight@ 32%),
@@ -2033,9 +2037,9 @@ toolbar[mode="text"] toolbarbutton.chevron > .toolbarbutton-icon {
 }
 
 #full-screen-warning-message {
-  background-color: hsl(0,0%,15%);
+  background-image: url("chrome://browser/skin/fullscreen-darknoise.png");
   color: white;
-  border-radius: 8px;
+  border-radius: 4px;
   margin-top: 30px;
   padding: 30px 50px;
   box-shadow: 0 0 2px white;
diff --git a/browser/themes/linux/fullscreen-darknoise.png b/browser/themes/linux/fullscreen-darknoise.png
new file mode 100644
index 000000000000..5c33e24d4c1b
Binary files /dev/null and b/browser/themes/linux/fullscreen-darknoise.png differ
diff --git a/browser/themes/linux/jar.mn b/browser/themes/linux/jar.mn
index b9ffe1ddf012..527636f29e38 100644
--- a/browser/themes/linux/jar.mn
+++ b/browser/themes/linux/jar.mn
@@ -22,6 +22,7 @@ browser.jar:
 * skin/classic/browser/browser.css
   skin/classic/browser/click-to-play-warning-stripes.png
 * skin/classic/browser/engineManager.css
+  skin/classic/browser/fullscreen-darknoise.png
   skin/classic/browser/Geolocation-16.png
   skin/classic/browser/Geolocation-64.png
   skin/classic/browser/Go-arrow.png
diff --git a/browser/themes/osx/browser.css b/browser/themes/osx/browser.css
index c30e2f80a6eb..31b7da98876f 100644
--- a/browser/themes/osx/browser.css
+++ b/browser/themes/osx/browser.css
@@ -2257,6 +2257,10 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {
   -moz-box-align: stretch;
 }
 
+.tabbrowser-tab[remote] {
+  text-decoration: underline;
+}
+
 %define TABSONTOP_TAB #tabbrowser-tabs[tabsontop="true"] > .tabbrowser-tab
 %define TABSONBOTTOM_TAB #tabbrowser-tabs[tabsontop="false"] > .tabbrowser-tab
 %define TABSONTOP_TAB_STACK #tabbrowser-tabs[tabsontop="true"] > .tabbrowser-tab > .tab-stack
@@ -3626,9 +3630,9 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {
 }
 
 #full-screen-warning-message {
-  background-color: hsl(0,0%,15%);
+  background-image: url("chrome://browser/skin/fullscreen-darknoise.png");
   color: white;
-  border-radius: 8px;
+  border-radius: 4px;
   margin-top: 30px;
   padding: 30px 50px;
   box-shadow: 0 0 2px white;
diff --git a/browser/themes/osx/fullscreen-darknoise.png b/browser/themes/osx/fullscreen-darknoise.png
new file mode 100644
index 000000000000..5c33e24d4c1b
Binary files /dev/null and b/browser/themes/osx/fullscreen-darknoise.png differ
diff --git a/browser/themes/osx/jar.mn b/browser/themes/osx/jar.mn
index ac16495475ae..22d99b2e3e52 100644
--- a/browser/themes/osx/jar.mn
+++ b/browser/themes/osx/jar.mn
@@ -22,6 +22,7 @@ browser.jar:
 * skin/classic/browser/browser.css                          (browser.css)
   skin/classic/browser/click-to-play-warning-stripes.png
 * skin/classic/browser/engineManager.css                    (engineManager.css)
+  skin/classic/browser/fullscreen-darknoise.png
   skin/classic/browser/Geolocation-16.png
   skin/classic/browser/Geolocation-16@2x.png
   skin/classic/browser/Geolocation-64.png
diff --git a/browser/themes/shared/devtools/webconsole.inc.css b/browser/themes/shared/devtools/webconsole.inc.css
index 550abfd265f3..f8f4ed86c8f2 100644
--- a/browser/themes/shared/devtools/webconsole.inc.css
+++ b/browser/themes/shared/devtools/webconsole.inc.css
@@ -272,3 +272,17 @@
 .webconsole-msg-security.webconsole-msg-warn {
   -moz-image-region: rect(32px, 24px, 40px, 16px);
 }
+
+.navigation-marker {
+  color: #aaa;
+  background: linear-gradient(#fff, #bbb, #fff) no-repeat left 50%;
+  background-size: 100% 2px;
+  -moz-margin-start: 3px;
+  -moz-margin-end: 6px;
+  font-size: 0.9em;
+}
+
+.navigation-marker .url {
+  background: #fff;
+  -moz-padding-end: 6px;
+}
diff --git a/browser/themes/windows/browser.css b/browser/themes/windows/browser.css
index c2174d16674a..b0dd0c780d0c 100644
--- a/browser/themes/windows/browser.css
+++ b/browser/themes/windows/browser.css
@@ -1971,6 +1971,10 @@ richlistitem[type~="action"][actiontype="switchtab"] > .ac-url-box > .ac-action-
   border-radius: 0;
 }
 
+.tabbrowser-tab[remote] {
+  text-decoration: underline;
+}
+
 .tabbrowser-tab:hover,
 .tabs-newtab-button:hover {
   background-image: @toolbarShadowOnTab@, @bgTabTextureHover@,
@@ -2783,9 +2787,9 @@ toolbarbutton.bookmark-item[dragover="true"][open="true"] {
 }
 
 #full-screen-warning-message {
-  background-color: hsl(0,0%,15%);
+  background-image: url("chrome://browser/skin/fullscreen-darknoise.png");
   color: white;
-  border-radius: 8px;
+  border-radius: 4px;
   margin-top: 30px;
   padding: 30px 50px;
   box-shadow: 0 0 2px white;
diff --git a/browser/themes/windows/fullscreen-darknoise.png b/browser/themes/windows/fullscreen-darknoise.png
new file mode 100644
index 000000000000..5c33e24d4c1b
Binary files /dev/null and b/browser/themes/windows/fullscreen-darknoise.png differ
diff --git a/browser/themes/windows/jar.mn b/browser/themes/windows/jar.mn
index 87fa96c33ff5..c4fae06db831 100644
--- a/browser/themes/windows/jar.mn
+++ b/browser/themes/windows/jar.mn
@@ -26,6 +26,7 @@ browser.jar:
 *       skin/classic/browser/browser.css
         skin/classic/browser/click-to-play-warning-stripes.png
 *       skin/classic/browser/engineManager.css
+        skin/classic/browser/fullscreen-darknoise.png
         skin/classic/browser/Geolocation-16.png
         skin/classic/browser/Geolocation-64.png
         skin/classic/browser/Info.png
@@ -283,6 +284,7 @@ browser.jar:
 *       skin/classic/aero/browser/browser.css                        (browser-aero.css)
         skin/classic/aero/browser/click-to-play-warning-stripes.png
 *       skin/classic/aero/browser/engineManager.css
+        skin/classic/aero/browser/fullscreen-darknoise.png
         skin/classic/aero/browser/Geolocation-16.png
         skin/classic/aero/browser/Geolocation-64.png
         skin/classic/aero/browser/Info.png                           (Info-aero.png)
diff --git a/build/mobile/sutagent/android/CmdWorkerThread.java b/build/mobile/sutagent/android/CmdWorkerThread.java
index 12ce6bfdb3af..e8037aec0189 100755
--- a/build/mobile/sutagent/android/CmdWorkerThread.java
+++ b/build/mobile/sutagent/android/CmdWorkerThread.java
@@ -139,6 +139,10 @@ public class CmdWorkerThread extends Thread
                     SUTAgentAndroid.log(dc, message);
 
                     outputLine = dc.processCommand(inputLine, out, in, cmdOut);
+                    if (outputLine == null)
+                        {
+                        outputLine = "";
+                        }
                     if (outputLine.length() > 0)
                         {
                         out.print(outputLine + "\n" + prompt);
diff --git a/build/mobile/sutagent/android/DataWorkerThread.java b/build/mobile/sutagent/android/DataWorkerThread.java
index e572a5c982e2..f8e3b6c5a4f6 100755
--- a/build/mobile/sutagent/android/DataWorkerThread.java
+++ b/build/mobile/sutagent/android/DataWorkerThread.java
@@ -170,6 +170,10 @@ public class DataWorkerThread extends Thread
                     if ((inputLine += readLine(in)) != null)
                         {
                         outputLine = dc.processCommand(inputLine, out, in, cmdOut);
+                        if (outputLine == null)
+                            {
+                            outputLine = "";
+                            }
                         out.print(outputLine + "\n");
                         out.flush();
                         if (outputLine.equals("exit"))
diff --git a/build/mobile/sutagent/android/DoCommand.java b/build/mobile/sutagent/android/DoCommand.java
index 8c7d071eae39..75913f5005af 100755
--- a/build/mobile/sutagent/android/DoCommand.java
+++ b/build/mobile/sutagent/android/DoCommand.java
@@ -107,7 +107,7 @@ public class DoCommand {
     String ffxProvider = "org.mozilla.ffxcp";
     String fenProvider = "org.mozilla.fencp";
 
-    private final String prgVersion = "SUTAgentAndroid Version 1.18";
+    private final String prgVersion = "SUTAgentAndroid Version 1.19";
 
     public enum Command
         {
@@ -1396,7 +1396,7 @@ private void CancelNotification()
             }
         Log.e("SUTAgentAndroid", "ERROR: Cannot access world writeable test root");
 
-        return(null);
+        return sErrorPrefix + " unable to determine test root";
         }
 
     public String GetAppRoot(String AppName)
diff --git a/config/check_spidermonkey_style.py b/config/check_spidermonkey_style.py
new file mode 100644
index 000000000000..00672dfbfb4e
--- /dev/null
+++ b/config/check_spidermonkey_style.py
@@ -0,0 +1,396 @@
+# vim: set ts=8 sts=4 et sw=4 tw=99:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#----------------------------------------------------------------------------
+# This script checks various aspects of SpiderMonkey code style.  The current checks are as
+# follows.
+#
+# We check the following things in headers.
+#
+# - No cyclic dependencies.
+# 
+# - No normal header should #include a inlines.h/-inl.h file.
+# 
+# - #ifndef wrappers should have the right form. (XXX: not yet implemented)
+#   - Every header file should have one.
+#   - It should be in the vanilla form and have no tokens before/after it so
+#     that GCC and clang can avoid multiple-inclusion.
+#   - The guard name used should be appropriate for the filename.
+# 
+# We check the following things in all files.
+#
+# - #includes should have full paths, e.g. "ion/Ion.h", not "Ion.h". 
+#
+# - #includes should use the appropriate form for system headers (<...>) and
+#   local headers ("...").
+#
+# - #includes should be ordered correctly. (XXX: not yet implemented;  see bug
+#   888088)
+#   - Each one should be in the correct section.
+#   - Alphabetical order should be used within sections.
+#   - Sections should be in the right order.
+#----------------------------------------------------------------------------
+
+from __future__ import print_function
+
+import difflib
+import os
+import re
+import subprocess
+import sys
+import traceback
+
+# We don't bother checking files in these directories, because they're (a) auxiliary or (b)
+# imported code that doesn't follow our coding style.
+ignored_js_src_dirs = [
+   'js/src/config/',            # auxiliary stuff
+   'js/src/ctypes/libffi/',     # imported code
+   'js/src/devtools/',          # auxiliary stuff
+   'js/src/editline/',          # imported code
+   'js/src/gdb/',               # auxiliary stuff
+   'js/src/vtune/'              # imported code
+]
+
+# We ignore #includes of these files, because they don't follow the usual rules.
+included_inclnames_to_ignore = set([
+    'ffi.h',                    # generated in ctypes/libffi/
+    'devtools/sharkctl.h',      # we ignore devtools/ in general
+    'devtools/Instruments.h',   # we ignore devtools/ in general
+    'double-conversion.h',      # strange MFBT case
+    'javascript-trace.h',       # generated in $OBJDIR if HAVE_DTRACE is defined
+    'jsautokw.h',               # generated in $OBJDIR
+    'jsautooplen.h',            # generated in $OBJDIR
+    'jscustomallocator.h',      # provided by embedders;  allowed to be missing
+    'js-config.h',              # generated in $OBJDIR
+    'pratom.h',                 # NSPR
+    'prcvar.h',                 # NSPR
+    'prinit.h',                 # NSPR
+    'prlink.h',                 # NSPR
+    'prlock.h',                 # NSPR
+    'prprf.h',                  # NSPR
+    'prthread.h',               # NSPR
+    'prtypes.h',                # NSPR
+    'selfhosted.out.h',         # generated in $OBJDIR
+    'unicode/locid.h',          # ICU
+    'unicode/numsys.h',         # ICU
+    'unicode/ucal.h',           # ICU
+    'unicode/uclean.h',         # ICU
+    'unicode/ucol.h',           # ICU
+    'unicode/udat.h',           # ICU
+    'unicode/udatpg.h',         # ICU
+    'unicode/uenum.h',          # ICU
+    'unicode/unum.h',           # ICU
+    'unicode/ustring.h',        # ICU
+    'unicode/utypes.h',         # ICU
+    'vtune/VTuneWrapper.h'      # VTune
+])
+
+# The files in tests/style/ contain code that fails this checking in various
+# ways.  Here is the output we expect.  If the actual output differs from
+# this, one of the following must have happened.
+# - New SpiderMonkey code violates one of the checked rules.
+# - The tests/style/ files have changed without expected_output being changed
+#   accordingly.
+# - This script has been broken somehow.
+#
+expected_output = '''\
+js/src/tests/style/BadIncludes2.h:1: error:
+    vanilla header includes an inline-header file "tests/style/BadIncludes2-inl.h"
+
+js/src/tests/style/BadIncludes.h:1: error:
+    the file includes itself
+
+js/src/tests/style/BadIncludes.h:3: error:
+    "BadIncludes2.h" is included using the wrong path;
+    did you forget a prefix, or is the file not yet committed?
+
+js/src/tests/style/BadIncludes.h:4: error:
+    <tests/style/BadIncludes2.h> should be included using
+    the #include "..." form
+
+js/src/tests/style/BadIncludes.h:5: error:
+    "stdio.h" is included using the wrong path;
+    did you forget a prefix, or is the file not yet committed?
+
+(multiple files): error:
+    header files form one or more cycles
+
+   tests/style/HeaderCycleA1.h
+   -> tests/style/HeaderCycleA2.h
+      -> tests/style/HeaderCycleA3.h
+         -> tests/style/HeaderCycleA1.h
+
+   tests/style/HeaderCycleB1-inl.h
+   -> tests/style/HeaderCycleB2-inl.h
+      -> tests/style/HeaderCycleB3-inl.h
+         -> tests/style/HeaderCycleB4-inl.h
+            -> tests/style/HeaderCycleB1-inl.h
+            -> tests/style/jsheadercycleB5inlines.h
+               -> tests/style/HeaderCycleB1-inl.h
+      -> tests/style/HeaderCycleB4-inl.h
+
+'''.splitlines(True)
+
+actual_output = []
+
+
+def out(*lines):
+    for line in lines:
+        actual_output.append(line + '\n')
+
+
+def error(filename, linenum, *lines):
+    location = filename
+    if linenum != None:
+        location += ":" + str(linenum)
+    out(location + ': error:')
+    for line in (lines):
+        out('    ' + line)
+    out('')
+
+
+class FileKind(object):
+    C = 1
+    CPP = 2
+    INL_H = 3
+    H = 4
+    TBL = 5
+    MSG = 6
+
+    @staticmethod
+    def get(filename):
+        if filename.endswith('.c'):
+            return FileKind.C
+       
+        if filename.endswith('.cpp'):
+            return FileKind.CPP
+       
+        if filename.endswith(('inlines.h', '-inl.h')):
+            return FileKind.INL_H
+
+        if filename.endswith('.h'):
+            return FileKind.H
+
+        if filename.endswith('.tbl'):
+            return FileKind.TBL
+
+        if filename.endswith('.msg'):
+            return FileKind.MSG
+
+        error(filename, None, 'unknown file kind')
+
+
+def get_all_filenames():
+    """Get a list of all the files in the (Mercurial or Git) repository."""
+    cmds = [['hg', 'manifest'], ['git', 'ls-files']]
+    for cmd in cmds:
+        try:
+            all_filenames = subprocess.check_output(cmd, universal_newlines=True,
+                                                    stderr=subprocess.PIPE).split('\n')
+            return all_filenames
+        except:
+            continue
+    else:
+        raise Exception('failed to run any of the repo manifest commands', cmds)
+
+
+def check_style():
+    # We deal with two kinds of name.
+    # - A "filename" is a full path to a file from the repository root.
+    # - An "inclname" is how a file is referred to in a #include statement.
+    #
+    # Examples (filename -> inclname)
+    # - "mfbt/Attributes.h"  -> "mozilla/Attributes.h"
+    # - "js/public/Vector.h" -> "js/Vector.h"
+    # - "js/src/vm/String.h" -> "vm/String.h"
+
+    mfbt_inclnames = set()      # type: set(inclname)
+    js_names = dict()           # type: dict(filename, inclname)
+
+    # Select the appropriate files.
+    for filename in get_all_filenames():
+        if filename.startswith('mfbt/') and filename.endswith('.h'):
+            inclname = 'mozilla/' + filename[len('mfbt/'):]
+            mfbt_inclnames.add(inclname)
+
+        if filename.startswith('js/public/') and filename.endswith('.h'):
+            inclname = 'js/' + filename[len('js/public/'):]
+            js_names[filename] = inclname
+
+        if filename.startswith('js/src/') and \
+           not filename.startswith(tuple(ignored_js_src_dirs)) and \
+           filename.endswith(('.c', '.cpp', '.h', '.tbl', '.msg')):
+            inclname = filename[len('js/src/'):]
+            js_names[filename] = inclname
+
+    all_inclnames = mfbt_inclnames | set(js_names.values())
+
+    edges = dict()      # type: dict(inclname, set(inclname))
+
+    # We don't care what's inside the MFBT files, but because they are
+    # #included from JS files we have to add them to the inclusion graph.
+    for inclname in mfbt_inclnames:
+        edges[inclname] = set()
+
+    # Process all the JS files.
+    for filename in js_names.keys():
+        inclname = js_names[filename]
+        file_kind = FileKind.get(filename)
+        if file_kind == FileKind.C or file_kind == FileKind.CPP or \
+           file_kind == FileKind.H or file_kind == FileKind.INL_H:
+            included_h_inclnames = set()    # type: set(inclname)
+
+            # This script is run in js/src/, so prepend '../../' to get to the root of the Mozilla
+            # source tree.
+            with open(os.path.join('../..', filename)) as f:
+                do_file(filename, inclname, file_kind, f, all_inclnames, included_h_inclnames)
+
+        edges[inclname] = included_h_inclnames
+
+    find_cycles(all_inclnames, edges)
+
+    # Compare expected and actual output.
+    difflines = difflib.unified_diff(expected_output, actual_output,
+                                     fromfile='check_spider_monkey_style.py expected output',
+                                       tofile='check_spider_monkey_style.py actual output')
+    ok = True
+    for diffline in difflines:
+        ok = False
+        print(diffline, end='')
+
+    return ok
+
+
+def do_file(filename, inclname, file_kind, f, all_inclnames, included_h_inclnames):
+    for linenum, line in enumerate(f, start=1):
+        # Look for a |#include "..."| line.
+        m = re.match(r'\s*#\s*include\s+"([^"]*)"', line)
+        if m is not None:
+            included_inclname = m.group(1)
+
+            if included_inclname not in included_inclnames_to_ignore:
+                included_kind = FileKind.get(included_inclname)
+
+                # Check the #include path has the correct form.
+                if included_inclname not in all_inclnames:
+                    error(filename, linenum,
+                          '"' + included_inclname + '" is included ' + 'using the wrong path;',
+                          'did you forget a prefix, or is the file not yet committed?')
+
+                # Record inclusions of .h files for cycle detection later.
+                # (Exclude .tbl and .msg files.)
+                elif included_kind == FileKind.H or included_kind == FileKind.INL_H:
+                    included_h_inclnames.add(included_inclname)
+
+                # Check a H file doesn't #include an INL_H file.
+                if file_kind == FileKind.H and included_kind == FileKind.INL_H:
+                    error(filename, linenum,
+                          'vanilla header includes an inline-header file "' + included_inclname + '"')
+
+                # Check a file doesn't #include itself.  (We do this here because the
+                # cycle detection below doesn't detect this case.)
+                if inclname == included_inclname:
+                    error(filename, linenum, 'the file includes itself')
+
+        # Look for a |#include <...>| line.
+        m = re.match(r'\s*#\s*include\s+<([^>]*)>', line)
+        if m is not None:
+            included_inclname = m.group(1)
+
+            # Check it is not a known local file (in which case it's
+            # probably a system header).
+            if included_inclname in included_inclnames_to_ignore or \
+               included_inclname in all_inclnames:
+                error(filename, linenum,
+                      '<' + included_inclname + '> should be included using',
+                      'the #include "..." form')
+
+
+def find_cycles(all_inclnames, edges):
+    """Find and draw any cycles."""
+    
+    SCCs = tarjan(all_inclnames, edges)
+
+    # The various sorted() calls below ensure the output is deterministic.
+
+    def draw_SCC(c):
+        cset = set(c)
+        drawn = set()
+        def draw(v, indent):
+            out('   ' * indent + ('-> ' if indent else '   ') + v)
+            if v in drawn:
+                return
+            drawn.add(v)
+            for succ in sorted(edges[v]):
+                if succ in cset:
+                    draw(succ, indent + 1)
+        draw(sorted(c)[0], 0)
+        out('')
+
+    have_drawn_an_SCC = False
+    for scc in sorted(SCCs):
+        if len(scc) != 1:
+            if not have_drawn_an_SCC:
+                error('(multiple files)', None, 'header files form one or more cycles')
+                have_drawn_an_SCC = True
+
+            draw_SCC(scc)
+
+
+# Tarjan's algorithm for finding the strongly connected components (SCCs) of a graph.
+# https://en.wikipedia.org/wiki/Tarjan%27s_strongly_connected_components_algorithm
+def tarjan(V, E):
+    vertex_index = {}
+    vertex_lowlink = {}
+    index = 0
+    S = []
+    all_SCCs = []
+
+    def strongconnect(v, index):
+        # Set the depth index for v to the smallest unused index
+        vertex_index[v] = index
+        vertex_lowlink[v] = index
+        index += 1
+        S.append(v)
+
+        # Consider successors of v
+        for w in E[v]:
+            if w not in vertex_index:
+                # Successor w has not yet been visited; recurse on it
+                index = strongconnect(w, index)
+                vertex_lowlink[v] = min(vertex_lowlink[v], vertex_lowlink[w])
+            elif w in S:
+                # Successor w is in stack S and hence in the current SCC
+                vertex_lowlink[v] = min(vertex_lowlink[v], vertex_index[w])
+
+        # If v is a root node, pop the stack and generate an SCC
+        if vertex_lowlink[v] == vertex_index[v]:
+            i = S.index(v)
+            scc = S[i:]
+            del S[i:]
+            all_SCCs.append(scc)
+
+        return index
+
+    for v in V:
+        if v not in vertex_index:
+            index = strongconnect(v, index)
+
+    return all_SCCs
+
+
+def main():
+    ok = check_style()
+
+    if ok:
+        print('TEST-PASS | check_spidermonkey_style.py | ok')
+    else:
+        print('TEST-UNEXPECTED-FAIL | check_spidermonkey_style.py | actual output does not match expected output;  diff is above')
+
+    sys.exit(0 if ok else 1)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/config/createprecomplete.py b/config/createprecomplete.py
index 7fe81093bc85..2c39306edc90 100644
--- a/config/createprecomplete.py
+++ b/config/createprecomplete.py
@@ -11,8 +11,7 @@ import os
 
 def get_build_entries(root_path):
     """ Iterates through the root_path, creating a list for each file and
-        directory. Excludes any path starting with extensions or distribution
-        and paths ending with channel-prefs.js.
+        directory. Excludes any file paths ending with channel-prefs.js.
     """
     rel_file_path_set = set()
     rel_dir_path_set = set()
@@ -21,18 +20,14 @@ def get_build_entries(root_path):
             parent_dir_rel_path = root[len(root_path)+1:]
             rel_path_file = os.path.join(parent_dir_rel_path, file_name)
             rel_path_file = rel_path_file.replace("\\", "/")
-            if not (rel_path_file.startswith("distribution/") or
-                    rel_path_file.startswith("extensions/") or
-                    rel_path_file.endswith("channel-prefs.js")):
+            if not (rel_path_file.endswith("channel-prefs.js")):
                 rel_file_path_set.add(rel_path_file)
 
         for dir_name in dirs:
             parent_dir_rel_path = root[len(root_path)+1:]
             rel_path_dir = os.path.join(parent_dir_rel_path, dir_name)
             rel_path_dir = rel_path_dir.replace("\\", "/")+"/"
-            if not (rel_path_dir.startswith("distribution/") or
-                    rel_path_dir.startswith("extensions/")):
-                rel_dir_path_set.add(rel_path_dir)
+            rel_dir_path_set.add(rel_path_dir)
 
     rel_file_path_list = list(rel_file_path_set)
     rel_file_path_list.sort(reverse=True)
diff --git a/config/rules.mk b/config/rules.mk
index 95e3e11fe944..b498822635cf 100644
--- a/config/rules.mk
+++ b/config/rules.mk
@@ -442,7 +442,7 @@ define SUBMAKE # $(call SUBMAKE,target,directory,static)
 endef # The extra line is important here! don't delete it
 
 define TIER_DIR_SUBMAKE
-@echo "BUILDSTATUS TIERDIR_START $(2)"
+@echo "BUILDSTATUS TIERDIR_START  $(2)"
 $(call SUBMAKE,$(1),$(2),$(3))
 @echo "BUILDSTATUS TIERDIR_FINISH $(2)"
 
diff --git a/configure.in b/configure.in
index b91b74726576..53a9fe6fd9eb 100644
--- a/configure.in
+++ b/configure.in
@@ -4207,7 +4207,6 @@ BUILD_CTYPES=1
 MOZ_USE_NATIVE_POPUP_WINDOWS=
 MOZ_ANDROID_HISTORY=
 MOZ_WEBSMS_BACKEND=
-MOZ_ANDROID_WALLPAPER=
 MOZ_ANDROID_BEAM=
 ACCESSIBILITY=1
 MOZ_TIME_MANAGER=
@@ -5166,13 +5165,6 @@ if test -n "$MOZ_WEBSMS_BACKEND"; then
     AC_DEFINE(MOZ_WEBSMS_BACKEND)
 fi
 
-dnl ========================================================
-dnl = Enable SET_WALLPAPER permission on Android
-dnl ========================================================
-if test -n "$MOZ_ANDROID_WALLPAPER"; then
-    AC_DEFINE(MOZ_ANDROID_WALLPAPER)
-fi
-
 dnl ========================================================
 dnl = Enable NFC permission on Android
 dnl ========================================================
@@ -8612,7 +8604,6 @@ AC_SUBST(MOZ_METRO)
 
 AC_SUBST(MOZ_ANDROID_HISTORY)
 AC_SUBST(MOZ_WEBSMS_BACKEND)
-AC_SUBST(MOZ_ANDROID_WALLPAPER)
 AC_SUBST(MOZ_ANDROID_BEAM)
 AC_SUBST(ENABLE_STRIP)
 AC_SUBST(PKG_SKIP_STRIP)
@@ -9134,7 +9125,7 @@ if test -n "$MOZ_WEBRTC"; then
    AC_MSG_RESULT("generating WebRTC Makefiles...")
 
    if test "${MOZ_WIDGET_TOOLKIT}" = "gonk"; then
-      EXTRA_GYP_DEFINES="${EXTRA_GYP_DEFINES} -D build_with_gonk=1 -D include_internal_audio_device=0"
+      EXTRA_GYP_DEFINES="${EXTRA_GYP_DEFINES} -D build_with_gonk=1"
    fi
 
 dnl Any --include files must also appear in -D FORCED_INCLUDE_FILE= entries
@@ -9424,11 +9415,14 @@ fi
 dist=$MOZ_BUILD_ROOT/dist
 ac_configure_args="$_SUBDIR_CONFIG_ARGS"
 ac_configure_args="$ac_configure_args --enable-threadsafe"
-if test "$MOZ_BUILD_APP" != "browser"; then
-    # The Internationalization API is currently disabled in all non-standalone,
-    # non-desktop SpiderMonkey builds.  Bug 864843 is on file for enabling it
-    # in Android builds, and bug 866301 is on file for enabling it in B2G
-    # builds.
+# Switch to "$MOZ_BUILD_APP" != "browser" when enabling for desktop builds.
+if test "A" = "A"; then
+    # The Internationalization API isn't on by default except in standalone JS
+    # engine builds.  Bugs to enable it in the browser:
+    #
+    #   Desktop:  bug 853301
+    #   Android:  bug 864843
+    #   B2G:      bug 866301
     ac_configure_args="$ac_configure_args --disable-intl-api"
 fi
 if test "$BUILD_CTYPES"; then
diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index 880cbbc12d7f..3955cca533c3 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -6704,6 +6704,14 @@ nsIDocument::AdoptNode(nsINode& aAdoptedNode, ErrorResult& rv)
         int32_t idx = parent->IndexOf(adoptedNode);
         MOZ_ASSERT(idx >= 0);
         parent->RemoveChildAt(idx, true);
+      } else {
+        MOZ_ASSERT(!adoptedNode->IsInDoc());
+
+        // If we're adopting a node that's not in a document, it might still
+        // have a binding applied. Remove the binding from the element now
+        // that it's getting adopted into a new document.
+        // TODO Fully tear down the binding.
+        adoptedNode->AsContent()->SetXBLBinding(nullptr);
       }
 
       break;
diff --git a/content/base/src/nsObjectLoadingContent.cpp b/content/base/src/nsObjectLoadingContent.cpp
index 31cb4474e65c..8e79aa1e5638 100644
--- a/content/base/src/nsObjectLoadingContent.cpp
+++ b/content/base/src/nsObjectLoadingContent.cpp
@@ -3389,6 +3389,19 @@ nsObjectLoadingContent::DoNewResolve(JSContext* aCx, JS::Handle<JSObject*> aObje
   return true;
 }
 
+void
+nsObjectLoadingContent::GetOwnPropertyNames(JSContext* aCx,
+                                            nsTArray<nsString>& /* unused */,
+                                            ErrorResult& aRv)
+{
+  // Just like DoNewResolve, just make sure we're instantiated.  That will do
+  // the work our Enumerate hook needs to do, and we don't want to return these
+  // property names from Xrays anyway.
+  nsRefPtr<nsNPAPIPluginInstance> pi;
+  aRv = ScriptRequestPluginInstance(aCx, getter_AddRefs(pi));
+}
+
+
 // SetupProtoChainRunner implementation
 nsObjectLoadingContent::SetupProtoChainRunner::SetupProtoChainRunner(
     nsIScriptContext* scriptContext,
diff --git a/content/base/src/nsObjectLoadingContent.h b/content/base/src/nsObjectLoadingContent.h
index a4f75abce0a7..d7f059cc5157 100644
--- a/content/base/src/nsObjectLoadingContent.h
+++ b/content/base/src/nsObjectLoadingContent.h
@@ -151,6 +151,9 @@ class nsObjectLoadingContent : public nsImageLoadingContent
     bool DoNewResolve(JSContext* aCx, JS::Handle<JSObject*> aObject,
                       JS::Handle<jsid> aId,
                       JS::MutableHandle<JS::Value> aValue);
+    // Helper for WebIDL enumeration
+    void GetOwnPropertyNames(JSContext* aCx, nsTArray<nsString>& /* unused */,
+                             mozilla::ErrorResult& aRv);
 
     // WebIDL API
     nsIDocument* GetContentDocument();
diff --git a/content/canvas/src/WebGLExtensionDrawBuffers.cpp b/content/canvas/src/WebGLExtensionDrawBuffers.cpp
index 5365919c4c3d..49f9e36759f3 100644
--- a/content/canvas/src/WebGLExtensionDrawBuffers.cpp
+++ b/content/canvas/src/WebGLExtensionDrawBuffers.cpp
@@ -55,8 +55,7 @@ bool WebGLExtensionDrawBuffers::IsSupported(const WebGLContext* context)
 {
     gl::GLContext * gl = context->GL();
 
-    if (!gl->IsExtensionSupported(gl->IsGLES2() ? GLContext::EXT_draw_buffers
-                                                : GLContext::ARB_draw_buffers)) {
+    if (!gl->IsExtensionSupported(GLContext::XXX_draw_buffers)) {
         return false;
     }
 
diff --git a/content/canvas/src/WebGLExtensionVertexArray.cpp b/content/canvas/src/WebGLExtensionVertexArray.cpp
index e4f4d0b2d3ac..25cc3bc3b364 100644
--- a/content/canvas/src/WebGLExtensionVertexArray.cpp
+++ b/content/canvas/src/WebGLExtensionVertexArray.cpp
@@ -46,12 +46,7 @@ bool WebGLExtensionVertexArray::IsSupported(const WebGLContext* context)
 {
     gl::GLContext* gl = context->GL();
 
-    if (gl->IsGLES2()) {
-        return gl->IsExtensionSupported(gl::GLContext::OES_vertex_array_object);
-    }
-
-    return gl->IsExtensionSupported(gl::GLContext::ARB_vertex_array_object) ||
-           gl->IsExtensionSupported(gl::GLContext::APPLE_vertex_array_object);
+    return gl->IsExtensionSupported(gl::GLContext::XXX_vertex_array_object);
 }
 
 IMPL_WEBGL_EXTENSION_GOOP(WebGLExtensionVertexArray)
diff --git a/content/media/webrtc/Makefile.in b/content/media/webrtc/Makefile.in
index 726ff7c703e0..440c14557271 100644
--- a/content/media/webrtc/Makefile.in
+++ b/content/media/webrtc/Makefile.in
@@ -21,6 +21,7 @@ include $(topsrcdir)/ipc/chromium/chromium-config.mk
 
 ifdef MOZ_WEBRTC
 LOCAL_INCLUDES += \
+  -I$(topsrcdir)/media/webrtc/trunk \
   -I$(topsrcdir)/media/webrtc/trunk/webrtc \
   -I$(topsrcdir)/media/webrtc/signaling/src/common \
   -I$(topsrcdir)/media/webrtc/signaling/src/common/browser_logging \
diff --git a/dom/alarm/AlarmsManager.js b/dom/alarm/AlarmsManager.js
index edefcb01cbdc..38a9aea73a02 100644
--- a/dom/alarm/AlarmsManager.js
+++ b/dom/alarm/AlarmsManager.js
@@ -88,8 +88,8 @@ AlarmsManager.prototype = {
   remove: function remove(aId) {
     debug("remove()");
 
-    return this._cpmm.sendSyncMessage(
-      "AlarmsManager:Remove", 
+    this._cpmm.sendAsyncMessage(
+      "AlarmsManager:Remove",
       { id: aId, manifestURL: this._manifestURL }
     );
   },
@@ -99,7 +99,7 @@ AlarmsManager.prototype = {
 
     let request = this.createRequest();
     this._cpmm.sendAsyncMessage(
-      "AlarmsManager:GetAll", 
+      "AlarmsManager:GetAll",
       { requestId: this.getRequestId(request), manifestURL: this._manifestURL }
     );
     return request;
@@ -128,7 +128,7 @@ AlarmsManager.prototype = {
           let alarm = { "id":              aAlarm.id,
                         "date":            aAlarm.date,
                         "respectTimezone": aAlarm.ignoreTimezone ?
-                                             "ignoreTimezone" : "honorTimezone", 
+                                             "ignoreTimezone" : "honorTimezone",
                         "data":            aAlarm.data };
           alarms.push(alarm);
         });
@@ -156,20 +156,26 @@ AlarmsManager.prototype = {
     debug("init()");
 
     // Set navigator.mozAlarms to null.
-    if (!Services.prefs.getBoolPref("dom.mozAlarms.enabled"))
+    if (!Services.prefs.getBoolPref("dom.mozAlarms.enabled")) {
       return null;
+    }
 
     // Only pages with perm set can use the alarms.
     let principal = aWindow.document.nodePrincipal;
-    let perm = Services.perms.testExactPermissionFromPrincipal(principal, "alarms");
-    if (perm != Ci.nsIPermissionManager.ALLOW_ACTION)
+    let perm =
+      Services.perms.testExactPermissionFromPrincipal(principal, "alarms");
+    if (perm != Ci.nsIPermissionManager.ALLOW_ACTION) {
       return null;
+    }
 
-    this._cpmm = Cc["@mozilla.org/childprocessmessagemanager;1"].getService(Ci.nsISyncMessageSender);
+    this._cpmm = Cc["@mozilla.org/childprocessmessagemanager;1"]
+                   .getService(Ci.nsISyncMessageSender);
 
     // Add the valid messages to be listened.
-    this.initDOMRequestHelper(aWindow, ["AlarmsManager:Add:Return:OK", "AlarmsManager:Add:Return:KO",
-                              "AlarmsManager:GetAll:Return:OK", "AlarmsManager:GetAll:Return:KO"]);
+    this.initDOMRequestHelper(aWindow, ["AlarmsManager:Add:Return:OK",
+                                        "AlarmsManager:Add:Return:KO",
+                                        "AlarmsManager:GetAll:Return:OK",
+                                        "AlarmsManager:GetAll:Return:KO"]);
 
     // Get the manifest URL if this is an installed app
     let appsService = Cc["@mozilla.org/AppsService;1"]
diff --git a/dom/base/Navigator.cpp b/dom/base/Navigator.cpp
index 519980824c51..bc72bb3d93a6 100644
--- a/dom/base/Navigator.cpp
+++ b/dom/base/Navigator.cpp
@@ -1456,7 +1456,7 @@ Navigator::DoNewResolve(JSContext* aCx, JS::Handle<JSObject*> aObject,
     return true;
   }
 
-  nsScriptNameSpaceManager *nameSpaceManager =
+  nsScriptNameSpaceManager* nameSpaceManager =
     nsJSRuntime::GetNameSpaceManager();
   if (!nameSpaceManager) {
     return Throw<true>(aCx, NS_ERROR_NOT_INITIALIZED);
@@ -1550,6 +1550,29 @@ Navigator::DoNewResolve(JSContext* aCx, JS::Handle<JSObject*> aObject,
   return true;
 }
 
+static PLDHashOperator
+SaveNavigatorName(const nsAString& aName, void* aClosure)
+{
+  nsTArray<nsString>* arr = static_cast<nsTArray<nsString>*>(aClosure);
+  arr->AppendElement(aName);
+  return PL_DHASH_NEXT;
+}
+
+void
+Navigator::GetOwnPropertyNames(JSContext* aCx, nsTArray<nsString>& aNames,
+                               ErrorResult& aRv)
+{
+  nsScriptNameSpaceManager *nameSpaceManager =
+    nsJSRuntime::GetNameSpaceManager();
+  if (!nameSpaceManager) {
+    NS_ERROR("Can't get namespace manager.");
+    aRv.Throw(NS_ERROR_UNEXPECTED);
+    return;
+  }
+
+  nameSpaceManager->EnumerateNavigatorNames(SaveNavigatorName, &aNames);
+}
+
 JSObject*
 Navigator::WrapObject(JSContext* cx, JS::Handle<JSObject*> scope)
 {
diff --git a/dom/base/Navigator.h b/dom/base/Navigator.h
index 0a305262436f..e97bef52f64c 100644
--- a/dom/base/Navigator.h
+++ b/dom/base/Navigator.h
@@ -243,6 +243,8 @@ public:
 #endif // MOZ_MEDIA_NAVIGATOR
   bool DoNewResolve(JSContext* aCx, JS::Handle<JSObject*> aObject,
                     JS::Handle<jsid> aId, JS::MutableHandle<JS::Value> aValue);
+  void GetOwnPropertyNames(JSContext* aCx, nsTArray<nsString>& aNames,
+                           ErrorResult& aRv);
 
   // WebIDL helper methods
   static bool HasBatterySupport(JSContext* /* unused*/, JSObject* /*unused */);
diff --git a/dom/base/nsScriptNameSpaceManager.cpp b/dom/base/nsScriptNameSpaceManager.cpp
index 5520a6265dd0..c18a214771bb 100644
--- a/dom/base/nsScriptNameSpaceManager.cpp
+++ b/dom/base/nsScriptNameSpaceManager.cpp
@@ -787,27 +787,34 @@ nsScriptNameSpaceManager::RegisterNavigatorDOMConstructor(
   }
 }
 
-struct GlobalNameClosure
+struct NameClosure
 {
-  nsScriptNameSpaceManager::GlobalNameEnumerator enumerator;
+  nsScriptNameSpaceManager::NameEnumerator enumerator;
   void* closure;
 };
 
 static PLDHashOperator
-EnumerateGlobalName(PLDHashTable*, PLDHashEntryHdr *hdr, uint32_t,
-                    void* aClosure)
+EnumerateName(PLDHashTable*, PLDHashEntryHdr *hdr, uint32_t, void* aClosure)
 {
   GlobalNameMapEntry *entry = static_cast<GlobalNameMapEntry *>(hdr);
-  GlobalNameClosure* closure = static_cast<GlobalNameClosure*>(aClosure);
+  NameClosure* closure = static_cast<NameClosure*>(aClosure);
   return closure->enumerator(entry->mKey, closure->closure);
 }
 
 void
-nsScriptNameSpaceManager::EnumerateGlobalNames(GlobalNameEnumerator aEnumerator,
+nsScriptNameSpaceManager::EnumerateGlobalNames(NameEnumerator aEnumerator,
                                                void* aClosure)
 {
-  GlobalNameClosure closure = { aEnumerator, aClosure };
-  PL_DHashTableEnumerate(&mGlobalNames, EnumerateGlobalName, &closure);
+  NameClosure closure = { aEnumerator, aClosure };
+  PL_DHashTableEnumerate(&mGlobalNames, EnumerateName, &closure);
+}
+
+void
+nsScriptNameSpaceManager::EnumerateNavigatorNames(NameEnumerator aEnumerator,
+                                                  void* aClosure)
+{
+  NameClosure closure = { aEnumerator, aClosure };
+  PL_DHashTableEnumerate(&mNavigatorNames, EnumerateName, &closure);
 }
 
 static size_t
diff --git a/dom/base/nsScriptNameSpaceManager.h b/dom/base/nsScriptNameSpaceManager.h
index 1d5600168593..41e8d144fa26 100644
--- a/dom/base/nsScriptNameSpaceManager.h
+++ b/dom/base/nsScriptNameSpaceManager.h
@@ -152,10 +152,12 @@ public:
     mozilla::dom::ConstructorEnabled* aConstructorEnabled);
 
   typedef PLDHashOperator
-  (* GlobalNameEnumerator)(const nsAString& aGlobalName, void* aClosure);
+  (* NameEnumerator)(const nsAString& aGlobalName, void* aClosure);
 
-  void EnumerateGlobalNames(GlobalNameEnumerator aEnumerator,
+  void EnumerateGlobalNames(NameEnumerator aEnumerator,
                             void* aClosure);
+  void EnumerateNavigatorNames(NameEnumerator aEnumerator,
+                               void* aClosure);
 
   size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf);
 
diff --git a/dom/bindings/BindingUtils.cpp b/dom/bindings/BindingUtils.cpp
index 4a8a46d8f958..8f99ff2d9864 100644
--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -7,6 +7,8 @@
 #include <algorithm>
 #include <stdarg.h>
 
+#include "JavaScriptParent.h"
+
 #include "prprf.h"
 #include "mozilla/DebugOnly.h"
 #include "mozilla/FloatingPoint.h"
@@ -1746,6 +1748,17 @@ InterfaceHasInstance(JSContext* cx, JS::Handle<JSObject*> obj,
     return true;
   }
 
+  JS::Rooted<JSObject*> unwrapped(cx, js::CheckedUnwrap(instance, true));
+  if (unwrapped && jsipc::JavaScriptParent::IsCPOW(unwrapped)) {
+    bool boolp = false;
+    if (!jsipc::JavaScriptParent::DOMInstanceOf(unwrapped, clasp->mPrototypeID,
+                                                clasp->mDepth, &boolp)) {
+      return false;
+    }
+    *bp = boolp;
+    return true;
+  }
+
   JS::Rooted<JS::Value> protov(cx);
   DebugOnly<bool> ok = JS_GetProperty(cx, obj, "prototype", &protov);
   MOZ_ASSERT(ok, "Someone messed with our prototype property?");
@@ -1787,6 +1800,21 @@ InterfaceHasInstance(JSContext* cx, JS::Handle<JSObject*> obj, JS::MutableHandle
   return InterfaceHasInstance(cx, obj, instanceObject, bp);
 }
 
+JSBool
+InterfaceHasInstance(JSContext* cx, int prototypeID, int depth,
+                     JS::Handle<JSObject*> instance,
+                     JSBool* bp)
+{
+  const DOMClass* domClass = GetDOMClass(js::UncheckedUnwrap(instance));
+
+  MOZ_ASSERT(!domClass || prototypeID != prototypes::id::_ID_Count,
+             "Why do we have a hasInstance hook if we don't have a prototype "
+             "ID?");
+
+  *bp = (domClass && domClass->mInterfaceChain[depth] == prototypeID);
+  return true;
+}
+
 bool
 ReportLenientThisUnwrappingFailure(JSContext* cx, JS::Handle<JSObject*> obj)
 {
diff --git a/dom/bindings/BindingUtils.h b/dom/bindings/BindingUtils.h
index 601e59b65652..62dcfd91aa27 100644
--- a/dom/bindings/BindingUtils.h
+++ b/dom/bindings/BindingUtils.h
@@ -2074,6 +2074,10 @@ InterfaceHasInstance(JSContext* cx, JS::Handle<JSObject*> obj,
 JSBool
 InterfaceHasInstance(JSContext* cx, JS::Handle<JSObject*> obj, JS::MutableHandle<JS::Value> vp,
                      JSBool* bp);
+JSBool
+InterfaceHasInstance(JSContext* cx, int prototypeID, int depth,
+                     JS::Handle<JSObject*> instance,
+                     JSBool* bp);
 
 // Helper for lenient getters/setters to report to console.  If this
 // returns false, we couldn't even get a global.
diff --git a/dom/bindings/Bindings.conf b/dom/bindings/Bindings.conf
index f199dffdde8e..9b72a622dcd0 100644
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@@ -29,6 +29,8 @@
 #                   true for workers, false otherwise).
 #   * customFinalize - The native class will use a custom finalize hook
 #                      (defaults to true for workers, false otherwise).
+#   * wantsQI - Indicates whether the interface should have a QueryInterface
+#               method available to chrome.
 #   * notflattened - The native type does not have nsIClassInfo, so when
 #                    wrapping it the right IID needs to be passed in.
 #   * register - True if this binding should be registered.  Defaults to true.
@@ -610,9 +612,11 @@ DOMInterfaces = {
     'workers': True,
 }],
 
-'ImageData': {
-   'wrapperCache': False
-},
+'ImageData': [
+{
+   'wrapperCache': False,
+   'wantsQI': False,
+}],
 
 'InputStream': [
 {
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index 506035a96966..49385a15ac84 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -23,6 +23,7 @@ CONSTRUCT_HOOK_NAME = '_constructor'
 LEGACYCALLER_HOOK_NAME = '_legacycaller'
 HASINSTANCE_HOOK_NAME = '_hasInstance'
 NEWRESOLVE_HOOK_NAME = '_newResolve'
+ENUMERATE_HOOK_NAME= '_enumerate'
 ENUM_ENTRY_VARIABLE_NAME = 'strings'
 
 def replaceFileIfChanged(filename, newContents):
@@ -88,7 +89,7 @@ class CGNativePropertyHooks(CGThing):
             enumerateOwnProperties = "EnumerateOwnProperties"
         elif self.descriptor.interface.getExtendedAttribute("NeedNewResolve"):
             resolveOwnProperty = "ResolveOwnPropertyViaNewresolve"
-            enumerateOwnProperties = "nullptr"
+            enumerateOwnProperties = "EnumerateOwnPropertiesViaGetOwnPropertyNames"
         else:
             resolveOwnProperty = "nullptr"
             enumerateOwnProperties = "nullptr"
@@ -173,8 +174,10 @@ class CGDOMJSClass(CGThing):
         if self.descriptor.interface.getExtendedAttribute("NeedNewResolve"):
             newResolveHook = "(JSResolveOp)" + NEWRESOLVE_HOOK_NAME
             classFlags += " | JSCLASS_NEW_RESOLVE"
+            enumerateHook = ENUMERATE_HOOK_NAME
         else:
             newResolveHook = "JS_ResolveStub"
+            enumerateHook = "JS_EnumerateStub"
         return """
 DOMJSClass Class = {
   { "%s",
@@ -183,8 +186,8 @@ DOMJSClass Class = {
     JS_DeletePropertyStub, /* delProperty */
     JS_PropertyStub,       /* getProperty */
     JS_StrictPropertyStub, /* setProperty */
-    JS_EnumerateStub,
-    %s,
+    %s, /* enumerate */
+    %s, /* resolve */
     JS_ConvertStub,
     %s, /* finalize */
     nullptr,               /* checkAccess */
@@ -199,7 +202,7 @@ DOMJSClass Class = {
 """ % (self.descriptor.interface.identifier.name,
        classFlags,
        ADDPROPERTY_HOOK_NAME if self.descriptor.concrete and not self.descriptor.workers and self.descriptor.wrapperCache else 'JS_PropertyStub',
-       newResolveHook, FINALIZE_HOOK_NAME, callHook, traceHook,
+       enumerateHook, newResolveHook, FINALIZE_HOOK_NAME, callHook, traceHook,
        CGIndenter(CGGeneric(DOMClass(self.descriptor))).define())
 
 def PrototypeIDAndDepth(descriptor):
@@ -647,13 +650,15 @@ class CGHeaders(CGWrapper):
         for desc in descriptors:
             if desc.interface.isExternal():
                 continue
-            for m in desc.interface.members:
-                func = PropertyDefiner.getStringAttr(m, "Func")
+            def addHeaderForFunc(func):
                 # Include the right class header, which we can only do
                 # if this is a class member function.
                 if func is not None and "::" in func:
                     # Strip out the function name and convert "::" to "/"
                     bindingHeaders.add("/".join(func.split("::")[:-1]) + ".h")
+            for m in desc.interface.members:
+                addHeaderForFunc(PropertyDefiner.getStringAttr(m, "Func"))
+            addHeaderForFunc(desc.interface.getExtendedAttribute("Func"))
 
         for d in dictionaries:
             if d.parent:
@@ -1369,21 +1374,6 @@ def overloadLength(arguments):
 def methodLength(method):
     signatures = method.signatures()
     return min(overloadLength(arguments) for (retType, arguments) in signatures)
-def requiresQueryInterfaceMethod(descriptor):
-    # Make sure to not stick QueryInterface on abstract interfaces that
-    # have hasXPConnectImpls (like EventTarget).  So only put it on
-    # interfaces that are concrete and all of whose ancestors are abstract.
-    def allAncestorsAbstract(iface):
-        if not iface.parent:
-            return True
-        desc = descriptor.getDescriptor(iface.parent.identifier.name)
-        if desc.concrete:
-            return False
-        return allAncestorsAbstract(iface.parent)
-    return (not descriptor.workers and
-            descriptor.interface.hasInterfacePrototypeObject() and
-            descriptor.concrete and
-            allAncestorsAbstract(descriptor.interface))
 
 class MethodDefiner(PropertyDefiner):
     """
@@ -1425,7 +1415,7 @@ class MethodDefiner(PropertyDefiner):
                                  "flags": "JSPROP_ENUMERATE",
                                  "condition": MemberCondition(None, None) })
 
-        if not static and requiresQueryInterfaceMethod(descriptor):
+        if not static and descriptor.wantsQI():
             condition = "WantsQueryInterface<%s>::Enabled" % descriptor.nativeType
             self.regular.append({"name": 'QueryInterface',
                                  "methodInfo": False,
@@ -1720,7 +1710,9 @@ class CGCreateInterfaceObjectsMethod(CGAbstractMethod):
             if len(idsToInit) > 1:
                 initIds = CGWrapper(initIds, pre="(", post=")", reindent=True)
             initIds = CGList(
-                [CGGeneric("%s_ids[0] == JSID_VOID &&" % idsToInit[0]), initIds],
+                [CGGeneric("%s_ids[0] == JSID_VOID &&" % idsToInit[0]),
+                 CGGeneric("NS_IsMainThread() &&"),
+                 initIds],
                 "\n")
             initIds = CGWrapper(initIds, pre="if (", post=") {", reindent=True)
             initIds = CGList(
@@ -1950,7 +1942,7 @@ class CGDefineDOMInterfaceMethod(CGAbstractMethod):
 
 """ + getConstructor)
 
-class CGPrefEnabledNative(CGAbstractMethod):
+class CGConstructorEnabledViaPrefEnabled(CGAbstractMethod):
     """
     A method for testing whether the preference controlling this
     interface is enabled. This delegates to PrefEnabled() on the
@@ -1967,7 +1959,7 @@ class CGPrefEnabledNative(CGAbstractMethod):
     def definition_body(self):
         return "  return %s::PrefEnabled();" % self.descriptor.nativeType
 
-class CGPrefEnabled(CGAbstractMethod):
+class CGConstructorEnabledViaPref(CGAbstractMethod):
     """
     A method for testing whether the preference controlling this
     interface is enabled. This generates code in the binding to
@@ -2002,6 +1994,22 @@ class CGConstructorEnabledChromeOnly(CGAbstractMethod):
     def definition_body(self):
         return "  return %s;" % GetAccessCheck(self.descriptor, "aObj")
 
+class CGConstructorEnabledViaFunc(CGAbstractMethod):
+    """
+    A method for testing whether the interface object should be exposed on a
+    given global based on whatever the callee wants to consider.
+    """
+    def __init__(self, descriptor):
+        CGAbstractMethod.__init__(self, descriptor,
+                                  'ConstructorEnabled', 'bool',
+                                  [Argument("JSContext*", "cx"),
+                                   Argument("JS::Handle<JSObject*>", "obj")])
+
+    def definition_body(self):
+        func = self.descriptor.interface.getExtendedAttribute("Func")
+        assert isinstance(func, list) and len(func) == 1
+        return "  return %s(cx, obj);" % func[0]
+
 class CGIsMethod(CGAbstractMethod):
     def __init__(self, descriptor):
         args = [Argument('JSObject*', 'obj')]
@@ -2148,7 +2156,7 @@ class CGWrapWithCacheMethod(CGAbstractMethod):
         self.properties = properties
 
     def definition_body(self):
-        if self.descriptor.workers:
+        if self.descriptor.nativeOwnership == 'worker':
             return """  return aObject->GetJSObject();"""
 
         assertISupportsInheritance = (
@@ -5336,20 +5344,15 @@ class CGNewResolveHook(CGAbstractBindingMethod):
     NewResolve hook for our object
     """
     def __init__(self, descriptor):
-        self._needNewResolve = descriptor.interface.getExtendedAttribute("NeedNewResolve")
+        assert descriptor.interface.getExtendedAttribute("NeedNewResolve")
         args = [Argument('JSContext*', 'cx'), Argument('JS::Handle<JSObject*>', 'obj'),
                 Argument('JS::Handle<jsid>', 'id'), Argument('unsigned', 'flags'),
                 Argument('JS::MutableHandle<JSObject*>', 'objp')]
-        # Our "self" is actually the callee in this case, not the thisval.
+        # Our "self" is actually the "obj" argument in this case, not the thisval.
         CGAbstractBindingMethod.__init__(
             self, descriptor, NEWRESOLVE_HOOK_NAME,
             args, getThisObj="", callArgs="")
 
-    def define(self):
-        if not self._needNewResolve:
-            return ""
-        return CGAbstractBindingMethod.define(self)
-
     def generate_code(self):
         return CGIndenter(CGGeneric(
                 "JS::Rooted<JS::Value> value(cx);\n"
@@ -5365,6 +5368,36 @@ class CGNewResolveHook(CGAbstractBindingMethod):
                 "objp.set(obj);\n"
                 "return true;"))
 
+class CGEnumerateHook(CGAbstractBindingMethod):
+    """
+    Enumerate hook for our object
+    """
+    def __init__(self, descriptor):
+        assert descriptor.interface.getExtendedAttribute("NeedNewResolve")
+        args = [Argument('JSContext*', 'cx'),
+                Argument('JS::Handle<JSObject*>', 'obj')]
+        # Our "self" is actually the "obj" argument in this case, not the thisval.
+        CGAbstractBindingMethod.__init__(
+            self, descriptor, ENUMERATE_HOOK_NAME,
+            args, getThisObj="", callArgs="")
+
+    def generate_code(self):
+        return CGIndenter(CGGeneric(
+                "nsAutoTArray<nsString, 8> names;\n"
+                "ErrorResult rv;\n"
+                "self->GetOwnPropertyNames(cx, names, rv);\n"
+                "rv.WouldReportJSException();\n"
+                "if (rv.Failed()) {\n"
+                '  return ThrowMethodFailedWithDetails<true>(cx, rv, "%s", "enumerate");\n'
+                "}\n"
+                "JS::Rooted<JS::Value> dummy(cx);\n"
+                "for (uint32_t i = 0; i < names.Length(); ++i) {\n"
+                "  if (!JS_LookupUCProperty(cx, obj, names[i].get(), names[i].Length(), &dummy)) {\n"
+                "    return false;\n"
+                "  }\n"
+                "}\n"
+                "return true;"))
+
 class CppKeywords():
     """
     A class for checking if method names declared in webidl
@@ -6920,6 +6953,33 @@ class CGEnumerateOwnProperties(CGAbstractStaticMethod):
         return """  return js::GetProxyHandler(obj)->getOwnPropertyNames(cx, wrapper, props);
 """
 
+class CGEnumerateOwnPropertiesViaGetOwnPropertyNames(CGAbstractBindingMethod):
+    """
+    An implementation of Xray EnumerateOwnProperties stuff for things
+    that have a newresolve hook.
+    """
+    def __init__(self, descriptor):
+        args = [Argument('JSContext*', 'cx'),
+                Argument('JS::Handle<JSObject*>', 'wrapper'),
+                Argument('JS::Handle<JSObject*>', 'obj'),
+                Argument('JS::AutoIdVector&', 'props')]
+        CGAbstractBindingMethod.__init__(self, descriptor,
+                                         "EnumerateOwnPropertiesViaGetOwnPropertyNames",
+                                         args, getThisObj="",
+                                         callArgs="", returnType="bool")
+    def generate_code(self):
+        return CGIndenter(CGGeneric(
+                "nsAutoTArray<nsString, 8> names;\n"
+                "ErrorResult rv;\n"
+                "self->GetOwnPropertyNames(cx, names, rv);\n"
+                "rv.WouldReportJSException();\n"
+                "if (rv.Failed()) {\n"
+                '  return ThrowMethodFailedWithDetails<true>(cx, rv, "%s", "enumerate");\n'
+                "}\n"
+                '// OK to pass null as "proxy" because it\'s ignored if\n'
+                "// shadowPrototypeProperties is true\n"
+                "return DOMProxyHandler::AppendNamedPropertyIds(cx, JS::NullPtr(), names, true, nullptr, props);"))
+
 class CGPrototypeTraitsClass(CGClass):
     def __init__(self, descriptor, indent=''):
         templateArgs = [Argument('prototypes::ID', 'PrototypeID')]
@@ -7488,7 +7548,7 @@ for (int32_t i = 0; i < int32_t(length); ++i) {
             addNames = """
 nsTArray<nsString> names;
 UnwrapProxy(proxy)->GetSupportedNames(names);
-if (!AppendNamedPropertyIds(cx, proxy, names, %s, props)) {
+if (!AppendNamedPropertyIds(cx, proxy, names, %s, this, props)) {
   return false;
 }
 """ % shadow
@@ -7882,6 +7942,7 @@ class CGDescriptor(CGThing):
             cgThings.append(CGEnumerateOwnProperties(descriptor))
         elif descriptor.interface.getExtendedAttribute("NeedNewResolve"):
             cgThings.append(CGResolveOwnPropertyViaNewresolve(descriptor))
+            cgThings.append(CGEnumerateOwnPropertiesViaGetOwnPropertyNames(descriptor))
 
         # Now that we have our ResolveOwnProperty/EnumerateOwnProperties stuff
         # done, set up our NativePropertyHooks.
@@ -7897,7 +7958,9 @@ class CGDescriptor(CGThing):
             cgThings.append(CGNamedConstructors(descriptor))
 
         cgThings.append(CGLegacyCallHook(descriptor))
-        cgThings.append(CGNewResolveHook(descriptor))
+        if descriptor.interface.getExtendedAttribute("NeedNewResolve"):
+            cgThings.append(CGNewResolveHook(descriptor))
+            cgThings.append(CGEnumerateHook(descriptor))
 
         if descriptor.interface.hasInterfacePrototypeObject():
             cgThings.append(CGPrototypeJSClass(descriptor, properties))
@@ -7918,17 +7981,21 @@ class CGDescriptor(CGThing):
             prefControlled = descriptor.interface.getExtendedAttribute("PrefControlled")
             havePref = descriptor.interface.getExtendedAttribute("Pref")
             haveChromeOnly = descriptor.interface.getExtendedAttribute("ChromeOnly")
+            haveFunc = descriptor.interface.getExtendedAttribute("Func")
             # Make sure at most one of those is set
-            if bool(prefControlled) + bool(havePref) + bool(haveChromeOnly) > 1:
+            if (bool(prefControlled) + bool(havePref) +
+                bool(haveChromeOnly) + bool(haveFunc) > 1):
                 raise TypeError("Interface %s has more than one of "
-                                "'PrefControlled', 'Pref', and 'ChomeOnly' "
-                                "specified", descriptor.name)
+                                "'PrefControlled', 'Pref', 'Func', and "
+                                "'ChomeOnly' specified", descriptor.name)
             if prefControlled is not None:
-                cgThings.append(CGPrefEnabledNative(descriptor))
+                cgThings.append(CGConstructorEnabledViaPrefEnabled(descriptor))
             elif havePref is not None:
-                cgThings.append(CGPrefEnabled(descriptor))
+                cgThings.append(CGConstructorEnabledViaPref(descriptor))
             elif haveChromeOnly is not None:
                 cgThings.append(CGConstructorEnabledChromeOnly(descriptor))
+            elif haveFunc is not None:
+                cgThings.append(CGConstructorEnabledViaFunc(descriptor))
 
         if descriptor.concrete:
             if descriptor.proxy:
@@ -8454,7 +8521,8 @@ class CGRegisterProtos(CGAbstractMethod):
         def getCheck(desc):
             if (desc.interface.getExtendedAttribute("PrefControlled") is None and
                 desc.interface.getExtendedAttribute("Pref") is None and
-                desc.interface.getExtendedAttribute("ChromeOnly") is None):
+                desc.interface.getExtendedAttribute("ChromeOnly") is None and
+                desc.interface.getExtendedAttribute("Func") is None):
                 return "nullptr"
             return "%sBinding::ConstructorEnabled" % desc.name
         lines = []
diff --git a/dom/bindings/Configuration.py b/dom/bindings/Configuration.py
index d82138138942..c63ce0fbf8ba 100644
--- a/dom/bindings/Configuration.py
+++ b/dom/bindings/Configuration.py
@@ -358,11 +358,7 @@ class Descriptor(DescriptorProvider):
                     iface = iface.parent
         self.operations = operations
 
-        if self.workers:
-            if desc.get('nativeOwnership', 'worker') != 'worker':
-                raise TypeError("Worker descriptor for %s should have 'worker' "
-                                "as value for nativeOwnership" %
-                                self.interface.identifier.name)
+        if self.workers and desc.get('nativeOwnership', 'worker') == 'worker':
             self.nativeOwnership = "worker"
         else:
             self.nativeOwnership = desc.get('nativeOwnership', 'refcounted')
@@ -372,8 +368,10 @@ class Descriptor(DescriptorProvider):
                                 (self.interface.identifier.name, self.nativeOwnership))
         self.customTrace = desc.get('customTrace', self.workers)
         self.customFinalize = desc.get('customFinalize', self.workers)
+        if desc.get('wantsQI', None) != None:
+            self._wantsQI = desc.get('wantsQI', None)
         self.wrapperCache = (not self.interface.isCallback() and
-                             (self.workers or
+                             (self.nativeOwnership == 'worker' or
                               (self.nativeOwnership != 'owned' and
                                desc.get('wrapperCache', True))))
 
@@ -488,6 +486,26 @@ class Descriptor(DescriptorProvider):
             self.interface.getExtendedAttribute("PrefControlled") or
             self.interface.hasInterfacePrototypeObject())
 
+    def wantsQI(self):
+        # If it was specified explicitly use that.
+        if hasattr(self, '_wantsQI'):
+            return self._wantsQI
+
+        # Make sure to not stick QueryInterface on abstract interfaces that
+        # have hasXPConnectImpls (like EventTarget).  So only put it on
+        # interfaces that are concrete and all of whose ancestors are abstract.
+        def allAncestorsAbstract(iface):
+            if not iface.parent:
+                return True
+            desc = self.getDescriptor(iface.parent.identifier.name)
+            if desc.concrete:
+                return False
+            return allAncestorsAbstract(iface.parent)
+        return (not self.workers and
+                self.interface.hasInterfacePrototypeObject() and
+                self.concrete and
+                allAncestorsAbstract(self.interface))
+
 # Some utility methods
 def getTypesFromDescriptor(descriptor):
     """
diff --git a/dom/bindings/DOMJSProxyHandler.cpp b/dom/bindings/DOMJSProxyHandler.cpp
index b061b73b2d48..901f5207965a 100644
--- a/dom/bindings/DOMJSProxyHandler.cpp
+++ b/dom/bindings/DOMJSProxyHandler.cpp
@@ -266,11 +266,13 @@ DOMProxyHandler::has(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid
   return ok;
 }
 
+/* static */
 bool
 DOMProxyHandler::AppendNamedPropertyIds(JSContext* cx,
                                         JS::Handle<JSObject*> proxy,
                                         nsTArray<nsString>& names,
                                         bool shadowPrototypeProperties,
+                                        DOMProxyHandler* handler,
                                         JS::AutoIdVector& props)
 {
   for (uint32_t i = 0; i < names.Length(); ++i) {
@@ -285,7 +287,7 @@ DOMProxyHandler::AppendNamedPropertyIds(JSContext* cx,
     }
 
     if (shadowPrototypeProperties ||
-        !HasPropertyOnPrototype(cx, proxy, this, id)) {
+        !HasPropertyOnPrototype(cx, proxy, handler, id)) {
       if (!props.append(id)) {
         return false;
       }
diff --git a/dom/bindings/DOMJSProxyHandler.h b/dom/bindings/DOMJSProxyHandler.h
index c329a1cb090c..8fd6179843cd 100644
--- a/dom/bindings/DOMJSProxyHandler.h
+++ b/dom/bindings/DOMJSProxyHandler.h
@@ -77,14 +77,15 @@ public:
 
   const DOMClass& mClass;
 
-protected:
   // Append the property names in "names" to "props". If
   // shadowPrototypeProperties is false then skip properties that are also
-  // present on our proto chain.
-  bool AppendNamedPropertyIds(JSContext* cx, JS::Handle<JSObject*> proxy,
-                              nsTArray<nsString>& names,
-                              bool shadowPrototypeProperties,
-                              JS::AutoIdVector& props);
+  // present on our proto chain.  If shadowPrototypeProperties is true,
+  // then the "proxy" and "handler" arguments are ignored.
+  static bool AppendNamedPropertyIds(JSContext* cx, JS::Handle<JSObject*> proxy,
+                                     nsTArray<nsString>& names,
+                                     bool shadowPrototypeProperties,
+                                     DOMProxyHandler* handler,
+                                     JS::AutoIdVector& props);
 };
 
 extern jsid s_length_id;
diff --git a/dom/bindings/Makefile.in b/dom/bindings/Makefile.in
index b743600faa14..6e224087e6fa 100644
--- a/dom/bindings/Makefile.in
+++ b/dom/bindings/Makefile.in
@@ -74,6 +74,7 @@ endif
 
 LOCAL_INCLUDES += -I$(topsrcdir)/js/xpconnect/src \
   -I$(topsrcdir)/js/xpconnect/wrappers \
+  -I$(topsrcdir)/js/ipc \
   -I$(topsrcdir)/content/canvas/src \
   -I$(topsrcdir)/content/html/content/src \
   -I$(topsrcdir)/media/webrtc/signaling/src/peerconnection \
diff --git a/dom/bindings/parser/WebIDL.py b/dom/bindings/parser/WebIDL.py
index 3909d3c6470b..f5ad8bdda9ee 100644
--- a/dom/bindings/parser/WebIDL.py
+++ b/dom/bindings/parser/WebIDL.py
@@ -932,7 +932,8 @@ class IDLInterface(IDLObjectWithScope):
             elif (identifier == "Pref" or
                   identifier == "JSImplementation" or
                   identifier == "HeaderFile" or
-                  identifier == "NavigatorProperty"):
+                  identifier == "NavigatorProperty" or
+                  identifier == "Func"):
                 # Known extended attributes that take a string value
                 if not attr.hasValue():
                     raise WebIDLError("[%s] must have a value" % identifier,
diff --git a/dom/bindings/test/Makefile.in b/dom/bindings/test/Makefile.in
index 1578f70ed8d0..fbfe03004cf0 100644
--- a/dom/bindings/test/Makefile.in
+++ b/dom/bindings/test/Makefile.in
@@ -63,6 +63,7 @@ MOCHITEST_FILES := \
   forOf_iframe.html \
   test_sequence_wrapping.html \
   file_bug775543.html \
+  file_bug707564.html \
   test_bug788369.html \
   test_bug742191.html \
   test_namedNoIndexed.html \
@@ -75,10 +76,12 @@ MOCHITEST_FILES := \
   test_lenientThis.html \
   test_ByteString.html \
   test_exception_messages.html \
+  test_bug707564.html \
   $(NULL)
 
 MOCHITEST_CHROME_FILES = \
   test_bug775543.html \
+  test_bug707564-chrome.html \
   $(NULL)
 
 ifdef GNU_CC
diff --git a/dom/bindings/test/file_bug707564.html b/dom/bindings/test/file_bug707564.html
new file mode 100644
index 000000000000..7a4ac9e4f4ad
--- /dev/null
+++ b/dom/bindings/test/file_bug707564.html
@@ -0,0 +1,5 @@
+<body>
+<script>
+  navigator.foopy = 5;
+</script>
+</body>
diff --git a/dom/bindings/test/test_bug707564-chrome.html b/dom/bindings/test/test_bug707564-chrome.html
new file mode 100644
index 000000000000..90339ee051c0
--- /dev/null
+++ b/dom/bindings/test/test_bug707564-chrome.html
@@ -0,0 +1,52 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=707564
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 707564</title>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=707564">Mozilla Bug 707564</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+<iframe id="t1" src="http://example.org/tests/dom/bindings/test/file_bug707564.html"></iframe>
+<iframe id="t2" src="http://example.org/tests/dom/bindings/test/file_bug707564.html"></iframe>
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 775543 **/
+function test()
+{
+  var nav = document.getElementById("t1").contentWindow.navigator;
+  ise(nav.foopy, undefined, "We should have an Xray now");
+  is(nav.wrappedJSObject.foopy, 5, "We should have the right navigator object");
+  var props = Object.getOwnPropertyNames(nav);
+  isnot(props.indexOf("mozApps"), -1,
+        "Should enumerate a mozApps property on navigator xray");
+
+  var nav = document.getElementById("t2").contentWindow.navigator;
+  ise(nav.foopy, undefined, "We should have an Xray now again");
+  is(nav.wrappedJSObject.foopy, 5, "We should have the right navigator object again");
+  var found = false;
+  for (var name in nav) {
+    if (name == "mozApps") {
+      found = true;
+    }
+  }
+  ok(found, "Should enumerate a mozApps property on navigator xray via for...in");
+
+  SimpleTest.finish();
+}
+
+addLoadEvent(test);
+
+SimpleTest.waitForExplicitFinish();
+</script>
+</pre>
+</body>
+</html>
diff --git a/dom/bindings/test/test_bug707564.html b/dom/bindings/test/test_bug707564.html
new file mode 100644
index 000000000000..8b0f9068b0ea
--- /dev/null
+++ b/dom/bindings/test/test_bug707564.html
@@ -0,0 +1,43 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=707564
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 707564</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+
+  /** Test for Bug 707564 **/
+  SimpleTest.waitForExplicitFinish();
+
+  addLoadEvent(function() {
+    var props = Object.getOwnPropertyNames(frames[0].navigator);
+    isnot(props.indexOf("mozApps"), -1,
+          "Should enumerate a mozApps property on navigator");
+
+    // Now enumerate a different navigator object
+    var found = false;
+    for (var name in frames[1].navigator) {
+      if (name == "mozApps") {
+        found = true;
+      }
+    }
+    ok(found, "Should enumerate a mozApps property on navigator via for...in");
+    SimpleTest.finish();
+  });
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=707564">Mozilla Bug 707564</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+<iframe></iframe>
+<iframe></iframe>
+</div>
+<pre id="test">
+</pre>
+</body>
+</html>
diff --git a/dom/interfaces/push/moz.build b/dom/interfaces/push/moz.build
deleted file mode 100644
index 087c553ef51d..000000000000
--- a/dom/interfaces/push/moz.build
+++ /dev/null
@@ -1,9 +0,0 @@
-# vim: set filetype=python:
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-MODULE        = 'dom'
-XPIDL_MODULE  = 'dom_push'
-XPIDL_SOURCES += ['nsIDOMPushManager.idl']
-XPIDL_FLAGS += ['-I$(topsrcdir)/dom/interfaces/base']
diff --git a/dom/interfaces/push/nsIDOMPushManager.idl b/dom/interfaces/push/nsIDOMPushManager.idl
deleted file mode 100644
index 12a853267cf8..000000000000
--- a/dom/interfaces/push/nsIDOMPushManager.idl
+++ /dev/null
@@ -1,45 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "domstubs.idl"
-interface nsIDOMDOMRequest;
-
-/**
- * Client API for SimplePush.
- *
- * The SimplePush API allows web applications to use push notifications and be
- * woken up when something of interest has changed. This frees web applications
- * from implementing polling, giving better responsiveness and conserving the
- * device's battery life.
- */
-[scriptable,uuid(c7ad4f42-faae-4e8b-9879-780a72349945)]
-interface nsIDOMPushManager : nsISupports
-{
-  /**
-   * Register for a new push endpoint.
-   *
-   * On success, the DOMRequest's result field will be a string URL.  This URL
-   * is the endpoint that can be contacted to wake up the application.
-   */
-  nsIDOMDOMRequest register();
-  
-  /**
-   * Unregister a push endpoint.
-   *
-   * On success, the DOMRequest's result field will be the endpoint that was
-   * passed in.
-   *
-   * Stops watching for changes to this URL.
-   */
-  nsIDOMDOMRequest unregister(in ACString endpoint);
-
-  /**
-   * Get a list of active registrations for this web app.
-   *
-   * On success, the DOMRequest's result field is an array of endpoints.
-   * For example:
-   *   ["https://example.com/notify/1", "https://example.com/notify/2"]
-   */
-  nsIDOMDOMRequest registrations();
-};
diff --git a/dom/ipc/PBrowser.ipdl b/dom/ipc/PBrowser.ipdl
index 482be78c0426..179309035aba 100644
--- a/dom/ipc/PBrowser.ipdl
+++ b/dom/ipc/PBrowser.ipdl
@@ -190,6 +190,12 @@ parent:
     SetCursor(uint32_t value);
     SetBackgroundColor(nscolor color);
 
+    /**
+     * Used to set the current text of the status tooltip.
+     * Nowadays this is mainly used for link locations on hover.
+     */
+    SetStatus(uint32_t type, nsString status);
+
     /**
      * Initiates an asynchronous request for permission for the
      * provided principal.
diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index 0520078a413c..1015320f3f61 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -744,8 +744,10 @@ NS_IMPL_RELEASE(TabChild)
 NS_IMETHODIMP
 TabChild::SetStatus(uint32_t aStatusType, const PRUnichar* aStatus)
 {
-  // FIXME/bug 617804: should the platform support this?
-  return NS_OK;
+  return SetStatusWithContext(aStatusType,
+      aStatus ? static_cast<const nsString &>(nsDependentString(aStatus))
+              : EmptyString(),
+      nullptr);
 }
 
 NS_IMETHODIMP
@@ -820,10 +822,13 @@ TabChild::ExitModalEventLoop(nsresult aStatus)
 
 NS_IMETHODIMP
 TabChild::SetStatusWithContext(uint32_t aStatusType,
-                                    const nsAString& aStatusText,
-                                    nsISupports* aStatusContext)
+                               const nsAString& aStatusText,
+                               nsISupports* aStatusContext)
 {
-  // FIXME/bug 617804: should the platform support this?
+  // We can only send the status after the ipc machinery is set up,
+  // mRemoteFrame is a good indicator.
+  if (mRemoteFrame)
+    SendSetStatus(aStatusType, nsString(aStatusText));
   return NS_OK;
 }
 
@@ -2208,14 +2213,19 @@ TabChild::InitRenderingState()
     if (id != 0) {
         // Pushing layers transactions directly to a separate
         // compositor context.
-		PCompositorChild* compositorChild = CompositorChild::Get();
+        PCompositorChild* compositorChild = CompositorChild::Get();
         if (!compositorChild) {
           NS_WARNING("failed to get CompositorChild instance");
           return false;
         }
+        bool success;
         shadowManager =
             compositorChild->SendPLayerTransactionConstructor(mTextureFactoryIdentifier.mParentBackend,
-                                                              id, &mTextureFactoryIdentifier);
+                                                              id, &mTextureFactoryIdentifier, &success);
+        if (!success) {
+          NS_WARNING("failed to properly allocate layer transaction");
+          return false;
+        }
     } else {
         // Pushing transactions to the parent content.
         shadowManager = remoteFrame->SendPLayerTransactionConstructor();
diff --git a/dom/ipc/TabParent.cpp b/dom/ipc/TabParent.cpp
index 7a4c3db0805a..b6a4f2180b99 100644
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -41,6 +41,9 @@
 #include "nsIURI.h"
 #include "nsIMozBrowserFrame.h"
 #include "nsIScriptSecurityManager.h"
+#include "nsIWebBrowserChrome.h"
+#include "nsIXULBrowserWindow.h"
+#include "nsIXULWindow.h"
 #include "nsViewManager.h"
 #include "nsIWidget.h"
 #include "nsIWindowWatcher.h"
@@ -748,6 +751,42 @@ TabParent::RecvSetBackgroundColor(const nscolor& aColor)
   return true;
 }
 
+bool
+TabParent::RecvSetStatus(const uint32_t& aType, const nsString& aStatus)
+{
+  nsCOMPtr<nsIContent> frame = do_QueryInterface(mFrameElement);
+  if (frame) {
+    nsCOMPtr<nsISupports> container = frame->OwnerDoc()->GetContainer();
+    if (!container)
+      return true;
+    nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(container);
+    if (!docShell)
+      return true;
+    nsCOMPtr<nsIDocShellTreeOwner> treeOwner;
+    docShell->GetTreeOwner(getter_AddRefs(treeOwner));
+    if (!treeOwner)
+      return true;
+
+    nsCOMPtr<nsIXULWindow> window = do_GetInterface(treeOwner);
+    if (window) {
+      nsCOMPtr<nsIXULBrowserWindow> xulBrowserWindow;
+      window->GetXULBrowserWindow(getter_AddRefs(xulBrowserWindow));
+      if (xulBrowserWindow) {
+        switch (aType)
+        {
+        case nsIWebBrowserChrome::STATUS_SCRIPT:
+          xulBrowserWindow->SetJSStatus(aStatus);
+          break;
+        case nsIWebBrowserChrome::STATUS_LINK:
+          xulBrowserWindow->SetOverLink(aStatus, nullptr);
+          break;
+        }
+      }
+    }
+  }
+  return true;
+}
+
 bool
 TabParent::RecvNotifyIMEFocus(const bool& aFocus,
                               nsIMEUpdatePreference* aPreference,
diff --git a/dom/ipc/TabParent.h b/dom/ipc/TabParent.h
index 6f2be2c7ce41..853a7d20a5db 100644
--- a/dom/ipc/TabParent.h
+++ b/dom/ipc/TabParent.h
@@ -153,6 +153,7 @@ public:
                                      const int32_t& aFocusChange);
     virtual bool RecvSetCursor(const uint32_t& aValue);
     virtual bool RecvSetBackgroundColor(const nscolor& aValue);
+    virtual bool RecvSetStatus(const uint32_t& aType, const nsString& aStatus);
     virtual bool RecvGetDPI(float* aValue);
     virtual bool RecvGetDefaultScale(double* aValue);
     virtual bool RecvGetWidgetNativeData(WindowsHandle* aValue);
diff --git a/dom/moz.build b/dom/moz.build
index f49b4f51745e..cfe9ab268af7 100644
--- a/dom/moz.build
+++ b/dom/moz.build
@@ -27,7 +27,6 @@ interfaces = [
     'geolocation',
     'notification',
     'permission',
-    'push',
     'svg',
     'smil',
     'apps',
diff --git a/dom/network/src/TCPSocket.js b/dom/network/src/TCPSocket.js
index 5a2f788c1b40..8c907bed3d28 100644
--- a/dom/network/src/TCPSocket.js
+++ b/dom/network/src/TCPSocket.js
@@ -350,7 +350,12 @@ TCPSocket.prototype = {
   /* end nsITCPSocketInternal methods */
 
   initWindowless: function ts_initWindowless() {
-    return Services.prefs.getBoolPref("dom.mozTCPSocket.enabled");
+    try {
+      return Services.prefs.getBoolPref("dom.mozTCPSocket.enabled");
+    } catch (e) {
+      // no pref means return false
+      return false;
+    }
   },
 
   init: function ts_init(aWindow) {
diff --git a/dom/push/src/Push.js b/dom/push/src/Push.js
index 0334763578ea..4486820d58ac 100644
--- a/dom/push/src/Push.js
+++ b/dom/push/src/Push.js
@@ -17,21 +17,22 @@ Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/DOMRequestHelper.jsm");
 Cu.import("resource://gre/modules/AppsUtils.jsm");
 
-const PUSH_CID = Components.ID("{c7ad4f42-faae-4e8b-9879-780a72349945}");
+const PUSH_CID = Components.ID("{cde1d019-fad8-4044-b141-65fb4fb7a245}");
 
 /**
  * The Push component runs in the child process and exposes the SimplePush API
  * to the web application. The PushService running in the parent process is the
  * one actually performing all operations.
  */
-function Push()
-{
+function Push() {
   debug("Push Constructor");
 }
 
 Push.prototype = {
   __proto__: DOMRequestIpcHelper.prototype,
 
+  contractID: "@mozilla.org/push/PushManager;1",
+
   classID : PUSH_CID,
 
   QueryInterface : XPCOMUtils.generateQI([Ci.nsIDOMGlobalPropertyInitializer,
@@ -40,9 +41,6 @@ Push.prototype = {
   init: function(aWindow) {
     debug("init()");
 
-    if (!Services.prefs.getBoolPref("services.push.enabled"))
-      return null;
-
     let principal = aWindow.document.nodePrincipal;
 
     this._pageURL = principal.URI;
@@ -51,13 +49,19 @@ Push.prototype = {
                         .getService(Ci.nsIAppsService);
     this._app = appsService.getAppByLocalId(principal.appId);
     this._manifestURL = appsService.getManifestURLByLocalId(principal.appId);
-    if (!this._manifestURL)
-      return null;
+    if (!this._manifestURL) {
+	// Now what?  XXXbz should this be tested in a Func for this
+	// interface so it wouldn't appear at all?
+	return;
+    }
 
     let perm = Services.perms.testExactPermissionFromPrincipal(principal,
                                                                "push");
-    if (perm != Ci.nsIPermissionManager.ALLOW_ACTION)
-      return null;
+    if (perm != Ci.nsIPermissionManager.ALLOW_ACTION) {
+	// Now what?  XXXbz should this be tested in a Func for this
+	// interface so it wouldn't appear at all?
+	return;
+    }
 
     this.initDOMRequestHelper(aWindow, [
       "PushService:Register:OK",
@@ -70,18 +74,6 @@ Push.prototype = {
 
     this._cpmm = Cc["@mozilla.org/childprocessmessagemanager;1"]
                    .getService(Ci.nsISyncMessageSender);
-
-    var self = this;
-    return {
-      register: self.register.bind(self),
-      unregister: self.unregister.bind(self),
-      registrations: self.registrations.bind(self),
-      __exposedProps__: {
-        register: "r",
-        unregister: "r",
-        registrations: "r"
-      }
-    };
   },
 
   receiveMessage: function(aMessage) {
diff --git a/dom/push/src/Push.manifest b/dom/push/src/Push.manifest
index 66eab3ef1747..aa859f8fa194 100644
--- a/dom/push/src/Push.manifest
+++ b/dom/push/src/Push.manifest
@@ -1,9 +1,8 @@
 # DOM API
-component {c7ad4f42-faae-4e8b-9879-780a72349945} Push.js
-contract @mozilla.org/Push;1 {c7ad4f42-faae-4e8b-9879-780a72349945}
-category JavaScript-navigator-property push @mozilla.org/Push;1
+component {cde1d019-fad8-4044-b141-65fb4fb7a245} Push.js
+contract @mozilla.org/push/PushManager;1 {cde1d019-fad8-4044-b141-65fb4fb7a245}
 
 # Component to initialize PushService on startup.
 component {4b8caa3b-3c58-4f3c-a7f5-7bd9cb24c11d} PushServiceLauncher.js
-contract @mozilla.org/dom/push/service;1 {4b8caa3b-3c58-4f3c-a7f5-7bd9cb24c11d}
-category app-startup PushServiceLauncher @mozilla.org/dom/push/service;1
+contract @mozilla.org/push/ServiceLauncher;1 {4b8caa3b-3c58-4f3c-a7f5-7bd9cb24c11d}
+category app-startup PushServiceLauncher @mozilla.org/push/ServiceLauncher;1
diff --git a/dom/push/src/PushServiceLauncher.js b/dom/push/src/PushServiceLauncher.js
index e6afc94ab127..4a0606e53826 100644
--- a/dom/push/src/PushServiceLauncher.js
+++ b/dom/push/src/PushServiceLauncher.js
@@ -18,6 +18,8 @@ function PushServiceLauncher() {
 PushServiceLauncher.prototype = {
   classID: Components.ID("{4b8caa3b-3c58-4f3c-a7f5-7bd9cb24c11d}"),
 
+  contractID: "@mozilla.org/push/ServiceLauncher;1",
+
   QueryInterface: XPCOMUtils.generateQI([Ci.nsIObserver,
                                          Ci.nsISupportsWeakReference]),
 
diff --git a/dom/system/gonk/NetworkManager.js b/dom/system/gonk/NetworkManager.js
index eb0878a053a5..87f60d61394b 100644
--- a/dom/system/gonk/NetworkManager.js
+++ b/dom/system/gonk/NetworkManager.js
@@ -434,6 +434,27 @@ NetworkManager.prototype = {
     });
   },
 
+  setWifiOperationMode: function setWifiOperationMode(interfaceName, mode, callback) {
+    debug("setWifiOperationMode on " + interfaceName + " to " + mode);
+
+    let params = {
+      cmd: "setWifiOperationMode",
+      ifname: interfaceName,
+      mode: mode
+    };
+
+    params.report = true;
+    params.isAsync = true;
+
+    this.controlMessage(params, function(result) {
+      if (isError(result.resultCode)) {
+        callback.wifiOperationModeResult("netd command error");
+      } else {
+        callback.wifiOperationModeResult(null);
+      }
+    });
+  },
+
   // Helpers
 
   controlMessage: function controlMessage(params, callback) {
diff --git a/dom/system/gonk/net_worker.js b/dom/system/gonk/net_worker.js
index baa0480c66d0..a8d7140d6d13 100644
--- a/dom/system/gonk/net_worker.js
+++ b/dom/system/gonk/net_worker.js
@@ -166,6 +166,18 @@ function updateUpStreamFail(params) {
   return true;
 }
 
+function wifiOperationModeFail(params) {
+  // Notify the main thread.
+  postMessage(params);
+  return true;
+}
+
+function wifiOperationModeSuccess(params) {
+  // Notify the main thread.
+  postMessage(params);
+  return true;
+}
+
 /**
  * Get network interface properties from the system property table.
  *
@@ -801,6 +813,18 @@ function getNetworkInterfaceStats(params) {
   return true;
 }
 
+let gWifiOperationModeChain = [wifiFirmwareReload,
+                               wifiOperationModeSuccess];
+
+/**
+ * handling main thread's reload Wifi firmware request
+ */
+function setWifiOperationMode(params) {
+  debug("setWifiOperationMode: " + params.ifname + " " + params.mode);
+  chain(params, gWifiOperationModeChain, wifiOperationModeFail);
+  return true;
+}
+
 let debug;
 if (DEBUG) {
   debug = function (s) {
diff --git a/dom/system/gonk/nsINetworkManager.idl b/dom/system/gonk/nsINetworkManager.idl
index 18ec203a35b8..b0c80e5660fc 100644
--- a/dom/system/gonk/nsINetworkManager.idl
+++ b/dom/system/gonk/nsINetworkManager.idl
@@ -108,10 +108,23 @@ interface nsINetworkStatsCallback : nsISupports
                              in jsval date);
 };
 
+[scriptable, function, uuid(9ede8720-f8bc-11e2-b778-0800200c9a66)]
+interface nsIWifiOperationModeCallback : nsISupports
+{
+  /**
+   * Callback function used to report result to WifiManager.
+   *
+   * @param error
+   *        An error message if the operation wasn't successful,
+   *        or `null` if it was.
+   */
+  void wifiOperationModeResult(in jsval error);
+};
+
 /**
  * Manage network interfaces.
  */
-[scriptable, uuid(f39a0fb6-2752-47d2-943e-a0cdd3e43494)]
+[scriptable, uuid(5b22c620-f8b9-11e2-b778-0800200c9a66)]
 interface nsINetworkManager : nsISupports
 {
   /**
@@ -208,4 +221,19 @@ interface nsINetworkManager : nsISupports
    */
   void getNetworkInterfaceStats(in DOMString networkName, in nsINetworkStatsCallback callback);
 
+  /**
+   * Reload Wifi firmware to specific operation mode.
+   *
+   * @param interfaceName
+   *        Wifi Network interface name.
+   *
+   * @param mode
+   *        AP  - Access pointer mode.
+   *        P2P - Peer to peer connection mode.
+   *        STA - Station mode.
+   *
+   * @param callback
+   *        Callback to notify Wifi firmware reload result.
+   */
+  void setWifiOperationMode(in DOMString interfaceName, in DOMString mode, in nsIWifiOperationModeCallback callback);
 };
diff --git a/dom/webidl/PushManager.webidl b/dom/webidl/PushManager.webidl
new file mode 100644
index 000000000000..facf3a31c873
--- /dev/null
+++ b/dom/webidl/PushManager.webidl
@@ -0,0 +1,12 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+* License, v. 2.0. If a copy of the MPL was not distributed with this file,
+* You can obtain one at http://mozilla.org/MPL/2.0/.
+*/
+
+[NoInterfaceObject, NavigatorProperty="push", JSImplementation="@mozilla.org/push/PushManager;1", Pref="services.push.enabled"]
+interface PushManager {
+    DOMRequest register();
+    DOMRequest unregister(DOMString pushEndpoint);
+    DOMRequest registrations();
+};
diff --git a/dom/webidl/WebIDL.mk b/dom/webidl/WebIDL.mk
index a784254f8656..46e1f30c7fdb 100644
--- a/dom/webidl/WebIDL.mk
+++ b/dom/webidl/WebIDL.mk
@@ -227,6 +227,7 @@ webidl_files = \
   PositionError.webidl \
   ProcessingInstruction.webidl \
   Promise.webidl \
+  PushManager.webidl \
   Range.webidl \
   Rect.webidl \
   RGBColor.webidl \
diff --git a/dom/wifi/WifiWorker.js b/dom/wifi/WifiWorker.js
index 71b97578b976..2f1d5aed3b1e 100644
--- a/dom/wifi/WifiWorker.js
+++ b/dom/wifi/WifiWorker.js
@@ -1224,36 +1224,46 @@ var WifiManager = (function() {
                                      null);
 
         prepareForStartup(function() {
-          loadDriver(function (status) {
-            if (status < 0) {
+          gNetworkManager.setWifiOperationMode(ifname,
+                                               WIFI_FIRMWARE_STATION,
+                                               function (status) {
+            if (status) {
               callback(status);
               manager.state = "UNINITIALIZED";
               return;
             }
 
-            function doStartSupplicant() {
-              cancelWaitForDriverReadyTimer();
-              startSupplicant(function (status) {
-                if (status < 0) {
-                  unloadDriver(function() {
-                    callback(status);
+            loadDriver(function (status) {
+              if (status < 0) {
+                callback(status);
+                manager.state = "UNINITIALIZED";
+                return;
+              }
+
+              function doStartSupplicant() {
+                cancelWaitForDriverReadyTimer();
+                startSupplicant(function (status) {
+                  if (status < 0) {
+                    unloadDriver(function() {
+                      callback(status);
+                    });
+                    manager.state = "UNINITIALIZED";
+                    return;
+                  }
+
+                  manager.supplicantStarted = true;
+                  enableInterface(ifname, function (ok) {
+                    callback(ok ? 0 : -1);
                   });
-                  manager.state = "UNINITIALIZED";
-                  return;
-                }
-
-                manager.supplicantStarted = true;
-                enableInterface(ifname, function (ok) {
-                  callback(ok ? 0 : -1);
                 });
-              });
-            }
+              }
 
-            // Driver startup on certain platforms takes longer than it takes for us
-            // to return from loadDriver, so wait 2 seconds before starting
-            // the supplicant to give it a chance to start.
-            createWaitForDriverReadyTimer(doStartSupplicant);
-         });
+              // Driver startup on certain platforms takes longer than it takes for us
+              // to return from loadDriver, so wait 2 seconds before starting
+              // the supplicant to give it a chance to start.
+              createWaitForDriverReadyTimer(doStartSupplicant);
+           });
+          });
         });
       });
     } else {
diff --git a/dom/workers/ImageData.cpp b/dom/workers/ImageData.cpp
deleted file mode 100644
index b80f36f652ed..000000000000
--- a/dom/workers/ImageData.cpp
+++ /dev/null
@@ -1,205 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "ImageData.h"
-
-#include "jsfriendapi.h"
-
-#include "nsTraceRefcnt.h"
-
-#define PROPERTY_FLAGS \
-  (JSPROP_ENUMERATE | JSPROP_SHARED)
-
-USING_WORKERS_NAMESPACE
-
-namespace {
-
-class ImageData
-{
-  static JSClass sClass;
-  static const JSPropertySpec sProperties[];
-
-  enum SLOT {
-    SLOT_width = 0,
-    SLOT_height,
-    SLOT_data,
-
-    SLOT_COUNT
-  };
-
-public:
-  static JSObject*
-  InitClass(JSContext* aCx, JSObject* aObj)
-  {
-    return JS_InitClass(aCx, aObj, NULL, &sClass, Construct, 0, sProperties,
-                        NULL, NULL, NULL);
-  }
-
-  static JSObject*
-  Create(JSContext* aCx, uint32_t aWidth,
-         uint32_t aHeight, JS::Handle<JSObject*> aData)
-  {
-    MOZ_ASSERT(aData);
-    MOZ_ASSERT(JS_IsTypedArrayObject(aData));
-    MOZ_ASSERT(JS_IsUint8ClampedArray(aData));
-
-    JSObject* obj = JS_NewObject(aCx, &sClass, NULL, NULL);
-    if (!obj) {
-      return NULL;
-    }
-
-    JS_SetReservedSlot(obj, SLOT_width, UINT_TO_JSVAL(aWidth));
-    JS_SetReservedSlot(obj, SLOT_height, UINT_TO_JSVAL(aHeight));
-    JS_SetReservedSlot(obj, SLOT_data, OBJECT_TO_JSVAL(aData));
-
-    // This is an empty object. The point is just to differentiate instances
-    // from the interface object.
-    ImageData* priv = new ImageData();
-    JS_SetPrivate(obj, priv);
-
-    return obj;
-  }
-
-  static bool
-  IsInstance(JSObject* aObj)
-  {
-    return JS_GetClass(aObj) == &sClass;
-  }
-
-  static uint32_t
-  GetWidth(JSObject* aObj)
-  {
-    MOZ_ASSERT(IsInstance(aObj));
-    return JS_DoubleToUint32(JS_GetReservedSlot(aObj, SLOT_width).toNumber());
-  }
-
-  static uint32_t
-  GetHeight(JSObject* aObj)
-  {
-    MOZ_ASSERT(IsInstance(aObj));
-    return JS_DoubleToUint32(JS_GetReservedSlot(aObj, SLOT_height).toNumber());
-  }
-
-  static
-  JSObject* GetData(JSObject* aObj)
-  {
-    MOZ_ASSERT(IsInstance(aObj));
-    return &JS_GetReservedSlot(aObj, SLOT_data).toObject();
-  }
-
-private:
-  ImageData()
-  {
-    MOZ_COUNT_CTOR(mozilla::dom::workers::ImageData);
-  }
-
-  ~ImageData()
-  {
-    MOZ_COUNT_DTOR(mozilla::dom::workers::ImageData);
-  }
-
-  static JSBool
-  Construct(JSContext* aCx, unsigned aArgc, jsval* aVp)
-  {
-    JS_ReportErrorNumber(aCx, js_GetErrorMessage, NULL, JSMSG_WRONG_CONSTRUCTOR,
-                         sClass.name);
-    return false;
-  }
-
-  static void
-  Finalize(JSFreeOp* aFop, JSObject* aObj)
-  {
-    MOZ_ASSERT(JS_GetClass(aObj) == &sClass);
-    delete static_cast<ImageData*>(JS_GetPrivate(aObj));
-  }
-
-  static JSBool
-  GetProperty(JSContext* aCx, JS::Handle<JSObject*> aObj, JS::Handle<jsid> aIdval,
-              JS::MutableHandle<JS::Value> aVp)
-  {
-    JSClass* classPtr = JS_GetClass(aObj);
-    if (classPtr != &sClass) {
-      JS_ReportErrorNumber(aCx, js_GetErrorMessage, NULL,
-                           JSMSG_INCOMPATIBLE_PROTO, sClass.name, "GetProperty",
-                           classPtr->name);
-      return false;
-    }
-
-    MOZ_ASSERT(JSID_IS_INT(aIdval));
-    MOZ_ASSERT(JSID_TO_INT(aIdval) >= 0 && JSID_TO_INT(aIdval) < SLOT_COUNT);
-
-    aVp.set(JS_GetReservedSlot(aObj, JSID_TO_INT(aIdval)));
-    return true;
-  }
-};
-
-JSClass ImageData::sClass = {
-  "ImageData",
-  JSCLASS_HAS_PRIVATE | JSCLASS_HAS_RESERVED_SLOTS(SLOT_COUNT),
-  JS_PropertyStub, JS_DeletePropertyStub, JS_PropertyStub, JS_StrictPropertyStub,
-  JS_EnumerateStub, JS_ResolveStub, JS_ConvertStub, Finalize
-};
-
-const JSPropertySpec ImageData::sProperties[] = {
-  // These properties are read-only per spec, which means that sets must throw
-  // in strict mode and silently fail otherwise. This is a problem for workers
-  // in general (because js_GetterOnlyPropertyStub throws unconditionally). The
-  // general plan for fixing this involves the new DOM bindings. But Peace
-  // Keeper breaks if we throw when setting these properties, so we need to do
-  // something about it in the mean time. So we use NULL, which defaults to the
-  // class setter (JS_StrictPropertyStub), which is always a silent no-op,
-  // regardless of strict mode. Not ideal, but good enough for now.
-  { "width", SLOT_width, PROPERTY_FLAGS, JSOP_WRAPPER(GetProperty), JSOP_NULLWRAPPER },
-  { "height", SLOT_height, PROPERTY_FLAGS, JSOP_WRAPPER(GetProperty), JSOP_NULLWRAPPER },
-  { "data", SLOT_data, PROPERTY_FLAGS, JSOP_WRAPPER(GetProperty), JSOP_NULLWRAPPER },
-  { 0, 0, 0, JSOP_NULLWRAPPER, JSOP_NULLWRAPPER }
-};
-
-} // anonymous namespace
-
-BEGIN_WORKERS_NAMESPACE
-
-namespace imagedata {
-
-bool
-InitClass(JSContext* aCx, JSObject* aGlobal)
-{
-  return !!ImageData::InitClass(aCx, aGlobal);
-}
-
-JSObject*
-Create(JSContext* aCx, uint32_t aWidth,
-       uint32_t aHeight, JS::Handle<JSObject*> aData)
-{
-  return ImageData::Create(aCx, aWidth, aHeight, aData);
-}
-
-bool
-IsImageData(JSObject* aObj)
-{
-  return ImageData::IsInstance(aObj);
-}
-
-uint32_t
-GetWidth(JSObject* aObj)
-{
-  return ImageData::GetWidth(aObj);
-}
-
-uint32_t
-GetHeight(JSObject* aObj)
-{
-  return ImageData::GetHeight(aObj);
-}
-
-JSObject*
-GetData(JSObject* aObj)
-{
-  return ImageData::GetData(aObj);
-}
-
-
-} // namespace imagedata
-
-END_WORKERS_NAMESPACE
diff --git a/dom/workers/ImageData.h b/dom/workers/ImageData.h
deleted file mode 100644
index fe43e13f613a..000000000000
--- a/dom/workers/ImageData.h
+++ /dev/null
@@ -1,42 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef mozilla_dom_workers_imagedata_h__
-#define mozilla_dom_workers_imagedata_h__
-
-#include "Workers.h"
-
-BEGIN_WORKERS_NAMESPACE
-
-namespace imagedata {
-
-bool
-InitClass(JSContext* aCx, JSObject* aGlobal);
-
-JSObject*
-Create(JSContext* aCx, uint32_t aWidth,
-       uint32_t aHeight, JS::Handle<JSObject*> aData);
-
-/*
- * All data members live in private slots on the JS Object. Callers must
- * first check IsImageData, after which they may call the data accessors.
- */
-
-bool
-IsImageData(JSObject* aObj);
-
-uint32_t
-GetWidth(JSObject* aObj);
-
-uint32_t
-GetHeight(JSObject* aObj);
-
-JSObject*
-GetData(JSObject* aObj);
-
-} // namespace imagedata
-
-END_WORKERS_NAMESPACE
-
-#endif // mozilla_dom_workers_imagedata_h__
diff --git a/dom/workers/RuntimeService.cpp b/dom/workers/RuntimeService.cpp
index c5330e892869..8a63f67a3865 100644
--- a/dom/workers/RuntimeService.cpp
+++ b/dom/workers/RuntimeService.cpp
@@ -21,6 +21,7 @@
 #include "GeckoProfiler.h"
 #include "jsdbgapi.h"
 #include "jsfriendapi.h"
+#include "mozilla/CycleCollectedJSRuntime.h"
 #include "mozilla/dom/BindingUtils.h"
 #include "mozilla/dom/EventTargetBinding.h"
 #include "mozilla/DebugOnly.h"
@@ -28,6 +29,7 @@
 #include "mozilla/Util.h"
 #include <Navigator.h>
 #include "nsContentUtils.h"
+#include "nsCycleCollector.h"
 #include "nsDOMJSUtils.h"
 #include "nsLayoutStatics.h"
 #include "nsNetUtil.h"
@@ -748,20 +750,11 @@ CTypesActivityCallback(JSContext* aCx,
 }
 
 JSContext*
-CreateJSContextForWorker(WorkerPrivate* aWorkerPrivate)
+CreateJSContextForWorker(WorkerPrivate* aWorkerPrivate, JSRuntime* aRuntime)
 {
   aWorkerPrivate->AssertIsOnWorkerThread();
   NS_ASSERTION(!aWorkerPrivate->GetJSContext(), "Already has a context!");
 
-  // The number passed here doesn't matter, we're about to change it in the call
-  // to JS_SetGCParameter.
-  JSRuntime* runtime =
-    JS_NewRuntime(WORKER_DEFAULT_RUNTIME_HEAPSIZE, JS_NO_HELPER_THREADS);
-  if (!runtime) {
-    NS_WARNING("Could not create new runtime!");
-    return nullptr;
-  }
-
   JSSettings settings;
   aWorkerPrivate->CopyJSSettings(settings);
 
@@ -779,45 +772,44 @@ CreateJSContextForWorker(WorkerPrivate* aWorkerPrivate)
     const JSSettings::JSGCSetting& setting = gcSettings[index];
     if (setting.IsSet()) {
       NS_ASSERTION(setting.value, "Can't handle 0 values!");
-      JS_SetGCParameter(runtime, setting.key, setting.value);
+      JS_SetGCParameter(aRuntime, setting.key, setting.value);
     }
   }
 
-  JS_SetNativeStackQuota(runtime, WORKER_CONTEXT_NATIVE_STACK_LIMIT);
+  JS_SetNativeStackQuota(aRuntime, WORKER_CONTEXT_NATIVE_STACK_LIMIT);
 
   // Security policy:
   static JSSecurityCallbacks securityCallbacks = {
     NULL,
     ContentSecurityPolicyAllows
   };
-  JS_SetSecurityCallbacks(runtime, &securityCallbacks);
+  JS_SetSecurityCallbacks(aRuntime, &securityCallbacks);
 
   // DOM helpers:
   static js::DOMCallbacks DOMCallbacks = {
     InstanceClassHasProtoAtDepth
   };
-  SetDOMCallbacks(runtime, &DOMCallbacks);
+  SetDOMCallbacks(aRuntime, &DOMCallbacks);
 
-  JSContext* workerCx = JS_NewContext(runtime, 0);
+  JSContext* workerCx = JS_NewContext(aRuntime, 0);
   if (!workerCx) {
-    JS_DestroyRuntime(runtime);
     NS_WARNING("Could not create new context!");
     return nullptr;
   }
 
-  JS_SetRuntimePrivate(runtime, aWorkerPrivate);
+  JS_SetRuntimePrivate(aRuntime, aWorkerPrivate);
 
   JS_SetErrorReporter(workerCx, ErrorReporter);
 
   JS_SetOperationCallback(workerCx, OperationCallback);
 
-  js::SetCTypesActivityCallback(runtime, CTypesActivityCallback);
+  js::SetCTypesActivityCallback(aRuntime, CTypesActivityCallback);
 
   JS_SetOptions(workerCx,
                 aWorkerPrivate->IsChromeWorker() ? settings.chrome.options :
                                                    settings.content.options);
 
-  JS_SetJitHardening(runtime, settings.jitHardening);
+  JS_SetJitHardening(aRuntime, settings.jitHardening);
 
 #ifdef JS_GC_ZEAL
   JS_SetGCZeal(workerCx, settings.gcZeal, settings.gcZealFrequency);
@@ -826,6 +818,58 @@ CreateJSContextForWorker(WorkerPrivate* aWorkerPrivate)
   return workerCx;
 }
 
+class WorkerJSRuntime : public mozilla::CycleCollectedJSRuntime
+{
+public:
+  // The heap size passed here doesn't matter, we will change it later in the
+  // call to JS_SetGCParameter inside CreateJSContextForWorker.
+  WorkerJSRuntime(WorkerPrivate* aWorkerPrivate)
+  : CycleCollectedJSRuntime(WORKER_DEFAULT_RUNTIME_HEAPSIZE,
+                            JS_NO_HELPER_THREADS,
+                            false)
+  {
+    // We need to ensure that a JSContext outlives the cycle collector, and
+    // that the internal JSContext created by ctypes is not the last JSContext
+    // to die.  So we create an unused JSContext here and destroy it after
+    // the cycle collector shuts down.  Thus all cycles will be broken before
+    // the last GC and all finalizers will be run.
+    mLastJSContext = JS_NewContext(Runtime(), 0);
+    MOZ_ASSERT(mLastJSContext);
+  }
+
+  ~WorkerJSRuntime()
+  {
+    // All JSContexts except mLastJSContext should be destroyed now.  The
+    // worker global will be unrooted and the shutdown cycle collection
+    // should break all remaining cycles.  Destroying mLastJSContext will run
+    // the GC the final time and finalize any JSObjects that were participating
+    // in cycles that were broken during CC shutdown.
+    nsCycleCollector_shutdownThreads();
+    nsCycleCollector_shutdown();
+    JS_DestroyContext(mLastJSContext);
+    mLastJSContext = nullptr;
+  }
+
+  // Make this public for now.  Ideally we'd hide the JSRuntime inside.
+  JSRuntime*
+  Runtime() const
+  {
+    return mozilla::CycleCollectedJSRuntime::Runtime();
+  }
+
+  void
+  DispatchDeferredDeletion(bool aContinuation) MOZ_OVERRIDE
+  {
+    MOZ_ASSERT(!aContinuation);
+
+    // Do it immediately, no need for asynchronous behavior here.
+    nsCycleCollector_doDeferredDeletion();
+  }
+
+private:
+  JSContext* mLastJSContext;
+};
+
 class WorkerThreadRunnable : public nsRunnable
 {
   WorkerPrivate* mWorkerPrivate;
@@ -845,50 +889,45 @@ public:
 
     workerPrivate->AssertIsOnWorkerThread();
 
-    JSContext* cx = CreateJSContextForWorker(workerPrivate);
-    if (!cx) {
-      // XXX need to fire an error at parent.
-      NS_ERROR("Failed to create runtime and context!");
-      return NS_ERROR_FAILURE;
-    }
-
-    JSRuntime* rt = JS_GetRuntime(cx);
-
-    char aLocal;
-    profiler_register_thread("WebWorker", &aLocal);
-#ifdef MOZ_ENABLE_PROFILER_SPS
-    if (PseudoStack* stack = mozilla_get_pseudo_stack())
-      stack->sampleRuntime(rt);
-#endif
-
     {
-      JSAutoRequest ar(cx);
-      workerPrivate->DoRunLoop(cx);
-    }
+      nsCycleCollector_startup(CCSingleThread);
 
-    // XXX Bug 666963 - CTypes can create another JSContext for use with
-    // closures, and then it holds that context in a reserved slot on the CType
-    // prototype object. We have to destroy that context before we can destroy
-    // the runtime, and we also have to make sure that it isn't the last context
-    // to be destroyed (otherwise it will assert). To accomplish this we create
-    // an unused dummy context, destroy our real context, and then destroy the
-    // dummy. Once this bug is resolved we can remove this nastiness and simply
-    // call JS_DestroyContextNoGC on our context.
-    JSContext* dummyCx = JS_NewContext(rt, 0);
-    if (dummyCx) {
-      JS_DestroyContext(cx);
-      JS_DestroyContext(dummyCx);
-    }
-    else {
-      NS_WARNING("Failed to create dummy context!");
+      WorkerJSRuntime runtime(workerPrivate);
+      JSRuntime* rt = runtime.Runtime();
+      JSContext* cx = CreateJSContextForWorker(workerPrivate, rt);
+      if (!cx) {
+        // XXX need to fire an error at parent.
+        NS_ERROR("Failed to create runtime and context!");
+        return NS_ERROR_FAILURE;
+      }
+
+      char aLocal;
+      profiler_register_thread("WebWorker", &aLocal);
+  #ifdef MOZ_ENABLE_PROFILER_SPS
+      if (PseudoStack* stack = mozilla_get_pseudo_stack())
+        stack->sampleRuntime(rt);
+  #endif
+
+      {
+        JSAutoRequest ar(cx);
+        workerPrivate->DoRunLoop(cx);
+      }
+
+      // Destroy the main context.  This will unroot the main worker global and
+      // GC.  This is not the last JSContext (WorkerJSRuntime maintains an
+      // internal JSContext).
       JS_DestroyContext(cx);
+
+      // Now WorkerJSRuntime goes out of scope and its destructor will shut
+      // down the cycle collector and destroy the final JSContext.  This
+      // breaks any remaining cycles and collects the C++ and JS objects
+      // participating.
     }
 
 #ifdef MOZ_ENABLE_PROFILER_SPS
     if (PseudoStack* stack = mozilla_get_pseudo_stack())
       stack->sampleRuntime(nullptr);
 #endif
-    JS_DestroyRuntime(rt);
 
     workerPrivate->ScheduleDeletion(false);
     profiler_unregister_thread();
diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index 20af98ca507a..fcd81e311368 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -36,6 +36,9 @@
 #include "js/MemoryMetrics.h"
 #include "mozilla/Attributes.h"
 #include "mozilla/Likely.h"
+#include "mozilla/dom/BindingUtils.h"
+#include "mozilla/dom/ImageData.h"
+#include "mozilla/dom/ImageDataBinding.h"
 #include "nsAlgorithm.h"
 #include "nsContentUtils.h"
 #include "nsCxPusher.h"
@@ -57,7 +60,6 @@
 #include "Events.h"
 #include "Exceptions.h"
 #include "File.h"
-#include "ImageData.h"
 #include "Principal.h"
 #include "RuntimeService.h"
 #include "ScriptLoader.h"
@@ -204,9 +206,14 @@ struct WorkerStructuredCloneCallbacks
       MOZ_ASSERT(dataArray.isObject());
 
       // Construct the ImageData.
-      JS::Rooted<JSObject*> dataObj(aCx, &dataArray.toObject());
-      JSObject* obj = imagedata::Create(aCx, width, height, dataObj);
-      return obj;
+      nsRefPtr<ImageData> imageData = new ImageData(width, height,
+                                                    dataArray.toObject());
+      // Wrap it in a JS::Value.
+      JS::Rooted<JSObject*> global(aCx, JS::CurrentGlobalOrNull(aCx));
+      if (!global) {
+        return nullptr;
+      }
+      return imageData->WrapObject(aCx, global);
     }
 
     Error(aCx, 0);
@@ -250,16 +257,20 @@ struct WorkerStructuredCloneCallbacks
     }
 
     // See if this is an ImageData object.
-    if (imagedata::IsImageData(aObj)) {
-      // Pull the properties off the object.
-      uint32_t width = imagedata::GetWidth(aObj);
-      uint32_t height = imagedata::GetHeight(aObj);
-      JSObject* data = imagedata::GetData(aObj);
+    {
+      ImageData* imageData = nullptr;
+      if (NS_SUCCEEDED(UnwrapObject<ImageData>(aCx, aObj, imageData))) {
+        // Prepare the ImageData internals.
+        uint32_t width = imageData->Width();
+        uint32_t height = imageData->Height();
+        JS::Rooted<JSObject*> dataArray(aCx, imageData->GetDataObject());
 
-      // Write the structured clone.
-      return JS_WriteUint32Pair(aWriter, SCTAG_DOM_IMAGEDATA, 0) &&
-             JS_WriteUint32Pair(aWriter, width, height) &&
-             JS_WriteTypedArray(aWriter, OBJECT_TO_JSVAL(data));
+        // Write the internals to the stream.
+        JSAutoCompartment ac(aCx, dataArray);
+        return JS_WriteUint32Pair(aWriter, SCTAG_DOM_IMAGEDATA, 0) &&
+               JS_WriteUint32Pair(aWriter, width, height) &&
+               JS_WriteTypedArray(aWriter, JS::ObjectValue(*dataArray));
+      }
     }
 
     Error(aCx, 0);
diff --git a/dom/workers/WorkerScope.cpp b/dom/workers/WorkerScope.cpp
index ee7b30bb1ffa..9a9aef26dc31 100644
--- a/dom/workers/WorkerScope.cpp
+++ b/dom/workers/WorkerScope.cpp
@@ -13,6 +13,8 @@
 #include "mozilla/dom/EventTargetBinding.h"
 #include "mozilla/dom/BindingUtils.h"
 #include "mozilla/dom/FileReaderSyncBinding.h"
+#include "mozilla/dom/ImageData.h"
+#include "mozilla/dom/ImageDataBinding.h"
 #include "mozilla/dom/TextDecoderBinding.h"
 #include "mozilla/dom/TextEncoderBinding.h"
 #include "mozilla/dom/XMLHttpRequestBinding.h"
@@ -36,7 +38,6 @@
 #include "File.h"
 #include "FileReaderSync.h"
 #include "Location.h"
-#include "ImageData.h"
 #include "Navigator.h"
 #include "Principal.h"
 #include "ScriptLoader.h"
@@ -1012,13 +1013,13 @@ CreateDedicatedWorkerGlobalScope(JSContext* aCx)
   // Init other classes we care about.
   if (!events::InitClasses(aCx, global, false) ||
       !file::InitClasses(aCx, global) ||
-      !exceptions::InitClasses(aCx, global) ||
-      !imagedata::InitClass(aCx, global)) {
+      !exceptions::InitClasses(aCx, global)) {
     return NULL;
   }
 
   // Init other paris-bindings.
   if (!FileReaderSyncBinding_workers::GetConstructorObject(aCx, global) ||
+      !ImageDataBinding::GetConstructorObject(aCx, global) ||
       !TextDecoderBinding_workers::GetConstructorObject(aCx, global) ||
       !TextEncoderBinding_workers::GetConstructorObject(aCx, global) ||
       !XMLHttpRequestBinding_workers::GetConstructorObject(aCx, global) ||
diff --git a/dom/workers/moz.build b/dom/workers/moz.build
index b2718fd6f31a..c5834d722a9c 100644
--- a/dom/workers/moz.build
+++ b/dom/workers/moz.build
@@ -39,7 +39,6 @@ CPP_SOURCES += [
     'Exceptions.cpp',
     'File.cpp',
     'FileReaderSync.cpp',
-    'ImageData.cpp',
     'Location.cpp',
     'Navigator.cpp',
     'Principal.cpp',
diff --git a/gfx/2d/DrawTargetSkia.cpp b/gfx/2d/DrawTargetSkia.cpp
index 6f2ce54359e6..37865dccfac7 100644
--- a/gfx/2d/DrawTargetSkia.cpp
+++ b/gfx/2d/DrawTargetSkia.cpp
@@ -76,6 +76,7 @@ public:
 };
 
 DrawTargetSkia::DrawTargetSkia()
+  : mSnapshot(nullptr)
 {
 #ifdef ANDROID
   mSoftClipping = false;
@@ -86,19 +87,20 @@ DrawTargetSkia::DrawTargetSkia()
 
 DrawTargetSkia::~DrawTargetSkia()
 {
-  MOZ_ASSERT(mSnapshots.size() == 0);
 }
 
 TemporaryRef<SourceSurface>
 DrawTargetSkia::Snapshot()
 {
-  RefPtr<SourceSurfaceSkia> source = new SourceSurfaceSkia();
+  RefPtr<SourceSurfaceSkia> snapshot = mSnapshot;
+  if (!snapshot) {
+    snapshot = new SourceSurfaceSkia();
+    mSnapshot = snapshot;
+    if (!snapshot->InitFromCanvas(mCanvas.get(), mFormat, this))
+      return nullptr;
+  }
 
-  if (!source->InitFromCanvas(mCanvas.get(), mFormat, this))
-    return nullptr;
-
-  AppendSnapshot(source);
-  return source;
+  return snapshot;
 }
 
 void SetPaintPattern(SkPaint& aPaint, const Pattern& aPattern, Float aAlpha = 1.0)
@@ -772,33 +774,20 @@ DrawTargetSkia::CreateGradientStops(GradientStop *aStops, uint32_t aNumStops, Ex
   return new GradientStopsSkia(stops, aNumStops, aExtendMode);
 }
 
-void
-DrawTargetSkia::AppendSnapshot(SourceSurfaceSkia* aSnapshot)
-{
-  mSnapshots.push_back(aSnapshot);
-}
-
-void
-DrawTargetSkia::RemoveSnapshot(SourceSurfaceSkia* aSnapshot)
-{
-  std::vector<SourceSurfaceSkia*>::iterator iter = std::find(mSnapshots.begin(), mSnapshots.end(), aSnapshot);
-  if (iter != mSnapshots.end()) {
-    mSnapshots.erase(iter);
-  }
-}
-
 void
 DrawTargetSkia::MarkChanged()
 {
-  if (mSnapshots.size()) {
-    for (std::vector<SourceSurfaceSkia*>::iterator iter = mSnapshots.begin();
-         iter != mSnapshots.end(); iter++) {
-      (*iter)->DrawTargetWillChange();
-    }
-    // All snapshots will now have copied data.
-    mSnapshots.clear();
+  if (mSnapshot) {
+    mSnapshot->DrawTargetWillChange();
+    mSnapshot = nullptr;
   }
 }
 
+void
+DrawTargetSkia::SnapshotDestroyed()
+{
+  mSnapshot = nullptr;
+}
+
 }
 }
diff --git a/gfx/2d/DrawTargetSkia.h b/gfx/2d/DrawTargetSkia.h
index 41fd4a90cad0..5bb50d53acaa 100644
--- a/gfx/2d/DrawTargetSkia.h
+++ b/gfx/2d/DrawTargetSkia.h
@@ -114,8 +114,7 @@ public:
 
 private:
   friend class SourceSurfaceSkia;
-  void AppendSnapshot(SourceSurfaceSkia* aSnapshot);
-  void RemoveSnapshot(SourceSurfaceSkia* aSnapshot);
+  void SnapshotDestroyed();
 
   void MarkChanged();
 
@@ -133,7 +132,7 @@ private:
 
   IntSize mSize;
   SkRefPtr<SkCanvas> mCanvas;
-  std::vector<SourceSurfaceSkia*> mSnapshots;
+  SourceSurfaceSkia* mSnapshot;
   bool mSoftClipping;
 };
 
diff --git a/gfx/2d/SourceSurfaceSkia.cpp b/gfx/2d/SourceSurfaceSkia.cpp
index d1767a4e2eb7..c3302f0862ab 100644
--- a/gfx/2d/SourceSurfaceSkia.cpp
+++ b/gfx/2d/SourceSurfaceSkia.cpp
@@ -22,7 +22,10 @@ SourceSurfaceSkia::SourceSurfaceSkia()
 SourceSurfaceSkia::~SourceSurfaceSkia()
 {
   MaybeUnlock();
-  MarkIndependent();
+  if (mDrawTarget) {
+    mDrawTarget->SnapshotDestroyed();
+    mDrawTarget = nullptr;
+  }
 }
 
 IntSize
@@ -108,15 +111,6 @@ SourceSurfaceSkia::DrawTargetWillChange()
   }
 }
 
-void
-SourceSurfaceSkia::MarkIndependent()
-{
-  if (mDrawTarget) {
-    mDrawTarget->RemoveSnapshot(this);
-    mDrawTarget = nullptr;
-  }
-}
-
 void
 SourceSurfaceSkia::MaybeUnlock()
 {
diff --git a/gfx/2d/SourceSurfaceSkia.h b/gfx/2d/SourceSurfaceSkia.h
index eab7b0f77d51..c98c003e196c 100644
--- a/gfx/2d/SourceSurfaceSkia.h
+++ b/gfx/2d/SourceSurfaceSkia.h
@@ -45,8 +45,6 @@ private:
   friend class DrawTargetSkia;
 
   void DrawTargetWillChange();
-  void DrawTargetDestroyed();
-  void MarkIndependent();
   void MaybeUnlock();
 
   SkBitmap mBitmap;
diff --git a/gfx/gl/GLContext.cpp b/gfx/gl/GLContext.cpp
index 0d1eee604ae8..6e1e80af57e3 100644
--- a/gfx/gl/GLContext.cpp
+++ b/gfx/gl/GLContext.cpp
@@ -15,6 +15,7 @@
 #include "GLContextProvider.h"
 #include "GLTextureImage.h"
 #include "nsIMemoryReporter.h"
+#include "nsPrintfCString.h"
 #include "nsThreadUtils.h"
 #include "prenv.h"
 #include "prlink.h"
@@ -469,8 +470,7 @@ GLContext::InitWithPrefix(const char *prefix, bool trygl)
         }
 
         // Check for aux symbols based on extensions
-        if (IsExtensionSupported(GLContext::ANGLE_framebuffer_blit) ||
-            IsExtensionSupported(GLContext::EXT_framebuffer_blit))
+        if (IsExtensionSupported(XXX_framebuffer_blit))
         {
             SymLoadStruct auxSymbols[] = {
                 {
@@ -487,15 +487,13 @@ GLContext::InitWithPrefix(const char *prefix, bool trygl)
             if (!LoadSymbols(&auxSymbols[0], trygl, prefix)) {
                 NS_ERROR("GL supports framebuffer_blit without supplying glBlitFramebuffer");
 
-                MarkExtensionUnsupported(ANGLE_framebuffer_blit);
-                MarkExtensionUnsupported(EXT_framebuffer_blit);
+                MarkExtensionGroupUnsupported(XXX_framebuffer_blit);
                 mSymbols.fBlitFramebuffer = nullptr;
             }
         }
 
-        if (SupportsFramebufferMultisample())
+        if (IsExtensionSupported(XXX_framebuffer_multisample))
         {
-            MOZ_ASSERT(SupportsSplitFramebuffer());
             SymLoadStruct auxSymbols[] = {
                 {
                     (PRFuncPtr*) &mSymbols.fRenderbufferStorageMultisample,
@@ -511,8 +509,7 @@ GLContext::InitWithPrefix(const char *prefix, bool trygl)
             if (!LoadSymbols(&auxSymbols[0], trygl, prefix)) {
                 NS_ERROR("GL supports framebuffer_multisample without supplying glRenderbufferStorageMultisample");
 
-                MarkExtensionUnsupported(ANGLE_framebuffer_multisample);
-                MarkExtensionUnsupported(EXT_framebuffer_multisample);
+                MarkExtensionGroupUnsupported(XXX_framebuffer_multisample);
                 mSymbols.fRenderbufferStorageMultisample = nullptr;
             }
         }
@@ -572,9 +569,7 @@ GLContext::InitWithPrefix(const char *prefix, bool trygl)
             if (!LoadSymbols(&vaoSymbols[0], trygl, prefix)) {
                 NS_ERROR("GL supports Vertex Array Object without supplying its functions.");
 
-                MarkExtensionUnsupported(ARB_vertex_array_object);
-                MarkExtensionUnsupported(OES_vertex_array_object);
-                MarkExtensionUnsupported(APPLE_vertex_array_object);
+                MarkExtensionGroupUnsupported(XXX_vertex_array_object);
                 mSymbols.fIsVertexArray = nullptr;
                 mSymbols.fGenVertexArrays = nullptr;
                 mSymbols.fBindVertexArray = nullptr;
@@ -597,7 +592,7 @@ GLContext::InitWithPrefix(const char *prefix, bool trygl)
             if (!LoadSymbols(&vaoSymbols[0], trygl, prefix)) {
                 NS_ERROR("GL supports Vertex Array Object without supplying its functions.");
 
-                MarkExtensionUnsupported(APPLE_vertex_array_object);
+                MarkExtensionGroupUnsupported(XXX_vertex_array_object);
                 mSymbols.fIsVertexArray = nullptr;
                 mSymbols.fGenVertexArrays = nullptr;
                 mSymbols.fBindVertexArray = nullptr;
@@ -631,10 +626,7 @@ GLContext::InitWithPrefix(const char *prefix, bool trygl)
             if (!LoadSymbols(drawInstancedSymbols, trygl, prefix)) {
                 NS_ERROR("GL supports instanced draws without supplying its functions.");
 
-                MarkExtensionUnsupported(ARB_draw_instanced);
-                MarkExtensionUnsupported(EXT_draw_instanced);
-                MarkExtensionUnsupported(NV_draw_instanced);
-                MarkExtensionUnsupported(ANGLE_instanced_array);
+                MarkExtensionGroupUnsupported(XXX_draw_instanced);
                 mSymbols.fDrawArraysInstanced = nullptr;
                 mSymbols.fDrawElementsInstanced = nullptr;
             }
@@ -705,7 +697,7 @@ GLContext::InitWithPrefix(const char *prefix, bool trygl)
         mMaxTextureImageSize = mMaxTextureSize;
 
         mMaxSamples = 0;
-        if (SupportsFramebufferMultisample()) {
+        if (IsExtensionSupported(XXX_framebuffer_multisample)) {
             fGetIntegerv(LOCAL_GL_MAX_SAMPLES, (GLint*)&mMaxSamples);
         }
 
@@ -731,6 +723,8 @@ GLContext::InitWithPrefix(const char *prefix, bool trygl)
         NS_WARNING("InitWithPrefix failed!");
     }
 
+    mVersionString = nsPrintfCString("%u.%u.%u", mVersion / 100, (mVersion / 10) % 10, mVersion % 10);
+
     return mInitialized;
 }
 
diff --git a/gfx/gl/GLContext.h b/gfx/gl/GLContext.h
index 9431108942db..c803c14720b7 100644
--- a/gfx/gl/GLContext.h
+++ b/gfx/gl/GLContext.h
@@ -197,6 +197,13 @@ public:
         return "OpenGL unknown profile";
     }
 
+    /**
+     * Return true if we are running on a OpenGL core profile context
+     */
+    const char* ProfileString() const {
+        return GetProfileName(mProfile);
+    }
+
     /**
      * Return true if the context is compatible with given parameters
      *
@@ -228,6 +235,10 @@ public:
         return mVersion;
     }
 
+    const char* VersionString() const {
+        return mVersionString.get();
+    }
+
     int Vendor() const {
         return mVendor;
     }
@@ -283,6 +294,7 @@ protected:
      * the context is an OpenGL 2.1 context, mVersion value will be 210.
      */
     unsigned int mVersion;
+    nsCString mVersionString;
     ContextProfile mProfile;
 
     int32_t mVendor;
@@ -369,7 +381,8 @@ public:
         EXT_draw_instanced,
         NV_draw_instanced,
         ANGLE_instanced_array,
-        Extensions_Max
+        Extensions_Max,
+        Extensions_End
     };
 
     bool IsExtensionSupported(GLExtensions aKnownExtension) const {
@@ -460,86 +473,33 @@ public:
     /**
      * This enum should be sorted by name.
      */
-    enum GLExtensionPackages {
+    enum GLExtensionGroup {
         XXX_draw_buffers,
         XXX_draw_instanced,
         XXX_framebuffer_blit,
         XXX_framebuffer_multisample,
         XXX_framebuffer_object,
+        XXX_robustness,
         XXX_texture_float,
         XXX_texture_non_power_of_two,
-        XXX_robustness,
         XXX_vertex_array_object,
-        ExtensionPackages_Max
+        ExtensionGroup_Max
     };
 
-    bool IsExtensionSupported(GLExtensionPackages aKnownExtensionPackage) const
-    {
-        switch (aKnownExtensionPackage)
-        {
-            case XXX_draw_buffers:
-                return IsExtensionSupported(ARB_draw_buffers) ||
-                       IsExtensionSupported(EXT_draw_buffers);
+    bool IsExtensionSupported(GLExtensionGroup extensionGroup) const;
 
-            case XXX_draw_instanced:
-                return IsExtensionSupported(ARB_draw_instanced) ||
-                       IsExtensionSupported(EXT_draw_instanced) ||
-                       IsExtensionSupported(NV_draw_instanced) ||
-                       IsExtensionSupported(ANGLE_instanced_array);
-
-            case XXX_framebuffer_blit:
-                return IsExtensionSupported(EXT_framebuffer_blit) ||
-                       IsExtensionSupported(ANGLE_framebuffer_blit);
-
-            case XXX_framebuffer_multisample:
-                return IsExtensionSupported(EXT_framebuffer_multisample) ||
-                       IsExtensionSupported(ANGLE_framebuffer_multisample);
-
-            case XXX_framebuffer_object:
-                return IsExtensionSupported(ARB_framebuffer_object) ||
-                       IsExtensionSupported(EXT_framebuffer_object);
-
-            case XXX_texture_float:
-                return IsExtensionSupported(ARB_texture_float) ||
-                       IsExtensionSupported(OES_texture_float);
-
-            case XXX_robustness:
-                return IsExtensionSupported(ARB_robustness) ||
-                       IsExtensionSupported(EXT_robustness);
-
-            case XXX_texture_non_power_of_two:
-                return IsExtensionSupported(ARB_texture_non_power_of_two) ||
-                       IsExtensionSupported(OES_texture_npot);
-
-            case XXX_vertex_array_object:
-                return IsExtensionSupported(ARB_vertex_array_object) ||
-                       IsExtensionSupported(OES_vertex_array_object) ||
-                       IsExtensionSupported(APPLE_vertex_array_object);
-
-            default:
-                break;
-        }
-
-        MOZ_ASSERT(false, "GLContext::IsExtensionSupported : unknown <aKnownExtensionPackage>");
-        return false;
-    }
+    static const char* GetExtensionGroupName(GLExtensionGroup extensionGroup);
 
 
-// -----------------------------------------------------------------------------
-// Deprecated extension group queries (use XXX_* instead)
-public:
+private:
 
-    bool SupportsFramebufferMultisample() const {
-        return IsExtensionSupported(XXX_framebuffer_multisample);
-    }
-
-    bool HasExt_FramebufferBlit() const {
-        return IsExtensionSupported(XXX_framebuffer_blit);
-    }
-
-    bool SupportsSplitFramebuffer() const {
-        return IsExtensionSupported(XXX_framebuffer_blit);
-    }
+    /**
+     * Mark all extensions of this group as unsupported.
+     *
+     * Returns false if marking this extension group as unsupported contradicts
+     * the OpenGL version and profile. Returns true otherwise.
+     */
+    bool MarkExtensionGroupUnsupported(GLExtensionGroup extensionGroup);
 
 
 // -----------------------------------------------------------------------------
@@ -565,8 +525,7 @@ private:
 // Error handling
 public:
 
-    // TODO: this function should be a static
-    const char* GLErrorToString(GLenum aError) const
+    static const char* GLErrorToString(GLenum aError)
     {
         switch (aError) {
             case LOCAL_GL_INVALID_ENUM:
@@ -2592,8 +2551,9 @@ public:
         if (mScreen)
             return mScreen->GetReadFB();
 
-        GLenum bindEnum = SupportsSplitFramebuffer() ? LOCAL_GL_READ_FRAMEBUFFER_BINDING_EXT
-                                                     : LOCAL_GL_FRAMEBUFFER_BINDING;
+        GLenum bindEnum = IsExtensionSupported(XXX_framebuffer_blit)
+                            ? LOCAL_GL_READ_FRAMEBUFFER_BINDING_EXT
+                            : LOCAL_GL_FRAMEBUFFER_BINDING;
 
         GLuint ret = 0;
         GetUIntegerv(bindEnum, &ret);
diff --git a/gfx/gl/GLContextExtensionGroupQueries.cpp b/gfx/gl/GLContextExtensionGroupQueries.cpp
new file mode 100644
index 000000000000..e705da65683e
--- /dev/null
+++ b/gfx/gl/GLContextExtensionGroupQueries.cpp
@@ -0,0 +1,220 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+
+#include "GLContext.h"
+#include "nsPrintfCString.h"
+
+namespace mozilla {
+namespace gl {
+
+const size_t kMAX_EXTENSION_GROUP_SIZE = 5;
+
+struct ExtensionGroupInfo
+{
+    const char* mName;
+    unsigned int mOpenGLVersion;
+    unsigned int mOpenGLESVersion;
+    GLContext::GLExtensions mExtensions[kMAX_EXTENSION_GROUP_SIZE];
+};
+
+static const ExtensionGroupInfo sExtensionGroupInfoArr[] = {
+    {
+        "XXX_draw_buffers",
+        200, // OpenGL version
+        300, // OpenGL ES version
+        {
+            GLContext::ARB_draw_buffers,
+            GLContext::EXT_draw_buffers,
+            GLContext::Extensions_End
+        }
+    },
+    {
+        "XXX_draw_instanced",
+        310, // OpenGL version
+        300, // OpenGL ES version
+        {
+            GLContext::ARB_draw_instanced,
+            GLContext::EXT_draw_instanced,
+            GLContext::NV_draw_instanced,
+            GLContext::ANGLE_instanced_array,
+            GLContext::Extensions_End
+        }
+    },
+    {
+        "XXX_framebuffer_blit",
+        300, // OpenGL version
+        300, // OpenGL ES version
+        {
+            GLContext::EXT_framebuffer_blit,
+            GLContext::ANGLE_framebuffer_blit,
+            GLContext::Extensions_End
+        }
+    },
+    {
+        "XXX_framebuffer_multisample",
+        300, // OpenGL version
+        300, // OpenGL ES version
+        {
+            GLContext::EXT_framebuffer_multisample,
+            GLContext::ANGLE_framebuffer_multisample,
+            GLContext::Extensions_End
+        }
+    },
+    {
+        "XXX_framebuffer_object",
+        300, // OpenGL version
+        200, // OpenGL ES version
+        {
+            GLContext::ARB_framebuffer_object,
+            GLContext::EXT_framebuffer_object,
+            GLContext::Extensions_End
+        }
+    },
+    {
+        "XXX_robustness",
+        0,   // OpenGL version
+        0,   // OpenGL ES version
+        {
+            GLContext::ARB_robustness,
+            GLContext::EXT_robustness,
+            GLContext::Extensions_End
+        }
+    },
+    {
+        "XXX_texture_float",
+        310, // OpenGL version
+        300, // OpenGL ES version
+        {
+            GLContext::ARB_texture_float,
+            GLContext::OES_texture_float,
+            GLContext::Extensions_End
+        }
+    },
+    {
+        "XXX_texture_non_power_of_two",
+        200, // OpenGL version
+        300, // OpenGL ES version
+        {
+            GLContext::ARB_texture_non_power_of_two,
+            GLContext::OES_texture_npot,
+            GLContext::Extensions_End
+        }
+    },
+    {
+        "XXX_vertex_array_object",
+        300, // OpenGL version
+        300, // OpenGL ES version
+        {
+            GLContext::ARB_vertex_array_object,
+            GLContext::OES_vertex_array_object,
+            GLContext::APPLE_vertex_array_object,
+            GLContext::Extensions_End
+        }
+    }
+};
+
+static inline const ExtensionGroupInfo&
+GetExtensionGroupInfo(GLContext::GLExtensionGroup extensionGroup)
+{
+    static_assert(MOZ_ARRAY_LENGTH(sExtensionGroupInfoArr) == size_t(GLContext::ExtensionGroup_Max),
+                  "Mismatched lengths for sExtensionGroupInfos and ExtensionGroup enums");
+
+    MOZ_ASSERT(extensionGroup < GLContext::ExtensionGroup_Max,
+               "GLContext::GetExtensionGroupInfo : unknown <extensionGroup>");
+
+    return sExtensionGroupInfoArr[extensionGroup];
+}
+
+static inline uint32_t
+ProfileVersionForExtensionGroup(GLContext::GLExtensionGroup extensionGroup, ContextProfile profile)
+{
+    MOZ_ASSERT(profile != ContextProfile::Unknown,
+               "GLContext::ProfileVersionForExtensionGroup : unknown <profile>");
+
+    const ExtensionGroupInfo& groupInfo = GetExtensionGroupInfo(extensionGroup);
+
+    if (profile == ContextProfile::OpenGLES) {
+        return groupInfo.mOpenGLESVersion;
+    }
+
+    return groupInfo.mOpenGLVersion;
+}
+
+static inline bool
+IsExtensionGroupIsPartOfProfileVersion(GLContext::GLExtensionGroup extensionGroup,
+                                       ContextProfile profile, unsigned int version)
+{
+    unsigned int profileVersion = ProfileVersionForExtensionGroup(extensionGroup, profile);
+
+    return profileVersion && version >= profileVersion;
+}
+
+const char*
+GLContext::GetExtensionGroupName(GLExtensionGroup extensionGroup)
+{
+    return GetExtensionGroupInfo(extensionGroup).mName;
+}
+
+bool
+GLContext::IsExtensionSupported(GLExtensionGroup extensionGroup) const
+{
+    if (IsExtensionGroupIsPartOfProfileVersion(extensionGroup, mProfile, mVersion)) {
+        return true;
+    }
+
+    const ExtensionGroupInfo& groupInfo = GetExtensionGroupInfo(extensionGroup);
+
+    for (size_t i = 0; true; i++)
+    {
+        MOZ_ASSERT(i < kMAX_EXTENSION_GROUP_SIZE, "kMAX_EXTENSION_GROUP_SIZE too small");
+
+        if (groupInfo.mExtensions[i] == GLContext::Extensions_End) {
+            break;
+        }
+
+        if (IsExtensionSupported(groupInfo.mExtensions[i])) {
+            return true;
+        }
+    }
+
+    return false;
+}
+
+bool
+GLContext::MarkExtensionGroupUnsupported(GLExtensionGroup extensionGroup)
+{
+    MOZ_ASSERT(IsExtensionSupported(extensionGroup), "extension group is already unsupported!");
+
+    if (IsExtensionGroupIsPartOfProfileVersion(extensionGroup, mProfile, mVersion)) {
+        NS_WARNING(nsPrintfCString("%s marked as unsupported, but it's supposed to be supported by %s %s",
+                                   GetExtensionGroupName(extensionGroup),
+                                   ProfileString(),
+                                   VersionString()).get());
+        return false;
+    }
+
+    const ExtensionGroupInfo& groupInfo = GetExtensionGroupInfo(extensionGroup);
+
+    for (size_t i = 0; true; i++)
+    {
+        MOZ_ASSERT(i < kMAX_EXTENSION_GROUP_SIZE, "kMAX_EXTENSION_GROUP_SIZE too small");
+
+        if (groupInfo.mExtensions[i] == GLContext::Extensions_End) {
+            break;
+        }
+
+        MarkExtensionUnsupported(groupInfo.mExtensions[i]);
+    }
+
+    MOZ_ASSERT(!IsExtensionSupported(extensionGroup), "GLContext::MarkExtensionGroupUnsupported has failed!");
+
+    NS_WARNING(nsPrintfCString("%s marked as unsupported", GetExtensionGroupName(extensionGroup)).get());
+
+    return true;
+}
+
+} /* namespace gl */
+} /* namespace mozilla */
diff --git a/gfx/gl/GLContextProviderCGL.mm b/gfx/gl/GLContextProviderCGL.mm
index fa3926b48560..fbc21b1c6803 100644
--- a/gfx/gl/GLContextProviderCGL.mm
+++ b/gfx/gl/GLContextProviderCGL.mm
@@ -138,12 +138,13 @@ public:
 
         if (mContext) {
             [mContext makeCurrentContext];
-            // Use blocking swap only with the default frame rate.
+            // Use non-blocking swap in "ASAP mode".
+            // ASAP mode means that rendering is iterated as fast as possible.
+            // ASAP mode is entered when layout.frame_rate=0 (requires restart).
             // If swapInt is 1, then glSwapBuffers will block and wait for a vblank signal.
-            // While this is fine for the default refresh rate, if the user chooses some
-            // other rate, and specifically if this rate is higher than the screen refresh rate,
-            // then we want a non-blocking glSwapBuffers, which will happen when swapInt==0.
-            GLint swapInt = gfxPlatform::GetPrefLayoutFrameRate() == -1 ? 1 : 0;
+            // When we're iterating as fast as possible, however, we want a non-blocking
+            // glSwapBuffers, which will happen when swapInt==0.
+            GLint swapInt = gfxPlatform::GetPrefLayoutFrameRate() == 0 ? 0 : 1;
             [mContext setValues:&swapInt forParameter:NSOpenGLCPSwapInterval];
         }
         return true;
diff --git a/gfx/gl/GLScreenBuffer.cpp b/gfx/gl/GLScreenBuffer.cpp
index 21becd7212e9..5dd2fbf97250 100644
--- a/gfx/gl/GLScreenBuffer.cpp
+++ b/gfx/gl/GLScreenBuffer.cpp
@@ -29,7 +29,7 @@ GLScreenBuffer::Create(GLContext* gl,
                      const SurfaceCaps& caps)
 {
     if (caps.antialias &&
-        !gl->SupportsFramebufferMultisample())
+        !gl->IsExtensionSupported(GLContext::XXX_framebuffer_multisample))
     {
         return nullptr;
     }
@@ -79,7 +79,7 @@ GLScreenBuffer::BindAsFramebuffer(GLContext* const gl, GLenum target) const
     GLuint drawFB = DrawFB();
     GLuint readFB = ReadFB();
 
-    if (!gl->HasExt_FramebufferBlit()) {
+    if (!gl->IsExtensionSupported(GLContext::XXX_framebuffer_blit)) {
         MOZ_ASSERT(drawFB == readFB);
         gl->raw_fBindFramebuffer(target, readFB);
         return;
@@ -92,14 +92,14 @@ GLScreenBuffer::BindAsFramebuffer(GLContext* const gl, GLenum target) const
         break;
 
     case LOCAL_GL_DRAW_FRAMEBUFFER_EXT:
-        if (!gl->HasExt_FramebufferBlit())
+        if (!gl->IsExtensionSupported(GLContext::XXX_framebuffer_blit))
             NS_WARNING("DRAW_FRAMEBUFFER requested but unavailable.");
 
         gl->raw_fBindFramebuffer(LOCAL_GL_DRAW_FRAMEBUFFER_EXT, drawFB);
         break;
 
     case LOCAL_GL_READ_FRAMEBUFFER_EXT:
-        if (!gl->HasExt_FramebufferBlit())
+        if (!gl->IsExtensionSupported(GLContext::XXX_framebuffer_blit))
             NS_WARNING("READ_FRAMEBUFFER requested but unavailable.");
 
         gl->raw_fBindFramebuffer(LOCAL_GL_READ_FRAMEBUFFER_EXT, readFB);
@@ -124,7 +124,7 @@ GLScreenBuffer::BindFB(GLuint fb)
     if (mInternalDrawFB == mInternalReadFB) {
         mGL->raw_fBindFramebuffer(LOCAL_GL_FRAMEBUFFER, mInternalDrawFB);
     } else {
-        MOZ_ASSERT(mGL->SupportsSplitFramebuffer());
+        MOZ_ASSERT(mGL->IsExtensionSupported(GLContext::XXX_framebuffer_blit));
         mGL->raw_fBindFramebuffer(LOCAL_GL_DRAW_FRAMEBUFFER_EXT, mInternalDrawFB);
         mGL->raw_fBindFramebuffer(LOCAL_GL_READ_FRAMEBUFFER_EXT, mInternalReadFB);
     }
@@ -138,7 +138,7 @@ GLScreenBuffer::BindFB(GLuint fb)
 void
 GLScreenBuffer::BindDrawFB(GLuint fb)
 {
-    if (!mGL->SupportsSplitFramebuffer()) {
+    if (!mGL->IsExtensionSupported(GLContext::XXX_framebuffer_blit)) {
         NS_WARNING("DRAW_FRAMEBUFFER requested, but unsupported.");
 
         mGL->raw_fBindFramebuffer(LOCAL_GL_DRAW_FRAMEBUFFER_EXT, fb);
@@ -158,7 +158,7 @@ GLScreenBuffer::BindDrawFB(GLuint fb)
 void
 GLScreenBuffer::BindReadFB(GLuint fb)
 {
-    if (!mGL->SupportsSplitFramebuffer()) {
+    if (!mGL->IsExtensionSupported(GLContext::XXX_framebuffer_blit)) {
         NS_WARNING("READ_FRAMEBUFFER requested, but unsupported.");
 
         mGL->raw_fBindFramebuffer(LOCAL_GL_READ_FRAMEBUFFER_EXT, fb);
@@ -233,7 +233,7 @@ GLScreenBuffer::GetReadFB() const
     // We use raw_ here because this is debug code and we need to see what
     // the driver thinks.
     GLuint actual = 0;
-    if (mGL->SupportsSplitFramebuffer())
+    if (mGL->IsExtensionSupported(GLContext::XXX_framebuffer_blit))
         mGL->raw_fGetIntegerv(LOCAL_GL_READ_FRAMEBUFFER_BINDING_EXT, (GLint*)&actual);
     else
         mGL->raw_fGetIntegerv(LOCAL_GL_FRAMEBUFFER_BINDING, (GLint*)&actual);
diff --git a/gfx/gl/moz.build b/gfx/gl/moz.build
index 4bc6c74ae087..9e0680d67597 100644
--- a/gfx/gl/moz.build
+++ b/gfx/gl/moz.build
@@ -101,6 +101,7 @@ if gl_provider == 'EGL':
 
 CPP_SOURCES += [
     'GLContext.cpp',
+    'GLContextExtensionGroupQueries.cpp',
     'GLContextTypes.cpp',
     'GLContextUtils.cpp',
     'GLLibraryLoader.cpp',
diff --git a/gfx/layers/CompositorTypes.h b/gfx/layers/CompositorTypes.h
index f2219be158be..cd84d5d48396 100644
--- a/gfx/layers/CompositorTypes.h
+++ b/gfx/layers/CompositorTypes.h
@@ -7,6 +7,8 @@
 #define MOZILLA_LAYERS_COMPOSITORTYPES_H
 
 #include "LayersTypes.h"
+#include "nsXULAppAPI.h"
+
 
 namespace mozilla {
 namespace layers {
@@ -67,11 +69,30 @@ const TextureFlags TEXTURE_DEALLOCATE_HOST    = 1 << 26;
 // modified, it can only be read. It is safe to not Lock/Unlock immutable
 // textures.
 const TextureFlags TEXTURE_IMMUTABLE          = 1 << 27;
+// The contents of the texture must be uploaded or copied immediately
+// during the transaction, because the producer may want to write
+// to it again.
+const TextureFlags TEXTURE_IMMEDIATE_UPLOAD   = 1 << 28;
+// The texture is going to be used as part of a double
+// buffered pair, and so we can guarantee that the producer/consumer
+// won't be racing to access its contents.
+const TextureFlags TEXTURE_DOUBLE_BUFFERED    = 1 << 29;
 
 // the default flags
 const TextureFlags TEXTURE_FLAGS_DEFAULT = TEXTURE_DEALLOCATE_HOST
                                          | TEXTURE_FRONT;
 
+static inline bool
+TextureRequiresLocking(TextureFlags aFlags)
+{
+  // If we're not double buffered, or uploading
+  // within a transaction, then we need to support
+  // locking correctly.
+  return !(aFlags & (TEXTURE_IMMEDIATE_UPLOAD |
+                     TEXTURE_DOUBLE_BUFFERED |
+                     TEXTURE_IMMUTABLE));
+}
+
 /**
  * See gfx/layers/Effects.h
  */
@@ -104,7 +125,8 @@ enum DeprecatedTextureClientType
   TEXTURE_SHARED_GL_EXTERNAL, // GLContext::SharedTextureHandle, the ownership of
                               // the SurfaceDescriptor passed to the texture
                               // remains with whoever passed it.
-  TEXTURE_STREAM_GL           // WebGL streaming buffer
+  TEXTURE_STREAM_GL,          // WebGL streaming buffer
+  TEXTURE_FALLBACK            // A fallback path appropriate for the platform
 };
 
 /**
@@ -147,15 +169,18 @@ enum DeprecatedTextureHostFlags
 struct TextureFactoryIdentifier
 {
   LayersBackend mParentBackend;
+  GeckoProcessType mParentProcessId;
   int32_t mMaxTextureSize;
   bool mSupportsTextureBlitting;
   bool mSupportsPartialUploads;
 
   TextureFactoryIdentifier(LayersBackend aLayersBackend = LAYERS_NONE,
+                           GeckoProcessType aParentProcessId = GeckoProcessType_Default,
                            int32_t aMaxTextureSize = 0,
                            bool aSupportsTextureBlitting = false,
                            bool aSupportsPartialUploads = false)
     : mParentBackend(aLayersBackend)
+    , mParentProcessId(aParentProcessId)
     , mMaxTextureSize(aMaxTextureSize)
     , mSupportsTextureBlitting(aSupportsTextureBlitting)
     , mSupportsPartialUploads(aSupportsPartialUploads)
diff --git a/gfx/layers/ThebesLayerBuffer.cpp b/gfx/layers/ThebesLayerBuffer.cpp
index 6a1325af2ec7..093bf224b987 100644
--- a/gfx/layers/ThebesLayerBuffer.cpp
+++ b/gfx/layers/ThebesLayerBuffer.cpp
@@ -446,7 +446,8 @@ ThebesLayerBuffer::BeginPaint(ThebesLayer* aLayer, ContentType aContentType,
   PaintState result;
   // We need to disable rotation if we're going to be resampled when
   // drawing, because we might sample across the rotation boundary.
-  bool canHaveRotation = !(aFlags & (PAINT_WILL_RESAMPLE | PAINT_NO_ROTATION));
+  bool canHaveRotation = gfxPlatform::BufferRotationEnabled() &&
+                         !(aFlags & (PAINT_WILL_RESAMPLE | PAINT_NO_ROTATION));
 
   nsIntRegion validRegion = aLayer->GetValidRegion();
 
diff --git a/gfx/layers/YCbCrImageDataSerializer.cpp b/gfx/layers/YCbCrImageDataSerializer.cpp
index 93c83c3d5cdf..a97956da09e5 100644
--- a/gfx/layers/YCbCrImageDataSerializer.cpp
+++ b/gfx/layers/YCbCrImageDataSerializer.cpp
@@ -40,6 +40,7 @@ struct YCbCrBufferInfo
   uint32_t mYHeight;
   uint32_t mCbCrWidth;
   uint32_t mCbCrHeight;
+  StereoMode mStereoMode;
 };
 
 static YCbCrBufferInfo* GetYCbCrBufferInfo(uint8_t* aData)
@@ -103,6 +104,12 @@ gfxIntSize YCbCrImageDataDeserializerBase::GetCbCrSize()
   return gfxIntSize(info->mCbCrWidth, info->mCbCrHeight);
 }
 
+StereoMode YCbCrImageDataDeserializerBase::GetStereoMode()
+{
+  YCbCrBufferInfo* info = GetYCbCrBufferInfo(mData);
+  return info->mStereoMode;
+}
+
 // Offset in bytes
 static size_t ComputeOffset(uint32_t aHeight, uint32_t aStride)
 {
@@ -144,7 +151,8 @@ YCbCrImageDataSerializer::ComputeMinBufferSize(uint32_t aSize)
 
 void
 YCbCrImageDataSerializer::InitializeBufferInfo(const gfx::IntSize& aYSize,
-                                               const gfx::IntSize& aCbCrSize)
+                                               const gfx::IntSize& aCbCrSize,
+                                               StereoMode aStereoMode)
 {
   YCbCrBufferInfo* info = GetYCbCrBufferInfo(mData);
   info->mYOffset = MOZ_ALIGN_WORD(sizeof(YCbCrBufferInfo));
@@ -157,14 +165,17 @@ YCbCrImageDataSerializer::InitializeBufferInfo(const gfx::IntSize& aYSize,
   info->mYHeight = aYSize.height;
   info->mCbCrWidth = aCbCrSize.width;
   info->mCbCrHeight = aCbCrSize.height;
+  info->mStereoMode = aStereoMode;
 }
 
 void
 YCbCrImageDataSerializer::InitializeBufferInfo(const gfxIntSize& aYSize,
-                                               const gfxIntSize& aCbCrSize)
+                                               const gfxIntSize& aCbCrSize,
+                                               StereoMode aStereoMode)
 {
   InitializeBufferInfo(gfx::IntSize(aYSize.width, aYSize.height),
-                       gfx::IntSize(aCbCrSize.width, aCbCrSize.height));
+                       gfx::IntSize(aCbCrSize.width, aCbCrSize.height),
+                       aStereoMode);
 }
 
 static void CopyLineWithSkip(const uint8_t* src, uint8_t* dst, uint32_t len, uint32_t skip) {
diff --git a/gfx/layers/YCbCrImageDataSerializer.h b/gfx/layers/YCbCrImageDataSerializer.h
index ae376514b56c..cb48a9dda03e 100644
--- a/gfx/layers/YCbCrImageDataSerializer.h
+++ b/gfx/layers/YCbCrImageDataSerializer.h
@@ -66,6 +66,11 @@ public:
    */
   gfxIntSize GetCbCrSize();
 
+  /**
+   * Stereo mode for the image.
+   */
+  StereoMode GetStereoMode();
+
   /**
    * Return a pointer to the begining of the data buffer.
    */
@@ -111,9 +116,11 @@ public:
    * buffer on which we want to store the image.
    */
   void InitializeBufferInfo(const gfx::IntSize& aYSize,
-                            const gfx::IntSize& aCbCrSize);
+                            const gfx::IntSize& aCbCrSize,
+                            StereoMode aStereoMode);
   void InitializeBufferInfo(const gfxIntSize& aYSize,
-                            const gfxIntSize& aCbCrSize);
+                            const gfxIntSize& aCbCrSize,
+                            StereoMode aStereoMode);
 
   bool CopyData(const uint8_t* aYData,
                 const uint8_t* aCbData, const uint8_t* aCrData,
diff --git a/gfx/layers/basic/BasicCompositor.h b/gfx/layers/basic/BasicCompositor.h
index 78ba1442db20..999aa35a4890 100644
--- a/gfx/layers/basic/BasicCompositor.h
+++ b/gfx/layers/basic/BasicCompositor.h
@@ -43,7 +43,9 @@ public:
 
   virtual TextureFactoryIdentifier GetTextureFactoryIdentifier() MOZ_OVERRIDE
   {
-    return TextureFactoryIdentifier(LAYERS_BASIC, GetMaxTextureSize());
+    return TextureFactoryIdentifier(LAYERS_BASIC,
+                                    XRE_GetProcessType(),
+                                    GetMaxTextureSize());
   }
 
   virtual TemporaryRef<CompositingRenderTarget>
diff --git a/gfx/layers/client/CanvasClient.cpp b/gfx/layers/client/CanvasClient.cpp
index 87ecd1e16b33..259c14d6ebde 100644
--- a/gfx/layers/client/CanvasClient.cpp
+++ b/gfx/layers/client/CanvasClient.cpp
@@ -28,27 +28,77 @@ CanvasClient::CreateCanvasClient(CanvasClientType aType,
 {
   if (aType == CanvasClientGLContext &&
       aForwarder->GetCompositorBackendType() == LAYERS_OPENGL) {
-    return new CanvasClientSurfaceStream(aForwarder, aFlags);
+    return new DeprecatedCanvasClientSurfaceStream(aForwarder, aFlags);
+  }
+  if (gfxPlatform::GetPlatform()->UseDeprecatedTextures()) {
+    return new DeprecatedCanvasClient2D(aForwarder, aFlags);
   }
   return new CanvasClient2D(aForwarder, aFlags);
 }
 
 void
-CanvasClient::Updated()
+CanvasClient2D::Update(gfx::IntSize aSize, ClientCanvasLayer* aLayer)
+{
+  if (mBuffer &&
+      (mBuffer->IsImmutable() || mBuffer->GetSize() != aSize)) {
+    RemoveTextureClient(mBuffer);
+    mBuffer = nullptr;
+  }
+
+  if (!mBuffer) {
+    bool isOpaque = (aLayer->GetContentFlags() & Layer::CONTENT_OPAQUE);
+    gfxASurface::gfxContentType contentType = isOpaque
+                                                ? gfxASurface::CONTENT_COLOR
+                                                : gfxASurface::CONTENT_COLOR_ALPHA;
+    gfxASurface::gfxImageFormat format
+      = gfxPlatform::GetPlatform()->OptimalFormatForContent(contentType);
+    mBuffer = CreateBufferTextureClient(gfx::ImageFormatToSurfaceFormat(format));
+    MOZ_ASSERT(mBuffer->AsTextureClientSurface());
+    mBuffer->AsTextureClientSurface()->AllocateForSurface(aSize);
+
+    AddTextureClient(mBuffer);
+  }
+
+  if (!mBuffer->Lock(OPEN_READ_WRITE)) {
+    return;
+  }
+
+  nsRefPtr<gfxASurface> surface = mBuffer->AsTextureClientSurface()->GetAsSurface();
+  if (surface) {
+    aLayer->UpdateSurface(surface);
+  }
+
+  mBuffer->Unlock();
+
+  if (surface) {
+    GetForwarder()->UpdatedTexture(this, mBuffer, nullptr);
+    GetForwarder()->UseTexture(this, mBuffer);
+  }
+}
+
+TemporaryRef<BufferTextureClient>
+CanvasClient2D::CreateBufferTextureClient(gfx::SurfaceFormat aFormat)
+{
+  return CompositableClient::CreateBufferTextureClient(aFormat,
+                                                       mTextureInfo.mTextureFlags);
+}
+
+void
+DeprecatedCanvasClient2D::Updated()
 {
   mForwarder->UpdateTexture(this, 1, mDeprecatedTextureClient->GetDescriptor());
 }
 
 
-CanvasClient2D::CanvasClient2D(CompositableForwarder* aFwd,
-                               TextureFlags aFlags)
+DeprecatedCanvasClient2D::DeprecatedCanvasClient2D(CompositableForwarder* aFwd,
+                                                   TextureFlags aFlags)
 : CanvasClient(aFwd, aFlags)
 {
   mTextureInfo.mCompositableType = BUFFER_IMAGE_SINGLE;
 }
 
 void
-CanvasClient2D::Update(gfx::IntSize aSize, ClientCanvasLayer* aLayer)
+DeprecatedCanvasClient2D::Update(gfx::IntSize aSize, ClientCanvasLayer* aLayer)
 {
   if (!mDeprecatedTextureClient) {
     mDeprecatedTextureClient = CreateDeprecatedTextureClient(TEXTURE_CONTENT);
@@ -67,7 +117,7 @@ CanvasClient2D::Update(gfx::IntSize aSize, ClientCanvasLayer* aLayer)
 }
 
 void
-CanvasClientSurfaceStream::Updated()
+DeprecatedCanvasClientSurfaceStream::Updated()
 {
   if (mNeedsUpdate) {
     mForwarder->UpdateTextureNoSwap(this, 1, mDeprecatedTextureClient->GetDescriptor());
@@ -76,8 +126,8 @@ CanvasClientSurfaceStream::Updated()
 }
 
 
-CanvasClientSurfaceStream::CanvasClientSurfaceStream(CompositableForwarder* aFwd,
-                                                     TextureFlags aFlags)
+DeprecatedCanvasClientSurfaceStream::DeprecatedCanvasClientSurfaceStream(CompositableForwarder* aFwd,
+                                                                         TextureFlags aFlags)
 : CanvasClient(aFwd, aFlags)
 , mNeedsUpdate(false)
 {
@@ -85,7 +135,7 @@ CanvasClientSurfaceStream::CanvasClientSurfaceStream(CompositableForwarder* aFwd
 }
 
 void
-CanvasClientSurfaceStream::Update(gfx::IntSize aSize, ClientCanvasLayer* aLayer)
+DeprecatedCanvasClientSurfaceStream::Update(gfx::IntSize aSize, ClientCanvasLayer* aLayer)
 {
   if (!mDeprecatedTextureClient) {
     mDeprecatedTextureClient = CreateDeprecatedTextureClient(TEXTURE_STREAM_GL);
diff --git a/gfx/layers/client/CanvasClient.h b/gfx/layers/client/CanvasClient.h
index 4fc13f8cf193..3f4a96c6e87c 100644
--- a/gfx/layers/client/CanvasClient.h
+++ b/gfx/layers/client/CanvasClient.h
@@ -44,15 +44,9 @@ public:
 
   virtual void Update(gfx::IntSize aSize, ClientCanvasLayer* aLayer) = 0;
 
-  virtual void Updated();
+  virtual void Updated() { }
 
-  virtual void SetDescriptorFromReply(TextureIdentifier aTextureId,
-                                      const SurfaceDescriptor& aDescriptor) MOZ_OVERRIDE
-  {
-    mDeprecatedTextureClient->SetDescriptorFromReply(aDescriptor);
-  }
 protected:
-  RefPtr<DeprecatedTextureClient> mDeprecatedTextureClient;
   TextureInfo mTextureInfo;
 };
 
@@ -61,23 +55,40 @@ class CanvasClient2D : public CanvasClient
 {
 public:
   CanvasClient2D(CompositableForwarder* aLayerForwarder,
-                 TextureFlags aFlags);
-
-  TextureInfo GetTextureInfo() const MOZ_OVERRIDE
+                 TextureFlags aFlags)
+    : CanvasClient(aLayerForwarder, aFlags)
   {
-    return mTextureInfo;
   }
 
-  virtual void Update(gfx::IntSize aSize, ClientCanvasLayer* aLayer);
-};
+  TextureInfo GetTextureInfo() const
+  {
+    return TextureInfo(COMPOSITABLE_IMAGE);
+  }
 
-// Used for GL canvases where we don't need to do any readback, i.e., with a
-// GL backend.
-class CanvasClientSurfaceStream : public CanvasClient
+  virtual void Update(gfx::IntSize aSize, ClientCanvasLayer* aLayer) MOZ_OVERRIDE;
+
+  virtual void AddTextureClient(TextureClient* aTexture) MOZ_OVERRIDE
+  {
+    MOZ_ASSERT((mTextureInfo.mTextureFlags & aTexture->GetFlags()) == mTextureInfo.mTextureFlags);
+    CompositableClient::AddTextureClient(aTexture);
+  }
+
+  virtual TemporaryRef<BufferTextureClient>
+  CreateBufferTextureClient(gfx::SurfaceFormat aFormat) MOZ_OVERRIDE;
+
+  virtual void Detach() MOZ_OVERRIDE
+  {
+    mBuffer = nullptr;
+  }
+
+private:
+  RefPtr<TextureClient> mBuffer;
+};
+class DeprecatedCanvasClient2D : public CanvasClient
 {
 public:
-  CanvasClientSurfaceStream(CompositableForwarder* aFwd,
-                            TextureFlags aFlags);
+  DeprecatedCanvasClient2D(CompositableForwarder* aLayerForwarder,
+                           TextureFlags aFlags);
 
   TextureInfo GetTextureInfo() const MOZ_OVERRIDE
   {
@@ -87,7 +98,40 @@ public:
   virtual void Update(gfx::IntSize aSize, ClientCanvasLayer* aLayer);
   virtual void Updated() MOZ_OVERRIDE;
 
+  virtual void SetDescriptorFromReply(TextureIdentifier aTextureId,
+                                      const SurfaceDescriptor& aDescriptor) MOZ_OVERRIDE
+  {
+    mDeprecatedTextureClient->SetDescriptorFromReply(aDescriptor);
+  }
+
 private:
+  RefPtr<DeprecatedTextureClient> mDeprecatedTextureClient;
+};
+
+// Used for GL canvases where we don't need to do any readback, i.e., with a
+// GL backend.
+class DeprecatedCanvasClientSurfaceStream : public CanvasClient
+{
+public:
+  DeprecatedCanvasClientSurfaceStream(CompositableForwarder* aFwd,
+                                      TextureFlags aFlags);
+
+  TextureInfo GetTextureInfo() const MOZ_OVERRIDE
+  {
+    return mTextureInfo;
+  }
+
+  virtual void Update(gfx::IntSize aSize, ClientCanvasLayer* aLayer);
+  virtual void Updated() MOZ_OVERRIDE;
+
+  virtual void SetDescriptorFromReply(TextureIdentifier aTextureId,
+                                      const SurfaceDescriptor& aDescriptor) MOZ_OVERRIDE
+  {
+    mDeprecatedTextureClient->SetDescriptorFromReply(aDescriptor);
+  }
+
+private:
+  RefPtr<DeprecatedTextureClient> mDeprecatedTextureClient;
   bool mNeedsUpdate;
 };
 
diff --git a/gfx/layers/client/ClientCanvasLayer.cpp b/gfx/layers/client/ClientCanvasLayer.cpp
index 0524770b556d..258abb278340 100644
--- a/gfx/layers/client/ClientCanvasLayer.cpp
+++ b/gfx/layers/client/ClientCanvasLayer.cpp
@@ -81,7 +81,7 @@ ClientCanvasLayer::RenderLayer()
   }
   
   if (!mCanvasClient) {
-    TextureFlags flags = 0;
+    TextureFlags flags = TEXTURE_IMMEDIATE_UPLOAD;
     if (mNeedsYFlip) {
       flags |= NeedsYFlip;
     }
@@ -112,6 +112,7 @@ ClientCanvasLayer::RenderLayer()
 
   ClientManager()->Hold(this);
   mCanvasClient->Updated();
+  mCanvasClient->OnTransaction();
 }
 
 already_AddRefed<CanvasLayer>
diff --git a/gfx/layers/client/ClientCanvasLayer.h b/gfx/layers/client/ClientCanvasLayer.h
index ed2e8c6bb6a1..67bdaf64dfd1 100644
--- a/gfx/layers/client/ClientCanvasLayer.h
+++ b/gfx/layers/client/ClientCanvasLayer.h
@@ -86,8 +86,9 @@ protected:
 
   RefPtr<CanvasClient> mCanvasClient;
 
+  friend class DeprecatedCanvasClient2D;
   friend class CanvasClient2D;
-  friend class CanvasClientSurfaceStream;
+  friend class DeprecatedCanvasClientSurfaceStream;
 };
 }
 }
diff --git a/gfx/layers/client/ClientImageLayer.cpp b/gfx/layers/client/ClientImageLayer.cpp
index b21d1d4afd50..ae1af7fe6aa2 100644
--- a/gfx/layers/client/ClientImageLayer.cpp
+++ b/gfx/layers/client/ClientImageLayer.cpp
@@ -145,6 +145,9 @@ ClientImageLayer::RenderLayer()
       return;
     }
   }
+  if (mImageClient) {
+    mImageClient->OnTransaction();
+  }
   ClientManager()->Hold(this);
 }
 
diff --git a/gfx/layers/client/CompositableClient.cpp b/gfx/layers/client/CompositableClient.cpp
index c9a9874518f8..50a41f43e495 100644
--- a/gfx/layers/client/CompositableClient.cpp
+++ b/gfx/layers/client/CompositableClient.cpp
@@ -10,6 +10,7 @@
 #include "mozilla/layers/CompositableForwarder.h"
 #include "gfxPlatform.h"
 #ifdef XP_WIN
+#include "mozilla/layers/TextureD3D9.h"
 #include "mozilla/layers/TextureD3D11.h"
 #include "gfxWindowsPlatform.h"
 #endif
@@ -112,6 +113,7 @@ CompositableClient::CreateDeprecatedTextureClient(DeprecatedTextureClientType aD
     break;
   case TEXTURE_YCBCR:
     if (parentBackend == LAYERS_OPENGL ||
+        parentBackend == LAYERS_D3D9 ||
         parentBackend == LAYERS_D3D11 ||
         parentBackend == LAYERS_BASIC) {
       result = new DeprecatedTextureClientShmemYCbCr(GetForwarder(), GetTextureInfo());
@@ -123,11 +125,23 @@ CompositableClient::CreateDeprecatedTextureClient(DeprecatedTextureClientType aD
       result = new DeprecatedTextureClientD3D11(GetForwarder(), GetTextureInfo());
       break;
     }
+    if (parentBackend == LAYERS_D3D9 &&
+        !GetForwarder()->ForwardsToDifferentProcess()) {
+      result = new DeprecatedTextureClientD3D9(GetForwarder(), GetTextureInfo());
+      break;
+    }
 #endif
      // fall through to TEXTURE_SHMEM
   case TEXTURE_SHMEM:
     result = new DeprecatedTextureClientShmem(GetForwarder(), GetTextureInfo());
     break;
+  case TEXTURE_FALLBACK:
+#ifdef XP_WIN
+    if (parentBackend == LAYERS_D3D9) {
+      result = new DeprecatedTextureClientShmem(GetForwarder(), GetTextureInfo());
+    }
+#endif
+    break;
   default:
     MOZ_ASSERT(false, "Unhandled texture client type");
   }
@@ -147,16 +161,22 @@ CompositableClient::CreateDeprecatedTextureClient(DeprecatedTextureClientType aD
 }
 
 TemporaryRef<BufferTextureClient>
-CompositableClient::CreateBufferTextureClient(gfx::SurfaceFormat aFormat)
+CompositableClient::CreateBufferTextureClient(gfx::SurfaceFormat aFormat,
+                                              uint32_t aTextureFlags)
 {
   if (gfxPlatform::GetPlatform()->PreferMemoryOverShmem()) {
-    RefPtr<BufferTextureClient> result = new MemoryTextureClient(this, aFormat);
+    RefPtr<BufferTextureClient> result = new MemoryTextureClient(this, aFormat, aTextureFlags);
     return result.forget();
   }
-  RefPtr<BufferTextureClient> result = new ShmemTextureClient(this, aFormat);
+  RefPtr<BufferTextureClient> result = new ShmemTextureClient(this, aFormat, aTextureFlags);
   return result.forget();
 }
 
+TemporaryRef<BufferTextureClient>
+CompositableClient::CreateBufferTextureClient(gfx::SurfaceFormat aFormat)
+{
+  return CreateBufferTextureClient(aFormat, TEXTURE_FLAGS_DEFAULT);
+}
 
 void
 CompositableClient::AddTextureClient(TextureClient* aClient)
diff --git a/gfx/layers/client/CompositableClient.h b/gfx/layers/client/CompositableClient.h
index 0bdb7ebee834..fbd33bff9916 100644
--- a/gfx/layers/client/CompositableClient.h
+++ b/gfx/layers/client/CompositableClient.h
@@ -77,6 +77,9 @@ public:
   CreateDeprecatedTextureClient(DeprecatedTextureClientType aDeprecatedTextureClientType);
 
   TemporaryRef<BufferTextureClient>
+  CreateBufferTextureClient(gfx::SurfaceFormat aFormat, TextureFlags aFlags);
+
+  virtual TemporaryRef<BufferTextureClient>
   CreateBufferTextureClient(gfx::SurfaceFormat aFormat);
 
   virtual void SetDescriptorFromReply(TextureIdentifier aTextureId,
diff --git a/gfx/layers/client/ContentClient.cpp b/gfx/layers/client/ContentClient.cpp
index 8b2f0daf81fd..e5c8f334fa60 100644
--- a/gfx/layers/client/ContentClient.cpp
+++ b/gfx/layers/client/ContentClient.cpp
@@ -26,9 +26,10 @@ ContentClient::CreateContentClient(CompositableForwarder* aForwarder)
 {
   LayersBackend backend = aForwarder->GetCompositorBackendType();
   if (backend != LAYERS_OPENGL &&
+      backend != LAYERS_D3D9 &&
       backend != LAYERS_D3D11 &&
       backend != LAYERS_BASIC) {
-        return nullptr;
+    return nullptr;
   }
 
   bool useDoubleBuffering = false;
@@ -138,6 +139,25 @@ ContentClientRemoteBuffer::EndPaint()
   }
 }
 
+bool
+ContentClientRemoteBuffer::CreateAndAllocateDeprecatedTextureClient(RefPtr<DeprecatedTextureClient>& aClient)
+{
+  aClient = CreateDeprecatedTextureClient(TEXTURE_CONTENT);
+  MOZ_ASSERT(aClient, "Failed to create texture client");
+
+  if (!aClient->EnsureAllocated(mSize, mContentType)) {
+    aClient = CreateDeprecatedTextureClient(TEXTURE_FALLBACK);
+    MOZ_ASSERT(aClient, "Failed to create texture client");
+    if (!aClient->EnsureAllocated(mSize, mContentType)) {
+      NS_WARNING("Could not allocate texture client");
+      return false;
+    }
+  }
+
+  MOZ_ASSERT(IsSurfaceDescriptorValid(*aClient->GetDescriptor()));
+  return true;
+}
+
 void
 ContentClientRemoteBuffer::BuildDeprecatedTextureClients(ContentType aType,
                                                const nsIntRect& aRect,
@@ -155,22 +175,20 @@ ContentClientRemoteBuffer::BuildDeprecatedTextureClients(ContentType aType,
     }
     DestroyBuffers();
   }
-  mTextureInfo.mTextureFlags = aFlags | TEXTURE_DEALLOCATE_HOST;
-  mDeprecatedTextureClient = CreateDeprecatedTextureClient(TEXTURE_CONTENT);
-  MOZ_ASSERT(mDeprecatedTextureClient, "Failed to create texture client");
-  if (aFlags & BUFFER_COMPONENT_ALPHA) {
-    mDeprecatedTextureClientOnWhite = CreateDeprecatedTextureClient(TEXTURE_CONTENT);
-    MOZ_ASSERT(mDeprecatedTextureClientOnWhite, "Failed to create texture client");
-    mTextureInfo.mTextureFlags |= ComponentAlpha;
-  }
 
   mContentType = aType;
   mSize = gfx::IntSize(aRect.width, aRect.height);
-  mDeprecatedTextureClient->EnsureAllocated(mSize, mContentType);
-  MOZ_ASSERT(IsSurfaceDescriptorValid(*mDeprecatedTextureClient->GetDescriptor()));
-  if (mDeprecatedTextureClientOnWhite) {
-    mDeprecatedTextureClientOnWhite->EnsureAllocated(mSize, mContentType);
-    MOZ_ASSERT(IsSurfaceDescriptorValid(*mDeprecatedTextureClientOnWhite->GetDescriptor()));
+  mTextureInfo.mTextureFlags = aFlags | TEXTURE_DEALLOCATE_HOST;
+
+  if (!CreateAndAllocateDeprecatedTextureClient(mDeprecatedTextureClient)) {
+    return;
+  }
+  
+  if (aFlags & BUFFER_COMPONENT_ALPHA) {
+    if (!CreateAndAllocateDeprecatedTextureClient(mDeprecatedTextureClientOnWhite)) {
+      return;
+    }
+    mTextureInfo.mTextureFlags |= ComponentAlpha;
   }
 
   CreateFrontBufferAndNotify(aRect);
@@ -283,18 +301,18 @@ ContentClientDoubleBuffered::~ContentClientDoubleBuffered()
 void
 ContentClientDoubleBuffered::CreateFrontBufferAndNotify(const nsIntRect& aBufferRect)
 {
-  mFrontClient = CreateDeprecatedTextureClient(TEXTURE_CONTENT);
-  MOZ_ASSERT(mFrontClient, "Failed to create texture client");
-  mFrontClient->EnsureAllocated(mSize, mContentType);
+  if (!CreateAndAllocateDeprecatedTextureClient(mFrontClient)) {
+    return;
+  }
+
+  if (mTextureInfo.mTextureFlags & ComponentAlpha) {
+    if (!CreateAndAllocateDeprecatedTextureClient(mFrontClientOnWhite)) {
+      return;
+    }
+  }
 
   mFrontBufferRect = aBufferRect;
   mFrontBufferRotation = nsIntPoint();
-
-  if (mTextureInfo.mTextureFlags & ComponentAlpha) {
-    mFrontClientOnWhite = CreateDeprecatedTextureClient(TEXTURE_CONTENT);
-    MOZ_ASSERT(mFrontClientOnWhite, "Failed to create texture client");
-    mFrontClientOnWhite->EnsureAllocated(mSize, mContentType);
-  }
   
   mForwarder->CreatedDoubleBuffer(this,
                                   *mFrontClient->GetDescriptor(),
diff --git a/gfx/layers/client/ContentClient.h b/gfx/layers/client/ContentClient.h
index 816fd9fceee5..c2cc12d25c44 100644
--- a/gfx/layers/client/ContentClient.h
+++ b/gfx/layers/client/ContentClient.h
@@ -253,6 +253,8 @@ protected:
   // lock it now.
   virtual void LockFrontBuffer() {}
 
+  bool CreateAndAllocateDeprecatedTextureClient(RefPtr<DeprecatedTextureClient>& aClient);
+
   RefPtr<DeprecatedTextureClient> mDeprecatedTextureClient;
   RefPtr<DeprecatedTextureClient> mDeprecatedTextureClientOnWhite;
   // keep a record of texture clients we have created and need to keep
diff --git a/gfx/layers/client/ImageClient.cpp b/gfx/layers/client/ImageClient.cpp
index 543ba408af1d..bb3a1c2635dd 100644
--- a/gfx/layers/client/ImageClient.cpp
+++ b/gfx/layers/client/ImageClient.cpp
@@ -121,7 +121,7 @@ ImageClientSingle::UpdateImage(ImageContainer* aContainer,
       mFrontBuffer = CreateBufferTextureClient(gfx::FORMAT_YUV);
       gfx::IntSize ySize(data->mYSize.width, data->mYSize.height);
       gfx::IntSize cbCrSize(data->mCbCrSize.width, data->mCbCrSize.height);
-      if (!mFrontBuffer->AsTextureClientYCbCr()->AllocateForYCbCr(ySize, cbCrSize)) {
+      if (!mFrontBuffer->AsTextureClientYCbCr()->AllocateForYCbCr(ySize, cbCrSize, data->mStereoMode)) {
         mFrontBuffer = nullptr;
         return false;
       }
@@ -146,7 +146,10 @@ ImageClientSingle::UpdateImage(ImageContainer* aContainer,
     nsRefPtr<gfxASurface> surface = image->GetAsSurface();
     MOZ_ASSERT(surface);
 
-    if (mFrontBuffer && mFrontBuffer->IsImmutable()) {
+    gfx::IntSize size = gfx::IntSize(image->GetSize().width, image->GetSize().height);
+
+    if (mFrontBuffer &&
+        (mFrontBuffer->IsImmutable() || mFrontBuffer->GetSize() != size)) {
       RemoveTextureClient(mFrontBuffer);
       mFrontBuffer = nullptr;
     }
@@ -155,7 +158,6 @@ ImageClientSingle::UpdateImage(ImageContainer* aContainer,
       gfxASurface::gfxImageFormat format
         = gfxPlatform::GetPlatform()->OptimalFormatForContent(surface->GetContentType());
       mFrontBuffer = CreateBufferTextureClient(gfx::ImageFormatToSurfaceFormat(format));
-      gfx::IntSize size = gfx::IntSize(image->GetSize().width, image->GetSize().height);
       MOZ_ASSERT(mFrontBuffer->AsTextureClientSurface());
       mFrontBuffer->AsTextureClientSurface()->AllocateForSurface(size);
 
@@ -195,10 +197,16 @@ ImageClientBuffered::UpdateImage(ImageContainer* aContainer,
 void
 ImageClientSingle::AddTextureClient(TextureClient* aTexture)
 {
-  aTexture->AddFlags(mTextureFlags);
+  MOZ_ASSERT((mTextureFlags & aTexture->GetFlags()) == mTextureFlags);
   CompositableClient::AddTextureClient(aTexture);
 }
 
+TemporaryRef<BufferTextureClient>
+ImageClientSingle::CreateBufferTextureClient(gfx::SurfaceFormat aFormat)
+{
+  return CompositableClient::CreateBufferTextureClient(aFormat, mTextureFlags);
+}
+
 void
 ImageClientSingle::Detach()
 {
diff --git a/gfx/layers/client/ImageClient.h b/gfx/layers/client/ImageClient.h
index b4ccc6697a94..b7d1b8cfd256 100644
--- a/gfx/layers/client/ImageClient.h
+++ b/gfx/layers/client/ImageClient.h
@@ -77,6 +77,9 @@ public:
 
   virtual void AddTextureClient(TextureClient* aTexture) MOZ_OVERRIDE;
 
+  virtual TemporaryRef<BufferTextureClient>
+  CreateBufferTextureClient(gfx::SurfaceFormat aFormat) MOZ_OVERRIDE;
+
   virtual TextureInfo GetTextureInfo() const MOZ_OVERRIDE;
 protected:
   RefPtr<TextureClient> mFrontBuffer;
diff --git a/gfx/layers/client/TextureClient.cpp b/gfx/layers/client/TextureClient.cpp
index 3426c3b670d1..3919ad918501 100644
--- a/gfx/layers/client/TextureClient.cpp
+++ b/gfx/layers/client/TextureClient.cpp
@@ -88,8 +88,9 @@ ShmemTextureClient::GetBufferSize() const
 }
 
 ShmemTextureClient::ShmemTextureClient(CompositableClient* aCompositable,
-                                       gfx::SurfaceFormat aFormat)
-  : BufferTextureClient(aCompositable, aFormat)
+                                       gfx::SurfaceFormat aFormat,
+                                       TextureFlags aFlags)
+  : BufferTextureClient(aCompositable, aFormat, aFlags)
   , mAllocated(false)
 {
   MOZ_COUNT_CTOR(ShmemTextureClient);
@@ -125,8 +126,10 @@ MemoryTextureClient::Allocate(uint32_t aSize)
   return true;
 }
 
-MemoryTextureClient::MemoryTextureClient(CompositableClient* aCompositable, gfx::SurfaceFormat aFormat)
-  : BufferTextureClient(aCompositable, aFormat)
+MemoryTextureClient::MemoryTextureClient(CompositableClient* aCompositable,
+                                         gfx::SurfaceFormat aFormat,
+                                         TextureFlags aFlags)
+  : BufferTextureClient(aCompositable, aFormat, aFlags)
   , mBuffer(nullptr)
   , mBufSize(0)
 {
@@ -144,8 +147,9 @@ MemoryTextureClient::~MemoryTextureClient()
 }
 
 BufferTextureClient::BufferTextureClient(CompositableClient* aCompositable,
-                                         gfx::SurfaceFormat aFormat)
-  : TextureClient()
+                                         gfx::SurfaceFormat aFormat,
+                                         TextureFlags aFlags)
+  : TextureClient(aFlags)
   , mCompositable(aCompositable)
   , mFormat(aFormat)
 {}
@@ -172,9 +176,28 @@ BufferTextureClient::UpdateSurface(gfxASurface* aSurface)
   tmpCtx->SetOperator(gfxContext::OPERATOR_SOURCE);
   tmpCtx->DrawSurface(aSurface, gfxSize(serializer.GetSize().width,
                                         serializer.GetSize().height));
+
+  if (TextureRequiresLocking(mFlags)) {
+    // We don't have support for proper locking yet, so we'll
+    // have to be immutable instead.
+    MarkImmutable();
+  }
   return true;
 }
 
+already_AddRefed<gfxASurface>
+BufferTextureClient::GetAsSurface()
+{
+  ImageDataSerializer serializer(GetBuffer());
+  if (!serializer.IsValid()) {
+    return nullptr;
+  }
+
+  RefPtr<gfxImageSurface> surf = serializer.GetAsThebesSurface();
+  nsRefPtr<gfxASurface> result = surf.get();
+  return result.forget();
+}
+
 bool
 BufferTextureClient::AllocateForSurface(gfx::IntSize aSize)
 {
@@ -187,6 +210,7 @@ BufferTextureClient::AllocateForSurface(gfx::IntSize aSize)
   }
   ImageDataSerializer serializer(GetBuffer());
   serializer.InitializeBufferInfo(aSize, mFormat);
+  mSize = aSize;
   return true;
 }
 
@@ -206,11 +230,19 @@ BufferTextureClient::UpdateYCbCr(const PlanarYCbCrImage::Data& aData)
     NS_WARNING("Failed to copy image data!");
     return false;
   }
+
+  if (TextureRequiresLocking(mFlags)) {
+    // We don't have support for proper locking yet, so we'll
+    // have to be immutable instead.
+    MarkImmutable();
+  }
   return true;
 }
 
 bool
-BufferTextureClient::AllocateForYCbCr(gfx::IntSize aYSize, gfx::IntSize aCbCrSize)
+BufferTextureClient::AllocateForYCbCr(gfx::IntSize aYSize,
+                                      gfx::IntSize aCbCrSize,
+                                      StereoMode aStereoMode)
 {
   size_t bufSize = YCbCrImageDataSerializer::ComputeMinBufferSize(aYSize,
                                                                   aCbCrSize);
@@ -219,7 +251,9 @@ BufferTextureClient::AllocateForYCbCr(gfx::IntSize aYSize, gfx::IntSize aCbCrSiz
   }
   YCbCrImageDataSerializer serializer(GetBuffer());
   serializer.InitializeBufferInfo(aYSize,
-                                  aCbCrSize);
+                                  aCbCrSize,
+                                  aStereoMode);
+  mSize = aYSize;
   return true;
 }
 
@@ -273,7 +307,7 @@ DeprecatedTextureClientShmem::ReleaseResources()
   }
 }
 
-void
+bool
 DeprecatedTextureClientShmem::EnsureAllocated(gfx::IntSize aSize,
                                     gfxASurface::gfxContentType aContentType)
 {
@@ -290,6 +324,7 @@ DeprecatedTextureClientShmem::EnsureAllocated(gfx::IntSize aSize,
       NS_WARNING("creating SurfaceDescriptor failed!");
     }
   }
+  return true;
 }
 
 void
@@ -401,11 +436,12 @@ DeprecatedTextureClientShmemYCbCr::SetDescriptorFromReply(const SurfaceDescripto
   }
 }
 
-void
+bool
 DeprecatedTextureClientShmemYCbCr::EnsureAllocated(gfx::IntSize aSize,
                                          gfxASurface::gfxContentType aType)
 {
   NS_RUNTIMEABORT("not enough arguments to do this (need both Y and CbCr sizes)");
+  return false;
 }
 
 
@@ -417,7 +453,7 @@ DeprecatedTextureClientTile::DeprecatedTextureClientTile(CompositableForwarder*
   mTextureInfo.mDeprecatedTextureHostFlags = TEXTURE_HOST_TILED;
 }
 
-void
+bool
 DeprecatedTextureClientTile::EnsureAllocated(gfx::IntSize aSize, gfxASurface::gfxContentType aType)
 {
   if (!mSurface ||
@@ -428,6 +464,7 @@ DeprecatedTextureClientTile::EnsureAllocated(gfx::IntSize aSize, gfxASurface::gf
     mSurface = new gfxReusableSurfaceWrapper(tmpTile);
     mContentType = aType;
   }
+  return true;
 }
 
 gfxImageSurface*
@@ -549,7 +586,8 @@ bool AutoLockYCbCrClient::EnsureDeprecatedTextureClient(PlanarYCbCrImage* aImage
 
   YCbCrImageDataSerializer serializer(shmem.get<uint8_t>());
   serializer.InitializeBufferInfo(data->mYSize,
-                                  data->mCbCrSize);
+                                  data->mCbCrSize,
+                                  data->mStereoMode);
 
   *mDescriptor = YCbCrImage(shmem, 0);
 
diff --git a/gfx/layers/client/TextureClient.h b/gfx/layers/client/TextureClient.h
index 5004a55930a3..33fc9408b053 100644
--- a/gfx/layers/client/TextureClient.h
+++ b/gfx/layers/client/TextureClient.h
@@ -44,6 +44,7 @@ class TextureClientSurface
 {
 public:
   virtual bool UpdateSurface(gfxASurface* aSurface) = 0;
+  virtual already_AddRefed<gfxASurface> GetAsSurface() = 0;
   virtual bool AllocateForSurface(gfx::IntSize aSize) = 0;
 };
 
@@ -54,7 +55,9 @@ class TextureClientYCbCr
 {
 public:
   virtual bool UpdateYCbCr(const PlanarYCbCrImage::Data& aData) = 0;
-  virtual bool AllocateForYCbCr(gfx::IntSize aYSize, gfx::IntSize aCbCrSize) = 0;
+  virtual bool AllocateForYCbCr(gfx::IntSize aYSize,
+                                gfx::IntSize aCbCrSize,
+                                StereoMode aStereoMode) = 0;
 };
 
 
@@ -124,30 +127,7 @@ public:
 
   virtual bool ToSurfaceDescriptor(SurfaceDescriptor& aDescriptor) = 0;
 
-  void SetFlags(TextureFlags aFlags)
-  {
-    MOZ_ASSERT(!IsSharedWithCompositor());
-    mFlags = aFlags;
-  }
-
-  void AddFlags(TextureFlags  aFlags)
-  {
-    MOZ_ASSERT(!IsSharedWithCompositor());
-    // make sure we don't deallocate on both client and host;
-    MOZ_ASSERT(!(aFlags & TEXTURE_DEALLOCATE_CLIENT && aFlags & TEXTURE_DEALLOCATE_HOST));
-    if (aFlags & TEXTURE_DEALLOCATE_CLIENT) {
-      mFlags &= ~TEXTURE_DEALLOCATE_HOST;
-    } else if (aFlags & TEXTURE_DEALLOCATE_HOST) {
-      mFlags &= ~TEXTURE_DEALLOCATE_CLIENT;
-    }
-    mFlags |= aFlags;
-  }
-
-  void RemoveFlags(TextureFlags  aFlags)
-  {
-    MOZ_ASSERT(!IsSharedWithCompositor());
-    mFlags &= (~aFlags);
-  }
+  virtual gfx::IntSize GetSize() const = 0;
 
   TextureFlags GetFlags() const { return mFlags; }
 
@@ -164,6 +144,19 @@ public:
 
   bool ShouldDeallocateInDestructor() const;
 protected:
+  void AddFlags(TextureFlags  aFlags)
+  {
+    MOZ_ASSERT(!IsSharedWithCompositor());
+    // make sure we don't deallocate on both client and host;
+    MOZ_ASSERT(!(aFlags & TEXTURE_DEALLOCATE_CLIENT && aFlags & TEXTURE_DEALLOCATE_HOST));
+    if (aFlags & TEXTURE_DEALLOCATE_CLIENT) {
+      mFlags &= ~TEXTURE_DEALLOCATE_HOST;
+    } else if (aFlags & TEXTURE_DEALLOCATE_HOST) {
+      mFlags &= ~TEXTURE_DEALLOCATE_CLIENT;
+    }
+    mFlags |= aFlags;
+  }
+
   uint64_t mID;
   RefPtr<TextureClient> mNextSibling;
   TextureFlags mFlags;
@@ -179,7 +172,8 @@ class BufferTextureClient : public TextureClient
                           , TextureClientYCbCr
 {
 public:
-  BufferTextureClient(CompositableClient* aCompositable, gfx::SurfaceFormat aFormat);
+  BufferTextureClient(CompositableClient* aCompositable, gfx::SurfaceFormat aFormat,
+                      TextureFlags aFlags);
 
   virtual ~BufferTextureClient();
 
@@ -193,12 +187,16 @@ public:
 
   virtual size_t GetBufferSize() const = 0;
 
+  virtual gfx::IntSize GetSize() const { return mSize; }
+
   // TextureClientSurface
 
   virtual TextureClientSurface* AsTextureClientSurface() MOZ_OVERRIDE { return this; }
 
   virtual bool UpdateSurface(gfxASurface* aSurface) MOZ_OVERRIDE;
 
+  virtual already_AddRefed<gfxASurface> GetAsSurface() MOZ_OVERRIDE;
+
   virtual bool AllocateForSurface(gfx::IntSize aSize) MOZ_OVERRIDE;
 
   // TextureClientYCbCr
@@ -207,13 +205,16 @@ public:
 
   virtual bool UpdateYCbCr(const PlanarYCbCrImage::Data& aData) MOZ_OVERRIDE;
 
-  virtual bool AllocateForYCbCr(gfx::IntSize aYSize, gfx::IntSize aCbCrSize) MOZ_OVERRIDE;
+  virtual bool AllocateForYCbCr(gfx::IntSize aYSize,
+                                gfx::IntSize aCbCrSize,
+                                StereoMode aStereoMode) MOZ_OVERRIDE;
 
   gfx::SurfaceFormat GetFormat() const { return mFormat; }
 
 protected:
   CompositableClient* mCompositable;
   gfx::SurfaceFormat mFormat;
+  gfx::IntSize mSize;
 };
 
 /**
@@ -223,7 +224,8 @@ protected:
 class ShmemTextureClient : public BufferTextureClient
 {
 public:
-  ShmemTextureClient(CompositableClient* aCompositable, gfx::SurfaceFormat aFormat);
+  ShmemTextureClient(CompositableClient* aCompositable, gfx::SurfaceFormat aFormat,
+                     TextureFlags aFlags);
 
   ~ShmemTextureClient();
 
@@ -255,7 +257,8 @@ protected:
 class MemoryTextureClient : public BufferTextureClient
 {
 public:
-  MemoryTextureClient(CompositableClient* aCompositable, gfx::SurfaceFormat aFormat);
+  MemoryTextureClient(CompositableClient* aCompositable, gfx::SurfaceFormat aFormat,
+                      TextureFlags aFlags);
 
   ~MemoryTextureClient();
 
@@ -355,8 +358,9 @@ public:
   /**
    * Ensure that the texture client is suitable for the given size and content
    * type and that any initialisation has taken place.
+   * Returns true if succeeded, false if failed.
    */
-  virtual void EnsureAllocated(gfx::IntSize aSize,
+  virtual bool EnsureAllocated(gfx::IntSize aSize,
                                gfxASurface::gfxContentType aType) = 0;
 
   /**
@@ -423,13 +427,13 @@ public:
 
   virtual bool SupportsType(DeprecatedTextureClientType aType) MOZ_OVERRIDE
   {
-    return aType == TEXTURE_SHMEM || aType == TEXTURE_CONTENT;
+    return aType == TEXTURE_SHMEM || aType == TEXTURE_CONTENT || aType == TEXTURE_FALLBACK;
   }
   virtual gfxImageSurface* LockImageSurface() MOZ_OVERRIDE;
   virtual gfxASurface* LockSurface() MOZ_OVERRIDE { return GetSurface(); }
   virtual gfx::DrawTarget* LockDrawTarget();
   virtual void Unlock() MOZ_OVERRIDE;
-  virtual void EnsureAllocated(gfx::IntSize aSize, gfxASurface::gfxContentType aType) MOZ_OVERRIDE;
+  virtual bool EnsureAllocated(gfx::IntSize aSize, gfxASurface::gfxContentType aType) MOZ_OVERRIDE;
 
   virtual void ReleaseResources() MOZ_OVERRIDE;
   virtual void SetDescriptor(const SurfaceDescriptor& aDescriptor) MOZ_OVERRIDE;
@@ -457,7 +461,7 @@ public:
   ~DeprecatedTextureClientShmemYCbCr() { ReleaseResources(); }
 
   virtual bool SupportsType(DeprecatedTextureClientType aType) MOZ_OVERRIDE { return aType == TEXTURE_YCBCR; }
-  void EnsureAllocated(gfx::IntSize aSize, gfxASurface::gfxContentType aType) MOZ_OVERRIDE;
+  bool EnsureAllocated(gfx::IntSize aSize, gfxASurface::gfxContentType aType) MOZ_OVERRIDE;
   virtual void SetDescriptorFromReply(const SurfaceDescriptor& aDescriptor) MOZ_OVERRIDE;
   virtual void SetDescriptor(const SurfaceDescriptor& aDescriptor) MOZ_OVERRIDE;
   virtual void ReleaseResources();
@@ -472,7 +476,7 @@ public:
                     const TextureInfo& aTextureInfo);
   ~DeprecatedTextureClientTile();
 
-  virtual void EnsureAllocated(gfx::IntSize aSize,
+  virtual bool EnsureAllocated(gfx::IntSize aSize,
                                gfxASurface::gfxContentType aType) MOZ_OVERRIDE;
 
   virtual gfxImageSurface* LockImageSurface() MOZ_OVERRIDE;
diff --git a/gfx/layers/composite/CanvasLayerComposite.cpp b/gfx/layers/composite/CanvasLayerComposite.cpp
index 89657f50eefc..4cf674a35771 100644
--- a/gfx/layers/composite/CanvasLayerComposite.cpp
+++ b/gfx/layers/composite/CanvasLayerComposite.cpp
@@ -33,7 +33,8 @@ CanvasLayerComposite::~CanvasLayerComposite()
   CleanupResources();
 }
 
-void CanvasLayerComposite::SetCompositableHost(CompositableHost* aHost) {
+void
+CanvasLayerComposite::SetCompositableHost(CompositableHost* aHost) {
   mImageHost = aHost;
 }
 
@@ -46,7 +47,7 @@ CanvasLayerComposite::GetLayer()
 LayerRenderState
 CanvasLayerComposite::GetRenderState()
 {
-  if (mDestroyed || !mImageHost) {
+  if (mDestroyed || !mImageHost || !mImageHost->IsAttached()) {
     return LayerRenderState();
   }
   return mImageHost->GetRenderState();
@@ -56,7 +57,7 @@ void
 CanvasLayerComposite::RenderLayer(const nsIntPoint& aOffset,
                                   const nsIntRect& aClipRect)
 {
-  if (!mImageHost) {
+  if (!mImageHost || !mImageHost->IsAttached()) {
     return;
   }
 
@@ -98,8 +99,13 @@ CanvasLayerComposite::RenderLayer(const nsIntPoint& aOffset,
 }
 
 CompositableHost*
-CanvasLayerComposite::GetCompositableHost() {
-  return mImageHost.get();
+CanvasLayerComposite::GetCompositableHost()
+{
+  if (mImageHost->IsAttached()) {
+    return mImageHost.get();
+  }
+
+  return nullptr;
 }
 
 void
@@ -117,7 +123,7 @@ CanvasLayerComposite::PrintInfo(nsACString& aTo, const char* aPrefix)
 {
   CanvasLayer::PrintInfo(aTo, aPrefix);
   aTo += "\n";
-  if (mImageHost) {
+  if (mImageHost && mImageHost->IsAttached()) {
     nsAutoCString pfx(aPrefix);
     pfx += "  ";
     mImageHost->PrintInfo(aTo, pfx.get());
diff --git a/gfx/layers/composite/CompositableHost.cpp b/gfx/layers/composite/CompositableHost.cpp
index 66a343ced662..cdf114dc7dc7 100644
--- a/gfx/layers/composite/CompositableHost.cpp
+++ b/gfx/layers/composite/CompositableHost.cpp
@@ -18,6 +18,7 @@ CompositableHost::CompositableHost(const TextureInfo& aTextureInfo)
   : mTextureInfo(aTextureInfo)
   , mCompositor(nullptr)
   , mLayer(nullptr)
+  , mAttached(false)
 {
   MOZ_COUNT_CTOR(CompositableHost);
 }
diff --git a/gfx/layers/composite/CompositableHost.h b/gfx/layers/composite/CompositableHost.h
index 2ff202989012..b7d2502315b7 100644
--- a/gfx/layers/composite/CompositableHost.h
+++ b/gfx/layers/composite/CompositableHost.h
@@ -187,13 +187,18 @@ public:
   virtual void Attach(Layer* aLayer, Compositor* aCompositor)
   {
     MOZ_ASSERT(aCompositor, "Compositor is required");
+    MOZ_ASSERT(!IsAttached());
     SetCompositor(aCompositor);
     SetLayer(aLayer);
+    mAttached = true;
   }
-  void Detach() {
+  void Detach()
+  {
     SetLayer(nullptr);
     SetCompositor(nullptr);
+    mAttached = false;
   }
+  bool IsAttached() { return mAttached; }
 
   virtual void Dump(FILE* aFile=nullptr,
                     const char* aPrefix="",
@@ -219,6 +224,7 @@ protected:
   Compositor* mCompositor;
   Layer* mLayer;
   RefPtr<TextureHost> mFirstTexture;
+  bool mAttached;
 };
 
 class CompositableParentManager;
diff --git a/gfx/layers/composite/ImageLayerComposite.cpp b/gfx/layers/composite/ImageLayerComposite.cpp
index 81aee9af976f..d77bec93082a 100644
--- a/gfx/layers/composite/ImageLayerComposite.cpp
+++ b/gfx/layers/composite/ImageLayerComposite.cpp
@@ -54,7 +54,7 @@ ImageLayerComposite::Disconnect()
 LayerRenderState
 ImageLayerComposite::GetRenderState()
 {
-  if (mImageHost) {
+  if (mImageHost && mImageHost->IsAttached()) {
     return mImageHost->GetRenderState();
   }
   return LayerRenderState();
@@ -70,7 +70,7 @@ void
 ImageLayerComposite::RenderLayer(const nsIntPoint& aOffset,
                                  const nsIntRect& aClipRect)
 {
-  if (!mImageHost) {
+  if (!mImageHost || !mImageHost->IsAttached()) {
     return;
   }
 
@@ -108,7 +108,8 @@ ImageLayerComposite::ComputeEffectiveTransforms(const gfx3DMatrix& aTransformToS
   // Snap image edges to pixel boundaries
   gfxRect sourceRect(0, 0, 0, 0);
   if (mImageHost &&
-    (mImageHost->GetDeprecatedTextureHost() || mImageHost->GetTextureHost())) {
+      mImageHost->IsAttached() &&
+      (mImageHost->GetDeprecatedTextureHost() || mImageHost->GetTextureHost())) {
     IntSize size =
       mImageHost->GetTextureHost() ? mImageHost->GetTextureHost()->GetSize()
                                    : mImageHost->GetDeprecatedTextureHost()->GetSize();
@@ -132,8 +133,12 @@ ImageLayerComposite::ComputeEffectiveTransforms(const gfx3DMatrix& aTransformToS
 }
 
 CompositableHost*
-ImageLayerComposite::GetCompositableHost() {
-  return mImageHost.get();
+ImageLayerComposite::GetCompositableHost()
+{
+  if (mImageHost->IsAttached())
+    return mImageHost.get();
+
+  return nullptr;
 }
 
 void
@@ -151,7 +156,7 @@ ImageLayerComposite::PrintInfo(nsACString& aTo, const char* aPrefix)
 {
   ImageLayer::PrintInfo(aTo, aPrefix);
   aTo += "\n";
-  if (mImageHost) {
+  if (mImageHost && mImageHost->IsAttached()) {
     nsAutoCString pfx(aPrefix);
     pfx += "  ";
     mImageHost->PrintInfo(aTo, pfx.get());
diff --git a/gfx/layers/composite/LayerManagerComposite.cpp b/gfx/layers/composite/LayerManagerComposite.cpp
index f43f2a42d1e0..9ff1d5fd6349 100644
--- a/gfx/layers/composite/LayerManagerComposite.cpp
+++ b/gfx/layers/composite/LayerManagerComposite.cpp
@@ -86,6 +86,7 @@ LayerManagerComposite::ClearCachedResources(Layer* aSubtree)
 LayerManagerComposite::LayerManagerComposite(Compositor* aCompositor)
 : mCompositor(aCompositor)
 {
+  MOZ_ASSERT(aCompositor);
 }
 
 LayerManagerComposite::~LayerManagerComposite()
diff --git a/gfx/layers/composite/TextureHost.cpp b/gfx/layers/composite/TextureHost.cpp
index 3976f6efa35c..3c1091597fce 100644
--- a/gfx/layers/composite/TextureHost.cpp
+++ b/gfx/layers/composite/TextureHost.cpp
@@ -27,15 +27,11 @@ TemporaryRef<DeprecatedTextureHost> CreateBasicDeprecatedTextureHost(SurfaceDesc
                                                              uint32_t aDeprecatedTextureHostFlags,
                                                              uint32_t aTextureFlags);
 
+#ifdef XP_WIN
 TemporaryRef<DeprecatedTextureHost> CreateDeprecatedTextureHostD3D9(SurfaceDescriptorType aDescriptorType,
                                                             uint32_t aDeprecatedTextureHostFlags,
-                                                            uint32_t aTextureFlags)
-{
-  NS_RUNTIMEABORT("not implemented");
-  return nullptr;
-}
+                                                            uint32_t aTextureFlags);
 
-#ifdef XP_WIN
 TemporaryRef<DeprecatedTextureHost> CreateDeprecatedTextureHostD3D11(SurfaceDescriptorType aDescriptorType,
                                                              uint32_t aDeprecatedTextureHostFlags,
                                                              uint32_t aTextureFlags);
@@ -51,11 +47,11 @@ DeprecatedTextureHost::CreateDeprecatedTextureHost(SurfaceDescriptorType aDescri
       return CreateDeprecatedTextureHostOGL(aDescriptorType,
                                         aDeprecatedTextureHostFlags,
                                         aTextureFlags);
+#ifdef XP_WIN
     case LAYERS_D3D9:
       return CreateDeprecatedTextureHostD3D9(aDescriptorType,
                                          aDeprecatedTextureHostFlags,
                                          aTextureFlags);
-#ifdef XP_WIN
     case LAYERS_D3D11:
       return CreateDeprecatedTextureHostD3D11(aDescriptorType,
                                           aDeprecatedTextureHostFlags,
@@ -229,6 +225,9 @@ BufferTextureHost::Updated(const nsIntRegion* aRegion)
   } else {
     mPartialUpdate = false;
   }
+  if (GetFlags() & TEXTURE_IMMEDIATE_UPLOAD) {
+    MaybeUpload(mPartialUpdate ? &mMaybeUpdatedRegion : nullptr);
+  }
 }
 
 void
@@ -268,11 +267,8 @@ NewTextureSource*
 BufferTextureHost::GetTextureSources()
 {
   MOZ_ASSERT(mLocked, "should never be called while not locked");
-  if (!mFirstSource || mUpdateSerial != mFirstSource->GetUpdateSerial()) {
-    if (!Upload(mPartialUpdate ? &mMaybeUpdatedRegion : nullptr)) {
+  if (!MaybeUpload(mPartialUpdate ? &mMaybeUpdatedRegion : nullptr)) {
       return nullptr;
-    }
-    mFirstSource->SetUpdateSerial(mUpdateSerial);
   }
   return mFirstSource;
 }
@@ -293,6 +289,19 @@ BufferTextureHost::GetFormat() const
   return mFormat;
 }
 
+bool
+BufferTextureHost::MaybeUpload(nsIntRegion *aRegion)
+{
+  if (mFirstSource && mFirstSource->GetUpdateSerial() == mUpdateSerial) {
+    return true;
+  }
+  if (!Upload(aRegion)) {
+    return false;
+  }
+  mFirstSource->SetUpdateSerial(mUpdateSerial);
+  return true;
+}
+
 bool
 BufferTextureHost::Upload(nsIntRegion *aRegion)
 {
diff --git a/gfx/layers/composite/TextureHost.h b/gfx/layers/composite/TextureHost.h
index 1e39d82de223..9901b8c38b24 100644
--- a/gfx/layers/composite/TextureHost.h
+++ b/gfx/layers/composite/TextureHost.h
@@ -31,6 +31,7 @@ class Compositor;
 class SurfaceDescriptor;
 class ISurfaceAllocator;
 class TextureSourceOGL;
+class TextureSourceD3D9;
 class TextureSourceD3D11;
 class TextureSourceBasic;
 class TextureParent;
@@ -87,18 +88,11 @@ public:
   virtual gfx::SurfaceFormat GetFormat() const { return gfx::FORMAT_UNKNOWN; }
 
   /**
-   * Cast to a TextureSource for the OpenGL backend.
+   * Cast to a TextureSource for for each backend..
    */
   virtual TextureSourceOGL* AsSourceOGL() { return nullptr; }
-
-  /**
-   * Cast to a TextureSource for the D3D11 backend.
-   */
+  virtual TextureSourceD3D9* AsSourceD3D9() { return nullptr; }
   virtual TextureSourceD3D11* AsSourceD3D11() { return nullptr; }
-
-  /**
-   * Cast to a TextureSource for the software backend.
-   */
   virtual TextureSourceBasic* AsSourceBasic() { return nullptr; }
 
   /**
@@ -449,6 +443,7 @@ public:
 
 protected:
   bool Upload(nsIntRegion *aRegion = nullptr);
+  bool MaybeUpload(nsIntRegion *aRegion = nullptr);
 
   Compositor* mCompositor;
   RefPtr<DataTextureSource> mFirstSource;
diff --git a/gfx/layers/composite/ThebesLayerComposite.cpp b/gfx/layers/composite/ThebesLayerComposite.cpp
index e0b73d293a7b..3e410b8380e1 100644
--- a/gfx/layers/composite/ThebesLayerComposite.cpp
+++ b/gfx/layers/composite/ThebesLayerComposite.cpp
@@ -29,6 +29,7 @@ ThebesLayerComposite::ThebesLayerComposite(LayerManagerComposite *aManager)
   : ThebesLayer(aManager, nullptr)
   , LayerComposite(aManager)
   , mBuffer(nullptr)
+  , mRequiresTiledProperties(false)
 {
   MOZ_COUNT_CTOR(ThebesLayerComposite);
   mImplData = static_cast<LayerComposite*>(this);
@@ -37,15 +38,13 @@ ThebesLayerComposite::ThebesLayerComposite(LayerManagerComposite *aManager)
 ThebesLayerComposite::~ThebesLayerComposite()
 {
   MOZ_COUNT_DTOR(ThebesLayerComposite);
-  if (mBuffer) {
-    mBuffer->Detach();
-  }
+  CleanupResources();
 }
 
 void
 ThebesLayerComposite::SetCompositableHost(CompositableHost* aHost)
 {
-  mBuffer= static_cast<ContentHost*>(aHost);
+  mBuffer = static_cast<ContentHost*>(aHost);
 }
 
 void
@@ -58,10 +57,7 @@ void
 ThebesLayerComposite::Destroy()
 {
   if (!mDestroyed) {
-    if (mBuffer) {
-      mBuffer->Detach();
-    }
-    mBuffer = nullptr;
+    CleanupResources();
     mDestroyed = true;
   }
 }
@@ -75,13 +71,14 @@ ThebesLayerComposite::GetLayer()
 TiledLayerComposer*
 ThebesLayerComposite::GetTiledLayerComposer()
 {
+  MOZ_ASSERT(mBuffer && mBuffer->IsAttached());
   return mBuffer->AsTiledLayerComposer();
 }
 
 LayerRenderState
 ThebesLayerComposite::GetRenderState()
 {
-  if (!mBuffer || mDestroyed) {
+  if (!mBuffer || !mBuffer->IsAttached() || mDestroyed) {
     return LayerRenderState();
   }
   return mBuffer->GetRenderState();
@@ -91,10 +88,14 @@ void
 ThebesLayerComposite::RenderLayer(const nsIntPoint& aOffset,
                                   const nsIntRect& aClipRect)
 {
-  if (!mBuffer) {
+  if (!mBuffer || !mBuffer->IsAttached()) {
     return;
   }
 
+  MOZ_ASSERT(mBuffer->GetCompositor() == mCompositeManager->GetCompositor() &&
+             mBuffer->GetLayer() == this,
+             "buffer is corrupted");
+
   gfx::Matrix4x4 transform;
   ToMatrix4x4(GetEffectiveTransform(), transform);
   gfx::Rect clipRect(aClipRect.x, aClipRect.y, aClipRect.width, aClipRect.height);
@@ -145,14 +146,19 @@ ThebesLayerComposite::RenderLayer(const nsIntPoint& aOffset,
 }
 
 CompositableHost*
-ThebesLayerComposite::GetCompositableHost() {
-  return mBuffer.get();
+ThebesLayerComposite::GetCompositableHost()
+{
+  if (mBuffer->IsAttached()) {
+    return mBuffer.get();
+  }
+
+  return nullptr;
 }
 
 void
 ThebesLayerComposite::CleanupResources()
 {
-  if (mBuffer)  {
+  if (mBuffer) {
     mBuffer->Detach();
   }
   mBuffer = nullptr;
@@ -283,7 +289,7 @@ ThebesLayerComposite::PrintInfo(nsACString& aTo, const char* aPrefix)
 {
   ThebesLayer::PrintInfo(aTo, aPrefix);
   aTo += "\n";
-  if (mBuffer) {
+  if (mBuffer && mBuffer->IsAttached()) {
     nsAutoCString pfx(aPrefix);
     pfx += "  ";
     mBuffer->PrintInfo(aTo, pfx.get());
diff --git a/gfx/layers/d3d11/CompositorD3D11.cpp b/gfx/layers/d3d11/CompositorD3D11.cpp
index a6765535bdc2..5783ac4cbd0b 100644
--- a/gfx/layers/d3d11/CompositorD3D11.cpp
+++ b/gfx/layers/d3d11/CompositorD3D11.cpp
@@ -319,6 +319,7 @@ CompositorD3D11::GetTextureFactoryIdentifier()
 {
   TextureFactoryIdentifier ident;
   ident.mMaxTextureSize = GetMaxTextureSize();
+  ident.mParentProcessId = XRE_GetProcessType();
   ident.mParentBackend = LAYERS_D3D11;
   return ident;
 }
@@ -566,39 +567,47 @@ CompositorD3D11::BeginFrame(const Rect* aClipRectIn,
                             Rect* aClipRectOut,
                             Rect* aRenderBoundsOut)
 {
-  VerifyBufferSize();
   UpdateRenderTarget();
 
-  nsIntRect rect;
-  mWidget->GetClientBounds(rect);
-
-  if (rect.IsEmpty()) {
+  if (mSize.width == 0 || mSize.height == 0) {
     *aRenderBoundsOut = Rect();
     return;
   }
 
-  mDefaultRT->SetSize(IntSize(rect.width, rect.height));
-
   mContext->IASetInputLayout(mAttachments->mInputLayout);
 
   ID3D11Buffer* buffer = mAttachments->mVertexBuffer;
   UINT size = sizeof(Vertex);
   UINT offset = 0;
   mContext->IASetVertexBuffers(0, 1, &buffer, &size, &offset);
-  SetRenderTarget(mDefaultRT);
 
   if (aClipRectOut) {
-    *aClipRectOut = Rect(0, 0, rect.width, rect.height);
+    *aClipRectOut = Rect(0, 0, mSize.width, mSize.height);
   }
   if (aRenderBoundsOut) {
-    *aRenderBoundsOut = Rect(0, 0, rect.width, rect.height);
+    *aRenderBoundsOut = Rect(0, 0, mSize.width, mSize.height);
   }
 
+  D3D11_RECT scissor;
+  if (aClipRectIn) {
+    scissor.left = aClipRectIn->x;
+    scissor.right = aClipRectIn->XMost();
+    scissor.top = aClipRectIn->y;
+    scissor.bottom = aClipRectIn->YMost();
+  } else {
+    scissor.left = scissor.top = 0;
+    scissor.right = mSize.width;
+    scissor.bottom = mSize.height;
+  }
+  mContext->RSSetScissorRects(1, &scissor);
+
   FLOAT black[] = { 0, 0, 0, 0 };
   mContext->ClearRenderTargetView(mDefaultRT->mRTView, black);
 
   mContext->OMSetBlendState(mAttachments->mPremulBlendState, sBlendFactor, 0xFFFFFFFF);
   mContext->RSSetState(mAttachments->mRasterizerState);
+
+  SetRenderTarget(mDefaultRT);
 }
 
 void
@@ -640,43 +649,41 @@ CompositorD3D11::PrepareViewport(const gfx::IntSize& aSize,
   memcpy(&mVSConstants.projection, &projection, sizeof(mVSConstants.projection));
 }
 
-const nsIntSize&
-CompositorD3D11::GetWidgetSize()
+void
+CompositorD3D11::EnsureSize()
 {
   nsIntRect rect;
   mWidget->GetClientBounds(rect);
 
   mSize = rect.Size();
-
-  return mSize;
 }
 
 void
 CompositorD3D11::VerifyBufferSize()
 {
-  nsIntRect rect;
-  mWidget->GetClientBounds(rect);
-
   DXGI_SWAP_CHAIN_DESC swapDesc;
   mSwapChain->GetDesc(&swapDesc);
 
-  if ((swapDesc.BufferDesc.Width == rect.width &&
-      swapDesc.BufferDesc.Height == rect.height) || rect.IsEmpty()) {
+  if ((swapDesc.BufferDesc.Width == mSize.width &&
+       swapDesc.BufferDesc.Height == mSize.height) ||
+      mSize.width == 0 || mSize.height == 0) {
     return;
   }
 
   mDefaultRT = nullptr;
 
   if (gfxWindowsPlatform::IsOptimus()) {
-    mSwapChain->ResizeBuffers(1, rect.width, rect.height,
+    mSwapChain->ResizeBuffers(1, mSize.width, mSize.height,
                               DXGI_FORMAT_B8G8R8A8_UNORM,
                               0);
+#ifdef MOZ_METRO
   } else if (IsRunningInWindowsMetro()) {
-    mSwapChain->ResizeBuffers(2, rect.width, rect.height,
+    mSwapChain->ResizeBuffers(2, mSize.width, mSize.height,
                               DXGI_FORMAT_B8G8R8A8_UNORM,
                               0);
+#endif
   } else {
-    mSwapChain->ResizeBuffers(1, rect.width, rect.height,
+    mSwapChain->ResizeBuffers(1, mSize.width, mSize.height,
                               DXGI_FORMAT_B8G8R8A8_UNORM,
                               DXGI_SWAP_CHAIN_FLAG_GDI_COMPATIBLE);
   }
@@ -685,6 +692,9 @@ CompositorD3D11::VerifyBufferSize()
 void
 CompositorD3D11::UpdateRenderTarget()
 {
+  EnsureSize();
+  VerifyBufferSize();
+
   if (mDefaultRT) {
     return;
   }
@@ -699,6 +709,7 @@ CompositorD3D11::UpdateRenderTarget()
   }
 
   mDefaultRT = new CompositingRenderTargetD3D11(backBuf);
+  mDefaultRT->SetSize(mSize);
 }
 
 bool
@@ -706,7 +717,6 @@ CompositorD3D11::CreateShaders()
 {
   HRESULT hr;
 
-
   hr = mDevice->CreateVertexShader(LayerQuadVS,
                                    sizeof(LayerQuadVS),
                                    nullptr,
@@ -824,7 +834,7 @@ CompositorD3D11::PaintToTarget()
                         gfxASurface::ImageFormatARGB32);
 
   mTarget->SetSource(tmpSurface);
-  mTarget->SetOperator(gfxContext::OPERATOR_OVER);
+  mTarget->SetOperator(gfxContext::OPERATOR_SOURCE);
   mTarget->Paint();
 
   mContext->Unmap(readTexture, 0);
diff --git a/gfx/layers/d3d11/CompositorD3D11.h b/gfx/layers/d3d11/CompositorD3D11.h
index a985084b4ff3..77642e6db4d8 100644
--- a/gfx/layers/d3d11/CompositorD3D11.h
+++ b/gfx/layers/d3d11/CompositorD3D11.h
@@ -137,11 +137,20 @@ public:
   virtual void NotifyLayersTransaction() MOZ_OVERRIDE { }
 
   virtual nsIWidget* GetWidget() const MOZ_OVERRIDE { return mWidget; }
-  virtual const nsIntSize& GetWidgetSize() MOZ_OVERRIDE;
+  virtual const nsIntSize& GetWidgetSize() MOZ_OVERRIDE
+  {
+    NS_ASSERTION(false, "Getting the widget size on windows causes some kind of resizing of buffers. "
+                        "You should not do that outside of BeginFrame, so the best we can do is return "
+                        "the last size we got, that might not be up to date. So you probably shouldn't "
+                        "use this method.");
+    return mSize;
+  }
 
   ID3D11Device* GetDevice() { return mDevice; }
 
 private:
+  // ensure mSize is up to date with respect to mWidget
+  void EnsureSize();
   void VerifyBufferSize();
   void UpdateRenderTarget();
   bool CreateShaders();
@@ -161,9 +170,7 @@ private:
   nsRefPtr<gfxContext> mTarget;
 
   nsIWidget* mWidget;
-  // GetWidgetSize requires us to return a reference to an nsIntSize. Since we
-  // don't otherwise keep this value around, we need mSize to avoid a dangling
-  // reference problem.
+
   nsIntSize mSize;
 
   HWND mHwnd;
diff --git a/gfx/layers/d3d11/TextureD3D11.cpp b/gfx/layers/d3d11/TextureD3D11.cpp
index 021145ee104c..9e1fb6b0b29e 100644
--- a/gfx/layers/d3d11/TextureD3D11.cpp
+++ b/gfx/layers/d3d11/TextureD3D11.cpp
@@ -77,7 +77,7 @@ DeprecatedTextureClientD3D11::~DeprecatedTextureClientD3D11()
   ClearDT();
 }
 
-void
+bool
 DeprecatedTextureClientD3D11::EnsureAllocated(gfx::IntSize aSize,
                                               gfxASurface::gfxContentType aType)
 {
@@ -87,7 +87,7 @@ DeprecatedTextureClientD3D11::EnsureAllocated(gfx::IntSize aSize,
     mTexture->GetDesc(&desc);
 
     if (desc.Width == aSize.width && desc.Height == aSize.height) {
-      return;
+      return true;
     }
 
     mTexture = nullptr;
@@ -109,7 +109,7 @@ DeprecatedTextureClientD3D11::EnsureAllocated(gfx::IntSize aSize,
 
   if (FAILED(hr)) {
     LOGD3D11("Error creating texture for client!");
-    return;
+    return false;
   }
 
   RefPtr<IDXGIResource> resource;
@@ -126,6 +126,7 @@ DeprecatedTextureClientD3D11::EnsureAllocated(gfx::IntSize aSize,
                                        aType == gfxASurface::CONTENT_COLOR_ALPHA);
 
   mContentType = aType;
+  return true;
 }
 
 gfxASurface*
diff --git a/gfx/layers/d3d11/TextureD3D11.h b/gfx/layers/d3d11/TextureD3D11.h
index f870dd0f2b86..023557249d6f 100644
--- a/gfx/layers/d3d11/TextureD3D11.h
+++ b/gfx/layers/d3d11/TextureD3D11.h
@@ -77,7 +77,7 @@ public:
     return aType == TEXTURE_CONTENT;
   }
 
-  virtual void EnsureAllocated(gfx::IntSize aSize,
+  virtual bool EnsureAllocated(gfx::IntSize aSize,
                                gfxASurface::gfxContentType aType) MOZ_OVERRIDE;
 
   virtual gfxASurface* LockSurface() MOZ_OVERRIDE;
diff --git a/gfx/layers/d3d9/ColorLayerD3D9.cpp b/gfx/layers/d3d9/ColorLayerD3D9.cpp
index 1782a133d970..53127720764f 100644
--- a/gfx/layers/d3d9/ColorLayerD3D9.cpp
+++ b/gfx/layers/d3d9/ColorLayerD3D9.cpp
@@ -46,7 +46,7 @@ RenderColorLayerD3D9(ColorLayer* aLayer, LayerManagerD3D9 *aManager)
   color[2] = (float)(layerColor.b * opacity);
   color[3] = (float)(opacity);
 
-  aManager->device()->SetPixelShaderConstantF(0, color, 1);
+  aManager->device()->SetPixelShaderConstantF(CBvColor, color, 1);
 
   aManager->SetShaderMode(DeviceManagerD3D9::SOLIDCOLORLAYER,
                           aLayer->GetMaskLayer());
diff --git a/gfx/layers/d3d9/CompositorD3D9.cpp b/gfx/layers/d3d9/CompositorD3D9.cpp
new file mode 100644
index 000000000000..ff24712107c6
--- /dev/null
+++ b/gfx/layers/d3d9/CompositorD3D9.cpp
@@ -0,0 +1,592 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "CompositorD3D9.h"
+#include "LayerManagerD3D9Shaders.h"
+#include "gfxWindowsPlatform.h"
+#include "nsIWidget.h"
+#include "mozilla/layers/ImageHost.h"
+#include "mozilla/layers/ContentHost.h"
+#include "mozilla/layers/Effects.h"
+#include "nsWindowsHelpers.h"
+#include "Nv3DVUtils.h"
+#include "gfxFailure.h"
+
+using namespace mozilla::gfx;
+
+namespace mozilla {
+namespace layers {
+
+CompositorD3D9::CompositorD3D9(nsIWidget *aWidget)
+  : mWidget(aWidget)
+{
+  sBackend = LAYERS_D3D9;
+}
+
+CompositorD3D9::~CompositorD3D9()
+{
+  mSwapChain = nullptr;
+  mDeviceManager = nullptr;
+}
+
+bool
+CompositorD3D9::Initialize()
+{
+  if (!gfxPlatform::CanUseDirect3D9()) {
+    NS_WARNING("Direct3D 9-accelerated layers are not supported on this system.");
+    return false;
+  }
+
+  mDeviceManager = gfxWindowsPlatform::GetPlatform()->GetD3D9DeviceManager();
+  if (!mDeviceManager) {
+    return false;
+  }
+
+  mSwapChain = mDeviceManager->
+    CreateSwapChain((HWND)mWidget->GetNativeData(NS_NATIVE_WINDOW));
+
+  if (!mSwapChain) {
+    return false;
+  }
+
+  return true;
+}
+
+TextureFactoryIdentifier
+CompositorD3D9::GetTextureFactoryIdentifier()
+{
+  TextureFactoryIdentifier ident;
+  ident.mMaxTextureSize = GetMaxTextureSize();
+  ident.mParentBackend = LAYERS_D3D9;
+  ident.mParentProcessId = XRE_GetProcessType();
+  return ident;
+}
+
+bool
+CompositorD3D9::CanUseCanvasLayerForSize(const gfxIntSize &aSize)
+{
+  int32_t maxTextureSize = GetMaxTextureSize();
+
+  if (aSize.width > maxTextureSize || aSize.height > maxTextureSize) {
+    return false;
+  }
+
+  return true;
+}
+
+int32_t
+CompositorD3D9::GetMaxTextureSize() const
+{
+  return mDeviceManager->GetMaxTextureSize();
+}
+
+TemporaryRef<CompositingRenderTarget>
+CompositorD3D9::CreateRenderTarget(const gfx::IntRect &aRect,
+                                   SurfaceInitMode aInit)
+{
+  RefPtr<IDirect3DTexture9> texture;
+  HRESULT hr = device()->CreateTexture(aRect.width, aRect.height, 1,
+                                       D3DUSAGE_RENDERTARGET, D3DFMT_A8R8G8B8,
+                                       D3DPOOL_DEFAULT, byRef(texture),
+                                       NULL);
+  if (FAILED(hr)) {
+    ReportFailure(NS_LITERAL_CSTRING("CompositorD3D9::CreateRenderTarget: Failed to create texture"),
+                  hr);
+    return nullptr;
+  }
+
+  RefPtr<CompositingRenderTargetD3D9> rt =
+    new CompositingRenderTargetD3D9(texture, aInit, IntSize(aRect.width, aRect.height));
+
+  return rt;
+}
+
+TemporaryRef<CompositingRenderTarget>
+CompositorD3D9::CreateRenderTargetFromSource(const gfx::IntRect &aRect,
+                                             const CompositingRenderTarget *aSource)
+{
+  RefPtr<IDirect3DTexture9> texture;
+  HRESULT hr = device()->CreateTexture(aRect.width, aRect.height, 1,
+                                       D3DUSAGE_RENDERTARGET, D3DFMT_A8R8G8B8,
+                                       D3DPOOL_DEFAULT, byRef(texture),
+                                       NULL);
+  if (FAILED(hr)) {
+    ReportFailure(NS_LITERAL_CSTRING("CompositorD3D9::CreateRenderTargetFromSource: Failed to create texture"),
+                  hr);
+    return nullptr;
+  }
+
+  if (aSource) {
+    nsRefPtr<IDirect3DSurface9> sourceSurface =
+      static_cast<const CompositingRenderTargetD3D9*>(aSource)->GetD3D9Surface();
+
+    nsRefPtr<IDirect3DSurface9> destSurface;
+    hr = texture->GetSurfaceLevel(0, getter_AddRefs(destSurface));
+    if (FAILED(hr)) {
+      NS_WARNING("Failed to get texture surface level for dest.");
+    }
+
+    if (sourceSurface && destSurface) {
+      RECT sourceRect;
+      sourceRect.left = aRect.x;
+      sourceRect.right = aRect.XMost();
+      sourceRect.top = aRect.y;
+      sourceRect.bottom = aRect.YMost();
+      RECT destRect;
+      destRect.left = 0;
+      destRect.right = aRect.width;
+      destRect.top = 0;
+      destRect.bottom = aRect.height;
+
+      // copy the source to the dest
+      hr = device()->StretchRect(sourceSurface,
+                                 &sourceRect,
+                                 destSurface,
+                                 &destRect,
+                                 D3DTEXF_NONE);
+      if (FAILED(hr)) {
+        ReportFailure(NS_LITERAL_CSTRING("CompositorD3D9::CreateRenderTargetFromSource: Failed to update texture"),
+                      hr);
+      }
+    }
+  }
+
+  RefPtr<CompositingRenderTargetD3D9> rt =
+    new CompositingRenderTargetD3D9(texture,
+                                    INIT_MODE_NONE,
+                                    IntSize(aRect.width, aRect.height));
+
+  return rt;
+}
+
+void
+CompositorD3D9::SetRenderTarget(CompositingRenderTarget *aRenderTarget)
+{
+  MOZ_ASSERT(aRenderTarget);
+  RefPtr<CompositingRenderTargetD3D9> oldRT = mCurrentRT;
+  mCurrentRT = static_cast<CompositingRenderTargetD3D9*>(aRenderTarget);
+  mCurrentRT->BindRenderTarget(device());
+  PrepareViewport(mCurrentRT->GetSize(), gfxMatrix());
+}
+
+static DeviceManagerD3D9::ShaderMode
+ShaderModeForEffectType(EffectTypes aEffectType)
+{
+  switch (aEffectType) {
+  case EFFECT_SOLID_COLOR:
+    return DeviceManagerD3D9::SOLIDCOLORLAYER;
+  case EFFECT_BGRA:
+  case EFFECT_RENDER_TARGET:
+    return DeviceManagerD3D9::RGBALAYER;
+  case EFFECT_BGRX:
+    return DeviceManagerD3D9::RGBLAYER;
+  case EFFECT_YCBCR:
+    return DeviceManagerD3D9::YCBCRLAYER;
+  }
+
+  MOZ_CRASH("Bad effect type");
+}
+
+void
+CompositorD3D9::DrawQuad(const gfx::Rect &aRect, const gfx::Rect &aClipRect,
+                         const EffectChain &aEffectChain,
+                         gfx::Float aOpacity, const gfx::Matrix4x4 &aTransform,
+                         const gfx::Point &aOffset)
+{
+  MOZ_ASSERT(mCurrentRT, "No render target");
+  device()->SetVertexShaderConstantF(CBmLayerTransform, &aTransform._11, 4);
+
+  float renderTargetOffset[] = { aOffset.x, aOffset.y, 0, 0 };
+  device()->SetVertexShaderConstantF(CBvRenderTargetOffset,
+                                     renderTargetOffset,
+                                     1);
+  device()->SetVertexShaderConstantF(CBvLayerQuad,
+                                     ShaderConstantRect(aRect.x,
+                                                        aRect.y,
+                                                        aRect.width,
+                                                        aRect.height),
+                                     1);
+  bool target = false;
+
+  if (aEffectChain.mPrimaryEffect->mType != EFFECT_SOLID_COLOR) {
+    float opacity[4];
+    /*
+     * We always upload a 4 component float, but the shader will use only the
+     * first component since it's declared as a 'float'.
+     */
+    opacity[0] = aOpacity;
+    device()->SetPixelShaderConstantF(CBfLayerOpacity, opacity, 1);
+  }
+
+  bool isPremultiplied = true;
+
+  MaskType maskType = MaskNone;
+
+  if (aEffectChain.mSecondaryEffects[EFFECT_MASK]) {
+    if (aTransform.Is2D()) {
+      maskType = Mask2d;
+    } else {
+      maskType = Mask3d;
+    }
+  }
+
+  RECT scissor;
+  scissor.left = aClipRect.x;
+  scissor.right = aClipRect.XMost();
+  scissor.top = aClipRect.y;
+  scissor.bottom = aClipRect.YMost();
+  device()->SetScissorRect(&scissor);
+
+  uint32_t maskTexture = 0;
+  switch (aEffectChain.mPrimaryEffect->mType) {
+  case EFFECT_SOLID_COLOR:
+    {
+      // output color is premultiplied, so we need to adjust all channels.
+      Color layerColor =
+        static_cast<EffectSolidColor*>(aEffectChain.mPrimaryEffect.get())->mColor;
+      float color[4];
+      color[0] = layerColor.r * layerColor.a * aOpacity;
+      color[1] = layerColor.g * layerColor.a * aOpacity;
+      color[2] = layerColor.b * layerColor.a * aOpacity;
+      color[3] = layerColor.a * aOpacity;
+
+      device()->SetPixelShaderConstantF(CBvColor, color, 1);
+
+      maskTexture = mDeviceManager
+        ->SetShaderMode(DeviceManagerD3D9::SOLIDCOLORLAYER, maskType);
+    }
+    break;
+  case EFFECT_RENDER_TARGET:
+  case EFFECT_BGRX:
+  case EFFECT_BGRA:
+    {
+      TexturedEffect* texturedEffect =
+        static_cast<TexturedEffect*>(aEffectChain.mPrimaryEffect.get());
+
+      Rect textureCoords = texturedEffect->mTextureCoords;
+      device()->SetVertexShaderConstantF(CBvTextureCoords,
+                                         ShaderConstantRect(
+                                           textureCoords.x,
+                                           textureCoords.y,
+                                           textureCoords.width,
+                                           textureCoords.height),
+                                         1);
+
+      SetSamplerForFilter(texturedEffect->mFilter);
+
+      TextureSourceD3D9* source = texturedEffect->mTexture->AsSourceD3D9();
+      device()->SetTexture(0, source->GetD3D9Texture());
+
+      maskTexture = mDeviceManager
+        ->SetShaderMode(ShaderModeForEffectType(aEffectChain.mPrimaryEffect->mType),
+                        maskType);
+
+      isPremultiplied = texturedEffect->mPremultiplied;
+    }
+    break;
+  case EFFECT_YCBCR:
+    {
+      EffectYCbCr* ycbcrEffect =
+        static_cast<EffectYCbCr*>(aEffectChain.mPrimaryEffect.get());
+
+      SetSamplerForFilter(FILTER_LINEAR);
+
+      Rect textureCoords = ycbcrEffect->mTextureCoords;
+      device()->SetVertexShaderConstantF(CBvTextureCoords,
+                                         ShaderConstantRect(
+                                           textureCoords.x,
+                                           textureCoords.y,
+                                           textureCoords.width,
+                                           textureCoords.height),
+                                         1);
+                                    
+      TextureSourceD3D9* source = ycbcrEffect->mTexture->AsSourceD3D9();
+      TextureSourceD3D9::YCbCrTextures textures = source->GetYCbCrTextures();
+
+      /*
+       * Send 3d control data and metadata
+       */
+      if (mDeviceManager->GetNv3DVUtils()) {
+        Nv_Stereo_Mode mode;
+        switch (textures.mStereoMode) {
+        case STEREO_MODE_LEFT_RIGHT:
+          mode = NV_STEREO_MODE_LEFT_RIGHT;
+          break;
+        case STEREO_MODE_RIGHT_LEFT:
+          mode = NV_STEREO_MODE_RIGHT_LEFT;
+          break;
+        case STEREO_MODE_BOTTOM_TOP:
+          mode = NV_STEREO_MODE_BOTTOM_TOP;
+          break;
+        case STEREO_MODE_TOP_BOTTOM:
+          mode = NV_STEREO_MODE_TOP_BOTTOM;
+          break;
+        case STEREO_MODE_MONO:
+          mode = NV_STEREO_MODE_MONO;
+          break;
+        }
+
+        // Send control data even in mono case so driver knows to leave stereo mode.
+        mDeviceManager->GetNv3DVUtils()->SendNv3DVControl(mode, true, FIREFOX_3DV_APP_HANDLE);
+
+        if (textures.mStereoMode != STEREO_MODE_MONO) {
+          mDeviceManager->GetNv3DVUtils()->SendNv3DVControl(mode, true, FIREFOX_3DV_APP_HANDLE);
+
+          nsRefPtr<IDirect3DSurface9> renderTarget;
+          device()->GetRenderTarget(0, getter_AddRefs(renderTarget));
+          mDeviceManager->GetNv3DVUtils()->SendNv3DVMetaData((unsigned int)aRect.width,
+                                                             (unsigned int)aRect.height,
+                                                             (HANDLE)(textures.mY),
+                                                             (HANDLE)(renderTarget));
+        }
+      }
+
+      // Linear scaling is default here, adhering to mFilter is difficult since
+      // presumably even with point filtering we'll still want chroma upsampling
+      // to be linear. In the current approach we can't.
+      device()->SetTexture(0, textures.mY);
+      device()->SetTexture(1, textures.mCb);
+      device()->SetTexture(2, textures.mCr);
+      maskTexture = mDeviceManager->SetShaderMode(DeviceManagerD3D9::YCBCRLAYER, maskType);
+    }
+    break;
+  case EFFECT_COMPONENT_ALPHA:
+    {
+      EffectComponentAlpha* effectComponentAlpha =
+        static_cast<EffectComponentAlpha*>(aEffectChain.mPrimaryEffect.get());
+      TextureSourceD3D9* sourceOnWhite = effectComponentAlpha->mOnWhite->AsSourceD3D9();
+      TextureSourceD3D9* sourceOnBlack = effectComponentAlpha->mOnBlack->AsSourceD3D9();
+
+      Rect textureCoords = effectComponentAlpha->mTextureCoords;
+      device()->SetVertexShaderConstantF(CBvTextureCoords,
+                                         ShaderConstantRect(
+                                           textureCoords.x,
+                                           textureCoords.y,
+                                           textureCoords.width,
+                                           textureCoords.height),
+                                          1);
+
+      SetSamplerForFilter(effectComponentAlpha->mFilter);
+      SetMask(aEffectChain, maskTexture);
+
+      maskTexture = mDeviceManager->SetShaderMode(DeviceManagerD3D9::COMPONENTLAYERPASS1, maskType);
+      device()->SetTexture(0, sourceOnBlack->GetD3D9Texture());
+      device()->SetTexture(1, sourceOnWhite->GetD3D9Texture());
+      device()->SetRenderState(D3DRS_SRCBLEND, D3DBLEND_ZERO);
+      device()->SetRenderState(D3DRS_DESTBLEND, D3DBLEND_INVSRCCOLOR);
+      device()->SetRenderState(D3DRS_SEPARATEALPHABLENDENABLE, TRUE);
+      device()->DrawPrimitive(D3DPT_TRIANGLESTRIP, 0, 2);
+
+      maskTexture = mDeviceManager->SetShaderMode(DeviceManagerD3D9::COMPONENTLAYERPASS2, maskType);
+      device()->SetRenderState(D3DRS_SRCBLEND, D3DBLEND_ONE);
+      device()->SetRenderState(D3DRS_DESTBLEND, D3DBLEND_ONE);
+      device()->DrawPrimitive(D3DPT_TRIANGLESTRIP, 0, 2);
+
+      // Restore defaults
+      device()->SetRenderState(D3DRS_SRCBLEND, D3DBLEND_ONE);
+      device()->SetRenderState(D3DRS_DESTBLEND, D3DBLEND_INVSRCALPHA);
+      device()->SetRenderState(D3DRS_SEPARATEALPHABLENDENABLE, FALSE);
+      device()->SetTexture(1, NULL);
+    }
+    return;
+  default:
+    NS_WARNING("Unknown shader type");
+    return;
+  }
+
+  SetMask(aEffectChain, maskTexture);
+
+  if (!isPremultiplied) {
+    device()->SetRenderState(D3DRS_SRCBLEND, D3DBLEND_SRCALPHA);
+    device()->SetRenderState(D3DRS_SEPARATEALPHABLENDENABLE, TRUE);
+  }
+
+  HRESULT hr = device()->DrawPrimitive(D3DPT_TRIANGLESTRIP, 0, 2);
+
+  if (!isPremultiplied) {
+    device()->SetRenderState(D3DRS_SRCBLEND, D3DBLEND_ONE);
+    device()->SetRenderState(D3DRS_SEPARATEALPHABLENDENABLE, FALSE);
+  }
+}
+
+void
+CompositorD3D9::SetMask(const EffectChain &aEffectChain, uint32_t aMaskTexture)
+{
+  EffectMask *maskEffect =
+    static_cast<EffectMask*>(aEffectChain.mSecondaryEffects[EFFECT_MASK].get());
+  if (!maskEffect) {
+    return;
+  }
+
+  TextureSourceD3D9 *source = maskEffect->mMaskTexture->AsSourceD3D9();
+
+  MOZ_ASSERT(aMaskTexture >= 0);
+  device()->SetTexture(aMaskTexture, source->GetD3D9Texture());
+
+  const gfx::Matrix4x4& maskTransform = maskEffect->mMaskTransform;
+  NS_ASSERTION(maskTransform.Is2D(), "How did we end up with a 3D transform here?!");
+  Rect bounds = Rect(Point(), Size(maskEffect->mSize));
+  bounds = maskTransform.As2D().TransformBounds(bounds);
+
+  device()->SetVertexShaderConstantF(DeviceManagerD3D9::sMaskQuadRegister, 
+                                     ShaderConstantRect(bounds.x,
+                                                        bounds.y,
+                                                        bounds.width,
+                                                        bounds.height),
+                                     1);
+}
+
+void
+CompositorD3D9::BeginFrame(const Rect *aClipRectIn,
+                           const gfxMatrix& aTransform,
+                           const Rect& aRenderBounds,
+                           Rect *aClipRectOut,
+                           Rect *aRenderBoundsOut)
+{
+  if (!mSwapChain->PrepareForRendering()) {
+    return;
+  }
+  mDeviceManager->SetupRenderState();
+
+  EnsureSize();
+
+  device()->Clear(0, NULL, D3DCLEAR_TARGET, 0x00000000, 0, 0);
+  device()->BeginScene();
+
+  if (aClipRectOut) {
+    *aClipRectOut = Rect(0, 0, mSize.width, mSize.height);
+  }
+  if (aRenderBoundsOut) {
+    *aRenderBoundsOut = Rect(0, 0, mSize.width, mSize.height);
+  }
+
+  RECT r;
+  if (aClipRectIn) {
+    r.left = (LONG)aClipRectIn->x;
+    r.top = (LONG)aClipRectIn->y;
+    r.right = (LONG)(aClipRectIn->x + aClipRectIn->width);
+    r.bottom = (LONG)(aClipRectIn->y + aClipRectIn->height);
+  } else {
+    r.left = r.top = 0;
+    r.right = mSize.width;
+    r.bottom = mSize.height;
+  }
+  device()->SetScissorRect(&r);
+
+  nsRefPtr<IDirect3DSurface9> backBuffer = mSwapChain->GetBackBuffer();
+  mDefaultRT = new CompositingRenderTargetD3D9(backBuffer,
+                                               INIT_MODE_CLEAR,
+                                               IntSize(mSize.width, mSize.height));
+  SetRenderTarget(mDefaultRT);
+}
+
+void
+CompositorD3D9::EndFrame()
+{
+  device()->EndScene();
+
+  if (!!mTarget) {
+    PaintToTarget();
+  } else {
+    mSwapChain->Present();
+  }
+
+  mCurrentRT = nullptr;
+}
+
+void
+CompositorD3D9::PrepareViewport(const gfx::IntSize& aSize,
+                                const gfxMatrix &aWorldTransform)
+{
+  gfx3DMatrix viewMatrix;
+  /*
+   * Matrix to transform to viewport space ( <-1.0, 1.0> topleft,
+   * <1.0, -1.0> bottomright)
+   */
+  viewMatrix._11 = 2.0f / aSize.width;
+  viewMatrix._22 = -2.0f / aSize.height;
+  viewMatrix._41 = -1.0f;
+  viewMatrix._42 = 1.0f;
+
+  viewMatrix = gfx3DMatrix::From2D(aWorldTransform) * viewMatrix;
+
+  HRESULT hr = device()->SetVertexShaderConstantF(CBmProjection, &viewMatrix._11, 4);
+
+  if (FAILED(hr)) {
+    NS_WARNING("Failed to set projection matrix");
+  }
+}
+
+void
+CompositorD3D9::EnsureSize()
+{
+  nsIntRect rect;
+  mWidget->GetClientBounds(rect);
+
+  mSize = rect.Size();
+}
+
+void
+CompositorD3D9::SetSamplerForFilter(Filter aFilter)
+{
+  switch (aFilter) {
+  case FILTER_LINEAR:
+    device()->SetSamplerState(0, D3DSAMP_MAGFILTER, D3DTEXF_LINEAR);
+    device()->SetSamplerState(0, D3DSAMP_MINFILTER, D3DTEXF_LINEAR);
+    return;
+  case FILTER_POINT:
+    device()->SetSamplerState(0, D3DSAMP_MAGFILTER, D3DTEXF_POINT);
+    device()->SetSamplerState(0, D3DSAMP_MINFILTER, D3DTEXF_POINT);
+    return;
+  default:
+    device()->SetSamplerState(0, D3DSAMP_MAGFILTER, D3DTEXF_LINEAR);
+    device()->SetSamplerState(0, D3DSAMP_MINFILTER, D3DTEXF_LINEAR);
+  }
+}
+
+void
+CompositorD3D9::PaintToTarget()
+{
+  nsRefPtr<IDirect3DSurface9> backBuff;
+  nsRefPtr<IDirect3DSurface9> destSurf;
+  device()->GetRenderTarget(0, getter_AddRefs(backBuff));
+
+  D3DSURFACE_DESC desc;
+  backBuff->GetDesc(&desc);
+
+  device()->CreateOffscreenPlainSurface(desc.Width, desc.Height,
+                                        D3DFMT_A8R8G8B8, D3DPOOL_SYSTEMMEM,
+                                        getter_AddRefs(destSurf), NULL);
+
+  device()->GetRenderTargetData(backBuff, destSurf);
+
+  D3DLOCKED_RECT rect;
+  destSurf->LockRect(&rect, NULL, D3DLOCK_READONLY);
+  mTarget->SetOperator(gfxContext::OPERATOR_SOURCE);
+  nsRefPtr<gfxImageSurface> imageSurface =
+    new gfxImageSurface((unsigned char*)rect.pBits,
+                        gfxIntSize(desc.Width, desc.Height),
+                        rect.Pitch,
+                        gfxASurface::ImageFormatARGB32);
+  mTarget->SetSource(imageSurface);
+  mTarget->Paint();
+  destSurf->UnlockRect();
+}
+
+void
+CompositorD3D9::ReportFailure(const nsACString &aMsg, HRESULT aCode)
+{
+  // We could choose to abort here when hr == E_OUTOFMEMORY.
+  nsCString msg;
+  msg.Append(aMsg);
+  msg.AppendLiteral(" Error code: ");
+  msg.AppendInt(uint32_t(aCode));
+  NS_WARNING(msg.BeginReading());
+
+  gfx::LogFailure(msg);
+}
+
+}
+}
diff --git a/gfx/layers/d3d9/CompositorD3D9.h b/gfx/layers/d3d9/CompositorD3D9.h
new file mode 100644
index 000000000000..2b2e448fd4b6
--- /dev/null
+++ b/gfx/layers/d3d9/CompositorD3D9.h
@@ -0,0 +1,142 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef MOZILLA_GFX_COMPOSITORD3D9_H
+#define MOZILLA_GFX_COMPOSITORD3D9_H
+
+#include "mozilla/layers/Compositor.h"
+#include "mozilla/layers/TextureD3D9.h"
+#include "DeviceManagerD3D9.h"
+
+class nsWidget;
+
+namespace mozilla {
+namespace layers {
+
+class CompositorD3D9 : public Compositor
+{
+public:
+  CompositorD3D9(nsIWidget *aWidget);
+  ~CompositorD3D9();
+
+  virtual bool Initialize() MOZ_OVERRIDE;
+  virtual void Destroy() MOZ_OVERRIDE {}
+
+  virtual TextureFactoryIdentifier
+    GetTextureFactoryIdentifier() MOZ_OVERRIDE;
+
+  virtual bool CanUseCanvasLayerForSize(const gfxIntSize &aSize) MOZ_OVERRIDE;
+  virtual int32_t GetMaxTextureSize() const MOZ_FINAL;
+
+  virtual void SetTargetContext(gfxContext *aTarget) MOZ_OVERRIDE
+  {
+    mTarget = aTarget;
+  }
+
+  virtual void MakeCurrent(MakeCurrentFlags aFlags = 0) MOZ_OVERRIDE {}
+
+  virtual TemporaryRef<CompositingRenderTarget>
+    CreateRenderTarget(const gfx::IntRect &aRect,
+                       SurfaceInitMode aInit) MOZ_OVERRIDE;
+
+  virtual TemporaryRef<CompositingRenderTarget>
+    CreateRenderTargetFromSource(const gfx::IntRect &aRect,
+                                 const CompositingRenderTarget *aSource) MOZ_OVERRIDE;
+
+  virtual void SetRenderTarget(CompositingRenderTarget *aSurface);
+  virtual CompositingRenderTarget* GetCurrentRenderTarget() MOZ_OVERRIDE
+  {
+    return mCurrentRT;
+  }
+
+  virtual void SetDestinationSurfaceSize(const gfx::IntSize& aSize) MOZ_OVERRIDE {}
+
+  virtual void DrawQuad(const gfx::Rect &aRect, const gfx::Rect &aClipRect,
+                        const EffectChain &aEffectChain,
+                        gfx::Float aOpacity, const gfx::Matrix4x4 &aTransform,
+                        const gfx::Point &aOffset) MOZ_OVERRIDE;
+
+  virtual void BeginFrame(const gfx::Rect *aClipRectIn,
+                          const gfxMatrix& aTransform,
+                          const gfx::Rect& aRenderBounds,
+                          gfx::Rect *aClipRectOut = nullptr,
+                          gfx::Rect *aRenderBoundsOut = nullptr) MOZ_OVERRIDE;
+
+  virtual void EndFrame() MOZ_OVERRIDE;
+
+  virtual void EndFrameForExternalComposition(const gfxMatrix& aTransform) MOZ_OVERRIDE {}
+
+  virtual void AbortFrame() MOZ_OVERRIDE {}
+
+  virtual void PrepareViewport(const gfx::IntSize& aSize,
+                               const gfxMatrix& aWorldTransform) MOZ_OVERRIDE;
+
+  virtual bool SupportsPartialTextureUpdate() MOZ_OVERRIDE{ return true; }
+
+#ifdef MOZ_DUMP_PAINTING
+  virtual const char* Name() const MOZ_OVERRIDE { return "Direct3D9"; }
+#endif
+
+  virtual void NotifyLayersTransaction() MOZ_OVERRIDE {}
+
+  virtual nsIWidget* GetWidget() const MOZ_OVERRIDE { return mWidget; }
+  virtual const nsIntSize& GetWidgetSize() MOZ_OVERRIDE
+  {
+    NS_ASSERTION(false, "Getting the widget size on windows causes some kind of resizing of buffers. "
+                        "You should not do that outside of BeginFrame, so the best we can do is return "
+                        "the last size we got, that might not be up to date. So you probably shouldn't "
+                        "use this method.");
+    return mSize;
+  }
+
+  IDirect3DDevice9* device() const { return mDeviceManager->device(); }
+
+  /**
+   * Declare an offset to use when rendering layers. This will be ignored when
+   * rendering to a target instead of the screen.
+   */
+  virtual void SetScreenRenderOffset(const ScreenPoint& aOffset) MOZ_OVERRIDE
+  {
+    if (aOffset.x || aOffset.y) {
+      NS_RUNTIMEABORT("SetScreenRenderOffset not supported by CompositorD3D9.");
+    }
+    // If the offset is 0, 0 that's okay.
+  }
+
+   virtual TemporaryRef<DataTextureSource>
+     CreateDataTextureSource(TextureFlags aFlags = 0) MOZ_OVERRIDE { return nullptr; } 
+private:
+  // ensure mSize is up to date with respect to mWidget
+  void EnsureSize();
+  void SetSamplerForFilter(gfx::Filter aFilter);
+  void PaintToTarget();
+  void SetMask(const EffectChain &aEffectChain, uint32_t aMaskTexture);
+
+  void ReportFailure(const nsACString &aMsg, HRESULT aCode);
+
+  /* Device manager instance for this compositor */
+  nsRefPtr<DeviceManagerD3D9> mDeviceManager;
+
+  /* Swap chain associated with this compositor */
+  nsRefPtr<SwapChainD3D9> mSwapChain;
+
+  /* Widget associated with this layer manager */
+  nsIWidget *mWidget;
+
+  /*
+   * Context target, NULL when drawing directly to our swap chain.
+   */
+  nsRefPtr<gfxContext> mTarget;
+
+  RefPtr<CompositingRenderTargetD3D9> mDefaultRT;
+  RefPtr<CompositingRenderTargetD3D9> mCurrentRT;
+
+  nsIntSize mSize;
+};
+
+}
+}
+
+#endif
diff --git a/gfx/layers/d3d9/DeviceManagerD3D9.cpp b/gfx/layers/d3d9/DeviceManagerD3D9.cpp
index da79b8e8d538..c3abfd1eb3f7 100644
--- a/gfx/layers/d3d9/DeviceManagerD3D9.cpp
+++ b/gfx/layers/d3d9/DeviceManagerD3D9.cpp
@@ -12,6 +12,7 @@
 #include "Nv3DVUtils.h"
 #include "plstr.h"
 #include <algorithm>
+#include "gfxPlatform.h"
 
 namespace mozilla {
 namespace layers {
@@ -78,6 +79,16 @@ SwapChainD3D9::Init(HWND hWnd)
   return true;
 }
 
+already_AddRefed<IDirect3DSurface9>
+SwapChainD3D9::GetBackBuffer()
+{
+  nsRefPtr<IDirect3DSurface9> backBuffer;
+    mSwapChain->GetBackBuffer(0,
+                              D3DBACKBUFFER_TYPE_MONO,
+                              getter_AddRefs(backBuffer));
+  return backBuffer.forget();
+}
+
 bool
 SwapChainD3D9::PrepareForRendering()
 {
@@ -95,10 +106,7 @@ SwapChainD3D9::PrepareForRendering()
   }
 
   if (mSwapChain) {
-    nsRefPtr<IDirect3DSurface9> backBuffer;
-    mSwapChain->GetBackBuffer(0,
-                              D3DBACKBUFFER_TYPE_MONO,
-                              getter_AddRefs(backBuffer));
+    nsRefPtr<IDirect3DSurface9> backBuffer = GetBackBuffer();
 
     D3DSURFACE_DESC desc;
     backBuffer->GetDesc(&desc);
@@ -116,10 +124,7 @@ SwapChainD3D9::PrepareForRendering()
       return false;
     }
     
-    mSwapChain->GetBackBuffer(0,
-                              D3DBACKBUFFER_TYPE_MONO,
-                              getter_AddRefs(backBuffer));
-
+    backBuffer = GetBackBuffer();
     mDeviceManager->device()->SetRenderTarget(0, backBuffer);
     
     return true;
@@ -139,6 +144,12 @@ SwapChainD3D9::Present(const nsIntRect &aRect)
   mSwapChain->Present(&r, &r, 0, 0, 0);
 }
 
+void
+SwapChainD3D9::Present()
+{
+  mSwapChain->Present(NULL, NULL, 0, 0, 0);
+}
+
 void
 SwapChainD3D9::Reset()
 {
@@ -148,9 +159,12 @@ SwapChainD3D9::Reset()
 #define HAS_CAP(a, b) (((a) & (b)) == (b))
 #define LACKS_CAP(a, b) !(((a) & (b)) == (b))
 
+uint32_t DeviceManagerD3D9::sMaskQuadRegister = 11;
+
 DeviceManagerD3D9::DeviceManagerD3D9()
   : mDeviceResetCount(0)
   , mMaxTextureSize(0)
+  , mTextureAddressingMode(D3DTADDRESS_CLAMP)
   , mHasDynamicTextures(false)
   , mDeviceWasRemoved(false)
 {
@@ -161,9 +175,6 @@ DeviceManagerD3D9::~DeviceManagerD3D9()
   LayerManagerD3D9::OnDeviceManagerDestroy(this);
 }
 
-NS_IMPL_ADDREF(DeviceManagerD3D9)
-NS_IMPL_RELEASE(DeviceManagerD3D9)
-
 bool
 DeviceManagerD3D9::Init()
 {
@@ -496,12 +507,12 @@ DeviceManagerD3D9::SetupRenderState()
   mDevice->SetSamplerState(1, D3DSAMP_MINFILTER, D3DTEXF_LINEAR);
   mDevice->SetSamplerState(2, D3DSAMP_MAGFILTER, D3DTEXF_LINEAR);
   mDevice->SetSamplerState(2, D3DSAMP_MINFILTER, D3DTEXF_LINEAR);
-  mDevice->SetSamplerState(0, D3DSAMP_ADDRESSU, D3DTADDRESS_CLAMP);
-  mDevice->SetSamplerState(0, D3DSAMP_ADDRESSV, D3DTADDRESS_CLAMP);
-  mDevice->SetSamplerState(1, D3DSAMP_ADDRESSU, D3DTADDRESS_CLAMP);
-  mDevice->SetSamplerState(1, D3DSAMP_ADDRESSV, D3DTADDRESS_CLAMP);
-  mDevice->SetSamplerState(2, D3DSAMP_ADDRESSU, D3DTADDRESS_CLAMP);
-  mDevice->SetSamplerState(2, D3DSAMP_ADDRESSV, D3DTADDRESS_CLAMP);
+  mDevice->SetSamplerState(0, D3DSAMP_ADDRESSU, mTextureAddressingMode);
+  mDevice->SetSamplerState(0, D3DSAMP_ADDRESSV, mTextureAddressingMode);
+  mDevice->SetSamplerState(1, D3DSAMP_ADDRESSU, mTextureAddressingMode);
+  mDevice->SetSamplerState(1, D3DSAMP_ADDRESSV, mTextureAddressingMode);
+  mDevice->SetSamplerState(2, D3DSAMP_ADDRESSU, mTextureAddressingMode);
+  mDevice->SetSamplerState(2, D3DSAMP_ADDRESSV, mTextureAddressingMode);
 }
 
 already_AddRefed<SwapChainD3D9>
@@ -533,7 +544,7 @@ DeviceManagerD3D9::CreateSwapChain(HWND hWnd)
   */
 bool
 LoadMaskTexture(Layer* aMask, IDirect3DDevice9* aDevice,
-                uint32_t aMaskQuadTexture, uint32_t aMaskTexRegister)
+                uint32_t aMaskTexRegister)
 {
   gfxIntSize size;
   nsRefPtr<IDirect3DTexture9> texture =
@@ -549,7 +560,7 @@ LoadMaskTexture(Layer* aMask, IDirect3DDevice9* aDevice,
   gfxRect bounds = gfxRect(gfxPoint(), size);
   bounds = maskTransform.TransformBounds(bounds);
 
-  aDevice->SetVertexShaderConstantF(aMaskQuadTexture, 
+  aDevice->SetVertexShaderConstantF(DeviceManagerD3D9::sMaskQuadRegister, 
                                     ShaderConstantRect((float)bounds.x,
                                                        (float)bounds.y,
                                                        (float)bounds.width,
@@ -560,57 +571,10 @@ LoadMaskTexture(Layer* aMask, IDirect3DDevice9* aDevice,
   return true;
 }
 
-void
-DeviceManagerD3D9::SetShaderMode(ShaderMode aMode, Layer* aMask, bool aIs2D)
+uint32_t
+DeviceManagerD3D9::SetShaderMode(ShaderMode aMode, MaskType aMaskType)
 {
-  if (aMask) {
-    // register allocations are taken from LayerManagerD3D9Shaders.h after
-    // the shaders are compiled (genshaders.sh)
-    const uint32_t maskQuadRegister = 11;
-    uint32_t maskTexRegister;
-    switch (aMode) {
-      case RGBLAYER:
-        mDevice->SetVertexShader(mLayerVSMask);
-        mDevice->SetPixelShader(mRGBPSMask);
-        maskTexRegister = 1;
-        break;
-      case RGBALAYER:
-        if (aIs2D) {
-          mDevice->SetVertexShader(mLayerVSMask);
-          mDevice->SetPixelShader(mRGBAPSMask);
-        } else {
-          mDevice->SetVertexShader(mLayerVSMask3D);
-          mDevice->SetPixelShader(mRGBAPSMask3D);
-        }
-        maskTexRegister = 1;
-        break;
-      case COMPONENTLAYERPASS1:
-        mDevice->SetVertexShader(mLayerVSMask);
-        mDevice->SetPixelShader(mComponentPass1PSMask);
-        maskTexRegister = 2;
-        break;
-      case COMPONENTLAYERPASS2:
-        mDevice->SetVertexShader(mLayerVSMask);
-        mDevice->SetPixelShader(mComponentPass2PSMask);
-        maskTexRegister = 2;
-        break;
-      case YCBCRLAYER:
-        mDevice->SetVertexShader(mLayerVSMask);
-        mDevice->SetPixelShader(mYCbCrPSMask);
-        maskTexRegister = 3;
-        break;
-      case SOLIDCOLORLAYER:
-        mDevice->SetVertexShader(mLayerVSMask);
-        mDevice->SetPixelShader(mSolidColorPSMask);
-        maskTexRegister = 0;
-        break;
-    }
-    if (!LoadMaskTexture(aMask, mDevice, maskQuadRegister, maskTexRegister)) {
-      // if we can't load the mask, fall back to unmasked rendering
-      NS_WARNING("Could not load texture for mask layer.");
-      SetShaderMode(aMode, nullptr, true);
-    }
-  } else {
+  if (aMaskType == MaskNone) {
     switch (aMode) {
       case RGBLAYER:
         mDevice->SetVertexShader(mLayerVS);
@@ -637,6 +601,66 @@ DeviceManagerD3D9::SetShaderMode(ShaderMode aMode, Layer* aMask, bool aIs2D)
         mDevice->SetPixelShader(mSolidColorPS);
         break;
     }
+    return 0;
+  }
+
+  uint32_t maskTexRegister;
+  switch (aMode) {
+    case RGBLAYER:
+      mDevice->SetVertexShader(mLayerVSMask);
+      mDevice->SetPixelShader(mRGBPSMask);
+      maskTexRegister = 1;
+      break;
+    case RGBALAYER:
+      if (aMaskType == Mask2d) {
+        mDevice->SetVertexShader(mLayerVSMask);
+        mDevice->SetPixelShader(mRGBAPSMask);
+      } else {
+        mDevice->SetVertexShader(mLayerVSMask3D);
+        mDevice->SetPixelShader(mRGBAPSMask3D);
+      }
+      maskTexRegister = 1;
+      break;
+    case COMPONENTLAYERPASS1:
+      mDevice->SetVertexShader(mLayerVSMask);
+      mDevice->SetPixelShader(mComponentPass1PSMask);
+      maskTexRegister = 2;
+      break;
+    case COMPONENTLAYERPASS2:
+      mDevice->SetVertexShader(mLayerVSMask);
+      mDevice->SetPixelShader(mComponentPass2PSMask);
+      maskTexRegister = 2;
+      break;
+    case YCBCRLAYER:
+      mDevice->SetVertexShader(mLayerVSMask);
+      mDevice->SetPixelShader(mYCbCrPSMask);
+      maskTexRegister = 3;
+      break;
+    case SOLIDCOLORLAYER:
+      mDevice->SetVertexShader(mLayerVSMask);
+      mDevice->SetPixelShader(mSolidColorPSMask);
+      maskTexRegister = 0;
+      break;
+  }
+  return maskTexRegister;
+}
+
+void
+DeviceManagerD3D9::SetShaderMode(ShaderMode aMode, Layer* aMask, bool aIs2D)
+{
+  MaskType maskType = MaskNone;
+  if (aMask) {
+    maskType = aIs2D ? Mask2d : Mask3d;
+  }
+  uint32_t maskTexRegister = SetShaderMode(aMode, maskType);
+  if (aMask) {
+    // register allocations are taken from LayerManagerD3D9Shaders.h after
+    // the shaders are compiled (genshaders.sh)
+    if (!LoadMaskTexture(aMask, mDevice, maskTexRegister)) {
+      // if we can't load the mask, fall back to unmasked rendering
+      NS_WARNING("Could not load texture for mask layer.");
+      SetShaderMode(aMode, MaskNone);
+    }
   }
 }
 
@@ -773,6 +797,13 @@ DeviceManagerD3D9::VerifyCaps()
     mHasDynamicTextures = true;
   }
 
+  if (HAS_CAP(caps.TextureAddressCaps, D3DPTADDRESSCAPS_WRAP) &&
+      LACKS_CAP(caps.TextureCaps, D3DPTEXTURECAPS_NONPOW2CONDITIONAL)) {
+    mTextureAddressingMode = D3DTADDRESS_WRAP;
+  } else {
+    gfxPlatform::DisableBufferRotation();
+  }
+
   return true;
 }
 
diff --git a/gfx/layers/d3d9/DeviceManagerD3D9.h b/gfx/layers/d3d9/DeviceManagerD3D9.h
index 04d1a763f991..1766a86afe0d 100644
--- a/gfx/layers/d3d9/DeviceManagerD3D9.h
+++ b/gfx/layers/d3d9/DeviceManagerD3D9.h
@@ -11,6 +11,7 @@
 #include "nsAutoPtr.h"
 #include "d3d9.h"
 #include "nsTArray.h"
+#include "mozilla/layers/CompositorTypes.h"
 
 namespace mozilla {
 namespace layers {
@@ -26,7 +27,39 @@ const int CBmProjection = 4;
 const int CBvRenderTargetOffset = 8;
 const int CBvTextureCoords = 9;
 const int CBvLayerQuad = 10;
+// we don't use opacity with solid color shaders
 const int CBfLayerOpacity = 0;
+const int CBvColor = 0;
+
+/**
+ * This structure is used to pass rectangles to our shader constant. We can use
+ * this for passing rectangular areas to SetVertexShaderConstant. In the format
+ * of a 4 component float(x,y,width,height). Our vertex shader can then use
+ * this to construct rectangular positions from the 0,0-1,1 quad that we source
+ * it with.
+ */
+struct ShaderConstantRect
+{
+  float mX, mY, mWidth, mHeight;
+
+  // Provide all the commonly used argument types to prevent all the local
+  // casts in the code.
+  ShaderConstantRect(float aX, float aY, float aWidth, float aHeight)
+    : mX(aX), mY(aY), mWidth(aWidth), mHeight(aHeight)
+  { }
+
+  ShaderConstantRect(int32_t aX, int32_t aY, int32_t aWidth, int32_t aHeight)
+    : mX((float)aX), mY((float)aY)
+    , mWidth((float)aWidth), mHeight((float)aHeight)
+  { }
+
+  ShaderConstantRect(int32_t aX, int32_t aY, float aWidth, float aHeight)
+    : mX((float)aX), mY((float)aY), mWidth(aWidth), mHeight(aHeight)
+  { }
+
+  // For easy passing to SetVertexShaderConstantF.
+  operator float* () { return &mX; }
+};
 
 /**
  * SwapChain class, this class manages the swap chain belonging to a
@@ -50,11 +83,14 @@ public:
    */
   bool PrepareForRendering();
 
+  already_AddRefed<IDirect3DSurface9> GetBackBuffer();
+
   /**
    * This function will present the selected rectangle of the swap chain to
    * its associated window.
    */
   void Present(const nsIntRect &aRect);
+  void Present();
 
 private:
   friend class DeviceManagerD3D9;
@@ -83,13 +119,8 @@ class DeviceManagerD3D9 MOZ_FINAL
 {
 public:
   DeviceManagerD3D9();
-  NS_IMETHOD_(nsrefcnt) AddRef(void);
-  NS_IMETHOD_(nsrefcnt) Release(void);
-protected:
-  nsAutoRefCnt mRefCnt;
-  NS_DECL_OWNINGTHREAD
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(DeviceManagerD3D9)
 
-public:
   bool Init();
 
   /**
@@ -118,6 +149,8 @@ public:
   };
 
   void SetShaderMode(ShaderMode aMode, Layer* aMask, bool aIs2D);
+  // returns the register to be used for the mask texture, if appropriate
+  uint32_t SetShaderMode(ShaderMode aMode, MaskType aMaskType);
 
   /** 
    * Return pointer to the Nv3DVUtils instance 
@@ -139,6 +172,8 @@ public:
 
   int32_t GetMaxTextureSize() { return mMaxTextureSize; }
 
+  static uint32_t sMaskQuadRegister;
+
 private:
   friend class SwapChainD3D9;
 
@@ -222,6 +257,12 @@ private:
 
   uint32_t mMaxTextureSize;
 
+  /**
+   * Wrap (repeat) or clamp textures. We prefer the former so we can do buffer
+   * rotation, but some older hardware doesn't support it.
+   */
+  D3DTEXTUREADDRESS mTextureAddressingMode;
+
   /* If this device supports dynamic textures */
   bool mHasDynamicTextures;
 
diff --git a/gfx/layers/d3d9/LayerManagerD3D9.h b/gfx/layers/d3d9/LayerManagerD3D9.h
index 358e9c7b2dd1..bf01285e3bc4 100644
--- a/gfx/layers/d3d9/LayerManagerD3D9.h
+++ b/gfx/layers/d3d9/LayerManagerD3D9.h
@@ -22,36 +22,6 @@ namespace layers {
 class LayerD3D9;
 class ThebesLayerD3D9;
 
-/**
- * This structure is used to pass rectangles to our shader constant. We can use
- * this for passing rectangular areas to SetVertexShaderConstant. In the format
- * of a 4 component float(x,y,width,height). Our vertex shader can then use
- * this to construct rectangular positions from the 0,0-1,1 quad that we source
- * it with.
- */
-struct ShaderConstantRect
-{
-  float mX, mY, mWidth, mHeight;
-
-  // Provide all the commonly used argument types to prevent all the local
-  // casts in the code.
-  ShaderConstantRect(float aX, float aY, float aWidth, float aHeight)
-    : mX(aX), mY(aY), mWidth(aWidth), mHeight(aHeight)
-  { }
-
-  ShaderConstantRect(int32_t aX, int32_t aY, int32_t aWidth, int32_t aHeight)
-    : mX((float)aX), mY((float)aY)
-    , mWidth((float)aWidth), mHeight((float)aHeight)
-  { }
-
-  ShaderConstantRect(int32_t aX, int32_t aY, float aWidth, float aHeight)
-    : mX((float)aX), mY((float)aY), mWidth(aWidth), mHeight(aHeight)
-  { }
-
-  // For easy passing to SetVertexShaderConstantF.
-  operator float* () { return &mX; }
-};
-
 /*
  * This is the LayerManager used for Direct3D 9. For now this will render on
  * the main thread.
diff --git a/gfx/layers/d3d9/TextureD3D9.cpp b/gfx/layers/d3d9/TextureD3D9.cpp
new file mode 100644
index 000000000000..92402cac7217
--- /dev/null
+++ b/gfx/layers/d3d9/TextureD3D9.cpp
@@ -0,0 +1,628 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "TextureD3D9.h"
+#include "CompositorD3D9.h"
+#include "gfxContext.h"
+#include "gfxImageSurface.h"
+#include "Effects.h"
+#include "ipc/AutoOpenSurface.h"
+#include "mozilla/layers/YCbCrImageDataSerializer.h"
+#include "gfxWindowsPlatform.h"
+
+using namespace mozilla::gfx;
+
+namespace mozilla {
+namespace layers {
+
+TemporaryRef<DeprecatedTextureHost>
+CreateDeprecatedTextureHostD3D9(SurfaceDescriptorType aDescriptorType,
+                      uint32_t aDeprecatedTextureHostFlags,
+                      uint32_t aTextureFlags)
+{
+  RefPtr<DeprecatedTextureHost> result;
+  if (aDescriptorType == SurfaceDescriptor::TYCbCrImage) {
+    result = new DeprecatedTextureHostYCbCrD3D9();
+  } else if (aDescriptorType == SurfaceDescriptor::TSurfaceDescriptorD3D9) {
+    result = new DeprecatedTextureHostSystemMemD3D9();
+  } else {
+    result = new DeprecatedTextureHostShmemD3D9();
+  }
+
+  result->SetFlags(aTextureFlags);
+
+  return result.forget();
+}
+
+
+CompositingRenderTargetD3D9::CompositingRenderTargetD3D9(IDirect3DTexture9* aTexture,
+                                                         SurfaceInitMode aInit,
+                                                         const gfx::IntSize& aSize)
+  : mInitMode(aInit)
+  , mInitialized(false)
+{
+  MOZ_COUNT_CTOR(CompositingRenderTargetD3D9);
+  MOZ_ASSERT(aTexture);
+
+  mTextures[0] = aTexture;
+  HRESULT hr = mTextures[0]->GetSurfaceLevel(0, getter_AddRefs(mSurface));
+  NS_ASSERTION(mSurface, "Couldn't create surface for texture");
+  TextureSourceD3D9::SetSize(aSize);
+}
+
+CompositingRenderTargetD3D9::CompositingRenderTargetD3D9(IDirect3DSurface9* aSurface,
+                                                         SurfaceInitMode aInit,
+                                                         const gfx::IntSize& aSize)
+  : mSurface(aSurface)
+  , mInitMode(aInit)
+  , mInitialized(false)
+{
+  MOZ_COUNT_CTOR(CompositingRenderTargetD3D9);
+  MOZ_ASSERT(mSurface);
+  TextureSourceD3D9::SetSize(aSize);
+}
+
+CompositingRenderTargetD3D9::~CompositingRenderTargetD3D9()
+{
+  MOZ_COUNT_DTOR(CompositingRenderTargetD3D9);
+}
+
+void
+CompositingRenderTargetD3D9::BindRenderTarget(IDirect3DDevice9* aDevice)
+{
+  aDevice->SetRenderTarget(0, mSurface);
+  if (!mInitialized &&
+      mInitMode == INIT_MODE_CLEAR) {
+    mInitialized = true;
+    aDevice->Clear(0, 0, D3DCLEAR_TARGET, D3DCOLOR_RGBA(0, 0, 0, 0), 0, 0);
+  }
+}
+
+IntSize
+CompositingRenderTargetD3D9::GetSize() const
+{
+  return TextureSourceD3D9::GetSize();
+}
+
+DeprecatedTextureHostD3D9::DeprecatedTextureHostD3D9()
+  : mIsTiled(false)
+  , mCurrentTile(0)
+  , mIterating(false)
+{
+  MOZ_COUNT_CTOR(DeprecatedTextureHostD3D9);
+}
+
+DeprecatedTextureHostD3D9::~DeprecatedTextureHostD3D9()
+{
+  MOZ_COUNT_DTOR(DeprecatedTextureHostD3D9);
+}
+
+IntSize
+DeprecatedTextureHostD3D9::GetSize() const
+{
+  if (mIterating) {
+    gfx::IntRect rect = GetTileRect(mCurrentTile);
+    return gfx::IntSize(rect.width, rect.height);
+  }
+  return TextureSourceD3D9::GetSize();
+}
+
+nsIntRect
+DeprecatedTextureHostD3D9::GetTileRect()
+{
+  IntRect rect = GetTileRect(mCurrentTile);
+  return nsIntRect(rect.x, rect.y, rect.width, rect.height);
+}
+
+static uint32_t GetRequiredTiles(uint32_t aSize, uint32_t aMaxSize)
+{
+  uint32_t requiredTiles = aSize / aMaxSize;
+  if (aSize % aMaxSize) {
+    requiredTiles++;
+  }
+  return requiredTiles;
+}
+
+void
+DeprecatedTextureHostD3D9::SetCompositor(Compositor* aCompositor)
+{
+  mCompositor = static_cast<CompositorD3D9*>(aCompositor);
+  mDevice = mCompositor ? mCompositor->device() : nullptr;
+}
+
+static TemporaryRef<IDirect3DTexture9>
+DataToTexture(IDirect3DDevice9 *aDevice,
+              unsigned char *aData,
+              int aStride,
+              const gfxIntSize &aSize,
+              _D3DFORMAT aFormat,
+              uint32_t aBPP)
+{
+  RefPtr<IDirect3DTexture9> texture;
+  nsRefPtr<IDirect3DDevice9Ex> deviceEx;
+  aDevice->QueryInterface(IID_IDirect3DDevice9Ex,
+                          (void**)getter_AddRefs(deviceEx));
+
+  RefPtr<IDirect3DSurface9> surface;
+  D3DLOCKED_RECT lockedRect;
+  if (deviceEx) {
+    // D3D9Ex doesn't support managed textures. We could use dynamic textures
+    // here but since Images are immutable that probably isn't such a great
+    // idea.
+    if (FAILED(aDevice->
+               CreateTexture(aSize.width, aSize.height,
+                             1, 0, aFormat, D3DPOOL_DEFAULT,
+                             byRef(texture), nullptr)))
+    {
+      return nullptr;
+    }
+
+    RefPtr<IDirect3DTexture9> tmpTexture;
+    if (FAILED(aDevice->
+               CreateTexture(aSize.width, aSize.height,
+                             1, 0, aFormat, D3DPOOL_SYSTEMMEM,
+                             byRef(tmpTexture), nullptr)))
+    {
+      return nullptr;
+    }
+
+    tmpTexture->GetSurfaceLevel(0, byRef(surface));
+    surface->LockRect(&lockedRect, NULL, 0);
+    NS_ASSERTION(lockedRect.pBits, "Could not lock surface");
+  } else {
+    if (FAILED(aDevice->
+               CreateTexture(aSize.width, aSize.height,
+                             1, 0, aFormat, D3DPOOL_MANAGED,
+                             byRef(texture), nullptr))) {
+      return nullptr;
+    }
+
+    /* lock the entire texture */
+    texture->LockRect(0, &lockedRect, nullptr, 0);
+  }
+
+  uint32_t width = aSize.width * aBPP;
+
+  for (int y = 0; y < aSize.height; y++) {
+    memcpy((char*)lockedRect.pBits + lockedRect.Pitch * y,
+            aData + aStride * y,
+            width);
+  }
+
+  if (deviceEx) {
+    surface->UnlockRect();
+    nsRefPtr<IDirect3DSurface9> dstSurface;
+    texture->GetSurfaceLevel(0, getter_AddRefs(dstSurface));
+    aDevice->UpdateSurface(surface, NULL, dstSurface, NULL);
+  } else {
+    texture->UnlockRect(0);
+  }
+
+  return texture.forget();
+}
+
+void
+DeprecatedTextureHostShmemD3D9::UpdateImpl(const SurfaceDescriptor& aImage,
+                                 nsIntRegion *aRegion,
+                                 nsIntPoint *aOffset)
+{
+  MOZ_ASSERT(aImage.type() == SurfaceDescriptor::TShmem ||
+             aImage.type() == SurfaceDescriptor::TMemoryImage);
+  MOZ_ASSERT(mCompositor, "Must have compositor to update.");
+
+  AutoOpenSurface openSurf(OPEN_READ_ONLY, aImage);
+
+  nsRefPtr<gfxImageSurface> surf = openSurf.GetAsImage();
+
+  gfxIntSize size = surf->GetSize();
+  mSize = IntSize(size.width, size.height);
+
+  uint32_t bpp = 0;
+
+  _D3DFORMAT format = D3DFMT_A8R8G8B8;
+  switch (surf->Format()) {
+  case gfxImageSurface::ImageFormatRGB24:
+    mFormat = FORMAT_B8G8R8X8;
+    format = D3DFMT_X8R8G8B8;
+    bpp = 4;
+    break;
+  case gfxImageSurface::ImageFormatARGB32:
+    mFormat = FORMAT_B8G8R8A8;
+    format = D3DFMT_A8R8G8B8;
+    bpp = 4;
+    break;
+  case gfxImageSurface::ImageFormatA8:
+    mFormat = FORMAT_A8;
+    format = D3DFMT_A8;
+    bpp = 1;
+    break;
+  default:
+    NS_ERROR("Bad image format");
+  }
+
+  int32_t maxSize = mCompositor->GetMaxTextureSize();
+  if (size.width <= maxSize && size.height <= maxSize) {
+    mTextures[0] = DataToTexture(mDevice,
+                                 surf->Data(), surf->Stride(),
+                                 size, format, bpp);
+    NS_ASSERTION(mTextures[0], "Could not upload texture");
+    mIsTiled = false;
+  } else {
+    mIsTiled = true;
+    uint32_t tileCount = GetRequiredTiles(size.width, maxSize) *
+                         GetRequiredTiles(size.height, maxSize);
+    mTileTextures.resize(tileCount);
+
+    for (uint32_t i = 0; i < tileCount; i++) {
+      IntRect tileRect = GetTileRect(i);
+      unsigned char* data = surf->Data() +
+                            tileRect.y * surf->Stride() +
+                            tileRect.x * bpp;
+      mTileTextures[i] = DataToTexture(mDevice,
+                                       data,
+                                       surf->Stride(),
+                                       gfxIntSize(tileRect.width, tileRect.height),
+                                       format,
+                                       bpp);
+    }
+  }
+}
+
+IntRect
+DeprecatedTextureHostD3D9::GetTileRect(uint32_t aID) const
+{
+  uint32_t maxSize = mCompositor->GetMaxTextureSize();
+  uint32_t horizontalTiles = GetRequiredTiles(mSize.width, maxSize);
+  uint32_t verticalTiles = GetRequiredTiles(mSize.height, maxSize);
+
+  uint32_t verticalTile = aID / horizontalTiles;
+  uint32_t horizontalTile = aID % horizontalTiles;
+
+  return IntRect(horizontalTile * maxSize,
+                 verticalTile * maxSize,
+                 horizontalTile < (horizontalTiles - 1) ? maxSize : mSize.width % maxSize,
+                 verticalTile < (verticalTiles - 1) ? maxSize : mSize.height % maxSize);
+}
+
+void
+DeprecatedTextureHostYCbCrD3D9::SetCompositor(Compositor* aCompositor)
+{
+  CompositorD3D9 *d3dCompositor = static_cast<CompositorD3D9*>(aCompositor);
+  mDevice = d3dCompositor ? d3dCompositor->device() : nullptr;
+}
+
+IntSize
+DeprecatedTextureHostYCbCrD3D9::GetSize() const
+{
+  return TextureSourceD3D9::GetSize();
+}
+
+void
+DeprecatedTextureHostYCbCrD3D9::UpdateImpl(const SurfaceDescriptor& aImage,
+                                 nsIntRegion *aRegion,
+                                 nsIntPoint *aOffset)
+{
+  MOZ_ASSERT(aImage.type() == SurfaceDescriptor::TYCbCrImage);
+
+  YCbCrImageDataDeserializer yuvDeserializer(aImage.get_YCbCrImage().data().get<uint8_t>());
+
+  gfxIntSize gfxCbCrSize = yuvDeserializer.GetCbCrSize();
+  gfxIntSize size = yuvDeserializer.GetYSize();
+  mSize = IntSize(size.width, size.height);
+  mStereoMode = yuvDeserializer.GetStereoMode();
+
+  mTextures[0] = DataToTexture(mDevice,
+                               yuvDeserializer.GetYData(),
+                               yuvDeserializer.GetYStride(),
+                               size,
+                               D3DFMT_L8, 1);
+  mTextures[1] = DataToTexture(mDevice,
+                               yuvDeserializer.GetCbData(),
+                               yuvDeserializer.GetCbCrStride(),
+                               gfxCbCrSize,
+                               D3DFMT_L8, 1);
+  mTextures[2] = DataToTexture(mDevice,
+                               yuvDeserializer.GetCrData(),
+                               yuvDeserializer.GetCbCrStride(),
+                               gfxCbCrSize,
+                               D3DFMT_L8, 1);
+}
+
+// aTexture should be in SYSTEMMEM, returns a texture in the default
+// pool (that is, in video memory).
+static TemporaryRef<IDirect3DTexture9>
+TextureToTexture(IDirect3DDevice9* aDevice,
+                 IDirect3DTexture9* aTexture,
+                 const IntSize& aSize,
+                 _D3DFORMAT aFormat)
+{
+  RefPtr<IDirect3DTexture9> texture;
+  if (FAILED(aDevice->
+              CreateTexture(aSize.width, aSize.height,
+                            1, 0, aFormat, D3DPOOL_DEFAULT,
+                            byRef(texture), nullptr))) {
+    return nullptr;
+  }
+
+  HRESULT hr = aDevice->UpdateTexture(aTexture, texture);
+  if (FAILED(hr)) {
+    return nullptr;
+  }
+
+  return texture.forget();
+}
+
+void
+DeprecatedTextureHostSystemMemD3D9::UpdateImpl(const SurfaceDescriptor& aImage,
+                                     nsIntRegion *aRegion,
+                                     nsIntPoint *aOffset)
+{
+  MOZ_ASSERT(aImage.type() == SurfaceDescriptor::TSurfaceDescriptorD3D9);
+  MOZ_ASSERT(mCompositor, "Must have compositor to update.");
+
+  IDirect3DTexture9* texture =
+    reinterpret_cast<IDirect3DTexture9*>(aImage.get_SurfaceDescriptorD3D9().texture());
+
+  if (!texture) {
+    mTextures[0] = nullptr;
+    return;
+  }
+
+  D3DSURFACE_DESC desc;
+  texture->GetLevelDesc(0, &desc);
+  mSize.width = desc.Width;
+  mSize.height = desc.Height;
+
+  _D3DFORMAT format = desc.Format;
+  uint32_t bpp = 0;
+  switch (format) {
+  case D3DFMT_X8R8G8B8:
+    mFormat = FORMAT_B8G8R8X8;
+    bpp = 4;
+    break;
+  case D3DFMT_A8R8G8B8:
+    mFormat = FORMAT_B8G8R8A8;
+    bpp = 4;
+    break;
+  case D3DFMT_A8:
+    mFormat = FORMAT_A8;
+    bpp = 1;
+    break;
+  default:
+    NS_ERROR("Bad image format");
+  }
+
+  int32_t maxSize = mCompositor->GetMaxTextureSize();
+  if (mSize.width <= maxSize && mSize.height <= maxSize) {
+    mIsTiled = false;
+
+    mTextures[0] = TextureToTexture(mDevice, texture, mSize, format);
+    NS_ASSERTION(mTextures[0], "Could not upload texture");
+  } else {
+    mIsTiled = true;
+
+    uint32_t tileCount = GetRequiredTiles(mSize.width, maxSize) *
+                         GetRequiredTiles(mSize.height, maxSize);
+    mTileTextures.resize(tileCount);
+
+    for (uint32_t i = 0; i < tileCount; i++) {
+      IntRect tileRect = GetTileRect(i);
+      RECT d3dTileRect;
+      d3dTileRect.left = tileRect.x;
+      d3dTileRect.top = tileRect.y;
+      d3dTileRect.right = tileRect.XMost();
+      d3dTileRect.bottom = tileRect.YMost();
+      D3DLOCKED_RECT lockedRect;
+      texture->LockRect(0, &lockedRect, &d3dTileRect, 0);
+      mTileTextures[i] = DataToTexture(mDevice,
+                                       reinterpret_cast<unsigned char*>(lockedRect.pBits),
+                                       lockedRect.Pitch,
+                                       gfxIntSize(tileRect.width, tileRect.height),
+                                       format,
+                                       bpp);
+      texture->UnlockRect(0);
+    }
+  }
+}
+
+DeprecatedTextureClientD3D9::DeprecatedTextureClientD3D9(CompositableForwarder* aCompositableForwarder,
+                                     const TextureInfo& aTextureInfo)
+  : DeprecatedTextureClient(aCompositableForwarder, aTextureInfo)
+  , mDC(nullptr)
+  , mTextureLocked(false)
+{
+  MOZ_COUNT_CTOR(DeprecatedTextureClientD3D9);
+}
+
+DeprecatedTextureClientD3D9::~DeprecatedTextureClientD3D9()
+{
+  MOZ_COUNT_DTOR(DeprecatedTextureClientD3D9);
+  Unlock();
+  mDescriptor = SurfaceDescriptor();
+
+  ClearDT();
+}
+
+bool
+DeprecatedTextureClientD3D9::EnsureAllocated(gfx::IntSize aSize,
+                                   gfxASurface::gfxContentType aType)
+{
+  if (mTexture) {
+    D3DSURFACE_DESC desc;
+    mTexture->GetLevelDesc(0, &desc);
+
+    if (desc.Width == aSize.width &&
+        desc.Height == aSize.height) {
+      return true;
+    }
+
+    Unlock();
+    mD3D9Surface = nullptr;
+    mTexture = nullptr;
+  }
+
+  mSize = aSize;
+
+  _D3DFORMAT format = D3DFMT_A8R8G8B8;
+  switch (aType) {
+  case gfxASurface::CONTENT_COLOR:
+    format = D3DFMT_X8R8G8B8;
+    mIsOpaque = true;
+    break;
+  case gfxASurface::CONTENT_COLOR_ALPHA:
+    format = D3DFMT_A8R8G8B8;
+    mIsOpaque = false;
+    break;
+  case gfxASurface::CONTENT_ALPHA:
+    format = D3DFMT_A8;
+    mIsOpaque = true;
+    break;
+  default:
+    NS_ERROR("Bad image type");
+  }
+
+  IDirect3DDevice9 *device = gfxWindowsPlatform::GetPlatform()->GetD3D9Device();
+  if (!device ||
+      FAILED(device->
+               CreateTexture(aSize.width, aSize.height,
+                             1, 0, format, D3DPOOL_SYSTEMMEM,
+                             getter_AddRefs(mTexture), nullptr)))
+  {
+    NS_WARNING("Could not create texture");
+    return false;
+  }
+
+  MOZ_ASSERT(mTexture);
+  mDescriptor = SurfaceDescriptorD3D9(reinterpret_cast<uintptr_t>(mTexture.get()));
+
+  if (!mIsOpaque) {
+    nsRefPtr<gfxASurface> surface = LockSurface();
+    nsRefPtr<gfxContext> ctx = new gfxContext(surface);
+    ctx->SetOperator(gfxContext::OPERATOR_SOURCE);
+    ctx->SetColor(gfxRGBA(0.0, 0.0, 0.0, 0.0));
+    ctx->Paint();
+    Unlock();
+  }
+
+  mContentType = aType;
+  return true;
+}
+
+gfxASurface*
+DeprecatedTextureClientD3D9::LockSurface()
+{
+  if (mSurface) {
+    return mSurface.get();
+  }
+
+  MOZ_ASSERT(mTexture, "Cannot lock surface without a texture to lock");
+
+  if (mIsOpaque) {
+    MOZ_ASSERT(!mTextureLocked, "Shouldn't lock texture and have a surface");
+    if (!mD3D9Surface) {
+      HRESULT hr = mTexture->GetSurfaceLevel(0, getter_AddRefs(mD3D9Surface));
+      if (FAILED(hr)) {
+        NS_WARNING("Failed to get texture surface level.");
+        return nullptr;
+      }
+    }
+
+    if (!mDC) {
+      HRESULT hr = mD3D9Surface->GetDC(&mDC);
+      if (FAILED(hr)) {
+        NS_WARNING("Failed to get device context for texture surface.");
+        return nullptr;
+      }
+    }
+    NS_ASSERTION(mDC, "We need a DC here");
+    mSurface = new gfxWindowsSurface(mDC);
+  } else {
+    // d3d9 SYSTEMMEM surfaces do not support GDI with an alpha channel
+    MOZ_ASSERT(!mD3D9Surface && !mDC, "Shouldn't lock texture and have a surface");
+    if (!mTextureLocked) {
+      D3DLOCKED_RECT lockedRect;
+      mTexture->LockRect(0, &lockedRect, nullptr, 0);
+      mTextureLocked = true;
+
+      mSurface = new gfxImageSurface(reinterpret_cast<unsigned char*>(lockedRect.pBits),
+                                     gfxIntSize(mSize.width, mSize.height),
+                                     lockedRect.Pitch,
+                                     gfxASurface::ImageFormatARGB32);
+    }
+  }
+
+  NS_ASSERTION(mSurface, "should have a surface one way or the other");
+  return mSurface.get();
+}
+
+DrawTarget*
+DeprecatedTextureClientD3D9::LockDrawTarget()
+{
+  if (!mDrawTarget) {
+    mDrawTarget =
+      gfxPlatform::GetPlatform()->CreateDrawTargetForSurface(LockSurface(), mSize);
+  }
+
+  return mDrawTarget.get();
+}
+
+void
+DeprecatedTextureClientD3D9::Unlock()
+{
+  if (mDrawTarget) {
+    mDrawTarget->Flush();
+    mDrawTarget = nullptr;
+  }
+
+  if (mTextureLocked) {
+    MOZ_ASSERT(!mD3D9Surface && !mDC, "Shouldn't lock texture and have a surface");
+    mTexture->UnlockRect(0);
+    mTextureLocked = false;
+  } else if (mDC) {
+    MOZ_ASSERT(mD3D9Surface, "we need a D3D9Surface to release our DC");
+    MOZ_ASSERT(!mTextureLocked, "Shouldn't lock texture and have a surface");
+    mD3D9Surface->ReleaseDC(mDC);
+    mDC = nullptr;
+  }
+
+  if (mSurface) {
+    mSurface = nullptr;
+  }
+}
+
+void
+DeprecatedTextureClientD3D9::SetDescriptor(const SurfaceDescriptor& aDescriptor)
+{
+  if (aDescriptor.type() == SurfaceDescriptor::Tnull_t) {
+    EnsureAllocated(mSize, mContentType);
+    return;
+  }
+
+  mDescriptor = aDescriptor;
+  mSurface = nullptr;
+  ClearDT();
+
+  if (aDescriptor.type() == SurfaceDescriptor::T__None) {
+    return;
+  }
+
+  MOZ_ASSERT(aDescriptor.type() == SurfaceDescriptor::TSurfaceDescriptorD3D9);
+  Unlock();
+  mD3D9Surface = nullptr;
+  mTexture = reinterpret_cast<IDirect3DTexture9*>(
+               mDescriptor.get_SurfaceDescriptorD3D9().texture());
+}
+
+void
+DeprecatedTextureClientD3D9::ClearDT()
+{
+  // Perhaps this should be debug only.
+  if (mDrawTarget) {
+    mDrawTarget = nullptr;
+  }
+}
+
+}
+}
diff --git a/gfx/layers/d3d9/TextureD3D9.h b/gfx/layers/d3d9/TextureD3D9.h
new file mode 100644
index 000000000000..d61fb60be083
--- /dev/null
+++ b/gfx/layers/d3d9/TextureD3D9.h
@@ -0,0 +1,260 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef MOZILLA_GFX_TEXTURED3D9_H
+#define MOZILLA_GFX_TEXTURED3D9_H
+
+#include "mozilla/layers/Compositor.h"
+#include "mozilla/layers/TextureClient.h"
+#include "mozilla/layers/TextureHost.h"
+#include "gfxWindowsPlatform.h"
+#include "d3d9.h"
+#include <vector>
+
+namespace mozilla {
+namespace layers {
+
+class CompositorD3D9;
+
+class TextureSourceD3D9
+{
+public:
+  virtual IDirect3DTexture9* GetD3D9Texture() { return mTextures[0]; }
+  virtual bool IsYCbCrSource() const { return false; }
+
+  struct YCbCrTextures
+  {
+    IDirect3DTexture9 *mY;
+    IDirect3DTexture9 *mCb;
+    IDirect3DTexture9 *mCr;
+    StereoMode mStereoMode;
+  };
+
+  virtual YCbCrTextures GetYCbCrTextures() {
+    YCbCrTextures textures = { mTextures[0],
+                               mTextures[1],
+                               mTextures[2],
+                               mStereoMode };
+    return textures;
+  }
+
+protected:
+  virtual gfx::IntSize GetSize() const { return mSize; }
+  void SetSize(const gfx::IntSize& aSize) { mSize = aSize; }
+
+  gfx::IntSize mSize;
+  StereoMode mStereoMode;
+  RefPtr<IDirect3DTexture9> mTextures[3];
+};
+
+class CompositingRenderTargetD3D9 : public CompositingRenderTarget,
+                                    public TextureSourceD3D9
+{
+public:
+  CompositingRenderTargetD3D9(IDirect3DTexture9* aTexture,
+                              SurfaceInitMode aInit,
+                              const gfx::IntSize& aSize);
+  // use for rendering to the main window, cannot be rendered as a texture
+  CompositingRenderTargetD3D9(IDirect3DSurface9* aSurface,
+                              SurfaceInitMode aInit,
+                              const gfx::IntSize& aSize);
+  ~CompositingRenderTargetD3D9();
+
+  virtual TextureSourceD3D9* AsSourceD3D9() MOZ_OVERRIDE
+  {
+    MOZ_ASSERT(mTextures[0],
+               "No texture, can't be indirectly rendered. Is this the screen backbuffer?");
+    return this;
+  }
+
+  virtual gfx::IntSize GetSize() const MOZ_OVERRIDE;
+
+  void BindRenderTarget(IDirect3DDevice9* aDevice);
+
+  IDirect3DSurface9* GetD3D9Surface() const { return mSurface; }
+
+private:
+  friend class CompositorD3D9;
+
+  nsRefPtr<IDirect3DSurface9> mSurface;
+  SurfaceInitMode mInitMode;
+  bool mInitialized;
+};
+
+// Shared functionality for non-YCbCr texture hosts
+class DeprecatedTextureHostD3D9 : public DeprecatedTextureHost
+                      , public TextureSourceD3D9
+                      , public TileIterator
+{
+public:
+  DeprecatedTextureHostD3D9();
+  virtual ~DeprecatedTextureHostD3D9();
+
+  virtual void SetCompositor(Compositor* aCompositor) MOZ_OVERRIDE;
+
+  virtual TextureSourceD3D9* AsSourceD3D9() MOZ_OVERRIDE { return this; }
+
+  virtual IDirect3DTexture9 *GetD3D9Texture() MOZ_OVERRIDE {
+    return mIsTiled ? mTileTextures[mCurrentTile].get()
+                    : TextureSourceD3D9::GetD3D9Texture();
+  }
+
+  virtual gfx::IntSize GetSize() const MOZ_OVERRIDE;
+
+  virtual LayerRenderState GetRenderState() { return LayerRenderState(); }
+
+  virtual bool Lock() MOZ_OVERRIDE { return true; }
+
+  virtual already_AddRefed<gfxImageSurface> GetAsSurface() MOZ_OVERRIDE
+  {
+    return nullptr; // TODO: cf bug 872568
+  }
+
+  virtual void BeginTileIteration() MOZ_OVERRIDE
+  {
+    mIterating = true;
+    mCurrentTile = 0;
+  }
+  virtual void EndTileIteration() MOZ_OVERRIDE
+  {
+    mIterating = false;
+  }
+  virtual nsIntRect GetTileRect() MOZ_OVERRIDE;
+  virtual size_t GetTileCount() MOZ_OVERRIDE { return mTileTextures.size(); }
+  virtual bool NextTile() MOZ_OVERRIDE
+  {
+    return (++mCurrentTile < mTileTextures.size());
+  }
+
+  virtual TileIterator* AsTileIterator() MOZ_OVERRIDE
+  {
+    return mIsTiled ? this : nullptr;
+  }
+
+protected:
+  gfx::IntRect GetTileRect(uint32_t aID) const;
+
+  RefPtr<IDirect3DDevice9> mDevice;
+  RefPtr<CompositorD3D9> mCompositor;
+  bool mIsTiled;
+  std::vector< RefPtr<IDirect3DTexture9> > mTileTextures;
+  uint32_t mCurrentTile;
+  bool mIterating;
+};
+
+class DeprecatedTextureHostShmemD3D9 : public DeprecatedTextureHostD3D9
+{
+public:
+#ifdef MOZ_LAYERS_HAVE_LOG
+  virtual const char* Name() { return "DeprecatedTextureHostShmemD3D9"; }
+#endif
+
+protected:
+  virtual void UpdateImpl(const SurfaceDescriptor& aSurface,
+                          nsIntRegion* aRegion,
+                          nsIntPoint *aOffset = nullptr) MOZ_OVERRIDE;
+};
+
+class DeprecatedTextureHostSystemMemD3D9 : public DeprecatedTextureHostD3D9
+{
+public:
+#ifdef MOZ_LAYERS_HAVE_LOG
+  virtual const char* Name() { return "DeprecatedTextureHostSystemMemD3D9"; }
+#endif
+
+protected:
+  virtual void UpdateImpl(const SurfaceDescriptor& aSurface,
+                          nsIntRegion* aRegion,
+                          nsIntPoint *aOffset = nullptr) MOZ_OVERRIDE;
+
+  nsRefPtr<IDirect3DTexture9> mTexture;
+};
+
+class DeprecatedTextureHostYCbCrD3D9 : public DeprecatedTextureHost
+                           , public TextureSourceD3D9
+{
+public:
+  DeprecatedTextureHostYCbCrD3D9()
+    : mDevice(nullptr)
+  {
+    mFormat = gfx::FORMAT_YUV;
+  }
+
+  virtual void SetCompositor(Compositor* aCompositor) MOZ_OVERRIDE;
+
+  virtual TextureSourceD3D9* AsSourceD3D9() MOZ_OVERRIDE { return this; }
+
+  virtual gfx::IntSize GetSize() const MOZ_OVERRIDE;
+
+  virtual bool IsYCbCrSource() const MOZ_OVERRIDE { return true; }
+
+  virtual already_AddRefed<gfxImageSurface> GetAsSurface() MOZ_OVERRIDE
+  {
+    return nullptr; // TODO: cf bug 872568
+  }
+
+#ifdef MOZ_LAYERS_HAVE_LOG
+  virtual const char* Name() MOZ_OVERRIDE
+  {
+    return "TextureImageDeprecatedTextureHostD3D11";
+  }
+#endif
+
+protected:
+  virtual void UpdateImpl(const SurfaceDescriptor& aSurface,
+                          nsIntRegion* aRegion,
+                          nsIntPoint* aOffset = nullptr) MOZ_OVERRIDE;
+
+private:
+  RefPtr<IDirect3DDevice9> mDevice;
+};
+
+// If we want to use d3d9 textures for transport, use this class.
+// If we are using shmem, then use DeprecatedTextureClientShmem with DeprecatedTextureHostShmemD3D9
+// Since we pass a raw pointer, you should not use this texture client for
+// multi-process compositing.
+class DeprecatedTextureClientD3D9 : public DeprecatedTextureClient
+{
+public:
+  DeprecatedTextureClientD3D9(CompositableForwarder* aCompositableForwarder,
+                    const TextureInfo& aTextureInfo);
+  virtual ~DeprecatedTextureClientD3D9();
+
+  virtual bool SupportsType(DeprecatedTextureClientType aType) MOZ_OVERRIDE
+  {
+    return aType == TEXTURE_CONTENT;
+  }
+
+  virtual bool EnsureAllocated(gfx::IntSize aSize,
+                               gfxASurface::gfxContentType aType) MOZ_OVERRIDE;
+
+  virtual gfxASurface* LockSurface() MOZ_OVERRIDE;
+  virtual gfx::DrawTarget* LockDrawTarget() MOZ_OVERRIDE;
+  virtual void Unlock() MOZ_OVERRIDE;
+
+  virtual void SetDescriptor(const SurfaceDescriptor& aDescriptor) MOZ_OVERRIDE;
+  virtual gfxASurface::gfxContentType GetContentType() MOZ_OVERRIDE
+  {
+    return mContentType;
+  }
+
+private:
+  void ClearDT();
+
+  nsRefPtr<IDirect3DTexture9> mTexture;
+  nsRefPtr<gfxASurface> mSurface;
+  nsRefPtr<IDirect3DSurface9> mD3D9Surface;
+  HDC mDC;
+  RefPtr<gfx::DrawTarget> mDrawTarget;
+  gfx::IntSize mSize;
+  gfxContentType mContentType;
+  bool mTextureLocked;
+  bool mIsOpaque;
+};
+
+}
+}
+
+#endif /* MOZILLA_GFX_TEXTURED3D9_H */
diff --git a/gfx/layers/ipc/AsyncPanZoomController.cpp b/gfx/layers/ipc/AsyncPanZoomController.cpp
index f7cf20b576f7..4c9512f682fc 100644
--- a/gfx/layers/ipc/AsyncPanZoomController.cpp
+++ b/gfx/layers/ipc/AsyncPanZoomController.cpp
@@ -1169,6 +1169,7 @@ void AsyncPanZoomController::NotifyLayersUpdated(const FrameMetrics& aLayerMetri
 
   mLastContentPaintMetrics = aLayerMetrics;
 
+  bool isDefault = mFrameMetrics.IsDefault();
   mFrameMetrics.mMayHaveTouchListeners = aLayerMetrics.mMayHaveTouchListeners;
 
   // TODO: Once a mechanism for calling UpdateScrollOffset() when content does
@@ -1207,7 +1208,7 @@ void AsyncPanZoomController::NotifyLayersUpdated(const FrameMetrics& aLayerMetri
     needContentRepaint |= (previousResolution != newResolution);
   }
 
-  if (aIsFirstPaint || mFrameMetrics.IsDefault()) {
+  if (aIsFirstPaint || isDefault) {
     mPaintThrottler.ClearHistory();
     mPaintThrottler.SetMaxDurations(gNumPaintDurationSamples);
 
@@ -1217,7 +1218,7 @@ void AsyncPanZoomController::NotifyLayersUpdated(const FrameMetrics& aLayerMetri
     // XXX If this is the very first time we're getting a layers update we need to
     // trigger another repaint, or the B2G browser shows stale content. This needs
     // to be investigated and fixed.
-    needContentRepaint |= (mFrameMetrics.IsDefault() && !aLayerMetrics.IsDefault());
+    needContentRepaint |= (isDefault && !aLayerMetrics.IsDefault());
 
     mFrameMetrics = aLayerMetrics;
     mState = NOTHING;
diff --git a/gfx/layers/ipc/CompositableForwarder.h b/gfx/layers/ipc/CompositableForwarder.h
index eedaf9d8ebf9..89fc97be3a81 100644
--- a/gfx/layers/ipc/CompositableForwarder.h
+++ b/gfx/layers/ipc/CompositableForwarder.h
@@ -41,6 +41,7 @@ public:
   typedef gfxASurface::gfxContentType gfxContentType;
 
   CompositableForwarder()
+    : mMultiProcess(false)
   {}
 
   /**
@@ -207,8 +208,14 @@ public:
     return mTextureFactoryIdentifier.mSupportsPartialUploads;
   }
 
+  bool ForwardsToDifferentProcess() const
+  {
+    return mMultiProcess;
+  }
+
 protected:
   TextureFactoryIdentifier mTextureFactoryIdentifier;
+  bool mMultiProcess;
 };
 
 } // namespace
diff --git a/gfx/layers/ipc/CompositorChild.cpp b/gfx/layers/ipc/CompositorChild.cpp
index 1771d56ac4a8..c756dc7107b4 100644
--- a/gfx/layers/ipc/CompositorChild.cpp
+++ b/gfx/layers/ipc/CompositorChild.cpp
@@ -73,7 +73,8 @@ CompositorChild::Get()
 PLayerTransactionChild*
 CompositorChild::AllocPLayerTransactionChild(const LayersBackend& aBackendHint,
                                              const uint64_t& aId,
-                                             TextureFactoryIdentifier*)
+                                             TextureFactoryIdentifier*,
+                                             bool*)
 {
   return new LayerTransactionChild();
 }
diff --git a/gfx/layers/ipc/CompositorChild.h b/gfx/layers/ipc/CompositorChild.h
index 6de528ee3b44..b19c03bb4d22 100644
--- a/gfx/layers/ipc/CompositorChild.h
+++ b/gfx/layers/ipc/CompositorChild.h
@@ -41,7 +41,8 @@ protected:
   virtual PLayerTransactionChild*
     AllocPLayerTransactionChild(const LayersBackend& aBackendHint,
                                 const uint64_t& aId,
-                                TextureFactoryIdentifier* aTextureFactoryIdentifier) MOZ_OVERRIDE;
+                                TextureFactoryIdentifier* aTextureFactoryIdentifier,
+                                bool* aSuccess) MOZ_OVERRIDE;
 
   virtual bool DeallocPLayerTransactionChild(PLayerTransactionChild *aChild) MOZ_OVERRIDE;
 
diff --git a/gfx/layers/ipc/CompositorParent.cpp b/gfx/layers/ipc/CompositorParent.cpp
index 441c2b9fc792..d3f5cdebc0db 100644
--- a/gfx/layers/ipc/CompositorParent.cpp
+++ b/gfx/layers/ipc/CompositorParent.cpp
@@ -14,6 +14,7 @@
 #include "mozilla/layers/BasicCompositor.h"
 #ifdef XP_WIN
 #include "mozilla/layers/CompositorD3D11.h"
+#include "mozilla/layers/CompositorD3D9.h"
 #endif
 #include "LayerTransactionParent.h"
 #include "nsIWidget.h"
@@ -423,16 +424,13 @@ CompositorParent::ScheduleTask(CancelableTask* task, int time)
 void
 CompositorParent::NotifyShadowTreeTransaction(uint64_t aId, bool aIsFirstPaint)
 {
-  if (mApzcTreeManager) {
+  if (mApzcTreeManager &&
+      mLayerManager &&
+      mLayerManager->GetRoot()) {
     AutoResolveRefLayers resolve(mCompositionManager);
     mApzcTreeManager->UpdatePanZoomControllerTree(this, mLayerManager->GetRoot(), aIsFirstPaint, aId);
-  }
 
-  if (mLayerManager) {
-    LayerManagerComposite* managerComposite = mLayerManager->AsLayerManagerComposite();
-    if (managerComposite) {
-      managerComposite->NotifyShadowTreeTransaction();
-    }
+    mLayerManager->AsLayerManagerComposite()->NotifyShadowTreeTransaction();
   }
   ScheduleComposition();
 }
@@ -603,7 +601,8 @@ CompositorParent::ShadowLayersUpdated(LayerTransactionParent* aLayerTree,
 PLayerTransactionParent*
 CompositorParent::AllocPLayerTransactionParent(const LayersBackend& aBackendHint,
                                                const uint64_t& aId,
-                                               TextureFactoryIdentifier* aTextureFactoryIdentifier)
+                                               TextureFactoryIdentifier* aTextureFactoryIdentifier,
+                                               bool *aSuccess)
 {
   MOZ_ASSERT(aId == 0);
 
@@ -625,23 +624,29 @@ CompositorParent::AllocPLayerTransactionParent(const LayersBackend& aBackendHint
   } else if (aBackendHint == mozilla::layers::LAYERS_D3D11) {
     mLayerManager =
       new LayerManagerComposite(new CompositorD3D11(mWidget));
+  } else if (aBackendHint == mozilla::layers::LAYERS_D3D9) {
+    mLayerManager =
+      new LayerManagerComposite(new CompositorD3D9(mWidget));
 #endif
   } else {
-    NS_ERROR("Unsupported backend selected for Async Compositor");
-    return nullptr;
+    NS_WARNING("Unsupported backend selected for Async Compositor");
+    *aSuccess = false;
+    return new LayerTransactionParent(nullptr, this, 0);
   }
 
   mWidget = nullptr;
   mLayerManager->SetCompositorID(mCompositorID);
 
   if (!mLayerManager->Initialize()) {
-    NS_ERROR("Failed to init Compositor");
-    return nullptr;
+    NS_WARNING("Failed to init Compositor");
+    *aSuccess = false;
+    return new LayerTransactionParent(nullptr, this, 0);
   }
 
   mCompositionManager = new AsyncCompositionManager(mLayerManager);
 
   *aTextureFactoryIdentifier = mLayerManager->GetTextureFactoryIdentifier();
+  *aSuccess = true;
   return new LayerTransactionParent(mLayerManager, this, 0);
 }
 
@@ -831,7 +836,8 @@ public:
   virtual PLayerTransactionParent*
     AllocPLayerTransactionParent(const LayersBackend& aBackendType,
                                  const uint64_t& aId,
-                                 TextureFactoryIdentifier* aTextureFactoryIdentifier) MOZ_OVERRIDE;
+                                 TextureFactoryIdentifier* aTextureFactoryIdentifier,
+                                 bool *aSuccess) MOZ_OVERRIDE;
 
   virtual bool DeallocPLayerTransactionParent(PLayerTransactionParent* aLayers) MOZ_OVERRIDE;
 
@@ -912,17 +918,22 @@ CrossProcessCompositorParent::ActorDestroy(ActorDestroyReason aWhy)
 PLayerTransactionParent*
 CrossProcessCompositorParent::AllocPLayerTransactionParent(const LayersBackend& aBackendType,
                                                            const uint64_t& aId,
-                                                           TextureFactoryIdentifier* aTextureFactoryIdentifier)
+                                                           TextureFactoryIdentifier* aTextureFactoryIdentifier,
+                                                           bool *aSuccess)
 {
   MOZ_ASSERT(aId != 0);
 
   if (sIndirectLayerTrees[aId].mParent) {
     LayerManagerComposite* lm = sIndirectLayerTrees[aId].mParent->GetLayerManager();
     *aTextureFactoryIdentifier = lm->GetTextureFactoryIdentifier();
+    *aSuccess = true;
     return new LayerTransactionParent(lm, this, aId);
   }
 
   NS_WARNING("Created child without a matching parent?");
+  // XXX: should be false, but that causes us to fail some tests on Mac w/ OMTC.
+  // Bug 900745. change *aSuccess to false to see test failures.
+  *aSuccess = true;
   return new LayerTransactionParent(nullptr, this, aId);
 }
 
diff --git a/gfx/layers/ipc/CompositorParent.h b/gfx/layers/ipc/CompositorParent.h
index b48949a840b0..8397ddb2bd7e 100644
--- a/gfx/layers/ipc/CompositorParent.h
+++ b/gfx/layers/ipc/CompositorParent.h
@@ -208,7 +208,8 @@ protected:
   virtual PLayerTransactionParent*
     AllocPLayerTransactionParent(const LayersBackend& aBackendHint,
                                  const uint64_t& aId,
-                                 TextureFactoryIdentifier* aTextureFactoryIdentifier);
+                                 TextureFactoryIdentifier* aTextureFactoryIdentifier,
+                                 bool* aSuccess);
   virtual bool DeallocPLayerTransactionParent(PLayerTransactionParent* aLayers);
   virtual void ScheduleTask(CancelableTask*, int);
   virtual void Composite();
diff --git a/gfx/layers/ipc/ISurfaceAllocator.cpp b/gfx/layers/ipc/ISurfaceAllocator.cpp
index 1b7e01ad7a3c..bddf7adff46c 100644
--- a/gfx/layers/ipc/ISurfaceAllocator.cpp
+++ b/gfx/layers/ipc/ISurfaceAllocator.cpp
@@ -90,7 +90,10 @@ ISurfaceAllocator::AllocSurfaceDescriptorWithCaps(const gfxIntSize& aSize,
     gfxImageFormat format =
       gfxPlatform::GetPlatform()->OptimalFormatForContent(aContent);
     int32_t stride = gfxASurface::FormatStrideForWidth(format, aSize.width);
-    uint8_t *data = new uint8_t[stride * aSize.height];
+    uint8_t *data = new (std::nothrow) uint8_t[stride * aSize.height];
+    if (!data) {
+      return false;
+    }
 #ifdef XP_MACOSX
     // Workaround a bug in Quartz where drawing an a8 surface to another a8
     // surface with OPERATOR_SOURCE still requires the destination to be clear.
@@ -133,6 +136,7 @@ ISurfaceAllocator::DestroySharedSurface(SurfaceDescriptor* aSurface)
     case SurfaceDescriptor::TRGBImage:
       DeallocShmem(aSurface->get_RGBImage().data());
       break;
+    case SurfaceDescriptor::TSurfaceDescriptorD3D9:
     case SurfaceDescriptor::TSurfaceDescriptorD3D10:
       break;
     case SurfaceDescriptor::TMemoryImage:
diff --git a/gfx/layers/ipc/LayersSurfaces.ipdlh b/gfx/layers/ipc/LayersSurfaces.ipdlh
index b2011a135ea6..71f2eda8d91d 100644
--- a/gfx/layers/ipc/LayersSurfaces.ipdlh
+++ b/gfx/layers/ipc/LayersSurfaces.ipdlh
@@ -36,6 +36,11 @@ union MaybeMagicGrallocBufferHandle {
   null_t;
 };
 
+struct SurfaceDescriptorD3D9 {
+  // IDirect3DTexture9*
+  uintptr_t texture;
+};
+
 struct SurfaceDescriptorD3D10 {
   WindowsHandle handle;
   bool hasAlpha;
@@ -124,6 +129,7 @@ struct SurfaceDescriptorShmem {
 union SurfaceDescriptor {
   SurfaceDescriptorShmem;
   SurfaceDescriptorMemory;
+  SurfaceDescriptorD3D9;
   SurfaceDescriptorD3D10;
   SurfaceDescriptorX11;
   SharedTextureDescriptor;
diff --git a/gfx/layers/ipc/PCompositor.ipdl b/gfx/layers/ipc/PCompositor.ipdl
index 708a78cb811d..e14762e55ef1 100644
--- a/gfx/layers/ipc/PCompositor.ipdl
+++ b/gfx/layers/ipc/PCompositor.ipdl
@@ -60,7 +60,7 @@ parent:
   sync FlushRendering();
 
   sync PLayerTransaction(LayersBackend layersBackendHint, uint64_t id)
-    returns (TextureFactoryIdentifier textureFactoryIdentifier);
+    returns (TextureFactoryIdentifier textureFactoryIdentifier, bool success);
 };
 
 } // layers
diff --git a/gfx/layers/ipc/ShadowLayers.cpp b/gfx/layers/ipc/ShadowLayers.cpp
index c8d4917a8e71..27d7ca7c31d9 100644
--- a/gfx/layers/ipc/ShadowLayers.cpp
+++ b/gfx/layers/ipc/ShadowLayers.cpp
@@ -161,6 +161,7 @@ void
 CompositableForwarder::IdentifyTextureHost(const TextureFactoryIdentifier& aIdentifier)
 {
   mTextureFactoryIdentifier = aIdentifier;
+  mMultiProcess = aIdentifier.mParentProcessId != XRE_GetProcessType();
 }
 
 ShadowLayerForwarder::ShadowLayerForwarder()
@@ -407,9 +408,16 @@ ShadowLayerForwarder::UpdatedTexture(CompositableClient* aCompositable,
 {
   MaybeRegion region = aRegion ? MaybeRegion(*aRegion)
                                : MaybeRegion(null_t());
-  mTxn->AddEdit(OpUpdateTexture(nullptr, aCompositable->GetIPDLActor(),
-                                aTexture->GetID(),
-                                region));
+  if (aTexture->GetFlags() & TEXTURE_IMMEDIATE_UPLOAD) {
+    mTxn->AddPaint(OpUpdateTexture(nullptr, aCompositable->GetIPDLActor(),
+                                   aTexture->GetID(),
+                                   region));
+  } else {
+    mTxn->AddNoSwapPaint(OpUpdateTexture(nullptr, aCompositable->GetIPDLActor(),
+                                         aTexture->GetID(),
+                                         region));
+
+  }
 }
 
 void
diff --git a/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp b/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
index 6cda16879df1..7caf05929daf 100644
--- a/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
+++ b/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
@@ -119,7 +119,8 @@ SharedPlanarYCbCrImage::SetDataNoCopy(const Data &aData)
   mSize = aData.mPicSize;
   YCbCrImageDataSerializer serializer(mTextureClient->GetBuffer());
   serializer.InitializeBufferInfo(aData.mYSize,
-                                  aData.mCbCrSize);
+                                  aData.mCbCrSize,
+                                  aData.mStereoMode);
 }
 
 uint8_t*
@@ -153,7 +154,8 @@ SharedPlanarYCbCrImage::Allocate(PlanarYCbCrImage::Data& aData)
 
   YCbCrImageDataSerializer serializer(mTextureClient->GetBuffer());
   serializer.InitializeBufferInfo(aData.mYSize,
-                                  aData.mCbCrSize);
+                                  aData.mCbCrSize,
+                                  aData.mStereoMode);
   MOZ_ASSERT(serializer.IsValid());
 
   aData.mYChannel = serializer.GetYData();
@@ -239,7 +241,8 @@ DeprecatedSharedPlanarYCbCrImage::SetDataNoCopy(const Data &aData)
   mSize = aData.mPicSize;
   YCbCrImageDataSerializer serializer(mShmem.get<uint8_t>());
   serializer.InitializeBufferInfo(aData.mYSize,
-                                  aData.mCbCrSize);
+                                  aData.mCbCrSize,
+                                  aData.mStereoMode);
 }
 
 uint8_t* 
@@ -269,7 +272,8 @@ DeprecatedSharedPlanarYCbCrImage::Allocate(PlanarYCbCrImage::Data& aData)
 
   YCbCrImageDataSerializer serializer(mShmem.get<uint8_t>());
   serializer.InitializeBufferInfo(aData.mYSize,
-                                  aData.mCbCrSize);
+                                  aData.mCbCrSize,
+                                  aData.mStereoMode);
   if (!serializer.IsValid() || mShmem.Size<uint8_t>() < size) {
     mSurfaceAllocator->DeallocShmem(mShmem);
     return false;
diff --git a/gfx/layers/moz.build b/gfx/layers/moz.build
index 6fb002493f83..fb6d832f5d90 100644
--- a/gfx/layers/moz.build
+++ b/gfx/layers/moz.build
@@ -52,7 +52,13 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'windows':
             'd3d9/DeviceManagerD3D9.h',
             'd3d9/LayerManagerD3D9.h',
         ]
+        EXPORTS.mozilla.layers += [
+            'CompositorD3D9.h',
+            'TextureD3D9.h',
+        ]
         CPP_SOURCES += [
+            'CompositorD3D9.cpp',
+            'TextureD3D9.cpp',
             'LayerManagerD3D9.cpp',
             'ThebesLayerD3D9.cpp',
             'ContainerLayerD3D9.cpp',
diff --git a/gfx/layers/opengl/CompositorOGL.h b/gfx/layers/opengl/CompositorOGL.h
index fa502a8b517c..0fab795a8466 100644
--- a/gfx/layers/opengl/CompositorOGL.h
+++ b/gfx/layers/opengl/CompositorOGL.h
@@ -44,6 +44,7 @@ public:
   virtual TextureFactoryIdentifier GetTextureFactoryIdentifier() MOZ_OVERRIDE
   {
     return TextureFactoryIdentifier(LAYERS_OPENGL,
+                                    XRE_GetProcessType(),
                                     GetMaxTextureSize(),
                                     mFBOTextureTarget == LOCAL_GL_TEXTURE_2D,
                                     SupportsPartialTextureUpdate());
diff --git a/gfx/layers/opengl/TextureClientOGL.cpp b/gfx/layers/opengl/TextureClientOGL.cpp
index ee9225d6ad6e..08490acbf68d 100644
--- a/gfx/layers/opengl/TextureClientOGL.cpp
+++ b/gfx/layers/opengl/TextureClientOGL.cpp
@@ -78,11 +78,12 @@ DeprecatedTextureClientSharedOGL::ReleaseResources()
   // care of this for us though.
 }
 
-void
+bool
 DeprecatedTextureClientSharedOGL::EnsureAllocated(gfx::IntSize aSize,
                                         gfxASurface::gfxContentType aContentType)
 {
   mSize = aSize;
+  return true;
 }
 
 
diff --git a/gfx/layers/opengl/TextureClientOGL.h b/gfx/layers/opengl/TextureClientOGL.h
index abb048e6cd56..fa00ba007997 100644
--- a/gfx/layers/opengl/TextureClientOGL.h
+++ b/gfx/layers/opengl/TextureClientOGL.h
@@ -39,7 +39,7 @@ public:
                 bool aIsCrossProcess = false,
                 bool aInverted = false);
 
-  gfx::IntSize GetSize() const { return mSize; }
+  virtual gfx::IntSize GetSize() const { return mSize; }
 
 protected:
   gfx::IntSize mSize;
@@ -56,7 +56,7 @@ public:
   ~DeprecatedTextureClientSharedOGL() { ReleaseResources(); }
 
   virtual bool SupportsType(DeprecatedTextureClientType aType) MOZ_OVERRIDE { return aType == TEXTURE_SHARED_GL; }
-  virtual void EnsureAllocated(gfx::IntSize aSize, gfxASurface::gfxContentType aType);
+  virtual bool EnsureAllocated(gfx::IntSize aSize, gfxASurface::gfxContentType aType);
   virtual void ReleaseResources();
   virtual gfxASurface::gfxContentType GetContentType() MOZ_OVERRIDE { return gfxASurface::CONTENT_COLOR_ALPHA; }
 
@@ -88,7 +88,7 @@ public:
   ~DeprecatedTextureClientStreamOGL() { ReleaseResources(); }
 
   virtual bool SupportsType(DeprecatedTextureClientType aType) MOZ_OVERRIDE { return aType == TEXTURE_STREAM_GL; }
-  virtual void EnsureAllocated(gfx::IntSize aSize, gfxASurface::gfxContentType aType) { }
+  virtual bool EnsureAllocated(gfx::IntSize aSize, gfxASurface::gfxContentType aType) { return true; }
   virtual void ReleaseResources() { mDescriptor = SurfaceDescriptor(); }
   virtual gfxASurface::gfxContentType GetContentType() MOZ_OVERRIDE { return gfxASurface::CONTENT_COLOR_ALPHA; }
 };
diff --git a/gfx/src/nsFont.cpp b/gfx/src/nsFont.cpp
index 71987c23e783..985e3080e413 100644
--- a/gfx/src/nsFont.cpp
+++ b/gfx/src/nsFont.cpp
@@ -115,7 +115,8 @@ bool nsFont::BaseEquals(const nsFont& aOther) const
       (variantNumeric == aOther.variantNumeric) &&
       (variantPosition == aOther.variantPosition) &&
       (alternateValues == aOther.alternateValues) &&
-      (featureValueLookup == aOther.featureValueLookup)) {
+      (featureValueLookup == aOther.featureValueLookup) &&
+      (smoothing == aOther.smoothing)) {
     return true;
   }
   return false;
@@ -125,8 +126,7 @@ bool nsFont::Equals(const nsFont& aOther) const
 {
   if (BaseEquals(aOther) &&
       (variant == aOther.variant) &&
-      (decorations == aOther.decorations) &&
-      (smoothing == aOther.smoothing)) {
+      (decorations == aOther.decorations)) {
     return true;
   }
   return false;
diff --git a/gfx/thebes/gfxCachedTempSurface.cpp b/gfx/thebes/gfxCachedTempSurface.cpp
index 43e62ced38a7..d53cf3cf2991 100644
--- a/gfx/thebes/gfxCachedTempSurface.cpp
+++ b/gfx/thebes/gfxCachedTempSurface.cpp
@@ -73,11 +73,9 @@ gfxCachedTempSurface::Get(gfxASurface::gfxContentType aContentType,
   if (mSurface) {
     /* Verify the current buffer is valid for this purpose */
     if (mSize.width < aRect.width || mSize.height < aRect.height
-        || mSurface->GetContentType() != aContentType) {
+        || mSurface->GetContentType() != aContentType
+        || mType != aSimilarTo->GetType()) {
       mSurface = nullptr;
-    } else {
-      NS_ASSERTION(mType == aSimilarTo->GetType(),
-                   "Unexpected surface type change");
     }
   }
 
@@ -89,9 +87,7 @@ gfxCachedTempSurface::Get(gfxASurface::gfxContentType aContentType,
       return nullptr;
 
     cleared = true;
-#ifdef DEBUG
     mType = aSimilarTo->GetType();
-#endif
   }
   mSurface->SetDeviceOffset(-aRect.TopLeft());
 
diff --git a/gfx/thebes/gfxCachedTempSurface.h b/gfx/thebes/gfxCachedTempSurface.h
index 958ba622461b..7b183969a69a 100644
--- a/gfx/thebes/gfxCachedTempSurface.h
+++ b/gfx/thebes/gfxCachedTempSurface.h
@@ -33,10 +33,9 @@ public:
    * When |aContentType| differs in different invocations this is handled
    * appropriately, creating a new surface if necessary.
    * 
-   * |aSimilarTo| should be of the same gfxSurfaceType in each invocation.
    * Because the cached surface may have been created during a previous
    * invocation, this will not be efficient if the new |aSimilarTo| has a
-   * different format.
+   * different format, size, or gfxSurfaceType.
    */
   already_AddRefed<gfxContext> Get(gfxASurface::gfxContentType aContentType,
                                    const gfxRect& aRect,
@@ -52,9 +51,7 @@ private:
   nsRefPtr<gfxASurface> mSurface;
   gfxIntSize mSize;
   nsExpirationState mExpirationState;
-#ifdef DEBUG
   gfxASurface::gfxSurfaceType mType;
-#endif 
 };
 
 #endif /* GFX_CACHED_TEMP_SURFACE_H */
diff --git a/gfx/thebes/gfxPlatform.cpp b/gfx/thebes/gfxPlatform.cpp
index b98e30777044..e3fd5b5cf110 100644
--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -77,6 +77,7 @@
 #include "mozilla/Preferences.h"
 #include "mozilla/Assertions.h"
 #include "mozilla/Attributes.h"
+#include "mozilla/Mutex.h"
 
 #include "nsIGfxInfo.h"
 
@@ -86,6 +87,8 @@ using namespace mozilla::layers;
 gfxPlatform *gPlatform = nullptr;
 static bool gEverInitialized = false;
 
+static Mutex* gGfxPlatformPrefsLock = nullptr;
+
 // These two may point to the same profile
 static qcms_profile *gCMSOutputProfile = nullptr;
 static qcms_profile *gCMSsRGBProfile = nullptr;
@@ -313,6 +316,8 @@ gfxPlatform::Init()
     sCmapDataLog = PR_NewLogModule("cmapdata");;
 #endif
 
+    gGfxPlatformPrefsLock = new Mutex("gfxPlatform::gGfxPlatformPrefsLock");
+
     /* Initialize the GfxInfo service.
      * Note: we can't call functions on GfxInfo that depend
      * on gPlatform until after it has been initialized
@@ -475,6 +480,8 @@ gfxPlatform::Shutdown()
 
     CompositorParent::ShutDown();
 
+    delete gGfxPlatformPrefsLock;
+
     delete gPlatform;
     gPlatform = nullptr;
 }
@@ -1856,11 +1863,15 @@ static bool sPrefLayersAccelerationForceEnabled = false;
 static bool sPrefLayersAccelerationDisabled = false;
 static bool sPrefLayersPreferOpenGL = false;
 static bool sPrefLayersPreferD3D9 = false;
+static bool sLayersSupportsD3D9 = true;
 static int  sPrefLayoutFrameRate = -1;
+static bool sBufferRotationEnabled = false;
 
-void InitLayersAccelerationPrefs()
+static bool sLayersAccelerationPrefsInitialized = false;
+
+void
+InitLayersAccelerationPrefs()
 {
-  static bool sLayersAccelerationPrefsInitialized = false;
   if (!sLayersAccelerationPrefsInitialized)
   {
     sPrefLayersOffMainThreadCompositionEnabled = Preferences::GetBool("layers.offmainthreadcomposition.enabled", false);
@@ -1871,12 +1882,24 @@ void InitLayersAccelerationPrefs()
     sPrefLayersPreferOpenGL = Preferences::GetBool("layers.prefer-opengl", false);
     sPrefLayersPreferD3D9 = Preferences::GetBool("layers.prefer-d3d9", false);
     sPrefLayoutFrameRate = Preferences::GetInt("layout.frame_rate", -1);
+    sBufferRotationEnabled = Preferences::GetBool("layers.bufferrotation.enabled", true);
+
+    nsCOMPtr<nsIGfxInfo> gfxInfo = do_GetService("@mozilla.org/gfx/info;1");
+    if (gfxInfo) {
+      int32_t status;
+      if (NS_SUCCEEDED(gfxInfo->GetFeatureStatus(nsIGfxInfo::FEATURE_DIRECT3D_9_LAYERS, &status))) {
+        if (status != nsIGfxInfo::FEATURE_NO_INFO && !sPrefLayersAccelerationForceEnabled) {
+          sLayersSupportsD3D9 = false;
+        }
+      }
+    }
 
     sLayersAccelerationPrefsInitialized = true;
   }
 }
 
-bool gfxPlatform::GetPrefLayersOffMainThreadCompositionEnabled()
+bool
+gfxPlatform::GetPrefLayersOffMainThreadCompositionEnabled()
 {
   InitLayersAccelerationPrefs();
   return sPrefLayersOffMainThreadCompositionEnabled ||
@@ -1884,13 +1907,15 @@ bool gfxPlatform::GetPrefLayersOffMainThreadCompositionEnabled()
          sPrefLayersOffMainThreadCompositionTestingEnabled;
 }
 
-bool gfxPlatform::GetPrefLayersOffMainThreadCompositionForceEnabled()
+bool
+gfxPlatform::GetPrefLayersOffMainThreadCompositionForceEnabled()
 {
   InitLayersAccelerationPrefs();
   return sPrefLayersOffMainThreadCompositionForceEnabled;
 }
 
-bool gfxPlatform::GetPrefLayersAccelerationForceEnabled()
+bool
+gfxPlatform::GetPrefLayersAccelerationForceEnabled()
 {
   InitLayersAccelerationPrefs();
   return sPrefLayersAccelerationForceEnabled;
@@ -1903,20 +1928,49 @@ gfxPlatform::GetPrefLayersAccelerationDisabled()
   return sPrefLayersAccelerationDisabled;
 }
 
-bool gfxPlatform::GetPrefLayersPreferOpenGL()
+bool
+gfxPlatform::GetPrefLayersPreferOpenGL()
 {
   InitLayersAccelerationPrefs();
   return sPrefLayersPreferOpenGL;
 }
 
-bool gfxPlatform::GetPrefLayersPreferD3D9()
+bool
+gfxPlatform::GetPrefLayersPreferD3D9()
 {
   InitLayersAccelerationPrefs();
   return sPrefLayersPreferD3D9;
 }
 
-int gfxPlatform::GetPrefLayoutFrameRate()
+bool
+gfxPlatform::CanUseDirect3D9()
+{
+  // this function is called from the compositor thread, so it is not
+  // safe to init the prefs etc. from here.
+  MOZ_ASSERT(sLayersAccelerationPrefsInitialized);
+  return sLayersSupportsD3D9;
+}
+
+int
+gfxPlatform::GetPrefLayoutFrameRate()
 {
   InitLayersAccelerationPrefs();
   return sPrefLayoutFrameRate;
 }
+
+bool
+gfxPlatform::BufferRotationEnabled()
+{
+  MutexAutoLock autoLock(*gGfxPlatformPrefsLock);
+
+  InitLayersAccelerationPrefs();
+  return sBufferRotationEnabled;
+}
+
+void
+gfxPlatform::DisableBufferRotation()
+{
+  MutexAutoLock autoLock(*gGfxPlatformPrefsLock);
+
+  sBufferRotationEnabled = false;
+}
diff --git a/gfx/thebes/gfxPlatform.h b/gfx/thebes/gfxPlatform.h
index b3a4c4d0a46a..fa2c409d338e 100644
--- a/gfx/thebes/gfxPlatform.h
+++ b/gfx/thebes/gfxPlatform.h
@@ -471,8 +471,14 @@ public:
     static bool GetPrefLayersAccelerationDisabled();
     static bool GetPrefLayersPreferOpenGL();
     static bool GetPrefLayersPreferD3D9();
+    static bool CanUseDirect3D9();
     static int  GetPrefLayoutFrameRate();
 
+    /**
+     * Is it possible to use buffer rotation
+     */
+    static bool BufferRotationEnabled();
+    static void DisableBufferRotation();
     /**
      * Are we going to try color management?
      */
diff --git a/gfx/thebes/gfxWindowsPlatform.cpp b/gfx/thebes/gfxWindowsPlatform.cpp
index ffe48f4e56f7..baa2a209cb51 100644
--- a/gfx/thebes/gfxWindowsPlatform.cpp
+++ b/gfx/thebes/gfxWindowsPlatform.cpp
@@ -28,6 +28,8 @@
 #include "gfxGDIFontList.h"
 #include "gfxGDIFont.h"
 
+#include "DeviceManagerD3D9.h"
+
 #ifdef CAIRO_HAS_DWRITE_FONT
 #include "gfxDWriteFontList.h"
 #include "gfxDWriteFonts.h"
@@ -42,6 +44,7 @@
 
 using namespace mozilla;
 using namespace mozilla::gfx;
+using namespace mozilla::layers;
 
 #ifdef CAIRO_HAS_D2D_SURFACE
 #include "gfxD2DSurface.h"
@@ -350,7 +353,8 @@ BuildKeyNameFromFontName(nsAString &aName)
 }
 
 gfxWindowsPlatform::gfxWindowsPlatform()
-  : mD3D11DeviceInitialized(false)
+  : mD3D9DeviceInitialized(false)
+  , mD3D11DeviceInitialized(false)
 {
     mPrefFonts.Init(50);
 
@@ -384,6 +388,8 @@ gfxWindowsPlatform::~gfxWindowsPlatform()
 {
     NS_UnregisterMemoryMultiReporter(mGPUAdapterMultiReporter);
     
+     mDeviceManager = nullptr;
+     
     ::ReleaseDC(nullptr, mScreenDC);
     // not calling FT_Done_FreeType because cairo may still hold references to
     // these FT_Faces.  See bug 458169.
@@ -1447,6 +1453,29 @@ gfxWindowsPlatform::SetupClearTypeParams()
 #endif
 }
 
+IDirect3DDevice9*
+gfxWindowsPlatform::GetD3D9Device()
+{
+  DeviceManagerD3D9* manager = GetD3D9DeviceManager();
+  return manager ? manager->device() : nullptr;
+}
+
+DeviceManagerD3D9*
+gfxWindowsPlatform::GetD3D9DeviceManager()
+{
+  if (!mD3D9DeviceInitialized) {
+    mD3D9DeviceInitialized = true;
+
+    mDeviceManager = new DeviceManagerD3D9();
+    if (!mDeviceManager->Init()) {
+      NS_WARNING("Could not initialise devive manager");
+      mDeviceManager = nullptr;
+    }
+  }
+
+  return mDeviceManager;
+}
+
 ID3D11Device*
 gfxWindowsPlatform::GetD3D11Device()
 {
diff --git a/gfx/thebes/gfxWindowsPlatform.h b/gfx/thebes/gfxWindowsPlatform.h
index 3d8ab0e28347..99e9f5211667 100644
--- a/gfx/thebes/gfxWindowsPlatform.h
+++ b/gfx/thebes/gfxWindowsPlatform.h
@@ -43,6 +43,12 @@
 #define D3D_FL9_3_REQ_TEXTURE2D_U_OR_V_DIMENSION 4096
 #endif
 
+namespace mozilla {
+namespace layers {
+class DeviceManagerD3D9;
+}
+}
+class IDirect3DDevice9;
 class ID3D11Device;
 class IDXGIAdapter1;
 
@@ -265,6 +271,8 @@ public:
 #else
     inline bool DWriteEnabled() { return false; }
 #endif
+    mozilla::layers::DeviceManagerD3D9* GetD3D9DeviceManager();
+    IDirect3DDevice9* GetD3D9Device();
 #ifdef CAIRO_HAS_D2D_SURFACE
     cairo_device_t *GetD2DDevice() { return mD2DDevice; }
     ID3D10Device1 *GetD3D10Device() { return mD2DDevice ? cairo_d2d_device_get_device(mD2DDevice) : nullptr; }
@@ -297,7 +305,9 @@ private:
     cairo_device_t *mD2DDevice;
 #endif
     mozilla::RefPtr<IDXGIAdapter1> mAdapter;
+    nsRefPtr<mozilla::layers::DeviceManagerD3D9> mDeviceManager;
     mozilla::RefPtr<ID3D11Device> mD3D11Device;
+    bool mD3D9DeviceInitialized;
     bool mD3D11DeviceInitialized;
 
     virtual qcms_profile* GetPlatformCMSOutputProfile();
diff --git a/js/ipc/JavaScriptChild.cpp b/js/ipc/JavaScriptChild.cpp
index 207201c28820..76af39653c00 100644
--- a/js/ipc/JavaScriptChild.cpp
+++ b/js/ipc/JavaScriptChild.cpp
@@ -7,6 +7,7 @@
 
 #include "JavaScriptChild.h"
 #include "mozilla/dom/ContentChild.h"
+#include "mozilla/dom/BindingUtils.h"
 #include "nsContentUtils.h"
 #include "xpcprivate.h"
 #include "jsfriendapi.h"
@@ -625,3 +626,27 @@ JavaScriptChild::AnswerInstanceOf(const ObjectId &objId, const JSIID &iid, Retur
 
     return ok(rs);
 }
+
+bool
+JavaScriptChild::AnswerDOMInstanceOf(const ObjectId &objId, const int &prototypeID,
+                                     const int &depth,
+                                     ReturnStatus *rs, bool *instanceof)
+{
+    AutoSafeJSContext cx;
+    JSAutoRequest request(cx);
+
+    *instanceof = false;
+
+    RootedObject obj(cx, findObject(objId));
+    if (!obj)
+        return false;
+
+    JSAutoCompartment comp(cx, obj);
+
+    JSBool tmp;
+    if (!mozilla::dom::InterfaceHasInstance(cx, prototypeID, depth, obj, &tmp))
+        return fail(cx, rs);
+    *instanceof = tmp;
+
+    return ok(rs);
+}
diff --git a/js/ipc/JavaScriptChild.h b/js/ipc/JavaScriptChild.h
index b3a9aa63b0a4..4c098189769f 100644
--- a/js/ipc/JavaScriptChild.h
+++ b/js/ipc/JavaScriptChild.h
@@ -66,6 +66,8 @@ class JavaScriptChild
                                 ReturnStatus *rs, nsTArray<nsString> *names);
     bool AnswerInstanceOf(const ObjectId &objId, const JSIID &iid,
                           ReturnStatus *rs, bool *instanceof);
+    bool AnswerDOMInstanceOf(const ObjectId &objId, const int &prototypeID, const int &depth,
+                             ReturnStatus *rs, bool *instanceof);
 
   protected:
     JSObject *unwrap(JSContext *cx, ObjectId id);
diff --git a/js/ipc/JavaScriptParent.cpp b/js/ipc/JavaScriptParent.cpp
index 3d59faed68ae..f59321340c85 100644
--- a/js/ipc/JavaScriptParent.cpp
+++ b/js/ipc/JavaScriptParent.cpp
@@ -514,7 +514,8 @@ JavaScriptParent::init()
 bool
 JavaScriptParent::makeId(JSContext *cx, JSObject *obj, ObjectId *idp)
 {
-    if (!IsProxy(obj) || GetProxyHandler(obj) != &CPOWProxyHandler::singleton) {
+    obj = js::CheckedUnwrap(obj, false);
+    if (!obj || !IsProxy(obj) || GetProxyHandler(obj) != &CPOWProxyHandler::singleton) {
         JS_ReportError(cx, "cannot ipc non-cpow object");
         return false;
     }
@@ -656,3 +657,24 @@ JavaScriptParent::instanceOf(JSObject *obj, const nsID *id, bool *bp)
 
     return NS_OK;
 }
+
+/* static */ bool
+JavaScriptParent::DOMInstanceOf(JSObject *obj, int prototypeID, int depth, bool *bp)
+{
+    return ParentOf(obj)->domInstanceOf(obj, prototypeID, depth, bp);
+}
+
+bool
+JavaScriptParent::domInstanceOf(JSObject *obj, int prototypeID, int depth, bool *bp)
+{
+    ObjectId objId = idOf(obj);
+
+    ReturnStatus status;
+    if (!CallDOMInstanceOf(objId, prototypeID, depth, &status, bp))
+        return false;
+
+    if (!status.ok())
+        return false;
+
+    return true;
+}
diff --git a/js/ipc/JavaScriptParent.h b/js/ipc/JavaScriptParent.h
index 9c702a152beb..233a2575564f 100644
--- a/js/ipc/JavaScriptParent.h
+++ b/js/ipc/JavaScriptParent.h
@@ -66,10 +66,17 @@ class JavaScriptParent
     void drop(JSObject *obj);
 
     static bool IsCPOW(JSObject *obj);
-    static nsresult InstanceOf(JSObject *obj, const nsID *id, bool *bp);
 
+    static nsresult InstanceOf(JSObject *obj, const nsID *id, bool *bp);
     nsresult instanceOf(JSObject *obj, const nsID *id, bool *bp);
 
+    /*
+     * Check that |obj| is a DOM wrapper whose prototype chain contains
+     * |prototypeID| at depth |depth|.
+     */
+    static bool DOMInstanceOf(JSObject *obj, int prototypeID, int depth, bool *bp);
+    bool domInstanceOf(JSObject *obj, int prototypeID, int depth, bool *bp);
+
   protected:
     JSObject *unwrap(JSContext *cx, ObjectId objId);
 
diff --git a/js/ipc/PJavaScript.ipdl b/js/ipc/PJavaScript.ipdl
index 8f6e5ef09621..18eb4f888ced 100644
--- a/js/ipc/PJavaScript.ipdl
+++ b/js/ipc/PJavaScript.ipdl
@@ -41,6 +41,7 @@ child:
 
     urgent GetPropertyNames(uint64_t objId, uint32_t flags) returns (ReturnStatus rs, nsString[] names);
     urgent InstanceOf(uint64_t objId, JSIID iid) returns (ReturnStatus rs, bool instanceof);
+    urgent DOMInstanceOf(uint64_t objId, int prototypeID, int depth) returns (ReturnStatus rs, bool instanceof);
 
 parent:
     async __delete__();
diff --git a/js/src/Makefile.in b/js/src/Makefile.in
index e0a96e4afd53..0abce6aa4665 100644
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -105,7 +105,7 @@ VPATH += 	$(srcdir)/assembler/assembler \
 endif
 
 #
-# END enclude sources for the Nitro assembler
+# END include sources for the Nitro assembler
 #############################################
 
 ifdef JS_HAS_CTYPES
@@ -298,12 +298,15 @@ JITTEST_VALGRIND_FLAG = --valgrind
 endif
 endif
 
+check-style::
+	(cd $(srcdir) && $(PYTHON) config/check_spidermonkey_style.py);
+
 check-jit-test::
 	$(wildcard $(RUN_TEST_PROGRAM)) $(PYTHON) -u $(srcdir)/jit-test/jit_test.py \
 	        --no-slow --no-progress --tinderbox --tbpl $(JITTEST_VALGRIND_FLAG) \
 	        $(DIST)/bin/$(JS_SHELL_NAME)$(BIN_SUFFIX)
 
-check:: check-jit-test
+check:: check-style check-jit-test
 
 # jstests doesn't have a --jitflags option, so we need to loop, updating the
 # exit code (RC) after each invocation.
@@ -367,15 +370,6 @@ else
 NSPR_STATIC_PATH = $(DIST)/lib
 endif
 
-ifdef MOZ_VTUNE
-ifeq ($(OS_ARCH), WINNT)
-EXTRA_DSO_LDOPTS += $(VTUNE_LIBRARIES)
-LIBS += $(VTUNE_LIBRARIES)
-else
-SHARED_LIBRARY_LIBS += $(VTUNE_LIBRARIES)
-endif # WINNT
-endif # MOZ_VTUNE
-
 ifdef MOZ_ETW
 # This will get the ETW provider resources into the library mozjs.dll
 RESFILE = ETWProvider.res
diff --git a/js/src/assembler/wtf/Assertions.h b/js/src/assembler/wtf/Assertions.h
index 96ff43d16f7c..cfb101c75445 100644
--- a/js/src/assembler/wtf/Assertions.h
+++ b/js/src/assembler/wtf/Assertions.h
@@ -44,7 +44,7 @@
     (void)variable; \
     ASSERT(assertion); \
 } while (0)
-#define ASSERT_NOT_REACHED() MOZ_ASSUME_UNREACHABLE()
+#define ASSERT_NOT_REACHED() MOZ_ASSUME_UNREACHABLE("wtf/Assertions.h")
 #define CRASH() MOZ_CRASH()
 #define COMPILE_ASSERT(exp, name) static_assert(exp, #name)
 
diff --git a/js/src/builtin/String.js b/js/src/builtin/String.js
index 3f91978de34d..aeec476c87c2 100644
--- a/js/src/builtin/String.js
+++ b/js/src/builtin/String.js
@@ -17,19 +17,27 @@ function String_repeat(count) {
     var n = ToInteger(count);
 
     // Steps 6-7.
-    if (n < 0 || n === std_Number_POSITIVE_INFINITY)
-        ThrowError(JSMSG_REPEAT_RANGE);
+    if (n < 0)
+        ThrowError(JSMSG_NEGATIVE_REPETITION_COUNT); // a RangeError
 
-    // Step 8-9.
-    if (n === 0)
-        return "";
+    if (!(n * S.length < (1 << 28)))
+        ThrowError(JSMSG_RESULTING_STRING_TOO_LARGE); // a RangeError
 
-    var result = S;
-    for (var i = 1; i <= n / 2; i *= 2)
-        result += result;
-    for (; i < n; i++)
-        result += S;
-    return result;
+    // Communicate |n|'s possible range to the compiler.
+    n = n & ((1 << 28) - 1);
+
+    // Steps 8-9.
+    var T = '';
+    for (;;) {
+        if (n & 1)
+            T += S;
+        n >>= 1;
+        if (n)
+            S += S;
+        else
+            break;
+    }
+    return T;
 }
 
 /**
diff --git a/js/src/config/check_spidermonkey_style.py b/js/src/config/check_spidermonkey_style.py
new file mode 100644
index 000000000000..00672dfbfb4e
--- /dev/null
+++ b/js/src/config/check_spidermonkey_style.py
@@ -0,0 +1,396 @@
+# vim: set ts=8 sts=4 et sw=4 tw=99:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#----------------------------------------------------------------------------
+# This script checks various aspects of SpiderMonkey code style.  The current checks are as
+# follows.
+#
+# We check the following things in headers.
+#
+# - No cyclic dependencies.
+# 
+# - No normal header should #include a inlines.h/-inl.h file.
+# 
+# - #ifndef wrappers should have the right form. (XXX: not yet implemented)
+#   - Every header file should have one.
+#   - It should be in the vanilla form and have no tokens before/after it so
+#     that GCC and clang can avoid multiple-inclusion.
+#   - The guard name used should be appropriate for the filename.
+# 
+# We check the following things in all files.
+#
+# - #includes should have full paths, e.g. "ion/Ion.h", not "Ion.h". 
+#
+# - #includes should use the appropriate form for system headers (<...>) and
+#   local headers ("...").
+#
+# - #includes should be ordered correctly. (XXX: not yet implemented;  see bug
+#   888088)
+#   - Each one should be in the correct section.
+#   - Alphabetical order should be used within sections.
+#   - Sections should be in the right order.
+#----------------------------------------------------------------------------
+
+from __future__ import print_function
+
+import difflib
+import os
+import re
+import subprocess
+import sys
+import traceback
+
+# We don't bother checking files in these directories, because they're (a) auxiliary or (b)
+# imported code that doesn't follow our coding style.
+ignored_js_src_dirs = [
+   'js/src/config/',            # auxiliary stuff
+   'js/src/ctypes/libffi/',     # imported code
+   'js/src/devtools/',          # auxiliary stuff
+   'js/src/editline/',          # imported code
+   'js/src/gdb/',               # auxiliary stuff
+   'js/src/vtune/'              # imported code
+]
+
+# We ignore #includes of these files, because they don't follow the usual rules.
+included_inclnames_to_ignore = set([
+    'ffi.h',                    # generated in ctypes/libffi/
+    'devtools/sharkctl.h',      # we ignore devtools/ in general
+    'devtools/Instruments.h',   # we ignore devtools/ in general
+    'double-conversion.h',      # strange MFBT case
+    'javascript-trace.h',       # generated in $OBJDIR if HAVE_DTRACE is defined
+    'jsautokw.h',               # generated in $OBJDIR
+    'jsautooplen.h',            # generated in $OBJDIR
+    'jscustomallocator.h',      # provided by embedders;  allowed to be missing
+    'js-config.h',              # generated in $OBJDIR
+    'pratom.h',                 # NSPR
+    'prcvar.h',                 # NSPR
+    'prinit.h',                 # NSPR
+    'prlink.h',                 # NSPR
+    'prlock.h',                 # NSPR
+    'prprf.h',                  # NSPR
+    'prthread.h',               # NSPR
+    'prtypes.h',                # NSPR
+    'selfhosted.out.h',         # generated in $OBJDIR
+    'unicode/locid.h',          # ICU
+    'unicode/numsys.h',         # ICU
+    'unicode/ucal.h',           # ICU
+    'unicode/uclean.h',         # ICU
+    'unicode/ucol.h',           # ICU
+    'unicode/udat.h',           # ICU
+    'unicode/udatpg.h',         # ICU
+    'unicode/uenum.h',          # ICU
+    'unicode/unum.h',           # ICU
+    'unicode/ustring.h',        # ICU
+    'unicode/utypes.h',         # ICU
+    'vtune/VTuneWrapper.h'      # VTune
+])
+
+# The files in tests/style/ contain code that fails this checking in various
+# ways.  Here is the output we expect.  If the actual output differs from
+# this, one of the following must have happened.
+# - New SpiderMonkey code violates one of the checked rules.
+# - The tests/style/ files have changed without expected_output being changed
+#   accordingly.
+# - This script has been broken somehow.
+#
+expected_output = '''\
+js/src/tests/style/BadIncludes2.h:1: error:
+    vanilla header includes an inline-header file "tests/style/BadIncludes2-inl.h"
+
+js/src/tests/style/BadIncludes.h:1: error:
+    the file includes itself
+
+js/src/tests/style/BadIncludes.h:3: error:
+    "BadIncludes2.h" is included using the wrong path;
+    did you forget a prefix, or is the file not yet committed?
+
+js/src/tests/style/BadIncludes.h:4: error:
+    <tests/style/BadIncludes2.h> should be included using
+    the #include "..." form
+
+js/src/tests/style/BadIncludes.h:5: error:
+    "stdio.h" is included using the wrong path;
+    did you forget a prefix, or is the file not yet committed?
+
+(multiple files): error:
+    header files form one or more cycles
+
+   tests/style/HeaderCycleA1.h
+   -> tests/style/HeaderCycleA2.h
+      -> tests/style/HeaderCycleA3.h
+         -> tests/style/HeaderCycleA1.h
+
+   tests/style/HeaderCycleB1-inl.h
+   -> tests/style/HeaderCycleB2-inl.h
+      -> tests/style/HeaderCycleB3-inl.h
+         -> tests/style/HeaderCycleB4-inl.h
+            -> tests/style/HeaderCycleB1-inl.h
+            -> tests/style/jsheadercycleB5inlines.h
+               -> tests/style/HeaderCycleB1-inl.h
+      -> tests/style/HeaderCycleB4-inl.h
+
+'''.splitlines(True)
+
+actual_output = []
+
+
+def out(*lines):
+    for line in lines:
+        actual_output.append(line + '\n')
+
+
+def error(filename, linenum, *lines):
+    location = filename
+    if linenum != None:
+        location += ":" + str(linenum)
+    out(location + ': error:')
+    for line in (lines):
+        out('    ' + line)
+    out('')
+
+
+class FileKind(object):
+    C = 1
+    CPP = 2
+    INL_H = 3
+    H = 4
+    TBL = 5
+    MSG = 6
+
+    @staticmethod
+    def get(filename):
+        if filename.endswith('.c'):
+            return FileKind.C
+       
+        if filename.endswith('.cpp'):
+            return FileKind.CPP
+       
+        if filename.endswith(('inlines.h', '-inl.h')):
+            return FileKind.INL_H
+
+        if filename.endswith('.h'):
+            return FileKind.H
+
+        if filename.endswith('.tbl'):
+            return FileKind.TBL
+
+        if filename.endswith('.msg'):
+            return FileKind.MSG
+
+        error(filename, None, 'unknown file kind')
+
+
+def get_all_filenames():
+    """Get a list of all the files in the (Mercurial or Git) repository."""
+    cmds = [['hg', 'manifest'], ['git', 'ls-files']]
+    for cmd in cmds:
+        try:
+            all_filenames = subprocess.check_output(cmd, universal_newlines=True,
+                                                    stderr=subprocess.PIPE).split('\n')
+            return all_filenames
+        except:
+            continue
+    else:
+        raise Exception('failed to run any of the repo manifest commands', cmds)
+
+
+def check_style():
+    # We deal with two kinds of name.
+    # - A "filename" is a full path to a file from the repository root.
+    # - An "inclname" is how a file is referred to in a #include statement.
+    #
+    # Examples (filename -> inclname)
+    # - "mfbt/Attributes.h"  -> "mozilla/Attributes.h"
+    # - "js/public/Vector.h" -> "js/Vector.h"
+    # - "js/src/vm/String.h" -> "vm/String.h"
+
+    mfbt_inclnames = set()      # type: set(inclname)
+    js_names = dict()           # type: dict(filename, inclname)
+
+    # Select the appropriate files.
+    for filename in get_all_filenames():
+        if filename.startswith('mfbt/') and filename.endswith('.h'):
+            inclname = 'mozilla/' + filename[len('mfbt/'):]
+            mfbt_inclnames.add(inclname)
+
+        if filename.startswith('js/public/') and filename.endswith('.h'):
+            inclname = 'js/' + filename[len('js/public/'):]
+            js_names[filename] = inclname
+
+        if filename.startswith('js/src/') and \
+           not filename.startswith(tuple(ignored_js_src_dirs)) and \
+           filename.endswith(('.c', '.cpp', '.h', '.tbl', '.msg')):
+            inclname = filename[len('js/src/'):]
+            js_names[filename] = inclname
+
+    all_inclnames = mfbt_inclnames | set(js_names.values())
+
+    edges = dict()      # type: dict(inclname, set(inclname))
+
+    # We don't care what's inside the MFBT files, but because they are
+    # #included from JS files we have to add them to the inclusion graph.
+    for inclname in mfbt_inclnames:
+        edges[inclname] = set()
+
+    # Process all the JS files.
+    for filename in js_names.keys():
+        inclname = js_names[filename]
+        file_kind = FileKind.get(filename)
+        if file_kind == FileKind.C or file_kind == FileKind.CPP or \
+           file_kind == FileKind.H or file_kind == FileKind.INL_H:
+            included_h_inclnames = set()    # type: set(inclname)
+
+            # This script is run in js/src/, so prepend '../../' to get to the root of the Mozilla
+            # source tree.
+            with open(os.path.join('../..', filename)) as f:
+                do_file(filename, inclname, file_kind, f, all_inclnames, included_h_inclnames)
+
+        edges[inclname] = included_h_inclnames
+
+    find_cycles(all_inclnames, edges)
+
+    # Compare expected and actual output.
+    difflines = difflib.unified_diff(expected_output, actual_output,
+                                     fromfile='check_spider_monkey_style.py expected output',
+                                       tofile='check_spider_monkey_style.py actual output')
+    ok = True
+    for diffline in difflines:
+        ok = False
+        print(diffline, end='')
+
+    return ok
+
+
+def do_file(filename, inclname, file_kind, f, all_inclnames, included_h_inclnames):
+    for linenum, line in enumerate(f, start=1):
+        # Look for a |#include "..."| line.
+        m = re.match(r'\s*#\s*include\s+"([^"]*)"', line)
+        if m is not None:
+            included_inclname = m.group(1)
+
+            if included_inclname not in included_inclnames_to_ignore:
+                included_kind = FileKind.get(included_inclname)
+
+                # Check the #include path has the correct form.
+                if included_inclname not in all_inclnames:
+                    error(filename, linenum,
+                          '"' + included_inclname + '" is included ' + 'using the wrong path;',
+                          'did you forget a prefix, or is the file not yet committed?')
+
+                # Record inclusions of .h files for cycle detection later.
+                # (Exclude .tbl and .msg files.)
+                elif included_kind == FileKind.H or included_kind == FileKind.INL_H:
+                    included_h_inclnames.add(included_inclname)
+
+                # Check a H file doesn't #include an INL_H file.
+                if file_kind == FileKind.H and included_kind == FileKind.INL_H:
+                    error(filename, linenum,
+                          'vanilla header includes an inline-header file "' + included_inclname + '"')
+
+                # Check a file doesn't #include itself.  (We do this here because the
+                # cycle detection below doesn't detect this case.)
+                if inclname == included_inclname:
+                    error(filename, linenum, 'the file includes itself')
+
+        # Look for a |#include <...>| line.
+        m = re.match(r'\s*#\s*include\s+<([^>]*)>', line)
+        if m is not None:
+            included_inclname = m.group(1)
+
+            # Check it is not a known local file (in which case it's
+            # probably a system header).
+            if included_inclname in included_inclnames_to_ignore or \
+               included_inclname in all_inclnames:
+                error(filename, linenum,
+                      '<' + included_inclname + '> should be included using',
+                      'the #include "..." form')
+
+
+def find_cycles(all_inclnames, edges):
+    """Find and draw any cycles."""
+    
+    SCCs = tarjan(all_inclnames, edges)
+
+    # The various sorted() calls below ensure the output is deterministic.
+
+    def draw_SCC(c):
+        cset = set(c)
+        drawn = set()
+        def draw(v, indent):
+            out('   ' * indent + ('-> ' if indent else '   ') + v)
+            if v in drawn:
+                return
+            drawn.add(v)
+            for succ in sorted(edges[v]):
+                if succ in cset:
+                    draw(succ, indent + 1)
+        draw(sorted(c)[0], 0)
+        out('')
+
+    have_drawn_an_SCC = False
+    for scc in sorted(SCCs):
+        if len(scc) != 1:
+            if not have_drawn_an_SCC:
+                error('(multiple files)', None, 'header files form one or more cycles')
+                have_drawn_an_SCC = True
+
+            draw_SCC(scc)
+
+
+# Tarjan's algorithm for finding the strongly connected components (SCCs) of a graph.
+# https://en.wikipedia.org/wiki/Tarjan%27s_strongly_connected_components_algorithm
+def tarjan(V, E):
+    vertex_index = {}
+    vertex_lowlink = {}
+    index = 0
+    S = []
+    all_SCCs = []
+
+    def strongconnect(v, index):
+        # Set the depth index for v to the smallest unused index
+        vertex_index[v] = index
+        vertex_lowlink[v] = index
+        index += 1
+        S.append(v)
+
+        # Consider successors of v
+        for w in E[v]:
+            if w not in vertex_index:
+                # Successor w has not yet been visited; recurse on it
+                index = strongconnect(w, index)
+                vertex_lowlink[v] = min(vertex_lowlink[v], vertex_lowlink[w])
+            elif w in S:
+                # Successor w is in stack S and hence in the current SCC
+                vertex_lowlink[v] = min(vertex_lowlink[v], vertex_index[w])
+
+        # If v is a root node, pop the stack and generate an SCC
+        if vertex_lowlink[v] == vertex_index[v]:
+            i = S.index(v)
+            scc = S[i:]
+            del S[i:]
+            all_SCCs.append(scc)
+
+        return index
+
+    for v in V:
+        if v not in vertex_index:
+            index = strongconnect(v, index)
+
+    return all_SCCs
+
+
+def main():
+    ok = check_style()
+
+    if ok:
+        print('TEST-PASS | check_spidermonkey_style.py | ok')
+    else:
+        print('TEST-UNEXPECTED-FAIL | check_spidermonkey_style.py | actual output does not match expected output;  diff is above')
+
+    sys.exit(0 if ok else 1)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/js/src/config/rules.mk b/js/src/config/rules.mk
index 95e3e11fe944..b498822635cf 100644
--- a/js/src/config/rules.mk
+++ b/js/src/config/rules.mk
@@ -442,7 +442,7 @@ define SUBMAKE # $(call SUBMAKE,target,directory,static)
 endef # The extra line is important here! don't delete it
 
 define TIER_DIR_SUBMAKE
-@echo "BUILDSTATUS TIERDIR_START $(2)"
+@echo "BUILDSTATUS TIERDIR_START  $(2)"
 $(call SUBMAKE,$(1),$(2),$(3))
 @echo "BUILDSTATUS TIERDIR_FINISH $(2)"
 
diff --git a/js/src/configure.in b/js/src/configure.in
index c4c5d2592b50..a96e256d20a6 100644
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -2019,14 +2019,12 @@ arm*-*)
     ;;
 sparc*-*)
     if test ! "$HAVE_64BIT_OS" ; then
-    ENABLE_YARR_JIT=1
 dnl ENABLE_ION=0
     AC_DEFINE(JS_CPU_SPARC)
     AC_DEFINE(JS_NUNBOX32)
     fi
     ;;
 mips*-*)
-    ENABLE_YARR_JIT=1
     AC_DEFINE(JS_CPU_MIPS)
     AC_DEFINE(JS_NUNBOX32)
     ;;
@@ -3549,35 +3547,21 @@ MOZ_ARG_ENABLE_BOOL(vtune,
 [  --enable-vtune          Enable vtune profiling. Implies --enable-profiling.],
     MOZ_VTUNE=1,
     MOZ_VTUNE= )
-if test -n "$MOZ_VTUNE"; then
-    if test -z "$VTUNE_AMPLIFIER_XE_2013_DIR"; then
-        echo "Error: VTUNE_AMPLIFIER_XE_2013_DIR undefined."
-        exit 1
-    fi
-
-    VTUNE_DIR=`echo "$VTUNE_AMPLIFIER_XE_2013_DIR" | sed 's,\\\,/,g'`
-    VTUNE_DIR=`echo "$VTUNE_DIR" | sed 's,(,\\\(,g'`
-    VTUNE_DIR=`echo "$VTUNE_DIR" | sed 's,),\\\),g'`
-    VTUNE_DIR=`echo "$VTUNE_DIR" | sed 's, ,\\\ ,g'`
-
-    VTUNE_LIB=lib32
-    if test "x86_64" = "$TARGET_CPU"; then
-        VTUNE_LIB=lib64
-    fi
-
-    VTUNE_LIBRARIES="${VTUNE_DIR}/${VTUNE_LIB}/${LIB_PREFIX}jitprofiling.${LIB_SUFFIX}"
-    AC_SUBST(VTUNE_LIBRARIES)
-
-    CXXFLAGS="$CXXFLAGS -I${VTUNE_DIR}/include"
-    MOZ_PROFILING=1
-    AC_DEFINE(MOZ_VTUNE)
-fi
 
 dnl ========================================================
 dnl Profiling
 dnl ========================================================
 if test -n "$MOZ_PROFILING"; then
     AC_DEFINE(MOZ_PROFILING)
+
+    case "$OS_TARGET" in
+        Linux) MOZ_VTUNE=1 ;;
+        WINNT) MOZ_VTUNE=1 ;;
+    esac
+fi
+
+if test -n "$MOZ_VTUNE"; then
+    AC_DEFINE(MOZ_VTUNE)
 fi
 
 dnl ========================================================
diff --git a/js/src/frontend/BytecodeCompiler.cpp b/js/src/frontend/BytecodeCompiler.cpp
index a9baf8b5daa7..63fa43a86f4c 100644
--- a/js/src/frontend/BytecodeCompiler.cpp
+++ b/js/src/frontend/BytecodeCompiler.cpp
@@ -293,7 +293,7 @@ frontend::CompileScript(ExclusiveContext *cx, LifoAlloc *alloc, HandleObject sco
 
     bool canHaveDirectives = true;
     for (;;) {
-        TokenKind tt = parser.tokenStream.peekToken(TSF_OPERAND);
+        TokenKind tt = parser.tokenStream.peekToken(TokenStream::Operand);
         if (tt <= TOK_EOF) {
             if (tt == TOK_EOF)
                 break;
diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index 7aeeae931a3f..5317b0b225f7 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -62,14 +62,13 @@ typedef MutableHandle<PropertyName*> MutableHandlePropertyName;
  * Insist that the next token be of type tt, or report errno and return null.
  * NB: this macro uses cx and ts from its lexical environment.
  */
-#define MUST_MATCH_TOKEN_WITH_FLAGS(tt, errno, __flags)                                     \
+#define MUST_MATCH_TOKEN(tt, errno)                                                         \
     JS_BEGIN_MACRO                                                                          \
-        if (tokenStream.getToken((__flags)) != tt) {                                        \
+        if (tokenStream.getToken() != tt) {                                                 \
             report(ParseError, false, null(), errno);                                       \
             return null();                                                                  \
         }                                                                                   \
     JS_END_MACRO
-#define MUST_MATCH_TOKEN(tt, errno) MUST_MATCH_TOKEN_WITH_FLAGS(tt, errno, 0)
 
 template <typename ParseHandler>
 bool
@@ -399,6 +398,7 @@ Parser<ParseHandler>::Parser(ExclusiveContext *cx, LifoAlloc *alloc,
     keepAtoms(cx->perThreadData),
     foldConstants(foldConstants),
     abortedSyntaxParse(false),
+    isUnexpectedEOF_(false),
     handler(cx, *alloc, tokenStream, foldConstants, syntaxParser, lazyOuterFunction)
 {
     cx->perThreadData->activeCompilations++;
@@ -1246,12 +1246,12 @@ Parser<ParseHandler>::newFunction(GenericParseContext *pc, HandleAtom atom,
 static bool
 MatchOrInsertSemicolon(TokenStream &ts)
 {
-    TokenKind tt = ts.peekTokenSameLine(TSF_OPERAND);
+    TokenKind tt = ts.peekTokenSameLine(TokenStream::Operand);
     if (tt == TOK_ERROR)
         return false;
     if (tt != TOK_EOF && tt != TOK_EOL && tt != TOK_SEMI && tt != TOK_RC) {
         /* Advance the scanner for proper error location reporting. */
-        ts.getToken(TSF_OPERAND);
+        ts.getToken(TokenStream::Operand);
         ts.reportError(JSMSG_SEMI_BEFORE_STMNT);
         return false;
     }
@@ -2258,7 +2258,7 @@ Parser<ParseHandler>::functionArgsAndBodyGeneric(Node pn, HandleFunction fun, Fu
         yieldGuard.construct(this);
 
     FunctionBodyType bodyType = StatementListBody;
-    if (tokenStream.getToken(TSF_OPERAND) != TOK_LC) {
+    if (tokenStream.getToken(TokenStream::Operand) != TOK_LC) {
         tokenStream.ungetToken();
         bodyType = ExpressionBody;
         fun->setIsExprClosure();
@@ -2351,7 +2351,7 @@ Parser<ParseHandler>::functionStmt()
     tokenStream.tell(&start);
 
     RootedPropertyName name(context);
-    if (tokenStream.getToken(TSF_KEYWORD_IS_NAME) == TOK_NAME) {
+    if (tokenStream.getToken(TokenStream::KeywordIsName) == TOK_NAME) {
         name = tokenStream.currentToken().name();
     } else {
         /* Unnamed function expressions are forbidden in statement context. */
@@ -2375,7 +2375,7 @@ Parser<ParseHandler>::functionExpr()
     JS_ASSERT(tokenStream.currentToken().type == TOK_FUNCTION);
     TokenStream::Position start(keepAtoms);
     tokenStream.tell(&start);
-    if (tokenStream.getToken(TSF_KEYWORD_IS_NAME) == TOK_NAME)
+    if (tokenStream.getToken(TokenStream::KeywordIsName) == TOK_NAME)
         name = tokenStream.currentToken().name();
     else
         tokenStream.ungetToken();
@@ -2541,11 +2541,11 @@ Parser<ParseHandler>::statements()
 
     bool canHaveDirectives = pc->atBodyLevel();
     for (;;) {
-        TokenKind tt = tokenStream.peekToken(TSF_OPERAND);
+        TokenKind tt = tokenStream.peekToken(TokenStream::Operand);
         if (tt <= TOK_EOF || tt == TOK_RC) {
             if (tt == TOK_ERROR) {
                 if (tokenStream.isEOF())
-                    tokenStream.setUnexpectedEOF();
+                    isUnexpectedEOF_ = true;
                 return null();
             }
             break;
@@ -2553,7 +2553,7 @@ Parser<ParseHandler>::statements()
         Node next = statement(canHaveDirectives);
         if (!next) {
             if (tokenStream.isEOF())
-                tokenStream.setUnexpectedEOF();
+                isUnexpectedEOF_ = true;
             return null();
         }
 
@@ -2598,7 +2598,7 @@ Parser<ParseHandler>::condition()
 static bool
 MatchLabel(TokenStream &ts, MutableHandlePropertyName label)
 {
-    TokenKind tt = ts.peekTokenSameLine(TSF_OPERAND);
+    TokenKind tt = ts.peekTokenSameLine(TokenStream::Operand);
     if (tt == TOK_ERROR)
         return false;
     if (tt == TOK_NAME) {
@@ -3256,7 +3256,7 @@ Parser<ParseHandler>::letBlock(LetContext letContext)
     handler.setBeginPosition(pnlet, begin);
 
     bool needExprStmt = false;
-    if (letContext == LetStatement && !tokenStream.matchToken(TOK_LC, TSF_OPERAND)) {
+    if (letContext == LetStatement && !tokenStream.matchToken(TOK_LC, TokenStream::Operand)) {
         /*
          * Strict mode eliminates a grammar ambiguity with unparenthesized
          * LetExpressions in an ExpressionStatement. If followed immediately
@@ -3630,7 +3630,7 @@ Parser<ParseHandler>::ifStatement()
     if (!cond)
         return null();
 
-    if (tokenStream.peekToken(TSF_OPERAND) == TOK_SEMI &&
+    if (tokenStream.peekToken(TokenStream::Operand) == TOK_SEMI &&
         !report(ParseExtraWarning, false, null(), JSMSG_EMPTY_CONSEQUENT))
     {
         return null();
@@ -3643,7 +3643,7 @@ Parser<ParseHandler>::ifStatement()
         return null();
 
     Node elseBranch;
-    if (tokenStream.matchToken(TOK_ELSE, TSF_OPERAND)) {
+    if (tokenStream.matchToken(TOK_ELSE, TokenStream::Operand)) {
         stmtInfo.type = STMT_ELSE;
         elseBranch = statement();
         if (!elseBranch)
@@ -3803,7 +3803,7 @@ Parser<FullParseHandler>::forStatement()
     ParseNode *pn1;
 
     {
-        TokenKind tt = tokenStream.peekToken(TSF_OPERAND);
+        TokenKind tt = tokenStream.peekToken(TokenStream::Operand);
         if (tt == TOK_SEMI) {
             pn1 = NULL;
         } else {
@@ -4035,7 +4035,7 @@ Parser<FullParseHandler>::forStatement()
 
         /* Parse the loop condition or null into pn2. */
         MUST_MATCH_TOKEN(TOK_SEMI, JSMSG_SEMI_AFTER_FOR_INIT);
-        if (tokenStream.peekToken(TSF_OPERAND) == TOK_SEMI) {
+        if (tokenStream.peekToken(TokenStream::Operand) == TOK_SEMI) {
             pn2 = NULL;
         } else {
             pn2 = expr();
@@ -4045,7 +4045,7 @@ Parser<FullParseHandler>::forStatement()
 
         /* Parse the update expression or null into pn3. */
         MUST_MATCH_TOKEN(TOK_SEMI, JSMSG_SEMI_AFTER_FOR_COND);
-        if (tokenStream.peekToken(TSF_OPERAND) == TOK_RP) {
+        if (tokenStream.peekToken(TokenStream::Operand) == TOK_RP) {
             pn3 = NULL;
         } else {
             pn3 = expr();
@@ -4127,7 +4127,7 @@ Parser<SyntaxParseHandler>::forStatement()
     Node lhsNode;
 
     {
-        TokenKind tt = tokenStream.peekToken(TSF_OPERAND);
+        TokenKind tt = tokenStream.peekToken(TokenStream::Operand);
         if (tt == TOK_SEMI) {
             lhsNode = null();
         } else {
@@ -4187,14 +4187,14 @@ Parser<SyntaxParseHandler>::forStatement()
     } else {
         /* Parse the loop condition or null. */
         MUST_MATCH_TOKEN(TOK_SEMI, JSMSG_SEMI_AFTER_FOR_INIT);
-        if (tokenStream.peekToken(TSF_OPERAND) != TOK_SEMI) {
+        if (tokenStream.peekToken(TokenStream::Operand) != TOK_SEMI) {
             if (!expr())
                 return null();
         }
 
         /* Parse the update expression or null. */
         MUST_MATCH_TOKEN(TOK_SEMI, JSMSG_SEMI_AFTER_FOR_COND);
-        if (tokenStream.peekToken(TSF_OPERAND) != TOK_RP) {
+        if (tokenStream.peekToken(TokenStream::Operand) != TOK_RP) {
             if (!expr())
                 return null();
         }
@@ -4275,7 +4275,7 @@ Parser<ParseHandler>::switchStatement()
         if (!body)
             return null();
 
-        while ((tt = tokenStream.peekToken(TSF_OPERAND)) != TOK_RC &&
+        while ((tt = tokenStream.peekToken(TokenStream::Operand)) != TOK_RC &&
                tt != TOK_CASE && tt != TOK_DEFAULT) {
             if (tt == TOK_ERROR)
                 return null();
@@ -4433,7 +4433,7 @@ Parser<ParseHandler>::returnStatementOrYieldExpression()
     // this extension in order to conform to the ES6 syntax, which treats
     // "yield \n expr;" as a single ExpressionStatement.
     Node exprNode;
-    TokenKind next = tokenStream.peekTokenSameLine(TSF_OPERAND);
+    TokenKind next = tokenStream.peekTokenSameLine(TokenStream::Operand);
     if (next == TOK_ERROR)
         return null();
     if (next == TOK_EOF || next == TOK_EOL || next == TOK_SEMI || next == TOK_RC ||
@@ -4584,7 +4584,7 @@ Parser<ParseHandler>::throwStatement()
     uint32_t begin = pos().begin;
 
     /* ECMA-262 Edition 3 says 'throw [no LineTerminator here] Expr'. */
-    TokenKind tt = tokenStream.peekTokenSameLine(TSF_OPERAND);
+    TokenKind tt = tokenStream.peekTokenSameLine(TokenStream::Operand);
     if (tt == TOK_ERROR)
         return null();
     if (tt == TOK_EOF || tt == TOK_EOL || tt == TOK_SEMI || tt == TOK_RC) {
@@ -4740,7 +4740,7 @@ Parser<ParseHandler>::tryStatement()
             handler.setEndPosition(catchList, pos().end);
             handler.setEndPosition(pnblock, pos().end);
 
-            tt = tokenStream.getToken(TSF_OPERAND);
+            tt = tokenStream.getToken(TokenStream::Operand);
         } while (tt == TOK_CATCH);
     }
 
@@ -4788,7 +4788,7 @@ Parser<ParseHandler>::statement(bool canHaveDirectives)
 {
     JS_CHECK_RECURSION(context, return null());
 
-    switch (TokenKind tt = tokenStream.getToken(TSF_OPERAND)) {
+    switch (TokenKind tt = tokenStream.getToken(TokenStream::Operand)) {
       case TOK_LC:
         return blockStatement();
 
@@ -5167,7 +5167,7 @@ Parser<ParseHandler>::assignExpr()
     // assignExpr(), condExpr1(), orExpr1(), unaryExpr(), memberExpr(), and
     // primaryExpr().
 
-    TokenKind tt = tokenStream.getToken(TSF_OPERAND);
+    TokenKind tt = tokenStream.getToken(TokenStream::Operand);
 
     if (tt == TOK_NAME && tokenStream.nextTokenEndsExpr())
         return identifierName();
@@ -5299,7 +5299,7 @@ Parser<ParseHandler>::unaryExpr()
 
     JS_CHECK_RECURSION(context, return null());
 
-    TokenKind tt = tokenStream.getToken(TSF_OPERAND);
+    TokenKind tt = tokenStream.getToken(TokenStream::Operand);
     uint32_t begin = pos().begin;
     switch (tt) {
       case TOK_TYPEOF:
@@ -5310,15 +5310,15 @@ Parser<ParseHandler>::unaryExpr()
         return unaryOpExpr(PNK_NOT, JSOP_NOT, begin);
       case TOK_BITNOT:
         return unaryOpExpr(PNK_BITNOT, JSOP_BITNOT, begin);
-      case TOK_PLUS:
+      case TOK_ADD:
         return unaryOpExpr(PNK_POS, JSOP_POS, begin);
-      case TOK_MINUS:
+      case TOK_SUB:
         return unaryOpExpr(PNK_NEG, JSOP_NEG, begin);
 
       case TOK_INC:
       case TOK_DEC:
       {
-        TokenKind tt2 = tokenStream.getToken(TSF_OPERAND);
+        TokenKind tt2 = tokenStream.getToken(TokenStream::Operand);
         pn2 = memberExpr(tt2, true);
         if (!pn2)
             return null();
@@ -5355,7 +5355,7 @@ Parser<ParseHandler>::unaryExpr()
             return null();
 
         /* Don't look across a newline boundary for a postfix incop. */
-        tt = tokenStream.peekTokenSameLine(TSF_OPERAND);
+        tt = tokenStream.peekTokenSameLine(TokenStream::Operand);
         if (tt == TOK_INC || tt == TOK_DEC) {
             tokenStream.consumeKnownToken(tt);
             if (!checkAndMarkAsIncOperand(pn, tt, false))
@@ -6125,7 +6125,7 @@ template <typename ParseHandler>
 bool
 Parser<ParseHandler>::argumentList(Node listNode)
 {
-    if (tokenStream.matchToken(TOK_RP, TSF_OPERAND))
+    if (tokenStream.matchToken(TOK_RP, TokenStream::Operand))
         return true;
 
     GenexpGuard<ParseHandler> guard(this);
@@ -6187,7 +6187,7 @@ Parser<ParseHandler>::memberExpr(TokenKind tt, bool allowCallSyntax)
         if (!lhs)
             return null();
 
-        tt = tokenStream.getToken(TSF_OPERAND);
+        tt = tokenStream.getToken(TokenStream::Operand);
         Node ctorExpr = memberExpr(tt, false);
         if (!ctorExpr)
             return null();
@@ -6205,7 +6205,7 @@ Parser<ParseHandler>::memberExpr(TokenKind tt, bool allowCallSyntax)
     while ((tt = tokenStream.getToken()) > TOK_EOF) {
         Node nextMember;
         if (tt == TOK_DOT) {
-            tt = tokenStream.getToken(TSF_KEYWORD_IS_NAME);
+            tt = tokenStream.getToken(TokenStream::KeywordIsName);
             if (tt == TOK_ERROR)
                 return null();
             if (tt == TOK_NAME) {
@@ -6356,7 +6356,7 @@ Parser<ParseHandler>::primaryExpr(TokenKind tt)
             return null();
         handler.setBlockId(pn, pc->blockidGen);
 
-        if (tokenStream.matchToken(TOK_RB, TSF_OPERAND)) {
+        if (tokenStream.matchToken(TOK_RB, TokenStream::Operand)) {
             /*
              * Mark empty arrays as non-constant, since we cannot easily
              * determine their type.
@@ -6371,7 +6371,7 @@ Parser<ParseHandler>::primaryExpr(TokenKind tt)
                     return null();
                 }
 
-                tt = tokenStream.peekToken(TSF_OPERAND);
+                tt = tokenStream.peekToken(TokenStream::Operand);
                 if (tt == TOK_RB)
                     break;
 
@@ -6489,7 +6489,7 @@ Parser<ParseHandler>::primaryExpr(TokenKind tt)
         RootedAtom atom(context);
         Value tmp;
         for (;;) {
-            TokenKind ltok = tokenStream.getToken(TSF_KEYWORD_IS_NAME);
+            TokenKind ltok = tokenStream.getToken(TokenStream::KeywordIsName);
             switch (ltok) {
               case TOK_NUMBER:
                 tmp = DoubleValue(tokenStream.currentToken().number());
@@ -6512,7 +6512,7 @@ Parser<ParseHandler>::primaryExpr(TokenKind tt)
                         break;
                     }
 
-                    tt = tokenStream.getToken(TSF_KEYWORD_IS_NAME);
+                    tt = tokenStream.getToken(TokenStream::KeywordIsName);
                     if (tt == TOK_NAME) {
                         atom = tokenStream.currentToken().name();
                         pn3 = newName(atom->asPropertyName());
diff --git a/js/src/frontend/Parser.h b/js/src/frontend/Parser.h
index 7c0d08aacb1d..856760d62312 100644
--- a/js/src/frontend/Parser.h
+++ b/js/src/frontend/Parser.h
@@ -346,7 +346,10 @@ class Parser : private AutoGCRooter, public StrictModeGetter
      * is not known whether the parse succeeds or fails, this bit is set and
      * the parse will return false.
      */
-    bool abortedSyntaxParse;
+    bool abortedSyntaxParse:1;
+
+    /* Unexpected end of input, i.e. TOK_EOF not at top-level. */
+    bool isUnexpectedEOF_:1;
 
     typedef typename ParseHandler::Node Node;
     typedef typename ParseHandler::DefinitionNode DefinitionNode;
@@ -423,6 +426,8 @@ class Parser : private AutoGCRooter, public StrictModeGetter
         abortedSyntaxParse = false;
     }
 
+    bool isUnexpectedEOF() const { return isUnexpectedEOF_; }
+
   private:
     Parser *thisForCtor() { return this; }
 
diff --git a/js/src/frontend/TokenStream.cpp b/js/src/frontend/TokenStream.cpp
index cea7a0f4c918..2470aee0cf12 100644
--- a/js/src/frontend/TokenStream.cpp
+++ b/js/src/frontend/TokenStream.cpp
@@ -4,9 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-/*
- * JS lexical scanner.
- */
+// JS lexical scanner.
 
 #include "frontend/TokenStream.h"
 
@@ -38,9 +36,9 @@ using mozilla::PodCopy;
 using mozilla::PodZero;
 
 struct KeywordInfo {
-    const char  *chars;         /* C string with keyword text */
+    const char  *chars;         // C string with keyword text
     TokenKind   tokentype;
-    JSVersion   version;        /* JSVersion */
+    JSVersion   version;
 };
 
 static const KeywordInfo keywords[] = {
@@ -50,10 +48,8 @@ static const KeywordInfo keywords[] = {
 #undef KEYWORD_INFO
 };
 
-/*
- * Returns a KeywordInfo for the specified characters, or NULL if the string is
- * not a keyword.
- */
+// Returns a KeywordInfo for the specified characters, or NULL if the string is
+// not a keyword.
 static const KeywordInfo *
 FindKeyword(const jschar *s, size_t length)
 {
@@ -263,7 +259,7 @@ TokenStream::SourceCoords::lineNumAndColumnIndex(uint32_t offset, uint32_t *line
 #pragma warning(disable:4351)
 #endif
 
-/* Initialize members that aren't initialized in |init|. */
+// Initialize members that aren't initialized in |init|.
 TokenStream::TokenStream(ExclusiveContext *cx, const CompileOptions &options,
                          const jschar *base, size_t length, StrictModeGetter *smg)
   : srcCoords(cx, options.lineno),
@@ -302,14 +298,14 @@ TokenStream::TokenStream(ExclusiveContext *cx, const CompileOptions &options,
     // much easier.  Don't worry, the time to initialize them for each
     // TokenStream is trivial.  See bug 639420.
 
-    /* See getChar() for an explanation of maybeEOL[]. */
+    // See getChar() for an explanation of maybeEOL[].
     memset(maybeEOL, 0, sizeof(maybeEOL));
     maybeEOL[unsigned('\n')] = true;
     maybeEOL[unsigned('\r')] = true;
     maybeEOL[unsigned(LINE_SEPARATOR & 0xff)] = true;
     maybeEOL[unsigned(PARA_SEPARATOR & 0xff)] = true;
 
-    /* See getTokenInternal() for an explanation of maybeStrSpecial[]. */
+    // See getTokenInternal() for an explanation of maybeStrSpecial[].
     memset(maybeStrSpecial, 0, sizeof(maybeStrSpecial));
     maybeStrSpecial[unsigned('"')] = true;
     maybeStrSpecial[unsigned('\'')] = true;
@@ -320,7 +316,7 @@ TokenStream::TokenStream(ExclusiveContext *cx, const CompileOptions &options,
     maybeStrSpecial[unsigned(PARA_SEPARATOR & 0xff)] = true;
     maybeStrSpecial[unsigned(EOF & 0xff)] = true;
 
-    /* See Parser::assignExpr() for an explanation of isExprEnding[]. */
+    // See Parser::assignExpr() for an explanation of isExprEnding[].
     memset(isExprEnding, 0, sizeof(isExprEnding));
     isExprEnding[TOK_COMMA] = 1;
     isExprEnding[TOK_SEMI]  = 1;
@@ -342,7 +338,7 @@ TokenStream::~TokenStream()
     JS_ASSERT_IF(originPrincipals, originPrincipals->refcount);
 }
 
-/* Use the fastest available getc. */
+// Use the fastest available getc.
 #if defined(HAVE_GETC_UNLOCKED)
 # define fast_getc getc_unlocked
 #elif defined(HAVE__GETC_NOLOCK)
@@ -363,11 +359,11 @@ TokenStream::updateLineInfoForEOL()
 JS_ALWAYS_INLINE void
 TokenStream::updateFlagsForEOL()
 {
-    flags &= ~TSF_DIRTYLINE;
-    flags |= TSF_EOL;
+    flags.isDirtyLine = false;
+    flags.sawEOL = true;
 }
 
-/* This gets the next char, normalizing all EOL sequences to '\n' as it goes. */
+// This gets the next char, normalizing all EOL sequences to '\n' as it goes.
 int32_t
 TokenStream::getChar()
 {
@@ -375,26 +371,24 @@ TokenStream::getChar()
     if (JS_LIKELY(userbuf.hasRawChars())) {
         c = userbuf.getRawChar();
 
-        /*
-         * Normalize the jschar if it was a newline.  We need to detect any of
-         * these four characters:  '\n' (0x000a), '\r' (0x000d),
-         * LINE_SEPARATOR (0x2028), PARA_SEPARATOR (0x2029).  Testing for each
-         * one in turn is slow, so we use a single probabilistic check, and if
-         * that succeeds, test for them individually.
-         *
-         * We use the bottom 8 bits to index into a lookup table, succeeding
-         * when d&0xff is 0xa, 0xd, 0x28 or 0x29.  Among ASCII chars (which
-         * are by the far the most common) this gives false positives for '('
-         * (0x0028) and ')' (0x0029).  We could avoid those by incorporating
-         * the 13th bit of d into the lookup, but that requires extra shifting
-         * and masking and isn't worthwhile.  See TokenStream::TokenStream()
-         * for the initialization of the relevant entries in the table.
-         */
+        // Normalize the jschar if it was a newline.  We need to detect any of
+        // these four characters:  '\n' (0x000a), '\r' (0x000d),
+        // LINE_SEPARATOR (0x2028), PARA_SEPARATOR (0x2029).  Testing for each
+        // one in turn is slow, so we use a single probabilistic check, and if
+        // that succeeds, test for them individually.
+        //
+        // We use the bottom 8 bits to index into a lookup table, succeeding
+        // when d&0xff is 0xa, 0xd, 0x28 or 0x29.  Among ASCII chars (which
+        // are by the far the most common) this gives false positives for '('
+        // (0x0028) and ')' (0x0029).  We could avoid those by incorporating
+        // the 13th bit of d into the lookup, but that requires extra shifting
+        // and masking and isn't worthwhile.  See TokenStream::TokenStream()
+        // for the initialization of the relevant entries in the table.
         if (JS_UNLIKELY(maybeEOL[c & 0xff])) {
             if (c == '\n')
                 goto eol;
             if (c == '\r') {
-                /* if it's a \r\n sequence: treat as a single EOL, skip over the \n */
+                // If it's a \r\n sequence: treat as a single EOL, skip over the \n.
                 if (userbuf.hasRawChars())
                     userbuf.matchRawChar('\n');
                 goto eol;
@@ -405,7 +399,7 @@ TokenStream::getChar()
         return c;
     }
 
-    flags |= TSF_EOF;
+    flags.isEOF = true;
     return EOF;
 
   eol:
@@ -413,20 +407,18 @@ TokenStream::getChar()
     return '\n';
 }
 
-/*
- * This gets the next char. It does nothing special with EOL sequences, not
- * even updating the line counters.  It can be used safely if (a) the
- * resulting char is guaranteed to be ungotten (by ungetCharIgnoreEOL()) if
- * it's an EOL, and (b) the line-related state (lineno, linebase) is not used
- * before it's ungotten.
- */
+// This gets the next char. It does nothing special with EOL sequences, not
+// even updating the line counters.  It can be used safely if (a) the
+// resulting char is guaranteed to be ungotten (by ungetCharIgnoreEOL()) if
+// it's an EOL, and (b) the line-related state (lineno, linebase) is not used
+// before it's ungotten.
 int32_t
 TokenStream::getCharIgnoreEOL()
 {
     if (JS_LIKELY(userbuf.hasRawChars()))
         return userbuf.getRawChar();
 
-    flags |= TSF_EOF;
+    flags.isEOF = true;
     return EOF;
 }
 
@@ -443,11 +435,11 @@ TokenStream::ungetChar(int32_t c)
         JS_ASSERT(TokenBuf::isRawEOLChar(c2));
 #endif
 
-        /* if it's a \r\n sequence, also unget the \r */
+        // If it's a \r\n sequence, also unget the \r.
         if (!userbuf.atStart())
             userbuf.matchRawCharBackwards('\r');
 
-        JS_ASSERT(prevLinebase);    /* we should never get more than one EOL char */
+        JS_ASSERT(prevLinebase);    // we should never get more than one EOL char
         linebase = prevLinebase;
         prevLinebase = NULL;
         lineno--;
@@ -465,12 +457,10 @@ TokenStream::ungetCharIgnoreEOL(int32_t c)
     userbuf.ungetRawChar();
 }
 
-/*
- * Return true iff |n| raw characters can be read from this without reading past
- * EOF or a newline, and copy those characters into |cp| if so.  The characters
- * are not consumed: use skipChars(n) to do so after checking that the consumed
- * characters had appropriate values.
- */
+// Return true iff |n| raw characters can be read from this without reading past
+// EOF or a newline, and copy those characters into |cp| if so.  The characters
+// are not consumed: use skipChars(n) to do so after checking that the consumed
+// characters had appropriate values.
 bool
 TokenStream::peekChars(int n, jschar *cp)
 {
@@ -563,7 +553,7 @@ bool
 TokenStream::reportStrictModeErrorNumberVA(uint32_t offset, bool strictMode, unsigned errorNumber,
                                            va_list args)
 {
-    /* In strict mode code, this is an error, not merely a warning. */
+    // In strict mode code, this is an error, not merely a warning.
     unsigned flags = JSREPORT_STRICT;
     if (strictMode)
         flags |= JSREPORT_ERROR;
@@ -578,30 +568,26 @@ TokenStream::reportStrictModeErrorNumberVA(uint32_t offset, bool strictMode, uns
 void
 CompileError::throwError()
 {
-    /*
-     * If there's a runtime exception type associated with this error
-     * number, set that as the pending exception.  For errors occuring at
-     * compile time, this is very likely to be a JSEXN_SYNTAXERR.
-     *
-     * If an exception is thrown but not caught, the JSREPORT_EXCEPTION
-     * flag will be set in report.flags.  Proper behavior for an error
-     * reporter is to ignore a report with this flag for all but top-level
-     * compilation errors.  The exception will remain pending, and so long
-     * as the non-top-level "load", "eval", or "compile" native function
-     * returns false, the top-level reporter will eventually receive the
-     * uncaught exception report.
-     */
+    // If there's a runtime exception type associated with this error
+    // number, set that as the pending exception.  For errors occuring at
+    // compile time, this is very likely to be a JSEXN_SYNTAXERR.
+    //
+    // If an exception is thrown but not caught, the JSREPORT_EXCEPTION
+    // flag will be set in report.flags.  Proper behavior for an error
+    // reporter is to ignore a report with this flag for all but top-level
+    // compilation errors.  The exception will remain pending, and so long
+    // as the non-top-level "load", "eval", or "compile" native function
+    // returns false, the top-level reporter will eventually receive the
+    // uncaught exception report.
     if (!js_ErrorToException(cx, message, &report, NULL, NULL)) {
-        /*
-         * If debugErrorHook is present then we give it a chance to veto
-         * sending the error on to the regular error reporter.
-         */
+        // If debugErrorHook is present then we give it a chance to veto
+        // sending the error on to the regular error reporter.
         bool reportError = true;
         if (JSDebugErrorHook hook = cx->runtime()->debugHooks.debugErrorHook) {
             reportError = hook(cx, message, &report, cx->runtime()->debugHooks.debugErrorHookData);
         }
 
-        /* Report the error */
+        // Report the error.
         if (reportError && cx->errorReporter)
             cx->errorReporter(cx, message, &report);
     }
@@ -660,16 +646,14 @@ TokenStream::reportCompileErrorNumberVA(uint32_t offset, unsigned flags, unsigne
         return false;
     }
 
-    /*
-     * Given a token, T, that we want to complain about: if T's (starting)
-     * lineno doesn't match TokenStream's lineno, that means we've scanned past
-     * the line that T starts on, which makes it hard to print some or all of
-     * T's (starting) line for context.
-     *
-     * So we don't even try, leaving report.linebuf and friends zeroed.  This
-     * means that any error involving a multi-line token (e.g. an unterminated
-     * multi-line string literal) won't have a context printed.
-     */
+    // Given a token, T, that we want to complain about: if T's (starting)
+    // lineno doesn't match TokenStream's lineno, that means we've scanned past
+    // the line that T starts on, which makes it hard to print some or all of
+    // T's (starting) line for context.
+    //
+    // So we don't even try, leaving report.linebuf and friends zeroed.  This
+    // means that any error involving a multi-line token (e.g. an unterminated
+    // multi-line string literal) won't have a context printed.
     if (err.report.lineno == lineno) {
         const jschar *tokenStart = userbuf.base() + offset;
 
@@ -766,12 +750,10 @@ TokenStream::reportAsmJSError(uint32_t offset, unsigned errorNumber, ...)
     va_end(args);
 }
 
-/*
- * We have encountered a '\': check for a Unicode escape sequence after it.
- * Return 'true' and the character code value (by value) if we found a
- * Unicode escape sequence.  Otherwise, return 'false'.  In both cases, do not
- * advance along the buffer.
- */
+// We have encountered a '\': check for a Unicode escape sequence after it.
+// Return 'true' and the character code value (by value) if we found a
+// Unicode escape sequence.  Otherwise, return 'false'.  In both cases, do not
+// advance along the buffer.
 bool
 TokenStream::peekUnicodeEscape(int *result)
 {
@@ -810,10 +792,8 @@ TokenStream::matchUnicodeEscapeIdent(int32_t *cp)
     return false;
 }
 
-/*
- * Helper function which returns true if the first length(q) characters in p are
- * the same as the characters in q.
- */
+// Helper function which returns true if the first length(q) characters in p are
+// the same as the characters in q.
 static bool
 CharsMatch(const jschar *p, const char *q) {
     while (*q) {
@@ -826,14 +806,13 @@ CharsMatch(const jschar *p, const char *q) {
 bool
 TokenStream::getSourceMappingURL(bool isMultiline, bool shouldWarnDeprecated)
 {
-    /* Match comments of the form "//# sourceMappingURL=<url>" or
-     * "/\* //# sourceMappingURL=<url> *\/"
-     *
-     * To avoid a crashing bug in IE, several JavaScript transpilers wrap single
-     * line comments containing a source mapping URL inside a multiline
-     * comment. To avoid potentially expensive lookahead and backtracking, we
-     * only check for this case if we encounter a '#' character.
-     */
+    // Match comments of the form "//# sourceMappingURL=<url>" or
+    // "/\* //# sourceMappingURL=<url> *\/"
+    //
+    // To avoid a crashing bug in IE, several JavaScript transpilers wrap single
+    // line comments containing a source mapping URL inside a multiline
+    // comment. To avoid potentially expensive lookahead and backtracking, we
+    // only check for this case if we encounter a '#' character.
     jschar peeked[18];
     int32_t c;
 
@@ -847,11 +826,9 @@ TokenStream::getSourceMappingURL(bool isMultiline, bool shouldWarnDeprecated)
 
         while ((c = peekChar()) && c != EOF && !IsSpaceOrBOM2(c)) {
             getChar();
-            /*
-             * Source mapping URLs can occur in both single- and multiline
-             * comments. If we're currently inside a multiline comment, we also
-             * need to recognize multiline comment terminators.
-             */
+            // Source mapping URLs can occur in both single- and multiline
+            // comments. If we're currently inside a multiline comment, we also
+            // need to recognize multiline comment terminators.
             if (isMultiline && c == '*' && peekChar() == '/') {
                 ungetChar('*');
                 break;
@@ -860,8 +837,8 @@ TokenStream::getSourceMappingURL(bool isMultiline, bool shouldWarnDeprecated)
         }
 
         if (tokenbuf.empty())
-            /* The source map's URL was missing, but not quite an exception that
-             * we should stop and drop everything for, though. */
+            // The source map's URL was missing, but not quite an exception that
+            // we should stop and drop everything for, though.
             return true;
 
         size_t sourceMapLength = tokenbuf.length();
@@ -901,10 +878,8 @@ TokenStream::atomize(ExclusiveContext *cx, CharBuffer &cb)
 bool
 IsTokenSane(Token *tp)
 {
-    /*
-     * Nb: TOK_EOL should never be used in an actual Token;  it should only be
-     * returned as a TokenKind from peekTokenSameLine().
-     */
+    // Nb: TOK_EOL should never be used in an actual Token;  it should only be
+    // returned as a TokenKind from peekTokenSameLine().
     if (tp->type < TOK_ERROR || tp->type >= TOK_LIMIT || tp->type == TOK_EOL)
         return false;
 
@@ -951,7 +926,7 @@ TokenStream::checkForKeyword(const jschar *s, size_t length, TokenKind *ttp)
 
     if (kw->tokentype != TOK_STRICT_RESERVED) {
         if (kw->version <= versionNumber()) {
-            /* Working keyword. */
+            // Working keyword.
             if (ttp) {
                 *ttp = kw->tokentype;
                 return true;
@@ -959,16 +934,14 @@ TokenStream::checkForKeyword(const jschar *s, size_t length, TokenKind *ttp)
             return reportError(JSMSG_RESERVED_ID, kw->chars);
         }
 
-        /*
-         * The keyword is not in this version. Treat it as an identifier,
-         * unless it is let or yield which we treat as TOK_STRICT_RESERVED by
-         * falling through to the code below (ES5 forbids them in strict mode).
-         */
+        // The keyword is not in this version. Treat it as an identifier,
+        // unless it is let or yield which we treat as TOK_STRICT_RESERVED by
+        // falling through to the code below (ES5 forbids them in strict mode).
         if (kw->tokentype != TOK_LET && kw->tokentype != TOK_YIELD)
             return true;
     }
 
-    /* Strict reserved word. */
+    // Strict reserved word.
     return reportStrictModeError(JSMSG_RESERVED_ID, kw->chars);
 }
 
@@ -999,20 +972,18 @@ enum FirstCharKind {
     LastCharKind = Other
 };
 
-/*
- * OneChar: 40,  41,  44,  58,  59,  63,  91,  93,  123, 125, 126:
- *          '(', ')', ',', ':', ';', '?', '[', ']', '{', '}', '~'
- * Ident:   36, 65..90, 95, 97..122: '$', 'A'..'Z', '_', 'a'..'z'
- * Dot:     46: '.'
- * Equals:  61: '='
- * String:  34, 39: '"', '\''
- * Dec:     49..57: '1'..'9'
- * Plus:    43: '+'
- * BasePrefix:  48: '0'
- * Space:   9, 11, 12, 32: '\t', '\v', '\f', ' '
- * EOL:     10, 13: '\n', '\r'
- */
-
+// OneChar: 40,  41,  44,  58,  59,  63,  91,  93,  123, 125, 126:
+//          '(', ')', ',', ':', ';', '?', '[', ']', '{', '}', '~'
+// Ident:   36, 65..90, 95, 97..122: '$', 'A'..'Z', '_', 'a'..'z'
+// Dot:     46: '.'
+// Equals:  61: '='
+// String:  34, 39: '"', '\''
+// Dec:     49..57: '1'..'9'
+// Plus:    43: '+'
+// BasePrefix:  48: '0'
+// Space:   9, 11, 12, 32: '\t', '\v', '\f', ' '
+// EOL:     10, 13: '\n', '\r'
+//
 #define T_COMMA     TOK_COMMA
 #define T_COLON     TOK_COLON
 #define T_BITNOT    TOK_BITNOT
@@ -1042,9 +1013,8 @@ static_assert(LastCharKind < (1 << (sizeof(firstCharKinds[0]) * 8)),
               "Elements of firstCharKinds[] are too small");
 
 TokenKind
-TokenStream::getTokenInternal()
+TokenStream::getTokenInternal(Modifier modifier)
 {
-    TokenKind tt;
     int c, qc;
     Token *tp;
     FirstCharKind c1kind;
@@ -1057,18 +1027,16 @@ TokenStream::getTokenInternal()
   retry:
     if (JS_UNLIKELY(!userbuf.hasRawChars())) {
         tp = newToken(0);
-        tt = TOK_EOF;
-        flags |= TSF_EOF;
+        tp->type = TOK_EOF;
+        flags.isEOF = true;
         goto out;
     }
 
     c = userbuf.getRawChar();
     JS_ASSERT(c != EOF);
 
-    /*
-     * Chars not in the range 0..127 are rare.  Getting them out of the way
-     * early allows subsequent checking to be faster.
-     */
+    // Chars not in the range 0..127 are rare.  Getting them out of the way
+    // early allows subsequent checking to be faster.
     if (JS_UNLIKELY(c >= 128)) {
         if (IsSpaceOrBOM2(c)) {
             if (c == LINE_SEPARATOR || c == PARA_SEPARATOR) {
@@ -1081,7 +1049,7 @@ TokenStream::getTokenInternal()
 
         tp = newToken(-1);
 
-        /* '$' and '_' don't pass IsLetter, but they're < 128 so never appear here. */
+        // '$' and '_' don't pass IsLetter, but they're < 128 so never appear here.
         JS_STATIC_ASSERT('$' < 128 && '_' < 128);
         if (IsLetter(c)) {
             identStart = userbuf.addressOfNextRawChar() - 1;
@@ -1092,47 +1060,43 @@ TokenStream::getTokenInternal()
         goto badchar;
     }
 
-    /*
-     * Get the token kind, based on the first char.  The ordering of c1kind
-     * comparison is based on the frequency of tokens in real code -- Parsemark
-     * (which represents typical JS code on the web) and the Unreal demo (which
-     * represents asm.js code).
-     *
-     *                  Parsemark   Unreal
-     *  OneChar         32.9%       39.7%
-     *  Space           25.0%        0.6%
-     *  Ident           19.2%       36.4%
-     *  Dec              7.2%        5.1%
-     *  String           7.9%        0.0%
-     *  EOL              1.7%        0.0%
-     *  BasePrefix       0.4%        4.9%
-     *  Other            5.7%       13.3%
-     *
-     * The ordering is based mostly only Parsemark frequencies, with Unreal
-     * frequencies used to break close categories (e.g. |Dec| and |String|).
-     * |Other| is biggish, but no other token kind is common enough for it to
-     * be worth adding extra values to FirstCharKind.
-     */
+    // Get the token kind, based on the first char.  The ordering of c1kind
+    // comparison is based on the frequency of tokens in real code -- Parsemark
+    // (which represents typical JS code on the web) and the Unreal demo (which
+    // represents asm.js code).
+    //
+    //                  Parsemark   Unreal
+    //  OneChar         32.9%       39.7%
+    //  Space           25.0%        0.6%
+    //  Ident           19.2%       36.4%
+    //  Dec              7.2%        5.1%
+    //  String           7.9%        0.0%
+    //  EOL              1.7%        0.0%
+    //  BasePrefix       0.4%        4.9%
+    //  Other            5.7%       13.3%
+    //
+    // The ordering is based mostly only Parsemark frequencies, with Unreal
+    // frequencies used to break close categories (e.g. |Dec| and |String|).
+    // |Other| is biggish, but no other token kind is common enough for it to
+    // be worth adding extra values to FirstCharKind.
+    //
     c1kind = FirstCharKind(firstCharKinds[c]);
 
-    /*
-     * Look for an unambiguous single-char token.
-     */
+    // Look for an unambiguous single-char token.
+    //
     if (c1kind < OneChar_Max) {
         tp = newToken(-1);
-        tt = TokenKind(c1kind);
+        tp->type = TokenKind(c1kind);
         goto out;
     }
 
-    /*
-     * Skip over non-EOL whitespace chars.
-     */
+    // Skip over non-EOL whitespace chars.
+    //
     if (c1kind == Space)
         goto retry;
 
-    /*
-     * Look for an identifier.
-     */
+    // Look for an identifier.
+    //
     if (c1kind == Ident) {
         tp = newToken(-1);
         identStart = userbuf.addressOfNextRawChar() - 1;
@@ -1151,11 +1115,9 @@ TokenStream::getTokenInternal()
         }
         ungetCharIgnoreEOL(c);
 
-        /*
-         * Identifiers containing no Unicode escapes can be processed directly
-         * from userbuf.  The rest must use the escapes converted via tokenbuf
-         * before atomizing.
-         */
+        // Identifiers containing no Unicode escapes can be processed directly
+        // from userbuf.  The rest must use the escapes converted via tokenbuf
+        // before atomizing.
         const jschar *chars;
         size_t length;
         if (hadUnicodeEscape) {
@@ -1169,25 +1131,25 @@ TokenStream::getTokenInternal()
             length = userbuf.addressOfNextRawChar() - identStart;
         }
 
-        /* Check for keywords unless parser asks us to ignore keywords. */
-        if (!(flags & TSF_KEYWORD_IS_NAME)) {
-            tt = TOK_NAME;
-            if (!checkForKeyword(chars, length, &tt))
+        // Check for keywords unless the parser told us not to.
+        if (modifier != KeywordIsName) {
+            tp->type = TOK_NAME;
+            if (!checkForKeyword(chars, length, &tp->type))
                 goto error;
-            if (tt != TOK_NAME)                goto out;
+            if (tp->type != TOK_NAME)
+                goto out;
         }
 
         JSAtom *atom = AtomizeChars<CanGC>(cx, chars, length);
         if (!atom)
             goto error;
+        tp->type = TOK_NAME;
         tp->setName(atom->asPropertyName());
-        tt = TOK_NAME;
         goto out;
     }
 
-    /*
-     * Look for a decimal number.
-     */
+    // Look for a decimal number.
+    //
     if (c1kind == Dec) {
         tp = newToken(-1);
         numStart = userbuf.addressOfNextRawChar() - 1;
@@ -1226,11 +1188,9 @@ TokenStream::getTokenInternal()
             goto error;
         }
 
-        /*
-         * Unlike identifiers and strings, numbers cannot contain escaped
-         * chars, so we don't need to use tokenbuf.  Instead we can just
-         * convert the jschars in userbuf directly to the numeric value.
-         */
+        // Unlike identifiers and strings, numbers cannot contain escaped
+        // chars, so we don't need to use tokenbuf.  Instead we can just
+        // convert the jschars in userbuf directly to the numeric value.
         double dval;
         if (!((decimalPoint == HasDecimal) || hasExp)) {
             if (!GetDecimalInteger(cx, numStart, userbuf.addressOfNextRawChar(), &dval))
@@ -1240,26 +1200,23 @@ TokenStream::getTokenInternal()
             if (!js_strtod(cx, numStart, userbuf.addressOfNextRawChar(), &dummy, &dval))
                 goto error;
         }
+        tp->type = TOK_NUMBER;
         tp->setNumber(dval, decimalPoint);
-        tt = TOK_NUMBER;
         goto out;
     }
 
-    /*
-     * Look for a string.
-     */
+    // Look for a string.
+    //
     if (c1kind == String) {
         tp = newToken(-1);
         qc = c;
         tokenbuf.clear();
         while (true) {
-            /*
-             * We need to detect any of these chars:  " or ', \n (or its
-             * equivalents), \\, EOF.  We use maybeStrSpecial[] in a manner
-             * similar to maybeEOL[], see above.  Because we detect EOL
-             * sequences here and put them back immediately, we can use
-             * getCharIgnoreEOL().
-             */
+            // We need to detect any of these chars:  " or ', \n (or its
+            // equivalents), \\, EOF.  We use maybeStrSpecial[] in a manner
+            // similar to maybeEOL[], see above.  Because we detect EOL
+            // sequences here and put them back immediately, we can use
+            // getCharIgnoreEOL().
             c = getCharIgnoreEOL();
             if (maybeStrSpecial[c & 0xff]) {
                 if (c == qc)
@@ -1278,11 +1235,11 @@ TokenStream::getTokenInternal()
                             int32_t val = JS7_UNDEC(c);
 
                             c = peekChar();
-                            /* Strict mode code allows only \0, then a non-digit. */
+                            // Strict mode code allows only \0, then a non-digit.
                             if (val != 0 || JS7_ISDEC(c)) {
                                 if (!reportStrictModeError(JSMSG_DEPRECATED_OCTAL))
                                     goto error;
-                                flags |= TSF_OCTAL_CHAR;
+                                flags.sawOctalEscape = true;
                             }
                             if ('0' <= c && c < '8') {
                                 val = 8 * val + JS7_UNDEC(c);
@@ -1324,10 +1281,8 @@ TokenStream::getTokenInternal()
                                 goto error;
                             }
                         } else if (c == '\n') {
-                            /*
-                             * ES5 7.8.4: an escaped line terminator represents
-                             * no character.
-                             */
+                            // ES5 7.8.4: an escaped line terminator represents
+                            // no character.
                             continue;
                         }
                         break;
@@ -1344,16 +1299,15 @@ TokenStream::getTokenInternal()
         JSAtom *atom = atomize(cx, tokenbuf);
         if (!atom)
             goto error;
+        tp->type = TOK_STRING;
         tp->setAtom(atom);
-        tt = TOK_STRING;
         goto out;
     }
 
-    /*
-     * Skip over EOL chars, updating line state along the way.
-     */
+    // Skip over EOL chars, updating line state along the way.
+    //
     if (c1kind == EOL) {
-        /* If it's a \r\n sequence: treat as a single EOL, skip over the \n. */
+        // If it's a \r\n sequence: treat as a single EOL, skip over the \n.
         if (c == '\r' && userbuf.hasRawChars())
             userbuf.matchRawChar('\n');
         updateLineInfoForEOL();
@@ -1362,6 +1316,7 @@ TokenStream::getTokenInternal()
     }
 
     // Look for a hexadecimal, octal, or binary number.
+    //
     if (c1kind == BasePrefix) {
         tp = newToken(-1);
         int radix;
@@ -1374,7 +1329,7 @@ TokenStream::getTokenInternal()
                 reportError(JSMSG_MISSING_HEXDIGITS);
                 goto error;
             }
-            numStart = userbuf.addressOfNextRawChar() - 1;  /* one past the '0x' */
+            numStart = userbuf.addressOfNextRawChar() - 1;  // one past the '0x'
             while (JS7_ISHEX(c))
                 c = getCharIgnoreEOL();
         } else if (c == 'b' || c == 'B') {
@@ -1385,7 +1340,7 @@ TokenStream::getTokenInternal()
                 reportError(JSMSG_MISSING_BINARY_DIGITS);
                 goto error;
             }
-            numStart = userbuf.addressOfNextRawChar() - 1;  /* one past the '0b' */
+            numStart = userbuf.addressOfNextRawChar() - 1;  // one past the '0b'
             while (c == '0' || c == '1')
                 c = getCharIgnoreEOL();
         } else if (c == 'o' || c == 'O') {
@@ -1396,33 +1351,31 @@ TokenStream::getTokenInternal()
                 reportError(JSMSG_MISSING_OCTAL_DIGITS);
                 goto error;
             }
-            numStart = userbuf.addressOfNextRawChar() - 1;  /* one past the '0o' */
+            numStart = userbuf.addressOfNextRawChar() - 1;  // one past the '0o'
             while ('0' <= c && c <= '7')
                 c = getCharIgnoreEOL();
         } else if (JS7_ISDEC(c)) {
             radix = 8;
-            numStart = userbuf.addressOfNextRawChar() - 1;  /* one past the '0' */
+            numStart = userbuf.addressOfNextRawChar() - 1;  // one past the '0'
             while (JS7_ISDEC(c)) {
-                /* Octal integer literals are not permitted in strict mode code. */
+                // Octal integer literals are not permitted in strict mode code.
                 if (!reportStrictModeError(JSMSG_DEPRECATED_OCTAL))
                     goto error;
 
-                /*
-                 * Outside strict mode, we permit 08 and 09 as decimal numbers,
-                 * which makes our behaviour a superset of the ECMA numeric
-                 * grammar. We might not always be so permissive, so we warn
-                 * about it.
-                 */
+                // Outside strict mode, we permit 08 and 09 as decimal numbers,
+                // which makes our behaviour a superset of the ECMA numeric
+                // grammar. We might not always be so permissive, so we warn
+                // about it.
                 if (c >= '8') {
                     if (!reportWarning(JSMSG_BAD_OCTAL, c == '8' ? "08" : "09")) {
                         goto error;
                     }
-                    goto decimal;   /* use the decimal scanner for the rest of the number */
+                    goto decimal;   // use the decimal scanner for the rest of the number
                 }
                 c = getCharIgnoreEOL();
             }
         } else {
-            /* '0' not followed by 'x', 'X' or a digit;  scan as a decimal number. */
+            // '0' not followed by 'x', 'X' or a digit;  scan as a decimal number.
             numStart = userbuf.addressOfNextRawChar() - 1;
             goto decimal;
         }
@@ -1437,14 +1390,13 @@ TokenStream::getTokenInternal()
         const jschar *dummy;
         if (!GetPrefixInteger(cx, numStart, userbuf.addressOfNextRawChar(), radix, &dummy, &dval))
             goto error;
+        tp->type = TOK_NUMBER;
         tp->setNumber(dval, NoDecimal);
-        tt = TOK_NUMBER;
         goto out;
     }
 
-    /*
-     * This handles everything else.
-     */
+    // This handles everything else.
+    //
     JS_ASSERT(c1kind == Other);
     tp = newToken(-1);
     switch (c) {
@@ -1458,29 +1410,29 @@ TokenStream::getTokenInternal()
         }
         if (c == '.') {
             if (matchChar('.')) {
-                tt = TOK_TRIPLEDOT;
+                tp->type = TOK_TRIPLEDOT;
                 goto out;
             }
         }
         ungetCharIgnoreEOL(c);
-        tt = TOK_DOT;
-        break;
+        tp->type = TOK_DOT;
+        goto out;
 
       case '=':
         if (matchChar('='))
-            tt = matchChar('=') ? TOK_STRICTEQ : TOK_EQ;
+            tp->type = matchChar('=') ? TOK_STRICTEQ : TOK_EQ;
         else if (matchChar('>'))
-            tt = TOK_ARROW;
+            tp->type = TOK_ARROW;
         else
-            tt = TOK_ASSIGN;
-        break;
+            tp->type = TOK_ASSIGN;
+        goto out;
 
       case '+':
         if (matchChar('+'))
-            tt = TOK_INC;
+            tp->type = TOK_INC;
         else
-            tt = matchChar('=') ? TOK_ADDASSIGN : TOK_PLUS;
-        break;
+            tp->type = matchChar('=') ? TOK_ADDASSIGN : TOK_ADD;
+        goto out;
 
       case '\\':
         hadUnicodeEscape = matchUnicodeEscapeIdStart(&qc);
@@ -1492,31 +1444,31 @@ TokenStream::getTokenInternal()
 
       case '|':
         if (matchChar('|'))
-            tt = TOK_OR;
+            tp->type = TOK_OR;
         else
-            tt = matchChar('=') ? TOK_BITORASSIGN : TOK_BITOR;
-        break;
+            tp->type = matchChar('=') ? TOK_BITORASSIGN : TOK_BITOR;
+        goto out;
 
       case '^':
-        tt = matchChar('=') ? TOK_BITXORASSIGN : TOK_BITXOR;
-        break;
+        tp->type = matchChar('=') ? TOK_BITXORASSIGN : TOK_BITXOR;
+        goto out;
 
       case '&':
         if (matchChar('&'))
-            tt = TOK_AND;
+            tp->type = TOK_AND;
         else
-            tt = matchChar('=') ? TOK_BITANDASSIGN : TOK_BITAND;
-        break;
+            tp->type = matchChar('=') ? TOK_BITANDASSIGN : TOK_BITAND;
+        goto out;
 
       case '!':
         if (matchChar('='))
-            tt = matchChar('=') ? TOK_STRICTNE : TOK_NE;
+            tp->type = matchChar('=') ? TOK_STRICTNE : TOK_NE;
         else
-            tt = TOK_NOT;
-        break;
+            tp->type = TOK_NOT;
+        goto out;
 
       case '<':
-        /* NB: treat HTML begin-comment as comment-till-end-of-line */
+        // NB: treat HTML begin-comment as comment-till-end-of-line.
         if (matchChar('!')) {
             if (matchChar('-')) {
                 if (matchChar('-'))
@@ -1526,31 +1478,29 @@ TokenStream::getTokenInternal()
             ungetChar('!');
         }
         if (matchChar('<')) {
-            tt = matchChar('=') ? TOK_LSHASSIGN : TOK_LSH;
+            tp->type = matchChar('=') ? TOK_LSHASSIGN : TOK_LSH;
         } else {
-            tt = matchChar('=') ? TOK_LE : TOK_LT;
+            tp->type = matchChar('=') ? TOK_LE : TOK_LT;
         }
-        break;
+        goto out;
 
       case '>':
         if (matchChar('>')) {
             if (matchChar('>'))
-                tt = matchChar('=') ? TOK_URSHASSIGN : TOK_URSH;
+                tp->type = matchChar('=') ? TOK_URSHASSIGN : TOK_URSH;
             else
-                tt = matchChar('=') ? TOK_RSHASSIGN : TOK_RSH;
+                tp->type = matchChar('=') ? TOK_RSHASSIGN : TOK_RSH;
         } else {
-            tt = matchChar('=') ? TOK_GE : TOK_GT;
+            tp->type = matchChar('=') ? TOK_GE : TOK_GT;
         }
-        break;
+        goto out;
 
       case '*':
-        tt = matchChar('=') ? TOK_MULASSIGN : TOK_STAR;
-        break;
+        tp->type = matchChar('=') ? TOK_MULASSIGN : TOK_MUL;
+        goto out;
 
       case '/':
-        /*
-         * Look for a single-line comment.
-         */
+        // Look for a single-line comment.
         if (matchChar('/')) {
             c = peekChar();
             if (c == '@' || c == '#') {
@@ -1566,9 +1516,7 @@ TokenStream::getTokenInternal()
             goto retry;
         }
 
-        /*
-         * Look for a multi-line comment.
-         */
+        // Look for a multi-line comment.
         if (matchChar('*')) {
             unsigned linenoBefore = lineno;
             while ((c = getChar()) != EOF &&
@@ -1588,10 +1536,8 @@ TokenStream::getTokenInternal()
             goto retry;
         }
 
-        /*
-         * Look for a regexp.
-         */
-        if (flags & TSF_OPERAND) {
+        // Look for a regexp.
+        if (modifier == Operand) {
             tokenbuf.clear();
 
             bool inCharClass = false;
@@ -1606,7 +1552,7 @@ TokenStream::getTokenInternal()
                 } else if (c == ']') {
                     inCharClass = false;
                 } else if (c == '/' && !inCharClass) {
-                    /* For compat with IE, allow unescaped / in char classes. */
+                    // For compat with IE, allow unescaped / in char classes.
                     break;
                 }
                 if (c == '\n' || c == EOF) {
@@ -1645,27 +1591,27 @@ TokenStream::getTokenInternal()
                 (void) getChar();
                 goto error;
             }
+            tp->type = TOK_REGEXP;
             tp->setRegExpFlags(reflags);
-            tt = TOK_REGEXP;
-            break;
+            goto out;
         }
 
-        tt = matchChar('=') ? TOK_DIVASSIGN : TOK_DIV;
-        break;
+        tp->type = matchChar('=') ? TOK_DIVASSIGN : TOK_DIV;
+        goto out;
 
       case '%':
-        tt = matchChar('=') ? TOK_MODASSIGN : TOK_MOD;
-        break;
+        tp->type = matchChar('=') ? TOK_MODASSIGN : TOK_MOD;
+        goto out;
 
       case '-':
         if (matchChar('-')) {
-            if (peekChar() == '>' && !(flags & TSF_DIRTYLINE))
+            if (peekChar() == '>' && !flags.isDirtyLine)
                 goto skipline;
-            tt = TOK_DEC;
+            tp->type = TOK_DEC;
         } else {
-            tt = matchChar('=') ? TOK_SUBASSIGN : TOK_MINUS;
+            tp->type = matchChar('=') ? TOK_SUBASSIGN : TOK_SUB;
         }
-        break;
+        goto out;
 
       badchar:
       default:
@@ -1673,15 +1619,16 @@ TokenStream::getTokenInternal()
         goto error;
     }
 
+    MOZ_ASSUME_UNREACHABLE("should have jumped to |out| or |error|");
+
   out:
-    flags |= TSF_DIRTYLINE;
+    flags.isDirtyLine = true;
     tp->pos.end = userbuf.addressOfNextRawChar() - userbuf.base();
-    tp->type = tt;
     JS_ASSERT(IsTokenSane(tp));
-    return tt;
+    return tp->type;
 
   error:
-    flags |= TSF_DIRTYLINE;
+    flags.isDirtyLine = true;
     tp->pos.end = userbuf.addressOfNextRawChar() - userbuf.base();
     tp->type = TOK_ERROR;
     JS_ASSERT(IsTokenSane(tp));
@@ -1692,17 +1639,15 @@ TokenStream::getTokenInternal()
 void
 TokenStream::onError()
 {
-    flags |= TSF_HAD_ERROR;
+    flags.hadError = true;
 #ifdef DEBUG
-    /*
-     * Poisoning userbuf on error establishes an invariant: once an erroneous
-     * token has been seen, userbuf will not be consulted again.  This is true
-     * because the parser will either (a) deal with the TOK_ERROR token by
-     * aborting parsing immediately; or (b) if the TOK_ERROR token doesn't
-     * match what it expected, it will unget the token, and the next getToken()
-     * call will immediately return the just-gotten TOK_ERROR token again
-     * without consulting userbuf, thanks to the lookahead buffer.
-     */
+    // Poisoning userbuf on error establishes an invariant: once an erroneous
+    // token has been seen, userbuf will not be consulted again.  This is true
+    // because the parser will either (a) deal with the TOK_ERROR token by
+    // aborting parsing immediately; or (b) if the TOK_ERROR token doesn't
+    // match what it expected, it will unget the token, and the next getToken()
+    // call will immediately return the just-gotten TOK_ERROR token again
+    // without consulting userbuf, thanks to the lookahead buffer.
     userbuf.poison();
 #endif
 }
@@ -1720,13 +1665,13 @@ js_fgets(char *buf, int size, FILE *file)
     crflag = false;
     for (i = 0; i < n && (c = fast_getc(file)) != EOF; i++) {
         buf[i] = c;
-        if (c == '\n') {        /* any \n ends a line */
-            i++;                /* keep the \n; we know there is room for \0 */
+        if (c == '\n') {        // any \n ends a line
+            i++;                // keep the \n; we know there is room for \0
             break;
         }
-        if (crflag) {           /* \r not followed by \n ends line at the \r */
+        if (crflag) {           // \r not followed by \n ends line at the \r
             ungetc(c, file);
-            break;              /* and overwrite c in buf with \0 */
+            break;              // and overwrite c in buf with \0
         }
         crflag = (c == '\r');
     }
@@ -1752,9 +1697,9 @@ TokenKindToString(TokenKind tt)
       case TOK_BITOR:           return "TOK_BITOR";
       case TOK_BITXOR:          return "TOK_BITXOR";
       case TOK_BITAND:          return "TOK_BITAND";
-      case TOK_PLUS:            return "TOK_PLUS";
-      case TOK_MINUS:           return "TOK_MINUS";
-      case TOK_STAR:            return "TOK_STAR";
+      case TOK_ADD:             return "TOK_ADD";
+      case TOK_SUB:             return "TOK_SUB";
+      case TOK_MUL:             return "TOK_MUL";
       case TOK_DIV:             return "TOK_DIV";
       case TOK_MOD:             return "TOK_MOD";
       case TOK_INC:             return "TOK_INC";
diff --git a/js/src/frontend/TokenStream.h b/js/src/frontend/TokenStream.h
index 7e5b989565e2..2ffa4082bdfd 100644
--- a/js/src/frontend/TokenStream.h
+++ b/js/src/frontend/TokenStream.h
@@ -7,9 +7,7 @@
 #ifndef frontend_TokenStream_h
 #define frontend_TokenStream_h
 
-/*
- * JS lexical scanner interface.
- */
+// JS lexical scanner interface.
 
 #include "mozilla/DebugOnly.h"
 #include "mozilla/PodOperations.h"
@@ -32,72 +30,68 @@ namespace frontend {
 // Values of this type are used to index into arrays such as isExprEnding[],
 // so the first value must be zero.
 enum TokenKind {
-    TOK_ERROR = 0,                 /* well-known as the only code < EOF */
-    TOK_EOF,                       /* end of file */
-    TOK_EOL,                       /* end of line; only returned by peekTokenSameLine() */
-    TOK_SEMI,                      /* semicolon */
-    TOK_COMMA,                     /* comma operator */
-    TOK_HOOK, TOK_COLON,           /* conditional (?:) */
-    TOK_INC, TOK_DEC,              /* increment/decrement (++ --) */
-    TOK_DOT,                       /* member operator (.) */
-    TOK_TRIPLEDOT,                 /* for rest arguments (...) */
-    TOK_LB, TOK_RB,                /* left and right brackets */
-    TOK_LC, TOK_RC,                /* left and right curlies (braces) */
-    TOK_LP, TOK_RP,                /* left and right parentheses */
-    TOK_NAME,                      /* identifier */
-    TOK_NUMBER,                    /* numeric constant */
-    TOK_STRING,                    /* string constant */
-    TOK_REGEXP,                    /* RegExp constant */
-    TOK_TRUE,                      /* true */
-    TOK_FALSE,                     /* false */
-    TOK_NULL,                      /* null */
-    TOK_THIS,                      /* this */
-    TOK_FUNCTION,                  /* function keyword */
-    TOK_IF,                        /* if keyword */
-    TOK_ELSE,                      /* else keyword */
-    TOK_SWITCH,                    /* switch keyword */
-    TOK_CASE,                      /* case keyword */
-    TOK_DEFAULT,                   /* default keyword */
-    TOK_WHILE,                     /* while keyword */
-    TOK_DO,                        /* do keyword */
-    TOK_FOR,                       /* for keyword */
-    TOK_BREAK,                     /* break keyword */
-    TOK_CONTINUE,                  /* continue keyword */
-    TOK_VAR,                       /* var keyword */
-    TOK_CONST,                     /* const keyword */
-    TOK_WITH,                      /* with keyword */
-    TOK_RETURN,                    /* return keyword */
-    TOK_NEW,                       /* new keyword */
-    TOK_DELETE,                    /* delete keyword */
-    TOK_TRY,                       /* try keyword */
-    TOK_CATCH,                     /* catch keyword */
-    TOK_FINALLY,                   /* finally keyword */
-    TOK_THROW,                     /* throw keyword */
-    TOK_DEBUGGER,                  /* debugger keyword */
-    TOK_YIELD,                     /* yield from generator function */
-    TOK_LET,                       /* let keyword */
-    TOK_EXPORT,                    /* export keyword */
-    TOK_IMPORT,                    /* import keyword */
-    TOK_RESERVED,                  /* reserved keywords */
-    TOK_STRICT_RESERVED,           /* reserved keywords in strict mode */
+    TOK_ERROR = 0,                 // well-known as the only code < EOF
+    TOK_EOF,                       // end of file
+    TOK_EOL,                       // end of line; only returned by peekTokenSameLine()
+    TOK_SEMI,                      // semicolon
+    TOK_COMMA,                     // comma operator
+    TOK_HOOK, TOK_COLON,           // conditional (?:)
+    TOK_INC, TOK_DEC,              // increment/decrement (++ --)
+    TOK_DOT,                       // member operator (.)
+    TOK_TRIPLEDOT,                 // for rest arguments (...)
+    TOK_LB, TOK_RB,                // left and right brackets
+    TOK_LC, TOK_RC,                // left and right curlies (braces)
+    TOK_LP, TOK_RP,                // left and right parentheses
+    TOK_NAME,                      // identifier
+    TOK_NUMBER,                    // numeric constant
+    TOK_STRING,                    // string constant
+    TOK_REGEXP,                    // RegExp constant
+    TOK_TRUE,                      // true
+    TOK_FALSE,                     // false
+    TOK_NULL,                      // null
+    TOK_THIS,                      // this
+    TOK_FUNCTION,                  // function keyword
+    TOK_IF,                        // if keyword
+    TOK_ELSE,                      // else keyword
+    TOK_SWITCH,                    // switch keyword
+    TOK_CASE,                      // case keyword
+    TOK_DEFAULT,                   // default keyword
+    TOK_WHILE,                     // while keyword
+    TOK_DO,                        // do keyword
+    TOK_FOR,                       // for keyword
+    TOK_BREAK,                     // break keyword
+    TOK_CONTINUE,                  // continue keyword
+    TOK_VAR,                       // var keyword
+    TOK_CONST,                     // const keyword
+    TOK_WITH,                      // with keyword
+    TOK_RETURN,                    // return keyword
+    TOK_NEW,                       // new keyword
+    TOK_DELETE,                    // delete keyword
+    TOK_TRY,                       // try keyword
+    TOK_CATCH,                     // catch keyword
+    TOK_FINALLY,                   // finally keyword
+    TOK_THROW,                     // throw keyword
+    TOK_DEBUGGER,                  // debugger keyword
+    TOK_YIELD,                     // yield from generator function
+    TOK_LET,                       // let keyword
+    TOK_EXPORT,                    // export keyword
+    TOK_IMPORT,                    // import keyword
+    TOK_RESERVED,                  // reserved keywords
+    TOK_STRICT_RESERVED,           // reserved keywords in strict mode
 
-    /*
-     * The following token types occupy contiguous ranges to enable easy
-     * range-testing.
-     */
+    // The following token types occupy contiguous ranges to enable easy
+    // range-testing.
 
-    /*
-     * Binary operators tokens, TOK_OR thru TOK_MOD. These must be in the same
-     * order as F(OR) and friends in FOR_EACH_PARSE_NODE_KIND in ParseNode.h.
-     */
-    TOK_OR,                        /* logical or (||) */
+    // Binary operators tokens, TOK_OR thru TOK_MOD. These must be in the same
+    // order as F(OR) and friends in FOR_EACH_PARSE_NODE_KIND in ParseNode.h.
+    TOK_OR,                        // logical or (||)
     TOK_BINOP_FIRST = TOK_OR,
-    TOK_AND,                       /* logical and (&&) */
-    TOK_BITOR,                     /* bitwise-or (|) */
-    TOK_BITXOR,                    /* bitwise-xor (^) */
-    TOK_BITAND,                    /* bitwise-and (&) */
+    TOK_AND,                       // logical and (&&)
+    TOK_BITOR,                     // bitwise-or (|)
+    TOK_BITXOR,                    // bitwise-xor (^)
+    TOK_BITAND,                    // bitwise-and (&)
 
-    /* Equality operation tokens, per TokenKindIsEquality */
+    // Equality operation tokens, per TokenKindIsEquality.
     TOK_STRICTEQ,
     TOK_EQUALITY_START = TOK_STRICTEQ,
     TOK_EQ,
@@ -105,7 +99,7 @@ enum TokenKind {
     TOK_NE,
     TOK_EQUALITY_LAST = TOK_NE,
 
-    /* Relational ops (< <= > >=), per TokenKindIsRelational */
+    // Relational ops (< <= > >=), per TokenKindIsRelational.
     TOK_LT,
     TOK_RELOP_START = TOK_LT,
     TOK_LE,
@@ -113,33 +107,33 @@ enum TokenKind {
     TOK_GE,
     TOK_RELOP_LAST = TOK_GE,
 
-    TOK_INSTANCEOF,                /* instanceof keyword */
-    TOK_IN,                        /* in keyword */
+    TOK_INSTANCEOF,                // |instanceof| keyword
+    TOK_IN,                        // |in| keyword
 
-    /* Shift ops (<< >> >>>), per TokenKindIsShift */
+    // Shift ops (<< >> >>>), per TokenKindIsShift.
     TOK_LSH,
     TOK_SHIFTOP_START = TOK_LSH,
     TOK_RSH,
     TOK_URSH,
     TOK_SHIFTOP_LAST = TOK_URSH,
 
-    TOK_PLUS,                      /* plus */
-    TOK_MINUS,                     /* minus */
-    TOK_STAR,                      /* multiply */
-    TOK_DIV,                       /* divide */
-    TOK_MOD,                       /* modulus */
+    TOK_ADD,
+    TOK_SUB,
+    TOK_MUL,
+    TOK_DIV,
+    TOK_MOD,
     TOK_BINOP_LAST = TOK_MOD,
 
-    /* Unary operation tokens */
+    // Unary operation tokens.
     TOK_TYPEOF,
     TOK_VOID,
     TOK_NOT,
     TOK_BITNOT,
 
-    TOK_ARROW,                     /* function arrow (=>) */
+    TOK_ARROW,                     // function arrow (=>)
 
-    /* Assignment ops (= += -= etc.), per TokenKindIsAssignment */
-    TOK_ASSIGN,                    /* assignment ops (= += -= etc.) */
+    // Assignment ops (= += -= etc.), per TokenKindIsAssignment
+    TOK_ASSIGN,
     TOK_ASSIGNMENT_START = TOK_ASSIGN,
     TOK_ADDASSIGN,
     TOK_SUBASSIGN,
@@ -154,7 +148,7 @@ enum TokenKind {
     TOK_MODASSIGN,
     TOK_ASSIGNMENT_LAST = TOK_MODASSIGN,
 
-    TOK_LIMIT                      /* domain size */
+    TOK_LIMIT                      // domain size
 };
 
 inline bool
@@ -198,13 +192,13 @@ TokenKindIsDecl(TokenKind tt)
 }
 
 struct TokenPos {
-    uint32_t          begin;          /* offset of the token's first char */
-    uint32_t          end;            /* offset of 1 past the token's last char */
+    uint32_t    begin;  // Offset of the token's first char.
+    uint32_t    end;    // Offset of 1 past the token's last char.
 
     TokenPos() {}
     TokenPos(uint32_t begin, uint32_t end) : begin(begin), end(end) {}
 
-    /* Return a TokenPos that covers left, right, and anything in between. */
+    // Return a TokenPos that covers left, right, and anything in between.
     static TokenPos box(const TokenPos &left, const TokenPos &right) {
         JS_ASSERT(left.begin <= left.end);
         JS_ASSERT(left.end <= right.begin);
@@ -244,53 +238,52 @@ struct TokenPos {
 enum DecimalPoint { NoDecimal = false, HasDecimal = true };
 
 struct Token {
-    TokenKind           type;           /* char value or above enumerator */
-    TokenPos            pos;            /* token position in file */
+    TokenKind           type;           // char value or above enumerator
+    TokenPos            pos;            // token position in file
     union {
       private:
         friend struct Token;
-        PropertyName *name;             /* non-numeric atom */
-        JSAtom       *atom;             /* potentially-numeric atom */
+        PropertyName    *name;          // non-numeric atom
+        JSAtom          *atom;          // potentially-numeric atom
         struct {
-            double       value;         /* floating point number */
-            DecimalPoint decimalPoint;  /* literal contains '.' */
+            double      value;          // floating point number
+            DecimalPoint decimalPoint;  // literal contains '.'
         } number;
-        RegExpFlag      reflags;        /* regexp flags, use tokenbuf to access
-                                           regexp chars */
+        RegExpFlag      reflags;        // regexp flags; use tokenbuf to access
+                                        //   regexp chars
     } u;
 
-    /* Mutators */
-
-    /*
-     * FIXME: Init type early enough such that all mutators can assert
-     *        type-safety.  See bug 697000.
-     */
+    // Mutators
 
     void setName(PropertyName *name) {
+        JS_ASSERT(type == TOK_NAME);
         JS_ASSERT(!IsPoisonedPtr(name));
         u.name = name;
     }
 
     void setAtom(JSAtom *atom) {
+        JS_ASSERT(type == TOK_STRING);
         JS_ASSERT(!IsPoisonedPtr(atom));
         u.atom = atom;
     }
 
     void setRegExpFlags(js::RegExpFlag flags) {
+        JS_ASSERT(type == TOK_REGEXP);
         JS_ASSERT((flags & AllFlags) == flags);
         u.reflags = flags;
     }
 
     void setNumber(double n, DecimalPoint decimalPoint) {
+        JS_ASSERT(type == TOK_NUMBER);
         u.number.value = n;
         u.number.decimalPoint = decimalPoint;
     }
 
-    /* Type-safe accessors */
+    // Type-safe accessors
 
     PropertyName *name() const {
         JS_ASSERT(type == TOK_NAME);
-        return u.name->asPropertyName(); /* poor-man's type verification */
+        return u.name->asPropertyName(); // poor-man's type verification
     }
 
     JSAtom *atom() const {
@@ -315,18 +308,6 @@ struct Token {
     }
 };
 
-enum TokenStreamFlags
-{
-    TSF_EOF = 0x02,             /* hit end of file */
-    TSF_EOL = 0x04,             /* an EOL was hit in whitespace or a multi-line comment */
-    TSF_OPERAND = 0x08,         /* looking for operand, not operator */
-    TSF_UNEXPECTED_EOF = 0x10,  /* unexpected end of input, i.e. TOK_EOF not at top-level. */
-    TSF_KEYWORD_IS_NAME = 0x20, /* Ignore keywords and return TOK_NAME instead to the parser. */
-    TSF_DIRTYLINE = 0x40,       /* non-whitespace since start of line */
-    TSF_OCTAL_CHAR = 0x80,      /* observed a octal character escape */
-    TSF_HAD_ERROR = 0x100       /* returned TOK_ERROR from getToken */
-};
-
 struct CompileError {
     JSContext *cx;
     JSErrorReport report;
@@ -383,26 +364,25 @@ class StrictModeGetter {
 //
 // The behavior of the token scanning process (see getTokenInternal()) can be
 // modified by calling one of the first four above listed member functions with
-// an optional argument of type TokenStreamFlags. The two flags that do
-// influence the scanning process are TSF_OPERAND and TSF_KEYWORD_IS_NAME.
-// However, they will be ignored unless |lookahead == 0| holds.
-// Due to constraints of the grammar, this turns out not to be a problem in
-// practice. See the mozilla.dev.tech.js-engine.internals thread entitled 'Bug
-// in the scanner?' for more details (https://groups.google.com/forum/?
-// fromgroups=#!topic/mozilla.dev.tech.js-engine.internals/2JLH5jRcr7E).
+// an optional argument of type Modifier.  However, the modifier will be
+// ignored unless |lookahead == 0| holds.  Due to constraints of the grammar,
+// this turns out not to be a problem in practice. See the
+// mozilla.dev.tech.js-engine.internals thread entitled 'Bug in the scanner?'
+// for more details:
+// https://groups.google.com/forum/?fromgroups=#!topic/mozilla.dev.tech.js-engine.internals/2JLH5jRcr7E).
 //
 // The methods seek() and tell() allow to rescan from a previous visited
 // location of the buffer.
 class MOZ_STACK_CLASS TokenStream
 {
-    /* Unicode separators that are treated as line terminators, in addition to \n, \r */
+    // Unicode separators that are treated as line terminators, in addition to \n, \r.
     enum {
         LINE_SEPARATOR = 0x2028,
         PARA_SEPARATOR = 0x2029
     };
 
-    static const size_t ntokens = 4;                /* 1 current + 2 lookahead, rounded
-                                                       to power of 2 to avoid divmod by 3 */
+    static const size_t ntokens = 4;                // 1 current + 2 lookahead, rounded
+                                                    // to power of 2 to avoid divmod by 3
     static const unsigned maxLookahead = 2;
     static const unsigned ntokensMask = ntokens - 1;
 
@@ -414,7 +394,7 @@ class MOZ_STACK_CLASS TokenStream
 
     ~TokenStream();
 
-    /* Accessors. */
+    // Accessors.
     bool onCurrentLine(const TokenPos &pos) const { return srcCoords.isOnThisLine(pos.end, lineno); }
     const Token &currentToken() const { return tokens[cursor]; }
     bool isCurrentTokenType(TokenKind type) const {
@@ -427,18 +407,15 @@ class MOZ_STACK_CLASS TokenStream
     JSPrincipals *getOriginPrincipals() const { return originPrincipals; }
     JSVersion versionNumber() const { return VersionNumber(options().version); }
     JSVersion versionWithFlags() const { return options().version; }
-    bool hadError() const { return !!(flags & TSF_HAD_ERROR); }
 
     bool isCurrentTokenAssignment() const {
         return TokenKindIsAssignment(currentToken().type);
     }
 
-    /* Flag methods. */
-    void setUnexpectedEOF(bool enabled = true) { setFlag(enabled, TSF_UNEXPECTED_EOF); }
-
-    bool isUnexpectedEOF() const { return !!(flags & TSF_UNEXPECTED_EOF); }
-    bool isEOF() const { return !!(flags & TSF_EOF); }
-    bool sawOctalEscape() const { return !!(flags & TSF_OCTAL_CHAR); }
+    // Flag methods.
+    bool isEOF() const { return flags.isEOF; }
+    bool sawOctalEscape() const { return flags.sawOctalEscape; }
+    bool hadError() const { return flags.hadError; }
 
     // TokenStream-specific error reporters.
     bool reportError(unsigned errorNumber, ...);
@@ -467,36 +444,35 @@ class MOZ_STACK_CLASS TokenStream
     static JSAtom *atomize(ExclusiveContext *cx, CharBuffer &cb);
     bool putIdentInTokenbuf(const jschar *identStart);
 
-    /*
-     * Enables flags in the associated tokenstream for the object lifetime.
-     * Useful for lexically-scoped flag toggles.
-     */
-    class Flagger {
-        TokenStream * const parent;
-        unsigned       flags;
-      public:
-        Flagger(TokenStream *parent, unsigned withFlags) : parent(parent), flags(withFlags) {
-            parent->flags |= flags;
-        }
+    struct Flags
+    {
+        bool isEOF:1;           // Hit end of file.
+        bool sawEOL:1;          // An EOL was hit in whitespace or a multi-line comment.
+        bool isDirtyLine:1;     // Non-whitespace since start of line.
+        bool sawOctalEscape:1;  // Saw an octal character escape.
+        bool hadError:1;        // Returned TOK_ERROR from getToken.
 
-        ~Flagger() { parent->flags &= ~flags; }
+        Flags()
+          : isEOF(), sawEOL(), isDirtyLine(), sawOctalEscape(), hadError()
+        {}
     };
-    friend class Flagger;
-
-    void setFlag(bool enabled, TokenStreamFlags flag) {
-        if (enabled)
-            flags |= flag;
-        else
-            flags &= ~flag;
-    }
 
   public:
-    /*
-     * Get the next token from the stream, make it the current token, and
-     * return its kind.
-     */
-    TokenKind getToken() {
-        /* Check for a pushed-back token resulting from mismatching lookahead. */
+    // Sometimes the parser needs to modify how tokens are created.
+    enum Modifier
+    {
+        None,           // Normal operation.
+        Operand,        // Looking for an operand, not an operator.  In
+                        //   practice, this means that when '/' is seen,
+                        //   we look for a regexp instead of just returning
+                        //   TOK_DIV.
+        KeywordIsName,  // Treat keywords as names by returning TOK_NAME.
+    };
+
+    // Get the next token from the stream, make it the current token, and
+    // return its kind.
+    TokenKind getToken(Modifier modifier = None) {
+        // Check for a pushed-back token resulting from mismatching lookahead.
         if (lookahead != 0) {
             lookahead--;
             cursor = (cursor + 1) & ntokensMask;
@@ -505,73 +481,51 @@ class MOZ_STACK_CLASS TokenStream
             return tt;
         }
 
-        return getTokenInternal();
+        return getTokenInternal(modifier);
     }
 
-    /* Similar, but also sets flags. */
-    TokenKind getToken(unsigned withFlags) {
-        Flagger flagger(this, withFlags);
-        return getToken();
-    }
-
-    /*
-     * Push the last scanned token back into the stream.
-     */
+    // Push the last scanned token back into the stream.
     void ungetToken() {
         JS_ASSERT(lookahead < maxLookahead);
         lookahead++;
         cursor = (cursor - 1) & ntokensMask;
     }
 
-    TokenKind peekToken() {
+    TokenKind peekToken(Modifier modifier = None) {
         if (lookahead != 0)
             return tokens[(cursor + 1) & ntokensMask].type;
-        TokenKind tt = getTokenInternal();
+        TokenKind tt = getTokenInternal(modifier);
         ungetToken();
         return tt;
     }
 
-    TokenKind peekToken(unsigned withFlags) {
-        Flagger flagger(this, withFlags);
-        return peekToken();
-    }
-
-    TokenKind peekTokenSameLine(unsigned withFlags = 0) {
+    TokenKind peekTokenSameLine(Modifier modifier = None) {
         if (!onCurrentLine(currentToken().pos))
             return TOK_EOL;
 
         if (lookahead != 0)
             return tokens[(cursor + 1) & ntokensMask].type;
 
-        /*
-         * This is the only place TOK_EOL is produced.  No token with TOK_EOL
-         * is created, just a TOK_EOL TokenKind is returned.
-         */
-        flags &= ~TSF_EOL;
-        TokenKind tt = getToken(withFlags);
-        if (flags & TSF_EOL) {
+        // This is the only place TOK_EOL is produced.  No token with TOK_EOL
+        // is created, just a TOK_EOL TokenKind is returned.
+        flags.sawEOL = false;
+        TokenKind tt = getToken(modifier);
+        if (flags.sawEOL) {
             tt = TOK_EOL;
-            flags &= ~TSF_EOL;
+            flags.sawEOL = false;
         }
         ungetToken();
         return tt;
     }
 
-    /*
-     * Get the next token from the stream if its kind is |tt|.
-     */
-    bool matchToken(TokenKind tt) {
-        if (getToken() == tt)
+    // Get the next token from the stream if its kind is |tt|.
+    bool matchToken(TokenKind tt, Modifier modifier = None) {
+        if (getToken(modifier) == tt)
             return true;
         ungetToken();
         return false;
     }
 
-    bool matchToken(TokenKind tt, unsigned withFlags) {
-        Flagger flagger(this, withFlags);
-        return matchToken(tt);
-    }
-
     void consumeKnownToken(TokenKind tt) {
         JS_ALWAYS_TRUE(matchToken(tt));
     }
@@ -589,21 +543,19 @@ class MOZ_STACK_CLASS TokenStream
 
     class MOZ_STACK_CLASS Position {
       public:
-        /*
-         * The Token fields may contain pointers to atoms, so for correct
-         * rooting we must ensure collection of atoms is disabled while objects
-         * of this class are live.  Do this by requiring a dummy AutoKeepAtoms
-         * reference in the constructor.
-         *
-         * This class is explicity ignored by the analysis, so don't add any
-         * more pointers to GC things here!
-         */
+        // The Token fields may contain pointers to atoms, so for correct
+        // rooting we must ensure collection of atoms is disabled while objects
+        // of this class are live.  Do this by requiring a dummy AutoKeepAtoms
+        // reference in the constructor.
+        //
+        // This class is explicity ignored by the analysis, so don't add any
+        // more pointers to GC things here!
         Position(AutoKeepAtoms&) { }
       private:
         Position(const Position&) MOZ_DELETE;
         friend class TokenStream;
         const jschar *buf;
-        unsigned flags;
+        Flags flags;
         unsigned lineno;
         const jschar *linebase;
         const jschar *prevLinebase;
@@ -625,9 +577,7 @@ class MOZ_STACK_CLASS TokenStream
         return sourceMap != NULL;
     }
 
-    /*
-     * Give up responsibility for managing the sourceMap filename's memory.
-     */
+    // Give up responsibility for managing the sourceMap filename's memory.
     jschar *releaseSourceMap() {
         JS_ASSERT(hasSourceMap());
         jschar *sm = sourceMap;
@@ -635,18 +585,16 @@ class MOZ_STACK_CLASS TokenStream
         return sm;
     }
 
-    /*
-     * If the name at s[0:length] is not a keyword in this version, return
-     * true with *ttp unchanged.
-     *
-     * If it is a reserved word in this version and strictness mode, and thus
-     * can't be present in correct code, report a SyntaxError and return false.
-     *
-     * If it is a keyword, like "if", the behavior depends on ttp. If ttp is
-     * null, report a SyntaxError ("if is a reserved identifier") and return
-     * false. If ttp is non-null, return true with the keyword's TokenKind in
-     * *ttp.
-     */
+    // If the name at s[0:length] is not a keyword in this version, return
+    // true with *ttp unchanged.
+    //
+    // If it is a reserved word in this version and strictness mode, and thus
+    // can't be present in correct code, report a SyntaxError and return false.
+    //
+    // If it is a keyword, like "if", the behavior depends on ttp. If ttp is
+    // null, report a SyntaxError ("if is a reserved identifier") and return
+    // false. If ttp is non-null, return true with the keyword's TokenKind in
+    // *ttp.
     bool checkForKeyword(const jschar *s, size_t length, TokenKind *ttp);
 
     // This class maps a userbuf offset (which is 0-indexed) to a line number
@@ -732,13 +680,11 @@ class MOZ_STACK_CLASS TokenStream
     }
 
   private:
-    /*
-     * This is the low-level interface to the JS source code buffer.  It just
-     * gets raw chars, basically.  TokenStreams functions are layered on top
-     * and do some extra stuff like converting all EOL sequences to '\n',
-     * tracking the line number, and setting the TSF_EOF flag.  (The "raw" in
-     * "raw chars" refers to the lack of EOL sequence normalization.)
-     */
+    // This is the low-level interface to the JS source code buffer.  It just
+    // gets raw chars, basically.  TokenStreams functions are layered on top
+    // and do some extra stuff like converting all EOL sequences to '\n',
+    // tracking the line number, and setting |flags.isEOF|.  (The "raw" in "raw
+    // chars" refers to the lack of EOL sequence normalization.)
     class TokenBuf {
       public:
         TokenBuf(ExclusiveContext *cx, const jschar *buf, size_t length)
@@ -763,15 +709,15 @@ class MOZ_STACK_CLASS TokenStream
         }
 
         jschar getRawChar() {
-            return *ptr++;      /* this will NULL-crash if poisoned */
+            return *ptr++;      // this will NULL-crash if poisoned
         }
 
         jschar peekRawChar() const {
-            return *ptr;        /* this will NULL-crash if poisoned */
+            return *ptr;        // this will NULL-crash if poisoned
         }
 
         bool matchRawChar(jschar c) {
-            if (*ptr == c) {    /* this will NULL-crash if poisoned */
+            if (*ptr == c) {    // this will NULL-crash if poisoned
                 ptr++;
                 return true;
             }
@@ -779,7 +725,7 @@ class MOZ_STACK_CLASS TokenStream
         }
 
         bool matchRawCharBackwards(jschar c) {
-            JS_ASSERT(ptr);     /* make sure haven't been poisoned */
+            JS_ASSERT(ptr);     // make sure it hasn't been poisoned
             if (*(ptr - 1) == c) {
                 ptr--;
                 return true;
@@ -788,23 +734,23 @@ class MOZ_STACK_CLASS TokenStream
         }
 
         void ungetRawChar() {
-            JS_ASSERT(ptr);     /* make sure haven't been poisoned */
+            JS_ASSERT(ptr);     // make sure it hasn't been poisoned
             ptr--;
         }
 
         const jschar *addressOfNextRawChar(bool allowPoisoned = false) const {
-            JS_ASSERT_IF(!allowPoisoned, ptr);     /* make sure haven't been poisoned */
+            JS_ASSERT_IF(!allowPoisoned, ptr);     // make sure it hasn't been poisoned
             return ptr;
         }
 
-        /* Use this with caution! */
+        // Use this with caution!
         void setAddressOfNextRawChar(const jschar *a, bool allowPoisoned = false) {
             JS_ASSERT_IF(!allowPoisoned, a);
             ptr = a;
         }
 
 #ifdef DEBUG
-        /* Poison the TokenBuf so it cannot be accessed again. */
+        // Poison the TokenBuf so it cannot be accessed again.
         void poison() {
             ptr = NULL;
         }
@@ -819,15 +765,15 @@ class MOZ_STACK_CLASS TokenStream
         const jschar *findEOLMax(const jschar *p, size_t max);
 
       private:
-        const jschar *base_;            /* base of buffer */
-        const jschar *limit_;           /* limit for quick bounds check */
-        const jschar *ptr;              /* next char to get */
+        const jschar *base_;            // base of buffer
+        const jschar *limit_;           // limit for quick bounds check
+        const jschar *ptr;              // next char to get
 
         // We are not yet moving strings
         SkipRoot skipBase, skipLimit, skipPtr;
     };
 
-    TokenKind getTokenInternal();     /* doesn't check for pushback or error flag. */
+    TokenKind getTokenInternal(Modifier modifier);
 
     int32_t getChar();
     int32_t getCharIgnoreEOL();
@@ -869,29 +815,27 @@ class MOZ_STACK_CLASS TokenStream
     // Options used for parsing/tokenizing.
     const CompileOptions &options_;
 
-    Token               tokens[ntokens];/* circular token buffer */
-    unsigned            cursor;         /* index of last parsed token */
-    unsigned            lookahead;      /* count of lookahead tokens */
-    unsigned            lineno;         /* current line number */
-    unsigned            flags;          /* flags -- see above */
-    const jschar        *linebase;      /* start of current line;  points into userbuf */
-    const jschar        *prevLinebase;  /* start of previous line;  NULL if on the first line */
-    TokenBuf            userbuf;        /* user input buffer */
-    const char          *filename;      /* input filename or null */
-    jschar              *sourceMap;     /* source map's filename or null */
-    CharBuffer          tokenbuf;       /* current token string buffer */
-    bool                maybeEOL[256];       /* probabilistic EOL lookup table */
-    bool                maybeStrSpecial[256];/* speeds up string scanning */
-    uint8_t             isExprEnding[TOK_LIMIT]; /* which tokens definitely terminate exprs? */
+    Token               tokens[ntokens];    // circular token buffer
+    unsigned            cursor;             // index of last parsed token
+    unsigned            lookahead;          // count of lookahead tokens
+    unsigned            lineno;             // current line number
+    Flags               flags;              // flags -- see above
+    const jschar        *linebase;          // start of current line;  points into userbuf
+    const jschar        *prevLinebase;      // start of previous line;  NULL if on the first line
+    TokenBuf            userbuf;            // user input buffer
+    const char          *filename;          // input filename or null
+    jschar              *sourceMap;         // source map's filename or null
+    CharBuffer          tokenbuf;           // current token string buffer
+    bool                maybeEOL[256];      // probabilistic EOL lookup table
+    bool                maybeStrSpecial[256];   // speeds up string scanning
+    uint8_t             isExprEnding[TOK_LIMIT];// which tokens definitely terminate exprs?
     ExclusiveContext    *const cx;
     JSPrincipals        *const originPrincipals;
-    StrictModeGetter    *strictModeGetter; /* used to test for strict mode */
+    StrictModeGetter    *strictModeGetter;  // used to test for strict mode
 
-    /*
-     * The tokens array stores pointers to JSAtoms. These are rooted by the
-     * atoms table using AutoKeepAtoms in the Parser. This SkipRoot tells the
-     * exact rooting analysis to ignore the atoms in the tokens array.
-     */
+    // The tokens array stores pointers to JSAtoms. These are rooted by the
+    // atoms table using AutoKeepAtoms in the Parser. This SkipRoot tells the
+    // exact rooting analysis to ignore the atoms in the tokens array.
     SkipRoot            tokenSkip;
 
     // Bug 846011
@@ -899,14 +843,12 @@ class MOZ_STACK_CLASS TokenStream
     SkipRoot            prevLinebaseSkip;
 };
 
-/*
- * Steal one JSREPORT_* bit (see jsapi.h) to tell that arguments to the error
- * message have const jschar* type, not const char*.
- */
+// Steal one JSREPORT_* bit (see jsapi.h) to tell that arguments to the error
+// message have const jschar* type, not const char*.
 #define JSREPORT_UC 0x100
 
-} /* namespace frontend */
-} /* namespace js */
+} // namespace frontend
+} // namespace js
 
 extern JS_FRIEND_API(int)
 js_fgets(char *buf, int size, FILE *file);
diff --git a/js/src/ion/AsmJS.cpp b/js/src/ion/AsmJS.cpp
index a30dbe32a969..98e9b6f545db 100644
--- a/js/src/ion/AsmJS.cpp
+++ b/js/src/ion/AsmJS.cpp
@@ -9,7 +9,7 @@
 #include "mozilla/Move.h"
 
 #ifdef MOZ_VTUNE
-# include "jitprofiling.h"
+# include "vtune/VTuneWrapper.h"
 #endif
 
 #include "jsmath.h"
@@ -359,9 +359,9 @@ static TokenKind
 PeekToken(AsmJSParser &parser)
 {
     TokenStream &ts = parser.tokenStream;
-    while (ts.peekToken(TSF_OPERAND) == TOK_SEMI)
-        ts.getToken(TSF_OPERAND);
-    return ts.peekToken(TSF_OPERAND);
+    while (ts.peekToken(TokenStream::Operand) == TOK_SEMI)
+        ts.consumeKnownToken(TOK_SEMI);
+    return ts.peekToken(TokenStream::Operand);
 }
 
 static bool
@@ -4585,7 +4585,7 @@ ParseFunction(ModuleCompiler &m, ParseNode **fnOut)
     DebugOnly<TokenKind> tk = tokenStream.getToken();
     JS_ASSERT(tk == TOK_FUNCTION);
 
-    if (tokenStream.getToken(TSF_KEYWORD_IS_NAME) != TOK_NAME)
+    if (tokenStream.getToken(TokenStream::KeywordIsName) != TOK_NAME)
         return false;  // This will throw a SyntaxError, no need to m.fail.
 
     RootedPropertyName name(m.cx(), tokenStream.currentToken().name());
@@ -4710,10 +4710,8 @@ GenerateCode(ModuleCompiler &m, ModuleCompiler::Func &func, MIRGenerator &mir, L
     }
 
 #ifdef MOZ_VTUNE
-    if (iJIT_IsProfilingActive() == iJIT_SAMPLING_ON) {
-        if (!m.trackProfiledFunction(func, m.masm().size()))
-            return false;
-    }
+    if (IsVTuneProfilingActive() && !m.trackProfiledFunction(func, m.masm().size()))
+        return false;
 #endif
 
 #ifdef JS_ION_PERF
@@ -5118,7 +5116,7 @@ CheckModuleReturn(ModuleCompiler &m)
         return m.fail(NULL, "invalid asm.js statement");
     }
 
-    ParseNode *returnStmt = m.parser().statement(TSF_OPERAND);
+    ParseNode *returnStmt = m.parser().statement();
     if (!returnStmt)
         return false;
 
diff --git a/js/src/ion/AsmJSLink.cpp b/js/src/ion/AsmJSLink.cpp
index 1d0bcdfd4f38..26ce0b8ac7b5 100644
--- a/js/src/ion/AsmJSLink.cpp
+++ b/js/src/ion/AsmJSLink.cpp
@@ -7,8 +7,9 @@
 #include "ion/AsmJSLink.h"
 
 #ifdef MOZ_VTUNE
-# include "jitprofiling.h"
+# include "vtune/VTuneWrapper.h"
 #endif
+
 #include "jscntxt.h"
 #include "jsmath.h"
 #include "jswrapper.h"
@@ -576,7 +577,7 @@ LinkAsmJS(JSContext *cx, unsigned argc, JS::Value *vp)
     }
 
 #if defined(MOZ_VTUNE)
-    if (!SendFunctionsToVTune(cx, module))
+    if (IsVTuneProfilingActive() && !SendFunctionsToVTune(cx, module))
         return false;
 #endif
 
diff --git a/js/src/ion/IonBuilder.cpp b/js/src/ion/IonBuilder.cpp
index 10209f4689f0..6a32d8369b93 100644
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -4823,10 +4823,12 @@ IonBuilder::makeCallsiteClone(HandleFunction target, MDefinition *fun)
 {
     // Bake in the clone eagerly if we have a known target. We have arrived here
     // because TI told us that the known target is a should-clone-at-callsite
-    // function, which means that target already is the clone.
+    // function, which means that target already is the clone. Make sure to ensure
+    // that the old definition remains in resume points.
     if (target) {
         MConstant *constant = MConstant::New(ObjectValue(*target));
         current->add(constant);
+        fun->setFoldedUnchecked();
         return constant;
     }
 
diff --git a/js/src/ion/IonCaches.cpp b/js/src/ion/IonCaches.cpp
index 40fbb2e6d340..42a766950133 100644
--- a/js/src/ion/IonCaches.cpp
+++ b/js/src/ion/IonCaches.cpp
@@ -3019,7 +3019,7 @@ IsCacheableScopeChain(JSObject *scopeChain, JSObject *holder)
         }
     }
 
-    MOZ_ASSUME_UNREACHABLE();
+    MOZ_ASSUME_UNREACHABLE("Invalid scope chain");
 }
 
 JSObject *
diff --git a/js/src/ion/LiveRangeAllocator.h b/js/src/ion/LiveRangeAllocator.h
index c68106c47d5e..b161e4467ed9 100644
--- a/js/src/ion/LiveRangeAllocator.h
+++ b/js/src/ion/LiveRangeAllocator.h
@@ -476,14 +476,6 @@ class VirtualRegisterMap
     }
 };
 
-static inline AnyRegister
-GetFixedRegister(LDefinition *def, LUse *use)
-{
-    return def->type() == LDefinition::DOUBLE
-           ? AnyRegister(FloatRegister::FromCode(use->registerCode()))
-           : AnyRegister(Register::FromCode(use->registerCode()));
-}
-
 static inline bool
 IsNunbox(VirtualRegister *vreg)
 {
diff --git a/js/src/ion/RegisterAllocator.h b/js/src/ion/RegisterAllocator.h
index 8b69e622e052..f4716c700b5b 100644
--- a/js/src/ion/RegisterAllocator.h
+++ b/js/src/ion/RegisterAllocator.h
@@ -354,6 +354,14 @@ class RegisterAllocator
     }
 };
 
+static inline AnyRegister
+GetFixedRegister(LDefinition *def, const LUse *use)
+{
+    return def->type() == LDefinition::DOUBLE
+           ? AnyRegister(FloatRegister::FromCode(use->registerCode()))
+           : AnyRegister(Register::FromCode(use->registerCode()));
+}
+
 } // namespace ion
 } // namespace js
 
diff --git a/js/src/ion/StupidAllocator.cpp b/js/src/ion/StupidAllocator.cpp
index 1a6b15c89020..72ee1f724242 100644
--- a/js/src/ion/StupidAllocator.cpp
+++ b/js/src/ion/StupidAllocator.cpp
@@ -87,33 +87,36 @@ StupidAllocator::init()
     return true;
 }
 
-static inline bool
-AllocationRequiresRegister(const LAllocation *alloc, AnyRegister reg)
+bool
+StupidAllocator::allocationRequiresRegister(const LAllocation *alloc, AnyRegister reg)
 {
     if (alloc->isRegister() && alloc->toRegister() == reg)
         return true;
     if (alloc->isUse()) {
         const LUse *use = alloc->toUse();
-        if (use->policy() == LUse::FIXED && AnyRegister::FromCode(use->registerCode()) == reg)
-            return true;
+        if (use->policy() == LUse::FIXED) {
+            AnyRegister usedReg = GetFixedRegister(virtualRegisters[use->virtualRegister()], use);
+            if (usedReg == reg)
+                return true;
+        }
     }
     return false;
 }
 
-static inline bool
-RegisterIsReserved(LInstruction *ins, AnyRegister reg)
+bool
+StupidAllocator::registerIsReserved(LInstruction *ins, AnyRegister reg)
 {
     // Whether reg is already reserved for an input or output of ins.
     for (LInstruction::InputIterator alloc(*ins); alloc.more(); alloc.next()) {
-        if (AllocationRequiresRegister(*alloc, reg))
+        if (allocationRequiresRegister(*alloc, reg))
             return true;
     }
     for (size_t i = 0; i < ins->numTemps(); i++) {
-        if (AllocationRequiresRegister(ins->getTemp(i)->output(), reg))
+        if (allocationRequiresRegister(ins->getTemp(i)->output(), reg))
             return true;
     }
     for (size_t i = 0; i < ins->numDefs(); i++) {
-        if (AllocationRequiresRegister(ins->getDef(i)->output(), reg))
+        if (allocationRequiresRegister(ins->getDef(i)->output(), reg))
             return true;
     }
     return false;
@@ -127,7 +130,7 @@ StupidAllocator::ensureHasRegister(LInstruction *ins, uint32_t vreg)
     // Check if the virtual register is already held in a physical register.
     RegisterIndex existing = findExistingRegister(vreg);
     if (existing != UINT32_MAX) {
-        if (RegisterIsReserved(ins, registers[existing].reg)) {
+        if (registerIsReserved(ins, registers[existing].reg)) {
             evictRegister(ins, existing);
         } else {
             registers[existing].age = ins->id();
@@ -161,7 +164,7 @@ StupidAllocator::allocateRegister(LInstruction *ins, uint32_t vreg)
             continue;
 
         // Skip the register if it is in use for an allocated input or output.
-        if (RegisterIsReserved(ins, reg))
+        if (registerIsReserved(ins, reg))
             continue;
 
         if (registers[i].vreg == MISSING_ALLOCATION ||
@@ -329,7 +332,7 @@ StupidAllocator::allocateForInstruction(LInstruction *ins)
             AnyRegister reg = ensureHasRegister(ins, vreg);
             alloc.replace(LAllocation(reg));
         } else if (use->policy() == LUse::FIXED) {
-            AnyRegister reg = AnyRegister::FromCode(use->registerCode());
+            AnyRegister reg = GetFixedRegister(virtualRegisters[use->virtualRegister()], use);
             RegisterIndex index = registerIndex(reg);
             if (registers[index].vreg != vreg) {
                 evictRegister(ins, index);
diff --git a/js/src/ion/StupidAllocator.h b/js/src/ion/StupidAllocator.h
index 5132feb9333f..ff1e3c1ab12b 100644
--- a/js/src/ion/StupidAllocator.h
+++ b/js/src/ion/StupidAllocator.h
@@ -75,6 +75,9 @@ class StupidAllocator : public RegisterAllocator
     void loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index);
 
     RegisterIndex findExistingRegister(uint32_t vreg);
+
+    bool allocationRequiresRegister(const LAllocation *alloc, AnyRegister reg);
+    bool registerIsReserved(LInstruction *ins, AnyRegister reg);
 };
 
 } // namespace ion
diff --git a/js/src/jit-test/tests/auto-regress/bug743094.js b/js/src/jit-test/tests/auto-regress/bug743094.js
index f3e853dba670..0cb15d64c09e 100644
--- a/js/src/jit-test/tests/auto-regress/bug743094.js
+++ b/js/src/jit-test/tests/auto-regress/bug743094.js
@@ -1,11 +1,15 @@
-// |jit-test| error:InternalError
-
 // Binary: cache/js-dbg-32-a9a18824b4c1-linux
 // Flags: --ion-eager
 //
 
-gczeal(2)
+var i = 0;
+
+gczeal(2);
 function test() {
-  typeof (new test("1")) != 'function'
+  if (i++ > 2500)
+    return "function";
+  var res = typeof (new test("1")) != 'function';
+  return res ? "function" : "string";
 }
+
 test();
diff --git a/js/src/jit-test/tests/basic/string-repeat.js b/js/src/jit-test/tests/basic/string-repeat.js
index fdacc4a01dc1..06a25fd9fb32 100644
--- a/js/src/jit-test/tests/basic/string-repeat.js
+++ b/js/src/jit-test/tests/basic/string-repeat.js
@@ -6,10 +6,13 @@ assertEq("abc".repeat(1), "abc");
 assertEq("abc".repeat(2), "abcabc");
 assertEq("abc".repeat(3), "abcabcabc");
 assertEq("a".repeat(10), "aaaaaaaaaa");
+assertEq("abc".repeat(0), "");
+assertEq("abc".repeat(2.9), "abcabc");
+
 var myobj = {toString : (function () "abc"), repeat : String.prototype.repeat};
 assertEq(myobj.repeat(1), "abc");
 assertEq(myobj.repeat(2), "abcabc");
-assertEq("abc".repeat(0), "");
+
 assertThrowsInstanceOf(function() {
                          "abc".repeat(-1);
                        }, RangeError,
@@ -17,6 +20,11 @@ assertThrowsInstanceOf(function() {
 assertThrowsInstanceOf(function() {
                          "abc".repeat(Number.POSITIVE_INFINITY);
                        }, RangeError,
-                       "String.prototype.repeat should raise RangeError on positive infinity arguments");
+                       "String.prototype.repeat should raise RangeError on excedding maximum string length");
+assertThrowsInstanceOf(function() {
+                         "abc".repeat(1 << 29);
+                       }, RangeError,
+                       "String.prototype.repeat should raise RangeError on excedding maximum string length");
+
 assertEq("".repeat(5), "");
-assertEq("abc".repeat(2.0), "abcabc");
+assertEq("".repeat(1 << 29), "");
diff --git a/js/src/jit-test/tests/debug/Object-script-lazy.js b/js/src/jit-test/tests/debug/Object-script-lazy.js
new file mode 100644
index 000000000000..02c316822bd6
--- /dev/null
+++ b/js/src/jit-test/tests/debug/Object-script-lazy.js
@@ -0,0 +1,34 @@
+// Asking for the script of a Debugger.Object whose referent is a lazy
+// function should work.
+
+// Note that putting a compartment in debug mode automatically de-lazifies
+// all its functions (so that findScripts works); so the only way to get a
+// Debugger.Object whose referent is a lazy function is to get one
+// referring to a non-debuggee function. (I don't think we should be
+// handing out non-debuggee scripts anyway.)
+
+// Create functions f, g in a non-debuggee compartment.
+var g1 = newGlobal();
+g1.eval('function f() { return "from f"; }');
+g1.eval('function g() { return "from g"; }');
+
+// Create a debuggee compartment with CCWs referring to f and g.
+var g2 = newGlobal();
+var dbg = new Debugger;
+var g2w = dbg.addDebuggee(g2);
+g2.f = g1.f;
+g2.g = g1.g;
+
+// At this point, g1.f should still be a lazy function. Unwrapping a D.O
+// referring to g2's CCW of f should yield a D.O referring to f directly.
+// Asking for that second D.O's script should de-lazify f.
+var fDO = g2w.getOwnPropertyDescriptor('f').value;
+assertEq(fDO.global, g2w);
+assertEq(fDO.unwrap().global === g2w, false);
+assertEq(fDO.unwrap().script instanceof Debugger.Script, true);
+
+// Similarly for g1.g, and asking for its parameter names.
+var gDO = g2w.getOwnPropertyDescriptor('g').value;
+assertEq(gDO.global, g2w);
+assertEq(gDO.unwrap().global === g2w, false);
+assertEq(gDO.unwrap().parameterNames instanceof Array, true);
diff --git a/js/src/js.msg b/js/src/js.msg
index f08a05ea77d3..3f665d8d5481 100644
--- a/js/src/js.msg
+++ b/js/src/js.msg
@@ -196,7 +196,7 @@ MSG_DEF(JSMSG_BAD_CLONE_FUNOBJ_SCOPE, 142, 0, JSEXN_TYPEERR, "bad cloned functio
 MSG_DEF(JSMSG_MISSING_OCTAL_DIGITS,   143, 0, JSEXN_SYNTAXERR, "missing octal digits after '0o'")
 MSG_DEF(JSMSG_ILLEGAL_CHARACTER,      144, 0, JSEXN_SYNTAXERR, "illegal character")
 MSG_DEF(JSMSG_BAD_OCTAL,              145, 1, JSEXN_SYNTAXERR, "{0} is not a legal ECMA-262 octal constant")
-MSG_DEF(JSMSG_REPEAT_RANGE,           146, 0, JSEXN_RANGEERR, "repeat count must be positive and less than inifinity")
+MSG_DEF(JSMSG_RESULTING_STRING_TOO_LARGE, 146, 0, JSEXN_RANGEERR, "repeat count must be less than infinity and not overflow maximum string size")
 MSG_DEF(JSMSG_UNCAUGHT_EXCEPTION,     147, 1, JSEXN_INTERNALERR, "uncaught exception: {0}")
 MSG_DEF(JSMSG_INVALID_BACKREF,        148, 0, JSEXN_SYNTAXERR, "non-octal digit in an escape sequence that doesn't match a back-reference")
 MSG_DEF(JSMSG_BAD_BACKREF,            149, 0, JSEXN_SYNTAXERR, "back-reference exceeds number of capturing parentheses")
@@ -220,7 +220,7 @@ MSG_DEF(JSMSG_RESERVED_SLOT_RANGE,    166, 0, JSEXN_RANGEERR, "reserved slot ind
 MSG_DEF(JSMSG_CANT_DECODE_PRINCIPALS, 167, 0, JSEXN_INTERNALERR, "can't decode JSPrincipals")
 MSG_DEF(JSMSG_CANT_SEAL_OBJECT,       168, 1, JSEXN_ERR, "can't seal {0} objects")
 MSG_DEF(JSMSG_TOO_MANY_CATCH_VARS,    169, 0, JSEXN_SYNTAXERR, "too many catch variables")
-MSG_DEF(JSMSG_UNUSED170,              170, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_NEGATIVE_REPETITION_COUNT, 170, 0, JSEXN_RANGEERR, "repeat count must be non-negative")
 MSG_DEF(JSMSG_UNUSED171,              171, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_UNUSED172,              172, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_UNUSED173,              173, 0, JSEXN_NONE, "")
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 599454b22c8b..2cd052cf5004 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -706,8 +706,15 @@ JS_ShutDown(void)
 {
     MOZ_ASSERT(jsInitState == Running,
                "JS_ShutDown must only be called after JS_Init and can't race with it");
-    MOZ_ASSERT(!JSRuntime::hasLiveRuntimes(),
-               "forgot to destroy a runtime before shutting down");
+#ifdef DEBUG
+    if (JSRuntime::hasLiveRuntimes()) {
+        // Gecko is too buggy to assert this just yet.
+        fprintf(stderr,
+                "WARNING: YOU ARE LEAKING THE WORLD (at least one JSRuntime "
+                "and everything alive inside it, that is) AT JS_ShutDown "
+                "TIME.  FIX THIS!\n");
+    }
+#endif
 
     PRMJ_NowShutdown();
 
@@ -847,14 +854,11 @@ JS_IsInRequest(JSRuntime *rt)
 #endif
 }
 
-JS_PUBLIC_API(JSContextCallback)
-JS_SetContextCallback(JSRuntime *rt, JSContextCallback cxCallback)
+JS_PUBLIC_API(void)
+JS_SetContextCallback(JSRuntime *rt, JSContextCallback cxCallback, void *data)
 {
-    JSContextCallback old;
-
-    old = rt->cxCallback;
     rt->cxCallback = cxCallback;
-    return old;
+    rt->cxCallbackData = data;
 }
 
 JS_PUBLIC_API(JSContext *)
@@ -4950,7 +4954,7 @@ JS_BufferIsCompilableUnit(JSContext *cx, JSObject *objArg, const char *utf8, siz
                                                   options, chars, length,
                                                   /* foldConstants = */ true, NULL, NULL);
         older = JS_SetErrorReporter(cx, NULL);
-        if (!parser.parse(obj) && parser.tokenStream.isUnexpectedEOF()) {
+        if (!parser.parse(obj) && parser.isUnexpectedEOF()) {
             /*
              * We ran into an error. If it was because we ran out of
              * source, we return false so our caller knows to try to
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index a48308fb3c4c..724a81176db3 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -965,7 +965,7 @@ typedef enum JSContextOp {
  *                      and return true in this case.
  */
 typedef JSBool
-(* JSContextCallback)(JSContext *cx, unsigned contextOp);
+(* JSContextCallback)(JSContext *cx, unsigned contextOp, void *data);
 
 typedef enum JSGCStatus {
     JSGC_BEGIN,
@@ -1909,8 +1909,8 @@ class JSAutoCheckRequest
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
-extern JS_PUBLIC_API(JSContextCallback)
-JS_SetContextCallback(JSRuntime *rt, JSContextCallback cxCallback);
+extern JS_PUBLIC_API(void)
+JS_SetContextCallback(JSRuntime *rt, JSContextCallback cxCallback, void *data);
 
 extern JS_PUBLIC_API(JSContext *)
 JS_NewContext(JSRuntime *rt, size_t stackChunkSize);
diff --git a/js/src/jscntxt.cpp b/js/src/jscntxt.cpp
index 9c2db0759f2c..4f7894acd727 100644
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -211,7 +211,7 @@ js::NewContext(JSRuntime *rt, size_t stackChunkSize)
     }
 
     JSContextCallback cxCallback = rt->cxCallback;
-    if (cxCallback && !cxCallback(cx, JSCONTEXT_NEW)) {
+    if (cxCallback && !cxCallback(cx, JSCONTEXT_NEW, rt->cxCallbackData)) {
         DestroyContext(cx, DCM_NEW_FAILED);
         return NULL;
     }
@@ -241,7 +241,8 @@ js::DestroyContext(JSContext *cx, DestroyContextMode mode)
              * JSCONTEXT_DESTROY callback is not allowed to fail and must
              * return true.
              */
-            JS_ALWAYS_TRUE(cxCallback(cx, JSCONTEXT_DESTROY));
+            JS_ALWAYS_TRUE(cxCallback(cx, JSCONTEXT_DESTROY,
+                                      rt->cxCallbackData));
         }
     }
 
diff --git a/js/src/moz.build b/js/src/moz.build
index 94f0b8b37e1b..2e5b233c1e8c 100644
--- a/js/src/moz.build
+++ b/js/src/moz.build
@@ -328,6 +328,11 @@ if CONFIG['JS_HAS_CTYPES']:
         'Library.cpp',
     ]
 
+if CONFIG['MOZ_VTUNE']:
+    CSRCS += [
+        'vtune/jitprofiling.c'
+    ]
+
 if CONFIG['HAVE_LINUX_PERF_EVENT_H']:
     CPP_SOURCES += [
         'pm_linux.cpp'
diff --git a/js/src/shell/Makefile.in b/js/src/shell/Makefile.in
index 2e1df09e7538..70dde737bcba 100644
--- a/js/src/shell/Makefile.in
+++ b/js/src/shell/Makefile.in
@@ -52,15 +52,6 @@ SHELL_INSTALL_AUTOLOAD_DEST := $(DIST)/bin
 
 include $(topsrcdir)/config/rules.mk
 
-ifdef MOZ_VTUNE
-ifeq ($(OS_ARCH), WINNT)
-EXTRA_DSO_LDOPTS += $(VTUNE_LIBRARIES)
-LIBS += $(VTUNE_LIBRARIES)
-else
-SHARED_LIBRARY_LIBS += $(VTUNE_LIBRARIES)
-endif # WINNT
-endif # MOZ_VTUNE
-
 # People expect the js shell to wind up in the top-level JS dir.
 libs::
 	$(INSTALL) $(IFLAGS2) $(PROGRAM) $(DEPTH)
diff --git a/js/src/tests/style/BadIncludes.h b/js/src/tests/style/BadIncludes.h
new file mode 100644
index 000000000000..6f5ecbe1492e
--- /dev/null
+++ b/js/src/tests/style/BadIncludes.h
@@ -0,0 +1,5 @@
+#include "tests/style/BadIncludes.h"    // bad: self-include
+#include "tests/style/BadIncludes2.h"   // ok
+#include "BadIncludes2.h"               // bad: not a full path
+#include <tests/style/BadIncludes2.h>   // bad: <> form used for local file
+#include "stdio.h"                      // bad: "" form used for system file
diff --git a/js/src/tests/style/BadIncludes2-inl.h b/js/src/tests/style/BadIncludes2-inl.h
new file mode 100644
index 000000000000..bc4f7729b818
--- /dev/null
+++ b/js/src/tests/style/BadIncludes2-inl.h
@@ -0,0 +1 @@
+// (this file is deliberately empty)
diff --git a/js/src/tests/style/BadIncludes2.h b/js/src/tests/style/BadIncludes2.h
new file mode 100644
index 000000000000..1623c1ddc484
--- /dev/null
+++ b/js/src/tests/style/BadIncludes2.h
@@ -0,0 +1 @@
+#include "tests/style/BadIncludes2-inl.h" // bad: vanilla header #includes an inline-header
diff --git a/js/src/tests/style/HeaderCycleA1.h b/js/src/tests/style/HeaderCycleA1.h
new file mode 100644
index 000000000000..d70e08f01d60
--- /dev/null
+++ b/js/src/tests/style/HeaderCycleA1.h
@@ -0,0 +1 @@
+#include "tests/style/HeaderCycleA2.h"
diff --git a/js/src/tests/style/HeaderCycleA2.h b/js/src/tests/style/HeaderCycleA2.h
new file mode 100644
index 000000000000..d42dbe3d5984
--- /dev/null
+++ b/js/src/tests/style/HeaderCycleA2.h
@@ -0,0 +1 @@
+#include "tests/style/HeaderCycleA3.h"
diff --git a/js/src/tests/style/HeaderCycleA3.h b/js/src/tests/style/HeaderCycleA3.h
new file mode 100644
index 000000000000..01a72ecd827a
--- /dev/null
+++ b/js/src/tests/style/HeaderCycleA3.h
@@ -0,0 +1 @@
+#include "tests/style/HeaderCycleA1.h"
diff --git a/js/src/tests/style/HeaderCycleB1-inl.h b/js/src/tests/style/HeaderCycleB1-inl.h
new file mode 100644
index 000000000000..f89dc8530415
--- /dev/null
+++ b/js/src/tests/style/HeaderCycleB1-inl.h
@@ -0,0 +1 @@
+#include "tests/style/HeaderCycleB2-inl.h"
diff --git a/js/src/tests/style/HeaderCycleB2-inl.h b/js/src/tests/style/HeaderCycleB2-inl.h
new file mode 100644
index 000000000000..4ba0830474d6
--- /dev/null
+++ b/js/src/tests/style/HeaderCycleB2-inl.h
@@ -0,0 +1,2 @@
+#include "tests/style/HeaderCycleB3-inl.h"
+#include "tests/style/HeaderCycleB4-inl.h"
diff --git a/js/src/tests/style/HeaderCycleB3-inl.h b/js/src/tests/style/HeaderCycleB3-inl.h
new file mode 100644
index 000000000000..9963b460cfe5
--- /dev/null
+++ b/js/src/tests/style/HeaderCycleB3-inl.h
@@ -0,0 +1 @@
+#include "tests/style/HeaderCycleB4-inl.h"
diff --git a/js/src/tests/style/HeaderCycleB4-inl.h b/js/src/tests/style/HeaderCycleB4-inl.h
new file mode 100644
index 000000000000..eb9b20e0dcee
--- /dev/null
+++ b/js/src/tests/style/HeaderCycleB4-inl.h
@@ -0,0 +1,2 @@
+#include "tests/style/HeaderCycleB1-inl.h"
+#include "tests/style/jsheadercycleB5inlines.h"
diff --git a/js/src/tests/style/jsheadercycleB5inlines.h b/js/src/tests/style/jsheadercycleB5inlines.h
new file mode 100644
index 000000000000..92a54cf53500
--- /dev/null
+++ b/js/src/tests/style/jsheadercycleB5inlines.h
@@ -0,0 +1 @@
+#include "tests/style/HeaderCycleB1-inl.h"
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index 00b2f5c71ec4..6b422e537b4f 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -4516,11 +4516,19 @@ DebuggerObject_getParameterNames(JSContext *cx, unsigned argc, Value *vp)
     result->ensureDenseInitializedLength(cx, 0, fun->nargs);
 
     if (fun->isInterpreted()) {
-        JS_ASSERT(fun->nargs == fun->nonLazyScript()->bindings.numArgs());
+        RootedScript script(cx);
+
+        {
+            AutoCompartment ac(cx, fun);
+            script = fun->getOrCreateScript(cx);
+            if (!script)
+                return false;
+        }
+
+        JS_ASSERT(fun->nargs == script->bindings.numArgs());
 
         if (fun->nargs > 0) {
             BindingVector bindings(cx);
-            RootedScript script(cx, fun->nonLazyScript());
             if (!FillBindingVector(script, &bindings))
                 return false;
             for (size_t i = 0; i < fun->nargs; i++) {
@@ -4557,7 +4565,16 @@ DebuggerObject_getScript(JSContext *cx, unsigned argc, Value *vp)
         return true;
     }
 
-    RootedScript script(cx, fun->nonLazyScript());
+    RootedScript script(cx);
+
+    {
+        AutoCompartment ac(cx, obj);
+
+        script = fun->getOrCreateScript(cx);
+        if (!script)
+            return false;
+    }
+
     RootedObject scriptObject(cx, dbg->wrapScript(cx, script));
     if (!scriptObject)
         return false;
diff --git a/js/src/vm/Runtime.h b/js/src/vm/Runtime.h
index 8820420e1c57..b89bd2a3d98c 100644
--- a/js/src/vm/Runtime.h
+++ b/js/src/vm/Runtime.h
@@ -923,6 +923,7 @@ struct JSRuntime : public JS::shadow::Runtime,
 
     /* Context create/destroy callback. */
     JSContextCallback   cxCallback;
+    void               *cxCallbackData;
 
     /* Compartment destroy callback. */
     JSDestroyCompartmentCallback destroyCompartmentCallback;
diff --git a/js/src/vtune/README b/js/src/vtune/README
new file mode 100644
index 000000000000..23719d8c2bd4
--- /dev/null
+++ b/js/src/vtune/README
@@ -0,0 +1,10 @@
+VTune files imported from VTune Amplifier XE 2013 Rev 11.
+
+To update these files, copy the following from a VTune install directory:
+    sdk/src/ittnotify/ittnotify_config.h
+    sdk/src/ittnotify/ittnotify_types.h
+    sdk/src/ittnotify/jitprofiling.c
+    include/jitprofiling.h
+
+If the license has changed, update the "VTune License" section of
+    toolkit/content/license.html
diff --git a/js/src/vtune/VTuneWrapper.h b/js/src/vtune/VTuneWrapper.h
new file mode 100644
index 000000000000..b2f6b787b7f2
--- /dev/null
+++ b/js/src/vtune/VTuneWrapper.h
@@ -0,0 +1,18 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef vtunewrapper_h
+#define vtunewrapper_h
+
+#include "vtune/jitprofiling.h"
+
+inline bool
+IsVTuneProfilingActive()
+{
+    return (iJIT_IsProfilingActive() == iJIT_SAMPLING_ON);
+}
+
+#endif // vtunewrapper_h
diff --git a/js/src/vtune/ittnotify_config.h b/js/src/vtune/ittnotify_config.h
new file mode 100644
index 000000000000..2a5a62dc3003
--- /dev/null
+++ b/js/src/vtune/ittnotify_config.h
@@ -0,0 +1,493 @@
+/*
+  This file is provided under a dual BSD/GPLv2 license.  When using or
+  redistributing this file, you may do so under either license.
+
+  GPL LICENSE SUMMARY
+
+  Copyright (c) 2005-2012 Intel Corporation. All rights reserved.
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of version 2 of the GNU General Public License as
+  published by the Free Software Foundation.
+
+  This program is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+  General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+  The full GNU General Public License is included in this distribution
+  in the file called LICENSE.GPL.
+
+  Contact Information:
+  http://software.intel.com/en-us/articles/intel-vtune-amplifier-xe/
+
+  BSD LICENSE
+
+  Copyright (c) 2005-2012 Intel Corporation. All rights reserved.
+  All rights reserved.
+
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions
+  are met:
+
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in
+      the documentation and/or other materials provided with the
+      distribution.
+    * Neither the name of Intel Corporation nor the names of its
+      contributors may be used to endorse or promote products derived
+      from this software without specific prior written permission.
+
+  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+  OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+#ifndef _ITTNOTIFY_CONFIG_H_
+#define _ITTNOTIFY_CONFIG_H_
+
+/** @cond exclude_from_documentation */
+#ifndef ITT_OS_WIN
+#  define ITT_OS_WIN   1
+#endif /* ITT_OS_WIN */
+
+#ifndef ITT_OS_LINUX
+#  define ITT_OS_LINUX 2
+#endif /* ITT_OS_LINUX */
+
+#ifndef ITT_OS_MAC
+#  define ITT_OS_MAC   3
+#endif /* ITT_OS_MAC */
+
+#ifndef ITT_OS
+#  if defined WIN32 || defined _WIN32
+#    define ITT_OS ITT_OS_WIN
+#  elif defined( __APPLE__ ) && defined( __MACH__ )
+#    define ITT_OS ITT_OS_MAC
+#  else
+#    define ITT_OS ITT_OS_LINUX
+#  endif
+#endif /* ITT_OS */
+
+#ifndef ITT_PLATFORM_WIN
+#  define ITT_PLATFORM_WIN 1
+#endif /* ITT_PLATFORM_WIN */
+
+#ifndef ITT_PLATFORM_POSIX
+#  define ITT_PLATFORM_POSIX 2
+#endif /* ITT_PLATFORM_POSIX */
+
+#ifndef ITT_PLATFORM
+#  if ITT_OS==ITT_OS_WIN
+#    define ITT_PLATFORM ITT_PLATFORM_WIN
+#  else
+#    define ITT_PLATFORM ITT_PLATFORM_POSIX
+#  endif /* _WIN32 */
+#endif /* ITT_PLATFORM */
+
+#if defined(_UNICODE) && !defined(UNICODE)
+#define UNICODE
+#endif
+
+#include <stddef.h>
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#include <tchar.h>
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#include <stdint.h>
+#if defined(UNICODE) || defined(_UNICODE)
+#include <wchar.h>
+#endif /* UNICODE || _UNICODE */
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+#ifndef CDECL
+#  if ITT_PLATFORM==ITT_PLATFORM_WIN
+#    define CDECL __cdecl
+#  else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#    if defined _M_X64 || defined _M_AMD64 || defined __x86_64__
+#      define CDECL /* not actual on x86_64 platform */
+#    else  /* _M_X64 || _M_AMD64 || __x86_64__ */
+#      define CDECL __attribute__ ((cdecl))
+#    endif /* _M_X64 || _M_AMD64 || __x86_64__ */
+#  endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* CDECL */
+
+#ifndef STDCALL
+#  if ITT_PLATFORM==ITT_PLATFORM_WIN
+#    define STDCALL __stdcall
+#  else /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#    if defined _M_X64 || defined _M_AMD64 || defined __x86_64__
+#      define STDCALL /* not supported on x86_64 platform */
+#    else  /* _M_X64 || _M_AMD64 || __x86_64__ */
+#      define STDCALL __attribute__ ((stdcall))
+#    endif /* _M_X64 || _M_AMD64 || __x86_64__ */
+#  endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#endif /* STDCALL */
+
+#define ITTAPI    CDECL
+#define LIBITTAPI CDECL
+
+/* TODO: Temporary for compatibility! */
+#define ITTAPI_CALL    CDECL
+#define LIBITTAPI_CALL CDECL
+
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+/* use __forceinline (VC++ specific) */
+#define ITT_INLINE           __forceinline
+#define ITT_INLINE_ATTRIBUTE /* nothing */
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+/*
+ * Generally, functions are not inlined unless optimization is specified.
+ * For functions declared inline, this attribute inlines the function even
+ * if no optimization level was specified.
+ */
+#ifdef __STRICT_ANSI__
+#define ITT_INLINE           static
+#else  /* __STRICT_ANSI__ */
+#define ITT_INLINE           static inline
+#endif /* __STRICT_ANSI__ */
+#define ITT_INLINE_ATTRIBUTE __attribute__ ((always_inline))
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+/** @endcond */
+
+#ifndef ITT_ARCH_IA32
+#  define ITT_ARCH_IA32  1
+#endif /* ITT_ARCH_IA32 */
+
+#ifndef ITT_ARCH_IA32E
+#  define ITT_ARCH_IA32E 2
+#endif /* ITT_ARCH_IA32E */
+
+#ifndef ITT_ARCH_IA64
+#  define ITT_ARCH_IA64  3
+#endif /* ITT_ARCH_IA64 */
+
+#ifndef ITT_ARCH
+#  if defined _M_X64 || defined _M_AMD64 || defined __x86_64__
+#    define ITT_ARCH ITT_ARCH_IA32E
+#  elif defined _M_IA64 || defined __ia64
+#    define ITT_ARCH ITT_ARCH_IA64
+#  else
+#    define ITT_ARCH ITT_ARCH_IA32
+#  endif
+#endif
+
+#ifdef __cplusplus
+#  define ITT_EXTERN_C extern "C"
+#else
+#  define ITT_EXTERN_C /* nothing */
+#endif /* __cplusplus */
+
+#define ITT_TO_STR_AUX(x) #x
+#define ITT_TO_STR(x)     ITT_TO_STR_AUX(x)
+
+#define __ITT_BUILD_ASSERT(expr, suffix) do { \
+    static char __itt_build_check_##suffix[(expr) ? 1 : -1]; \
+    __itt_build_check_##suffix[0] = 0; \
+} while(0)
+#define _ITT_BUILD_ASSERT(expr, suffix)  __ITT_BUILD_ASSERT((expr), suffix)
+#define ITT_BUILD_ASSERT(expr)           _ITT_BUILD_ASSERT((expr), __LINE__)
+
+#define ITT_MAGIC { 0xED, 0xAB, 0xAB, 0xEC, 0x0D, 0xEE, 0xDA, 0x30 }
+
+/* Replace with snapshot date YYYYMMDD for promotion build. */
+#define API_VERSION_BUILD    20111111
+
+#ifndef API_VERSION_NUM
+#define API_VERSION_NUM 0.0.0
+#endif /* API_VERSION_NUM */
+
+#define API_VERSION "ITT-API-Version " ITT_TO_STR(API_VERSION_NUM) \
+                                " (" ITT_TO_STR(API_VERSION_BUILD) ")"
+
+/* OS communication functions */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#include <windows.h>
+typedef HMODULE           lib_t;
+typedef DWORD             TIDT;
+typedef CRITICAL_SECTION  mutex_t;
+#define MUTEX_INITIALIZER { 0 }
+#define strong_alias(name, aliasname) /* empty for Windows */
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#include <dlfcn.h>
+#if defined(UNICODE) || defined(_UNICODE)
+#include <wchar.h>
+#endif /* UNICODE */
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE 1 /* need for PTHREAD_MUTEX_RECURSIVE */
+#endif /* _GNU_SOURCE */
+#include <pthread.h>
+typedef void*             lib_t;
+typedef pthread_t         TIDT;
+typedef pthread_mutex_t   mutex_t;
+#define MUTEX_INITIALIZER PTHREAD_MUTEX_INITIALIZER
+#define _strong_alias(name, aliasname) \
+            extern __typeof (name) aliasname __attribute__ ((alias (#name)));
+#define strong_alias(name, aliasname) _strong_alias(name, aliasname)
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define __itt_get_proc(lib, name) GetProcAddress(lib, name)
+#define __itt_mutex_init(mutex)   InitializeCriticalSection(mutex)
+#define __itt_mutex_lock(mutex)   EnterCriticalSection(mutex)
+#define __itt_mutex_unlock(mutex) LeaveCriticalSection(mutex)
+#define __itt_load_lib(name)      LoadLibraryA(name)
+#define __itt_unload_lib(handle)  FreeLibrary(handle)
+#define __itt_system_error()      (int)GetLastError()
+#define __itt_fstrcmp(s1, s2)     lstrcmpA(s1, s2)
+#define __itt_fstrlen(s)          lstrlenA(s)
+#define __itt_fstrcpyn(s1, s2, l) lstrcpynA(s1, s2, l)
+#define __itt_fstrdup(s)          _strdup(s)
+#define __itt_thread_id()         GetCurrentThreadId()
+#define __itt_thread_yield()      SwitchToThread()
+#ifndef ITT_SIMPLE_INIT
+ITT_INLINE long
+__itt_interlocked_increment(volatile long* ptr) ITT_INLINE_ATTRIBUTE;
+ITT_INLINE long __itt_interlocked_increment(volatile long* ptr)
+{
+    return InterlockedIncrement(ptr);
+}
+#endif /* ITT_SIMPLE_INIT */
+#else /* ITT_PLATFORM!=ITT_PLATFORM_WIN */
+#define __itt_get_proc(lib, name) dlsym(lib, name)
+#define __itt_mutex_init(mutex)   {\
+    pthread_mutexattr_t mutex_attr;                                         \
+    int error_code = pthread_mutexattr_init(&mutex_attr);                   \
+    if (error_code)                                                         \
+        __itt_report_error(__itt_error_system, "pthread_mutexattr_init",    \
+                           error_code);                                     \
+    error_code = pthread_mutexattr_settype(&mutex_attr,                     \
+                                           PTHREAD_MUTEX_RECURSIVE);        \
+    if (error_code)                                                         \
+        __itt_report_error(__itt_error_system, "pthread_mutexattr_settype", \
+                           error_code);                                     \
+    error_code = pthread_mutex_init(mutex, &mutex_attr);                    \
+    if (error_code)                                                         \
+        __itt_report_error(__itt_error_system, "pthread_mutex_init",        \
+                           error_code);                                     \
+    error_code = pthread_mutexattr_destroy(&mutex_attr);                    \
+    if (error_code)                                                         \
+        __itt_report_error(__itt_error_system, "pthread_mutexattr_destroy", \
+                           error_code);                                     \
+}
+#define __itt_mutex_lock(mutex)   pthread_mutex_lock(mutex)
+#define __itt_mutex_unlock(mutex) pthread_mutex_unlock(mutex)
+#define __itt_load_lib(name)      dlopen(name, RTLD_LAZY)
+#define __itt_unload_lib(handle)  dlclose(handle)
+#define __itt_system_error()      errno
+#define __itt_fstrcmp(s1, s2)     strcmp(s1, s2)
+#define __itt_fstrlen(s)          strlen(s)
+#define __itt_fstrcpyn(s1, s2, l) strncpy(s1, s2, l)
+#define __itt_fstrdup(s)          strdup(s)
+#define __itt_thread_id()         pthread_self()
+#define __itt_thread_yield()      sched_yield()
+#if ITT_ARCH==ITT_ARCH_IA64
+#ifdef __INTEL_COMPILER
+#define __TBB_machine_fetchadd4(addr, val) __fetchadd4_acq((void *)addr, val)
+#else  /* __INTEL_COMPILER */
+/* TODO: Add Support for not Intel compilers for IA64 */
+#endif /* __INTEL_COMPILER */
+#else /* ITT_ARCH!=ITT_ARCH_IA64 */
+ITT_INLINE long
+__TBB_machine_fetchadd4(volatile void* ptr, long addend) ITT_INLINE_ATTRIBUTE;
+ITT_INLINE long __TBB_machine_fetchadd4(volatile void* ptr, long addend)
+{
+    long result;
+    __asm__ __volatile__("lock\nxadd %0,%1"
+                          : "=r"(result),"=m"(*(long*)ptr)
+                          : "0"(addend), "m"(*(long*)ptr)
+                          : "memory");
+    return result;
+}
+#endif /* ITT_ARCH==ITT_ARCH_IA64 */
+#ifndef ITT_SIMPLE_INIT
+ITT_INLINE long
+__itt_interlocked_increment(volatile long* ptr) ITT_INLINE_ATTRIBUTE;
+ITT_INLINE long __itt_interlocked_increment(volatile long* ptr)
+{
+    return __TBB_machine_fetchadd4(ptr, 1) + 1L;
+}
+#endif /* ITT_SIMPLE_INIT */
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+typedef enum {
+    __itt_collection_normal = 0,
+    __itt_collection_paused = 1
+} __itt_collection_state;
+
+typedef enum {
+    __itt_thread_normal  = 0,
+    __itt_thread_ignored = 1
+} __itt_thread_state;
+
+#pragma pack(push, 8)
+
+typedef struct ___itt_thread_info
+{
+    const char* nameA; /*!< Copy of original name in ASCII. */
+#if defined(UNICODE) || defined(_UNICODE)
+    const wchar_t* nameW; /*!< Copy of original name in UNICODE. */
+#else  /* UNICODE || _UNICODE */
+    void* nameW;
+#endif /* UNICODE || _UNICODE */
+    TIDT               tid;
+    __itt_thread_state state;   /*!< Thread state (paused or normal) */
+    int                extra1;  /*!< Reserved to the runtime */
+    void*              extra2;  /*!< Reserved to the runtime */
+    struct ___itt_thread_info* next;
+} __itt_thread_info;
+
+#include "ittnotify_types.h" /* For __itt_group_id definition */
+
+typedef struct ___itt_api_info_20101001
+{
+    const char*    name;
+    void**         func_ptr;
+    void*          init_func;
+    __itt_group_id group;
+}  __itt_api_info_20101001;
+
+typedef struct ___itt_api_info
+{
+    const char*    name;
+    void**         func_ptr;
+    void*          init_func;
+    void*          null_func;
+    __itt_group_id group;
+}  __itt_api_info;
+
+struct ___itt_domain;
+struct ___itt_string_handle;
+
+typedef struct ___itt_global
+{
+    unsigned char          magic[8];
+    unsigned long          version_major;
+    unsigned long          version_minor;
+    unsigned long          version_build;
+    volatile long          api_initialized;
+    volatile long          mutex_initialized;
+    volatile long          atomic_counter;
+    mutex_t                mutex;
+    lib_t                  lib;
+    void*                  error_handler;
+    const char**           dll_path_ptr;
+    __itt_api_info*        api_list_ptr;
+    struct ___itt_global*  next;
+    /* Joinable structures below */
+    __itt_thread_info*     thread_list;
+    struct ___itt_domain*  domain_list;
+    struct ___itt_string_handle* string_list;
+    __itt_collection_state state;
+} __itt_global;
+
+#pragma pack(pop)
+
+#define NEW_THREAD_INFO_W(gptr,h,h_tail,t,s,n) { \
+    h = (__itt_thread_info*)malloc(sizeof(__itt_thread_info)); \
+    if (h != NULL) { \
+        h->tid    = t; \
+        h->nameA  = NULL; \
+        h->nameW  = n ? _wcsdup(n) : NULL; \
+        h->state  = s; \
+        h->extra1 = 0;    /* reserved */ \
+        h->extra2 = NULL; /* reserved */ \
+        h->next   = NULL; \
+        if (h_tail == NULL) \
+            (gptr)->thread_list = h; \
+        else \
+            h_tail->next = h; \
+    } \
+}
+
+#define NEW_THREAD_INFO_A(gptr,h,h_tail,t,s,n) { \
+    h = (__itt_thread_info*)malloc(sizeof(__itt_thread_info)); \
+    if (h != NULL) { \
+        h->tid    = t; \
+        h->nameA  = n ? __itt_fstrdup(n) : NULL; \
+        h->nameW  = NULL; \
+        h->state  = s; \
+        h->extra1 = 0;    /* reserved */ \
+        h->extra2 = NULL; /* reserved */ \
+        h->next   = NULL; \
+        if (h_tail == NULL) \
+            (gptr)->thread_list = h; \
+        else \
+            h_tail->next = h; \
+    } \
+}
+
+#define NEW_DOMAIN_W(gptr,h,h_tail,name) { \
+    h = (__itt_domain*)malloc(sizeof(__itt_domain)); \
+    if (h != NULL) { \
+        h->flags  = 0;    /* domain is disabled by default */ \
+        h->nameA  = NULL; \
+        h->nameW  = name ? _wcsdup(name) : NULL; \
+        h->extra1 = 0;    /* reserved */ \
+        h->extra2 = NULL; /* reserved */ \
+        h->next   = NULL; \
+        if (h_tail == NULL) \
+            (gptr)->domain_list = h; \
+        else \
+            h_tail->next = h; \
+    } \
+}
+
+#define NEW_DOMAIN_A(gptr,h,h_tail,name) { \
+    h = (__itt_domain*)malloc(sizeof(__itt_domain)); \
+    if (h != NULL) { \
+        h->flags  = 0;    /* domain is disabled by default */ \
+        h->nameA  = name ? __itt_fstrdup(name) : NULL; \
+        h->nameW  = NULL; \
+        h->extra1 = 0;    /* reserved */ \
+        h->extra2 = NULL; /* reserved */ \
+        h->next   = NULL; \
+        if (h_tail == NULL) \
+            (gptr)->domain_list = h; \
+        else \
+            h_tail->next = h; \
+    } \
+}
+
+#define NEW_STRING_HANDLE_W(gptr,h,h_tail,name) { \
+    h = (__itt_string_handle*)malloc(sizeof(__itt_string_handle)); \
+    if (h != NULL) { \
+        h->strA   = NULL; \
+        h->strW   = name ? _wcsdup(name) : NULL; \
+        h->extra1 = 0;    /* reserved */ \
+        h->extra2 = NULL; /* reserved */ \
+        h->next   = NULL; \
+        if (h_tail == NULL) \
+            (gptr)->string_list = h; \
+        else \
+            h_tail->next = h; \
+    } \
+}
+
+#define NEW_STRING_HANDLE_A(gptr,h,h_tail,name) { \
+    h = (__itt_string_handle*)malloc(sizeof(__itt_string_handle)); \
+    if (h != NULL) { \
+        h->strA   = name ? __itt_fstrdup(name) : NULL; \
+        h->strW   = NULL; \
+        h->extra1 = 0;    /* reserved */ \
+        h->extra2 = NULL; /* reserved */ \
+        h->next   = NULL; \
+        if (h_tail == NULL) \
+            (gptr)->string_list = h; \
+        else \
+            h_tail->next = h; \
+    } \
+}
+
+#endif /* _ITTNOTIFY_CONFIG_H_ */
diff --git a/js/src/vtune/ittnotify_types.h b/js/src/vtune/ittnotify_types.h
new file mode 100644
index 000000000000..3f2cd7f0c9ca
--- /dev/null
+++ b/js/src/vtune/ittnotify_types.h
@@ -0,0 +1,114 @@
+/*
+  This file is provided under a dual BSD/GPLv2 license.  When using or
+  redistributing this file, you may do so under either license.
+
+  GPL LICENSE SUMMARY
+
+  Copyright (c) 2005-2012 Intel Corporation. All rights reserved.
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of version 2 of the GNU General Public License as
+  published by the Free Software Foundation.
+
+  This program is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+  General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+  The full GNU General Public License is included in this distribution
+  in the file called LICENSE.GPL.
+
+  Contact Information:
+  http://software.intel.com/en-us/articles/intel-vtune-amplifier-xe/
+
+  BSD LICENSE
+
+  Copyright (c) 2005-2012 Intel Corporation. All rights reserved.
+  All rights reserved.
+
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions
+  are met:
+
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in
+      the documentation and/or other materials provided with the
+      distribution.
+    * Neither the name of Intel Corporation nor the names of its
+      contributors may be used to endorse or promote products derived
+      from this software without specific prior written permission.
+
+  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+  OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+#ifndef _ITTNOTIFY_TYPES_H_
+#define _ITTNOTIFY_TYPES_H_
+
+typedef enum ___itt_group_id
+{
+    __itt_group_none      = 0,
+    __itt_group_legacy    = 1<<0,
+    __itt_group_control   = 1<<1,
+    __itt_group_thread    = 1<<2,
+    __itt_group_mark      = 1<<3,
+    __itt_group_sync      = 1<<4,
+    __itt_group_fsync     = 1<<5,
+    __itt_group_jit       = 1<<6,
+    __itt_group_model     = 1<<7,
+    __itt_group_splitter_min = 1<<7,
+    __itt_group_counter   = 1<<8,
+    __itt_group_frame     = 1<<9,
+    __itt_group_stitch    = 1<<10,
+    __itt_group_heap      = 1<<11,
+    __itt_group_splitter_max = 1<<12,
+    __itt_group_structure = 1<<12,
+    __itt_group_suppress = 1<<13,
+    __itt_group_arrays    = 1<<14,
+    __itt_group_all       = -1
+} __itt_group_id;
+
+#pragma pack(push, 8)
+
+typedef struct ___itt_group_list
+{
+    __itt_group_id id;
+    const char*    name;
+} __itt_group_list;
+
+#pragma pack(pop)
+
+#define ITT_GROUP_LIST(varname) \
+    static __itt_group_list varname[] = {       \
+        { __itt_group_all,       "all"       }, \
+        { __itt_group_control,   "control"   }, \
+        { __itt_group_thread,    "thread"    }, \
+        { __itt_group_mark,      "mark"      }, \
+        { __itt_group_sync,      "sync"      }, \
+        { __itt_group_fsync,     "fsync"     }, \
+        { __itt_group_jit,       "jit"       }, \
+        { __itt_group_model,     "model"     }, \
+        { __itt_group_counter,   "counter"   }, \
+        { __itt_group_frame,     "frame"     }, \
+        { __itt_group_stitch,    "stitch"    }, \
+        { __itt_group_heap,      "heap"      }, \
+        { __itt_group_structure, "structure" }, \
+        { __itt_group_suppress,  "suppress"  }, \
+        { __itt_group_arrays,    "arrays"    }, \
+        { __itt_group_none,      NULL        }  \
+    }
+
+#endif /* _ITTNOTIFY_TYPES_H_ */
diff --git a/js/src/vtune/jitprofiling.c b/js/src/vtune/jitprofiling.c
new file mode 100644
index 000000000000..558af0c306ae
--- /dev/null
+++ b/js/src/vtune/jitprofiling.c
@@ -0,0 +1,528 @@
+/*
+  This file is provided under a dual BSD/GPLv2 license.  When using or
+  redistributing this file, you may do so under either license.
+
+  GPL LICENSE SUMMARY
+
+  Copyright (c) 2005-2012 Intel Corporation. All rights reserved.
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of version 2 of the GNU General Public License as
+  published by the Free Software Foundation.
+
+  This program is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+  General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+  The full GNU General Public License is included in this distribution
+  in the file called LICENSE.GPL.
+
+  Contact Information:
+  http://software.intel.com/en-us/articles/intel-vtune-amplifier-xe/
+
+  BSD LICENSE
+
+  Copyright (c) 2005-2012 Intel Corporation. All rights reserved.
+  All rights reserved.
+
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions
+  are met:
+
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in
+      the documentation and/or other materials provided with the
+      distribution.
+    * Neither the name of Intel Corporation nor the names of its
+      contributors may be used to endorse or promote products derived
+      from this software without specific prior written permission.
+
+  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+  OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+#include "vtune/ittnotify_config.h"
+
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#include <windows.h>
+#pragma optimize("", off)
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#include <pthread.h>
+#include <dlfcn.h>
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#include <malloc.h>
+#include <stdlib.h>
+
+#include "vtune/jitprofiling.h"
+
+static const char rcsid[] = "\n@(#) $Revision: 294150 $\n";
+
+#define DLL_ENVIRONMENT_VAR             "VS_PROFILER"
+
+#ifndef NEW_DLL_ENVIRONMENT_VAR
+#if ITT_ARCH==ITT_ARCH_IA32
+#define NEW_DLL_ENVIRONMENT_VAR	        "INTEL_JIT_PROFILER32"
+#else
+#define NEW_DLL_ENVIRONMENT_VAR	        "INTEL_JIT_PROFILER64"
+#endif
+#endif /* NEW_DLL_ENVIRONMENT_VAR */
+
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+#define DEFAULT_DLLNAME                 "JitPI.dll"
+HINSTANCE m_libHandle = NULL;
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+#define DEFAULT_DLLNAME                 "libJitPI.so"
+void* m_libHandle = NULL;
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+/* default location of JIT profiling agent on Android */
+#define ANDROID_JIT_AGENT_PATH  "/data/intel/libittnotify.so"
+
+/* the function pointers */
+typedef unsigned int(*TPInitialize)(void);
+static TPInitialize FUNC_Initialize=NULL;
+
+typedef unsigned int(*TPNotify)(unsigned int, void*);
+static TPNotify FUNC_NotifyEvent=NULL;
+
+static iJIT_IsProfilingActiveFlags executionMode = iJIT_NOTHING_RUNNING;
+
+/* end collector dll part. */
+
+/* loadiJIT_Funcs() : this function is called just in the beginning 
+ *  and is responsible to load the functions from BistroJavaCollector.dll
+ * result:
+ *  on success: the functions loads, iJIT_DLL_is_missing=0, return value = 1
+ *  on failure: the functions are NULL, iJIT_DLL_is_missing=1, return value = 0
+ */ 
+static int loadiJIT_Funcs(void);
+
+/* global representing whether the BistroJavaCollector can't be loaded */
+static int iJIT_DLL_is_missing = 0;
+
+/* Virtual stack - the struct is used as a virtual stack for each thread.
+ * Every thread initializes with a stack of size INIT_TOP_STACK.
+ * Every method entry decreases from the current stack point,
+ * and when a thread stack reaches its top of stack (return from the global 
+ * function), the top of stack and the current stack increase. Notice that 
+ * when returning from a function the stack pointer is the address of 
+ * the function return.
+*/
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+static DWORD threadLocalStorageHandle = 0;
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+static pthread_key_t threadLocalStorageHandle = (pthread_key_t)0;
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+#define INIT_TOP_Stack 10000
+
+typedef struct 
+{
+    unsigned int TopStack;
+    unsigned int CurrentStack;
+} ThreadStack, *pThreadStack;
+
+/* end of virtual stack. */
+
+/*
+ * The function for reporting virtual-machine related events to VTune.
+ * Note: when reporting iJVM_EVENT_TYPE_ENTER_NIDS, there is no need to fill 
+ * in the stack_id field in the iJIT_Method_NIDS structure, as VTune fills it.
+ * The return value in iJVM_EVENT_TYPE_ENTER_NIDS && 
+ * iJVM_EVENT_TYPE_LEAVE_NIDS events will be 0 in case of failure.
+ * in iJVM_EVENT_TYPE_METHOD_LOAD_FINISHED event 
+ * it will be -1 if EventSpecificData == 0 otherwise it will be 0.
+*/
+
+ITT_EXTERN_C int JITAPI 
+iJIT_NotifyEvent(iJIT_JVM_EVENT event_type, void *EventSpecificData)
+{
+    int ReturnValue;
+
+    /*
+     * This section is for debugging outside of VTune. 
+     * It creates the environment variables that indicates call graph mode.
+     * If running outside of VTune remove the remark.
+     *
+     *
+     * static int firstTime = 1;
+     * char DoCallGraph[12] = "DoCallGraph";
+     * if (firstTime)
+     * {
+     * firstTime = 0;
+     * SetEnvironmentVariable( "BISTRO_COLLECTORS_DO_CALLGRAPH", DoCallGraph);
+     * }
+     *
+     * end of section.
+    */
+
+    /* initialization part - the functions have not been loaded yet. This part
+     *        will load the functions, and check if we are in Call Graph mode. 
+     *        (for special treatment).
+     */
+    if (!FUNC_NotifyEvent) 
+    {
+        if (iJIT_DLL_is_missing) 
+            return 0;
+
+        /* load the Function from the DLL */
+        if (!loadiJIT_Funcs()) 
+            return 0;
+
+        /* Call Graph initialization. */
+    }
+
+    /* If the event is method entry/exit, check that in the current mode 
+     * VTune is allowed to receive it
+     */
+    if ((event_type == iJVM_EVENT_TYPE_ENTER_NIDS || 
+         event_type == iJVM_EVENT_TYPE_LEAVE_NIDS) &&
+        (executionMode != iJIT_CALLGRAPH_ON))
+    {
+        return 0;
+    }
+    /* This section is performed when method enter event occurs.
+     * It updates the virtual stack, or creates it if this is the first 
+     * method entry in the thread. The stack pointer is decreased.
+     */
+    if (event_type == iJVM_EVENT_TYPE_ENTER_NIDS)
+    {
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+        pThreadStack threadStack = 
+            (pThreadStack)TlsGetValue (threadLocalStorageHandle);
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+        pThreadStack threadStack = 
+            (pThreadStack)pthread_getspecific(threadLocalStorageHandle);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+        /* check for use of reserved method IDs */
+        if ( ((piJIT_Method_NIDS) EventSpecificData)->method_id <= 999 )
+            return 0;
+
+        if (!threadStack)
+        {
+            /* initialize the stack. */
+            threadStack = (pThreadStack) calloc (sizeof(ThreadStack), 1);
+            if (!threadStack)
+                return 0;
+            threadStack->TopStack = INIT_TOP_Stack;
+            threadStack->CurrentStack = INIT_TOP_Stack;
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+            TlsSetValue(threadLocalStorageHandle,(void*)threadStack);
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+            pthread_setspecific(threadLocalStorageHandle,(void*)threadStack);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+        }
+
+        /* decrease the stack. */
+        ((piJIT_Method_NIDS) EventSpecificData)->stack_id = 
+            (threadStack->CurrentStack)--;
+    }
+
+    /* This section is performed when method leave event occurs
+     * It updates the virtual stack.
+     *    Increases the stack pointer.
+     *    If the stack pointer reached the top (left the global function)
+     *        increase the pointer and the top pointer.
+     */
+    if (event_type == iJVM_EVENT_TYPE_LEAVE_NIDS)
+    {
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+        pThreadStack threadStack = 
+           (pThreadStack)TlsGetValue (threadLocalStorageHandle);
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+        pThreadStack threadStack = 
+            (pThreadStack)pthread_getspecific(threadLocalStorageHandle);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+        /* check for use of reserved method IDs */
+        if ( ((piJIT_Method_NIDS) EventSpecificData)->method_id <= 999 )
+            return 0;
+
+        if (!threadStack)
+        {
+            /* Error: first report in this thread is method exit */
+            exit (1);
+        }
+
+        ((piJIT_Method_NIDS) EventSpecificData)->stack_id = 
+            ++(threadStack->CurrentStack) + 1;
+
+        if (((piJIT_Method_NIDS) EventSpecificData)->stack_id 
+               > threadStack->TopStack)
+            ((piJIT_Method_NIDS) EventSpecificData)->stack_id = 
+                (unsigned int)-1;
+    }
+
+    if (event_type == iJVM_EVENT_TYPE_METHOD_LOAD_FINISHED)
+    {
+        /* check for use of reserved method IDs */
+        if ( ((piJIT_Method_Load) EventSpecificData)->method_id <= 999 )
+            return 0;
+    }
+    else if (event_type == iJVM_EVENT_TYPE_METHOD_LOAD_FINISHED_V2)
+    {
+        /* check for use of reserved method IDs */
+        if ( ((piJIT_Method_Load_V2) EventSpecificData)->method_id <= 999 )
+            return 0;
+    }
+
+    ReturnValue = (int)FUNC_NotifyEvent(event_type, EventSpecificData);
+
+    return ReturnValue;
+}
+
+/* The new mode call back routine */
+ITT_EXTERN_C void JITAPI 
+iJIT_RegisterCallbackEx(void *userdata, iJIT_ModeChangedEx 
+                        NewModeCallBackFuncEx) 
+{
+    /* is it already missing... or the load of functions from the DLL failed */
+    if (iJIT_DLL_is_missing || !loadiJIT_Funcs())
+    {
+        /* then do not bother with notifications */
+        NewModeCallBackFuncEx(userdata, iJIT_NO_NOTIFICATIONS);  
+        /* Error: could not load JIT functions. */
+        return;
+    }
+    /* nothing to do with the callback */
+}
+
+/*
+ * This function allows the user to query in which mode, if at all, 
+ *VTune is running
+ */
+ITT_EXTERN_C iJIT_IsProfilingActiveFlags JITAPI iJIT_IsProfilingActive()
+{
+    if (!iJIT_DLL_is_missing)
+    {
+        loadiJIT_Funcs();
+    }
+
+    return executionMode;
+}
+
+/* this function loads the collector dll (BistroJavaCollector) 
+ * and the relevant functions.
+ * on success: all functions load,     iJIT_DLL_is_missing = 0, return value = 1
+ * on failure: all functions are NULL, iJIT_DLL_is_missing = 1, return value = 0
+ */ 
+static int loadiJIT_Funcs()
+{
+    static int bDllWasLoaded = 0;
+    char *dllName = (char*)rcsid; /* !! Just to avoid unused code elimination */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+    DWORD dNameLength = 0;
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+    if(bDllWasLoaded)
+    {
+        /* dll was already loaded, no need to do it for the second time */
+        return 1;
+    }
+
+    /* Assumes that the DLL will not be found */
+    iJIT_DLL_is_missing = 1;
+    FUNC_NotifyEvent = NULL;
+
+    if (m_libHandle) 
+    {
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+        FreeLibrary(m_libHandle);
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+        dlclose(m_libHandle);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+        m_libHandle = NULL;
+    }
+
+    /* Try to get the dll name from the environment */
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+    dNameLength = GetEnvironmentVariableA(NEW_DLL_ENVIRONMENT_VAR, NULL, 0);
+    if (dNameLength)
+    {
+        DWORD envret = 0;
+        dllName = (char*)malloc(sizeof(char) * (dNameLength + 1));
+        envret = GetEnvironmentVariableA(NEW_DLL_ENVIRONMENT_VAR, 
+                                         dllName, dNameLength);
+        if (envret)
+        {
+            /* Try to load the dll from the PATH... */
+            m_libHandle = LoadLibraryExA(dllName, 
+                                         NULL, LOAD_WITH_ALTERED_SEARCH_PATH);
+        }
+        free(dllName);
+    } else {
+        /* Try to use old VS_PROFILER variable */
+        dNameLength = GetEnvironmentVariableA(DLL_ENVIRONMENT_VAR, NULL, 0);
+        if (dNameLength)
+        {
+            DWORD envret = 0;
+            dllName = (char*)malloc(sizeof(char) * (dNameLength + 1));
+            envret = GetEnvironmentVariableA(DLL_ENVIRONMENT_VAR, 
+                                             dllName, dNameLength);
+            if (envret)
+            {
+                /* Try to load the dll from the PATH... */
+                m_libHandle = LoadLibraryA(dllName);
+            }
+            free(dllName);
+        }
+    }
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+    dllName = getenv(NEW_DLL_ENVIRONMENT_VAR);
+    if (!dllName)
+        dllName = getenv(DLL_ENVIRONMENT_VAR);
+#ifdef ANDROID
+    if (!dllName)
+        dllName = ANDROID_JIT_AGENT_PATH;
+#endif
+    if (dllName)
+    {
+        /* Try to load the dll from the PATH... */
+        m_libHandle = dlopen(dllName, RTLD_LAZY);
+    }
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+
+    if (!m_libHandle)
+    {
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+        m_libHandle = LoadLibraryA(DEFAULT_DLLNAME);
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+        m_libHandle = dlopen(DEFAULT_DLLNAME, RTLD_LAZY);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+    }
+
+    /* if the dll wasn't loaded - exit. */
+    if (!m_libHandle)
+    {
+        iJIT_DLL_is_missing = 1; /* don't try to initialize 
+                                  * JIT agent the second time 
+                                  */
+        return 0;
+    }
+
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+    FUNC_NotifyEvent = (TPNotify)GetProcAddress(m_libHandle, "NotifyEvent");
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+    FUNC_NotifyEvent = (TPNotify)dlsym(m_libHandle, "NotifyEvent");
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+    if (!FUNC_NotifyEvent) 
+    {
+        FUNC_Initialize = NULL;
+        return 0;
+    }
+
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+    FUNC_Initialize = (TPInitialize)GetProcAddress(m_libHandle, "Initialize");
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+    FUNC_Initialize = (TPInitialize)dlsym(m_libHandle, "Initialize");
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+    if (!FUNC_Initialize) 
+    {
+        FUNC_NotifyEvent = NULL;
+        return 0;
+    }
+
+    executionMode = (iJIT_IsProfilingActiveFlags)FUNC_Initialize();
+
+    bDllWasLoaded = 1;
+    iJIT_DLL_is_missing = 0; /* DLL is ok. */
+
+    /*
+     * Call Graph mode: init the thread local storage
+     * (need to store the virtual stack there).
+     */
+    if ( executionMode == iJIT_CALLGRAPH_ON )
+    {
+        /* Allocate a thread local storage slot for the thread "stack" */
+        if (!threadLocalStorageHandle)
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+            threadLocalStorageHandle = TlsAlloc();
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+        pthread_key_create(&threadLocalStorageHandle, NULL);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+    }
+
+    return 1;
+}
+
+/*
+ * This function should be called by the user whenever a thread ends, 
+ * to free the thread "virtual stack" storage
+ */
+ITT_EXTERN_C void JITAPI FinalizeThread()
+{
+    if (threadLocalStorageHandle)
+    {
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+        pThreadStack threadStack = 
+            (pThreadStack)TlsGetValue (threadLocalStorageHandle);
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+        pThreadStack threadStack = 
+            (pThreadStack)pthread_getspecific(threadLocalStorageHandle);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+        if (threadStack)
+        {
+            free (threadStack);
+            threadStack = NULL;
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+            TlsSetValue (threadLocalStorageHandle, threadStack);
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+            pthread_setspecific(threadLocalStorageHandle, threadStack);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+        }
+    }
+}
+
+/*
+ * This function should be called by the user when the process ends, 
+ * to free the local storage index
+*/
+ITT_EXTERN_C void JITAPI FinalizeProcess()
+{
+    if (m_libHandle) 
+    {
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+        FreeLibrary(m_libHandle);
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+        dlclose(m_libHandle);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+        m_libHandle = NULL;
+    }
+
+    if (threadLocalStorageHandle)
+#if ITT_PLATFORM==ITT_PLATFORM_WIN
+        TlsFree (threadLocalStorageHandle);
+#else  /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+    pthread_key_delete(threadLocalStorageHandle);
+#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */
+}
+
+/*
+ * This function should be called by the user for any method once.
+ * The function will return a unique method ID, the user should maintain 
+ * the ID for each method
+ */
+ITT_EXTERN_C unsigned int JITAPI iJIT_GetNewMethodID()
+{
+    static unsigned int methodID = 0x100000;
+
+    if (methodID == 0)
+        return 0;  /* ERROR : this is not a valid value */
+
+    return methodID++;
+}
diff --git a/js/src/vtune/jitprofiling.h b/js/src/vtune/jitprofiling.h
new file mode 100644
index 000000000000..4833c88011ad
--- /dev/null
+++ b/js/src/vtune/jitprofiling.h
@@ -0,0 +1,610 @@
+/*
+  This file is provided under a dual BSD/GPLv2 license.  When using or
+  redistributing this file, you may do so under either license.
+
+  GPL LICENSE SUMMARY
+
+  Copyright (c) 2005-2013 Intel Corporation. All rights reserved.
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of version 2 of the GNU General Public License as
+  published by the Free Software Foundation.
+
+  This program is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+  General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+  The full GNU General Public License is included in this distribution
+  in the file called LICENSE.GPL.
+
+  Contact Information:
+  http://software.intel.com/en-us/articles/intel-vtune-amplifier-xe/
+
+  BSD LICENSE
+
+  Copyright (c) 2005-2013 Intel Corporation. All rights reserved.
+  All rights reserved.
+
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions
+  are met:
+
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in
+      the documentation and/or other materials provided with the
+      distribution.
+    * Neither the name of Intel Corporation nor the names of its
+      contributors may be used to endorse or promote products derived
+      from this software without specific prior written permission.
+
+  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+  OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef __JITPROFILING_H__
+#define __JITPROFILING_H__
+
+/**
+ * @brief JIT Profiling APIs
+ *
+ * The JIT Profiling API is used to report information about just-in-time
+ * generated code that can be used by performance tools. The user inserts
+ * calls in the code generator to report information before JIT-compiled
+ * code goes to execution. This information is collected at runtime and used
+ * by tools like Intel(R) VTune(TM) Amplifier to display performance metrics
+ * associated with JIT-compiled code.
+ *
+ * These APIs can be used to\n
+ * **Profile trace-based and method-based JIT-compiled
+ * code**. Some examples of environments that you can profile with this APIs:
+ * dynamic JIT compilation of JavaScript code traces, OpenCL JIT execution,
+ * Java/.NET managed execution environments, and custom ISV JIT engines.
+ *
+ * @code
+ * #include <jitprofiling.h>
+ *
+ * if (iJIT_IsProfilingActive != iJIT_SAMPLING_ON) {
+ *     return;
+ * }
+ *
+ * iJIT_Method_Load jmethod = {0};
+ * jmethod.method_id = iJIT_GetNewMethodID();
+ * jmethod.method_name = "method_name";
+ * jmethod.class_file_name = "class_name";
+ * jmethod.source_file_name = "source_file_name";
+ * jmethod.method_load_address = code_addr;
+ * jmethod.method_size = code_size;
+ *
+ * iJIT_NotifyEvent(iJVM_EVENT_TYPE_METHOD_LOAD_FINISHED, (void*)&jmethod);
+ * iJIT_NotifyEvent(iJVM_EVENT_TYPE_SHUTDOWN, NULL);
+ * @endcode
+ *
+ *  * Expected behaviour:
+ *    * If any iJVM_EVENT_TYPE_METHOD_LOAD_FINISHED event overwrites
+ *      already reported method, then such a method becomes invalid and its
+ *      memory region is treated as unloaded. VTune Amplifier displays the metrics
+ *      collected by the method until it is overwritten.
+ *    * If supplied line number information contains multiple source lines for
+ *      the same assembly instruction (code location), then VTune Amplifier picks up
+ *      the first line number.
+ *    * Dynamically generated code can be associated with a module name.
+ *      Use the iJIT_Method_Load_V2 structure.\n
+ *      Clarification of some cases:\n
+ *        * If you register a function with the same method ID multiple times
+ *          specifying different module names, then the VTune Amplifier picks up
+ *          the module name registered first. If you want to distinguish the same
+ *          function between different JIT engines, supply different method IDs for
+ *          each function. Other symbolic information (for example, source file)
+ *          can be identical.
+ *
+ * **Analyze split functions** (multiple joint or disjoint code regions
+ * belonging to the same function) **including re-JIT**
+ * with potential overlapping of code regions in time, which is common in
+ * resource-limited environments.
+ * @code
+ * #include <jitprofiling.h>
+ *
+ * unsigned int method_id = iJIT_GetNewMethodID();
+ *
+ * iJIT_Method_Load a = {0};
+ * a.method_id = method_id;
+ * a.method_load_address = acode_addr;
+ * a.method_size = acode_size;
+ *
+ * iJIT_Method_Load b = {0};
+ * b.method_id = method_id;
+ * b.method_load_address = baddr_second;
+ * b.method_size = bsize_second;
+ *
+ * iJIT_NotifyEvent(iJVM_EVENT_TYPE_METHOD_LOAD_FINISHED, (void*)&a);
+ * iJIT_NotifyEvent(iJVM_EVENT_TYPE_METHOD_LOAD_FINISHED, (void*)&b);
+ * @endcode
+ *
+ *  * Expected behaviour:
+ *      * If a iJVM_EVENT_TYPE_METHOD_LOAD_FINISHED event overwrites
+ *        already reported method, then such a method becomes invalid and
+ *        its memory region is treated as unloaded.
+ *      * All code regions reported with the same method ID are considered as
+ *        belonging to the same method. Symbolic information (method name,
+ *        source file name) will be taken from the first notification, all
+ *        subsequent notifications with the same method ID will be processed
+ *        only for line number table information. So, the VTune Amplifier will map
+ *        samples to a source line using the line number table from the current
+ *        notification while taking source file name from the very first one.\n
+ *        Clarification of some cases:\n
+ *          * If you register a second code region with a different source file
+ *          name and the same method ID, then this information will be saved and
+ *          will not be considered as an extension of the first code region, but
+ *          VTune Amplifier will use source file of the first code region and map
+ *          performance metrics incorrectly.
+ *          * If you register a second code region with the same source file as
+ *          for the first region and the same method ID, then source file will be
+ *          discarded but VTune Amplifier will map metrics to the source file correctly.
+ *          * If you register a second code region with a null source file and
+ *          the same method ID, then provided line number info will be associated
+ *          with the source file of the first code region.
+ *
+ * **Explore inline functions** including multi-level hierarchy of
+ * nested inlines to see how performance metrics are distributed through them.
+ *
+ * @code
+ * #include <jitprofiling.h>
+ *
+ *  //                                    method_id   parent_id
+ *  //   [-- c --]                          3000        2000
+ *  //                  [---- d -----]      2001        1000
+ *  //  [---- b ----]                       2000        1000
+ *  // [------------ a ----------------]    1000         n/a
+ *
+ * iJIT_Method_Load a = {0};
+ * a.method_id = 1000;
+ *
+ * iJIT_Method_Inline_Load b = {0};
+ * b.method_id = 2000;
+ * b.parent_method_id = 1000;
+ *
+ * iJIT_Method_Inline_Load c = {0};
+ * c.method_id = 3000;
+ * c.parent_method_id = 2000;
+ *
+ * iJIT_Method_Inline_Load d = {0};
+ * d.method_id = 2001;
+ * d.parent_method_id = 1000;
+ *
+ * iJIT_NotifyEvent(iJVM_EVENT_TYPE_METHOD_LOAD_FINISHED, (void*)&a);
+ * iJIT_NotifyEvent(iJVM_EVENT_TYPE_METHOD_INLINE_LOAD_FINISHED, (void*)&b);
+ * iJIT_NotifyEvent(iJVM_EVENT_TYPE_METHOD_INLINE_LOAD_FINISHED, (void*)&c);
+ * iJIT_NotifyEvent(iJVM_EVENT_TYPE_METHOD_INLINE_LOAD_FINISHED, (void*)&d);
+ * @endcode
+ *
+ *  * Requirements:
+ *      * Each inline (iJIT_Method_Inline_Load) method should be associated
+ *        with two method IDs: one for itself, one for its immediate parent.
+ *      * Address regions of inline methods of the same parent method cannot
+ *        overlap each other.
+ *      * Execution of the parent method must not be started until it and all
+ *        its inlines are reported.
+ *  * Expected behaviour:
+ *      * In case of nested inlines an order of
+ *        iJVM_EVENT_TYPE_METHOD_INLINE_LOAD_FINISHED events is not important.
+ *      * If any event overwrites either inline method or top parent method,
+ *        then the parent including inlines becomes invalid and its memory
+ *        region is treated as unloaded.
+ *
+ * **Life time of allocated data**\n
+ * The client sends an event notification to the agent with event-specific
+ * data, which is a structure. The pointers in the structure refers to memory
+ * allocated by the client, which responsible for releasing it. The pointers are
+ * used by the iJIT_NotifyEvent method to copy client's data in a trace file
+ * and they are not used after the iJIT_NotifyEvent method returns.
+ *
+ */
+
+/**
+ * @defgroup jitapi JIT Profiling
+ * @ingroup internal
+ * @{
+ */
+
+/**
+ * @enum iJIT_jvm_event
+ * @brief Enumerator for the types of notifications
+ */
+typedef enum iJIT_jvm_event
+{
+    iJVM_EVENT_TYPE_SHUTDOWN = 2,               /**< Send to shutdown the agent.
+                                                 * Use NULL for event data. */
+
+    iJVM_EVENT_TYPE_METHOD_LOAD_FINISHED = 13,  /**< Send when a dynamic code is
+                                                 * JIT compiled and loaded into
+                                                 * memory by the JIT engine but
+                                                 * before the code is executed.
+                                                 * Use iJIT_Method_Load as event
+                                                 * data. */
+/** @cond exclude_from_documentation */
+    iJVM_EVENT_TYPE_METHOD_UNLOAD_START,    /**< Send when a compiled dynamic
+                                             * code is being unloaded from memory.
+                                             * Use iJIT_Method_Load as event data.*/
+/** @endcond */
+
+//TODO: add a note that line info assumes from method load
+    iJVM_EVENT_TYPE_METHOD_UPDATE,   /**< Send to provide a new content for
+                                      * an early reported dynamic code.
+                                      * The previous content will be invalidate
+                                      * starting from time of the notification.
+                                      * Use iJIT_Method_Load as event data but
+                                      * required fields are following:
+                                      * - method_id    identify the code to update.
+                                      * - method_load_address    specify start address
+                                      *                          within identified code range
+                                      *                          where update should be started.
+                                      * - method_size            specify length of updated code
+                                      *                          range. */
+
+    iJVM_EVENT_TYPE_METHOD_INLINE_LOAD_FINISHED, /**< Send when an inline dynamic
+                                                  * code is JIT compiled and loaded
+                                                  * into memory by the JIT engine
+                                                  * but before the parent code region
+                                                  * is started executing.
+                                                  * Use iJIT_Method_Inline_Load as event data.*/
+
+/** @cond exclude_from_documentation */
+    /* Legacy stuff. Do not use it. */
+    iJVM_EVENT_TYPE_ENTER_NIDS = 19,
+    iJVM_EVENT_TYPE_LEAVE_NIDS,
+/** @endcond */
+
+    iJVM_EVENT_TYPE_METHOD_LOAD_FINISHED_V2  /**< Send when a dynamic code is
+                                              * JIT compiled and loaded into
+                                              * memory by the JIT engine but
+                                              * before the code is executed.
+                                              * Use iJIT_Method_Load_V2 as event
+                                              * data. */
+} iJIT_JVM_EVENT;
+
+/** @cond exclude_from_documentation */
+/* Legacy stuff. Do not use it. */
+typedef enum _iJIT_ModeFlags
+{
+    iJIT_NO_NOTIFICATIONS          = 0x0000,
+    iJIT_BE_NOTIFY_ON_LOAD         = 0x0001,
+    iJIT_BE_NOTIFY_ON_UNLOAD       = 0x0002,
+    iJIT_BE_NOTIFY_ON_METHOD_ENTRY = 0x0004,
+    iJIT_BE_NOTIFY_ON_METHOD_EXIT  = 0x0008
+
+} iJIT_ModeFlags;
+/** @endcond */
+
+/**
+ * @enum _iJIT_IsProfilingActiveFlags
+ * @brief Enumerator for the agent's mode
+ */
+typedef enum _iJIT_IsProfilingActiveFlags
+{
+    iJIT_NOTHING_RUNNING           = 0x0000,    /**< The agent is not running.
+                                                 * iJIT_NotifyEvent calls will
+                                                 * not be processed. */
+    iJIT_SAMPLING_ON               = 0x0001,    /**< The agent is running and
+                                                 * ready to process notifications. */
+
+/** @cond exclude_from_documentation */
+    /* Legacy. Call Graph is running */
+    iJIT_CALLGRAPH_ON              = 0x0002
+/** @endcond */
+
+} iJIT_IsProfilingActiveFlags;
+
+/** @cond exclude_from_documentation */
+/* Legacy stuff. Do not use it. */
+typedef enum _iJDEnvironmentType
+{
+    iJDE_JittingAPI = 2
+
+} iJDEnvironmentType;
+
+typedef struct _iJIT_Method_Id
+{
+    unsigned int method_id;
+
+} *piJIT_Method_Id, iJIT_Method_Id;
+
+typedef struct _iJIT_Method_NIDS
+{
+    unsigned int method_id;     /**< Unique method ID */
+    unsigned int stack_id;      /**< NOTE: no need to fill this field,
+                                 * it's filled by VTune Amplifier */
+    char*  method_name;         /**< Method name (just the method, without the class) */
+
+} *piJIT_Method_NIDS, iJIT_Method_NIDS;
+/** @endcond */
+
+typedef enum _iJIT_CodeType
+{
+    iJIT_CT_UNKNOWN = 0,
+    iJIT_CT_CODE,             // executable code
+    iJIT_CT_DATA,             // this kind of “update” will be excluded from the function’s body.
+    iJIT_CT_EOF
+} iJIT_CodeType;
+
+typedef struct _iJIT_Method_Update
+{
+    unsigned int method_id;
+    void* load_address;
+    unsigned int size;
+    iJIT_CodeType type;
+
+} *piJIT_Method_Update, iJIT_Method_Update;
+
+/**
+ * @details Describes a single entry in the line number information of
+ * a code region that gives information about how the reported code region
+ * is mapped to source file.
+ * Intel(R) VTune(TM) Amplifier uses line number information to attribute
+ * the samples (virtual address) to a line number. \n
+ * It is acceptable to report different code addresses for the same source line:
+ * @code
+ *   Offset LineNumber
+ *      1       2
+ *      12      4
+ *      15      2
+ *      18      1
+ *      21      30
+ *
+ *  VTune(TM) Amplifier XE contsructs the following table using the client data
+ *
+ *   Code subrange  Line number
+ *      0-1             2
+ *      1-12            4
+ *      12-15           2
+ *      15-18           1
+ *      18-21           30
+ * @endcode
+ */
+typedef struct _LineNumberInfo
+{
+    unsigned int Offset;     /**< Offset from the begining of the code region. */
+    unsigned int LineNumber; /**< Matching source line number offset (from beginning of source file). */
+
+} *pLineNumberInfo, LineNumberInfo;
+
+/**
+ *  Description of a JIT-compiled method
+ */
+typedef struct _iJIT_Method_Load
+{
+    unsigned int method_id; /**< Unique method ID.
+                             *  Method ID cannot be smaller than 999.
+                             *  Either you use the API function
+                             *  iJIT_GetNewMethodID to get a valid and unique
+                             *  method ID, or you take care of ID uniqueness
+                             *  and correct range by yourself.\n
+                             *  You must use the same method ID for all code
+                             *  regions of the same method, otherwise different
+                             *  method IDs mean different methods. */
+
+    char* method_name; /** The name of the method. It can be optionally
+                        *  prefixed with its class name and appended with
+                        *  its complete signature. Can't be  NULL. */
+
+    void* method_load_address; /** The start virtual address of the method code
+                                *  region. If NULL that data provided with
+                                *  event are not accepted. */
+
+    unsigned int method_size; /** The code size of the method in memory.
+                               *  If 0, then data provided with the event are not
+                               *  accepted. */
+
+    unsigned int line_number_size; /** The number of entries in the line number
+                                    *  table.0 if none. */
+
+    pLineNumberInfo line_number_table; /** Pointer to the line numbers info
+                                        *  array. Can be NULL if
+                                        *  line_number_size is 0. See
+                                        *  LineNumberInfo Structure for a
+                                        *  description of a single entry in
+                                        *  the line number info array */
+
+    unsigned int class_id; /** This field is obsolete. */
+
+    char* class_file_name; /** Class name. Can be NULL.*/
+
+    char* source_file_name; /** Source file name. Can be NULL.*/
+
+    void* user_data; /** This field is obsolete. */
+
+    unsigned int user_data_size; /** This field is obsolete. */
+
+    iJDEnvironmentType  env; /** This field is obsolete. */
+
+} *piJIT_Method_Load, iJIT_Method_Load;
+
+#pragma pack(push, 8)
+/**
+ *  Description of a JIT-compiled method
+ *
+ *  When you use the iJIT_Method_Load_V2 structure to describe
+ *  the JIT compiled method, use iJVM_EVENT_TYPE_METHOD_LOAD_FINISHED_V2
+ *  as an event type to report it.
+ */
+typedef struct _iJIT_Method_Load_V2
+{
+    unsigned int method_id; /**< Unique method ID.
+                             *  Method ID cannot be smaller than 999.
+                             *  Either you use the API function
+                             *  iJIT_GetNewMethodID to get a valid and unique
+                             *  method ID, or you take care of ID uniqueness
+                             *  and correct range by yourself.\n
+                             *  You must use the same method ID for all code
+                             *  regions of the same method, otherwise different
+                             *  method IDs mean different methods. */
+
+    char* method_name; /** The name of the method. It can be optionally
+                        *  prefixed with its class name and appended with
+                        *  its complete signature. Can't be  NULL. */
+
+    void* method_load_address; /** The start virtual address of the method code
+                                *  region. If NULL that data provided with
+                                *  event are not accepted. */
+
+    unsigned int method_size; /** The code size of the method in memory.
+                               *  If 0, then data provided with the event are not
+                               *  accepted. */
+
+    unsigned int line_number_size; /** The number of entries in the line number
+                                    *  table.0 if none. */
+
+    pLineNumberInfo line_number_table; /** Pointer to the line numbers info
+                                        *  array. Can be NULL if
+                                        *  line_number_size is 0. See
+                                        *  LineNumberInfo Structure for a
+                                        *  description of a single entry in
+                                        *  the line number info array */
+
+    char* class_file_name; /** Class name. Can be NULL.*/
+
+    char* source_file_name; /** Source file name. Can be NULL.*/
+
+    char* module_name; /** Module name. Can be NULL.
+                           The module name can be useful for distinguishing among
+                           different JIT engines. Intel VTune Amplifier will display
+                           reported methods split by specified modules */
+
+} *piJIT_Method_Load_V2, iJIT_Method_Load_V2;
+#pragma pack(pop)
+
+/**
+ * Description of an inline JIT-compiled method
+ */
+typedef struct _iJIT_Method_Inline_Load
+{
+    unsigned int method_id; /**< Unique method ID.
+                             *  Method ID cannot be smaller than 999.
+                             *  Either you use the API function
+                             *  iJIT_GetNewMethodID to get a valid and unique
+                             *  method ID, or you take care of ID uniqueness
+                             *  and correct range by yourself. */
+
+    unsigned int parent_method_id; /** Unique immediate parent's method ID.
+                                    *  Method ID may not be smaller than 999.
+                                    *  Either you use the API function
+                                    *  iJIT_GetNewMethodID to get a valid and unique
+                                    *  method ID, or you take care of ID uniqueness
+                                    *  and correct range by yourself. */
+
+    char* method_name; /** The name of the method. It can be optionally
+                        *  prefixed with its class name and appended with
+                        *  its complete signature. Can't be  NULL. */
+
+    void* method_load_address;  /** The virtual address on which the method
+                                  * is inlined. If NULL, then data provided with
+                                  * the event are not accepted. */
+
+    unsigned int method_size; /** The code size of the method in memory.
+                               *  If 0 that data provided with event are not
+                               *  accepted. */
+
+    unsigned int line_number_size; /** The number of entries in the line number
+                                    *  table. 0 if none. */
+
+    pLineNumberInfo line_number_table; /** Pointer to the line numbers info
+                                        *  array. Can be NULL if
+                                        *  line_number_size is 0. See
+                                        *  LineNumberInfo Structure for a
+                                        *  description of a single entry in
+                                        *  the line number info array */
+
+    char* class_file_name; /** Class name. Can be NULL.*/
+
+    char* source_file_name; /** Source file name. Can be NULL.*/
+
+} *piJIT_Method_Inline_Load, iJIT_Method_Inline_Load;
+
+/** @cond exclude_from_documentation */
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+#ifndef CDECL
+#  if defined WIN32 || defined _WIN32
+#    define CDECL __cdecl
+#  else /* defined WIN32 || defined _WIN32 */
+#    if defined _M_X64 || defined _M_AMD64 || defined __x86_64__
+#      define CDECL /* not actual on x86_64 platform */
+#    else  /* _M_X64 || _M_AMD64 || __x86_64__ */
+#      define CDECL __attribute__ ((cdecl))
+#    endif /* _M_X64 || _M_AMD64 || __x86_64__ */
+#  endif /* defined WIN32 || defined _WIN32 */
+#endif /* CDECL */
+
+#define JITAPI CDECL
+/** @endcond */
+
+/**
+ * @brief Generates a new unique method ID.
+ *
+ * You must use this API to obtain unique and valid method IDs for methods or
+ * traces reported to the agent if you don't have you own mechanism to generate
+ * unique method IDs.
+ *
+ * @return a new unique method ID. When out of unique method IDs, this API
+ * returns 0, which is not an accepted value.
+ */
+unsigned int JITAPI iJIT_GetNewMethodID(void);
+
+/**
+ * @brief Returns the current mode of the agent.
+ *
+ * @return iJIT_SAMPLING_ON, indicating that agent is running, or
+ * iJIT_NOTHING_RUNNING if no agent is running.
+ */
+iJIT_IsProfilingActiveFlags JITAPI iJIT_IsProfilingActive(void);
+
+/**
+ * @brief Reports infomation about JIT-compiled code to the agent.
+ *
+ * The reported information is used to attribute samples obtained from any
+ * Intel(R) VTune(TM) Amplifier collector. This API needs to be called
+ * after JIT compilation and before the first entry into the JIT compiled
+ * code.
+ *
+ * @param[in] event_type - type of the data sent to the agent
+ * @param[in] EventSpecificData - pointer to event-specific data
+ * 
+ * @returns 1 on success, otherwise 0.
+ */
+int JITAPI iJIT_NotifyEvent(iJIT_JVM_EVENT event_type, void *EventSpecificData);
+
+/** @cond exclude_from_documentation */
+/*
+ * Do not use these legacy APIs, which are here for backward compatibility
+ * with Intel(R) VTune(TM) Performance Analyzer.
+ */
+typedef void (*iJIT_ModeChangedEx)(void *UserData, iJIT_ModeFlags Flags);
+void JITAPI iJIT_RegisterCallbackEx(void *userdata,
+                                    iJIT_ModeChangedEx NewModeCallBackFuncEx);
+void JITAPI FinalizeThread(void);
+void JITAPI FinalizeProcess(void);
+
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+/** @endcond */
+
+/** @} jitapi group */
+
+#endif /* __JITPROFILING_H__ */
diff --git a/js/xpconnect/idl/nsIJSRuntimeService.idl b/js/xpconnect/idl/nsIJSRuntimeService.idl
index 570e4877ad42..bc841ae857cd 100644
--- a/js/xpconnect/idl/nsIJSRuntimeService.idl
+++ b/js/xpconnect/idl/nsIJSRuntimeService.idl
@@ -7,18 +7,23 @@
 #include "nsISupports.idl"
 
 [ptr] native JSRuntime(JSRuntime);
+[ptr] native JSContext(JSContext);
 native xpcGCCallback(xpcGCCallback);
+native xpcContextCallback(xpcContextCallback);
 
 %{C++
 
 typedef void
 (* xpcGCCallback)(JSGCStatus status);
 
+typedef bool
+(* xpcContextCallback)(JSContext* cx, unsigned operation);
+
 %}
 
 interface nsIBackstagePass;
 
-[uuid(996ef894-88cd-42c8-ac2d-28c60970daaf)]
+[uuid( 2ac111f2-e492-488e-85df-353c453e98f3)]
 interface nsIJSRuntimeService : nsISupports
 {
     readonly attribute JSRuntime        runtime;
@@ -29,4 +34,11 @@ interface nsIJSRuntimeService : nsISupports
      */
     [noscript, notxpcom] void registerGCCallback(in xpcGCCallback func);
     [noscript, notxpcom] void unregisterGCCallback(in xpcGCCallback func);
+
+    /**
+     * Register additional context callback which will run after the
+     * standard XPConnect callback.
+     */
+    [noscript, notxpcom] void registerContextCallback(in xpcContextCallback func);
+    [noscript, notxpcom] void unregisterContextCallback(in xpcContextCallback func);
 };
diff --git a/js/xpconnect/shell/xpcshell.cpp b/js/xpconnect/shell/xpcshell.cpp
index 04aee97e0ae1..8e35c34dabb1 100644
--- a/js/xpconnect/shell/xpcshell.cpp
+++ b/js/xpconnect/shell/xpcshell.cpp
@@ -1450,9 +1450,6 @@ nsXPCFunctionThisTranslator::TranslateThis(nsISupports *aInitialThis,
 
 #endif
 
-// ContextCallback calls are chained
-static JSContextCallback gOldJSContextCallback;
-
 void
 XPCShellErrorReporter(JSContext *cx, const char *message, JSErrorReport *rep)
 {
@@ -1466,12 +1463,9 @@ XPCShellErrorReporter(JSContext *cx, const char *message, JSErrorReport *rep)
     xpc::SystemErrorReporterExternal(cx, message, rep);
 }
 
-static JSBool
+static bool
 ContextCallback(JSContext *cx, unsigned contextOp)
 {
-    if (gOldJSContextCallback && !gOldJSContextCallback(cx, contextOp))
-        return false;
-
     if (contextOp == JSCONTEXT_NEW) {
         JS_SetErrorReporter(cx, XPCShellErrorReporter);
         JS_SetOperationCallback(cx, XPCShellOperationCallback);
@@ -1646,7 +1640,7 @@ main(int argc, char **argv, char **envp)
             return 1;
         }
 
-        gOldJSContextCallback = JS_SetContextCallback(rt, ContextCallback);
+        rtsvc->RegisterContextCallback(ContextCallback);
 
         cx = JS_NewContext(rt, 8192);
         if (!cx) {
diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
index 20ab3e48ed47..0ff2ba64a76c 100644
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -201,22 +201,64 @@ DetachedWrappedNativeProtoMarker(PLDHashTable *table, PLDHashEntryHdr *hdr,
     return PL_DHASH_NEXT;
 }
 
-// GCCallback calls are chained
-static JSBool
-ContextCallback(JSContext *cx, unsigned operation)
+bool
+XPCJSRuntime::CustomContextCallback(JSContext *cx, unsigned operation)
 {
-    XPCJSRuntime* self = nsXPConnect::GetRuntimeInstance();
-    if (self) {
-        if (operation == JSCONTEXT_NEW) {
-            if (!self->OnJSContextNew(cx))
-                return false;
-        } else if (operation == JSCONTEXT_DESTROY) {
-            delete XPCContext::GetXPCContext(cx);
+    if (operation == JSCONTEXT_NEW) {
+        if (!OnJSContextNew(cx)) {
+            return false;
+        }
+    } else if (operation == JSCONTEXT_DESTROY) {
+        delete XPCContext::GetXPCContext(cx);
+    }
+
+    nsTArray<xpcContextCallback> callbacks(extraContextCallbacks);
+    for (uint32_t i = 0; i < callbacks.Length(); ++i) {
+        if (!callbacks[i](cx, operation)) {
+            return false;
         }
     }
+
     return true;
 }
 
+class AsyncFreeSnowWhite : public nsRunnable
+{
+public:
+  NS_IMETHOD Run()
+  {
+      TimeStamp start = TimeStamp::Now();
+      bool hadSnowWhiteObjects = nsCycleCollector_doDeferredDeletion();
+      Telemetry::Accumulate(Telemetry::CYCLE_COLLECTOR_ASYNC_SNOW_WHITE_FREEING,
+                            uint32_t((TimeStamp::Now() - start).ToMilliseconds()));
+      if (hadSnowWhiteObjects && !mContinuation) {
+          mContinuation = true;
+          if (NS_FAILED(NS_DispatchToCurrentThread(this))) {
+              mActive = false;
+          }
+      } else {
+          mActive = false;
+      }
+      return NS_OK;
+  }
+
+  void Dispatch(bool aContinuation = false)
+  {
+      if (mContinuation) {
+          mContinuation = aContinuation;
+      }
+      if (!mActive && NS_SUCCEEDED(NS_DispatchToCurrentThread(this))) {
+          mActive = true;
+      }
+  }
+
+  AsyncFreeSnowWhite() : mContinuation(false), mActive(false) {}
+
+public:
+  bool mContinuation;
+  bool mActive;
+};
+
 namespace xpc {
 
 CompartmentPrivate::~CompartmentPrivate()
@@ -561,6 +603,12 @@ XPCJSRuntime::PrepareForCollection()
     }
 }
 
+void
+XPCJSRuntime::DispatchDeferredDeletion(bool aContinuation)
+{
+    mAsyncSnowWhiteFreer->Dispatch(aContinuation);
+}
+
 void
 xpc_UnmarkSkippableJSHolders()
 {
@@ -605,24 +653,6 @@ XPCJSRuntime::GCSliceCallback(JSRuntime *rt,
 void
 XPCJSRuntime::CustomGCCallback(JSGCStatus status)
 {
-    switch (status) {
-        case JSGC_BEGIN:
-        {
-            // We seem to sometime lose the unrooted global flag. Restore it
-            // here. FIXME: bug 584495.
-            JSContext *iter = nullptr;
-            while (JSContext *acx = JS_ContextIterator(Runtime(), &iter)) {
-                if (!js::HasUnrootedGlobal(acx))
-                    JS_ToggleOptions(acx, JSOPTION_UNROOTED_GLOBAL);
-            }
-            break;
-        }
-        case JSGC_END:
-        {
-            break;
-        }
-    }
-
     nsTArray<xpcGCCallback> callbacks(extraGCCallbacks);
     for (uint32_t i = 0; i < callbacks.Length(); ++i)
         callbacks[i](status);
@@ -2711,6 +2741,7 @@ XPCJSRuntime::XPCJSRuntime(nsXPConnect* aXPConnect)
    mObjectHolderRoots(nullptr),
    mWatchdogManager(new WatchdogManager(this)),
    mJunkScope(nullptr),
+   mAsyncSnowWhiteFreer(new AsyncFreeSnowWhite()),
    mExceptionManagerNotAvailable(false)
 {
 #ifdef XPC_CHECK_WRAPPERS_AT_SHUTDOWN
@@ -2748,7 +2779,6 @@ XPCJSRuntime::XPCJSRuntime(nsXPConnect* aXPConnect)
 #else
     JS_SetNativeStackQuota(runtime, 128 * sizeof(size_t) * 1024);
 #endif
-    JS_SetContextCallback(runtime, ContextCallback);
     JS_SetDestroyCompartmentCallback(runtime, CompartmentDestroyedCallback);
     JS_SetCompartmentNameCallback(runtime, CompartmentNameCallback);
     mPrevGCSliceCallback = JS::SetGCSliceCallback(runtime, GCSliceCallback);
@@ -2869,9 +2899,6 @@ XPCJSRuntime::OnJSContextNew(JSContext *cx)
     if (!xpc)
         return false;
 
-    // we want to mark the global object ourselves since we use a different color
-    JS_ToggleOptions(cx, JSOPTION_UNROOTED_GLOBAL);
-
     return true;
 }
 
@@ -3064,6 +3091,23 @@ XPCJSRuntime::RemoveGCCallback(xpcGCCallback cb)
     }
 }
 
+void
+XPCJSRuntime::AddContextCallback(xpcContextCallback cb)
+{
+    NS_ASSERTION(cb, "null callback");
+    extraContextCallbacks.AppendElement(cb);
+}
+
+void
+XPCJSRuntime::RemoveContextCallback(xpcContextCallback cb)
+{
+    NS_ASSERTION(cb, "null callback");
+    bool found = extraContextCallbacks.RemoveElement(cb);
+    if (!found) {
+        NS_ERROR("Removing a callback which was never added.");
+    }
+}
+
 JSObject *
 XPCJSRuntime::GetJunkScope()
 {
diff --git a/js/xpconnect/src/nsScriptError.cpp b/js/xpconnect/src/nsScriptError.cpp
index 96e2a5d3ddfb..732febbabde8 100644
--- a/js/xpconnect/src/nsScriptError.cpp
+++ b/js/xpconnect/src/nsScriptError.cpp
@@ -102,9 +102,11 @@ nsScriptError::Init(const nsAString& message,
                     uint32_t flags,
                     const char *category)
 {
-    nsDependentCString c(category);
     return InitWithWindowID(message, sourceName, sourceLine, lineNumber,
-                            columnNumber, flags, c, 0);
+                            columnNumber, flags,
+                            category ? nsDependentCString(category)
+                                     : EmptyCString(),
+                            0);
 }
 
 NS_IMETHODIMP
diff --git a/js/xpconnect/src/nsXPConnect.cpp b/js/xpconnect/src/nsXPConnect.cpp
index 33607e7c0aa8..a5bd73854206 100644
--- a/js/xpconnect/src/nsXPConnect.cpp
+++ b/js/xpconnect/src/nsXPConnect.cpp
@@ -1242,6 +1242,20 @@ nsXPConnect::UnregisterGCCallback(xpcGCCallback func)
     mRuntime->RemoveGCCallback(func);
 }
 
+/* [noscript, notxpcom] void registerContextCallback(in xpcContextCallback func); */
+NS_IMETHODIMP_(void)
+nsXPConnect::RegisterContextCallback(xpcContextCallback func)
+{
+    mRuntime->AddContextCallback(func);
+}
+
+/* [noscript, notxpcom] void unregisterContextCallback(in xpcContextCallback func); */
+NS_IMETHODIMP_(void)
+nsXPConnect::UnregisterContextCallback(xpcContextCallback func)
+{
+    mRuntime->RemoveContextCallback(func);
+}
+
 #ifdef MOZ_JSDEBUGGER
 void
 nsXPConnect::CheckForDebugMode(JSRuntime *rt)
@@ -1445,14 +1459,6 @@ Base64Decode(JSContext *cx, JS::Value val, JS::Value *out)
     return true;
 }
 
-void
-DumpJSHeap(FILE* file)
-{
-    NS_ABORT_IF_FALSE(NS_IsMainThread(), "Must dump GC heap on main thread.");
-    nsXPConnect* xpc = nsXPConnect::XPConnect();
-    js::DumpHeapComplete(xpc->GetRuntime()->Runtime(), file);
-}
-
 void
 SetLocationForGlobal(JSObject *global, const nsACString& location)
 {
diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h
index aa6515bae196..587cf30d2fb8 100644
--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -607,6 +607,8 @@ enum WatchdogTimestampCategory
     TimestampCount
 };
 
+class AsyncFreeSnowWhite;
+
 class XPCJSRuntime : public mozilla::CycleCollectedJSRuntime
 {
 public:
@@ -668,10 +670,10 @@ public:
 
     virtual bool
     DescribeCustomObjects(JSObject* aObject, js::Class* aClasp,
-                          char (&aName)[72]) const;
+                          char (&aName)[72]) const MOZ_OVERRIDE;
     virtual bool
     NoteCustomGCThingXPCOMChildren(js::Class* aClasp, JSObject* aObj,
-                                   nsCycleCollectionTraversalCallback& aCb) const;
+                                   nsCycleCollectionTraversalCallback& aCb) const MOZ_OVERRIDE;
 
     /**
      * Infrastructure for classes that need to defer part of the finalization
@@ -723,14 +725,16 @@ public:
         return mStrings[index];
     }
 
-    void TraceNativeBlackRoots(JSTracer* trc);
-    void TraceAdditionalNativeGrayRoots(JSTracer* aTracer);
-    void TraverseAdditionalNativeRoots(nsCycleCollectionNoteRootCallback& cb);
+    void TraceNativeBlackRoots(JSTracer* trc) MOZ_OVERRIDE;
+    void TraceAdditionalNativeGrayRoots(JSTracer* aTracer) MOZ_OVERRIDE;
+    void TraverseAdditionalNativeRoots(nsCycleCollectionNoteRootCallback& cb) MOZ_OVERRIDE;
     void UnmarkSkippableJSHolders();
     void PrepareForForgetSkippable() MOZ_OVERRIDE;
     void PrepareForCollection() MOZ_OVERRIDE;
+    void DispatchDeferredDeletion(bool continuation) MOZ_OVERRIDE;
 
     void CustomGCCallback(JSGCStatus status) MOZ_OVERRIDE;
+    bool CustomContextCallback(JSContext *cx, unsigned operation) MOZ_OVERRIDE;
     static void GCSliceCallback(JSRuntime *rt,
                                 JS::GCProgress progress,
                                 const JS::GCDescription &desc);
@@ -817,6 +821,8 @@ public:
 
     void AddGCCallback(xpcGCCallback cb);
     void RemoveGCCallback(xpcGCCallback cb);
+    void AddContextCallback(xpcContextCallback cb);
+    void RemoveContextCallback(xpcContextCallback cb);
 
     static void ActivityCallback(void *arg, JSBool active);
     static void CTypesActivityCallback(JSContext *cx,
@@ -864,9 +870,11 @@ private:
     XPCRootSetElem *mWrappedJSRoots;
     XPCRootSetElem *mObjectHolderRoots;
     nsTArray<xpcGCCallback> extraGCCallbacks;
+    nsTArray<xpcContextCallback> extraContextCallbacks;
     nsRefPtr<WatchdogManager> mWatchdogManager;
     JS::GCSliceCallback mPrevGCSliceCallback;
     JSObject* mJunkScope;
+    nsRefPtr<AsyncFreeSnowWhite> mAsyncSnowWhiteFreer;
 
     nsCOMPtr<nsIException>   mPendingException;
     nsCOMPtr<nsIExceptionManager> mExceptionManager;
diff --git a/js/xpconnect/src/xpcpublic.h b/js/xpconnect/src/xpcpublic.h
index b07c6b108da1..dedaded837b0 100644
--- a/js/xpconnect/src/xpcpublic.h
+++ b/js/xpconnect/src/xpcpublic.h
@@ -321,8 +321,6 @@ nsIPrincipal *GetObjectPrincipal(JSObject *obj);
 
 bool IsXBLScope(JSCompartment *compartment);
 
-void DumpJSHeap(FILE* file);
-
 void SetLocationForGlobal(JSObject *global, const nsACString& location);
 void SetLocationForGlobal(JSObject *global, nsIURI *locationURI);
 
diff --git a/layout/base/PositionedEventTargeting.cpp b/layout/base/PositionedEventTargeting.cpp
index 31ba1fefc35d..7ffcb9a108c5 100644
--- a/layout/base/PositionedEventTargeting.cpp
+++ b/layout/base/PositionedEventTargeting.cpp
@@ -207,6 +207,7 @@ ComputeDistanceFromRect(const nsPoint& aPoint, const nsRect& aRect)
 static float
 ComputeDistanceFromRegion(const nsPoint& aPoint, const nsRegion& aRegion)
 {
+  MOZ_ASSERT(!aRegion.IsEmpty(), "can't compute distance between point and empty region");
   nsRegionRectIterator iter(aRegion);
   const nsRect* r;
   float minDist = -1;
@@ -254,6 +255,11 @@ GetClosest(nsIFrame* aRoot, const nsPoint& aPointRelativeToRootFrame,
         nsRect(nsPoint(0, 0), f->GetSize()), aRoot, &preservesAxisAlignedRectangles);
     nsRegion region;
     region.And(exposedRegion, borderBox);
+
+    if (region.IsEmpty()) {
+      continue;
+    }
+
     if (preservesAxisAlignedRectangles) {
       // Subtract from the exposed region if we have a transform that won't make
       // the bounds include a bunch of area that we don't actually cover.
diff --git a/layout/base/RestyleManager.cpp b/layout/base/RestyleManager.cpp
index 85b9999f5f6f..e8c65db8c800 100644
--- a/layout/base/RestyleManager.cpp
+++ b/layout/base/RestyleManager.cpp
@@ -2266,9 +2266,7 @@ ElementRestyler::RestyleSelf(nsRestyleHint aRestyleHint)
     }
   }
 
-  if (!newContext) {
-    NS_RUNTIMEABORT("couldn't allocate new style context");
-  }
+  MOZ_ASSERT(newContext);
 
   if (!parentContext) {
     if (oldContext->RuleNode() == newContext->RuleNode() &&
@@ -2326,12 +2324,13 @@ ElementRestyler::RestyleSelf(nsRestyleHint aRestyleHint)
                                                             extraPseudoType,
                                                             newContext);
     }
-    if (newExtraContext) {
-      if (oldExtraContext != newExtraContext) {
-        CaptureChange(oldExtraContext, newExtraContext, assumeDifferenceHint);
-        if (!(mHintsHandled & nsChangeHint_ReconstructFrame)) {
-          mFrame->SetAdditionalStyleContext(contextIndex, newExtraContext);
-        }
+
+    MOZ_ASSERT(newExtraContext);
+
+    if (oldExtraContext != newExtraContext) {
+      CaptureChange(oldExtraContext, newExtraContext, assumeDifferenceHint);
+      if (!(mHintsHandled & nsChangeHint_ReconstructFrame)) {
+        mFrame->SetAdditionalStyleContext(contextIndex, newExtraContext);
       }
     }
   }
@@ -2448,19 +2447,17 @@ ElementRestyler::RestyleUndisplayedChildren(nsRestyleHint aChildRestyleHint)
                                          mFrame->StyleContext(),
                                          undisplayed->mContent->AsElement());
       }
-      if (undisplayedContext) {
-        const nsStyleDisplay* display = undisplayedContext->StyleDisplay();
-        if (display->mDisplay != NS_STYLE_DISPLAY_NONE) {
-          NS_ASSERTION(undisplayed->mContent,
-                       "Must have undisplayed content");
-          mChangeList->AppendChange(nullptr, undisplayed->mContent,
-                                    NS_STYLE_HINT_FRAMECHANGE);
-          // The node should be removed from the undisplayed map when
-          // we reframe it.
-        } else {
-          // update the undisplayed node with the new context
-          undisplayed->mStyle = undisplayedContext;
-        }
+      const nsStyleDisplay* display = undisplayedContext->StyleDisplay();
+      if (display->mDisplay != NS_STYLE_DISPLAY_NONE) {
+        NS_ASSERTION(undisplayed->mContent,
+                     "Must have undisplayed content");
+        mChangeList->AppendChange(nullptr, undisplayed->mContent,
+                                  NS_STYLE_HINT_FRAMECHANGE);
+        // The node should be removed from the undisplayed map when
+        // we reframe it.
+      } else {
+        // update the undisplayed node with the new context
+        undisplayed->mStyle = undisplayedContext;
       }
     }
   }
diff --git a/layout/base/Units.h b/layout/base/Units.h
index cae5ce4ada77..5aaaed8bd38a 100644
--- a/layout/base/Units.h
+++ b/layout/base/Units.h
@@ -106,20 +106,20 @@ struct CSSPixel {
   // Conversions to app units
 
   static nsPoint ToAppUnits(const CSSPoint& aPoint) {
-    return nsPoint(NSFloatPixelsToAppUnits(aPoint.x, float(nsDeviceContext::AppUnitsPerCSSPixel())),
-                   NSFloatPixelsToAppUnits(aPoint.y, float(nsDeviceContext::AppUnitsPerCSSPixel())));
+    return nsPoint(NSToCoordRoundWithClamp(aPoint.x * float(nsDeviceContext::AppUnitsPerCSSPixel())),
+                   NSToCoordRoundWithClamp(aPoint.y * float(nsDeviceContext::AppUnitsPerCSSPixel())));
   }
 
   static nsPoint ToAppUnits(const CSSIntPoint& aPoint) {
-    return nsPoint(NSIntPixelsToAppUnits(aPoint.x, nsDeviceContext::AppUnitsPerCSSPixel()),
-                   NSIntPixelsToAppUnits(aPoint.y, nsDeviceContext::AppUnitsPerCSSPixel()));
+    return nsPoint(NSToCoordRoundWithClamp(float(aPoint.x) * float(nsDeviceContext::AppUnitsPerCSSPixel())),
+                   NSToCoordRoundWithClamp(float(aPoint.y) * float(nsDeviceContext::AppUnitsPerCSSPixel())));
   }
 
   static nsRect ToAppUnits(const CSSRect& aRect) {
-    return nsRect(NSFloatPixelsToAppUnits(aRect.x, float(nsDeviceContext::AppUnitsPerCSSPixel())),
-                  NSFloatPixelsToAppUnits(aRect.y, float(nsDeviceContext::AppUnitsPerCSSPixel())),
-                  NSFloatPixelsToAppUnits(aRect.width, float(nsDeviceContext::AppUnitsPerCSSPixel())),
-                  NSFloatPixelsToAppUnits(aRect.height, float(nsDeviceContext::AppUnitsPerCSSPixel())));
+    return nsRect(NSToCoordRoundWithClamp(aRect.x * float(nsDeviceContext::AppUnitsPerCSSPixel())),
+                  NSToCoordRoundWithClamp(aRect.y * float(nsDeviceContext::AppUnitsPerCSSPixel())),
+                  NSToCoordRoundWithClamp(aRect.width * float(nsDeviceContext::AppUnitsPerCSSPixel())),
+                  NSToCoordRoundWithClamp(aRect.height * float(nsDeviceContext::AppUnitsPerCSSPixel())));
   }
 };
 
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index 0b1eb3eca84a..a4127d9c9f92 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -2194,9 +2194,6 @@ nsCSSFrameConstructor::PropagateScrollToViewport()
   nsStyleSet *styleSet = mPresShell->StyleSet();
   nsRefPtr<nsStyleContext> rootStyle;
   rootStyle = styleSet->ResolveStyleFor(docElement, nullptr);
-  if (!rootStyle) {
-    return nullptr;
-  }
   if (CheckOverflow(presContext, rootStyle->StyleDisplay())) {
     // tell caller we stole the overflow style from the root element
     return docElement;
@@ -2225,9 +2222,6 @@ nsCSSFrameConstructor::PropagateScrollToViewport()
 
   nsRefPtr<nsStyleContext> bodyStyle;
   bodyStyle = styleSet->ResolveStyleFor(bodyElement->AsElement(), rootStyle);
-  if (!bodyStyle) {
-    return nullptr;
-  }
 
   if (CheckOverflow(presContext, bodyStyle->StyleDisplay())) {
     // tell caller we stole the overflow style from the body element
@@ -5835,7 +5829,6 @@ nsCSSFrameConstructor::IsValidSibling(nsIFrame*              aSibling,
       // XXXbz when this code is killed, the state argument to
       // ResolveStyleContext can be made non-optional.
       styleContext = ResolveStyleContext(styleParent, aContent, nullptr);
-      if (!styleContext) return false;
       const nsStyleDisplay* display = styleContext->StyleDisplay();
       aDisplay = display->mDisplay;
     }
@@ -9606,9 +9599,7 @@ nsCSSFrameConstructor::CreateFloatingLetterFrame(
     if (parentStyleContext) {
       nsRefPtr<nsStyleContext> newSC;
       newSC = styleSet->ResolveStyleForNonElement(parentStyleContext);
-      if (newSC) {
-        nextTextFrame->SetStyleContext(newSC);
-      }
+      nextTextFrame->SetStyleContext(newSC);
     }
   }
 
@@ -9856,9 +9847,6 @@ nsCSSFrameConstructor::RemoveFloatingFirstLetterFrames(
   }
   nsRefPtr<nsStyleContext> newSC;
   newSC = aPresShell->StyleSet()->ResolveStyleForNonElement(parentSC);
-  if (!newSC) {
-    return NS_OK;
-  }
   nsIFrame* newTextFrame = NS_NewTextFrame(aPresShell, newSC);
   newTextFrame->Init(textContent, parentFrame, nullptr);
 
@@ -9927,9 +9915,6 @@ nsCSSFrameConstructor::RemoveFirstLetterFrames(nsPresContext* aPresContext,
       }
       nsRefPtr<nsStyleContext> newSC;
       newSC = aPresShell->StyleSet()->ResolveStyleForNonElement(parentSC);
-      if (!newSC) {
-        break;
-      }
       textFrame = NS_NewTextFrame(aPresShell, newSC);
       textFrame->Init(textContent, aFrame, nullptr);
 
diff --git a/layout/base/nsPresContext.h b/layout/base/nsPresContext.h
index 979776472d8d..be8728cc5968 100644
--- a/layout/base/nsPresContext.h
+++ b/layout/base/nsPresContext.h
@@ -580,11 +580,11 @@ public:
   static int32_t AppUnitsPerCSSInch() { return nsDeviceContext::AppUnitsPerCSSInch(); }
 
   static nscoord CSSPixelsToAppUnits(int32_t aPixels)
-  { return NSIntPixelsToAppUnits(aPixels,
-                                 nsDeviceContext::AppUnitsPerCSSPixel()); }
+  { return NSToCoordRoundWithClamp(float(aPixels) *
+             float(nsDeviceContext::AppUnitsPerCSSPixel())); }
 
   static nscoord CSSPixelsToAppUnits(float aPixels)
-  { return NSFloatPixelsToAppUnits(aPixels,
+  { return NSToCoordRoundWithClamp(aPixels *
              float(nsDeviceContext::AppUnitsPerCSSPixel())); }
 
   static int32_t AppUnitsToIntCSSPixels(nscoord aAppUnits)
diff --git a/layout/base/nsRefreshDriver.cpp b/layout/base/nsRefreshDriver.cpp
index c61096d81d7c..2c0555381c85 100644
--- a/layout/base/nsRefreshDriver.cpp
+++ b/layout/base/nsRefreshDriver.cpp
@@ -654,11 +654,16 @@ nsRefreshDriver::DefaultInterval()
 // Compute the interval to use for the refresh driver timer, in milliseconds.
 // outIsDefault indicates that rate was not explicitly set by the user
 // so we might choose other, more appropriate rates (e.g. vsync, etc)
+// layout.frame_rate=0 indicates "ASAP mode".
+// In ASAP mode rendering is iterated as fast as possible (typically for stress testing).
+// A target rate of 10k is used internally instead of special-handling 0.
+// Backends which block on swap/present/etc should try to not block
+// when layout.frame_rate=0 - to comply with "ASAP" as much as possible.
 double
 nsRefreshDriver::GetRegularTimerInterval(bool *outIsDefault) const
 {
   int32_t rate = Preferences::GetInt("layout.frame_rate", -1);
-  if (rate <= 0) {
+  if (rate < 0) {
     rate = DEFAULT_FRAME_RATE;
     if (outIsDefault) {
       *outIsDefault = true;
@@ -668,6 +673,11 @@ nsRefreshDriver::GetRegularTimerInterval(bool *outIsDefault) const
       *outIsDefault = false;
     }
   }
+
+  if (rate == 0) {
+    rate = 10000;
+  }
+
   return 1000.0 / rate;
 }
 
diff --git a/layout/base/tests/test_event_target_radius.html b/layout/base/tests/test_event_target_radius.html
index 037a79680d36..54a43a1e317f 100644
--- a/layout/base/tests/test_event_target_radius.html
+++ b/layout/base/tests/test_event_target_radius.html
@@ -39,6 +39,10 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=780847
   <div class="target" id="t6" onmousedown="x=1" hidden>
     <div id="t6_inner" style="position:absolute; left:-20px; top:20px; width:60px; height:60px; background:yellow;"></div>
   </div>
+
+  <div class="target" id="t7" onmousedown="x=1" hidden></div>
+  <div class="target" id="t7_over" hidden></div>
+
 </div>
 <pre id="test">
 <script type="application/javascript">
@@ -180,6 +184,13 @@ function runTest() {
     "clicking in clickable parent close to inner activates parent, not inner");
   setShowing("t6", false);
 
+  setShowing("t7", true);
+  setShowing("t7_over", true);
+  testMouseClick("t7", 100 + 11*mm, 10, "body", "covered div is not clickable");
+  testMouseClick("t7", 10, 10, "t7_over", "covered div is not clickable even within its bounds");
+  setShowing("t7", false);
+  setShowing("t7_over", false);
+
   // Not yet tested:
   // -- visited link weight
   // -- "Closest" using Euclidean distance
diff --git a/layout/forms/nsComboboxControlFrame.cpp b/layout/forms/nsComboboxControlFrame.cpp
index 5d65b8469d01..0f9d751938a3 100644
--- a/layout/forms/nsComboboxControlFrame.cpp
+++ b/layout/forms/nsComboboxControlFrame.cpp
@@ -1326,29 +1326,16 @@ nsComboboxControlFrame::CreateFrameFor(nsIContent*      aContent)
   styleContext = styleSet->
     ResolveAnonymousBoxStyle(nsCSSAnonBoxes::mozDisplayComboboxControlFrame,
                              mStyleContext);
-  if (MOZ_UNLIKELY(!styleContext)) {
-    return nullptr;
-  }
 
   nsRefPtr<nsStyleContext> textStyleContext;
   textStyleContext = styleSet->ResolveStyleForNonElement(mStyleContext);
-  if (MOZ_UNLIKELY(!textStyleContext)) {
-    return nullptr;
-  }
 
-  // Start by by creating our anonymous block frame
+  // Start by creating our anonymous block frame
   mDisplayFrame = new (shell) nsComboboxDisplayFrame(styleContext, this);
-  if (MOZ_UNLIKELY(!mDisplayFrame)) {
-    return nullptr;
-  }
-
   mDisplayFrame->Init(mContent, this, nullptr);
 
   // Create a text frame and put it inside the block frame
   nsIFrame* textFrame = NS_NewTextFrame(shell, textStyleContext);
-  if (MOZ_UNLIKELY(!textFrame)) {
-    return nullptr;
-  }
 
   // initialize the text frame
   textFrame->Init(aContent, mDisplayFrame, nullptr);
diff --git a/layout/forms/nsGfxButtonControlFrame.cpp b/layout/forms/nsGfxButtonControlFrame.cpp
index 63264874fa2c..4ecc0d7c928f 100644
--- a/layout/forms/nsGfxButtonControlFrame.cpp
+++ b/layout/forms/nsGfxButtonControlFrame.cpp
@@ -99,14 +99,10 @@ nsGfxButtonControlFrame::CreateFrameFor(nsIContent*      aContent)
     textStyleContext = presContext->StyleSet()->
       ResolveStyleForNonElement(mStyleContext);
 
-    if (textStyleContext) {
-      newFrame = NS_NewTextFrame(presContext->PresShell(), textStyleContext);
-      if (newFrame) {
-        // initialize the text frame
-        newFrame->Init(mTextContent, parentFrame, nullptr);
-        mTextContent->SetPrimaryFrame(newFrame);
-      }
-    }
+    newFrame = NS_NewTextFrame(presContext->PresShell(), textStyleContext);
+    // initialize the text frame
+    newFrame->Init(mTextContent, parentFrame, nullptr);
+    mTextContent->SetPrimaryFrame(newFrame);
   }
 
   return newFrame;
diff --git a/layout/forms/nsListControlFrame.cpp b/layout/forms/nsListControlFrame.cpp
index 11cc3aed47f8..806fb5a4849f 100644
--- a/layout/forms/nsListControlFrame.cpp
+++ b/layout/forms/nsListControlFrame.cpp
@@ -93,9 +93,7 @@ NS_NewListControlFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
   nsListControlFrame* it =
     new (aPresShell) nsListControlFrame(aPresShell, aPresShell->GetDocument(), aContext);
 
-  if (it) {
-    it->AddStateBits(NS_FRAME_INDEPENDENT_SELECTION);
-  }
+  it->AddStateBits(NS_FRAME_INDEPENDENT_SELECTION);
 
   return it;
 }
diff --git a/layout/forms/nsSelectsAreaFrame.cpp b/layout/forms/nsSelectsAreaFrame.cpp
index 9c0f8f873330..851364401de7 100644
--- a/layout/forms/nsSelectsAreaFrame.cpp
+++ b/layout/forms/nsSelectsAreaFrame.cpp
@@ -14,11 +14,9 @@ NS_NewSelectsAreaFrame(nsIPresShell* aShell, nsStyleContext* aContext, uint32_t
 {
   nsSelectsAreaFrame* it = new (aShell) nsSelectsAreaFrame(aContext);
 
-  if (it) {
-    // We need NS_BLOCK_FLOAT_MGR to ensure that the options inside the select
-    // aren't expanded by right floats outside the select.
-    it->SetFlags(aFlags | NS_BLOCK_FLOAT_MGR);
-  }
+  // We need NS_BLOCK_FLOAT_MGR to ensure that the options inside the select
+  // aren't expanded by right floats outside the select.
+  it->SetFlags(aFlags | NS_BLOCK_FLOAT_MGR);
 
   return it;
 }
diff --git a/layout/generic/crashtests/893523.html b/layout/generic/crashtests/893523.html
new file mode 100644
index 000000000000..af4bee2a1891
--- /dev/null
+++ b/layout/generic/crashtests/893523.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html style="direction: rtl; border-top: solid; margin-left: -1px;">
+<head>
+<meta charset="UTF-8">
+</head>
+<body onload="window.scroll(-0x20000000, 0);"></body>
+</html>
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index ee9f19283811..53423e628382 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -498,3 +498,4 @@ needs-focus pref(accessibility.browsewithcaret,true) load 868906.html
 test-pref(layout.css.flexbox.enabled,true) load 866547-1.html
 asserts(1-4) test-pref(layout.css.flexbox.enabled,true) load 876074-1.html # bug 876749
 load 885009-1.html
+load 893523.html
diff --git a/layout/generic/nsFirstLetterFrame.cpp b/layout/generic/nsFirstLetterFrame.cpp
index 3681279b3235..3740eab87654 100644
--- a/layout/generic/nsFirstLetterFrame.cpp
+++ b/layout/generic/nsFirstLetterFrame.cpp
@@ -70,8 +70,7 @@ nsFirstLetterFrame::Init(nsIContent*      aContent,
     if (parentStyleContext) {
       newSC = PresContext()->StyleSet()->
         ResolveStyleForNonElement(parentStyleContext);
-      if (newSC)
-        SetStyleContextWithoutNotification(newSC);
+      SetStyleContextWithoutNotification(newSC);
     }
   }
 
@@ -328,9 +327,7 @@ nsFirstLetterFrame::CreateContinuationForFloatingParent(nsPresContext* aPresCont
   if (parentSC) {
     nsRefPtr<nsStyleContext> newSC;
     newSC = presShell->StyleSet()->ResolveStyleForNonElement(parentSC);
-    if (newSC) {
-      continuation->SetStyleContext(newSC);
-    }
+    continuation->SetStyleContext(newSC);
   }
 
   //XXX Bidi may not be involved but we have to use the list name
@@ -381,9 +378,7 @@ nsFirstLetterFrame::DrainOverflowFrames(nsPresContext* aPresContext)
       NS_ASSERTION(kidContent->IsNodeOfType(nsINode::eTEXT),
                    "should contain only text nodes");
       sc = aPresContext->StyleSet()->ResolveStyleForNonElement(mStyleContext);
-      if (sc) {
-        kid->SetStyleContext(sc);
-      }
+      kid->SetStyleContext(sc);
     }
   }
 }
diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index 11065c72e1aa..b5844730987f 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -394,8 +394,7 @@ nsFrame::~nsFrame()
   MOZ_COUNT_DTOR(nsFrame);
 
   NS_IF_RELEASE(mContent);
-  if (mStyleContext)
-    mStyleContext->Release();
+  mStyleContext->Release();
 }
 
 NS_IMPL_FRAMEARENA_HELPERS(nsFrame)
diff --git a/layout/generic/nsFrameSetFrame.cpp b/layout/generic/nsFrameSetFrame.cpp
index 407172976ab6..0ff16fb649a1 100644
--- a/layout/generic/nsFrameSetFrame.cpp
+++ b/layout/generic/nsFrameSetFrame.cpp
@@ -972,27 +972,21 @@ nsHTMLFramesetFrame::Reflow(nsPresContext*           aPresContext,
                                                             borderWidth,
                                                             false,
                                                             false);
-        if (MOZ_LIKELY(borderFrame != nullptr)) {
-          borderFrame->Init(mContent, this, nullptr);
-          mChildCount++;
-          mFrames.AppendFrame(nullptr, borderFrame);
-          mHorBorders[cellIndex.y-1] = borderFrame;
-          // set the neighbors for determining drag boundaries
-          borderFrame->mPrevNeighbor = lastRow;
-          borderFrame->mNextNeighbor = cellIndex.y;
-        }
+        borderFrame->Init(mContent, this, nullptr);
+        mChildCount++;
+        mFrames.AppendFrame(nullptr, borderFrame);
+        mHorBorders[cellIndex.y-1] = borderFrame;
+        // set the neighbors for determining drag boundaries
+        borderFrame->mPrevNeighbor = lastRow;
+        borderFrame->mNextNeighbor = cellIndex.y;
       } else {
         borderFrame = (nsHTMLFramesetBorderFrame*)mFrames.FrameAt(borderChildX);
-        if (MOZ_LIKELY(borderFrame != nullptr)) {
-          borderFrame->mWidth = borderWidth;
-          borderChildX++;
-        }
-      }
-      if (MOZ_LIKELY(borderFrame != nullptr)) {
-        nsSize borderSize(aDesiredSize.width, borderWidth);
-        ReflowPlaceChild(borderFrame, aPresContext, aReflowState, offset, borderSize);
-        borderFrame = nullptr;
+        borderFrame->mWidth = borderWidth;
+        borderChildX++;
       }
+      nsSize borderSize(aDesiredSize.width, borderWidth);
+      ReflowPlaceChild(borderFrame, aPresContext, aReflowState, offset, borderSize);
+      borderFrame = nullptr;
       offset.y += borderWidth;
     } else {
       if (cellIndex.x > 0) {  // moved to next col in same row
@@ -1008,27 +1002,21 @@ nsHTMLFramesetFrame::Reflow(nsPresContext*           aPresContext,
                                                                 borderWidth,
                                                                 true,
                                                                 false);
-            if (MOZ_LIKELY(borderFrame != nullptr)) {
-              borderFrame->Init(mContent, this, nullptr);
-              mChildCount++;
-              mFrames.AppendFrame(nullptr, borderFrame);
-              mVerBorders[cellIndex.x-1] = borderFrame;
-              // set the neighbors for determining drag boundaries
-              borderFrame->mPrevNeighbor = lastCol;
-              borderFrame->mNextNeighbor = cellIndex.x;
-            }
+            borderFrame->Init(mContent, this, nullptr);
+            mChildCount++;
+            mFrames.AppendFrame(nullptr, borderFrame);
+            mVerBorders[cellIndex.x-1] = borderFrame;
+            // set the neighbors for determining drag boundaries
+            borderFrame->mPrevNeighbor = lastCol;
+            borderFrame->mNextNeighbor = cellIndex.x;
           } else {
             borderFrame = (nsHTMLFramesetBorderFrame*)mFrames.FrameAt(borderChildX);
-            if (MOZ_LIKELY(borderFrame != nullptr)) {
-              borderFrame->mWidth = borderWidth;
-              borderChildX++;
-            }
-          }
-          if (MOZ_LIKELY(borderFrame != nullptr)) {
-            nsSize borderSize(borderWidth, aDesiredSize.height);
-            ReflowPlaceChild(borderFrame, aPresContext, aReflowState, offset, borderSize);
-            borderFrame = nullptr;
+            borderFrame->mWidth = borderWidth;
+            borderChildX++;
           }
+          nsSize borderSize(borderWidth, aDesiredSize.height);
+          ReflowPlaceChild(borderFrame, aPresContext, aReflowState, offset, borderSize);
+          borderFrame = nullptr;
         }
         offset.x += borderWidth;
       }
diff --git a/layout/generic/nsIFrame.h b/layout/generic/nsIFrame.h
index fd62e42074d4..4ba4934fa629 100644
--- a/layout/generic/nsIFrame.h
+++ b/layout/generic/nsIFrame.h
@@ -751,12 +751,9 @@ public:
     if (aContext != mStyleContext) {
       nsStyleContext* oldStyleContext = mStyleContext;
       mStyleContext = aContext;
-      if (aContext) {
-        aContext->AddRef();
-        DidSetStyleContext(oldStyleContext);
-      }
-      if (oldStyleContext)
-        oldStyleContext->Release();
+      aContext->AddRef();
+      DidSetStyleContext(oldStyleContext);
+      oldStyleContext->Release();
     }
   }
 
@@ -769,12 +766,9 @@ public:
   void SetStyleContextWithoutNotification(nsStyleContext* aContext)
   {
     if (aContext != mStyleContext) {
-      if (mStyleContext)
-        mStyleContext->Release();
+      mStyleContext->Release();
       mStyleContext = aContext;
-      if (aContext) {
-        aContext->AddRef();
-      }
+      aContext->AddRef();
     }
   }
 
diff --git a/layout/generic/nsImageFrame.cpp b/layout/generic/nsImageFrame.cpp
index 48c0aab36f71..5ed849d91e4e 100644
--- a/layout/generic/nsImageFrame.cpp
+++ b/layout/generic/nsImageFrame.cpp
@@ -1701,14 +1701,12 @@ nsImageFrame::GetCursor(const nsPoint& aPoint,
       nsRefPtr<nsStyleContext> areaStyle = 
         PresContext()->PresShell()->StyleSet()->
           ResolveStyleFor(area->AsElement(), StyleContext());
-      if (areaStyle) {
-        FillCursorInformationFromStyle(areaStyle->StyleUserInterface(),
-                                       aCursor);
-        if (NS_STYLE_CURSOR_AUTO == aCursor.mCursor) {
-          aCursor.mCursor = NS_STYLE_CURSOR_DEFAULT;
-        }
-        return NS_OK;
+      FillCursorInformationFromStyle(areaStyle->StyleUserInterface(),
+                                     aCursor);
+      if (NS_STYLE_CURSOR_AUTO == aCursor.mCursor) {
+        aCursor.mCursor = NS_STYLE_CURSOR_DEFAULT;
       }
+      return NS_OK;
     }
   }
   return nsFrame::GetCursor(aPoint, aCursor);
diff --git a/layout/mathml/nsMathMLContainerFrame.cpp b/layout/mathml/nsMathMLContainerFrame.cpp
index 65e3d3e15c2d..5e69a769f774 100644
--- a/layout/mathml/nsMathMLContainerFrame.cpp
+++ b/layout/mathml/nsMathMLContainerFrame.cpp
@@ -1551,9 +1551,7 @@ NS_NewMathMLmathBlockFrame(nsIPresShell* aPresShell, nsStyleContext* aContext,
                            uint32_t aFlags)
 {
   nsMathMLmathBlockFrame* it = new (aPresShell) nsMathMLmathBlockFrame(aContext);
-  if (it) {
-    it->SetFlags(aFlags);
-  }
+  it->SetFlags(aFlags);
   return it;
 }
 
diff --git a/layout/mathml/nsMathMLFrame.cpp b/layout/mathml/nsMathMLFrame.cpp
index d11735d9a208..bff13a9972a7 100644
--- a/layout/mathml/nsMathMLFrame.cpp
+++ b/layout/mathml/nsMathMLFrame.cpp
@@ -133,8 +133,7 @@ nsMathMLFrame::ResolveMathMLCharStyle(nsPresContext*  aPresContext,
     ResolvePseudoElementStyle(aContent->AsElement(), pseudoType,
                               aParentStyleContext);
 
-  if (newStyleContext)
-    aMathMLChar->SetStyleContext(newStyleContext);
+  aMathMLChar->SetStyleContext(newStyleContext);
 }
 
 /* static */ void
diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list
index 6561db6b2285..9e4bb521ad74 100644
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -1641,14 +1641,14 @@ fuzzy-if(Android&&AndroidVersion>=15,8,100) == 625409-1.html 625409-1-ref.html
 == 630835-1.html about:blank
 == 631352-1.html 631352-1-ref.html
 skip-if(B2G) fails-if(Android) == 632423-1.html 632423-1-ref.html
-skip-if(Android||B2G) random-if(/^Windows\x20NT\x205\.1/.test(http.oscpu)) == 632781-verybig.html 632781-ref.html
+skip-if(Android||B2G) random-if(winWidget&&!d2d) == 632781-verybig.html 632781-ref.html
 == 632781-normalsize.html 632781-ref.html
 fails-if(Android) == 633344-1.html 633344-1-ref.html
 == 634232-1.html 634232-1-ref.html
 fails-if(Android) == 635302-1.html 635302-1-ref.html
-skip-if(B2G) random-if(d2d) fails-if(Android) == 635373-1.html 635373-1-ref.html
-skip-if(B2G) random-if(d2d) fails-if(Android) == 635373-2.html 635373-2-ref.html
-skip-if(B2G) random-if(d2d) fails-if(Android) == 635373-3.html 635373-3-ref.html
+skip-if(B2G) random-if(d2d) fails-if(Android) fuzzy-if(winWidget&&!d2d,1,11) == 635373-1.html 635373-1-ref.html
+skip-if(B2G) random-if(d2d) fails-if(Android) fuzzy-if(winWidget&&!d2d,1,15) == 635373-2.html 635373-2-ref.html
+skip-if(B2G) random-if(d2d) fails-if(Android) fuzzy-if(winWidget&&!d2d,1,15) == 635373-3.html 635373-3-ref.html
 HTTP(..) == 635639-1.html 635639-1-ref.html
 HTTP(..) == 635639-2.html 635639-2-ref.html
 random == 637597-1.html 637597-1-ref.html # bug 637597 was never really fixed!
diff --git a/layout/reftests/ogg-video/reftest.list b/layout/reftests/ogg-video/reftest.list
index 3f11be8b38f6..e4fb8c61f092 100644
--- a/layout/reftests/ogg-video/reftest.list
+++ b/layout/reftests/ogg-video/reftest.list
@@ -17,7 +17,7 @@ random skip-if(Android||B2G) HTTP(..) == object-aspect-ratio-1b.xhtml aspect-rat
 skip-if(Android||B2G) HTTP(..) == offset-1.xhtml offset-1-ref.html
 random skip-if(Android||B2G) HTTP(..) == object-aspect-ratio-2a.xhtml aspect-ratio-2-ref.html
 random skip-if(Android||B2G) HTTP(..) == object-aspect-ratio-2b.xhtml aspect-ratio-2-ref.html
-skip-if(Android||B2G) skip-if(gtk2Widget) fuzzy-if(/^Windows\x20NT\x205\.1/.test(http.oscpu),1,56000) fuzzy-if(cocoaWidget,1,56000) fuzzy-if(d2d&&layersGPUAccelerated,1,56000) HTTP(..) == zoomed-1.xhtml zoomed-1-ref.html # bug 778995 for fuzzy
+skip-if(Android||B2G) skip-if(gtk2Widget) fuzzy-if(winWidget,1,56000) fuzzy-if(cocoaWidget,1,56000) HTTP(..) == zoomed-1.xhtml zoomed-1-ref.html # bug 778995 for fuzzy
 skip-if(Android||B2G) == poster-1.html poster-ref-blue250x200.html
 skip-if(Android||B2G) == poster-2.html poster-ref-black140x100.html
 skip-if(Android||B2G) == poster-3.html poster-ref-black140x100.html
diff --git a/layout/reftests/text/osx-font-smoothing-2-notref.html b/layout/reftests/text/osx-font-smoothing-2-notref.html
new file mode 100644
index 000000000000..3cf80f8d71dc
--- /dev/null
+++ b/layout/reftests/text/osx-font-smoothing-2-notref.html
@@ -0,0 +1,23 @@
+<!DOCTYPE HTML>
+<!-- testcase for https://bugzilla.mozilla.org/show_bug.cgi?id=900975 -->
+<html>
+<head>
+<style type="text/css">
+p {
+  margin: 20px;
+  font-family: Arial, sans-serif;
+  background-color: black;
+  color: white;
+}
+.smoothing-gray {
+  -moz-osx-font-smoothing: grayscale;
+}
+.smoothing-auto {
+  -moz-osx-font-smoothing: auto;
+}
+</style>
+</head>
+<body lang="en">
+<p class="smoothing-auto"><span>foo</span> <span>bar</span></p>
+</body>
+</html>
diff --git a/layout/reftests/text/osx-font-smoothing-2-ref.html b/layout/reftests/text/osx-font-smoothing-2-ref.html
new file mode 100644
index 000000000000..fc7ca44af155
--- /dev/null
+++ b/layout/reftests/text/osx-font-smoothing-2-ref.html
@@ -0,0 +1,26 @@
+<!DOCTYPE HTML>
+<!-- testcase for https://bugzilla.mozilla.org/show_bug.cgi?id=900975 -->
+<html>
+<head>
+<style type="text/css">
+p {
+  margin: 20px;
+  font-family: Arial, sans-serif;
+  background-color: black;
+  color: white;
+}
+.smoothing-gray {
+  -moz-osx-font-smoothing: grayscale;
+}
+.smoothing-auto {
+  -moz-osx-font-smoothing: auto;
+}
+span {
+  display: inline-block;
+}
+</style>
+</head>
+<body lang="en">
+<p class="smoothing-auto"><span>foo</span> <span class="smoothing-gray">bar</span></p>
+</body>
+</html>
diff --git a/layout/reftests/text/osx-font-smoothing-2.html b/layout/reftests/text/osx-font-smoothing-2.html
new file mode 100644
index 000000000000..2ef3b3ff48b3
--- /dev/null
+++ b/layout/reftests/text/osx-font-smoothing-2.html
@@ -0,0 +1,23 @@
+<!DOCTYPE HTML>
+<!-- testcase for https://bugzilla.mozilla.org/show_bug.cgi?id=900975 -->
+<html>
+<head>
+<style type="text/css">
+p {
+  margin: 20px;
+  font-family: Arial, sans-serif;
+  background-color: black;
+  color: white;
+}
+.smoothing-gray {
+  -moz-osx-font-smoothing: grayscale;
+}
+.smoothing-auto {
+  -moz-osx-font-smoothing: auto;
+}
+</style>
+</head>
+<body lang="en">
+<p class="smoothing-auto"><span>foo</span> <span class="smoothing-gray">bar</span></p>
+</body>
+</html>
diff --git a/layout/reftests/text/reftest.list b/layout/reftests/text/reftest.list
index f52f98cd5688..a0127258356c 100644
--- a/layout/reftests/text/reftest.list
+++ b/layout/reftests/text/reftest.list
@@ -278,4 +278,6 @@ pref(gfx.font_rendering.graphite.enabled,true) HTTP(..) == glyph-decomposition-g
 == auto-hyphenation-uk-1.html auto-hyphenation-uk-1-ref.html
 
 # osx-font-smoothing - with and without subpixel AA, only under OSX
-skip-if(!cocoaWidget||OSX==10.6||OSX==10.7) != osx-font-smoothing.html osx-font-smoothing-ref.html
+fails-if(!cocoaWidget||OSX==10.6||OSX==10.7) != osx-font-smoothing.html osx-font-smoothing-ref.html
+fails-if(!cocoaWidget||OSX==10.6||OSX==10.7) != osx-font-smoothing-2.html osx-font-smoothing-2-notref.html
+== osx-font-smoothing-2.html osx-font-smoothing-2-ref.html
diff --git a/layout/reftests/transform-3d/reftest.list b/layout/reftests/transform-3d/reftest.list
index 85b7f77ef912..6d85eabd3779 100644
--- a/layout/reftests/transform-3d/reftest.list
+++ b/layout/reftests/transform-3d/reftest.list
@@ -22,8 +22,8 @@ fails-if(Android) == rotatex-perspective-3a.html rotatex-perspective-3-ref.html
 skip-if(B2G) == preserve3d-4a.html green-rect.html
 fuzzy-if(Android&&AndroidVersion>=15,4,300) == preserve3d-5a.html preserve3d-5-ref.html
 == scale3d-z.html scalez-1-ref.html
-fuzzy-if(winWidget&&!layersGPUAccelerated,102,580) fuzzy-if(d2d,143,681) fails-if(Android) fuzzy-if(OSX==10.8,145,752) == scale3d-all.html scale3d-1-ref.html # subpixel AA
-fuzzy-if(winWidget&&!layersGPUAccelerated,102,580) fuzzy-if(d2d,143,681) fails-if(Android) fuzzy-if(OSX==10.8,145,752) == scale3d-all-separate.html scale3d-1-ref.html # subpixel AA
+fuzzy-if(winWidget,102,580) fuzzy-if(d2d,143,681) fails-if(Android) fuzzy-if(OSX==10.8,145,752) == scale3d-all.html scale3d-1-ref.html # subpixel AA
+fuzzy-if(winWidget,102,580) fuzzy-if(d2d,143,681) fails-if(Android) fuzzy-if(OSX==10.8,145,752) == scale3d-all-separate.html scale3d-1-ref.html # subpixel AA
 == scale3d-xz.html scale3d-1-ref.html
 == translatez-1a.html translatez-1-ref.html
 != translatez-1b.html translatez-1-ref.html
diff --git a/layout/reftests/webm-video/reftest.list b/layout/reftests/webm-video/reftest.list
index 4b37738a337a..cbf63a5e191b 100644
--- a/layout/reftests/webm-video/reftest.list
+++ b/layout/reftests/webm-video/reftest.list
@@ -17,7 +17,7 @@ random skip-if(Android||B2G) HTTP(..) == object-aspect-ratio-1b.xhtml aspect-rat
 skip-if(Android||B2G) HTTP(..) == offset-1.xhtml offset-1-ref.html
 random skip-if(Android||B2G) HTTP(..) == object-aspect-ratio-2a.xhtml aspect-ratio-2-ref.html
 random skip-if(Android||B2G) HTTP(..) == object-aspect-ratio-2b.xhtml aspect-ratio-2-ref.html
-skip-if(Android||B2G) skip-if(gtk2Widget) fuzzy-if(/^Windows\x20NT\x205\.1/.test(http.oscpu),1,56000) fuzzy-if(cocoaWidget,1,56000) fuzzy-if(d2d&&layersGPUAccelerated,1,56000) HTTP(..) == zoomed-1.xhtml zoomed-1-ref.html # bug 778995 for fuzzy
+skip-if(Android||B2G) skip-if(gtk2Widget) fuzzy-if(winWidget,1,56000) fuzzy-if(cocoaWidget,1,56000) HTTP(..) == zoomed-1.xhtml zoomed-1-ref.html # bug 778995 for fuzzy
 skip-if(Android||B2G) == poster-1.html poster-ref-blue250x200.html
 skip-if(Android||B2G) == poster-2.html poster-ref-black140x100.html
 skip-if(Android||B2G) == poster-3.html poster-ref-black140x100.html
diff --git a/layout/style/nsRuleNode.cpp b/layout/style/nsRuleNode.cpp
index 3c8bd1eda265..a200951c048e 100644
--- a/layout/style/nsRuleNode.cpp
+++ b/layout/style/nsRuleNode.cpp
@@ -387,9 +387,7 @@ static nscoord CalcLengthWith(const nsCSSValue& aValue,
         if (docElement) {
           rootStyle = aPresContext->StyleSet()->ResolveStyleFor(docElement,
                                                                 nullptr);
-          if (rootStyle) {
-            rootStyleFont = rootStyle->StyleFont();
-          }
+          rootStyleFont = rootStyle->StyleFont();
         }
 
         rootFontSize = rootStyleFont->mFont.size;
diff --git a/layout/style/nsStyleSet.cpp b/layout/style/nsStyleSet.cpp
index ad12bf61cdb9..131a972a6860 100644
--- a/layout/style/nsStyleSet.cpp
+++ b/layout/style/nsStyleSet.cpp
@@ -1741,10 +1741,7 @@ nsStyleSet::ReparentStyleContext(nsStyleContext* aStyleContext,
                                  nsStyleContext* aNewParentContext,
                                  Element* aElement)
 {
-  if (!aStyleContext) {
-    NS_NOTREACHED("must have style context");
-    return nullptr;
-  }
+  MOZ_ASSERT(aStyleContext, "aStyleContext must not be null");
 
   // This short-circuit is OK because we don't call TryStartingTransition
   // during style reresolution if the style context pointer hasn't changed.
diff --git a/layout/tables/nsTableFrame.cpp b/layout/tables/nsTableFrame.cpp
index dcb97973d527..9409668cb0d4 100644
--- a/layout/tables/nsTableFrame.cpp
+++ b/layout/tables/nsTableFrame.cpp
@@ -596,10 +596,8 @@ nsTableFrame::CreateAnonymousColGroupFrame(nsTableColGroupType aColGroupType)
     ResolveAnonymousBoxStyle(nsCSSAnonBoxes::tableColGroup, mStyleContext);
   // Create a col group frame
   nsIFrame* newFrame = NS_NewTableColGroupFrame(shell, colGroupStyle);
-  if (newFrame) {
-    ((nsTableColGroupFrame *)newFrame)->SetColType(aColGroupType);
-    newFrame->Init(colGroupContent, this, nullptr);
-  }
+  ((nsTableColGroupFrame *)newFrame)->SetColType(aColGroupType);
+  newFrame->Init(colGroupContent, this, nullptr);
   return (nsTableColGroupFrame *)newFrame;
 }
 
diff --git a/layout/xul/base/src/nsListBoxBodyFrame.cpp b/layout/xul/base/src/nsListBoxBodyFrame.cpp
index e00a5887f340..b192386f96b5 100644
--- a/layout/xul/base/src/nsListBoxBodyFrame.cpp
+++ b/layout/xul/base/src/nsListBoxBodyFrame.cpp
@@ -1474,10 +1474,6 @@ nsIFrame*
 NS_NewListBoxBodyFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   nsCOMPtr<nsBoxLayout> layout = NS_NewListBoxLayout();
-  if (!layout) {
-    return nullptr;
-  }
-
   return new (aPresShell) nsListBoxBodyFrame(aPresShell, aContext, layout);
 }
 
diff --git a/layout/xul/base/src/nsXULLabelFrame.cpp b/layout/xul/base/src/nsXULLabelFrame.cpp
index d2d9444722b2..4dd4de0e9c03 100644
--- a/layout/xul/base/src/nsXULLabelFrame.cpp
+++ b/layout/xul/base/src/nsXULLabelFrame.cpp
@@ -15,8 +15,7 @@ NS_NewXULLabelFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   nsXULLabelFrame* it = new (aPresShell) nsXULLabelFrame(aContext);
   
-  if (it)
-    it->SetFlags(NS_BLOCK_FLOAT_MGR | NS_BLOCK_MARGIN_ROOT);
+  it->SetFlags(NS_BLOCK_FLOAT_MGR | NS_BLOCK_MARGIN_ROOT);
 
   return it;
 }
diff --git a/layout/xul/grid/nsGridRowGroupFrame.cpp b/layout/xul/grid/nsGridRowGroupFrame.cpp
index 9faf35e87cad..c9aad3803587 100644
--- a/layout/xul/grid/nsGridRowGroupFrame.cpp
+++ b/layout/xul/grid/nsGridRowGroupFrame.cpp
@@ -23,10 +23,6 @@ NS_NewGridRowGroupFrame(nsIPresShell* aPresShell,
                         nsStyleContext* aContext)
 {
   nsCOMPtr<nsBoxLayout> layout = NS_NewGridRowGroupLayout();
-  if (!layout) {
-    return nullptr;
-  }
-
   return new (aPresShell) nsGridRowGroupFrame(aPresShell, aContext, layout);
 }
 
diff --git a/layout/xul/grid/nsGridRowLeafFrame.cpp b/layout/xul/grid/nsGridRowLeafFrame.cpp
index c418c07428e7..6dd6ed19447f 100644
--- a/layout/xul/grid/nsGridRowLeafFrame.cpp
+++ b/layout/xul/grid/nsGridRowLeafFrame.cpp
@@ -23,10 +23,6 @@ NS_NewGridRowLeafFrame(nsIPresShell* aPresShell,
                        nsStyleContext* aContext)
 {
   nsCOMPtr<nsBoxLayout> layout = NS_NewGridRowLeafLayout();
-  if (!layout) {
-    return nullptr;
-  }
-  
   return new (aPresShell) nsGridRowLeafFrame(aPresShell, aContext, false,
                                              layout);
 }
diff --git a/media/mtransport/third_party/nICEr/src/ice/ice_candidate.c b/media/mtransport/third_party/nICEr/src/ice/ice_candidate.c
index 629bef4aefae..8655a7d5ceb8 100644
--- a/media/mtransport/third_party/nICEr/src/ice/ice_candidate.c
+++ b/media/mtransport/third_party/nICEr/src/ice/ice_candidate.c
@@ -551,7 +551,7 @@ static void nr_ice_srvrflx_start_stun_timer_cb(NR_SOCKET s, int how, void *cb_ar
 /* TODO: if the response is a BINDING-ERROR-RESPONSE, then restart
  * TODO: using NR_STUN_CLIENT_MODE_BINDING_REQUEST because the
  * TODO: server may not have understood the 0.96-style request */
-    if(r=nr_stun_client_start(cand->u.srvrflx.stun, NR_STUN_CLIENT_MODE_BINDING_REQUEST_STUND_0_96, nr_ice_srvrflx_stun_finished_cb, cand))
+    if(r=nr_stun_client_start(cand->u.srvrflx.stun, NR_STUN_CLIENT_MODE_BINDING_REQUEST_NO_AUTH, nr_ice_srvrflx_stun_finished_cb, cand))
       ABORT(r);
 
     if(r=nr_ice_ctx_remember_id(cand->ctx, cand->u.srvrflx.stun->request))
@@ -656,7 +656,7 @@ static void nr_ice_srvrflx_stun_finished_cb(NR_SOCKET sock, int how, void *cb_ar
       /* OK, we should have a mapped address */
       case NR_STUN_CLIENT_STATE_DONE:
         /* Copy the address */
-        nr_transport_addr_copy(&cand->addr, &cand->u.srvrflx.stun->results.stun_binding_response_stund_0_96.mapped_addr);
+        nr_transport_addr_copy(&cand->addr, &cand->u.srvrflx.stun->results.stun_binding_response.mapped_addr);
         nr_stun_client_ctx_destroy(&cand->u.srvrflx.stun);
         cand->state=NR_ICE_CAND_STATE_INITIALIZED;
         /* Execute the ready callback */
diff --git a/media/mtransport/third_party/nICEr/src/stun/stun_client_ctx.c b/media/mtransport/third_party/nICEr/src/stun/stun_client_ctx.c
index da9a4c11f2d9..fb6da71bf195 100644
--- a/media/mtransport/third_party/nICEr/src/stun/stun_client_ctx.c
+++ b/media/mtransport/third_party/nICEr/src/stun/stun_client_ctx.c
@@ -573,8 +573,15 @@ int nr_stun_client_process_response(nr_stun_client_ctx *ctx, UCHAR *msg, int len
         break;
 
     case NR_STUN_CLIENT_MODE_BINDING_REQUEST_NO_AUTH:
-        if (! nr_stun_message_has_attribute(ctx->response, NR_STUN_ATTR_XOR_MAPPED_ADDRESS, 0))
-            ABORT(R_BAD_DATA);
+        if (! nr_stun_message_has_attribute(ctx->response, NR_STUN_ATTR_XOR_MAPPED_ADDRESS, 0)) {
+            if (nr_stun_message_has_attribute(ctx->response, NR_STUN_ATTR_MAPPED_ADDRESS, 0)) {
+              /* Compensate for a bug in Google's STUN servers where they always respond with MAPPED-ADDRESS */
+              r_log(NR_LOG_STUN,LOG_DEBUG,"STUN-CLIENT(%s): No XOR-MAPPED-ADDRESS but MAPPED-ADDRESS. Falling back (though server is wrong).", ctx->label);
+            }
+            else {
+              ABORT(R_BAD_DATA);
+            }
+        }
 
         mapped_addr = &ctx->results.stun_binding_response.mapped_addr;
         break;
diff --git a/media/mtransport/third_party/nICEr/src/stun/stun_proc.c b/media/mtransport/third_party/nICEr/src/stun/stun_proc.c
index 031bdc09963b..03888bb964ac 100644
--- a/media/mtransport/third_party/nICEr/src/stun/stun_proc.c
+++ b/media/mtransport/third_party/nICEr/src/stun/stun_proc.c
@@ -199,7 +199,12 @@ nr_stun_process_indication(nr_stun_message *ind)
     return _status;
 }
 
-/* draft-ietf-behave-rfc3489bis-10.txt S 7.3.3 */
+/* RFC5389 S 7.3.3, except that we *also* allow a MAPPED_ADDRESS
+   to compensate for a bug in Google's STUN server where it
+   always returns MAPPED_ADDRESS.
+
+   Mozilla bug: 888274.
+ */
 int
 nr_stun_process_success_response(nr_stun_message *res)
 {
@@ -211,8 +216,9 @@ nr_stun_process_success_response(nr_stun_message *res)
 #endif /* USE_STUN_PEDANTIC */
 
     if (NR_STUN_GET_TYPE_METHOD(res->header.type) == NR_METHOD_BINDING) {
-        if (! nr_stun_message_has_attribute(res, NR_STUN_ATTR_XOR_MAPPED_ADDRESS, 0)) {
-            r_log(NR_LOG_STUN, LOG_ERR, "Missing XOR-MAPPED-ADDRESS");
+        if (! nr_stun_message_has_attribute(res, NR_STUN_ATTR_XOR_MAPPED_ADDRESS, 0) &&
+            ! nr_stun_message_has_attribute(res, NR_STUN_ATTR_MAPPED_ADDRESS, 0)) {
+            r_log(NR_LOG_STUN, LOG_ERR, "Missing XOR-MAPPED-ADDRESS and MAPPED_ADDRESS");
             ABORT(R_REJECTED);
         }
     }
diff --git a/media/webrtc/trunk/webrtc/modules/audio_device/audio_device.gypi b/media/webrtc/trunk/webrtc/modules/audio_device/audio_device.gypi
index 5da516135517..ce9dad681dc0 100644
--- a/media/webrtc/trunk/webrtc/modules/audio_device/audio_device.gypi
+++ b/media/webrtc/trunk/webrtc/modules/audio_device/audio_device.gypi
@@ -71,6 +71,12 @@
             'android',
           ],
         }], # OS==android
+        ['moz_widget_toolkit_gonk==1', {
+          'include_dirs': [
+            '$(ANDROID_SOURCE)/frameworks/wilhelm/include',
+            '$(ANDROID_SOURCE)/system/media/wilhelm/include',
+          ],
+        }], # moz_widget_toolkit_gonk==1
         ['include_internal_audio_device==0', {
           'defines': [
             'WEBRTC_DUMMY_AUDIO_BUILD',
@@ -105,13 +111,16 @@
             'win/audio_mixer_manager_win.h',
             'android/audio_device_utility_android.cc',
             'android/audio_device_utility_android.h',
-            'android/audio_device_opensles_android.cc',
-            'android/audio_device_opensles_android.h',
+# opensles is shared with gonk, so isn't here
             'android/audio_device_jni_android.cc',
             'android/audio_device_jni_android.h',
           ],
           'conditions': [
             ['OS=="android"', {
+              'sources': [
+                'audio_device_opensles.cc',
+                'audio_device_opensles.h',
+              ],
               'link_settings': {
                 'libraries': [
                   '-llog',
@@ -119,6 +128,12 @@
                 ],
               },
             }],
+            ['moz_widget_toolkit_gonk==1', {
+              'sources': [
+                'audio_device_opensles.cc',
+                'audio_device_opensles.h',
+              ],
+            }],
             ['OS=="linux"', {
               'link_settings': {
                 'libraries': [
diff --git a/media/webrtc/trunk/webrtc/modules/audio_device/audio_device_impl.cc b/media/webrtc/trunk/webrtc/modules/audio_device/audio_device_impl.cc
index 0013e3d2f298..aae55fe0c171 100644
--- a/media/webrtc/trunk/webrtc/modules/audio_device/audio_device_impl.cc
+++ b/media/webrtc/trunk/webrtc/modules/audio_device/audio_device_impl.cc
@@ -26,8 +26,13 @@
     #include <stdlib.h>
     #include <dlfcn.h>
     #include "audio_device_utility_android.h"
-    #include "audio_device_opensles_android.h"
+    #include "audio_device_opensles.h"
     #include "audio_device_jni_android.h"
+#elif defined(WEBRTC_GONK)
+    #include <stdlib.h>
+    #include <dlfcn.h>
+    #include "audio_device_utility_linux.h"
+    #include "audio_device_opensles.h"
 #elif defined(WEBRTC_ANDROID)
     #include <stdlib.h>
     #include "audio_device_utility_android.h"
@@ -260,7 +265,7 @@ int32_t AudioDeviceModuleImpl::CreatePlatformSpecificObjects()
 
     // Create the *Android OpenSLES* implementation of the Audio Device
     //
-#if defined(WEBRTC_ANDROID_OPENSLES)
+#if defined(WEBRTC_ANDROID_OPENSLES) || defined(WEBRTC_GONK)
     // Check if the OpenSLES library is available before going further.
     void* opensles_lib = dlopen("libOpenSLES.so", RTLD_LAZY);
     if (opensles_lib) {
@@ -275,12 +280,15 @@ int32_t AudioDeviceModuleImpl::CreatePlatformSpecificObjects()
         }
     }
 
+#if !defined(WEBRTC_GONK)
     if (ptrAudioDevice != NULL)
     {
         // Create the Android implementation of the Device Utility.
         ptrAudioDeviceUtility = new AudioDeviceUtilityAndroid(Id());
     }
 #endif
+
+#endif
 #if defined(WEBRTC_ANDROID_OPENSLES) or defined(WEBRTC_ANDROID)
     // Fall back to this case if on Android 2.2/OpenSLES not available.
     if (ptrAudioDevice == NULL) {
diff --git a/media/webrtc/trunk/webrtc/modules/audio_device/android/audio_device_opensles_android.cc b/media/webrtc/trunk/webrtc/modules/audio_device/audio_device_opensles.cc
similarity index 99%
rename from media/webrtc/trunk/webrtc/modules/audio_device/android/audio_device_opensles_android.cc
rename to media/webrtc/trunk/webrtc/modules/audio_device/audio_device_opensles.cc
index 21e31b1315cc..d5cc035093e4 100644
--- a/media/webrtc/trunk/webrtc/modules/audio_device/android/audio_device_opensles_android.cc
+++ b/media/webrtc/trunk/webrtc/modules/audio_device/audio_device_opensles.cc
@@ -8,7 +8,7 @@
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
-#include "modules/audio_device/android/audio_device_opensles_android.h"
+#include "modules/audio_device/audio_device_opensles.h"
 
 #ifdef WEBRTC_ANDROID_DEBUG
 #include <android/log.h>
diff --git a/media/webrtc/trunk/webrtc/modules/audio_device/android/audio_device_opensles_android.h b/media/webrtc/trunk/webrtc/modules/audio_device/audio_device_opensles.h
similarity index 100%
rename from media/webrtc/trunk/webrtc/modules/audio_device/android/audio_device_opensles_android.h
rename to media/webrtc/trunk/webrtc/modules/audio_device/audio_device_opensles.h
diff --git a/memory/mozjemalloc/jemalloc.c b/memory/mozjemalloc/jemalloc.c
index 5ee8682f0be8..625089cb22b5 100644
--- a/memory/mozjemalloc/jemalloc.c
+++ b/memory/mozjemalloc/jemalloc.c
@@ -1104,7 +1104,9 @@ static unsigned		ncpus;
  * controlling the malloc behavior are defined as compile-time constants
  * for best performance and cannot be altered at runtime.
  */
+#if !defined(__ia64__) && !defined(__sparc__) && !defined(__mips__)
 #define MALLOC_STATIC_SIZES 1
+#endif
 
 #ifdef MALLOC_STATIC_SIZES
 
diff --git a/mfbt/Atomics.h b/mfbt/Atomics.h
index 34d7a5d9c9ff..f876683c3e95 100644
--- a/mfbt/Atomics.h
+++ b/mfbt/Atomics.h
@@ -43,12 +43,17 @@
 #  endif
 /*
  * Android uses a different C++ standard library that does not provide
- * support for <atomic>
+ * support for <atomic>.
+ *
+ * GCC 4.5.x and 4.6.x's unspecialized std::atomic template doesn't include
+ * inline definitions for the functions declared therein.  This oversight
+ * leads to linking errors when using atomic enums.  We therefore require
+ * GCC 4.7 or higher.
  */
 #elif defined(__GNUC__) && !defined(__ANDROID__)
 #  include "mozilla/Compiler.h"
 #  if (defined(__GXX_EXPERIMENTAL_CXX0X__) || __cplusplus >= 201103L) && \
-      MOZ_GCC_VERSION_AT_LEAST(4, 5, 2)
+      MOZ_GCC_VERSION_AT_LEAST(4, 7, 0)
 #    define MOZ_HAVE_CXX11_ATOMICS
 #  endif
 #elif defined(_MSC_VER) && _MSC_VER >= 1700
diff --git a/mfbt/TypedEnum.h b/mfbt/TypedEnum.h
index 2baae5ea8b2a..6f595cb4c5f1 100644
--- a/mfbt/TypedEnum.h
+++ b/mfbt/TypedEnum.h
@@ -92,16 +92,33 @@
  * mandatory.  As with MOZ_ENUM_TYPE(), it will do nothing on compilers that do
  * not support it.
  *
- * Note that the workaround implemented here is not compatible with enums
- * nested inside a class.
+ * MOZ_{BEGIN,END}_ENUM_CLASS doesn't work for defining enum classes nested
+ * inside classes.  To define an enum class nested inside another class, use
+ * MOZ_{BEGIN,END}_NESTED_ENUM_CLASS, and place a MOZ_FINISH_NESTED_ENUM_CLASS
+ * in namespace scope to handle bits that can only be implemented with
+ * namespace-scoped code.  For example:
+ *
+ *   class FooBar {
+ *
+ *     MOZ_BEGIN_NESTED_ENUM_CLASS(Enum, int32_t)
+ *       A,
+ *       B = 6
+ *     MOZ_END_NESTED_ENUM_CLASS(Enum)
+ *
+ *   };
+ *
+ *   MOZ_FINISH_NESTED_ENUM_CLASS(FooBar::Enum)
  */
 #if defined(MOZ_HAVE_CXX11_STRONG_ENUMS)
   /*
    * All compilers that support strong enums also support an explicit
    * underlying type, so no extra check is needed.
    */
-#  define MOZ_BEGIN_ENUM_CLASS(Name, type) enum class Name : type {
-#  define MOZ_END_ENUM_CLASS(Name)         };
+#  define MOZ_BEGIN_NESTED_ENUM_CLASS(Name, type) \
+     enum class Name : type {
+#  define MOZ_END_NESTED_ENUM_CLASS(Name) \
+     };
+#  define MOZ_FINISH_NESTED_ENUM_CLASS(Name) /* nothing */
 #else
    /**
     * We need Name to both name a type, and scope the provided enumerator
@@ -137,14 +154,14 @@
     *   {
     *     return Enum::A;
     *   }
-    */
-#  define MOZ_BEGIN_ENUM_CLASS(Name, type) \
+    */\
+#  define MOZ_BEGIN_NESTED_ENUM_CLASS(Name, type) \
      class Name \
      { \
        public: \
          enum Enum MOZ_ENUM_TYPE(type) \
          {
-#  define MOZ_END_ENUM_CLASS(Name) \
+#  define MOZ_END_NESTED_ENUM_CLASS(Name) \
          }; \
          Name() {} \
          Name(Enum aEnum) : mEnum(aEnum) {} \
@@ -152,7 +169,8 @@
          operator Enum() const { return mEnum; } \
        private: \
          Enum mEnum; \
-     }; \
+     };
+#  define MOZ_FINISH_NESTED_ENUM_CLASS(Name) \
      inline int operator+(const int&, const Name::Enum&) MOZ_DELETE; \
      inline int operator+(const Name::Enum&, const int&) MOZ_DELETE; \
      inline int operator-(const int&, const Name::Enum&) MOZ_DELETE; \
@@ -208,6 +226,10 @@
      inline int& operator<<=(int&, const Name::Enum&) MOZ_DELETE; \
      inline int& operator>>=(int&, const Name::Enum&) MOZ_DELETE;
 #endif
+#  define MOZ_BEGIN_ENUM_CLASS(Name, type) MOZ_BEGIN_NESTED_ENUM_CLASS(Name, type)
+#  define MOZ_END_ENUM_CLASS(Name) \
+     MOZ_END_NESTED_ENUM_CLASS(Name) \
+     MOZ_FINISH_NESTED_ENUM_CLASS(Name)
 
 #endif /* __cplusplus */
 
diff --git a/mfbt/decimal/moz-decimal-utils.h b/mfbt/decimal/moz-decimal-utils.h
index 05a3eb842b59..b76a6a7845cf 100644
--- a/mfbt/decimal/moz-decimal-utils.h
+++ b/mfbt/decimal/moz-decimal-utils.h
@@ -32,7 +32,7 @@
 #endif
 #define ASSERT MOZ_ASSERT
 
-#define ASSERT_NOT_REACHED() MOZ_ASSUME_UNREACHABLE()
+#define ASSERT_NOT_REACHED() MOZ_ASSUME_UNREACHABLE("moz-decimal-utils.h")
 
 #define WTF_MAKE_NONCOPYABLE(ClassName) \
   private: \
diff --git a/mobile/android/base/ActivityHandlerHelper.java b/mobile/android/base/ActivityHandlerHelper.java
index 2f38228dc6a9..9d389c47f5c8 100644
--- a/mobile/android/base/ActivityHandlerHelper.java
+++ b/mobile/android/base/ActivityHandlerHelper.java
@@ -99,6 +99,10 @@ public class ActivityHandlerHelper implements GeckoEventListener {
         return mActivityResultHandlerMap.put(aHandler);
     }
 
+    public void startIntentForActivity (Activity activity, Intent intent, ActivityResultHandler activityResultHandler) {
+        activity.startActivityForResult(intent, mActivityResultHandlerMap.put(activityResultHandler));
+    }
+
     private int addIntentActivitiesToList(Context context, Intent intent, ArrayList<Prompt.PromptListItem> items, ArrayList<Intent> aIntents) {
         PackageManager pm = context.getPackageManager();
         List<ResolveInfo> lri = pm.queryIntentActivityOptions(GeckoAppShell.getGeckoInterface().getActivity().getComponentName(), null, intent, 0);
diff --git a/mobile/android/base/AndroidManifest.xml.in b/mobile/android/base/AndroidManifest.xml.in
index ed6043cbd293..e6d58df3740e 100644
--- a/mobile/android/base/AndroidManifest.xml.in
+++ b/mobile/android/base/AndroidManifest.xml.in
@@ -28,9 +28,6 @@
 
     <uses-permission android:name="android.permission.WAKE_LOCK"/>
     <uses-permission android:name="android.permission.VIBRATE"/>
-#ifdef MOZ_ANDROID_WALLPAPER
-    <uses-permission android:name="android.permission.SET_WALLPAPER"/>
-#endif
     <uses-permission android:name="@ANDROID_PACKAGE_NAME@.permissions.PASSWORD_PROVIDER"/>
     <uses-permission android:name="@ANDROID_PACKAGE_NAME@.permissions.BROWSER_PROVIDER"/>
     <uses-permission android:name="@ANDROID_PACKAGE_NAME@.permissions.FORMHISTORY_PROVIDER"/>
diff --git a/mobile/android/base/BrowserApp.java b/mobile/android/base/BrowserApp.java
index 4eef51b0a181..1b68db52ce48 100644
--- a/mobile/android/base/BrowserApp.java
+++ b/mobile/android/base/BrowserApp.java
@@ -1644,8 +1644,8 @@ abstract public class BrowserApp extends GeckoApp
         MenuItem charEncoding = aMenu.findItem(R.id.char_encoding);
         MenuItem findInPage = aMenu.findItem(R.id.find_in_page);
         MenuItem desktopMode = aMenu.findItem(R.id.desktop_mode);
-        MenuItem enterGuestMode = aMenu.findItem(R.id.enter_guest_mode);
-        MenuItem exitGuestMode = aMenu.findItem(R.id.exit_guest_mode);
+        MenuItem enterGuestMode = aMenu.findItem(R.id.new_guest_session);
+        MenuItem exitGuestMode = aMenu.findItem(R.id.exit_guest_session);
 
         // Only show the "Quit" menu item on pre-ICS or television devices.
         // In ICS+, it's easy to kill an app through the task switcher.
@@ -1800,10 +1800,10 @@ abstract public class BrowserApp extends GeckoApp
             case R.id.new_private_tab:
                 addPrivateTab();
                 return true;
-            case R.id.enter_guest_mode:
+            case R.id.new_guest_session:
                 showGuestModeDialog(GuestModeDialog.ENTERING);
                 return true;
-            case R.id.exit_guest_mode:
+            case R.id.exit_guest_session:
                 showGuestModeDialog(GuestModeDialog.LEAVING);
                 return true;
             default:
@@ -1835,18 +1835,18 @@ abstract public class BrowserApp extends GeckoApp
 
         Resources res = getResources();
         ps.setButtons(new String[] {
-            res.getString(R.string.guest_mode_dialog_continue),
-            res.getString(R.string.guest_mode_dialog_cancel)
+            res.getString(R.string.guest_session_dialog_continue),
+            res.getString(R.string.guest_session_dialog_cancel)
         });
 
         int titleString = 0;
         int msgString = 0;
         if (type == GuestModeDialog.ENTERING) {
-            titleString = R.string.guest_mode_enter_title;
-            msgString = R.string.guest_mode_enter_text;
+            titleString = R.string.new_guest_session_title;
+            msgString = R.string.new_guest_session_text;
         } else {
-            titleString = R.string.guest_mode_leave_title;
-            msgString = R.string.guest_mode_leave_text;
+            titleString = R.string.exit_guest_session_title;
+            msgString = R.string.exit_guest_session_text;
         }
 
         ps.show(res.getString(titleString), res.getString(msgString), null, false);
diff --git a/mobile/android/base/GeckoApp.java b/mobile/android/base/GeckoApp.java
index b24da1b57cb4..569d7d61cedb 100644
--- a/mobile/android/base/GeckoApp.java
+++ b/mobile/android/base/GeckoApp.java
@@ -19,6 +19,7 @@ import org.mozilla.gecko.health.BrowserHealthRecorder;
 import org.mozilla.gecko.health.BrowserHealthRecorder.SessionInformation;
 import org.mozilla.gecko.updater.UpdateService;
 import org.mozilla.gecko.updater.UpdateServiceHelper;
+import org.mozilla.gecko.util.ActivityResultHandler;
 import org.mozilla.gecko.util.EventDispatcher;
 import org.mozilla.gecko.util.GeckoEventListener;
 import org.mozilla.gecko.util.GeckoEventResponder;
@@ -63,6 +64,7 @@ import android.os.PowerManager;
 import android.os.StrictMode;
 import android.preference.PreferenceManager;
 import android.provider.ContactsContract;
+import android.provider.MediaStore.Images.Media;
 
 import android.telephony.CellLocation;
 import android.telephony.NeighboringCellInfo;
@@ -691,7 +693,7 @@ abstract public class GeckoApp
                 GeckoAppShell.shareImage(src, type);
             } else if (event.equals("Wallpaper:Set")) {
                 String src = message.getString("url");
-                setImageAsWallpaper(src);
+                setImageAs(src);
             } else if (event.equals("Sanitize:ClearHistory")) {
                 handleClearHistory();
             } else if (event.equals("Update:Check")) {
@@ -971,147 +973,71 @@ abstract public class GeckoApp
         });
     }
 
-    private void setImageAsWallpaper(final String aSrc) {
-        final String progText = getString(R.string.wallpaper_progress);
-        final String successText = getString(R.string.wallpaper_success);
-        final String failureText = getString(R.string.wallpaper_fail);
-        final String fileName = aSrc.substring(aSrc.lastIndexOf("/") + 1);
-        final PendingIntent emptyIntent = PendingIntent.getActivity(this, 0, new Intent(), 0);
-        final AlertNotification notification = new AlertNotification(this, fileName.hashCode(),
-                                R.drawable.alert_download, fileName, progText, System.currentTimeMillis(), null);
-        notification.setLatestEventInfo(this, fileName, progText, emptyIntent );
-        notification.flags |= Notification.FLAG_ONGOING_EVENT;
-        notification.show();
-        new UiAsyncTask<Void, Void, Boolean>(ThreadUtils.getBackgroundHandler()) {
+    // This method starts downloading an image synchronously and displays the Chooser activity to set the image as wallpaper.
+    private void setImageAs(final String aSrc) {
+        boolean isDataURI = aSrc.startsWith("data:");
+        Bitmap image = null;
+        InputStream is = null;
+        ByteArrayOutputStream os = null;
+        try {
+            if (isDataURI) {
+                int dataStart = aSrc.indexOf(",");
+                byte[] buf = Base64.decode(aSrc.substring(dataStart+1), Base64.DEFAULT);
+                image = BitmapUtils.decodeByteArray(buf);
+            } else {
+                int byteRead;
+                byte[] buf = new byte[4192];
+                os = new ByteArrayOutputStream();
+                URL url = new URL(aSrc);
+                is = url.openStream();
 
-            @Override
-            protected Boolean doInBackground(Void... params) {
-                WallpaperManager mgr = WallpaperManager.getInstance(GeckoApp.this);
-                if (mgr == null) {
-                    return false;
+                // Cannot read from same stream twice. Also, InputStream from
+                // URL does not support reset. So converting to byte array.
+
+                while((byteRead = is.read(buf)) != -1) {
+                    os.write(buf, 0, byteRead);
                 }
+                byte[] imgBuffer = os.toByteArray();
+                image = BitmapUtils.decodeByteArray(imgBuffer);
+            }
+            if (image != null) {
+                String path = Media.insertImage(getContentResolver(),image, null, null);
+                final Intent intent = new Intent(Intent.ACTION_ATTACH_DATA);
+                intent.addCategory(Intent.CATEGORY_DEFAULT);
+                intent.setData(Uri.parse(path));
 
-                // Determine the ideal width and height of the wallpaper
-                // for the device
-
-                int idealWidth = mgr.getDesiredMinimumWidth();
-                int idealHeight = mgr.getDesiredMinimumHeight();
-
-                // Sometimes WallpaperManager's getDesiredMinimum*() methods
-                // can return 0 if a Remote Exception occurs when calling the
-                // Wallpaper Service. So if that fails, we are calculating
-                // the ideal width and height from the device's display 
-                // resolution (excluding the decorated area)
-
-                if (idealWidth <= 0 || idealHeight <= 0) {
-                    int orientation;
-                    Display defaultDisplay = getWindowManager().getDefaultDisplay();
-                    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.FROYO) {
-                        orientation = defaultDisplay.getRotation();
-                    } else {
-                        orientation = defaultDisplay.getOrientation();
-                    }
-                    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.HONEYCOMB) {
-                        Point size = new Point();
-                        defaultDisplay.getSize(size);
-                        // The ideal wallpaper width is always twice the size of
-                        // display width
-                        if (orientation == Surface.ROTATION_0 || orientation == Surface.ROTATION_270) {
-                            idealWidth = size.x * 2;
-                            idealHeight = size.y;
-                        } else {
-                            idealWidth = size.y;
-                            idealHeight = size.x * 2;
-                        }
-                    } else {
-                        if (orientation == Surface.ROTATION_0 || orientation == Surface.ROTATION_270) {
-                            idealWidth = defaultDisplay.getWidth() * 2;
-                            idealHeight = defaultDisplay.getHeight();
-                        } else {
-                            idealWidth = defaultDisplay.getHeight();
-                            idealHeight = defaultDisplay.getWidth() * 2;
-                        }
-                    }
-                }
-
-                boolean isDataURI = aSrc.startsWith("data:");
-                BitmapFactory.Options options = new BitmapFactory.Options();
-                options.inJustDecodeBounds = true;
-                Bitmap image = null;
-                InputStream is = null;
-                ByteArrayOutputStream os = null;
-                try{
-                    if (isDataURI) {
-                        int dataStart = aSrc.indexOf(',');
-                        byte[] buf = Base64.decode(aSrc.substring(dataStart+1), Base64.DEFAULT);
-                        BitmapUtils.decodeByteArray(buf, options);
-                        options.inSampleSize = getBitmapSampleSize(options, idealWidth, idealHeight);
-                        options.inJustDecodeBounds = false;
-                        image = BitmapUtils.decodeByteArray(buf, options);
-                    } else {
-                        int byteRead;
-                        byte[] buf = new byte[4192];
-                        os = new ByteArrayOutputStream();
-                        URL url = new URL(aSrc);
-                        is = url.openStream();
-
-                        // Cannot read from same stream twice. Also, InputStream from
-                        // URL does not support reset. So converting to byte array
-
-                        while((byteRead = is.read(buf)) != -1) {
-                            os.write(buf, 0, byteRead);
-                        }
-                        byte[] imgBuffer = os.toByteArray();
-                        BitmapUtils.decodeByteArray(imgBuffer, options);
-                        options.inSampleSize = getBitmapSampleSize(options, idealWidth, idealHeight);
-                        options.inJustDecodeBounds = false;
-                        image = BitmapUtils.decodeByteArray(imgBuffer, options);
-                    }
-                    if(image != null) {
-                        mgr.setBitmap(image);
-                        return true;
-                    } else {
-                        return false;
-                    }
-                } catch(OutOfMemoryError ome) {
-                    Log.e(LOGTAG, "Out of Memory when converting to byte array", ome);
-                    return false;
+                // Removes the image from storage once the chooser activity ends.
+                GeckoAppShell.sActivityHelper.startIntentForActivity(this,
+                                                                    Intent.createChooser(intent, sAppContext.getString(R.string.set_image_chooser_title)),
+                                                                    new ActivityResultHandler() {
+                                                                        @Override
+                                                                        public void onActivityResult (int resultCode, Intent data) {
+                                                                            getContentResolver().delete(intent.getData(), null, null);
+                                                                        }
+                                                                    });
+            } else {
+                Toast.makeText(sAppContext, R.string.set_image_fail, Toast.LENGTH_SHORT).show();
+            }
+        } catch(OutOfMemoryError ome) {
+            Log.e(LOGTAG, "Out of Memory when converting to byte array", ome);
+        } catch(IOException ioe) {
+            Log.e(LOGTAG, "I/O Exception while setting wallpaper", ioe);
+        } finally {
+            if (is != null) {
+                try {
+                    is.close();
                 } catch(IOException ioe) {
-                    Log.e(LOGTAG, "I/O Exception while setting wallpaper", ioe);
-                    return false;
-                } finally {
-                    if(is != null) {
-                        try {
-                            is.close();
-                        } catch(IOException ioe) {
-                            Log.w(LOGTAG, "I/O Exception while closing stream", ioe);
-                        }
-                    }
-                    if(os != null) {
-                        try {
-                            os.close();
-                        } catch(IOException ioe) {
-                            Log.w(LOGTAG, "I/O Exception while closing stream", ioe);
-                        }
-                    }
+                    Log.w(LOGTAG, "I/O Exception while closing stream", ioe);
                 }
             }
-
-            @Override
-            protected void onPostExecute(Boolean success) {
-                notification.cancel();
-                notification.flags = 0;
-                notification.flags |= Notification.FLAG_AUTO_CANCEL;
-                if(!success) {
-                    notification.tickerText = failureText;
-                    notification.setLatestEventInfo(GeckoApp.this, fileName, failureText, emptyIntent);
-                } else {
-                    notification.tickerText = successText;
-                    notification.setLatestEventInfo(GeckoApp.this, fileName, successText, emptyIntent);
+            if (os != null) {
+                try {
+                    os.close();
+                } catch(IOException ioe) {
+                    Log.w(LOGTAG, "I/O Exception while closing stream", ioe);
                 }
-                notification.show();
             }
-        }.execute();
+        }
     }
 
     private int getBitmapSampleSize(BitmapFactory.Options options, int idealWidth, int idealHeight) {
diff --git a/mobile/android/base/locales/en-US/android_strings.dtd b/mobile/android/base/locales/en-US/android_strings.dtd
index d216a333f4d2..3bab1bee8a41 100644
--- a/mobile/android/base/locales/en-US/android_strings.dtd
+++ b/mobile/android/base/locales/en-US/android_strings.dtd
@@ -195,9 +195,8 @@ size. -->
 <!ENTITY tabs_normal "Tabs">
 <!ENTITY tabs_private "Private">
 <!ENTITY tabs_synced "Synced">
-<!ENTITY wallpaper_success "Wallpaper updated">
-<!ENTITY wallpaper_progress "Setting wallpaper">
-<!ENTITY wallpaper_fail "Unable to set wallpaper">
+<!ENTITY set_image_fail "Unable to set image">
+<!ENTITY set_image_chooser_title "Set Image As">
 
 <!-- Localization note (find_text, find_prev, find_next, find_close) : These strings are used
      as alternate text for accessibility. They are not visible in the UI. -->
@@ -348,12 +347,12 @@ just addresses the organization to follow, e.g. "This site is run by " -->
 <!ENTITY updater_apply_select2 "Touch to update">
 
 <!-- Guest mode -->
-<!ENTITY enter_guest_mode "Enter guest mode">
-<!ENTITY exit_guest_mode "Leave guest mode">
-<!ENTITY guest_mode_dialog_continue "Continue">
-<!ENTITY guest_mode_dialog_cancel "Cancel">
-<!ENTITY guest_mode_enter_title "Guest mode">
-<!ENTITY guest_mode_enter_text "While in guest mode, the person using &brandShortName; will not be able to see any of your personal browsing data (like your saved passwords, history or bookmarks).\n\nWhen your guest is done, their browsing data will be deleted.">
+<!ENTITY new_guest_session "New Guest Session">
+<!ENTITY exit_guest_session "Exit Guest Session">
+<!ENTITY guest_session_dialog_continue "Continue">
+<!ENTITY guest_session_dialog_cancel "Cancel">
+<!ENTITY new_guest_session_title "&brandShortName; will now restart">
+<!ENTITY new_guest_session_text "The person using it will not be able to see any of your personal browsing data (like saved passwords, history or bookmarks).\n\nWhen your guest is done, their browsing data will be deleted and your session will be restored.">
 
-<!ENTITY guest_mode_leave_title "Leaving guest mode">
-<!ENTITY guest_mode_leave_text "&brandShortName; will delete browsing data from this session.">
+<!ENTITY exit_guest_session_title "&brandShortName; will now restart">
+<!ENTITY exit_guest_session_text "The browsing data from this session will be deleted.">
diff --git a/mobile/android/base/resources/menu-large-v11/browser_app_menu.xml b/mobile/android/base/resources/menu-large-v11/browser_app_menu.xml
index 05c8de8d0f57..3b8fab4c3348 100644
--- a/mobile/android/base/resources/menu-large-v11/browser_app_menu.xml
+++ b/mobile/android/base/resources/menu-large-v11/browser_app_menu.xml
@@ -75,11 +75,11 @@
           android:icon="@drawable/ic_menu_settings"
           android:title="@string/settings" />
 
-    <item android:id="@+id/enter_guest_mode"
+    <item android:id="@+id/new_guest_session"
           android:visible="false"
-          android:title="@string/enter_guest_mode"/>
+          android:title="@string/new_guest_session"/>
 
-    <item android:id="@+id/exit_guest_mode"
+    <item android:id="@+id/exit_guest_session"
           android:visible="false"
-          android:title="@string/exit_guest_mode"/>
+          android:title="@string/exit_guest_session"/>
 </menu>
diff --git a/mobile/android/base/resources/menu-v11/browser_app_menu.xml b/mobile/android/base/resources/menu-v11/browser_app_menu.xml
index d3084509952d..a48be42582dd 100644
--- a/mobile/android/base/resources/menu-v11/browser_app_menu.xml
+++ b/mobile/android/base/resources/menu-v11/browser_app_menu.xml
@@ -76,11 +76,11 @@
           android:icon="@drawable/ic_menu_settings"
           android:title="@string/settings" />
 
-    <item android:id="@+id/enter_guest_mode"
+    <item android:id="@+id/new_guest_session"
           android:visible="false"
-          android:title="@string/enter_guest_mode"/>
+          android:title="@string/new_guest_session"/>
 
-    <item android:id="@+id/exit_guest_mode"
+    <item android:id="@+id/exit_guest_session"
           android:visible="false"
-          android:title="@string/exit_guest_mode"/>
+          android:title="@string/exit_guest_session"/>
 </menu>
diff --git a/mobile/android/base/resources/menu-xlarge-v11/browser_app_menu.xml b/mobile/android/base/resources/menu-xlarge-v11/browser_app_menu.xml
index a85ab4f2e295..5fa54e1c87a2 100644
--- a/mobile/android/base/resources/menu-xlarge-v11/browser_app_menu.xml
+++ b/mobile/android/base/resources/menu-xlarge-v11/browser_app_menu.xml
@@ -76,11 +76,11 @@
           android:icon="@drawable/ic_menu_settings"
           android:title="@string/settings" />
 
-    <item android:id="@+id/enter_guest_mode"
+    <item android:id="@+id/new_guest_session"
           android:visible="false"
-          android:title="@string/enter_guest_mode"/>
+          android:title="@string/new_guest_session"/>
 
-    <item android:id="@+id/exit_guest_mode"
+    <item android:id="@+id/exit_guest_session"
           android:visible="false"
-          android:title="@string/exit_guest_mode"/>
+          android:title="@string/exit_guest_session"/>
 </menu>
diff --git a/mobile/android/base/resources/menu/browser_app_menu.xml b/mobile/android/base/resources/menu/browser_app_menu.xml
index 9d681e4a0735..f6122021a7f6 100644
--- a/mobile/android/base/resources/menu/browser_app_menu.xml
+++ b/mobile/android/base/resources/menu/browser_app_menu.xml
@@ -54,11 +54,11 @@
     <item android:id="@+id/settings"
           android:title="@string/settings" />
 
-    <item android:id="@+id/enter_guest_mode"
+    <item android:id="@+id/new_guest_session"
           android:visible="false"
-          android:title="@string/enter_guest_mode"/>
+          android:title="@string/new_guest_session"/>
 
-    <item android:id="@+id/exit_guest_mode"
+    <item android:id="@+id/exit_guest_session"
           android:visible="false"
-          android:title="@string/exit_guest_mode"/>
+          android:title="@string/exit_guest_session"/>
 </menu>
diff --git a/mobile/android/base/strings.xml.in b/mobile/android/base/strings.xml.in
index 7f518ae261eb..b27c1f42471c 100644
--- a/mobile/android/base/strings.xml.in
+++ b/mobile/android/base/strings.xml.in
@@ -321,23 +321,22 @@
   <!-- Search suggestions opt-in -->
   <string name="suggestions_prompt">&suggestions_prompt2;</string>
 
-  <!-- Wallpaper Notifications -->
-  <string name="wallpaper_success">&wallpaper_success;</string>
-  <string name="wallpaper_progress">&wallpaper_progress;</string>
-  <string name="wallpaper_fail">&wallpaper_fail;</string>
+  <!-- Set Image Notifications -->
+  <string name="set_image_fail">&set_image_fail;</string>
+  <string name="set_image_chooser_title">&set_image_chooser_title;</string>
 
   <!-- Contacts API -->
   <string name="contacts_account_chooser_dialog_title">Share contacts from...</string>
 
 
   <!-- Guest mode -->
-  <string name="enter_guest_mode">&enter_guest_mode;</string>
-  <string name="exit_guest_mode">&exit_guest_mode;</string>
-  <string name="guest_mode_dialog_continue">&guest_mode_dialog_continue;</string>
-  <string name="guest_mode_dialog_cancel">&guest_mode_dialog_cancel;</string>
-  <string name="guest_mode_enter_title">&guest_mode_enter_title;</string>
-  <string name="guest_mode_enter_text">&guest_mode_enter_text;</string>
+  <string name="new_guest_session">&new_guest_session;</string>
+  <string name="exit_guest_session">&exit_guest_session;</string>
+  <string name="guest_session_dialog_continue">&guest_session_dialog_continue;</string>
+  <string name="guest_session_dialog_cancel">&guest_session_dialog_cancel;</string>
+  <string name="new_guest_session_title">&new_guest_session_title;</string>
+  <string name="new_guest_session_text">&new_guest_session_text;</string>
 
-  <string name="guest_mode_leave_title">&guest_mode_leave_title;</string>
-  <string name="guest_mode_leave_text">&guest_mode_leave_text;</string>
+  <string name="exit_guest_session_title">&exit_guest_session_title;</string>
+  <string name="exit_guest_session_text">&exit_guest_session_text;</string>
 </resources>
diff --git a/mobile/android/base/tests/testMasterPassword.java.in b/mobile/android/base/tests/testMasterPassword.java.in
index e0fe583511d2..5b514d762498 100644
--- a/mobile/android/base/tests/testMasterPassword.java.in
+++ b/mobile/android/base/tests/testMasterPassword.java.in
@@ -103,7 +103,7 @@ public class testMasterPassword extends PixelTest {
 
         // Disable Master Password
         mSolo.clickOnText("^Use master password$");
-        mSolo.waitForText("^Remove Master Password$");
+        waitForText("^Remove Master Password$");
         closeTabletKeyboard();
         editPasswordField(0, password);
         mSolo.clickOnButton("OK");
@@ -123,13 +123,13 @@ public class testMasterPassword extends PixelTest {
     }
 
     public void noDoorhangerDisplayed(String LOGIN_URL) {
-        mSolo.waitForText("Browser Blank Page 01 | Enter Search or Address");
+        waitForText("Browser Blank Page 01|Enter Search or Address");
         loadUrl(LOGIN_URL);
         mAsserter.is(waitForText("Save password for"), false, "Doorhanger notification is hidden");
     }
 
     public void doorhangerDisplayed(String LOGIN_URL) {
-        mSolo.waitForText("Browser Blank Page 01 | Enter Search or Address");
+        waitForText("Browser Blank Page 01|Enter Search or Address");
         loadUrl(LOGIN_URL);
         mAsserter.is(mSolo.waitForText("Save password for"), true, "Doorhanger notification is displayed");
     }
diff --git a/mobile/android/base/tests/testWebContentContextMenu.java.in b/mobile/android/base/tests/testWebContentContextMenu.java.in
index de12102a0db5..ec75831abbb0 100644
--- a/mobile/android/base/tests/testWebContentContextMenu.java.in
+++ b/mobile/android/base/tests/testWebContentContextMenu.java.in
@@ -23,7 +23,7 @@ public class testWebContentContextMenu extends PixelTest {
         String urls [] = { "/robocop/robocop_big_link.html", "/robocop/robocop_big_mailto.html", "/robocop/robocop_picture_link.html"};
         String linkMenuItems [] = { "Open Link in New Tab", "Open Link in Private Tab", "Copy Link", "Share Link", "Bookmark Link"};
         String mailtoMenuItems [] = { "Open With an App", "Copy Email Address", "Share Email Address"};
-        String photoMenuItems [] = { "Copy Image Location", "Share Image", "Set as Wallpaper", "Save Image"};
+        String photoMenuItems [] = { "Copy Image Location", "Share Image", "Set Image As", "Save Image"};
 
         verfyLinkContextMenu(linkMenuItems, urls);
         verfyMailtoContextMenu(mailtoMenuItems, urls);
@@ -192,7 +192,7 @@ public class testWebContentContextMenu extends PixelTest {
                     mSolo.waitForText("Picture Link");
                 }
                 else {
-                    if (opt.equals("Set as Wallpaper")) {
+                    if (opt.equals("Set Image As")) {
                         openContextMenu(2, urls);
                         mAsserter.ok(mSolo.waitForText(opt), "Waiting for  " + opt + "  option", "The " + opt + "  option is present");
                     }
diff --git a/mobile/android/chrome/content/browser.js b/mobile/android/chrome/content/browser.js
index 093d256628ad..2b91d37fb0c3 100644
--- a/mobile/android/chrome/content/browser.js
+++ b/mobile/android/chrome/content/browser.js
@@ -595,8 +595,7 @@ var BrowserApp = {
                                       aTarget.ownerDocument);
       });
 
-#ifdef MOZ_ANDROID_WALLPAPER
-    NativeWindow.contextmenus.add(Strings.browser.GetStringFromName("contextmenu.setWallpaper"),
+    NativeWindow.contextmenus.add(Strings.browser.GetStringFromName("contextmenu.setImageAs"),
       NativeWindow.contextmenus.imageSaveableContext,
       function(aTarget) {
         let src = aTarget.src;
@@ -605,7 +604,6 @@ var BrowserApp = {
           url: src
         });
       });
-#endif
 
     NativeWindow.contextmenus.add(
       function(aTarget) {
diff --git a/mobile/android/confvars.sh b/mobile/android/confvars.sh
index 479c361d366a..5789d5e3309d 100644
--- a/mobile/android/confvars.sh
+++ b/mobile/android/confvars.sh
@@ -19,9 +19,6 @@ MOZ_DISABLE_CRYPTOLEGACY=1
 # Enable getUserMedia
 MOZ_MEDIA_NAVIGATOR=1
 
-# Enable SET_WALLPAPER permission
-MOZ_ANDROID_WALLPAPER=1
-
 # Enable NFC permission
 MOZ_ANDROID_BEAM=1
 
diff --git a/mobile/android/locales/en-US/chrome/browser.properties b/mobile/android/locales/en-US/chrome/browser.properties
index 7608c1717ab0..0101ccdf999f 100644
--- a/mobile/android/locales/en-US/chrome/browser.properties
+++ b/mobile/android/locales/en-US/chrome/browser.properties
@@ -170,7 +170,7 @@ contextmenu.shareImage=Share Image
 # the text you have selected. %S is the name of the search engine. For example, "Google".
 contextmenu.search=%S Search
 contextmenu.saveImage=Save Image
-contextmenu.setWallpaper=Set as Wallpaper
+contextmenu.setImageAs=Set Image As
 contextmenu.addSearchEngine=Add Search Engine
 contextmenu.playMedia=Play
 contextmenu.pauseMedia=Pause
diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index 3e36e6b2ae91..b63ceef0e44e 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -4088,6 +4088,8 @@ pref("layers.offmainthreadcomposition.async-animations", false);
 // Whether to prefer normal memory over shared memory. Ignored with cross-process compositing
 pref("layers.prefer-memory-over-shmem", true);
 
+pref("layers.bufferrotation.enabled", true);
+
 #ifdef MOZ_X11
 #ifdef MOZ_WIDGET_GTK2
 pref("gfx.xrender.enabled",true);
diff --git a/security/manager/boot/src/nsSTSPreloadList.errors b/security/manager/boot/src/nsSTSPreloadList.errors
index b686a5458a74..07dc90280f83 100644
--- a/security/manager/boot/src/nsSTSPreloadList.errors
+++ b/security/manager/boot/src/nsSTSPreloadList.errors
@@ -24,16 +24,17 @@ dl.google.com: did not receive HSTS header
 docs.google.com: did not receive HSTS header
 drive.google.com: did not receive HSTS header
 dropcam.com: did not receive HSTS header
-emailprivacytester.com: max-age too low: 8640000
+emailprivacytester.com: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIStrictTransportSecurityService.processStsHeader]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: /builds/slave/m-cen-l64-hsts-000000000000000/getHSTSPreloadList.js :: processStsHeader :: line 123"  data: no]
 encrypted.google.com: did not receive HSTS header
 epoxate.com: max-age too low: 259200
 fatzebra.com.au: did not receive HSTS header
 fj.simple.com: did not receive HSTS header
 gmail.com: did not receive HSTS header
+gocardless.com: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIStrictTransportSecurityService.processStsHeader]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: /builds/slave/m-cen-l64-hsts-000000000000000/getHSTSPreloadList.js :: processStsHeader :: line 123"  data: no]
 googlemail.com: did not receive HSTS header
 googleplex.com: could not connect to host
 greplin.com: did not receive HSTS header
-grepular.com: max-age too low: 8640000
+grepular.com: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIStrictTransportSecurityService.processStsHeader]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: /builds/slave/m-cen-l64-hsts-000000000000000/getHSTSPreloadList.js :: processStsHeader :: line 123"  data: no]
 groups.google.com: did not receive HSTS header
 health.google.com: did not receive HSTS header
 history.google.com: did not receive HSTS header
@@ -85,6 +86,7 @@ www.dropcam.com: max-age too low: 2592000
 www.elanex.biz: did not receive HSTS header
 www.gmail.com: did not receive HSTS header
 www.googlemail.com: did not receive HSTS header
+www.gov.uk: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIStrictTransportSecurityService.processStsHeader]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: /builds/slave/m-cen-l64-hsts-000000000000000/getHSTSPreloadList.js :: processStsHeader :: line 123"  data: no]
 www.greplin.com: did not receive HSTS header
 www.jitsi.org: did not receive HSTS header
 www.lastpass.com: did not receive HSTS header
@@ -93,6 +95,7 @@ www.logentries.com: did not receive HSTS header
 www.moneybookers.com: did not receive HSTS header
 www.neonisi.com: could not connect to host
 www.paycheckrecords.com: max-age too low: 86400
-www.paypal.com: max-age too low: 14400
+www.paypal.com: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIStrictTransportSecurityService.processStsHeader]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: /builds/slave/m-cen-l64-hsts-000000000000000/getHSTSPreloadList.js :: processStsHeader :: line 123"  data: no]
 www.sandbox.mydigipass.com: could not connect to host
 www.surfeasy.com: did not receive HSTS header
+zoo24.de: did not receive HSTS header
diff --git a/security/manager/boot/src/nsSTSPreloadList.inc b/security/manager/boot/src/nsSTSPreloadList.inc
index 881b9265ef5a..cf9fd8808653 100644
--- a/security/manager/boot/src/nsSTSPreloadList.inc
+++ b/security/manager/boot/src/nsSTSPreloadList.inc
@@ -8,7 +8,7 @@
 /*****************************************************************************/
 
 #include <stdint.h>
-const PRTime gPreloadListExpirationTime = INT64_C(1385805971022000);
+const PRTime gPreloadListExpirationTime = INT64_C(1386411284101000);
 
 class nsSTSPreload
 {
@@ -53,8 +53,8 @@ static const nsSTSPreload kSTSPreloadList[] = {
   { "factor.cc", false },
   { "forum.linode.com", false },
   { "forum.quantifiedself.com", true },
-  { "gocardless.com", true },
   { "grc.com", false },
+  { "haste.ch", true },
   { "howrandom.org", true },
   { "id.mayfirst.org", false },
   { "inertianetworks.com", true },
@@ -117,7 +117,6 @@ static const nsSTSPreload kSTSPreloadList[] = {
   { "www.cueup.com", false },
   { "www.cyveillance.com", true },
   { "www.entropia.de", false },
-  { "www.gov.uk", false },
   { "www.grc.com", false },
   { "www.intercom.io", false },
   { "www.irccloud.com", false },
@@ -131,5 +130,4 @@ static const nsSTSPreload kSTSPreloadList[] = {
   { "www.therapynotes.com", false },
   { "www.torproject.org", false },
   { "www.twitter.com", false },
-  { "zoo24.de", true },
 };
diff --git a/testing/mochitest/mochitest_options.py b/testing/mochitest/mochitest_options.py
index b7a09ef142e9..75b870a9555e 100644
--- a/testing/mochitest/mochitest_options.py
+++ b/testing/mochitest/mochitest_options.py
@@ -468,7 +468,7 @@ class MochitestOptions(optparse.OptionParser):
 
         if not options.mozInfo:
             if build_obj:
-                options.mozInfo = os.path.join(build_obj.get_binary_path(), 'mozinfo.json')
+                options.mozInfo = os.path.join(build_obj.topobjdir, 'mozinfo.json')
             else:
                 options.mozInfo = os.path.abspath('mozinfo.json')
 
diff --git a/toolkit/components/jsdownloads/src/DownloadCore.jsm b/toolkit/components/jsdownloads/src/DownloadCore.jsm
index 3ecadcf4553b..e3dbe109e0c4 100644
--- a/toolkit/components/jsdownloads/src/DownloadCore.jsm
+++ b/toolkit/components/jsdownloads/src/DownloadCore.jsm
@@ -311,10 +311,11 @@ Download.prototype = {
       }
     }
 
-    // This function propragates download properties from the DownloadSaver
+    // This function propagates download properties from the DownloadSaver
     // object, unless it comes in late from a download attempt that was
     // replaced by a new one.
-    function DS_setDownloadProperties(aOptions) {
+    function DS_setProperties(aOptions)
+    {
       if (this._currentAttempt && this._currentAttempt != currentAttempt) {
         return;
       }
@@ -359,7 +360,7 @@ Download.prototype = {
       try {
         // Execute the actual download through the saver object.
         yield this.saver.execute(DS_setProgressBytes.bind(this),
-                                 DS_setDownloadProperties.bind(this));
+                                 DS_setProperties.bind(this));
 
         // Update the status properties for a successful download.
         this.progress = 100;
@@ -1018,7 +1019,7 @@ DownloadSaver.prototype = {
    *        transferred (or -1 if unknown), the third indicates whether the
    *        partially downloaded data can be used when restarting the download
    *        if it fails or is canceled.
-   * @parem aSetPropertiesFn
+   * @param aSetPropertiesFn
    *        This function may be called by the saver to report information
    *        about new download properties discovered by the saver during the
    *        download process. It takes an object where the keys represents
@@ -1233,13 +1234,13 @@ DownloadCopySaver.prototype = {
             onStartRequest: function (aRequest, aContext) {
               backgroundFileSaver.onStartRequest(aRequest, aContext);
 
+              aSetPropertiesFn({ contentType: channel.contentType });
+
               // Ensure we report the value of "Content-Length", if available,
               // even if the download doesn't generate any progress events
               // later.
-              if (aRequest instanceof Ci.nsIChannel &&
-                  aRequest.contentLength >= 0) {
-                aSetProgressBytesFn(0, aRequest.contentLength);
-                aSetPropertiesFn({ contentType: aRequest.contentType });
+              if (channel.contentLength >= 0) {
+                aSetProgressBytesFn(0, channel.contentLength);
               }
 
               if (keepPartialData) {
diff --git a/toolkit/components/jsdownloads/src/DownloadIntegration.jsm b/toolkit/components/jsdownloads/src/DownloadIntegration.jsm
index 02c992b720d2..fd22e29ed5b7 100644
--- a/toolkit/components/jsdownloads/src/DownloadIntegration.jsm
+++ b/toolkit/components/jsdownloads/src/DownloadIntegration.jsm
@@ -343,24 +343,26 @@ this.DownloadIntegration = {
         }
 
         // Custom application chosen
-        mimeInfo.preferredAction = Ci.nsIMIMEInfo.useHelperApp;
-
         let localHandlerApp = Cc["@mozilla.org/uriloader/local-handler-app;1"]
                                 .createInstance(Ci.nsILocalHandlerApp);
         localHandlerApp.executable = new FileUtils.File(aDownload.launcherPath);
 
+        mimeInfo.preferredApplicationHandler = localHandlerApp;
+        mimeInfo.preferredAction = Ci.nsIMIMEInfo.useHelperApp;
+
+        // In test mode, allow the test to verify the nsIMIMEInfo instance.
         if (this.dontOpenFileAndFolder) {
-          throw new Task.Result("chosen-app");
+          throw new Task.Result(mimeInfo);
         }
 
         mimeInfo.launchWithFile(file);
         return;
       }
 
-      // No custom application chosen, let's launch the file with the
-      // default handler
+      // No custom application chosen, let's launch the file with the default
+      // handler.  In test mode, we indicate this with a null value.
       if (this.dontOpenFileAndFolder) {
-        throw new Task.Result("default-handler");
+        throw new Task.Result(null);
       }
 
       // First let's try to launch it through the MIME service application
diff --git a/toolkit/components/jsdownloads/src/DownloadLegacy.js b/toolkit/components/jsdownloads/src/DownloadLegacy.js
index 75d55266bef3..4326c02c08cc 100644
--- a/toolkit/components/jsdownloads/src/DownloadLegacy.js
+++ b/toolkit/components/jsdownloads/src/DownloadLegacy.js
@@ -164,16 +164,16 @@ DownloadLegacyTransfer.prototype = {
   init: function DLT_init(aSource, aTarget, aDisplayName, aMIMEInfo, aStartTime,
                           aTempFile, aCancelable, aIsPrivate)
   {
-
-    let launchWhenSuccedded = false, contentType = null, launcherPath = null;
+    let launchWhenSucceeded = false, contentType = null, launcherPath = null;
 
     if (aMIMEInfo instanceof Ci.nsIMIMEInfo) {
-      launchWhenSuccedded = aMIMEInfo.preferredAction != Ci.nsIMIMEInfo.saveToDisk;
+      launchWhenSucceeded =
+                aMIMEInfo.preferredAction != Ci.nsIMIMEInfo.saveToDisk;
       contentType = aMIMEInfo.type;
-      let appHandler = aMIMEInfo.preferredApplicationHandler;
 
+      let appHandler = aMIMEInfo.preferredApplicationHandler;
       if (appHandler instanceof Ci.nsILocalHandlerApp) {
-        launcherPath = localHandler.executable.path;
+        launcherPath = appHandler.executable.path;
       }
     }
 
@@ -185,7 +185,7 @@ DownloadLegacyTransfer.prototype = {
       target: { path: aTarget.QueryInterface(Ci.nsIFileURL).file.path,
                 partFilePath: aTempFile && aTempFile.path },
       saver: "legacy",
-      launchWhenSuccedded: launchWhenSuccedded,
+      launchWhenSucceeded: launchWhenSucceeded,
       contentType: contentType,
       launcherPath: launcherPath
     }).then(function DLT_I_onDownload(aDownload) {
diff --git a/toolkit/components/jsdownloads/test/unit/common_test_Download.js b/toolkit/components/jsdownloads/test/unit/common_test_Download.js
index 9bf308b429c3..6638982272c3 100644
--- a/toolkit/components/jsdownloads/test/unit/common_test_Download.js
+++ b/toolkit/components/jsdownloads/test/unit/common_test_Download.js
@@ -354,6 +354,9 @@ add_task(function test_empty_progress()
   do_check_eq(download.currentBytes, 0);
   do_check_eq(download.totalBytes, 0);
 
+  // We should have received the content type even for an empty file.
+  do_check_eq(download.contentType, "text/plain");
+
   do_check_eq((yield OS.File.stat(download.target.path)).size, 0);
 });
 
@@ -419,6 +422,9 @@ add_task(function test_empty_noprogress()
   continueResponses();
   yield promiseDownloadStopped(download);
 
+  // We should have received the content type even if no progress is reported.
+  do_check_eq(download.contentType, "text/plain");
+
   // Verify the state of the completed download.
   do_check_true(download.stopped);
   do_check_false(download.hasProgress);
@@ -1401,35 +1407,65 @@ add_task(function test_showContainingDirectory() {
  * download.launch() action
  */
 add_task(function test_launch() {
-  let targetPath = getTempFile(TEST_TARGET_FILE_NAME).path;
+  let customLauncher = getTempFile("app-launcher");
 
+  // Test both with and without setting a custom application.
+  for (let launcherPath of [null, customLauncher.path]) {
+    let download;
+    if (!gUseLegacySaver) {
+      // When testing DownloadCopySaver, we have control over the download, thus
+      // we can test that file is not launched if download.succeeded is not set.
+      download = yield Downloads.createDownload({
+        source: httpUrl("source.txt"),
+        target: getTempFile(TEST_TARGET_FILE_NAME).path,
+        launcherPath: launcherPath,
+      });
+
+      try {
+        yield download.launch();
+        do_throw("Can't launch download file as it has not completed yet");
+      } catch (ex) {
+        do_check_eq(ex.message,
+                    "launch can only be called if the download succeeded");
+      }
+
+      yield download.start();
+    } else {
+      // When testing DownloadLegacySaver, the download is already started when
+      // it is created, thus we don't test calling "launch" before starting.
+      download = yield promiseStartLegacyDownload(
+                                         httpUrl("source.txt"),
+                                         { launcherPath: launcherPath });
+      yield promiseDownloadStopped(download);
+    }
+
+    do_check_false(download.launchWhenSucceeded);
+
+    DownloadIntegration._deferTestOpenFile = Promise.defer();
+    download.launch();
+    let result = yield DownloadIntegration._deferTestOpenFile.promise;
+
+    // Verify that the results match the test case.
+    if (!launcherPath) {
+      // This indicates that the default handler has been chosen.
+      do_check_true(result === null);
+    } else {
+      // Check the nsIMIMEInfo instance that would have been used for launching.
+      do_check_eq(result.preferredAction, Ci.nsIMIMEInfo.useHelperApp);
+      do_check_true(result.preferredApplicationHandler
+                          .QueryInterface(Ci.nsILocalHandlerApp)
+                          .executable.equals(customLauncher));
+    }
+  }
+});
+
+/**
+ * Test passing an invalid path as the launcherPath property.
+ */
+add_task(function test_launcherPath_invalid() {
   let download = yield Downloads.createDownload({
     source: { url: httpUrl("source.txt") },
-    target: { path: targetPath }
-  });
-
-  // Test that file is not launched if this.succeeded is not set.
-  // i.e., download has not yet completed.
-  try {
-    yield download.launch();
-    do_throw("Can't launch download file as it has not completed yet");
-  } catch (ex) {
-    do_check_eq(ex.message, "launch can only be called if the download succeeded")
-  }
-
-  // Test that the file can be launched after download is completed.
-  DownloadIntegration._deferTestOpenFile = Promise.defer();
-  yield download.start();
-  download.launch();
-  let result = yield DownloadIntegration._deferTestOpenFile.promise;
-  do_check_eq(result, "default-handler");
-
-
-  // Test that a proper error will be thrown if an invalid
-  // custom handler was chosen.
-  download = yield Downloads.createDownload({
-    source: { url: httpUrl("source.txt") },
-    target: { path: targetPath },
+    target: { path: getTempFile(TEST_TARGET_FILE_NAME).path },
     launcherPath: " "
   });
 
@@ -1446,21 +1482,6 @@ add_task(function test_launch() {
                       ex.result == Cr.NS_ERROR_FAILURE;
     do_check_true(validResult);
   }
-
-  // Test that the custom app chosen will be used
-  // if launcherPath is set.
-  download = yield Downloads.createDownload({
-    source: { url: httpUrl("source.txt") },
-    target: { path: targetPath },
-    launcherPath: getTempFile("app-launcher").path
-  });
-
-  DownloadIntegration._deferTestOpenFile = Promise.defer();
-  yield download.start();
-  download.launch();
-  result = yield DownloadIntegration._deferTestOpenFile.promise;
-  do_check_eq(result, "chosen-app");
-
 });
 
 /**
@@ -1468,44 +1489,50 @@ add_task(function test_launch() {
  * the download finishes if download.launchWhenSucceeded = true
  */
 add_task(function test_launchWhenSucceeded() {
-  let targetPath = getTempFile(TEST_TARGET_FILE_NAME).path;
+  let customLauncher = getTempFile("app-launcher");
 
-  let download = yield Downloads.createDownload({
-    source: { url: httpUrl("source.txt") },
-    target: { path: targetPath },
-    launchWhenSucceeded: true,
-  });
+  // Test both with and without setting a custom application.
+  for (let launcherPath of [null, customLauncher.path]) {
+    DownloadIntegration._deferTestOpenFile = Promise.defer();
 
-  // Test that the default handler will be used if no
-  // custom handler was chosen.
-  DownloadIntegration._deferTestOpenFile = Promise.defer();
-  download.start();
-  let result = yield DownloadIntegration._deferTestOpenFile.promise;
-  do_check_eq(result, "default-handler");
+    if (!gUseLegacySaver) {
+      let download = yield Downloads.createDownload({
+        source: httpUrl("source.txt"),
+        target: getTempFile(TEST_TARGET_FILE_NAME).path,
+        launchWhenSucceeded: true,
+        launcherPath: launcherPath,
+      });
+      yield download.start();
+    } else {
+      let download = yield promiseStartLegacyDownload(
+                                             httpUrl("source.txt"),
+                                             { launcherPath: launcherPath,
+                                               launchWhenSucceeded: true });
+      yield promiseDownloadStopped(download);
+    }
 
+    let result = yield DownloadIntegration._deferTestOpenFile.promise;
 
-  // Test that the custom app chosen will be used
-  // if launcherPath is set.
-  download = yield Downloads.createDownload({
-    source: { url: httpUrl("source.txt") },
-    target: { path: targetPath },
-    launchWhenSucceeded: true,
-    launcherPath: getTempFile("app-launcher").path
-  });
-
-  DownloadIntegration._deferTestOpenFile = Promise.defer();
-  yield download.start();
-  result = yield DownloadIntegration._deferTestOpenFile.promise;
-  do_check_eq(result, "chosen-app");
+    // Verify that the results match the test case.
+    if (!launcherPath) {
+      // This indicates that the default handler has been chosen.
+      do_check_true(result === null);
+    } else {
+      // Check the nsIMIMEInfo instance that would have been used for launching.
+      do_check_eq(result.preferredAction, Ci.nsIMIMEInfo.useHelperApp);
+      do_check_true(result.preferredApplicationHandler
+                          .QueryInterface(Ci.nsILocalHandlerApp)
+                          .executable.equals(customLauncher));
+    }
+  }
 });
 
 /**
- * Tests that the proper content type is set for a download.
+ * Tests that the proper content type is set for a normal download.
  */
 add_task(function test_contentType() {
   let download = yield promiseStartDownload(httpUrl("source.txt"));
-
   yield promiseDownloadStopped(download);
+
   do_check_eq("text/plain", download.contentType);
 });
-
diff --git a/toolkit/components/jsdownloads/test/unit/head.js b/toolkit/components/jsdownloads/test/unit/head.js
index 5322547034b8..181652a17bc7 100644
--- a/toolkit/components/jsdownloads/test/unit/head.js
+++ b/toolkit/components/jsdownloads/test/unit/head.js
@@ -203,6 +203,10 @@ function promiseNewDownload(aSourceUrl) {
  *          targetFile: nsIFile for the target, or null to use a temporary file.
  *          outPersist: Receives a reference to the created nsIWebBrowserPersist
  *                      instance.
+ *          launchWhenSucceeded: Boolean indicating whether the target should
+ *                               be launched when it has completed successfully.
+ *          launcherPath: String containing the path of the custom executable to
+ *                        use to launch the target of the download.
  *        }
  *
  * @return {Promise}
@@ -229,11 +233,27 @@ function promiseStartLegacyDownload(aSourceUrl, aOptions) {
 
   if (fileExtension) {
     try {
-      mimeInfo = gMIMEService.getFromTypeAndExtension(null,
-                                                      fileExtension);
+      mimeInfo = gMIMEService.getFromTypeAndExtension(null, fileExtension);
+      mimeInfo.preferredAction = Ci.nsIMIMEInfo.saveToDisk;
     } catch (ex) { }
   }
 
+  if (aOptions && aOptions.launcherPath) {
+    do_check_true(mimeInfo != null);
+
+    let localHandlerApp = Cc["@mozilla.org/uriloader/local-handler-app;1"]
+                            .createInstance(Ci.nsILocalHandlerApp);
+    localHandlerApp.executable = new FileUtils.File(aOptions.launcherPath);
+
+    mimeInfo.preferredApplicationHandler = localHandlerApp;
+  }
+
+  if (aOptions && aOptions.launchWhenSucceeded) {
+    do_check_true(mimeInfo != null);
+
+    mimeInfo.preferredAction = Ci.nsIMIMEInfo.useHelperApp;
+  }
+
   // Apply decoding if required by the "Content-Encoding" header.
   persist.persistFlags &= ~Ci.nsIWebBrowserPersist.PERSIST_FLAGS_NO_CONVERSION;
 
@@ -268,8 +288,8 @@ function promiseStartLegacyDownload(aSourceUrl, aOptions) {
 
     // Initialize the components so they reference each other.  This will cause
     // the Download object to be created and added to the public downloads.
-    transfer.init(sourceURI, NetUtil.newURI(targetFile), null, mimeInfo, null, null,
-                  persist, isPrivate);
+    transfer.init(sourceURI, NetUtil.newURI(targetFile), null, mimeInfo, null,
+                  null, persist, isPrivate);
     persist.progressListener = transfer;
 
     // Start the actual download process.
diff --git a/toolkit/components/jsdownloads/test/unit/test_DownloadList.js b/toolkit/components/jsdownloads/test/unit/test_DownloadList.js
index 4a50fee055eb..aeaca97f53c2 100644
--- a/toolkit/components/jsdownloads/test/unit/test_DownloadList.js
+++ b/toolkit/components/jsdownloads/test/unit/test_DownloadList.js
@@ -159,6 +159,47 @@ add_task(function test_notifications_change()
   do_check_false(receivedOnDownloadChanged);
 });
 
+/**
+ * Checks that the reference to "this" is correct in the view callbacks.
+ */
+add_task(function test_notifications_this()
+{
+  let list = yield promiseNewDownloadList();
+
+  // Check that we receive change notifications.
+  let receivedOnDownloadAdded = false;
+  let receivedOnDownloadChanged = false;
+  let receivedOnDownloadRemoved = false;
+  let view = {
+    onDownloadAdded: function () {
+      do_check_eq(this, view);
+      receivedOnDownloadAdded = true;
+    },
+    onDownloadChanged: function () {
+      // Only do this check once.
+      if (!receivedOnDownloadChanged) {
+        do_check_eq(this, view);
+        receivedOnDownloadChanged = true;
+      }
+    },
+    onDownloadRemoved: function () {
+      do_check_eq(this, view);
+      receivedOnDownloadRemoved = true;
+    },
+  };
+  list.addView(view);
+
+  let download = yield promiseNewDownload();
+  list.add(download);
+  yield download.start();
+  list.remove(download);
+
+  // Verify that we executed the checks.
+  do_check_true(receivedOnDownloadAdded);
+  do_check_true(receivedOnDownloadChanged);
+  do_check_true(receivedOnDownloadRemoved);
+});
+
 /**
  * Checks that download is removed on history expiration.
  */
diff --git a/toolkit/components/places/PlacesUtils.jsm b/toolkit/components/places/PlacesUtils.jsm
index 236191200f72..d500083cf660 100644
--- a/toolkit/components/places/PlacesUtils.jsm
+++ b/toolkit/components/places/PlacesUtils.jsm
@@ -772,28 +772,19 @@ this.PlacesUtils = {
    * @param aURI
    *        The URI for which annotations are to be retrieved.
    * @return Array of objects, each containing the following properties:
-   *         name, flags, expires, mimeType, type, value
+   *         name, flags, expires, value
    */
   getAnnotationsForURI: function PU_getAnnotationsForURI(aURI) {
     var annosvc = this.annotations;
     var annos = [], val = null;
     var annoNames = annosvc.getPageAnnotationNames(aURI);
     for (var i = 0; i < annoNames.length; i++) {
-      var flags = {}, exp = {}, mimeType = {}, storageType = {};
-      annosvc.getPageAnnotationInfo(aURI, annoNames[i], flags, exp, mimeType, storageType);
-      if (storageType.value == annosvc.TYPE_BINARY) {
-        var data = {}, length = {}, mimeType = {};
-        annosvc.getPageAnnotationBinary(aURI, annoNames[i], data, length, mimeType);
-        val = data.value;
-      }
-      else
-        val = annosvc.getPageAnnotation(aURI, annoNames[i]);
-
+      var flags = {}, exp = {}, storageType = {};
+      annosvc.getPageAnnotationInfo(aURI, annoNames[i], flags, exp, storageType);
+      val = annosvc.getPageAnnotation(aURI, annoNames[i]);
       annos.push({name: annoNames[i],
                   flags: flags.value,
                   expires: exp.value,
-                  mimeType: mimeType.value,
-                  type: storageType.value,
                   value: val});
     }
     return annos;
@@ -813,21 +804,12 @@ this.PlacesUtils = {
     var annos = [], val = null;
     var annoNames = annosvc.getItemAnnotationNames(aItemId);
     for (var i = 0; i < annoNames.length; i++) {
-      var flags = {}, exp = {}, mimeType = {}, storageType = {};
-      annosvc.getItemAnnotationInfo(aItemId, annoNames[i], flags, exp, mimeType, storageType);
-      if (storageType.value == annosvc.TYPE_BINARY) {
-        var data = {}, length = {}, mimeType = {};
-        annosvc.geItemAnnotationBinary(aItemId, annoNames[i], data, length, mimeType);
-        val = data.value;
-      }
-      else
-        val = annosvc.getItemAnnotation(aItemId, annoNames[i]);
-
+      var flags = {}, exp = {}, storageType = {};
+      annosvc.getItemAnnotationInfo(aItemId, annoNames[i], flags, exp, storageType);
+      val = annosvc.getItemAnnotation(aItemId, annoNames[i]);
       annos.push({name: annoNames[i],
                   flags: flags.value,
                   expires: exp.value,
-                  mimeType: mimeType.value,
-                  type: storageType.value,
                   value: val});
     }
     return annos;
@@ -839,27 +821,21 @@ this.PlacesUtils = {
    *        The URI for which annotations are to be set.
    * @param aAnnotations
    *        Array of objects, each containing the following properties:
-   *        name, flags, expires, type, mimeType (only used for binary
-   *        annotations) value.
+   *        name, flags, expires.
    *        If the value for an annotation is not set it will be removed.
    */
   setAnnotationsForURI: function PU_setAnnotationsForURI(aURI, aAnnos) {
     var annosvc = this.annotations;
     aAnnos.forEach(function(anno) {
-      if (!anno.value) {
+      if (anno.value === undefined || anno.value === null) {
         annosvc.removePageAnnotation(aURI, anno.name);
-        return;
       }
-      var flags = ("flags" in anno) ? anno.flags : 0;
-      var expires = ("expires" in anno) ?
-        anno.expires : Ci.nsIAnnotationService.EXPIRE_NEVER;
-      if (anno.type == annosvc.TYPE_BINARY) {
-        annosvc.setPageAnnotationBinary(aURI, anno.name, anno.value,
-                                        anno.value.length, anno.mimeType,
-                                        flags, expires);
-      }
-      else
+      else {
+        let flags = ("flags" in anno) ? anno.flags : 0;
+        let expires = ("expires" in anno) ?
+          anno.expires : Ci.nsIAnnotationService.EXPIRE_NEVER;
         annosvc.setPageAnnotation(aURI, anno.name, anno.value, flags, expires);
+      }
     });
   },
 
@@ -869,27 +845,20 @@ this.PlacesUtils = {
    *        The identifier of the item for which annotations are to be set
    * @param aAnnotations
    *        Array of objects, each containing the following properties:
-   *        name, flags, expires, type, mimeType (only used for binary
-   *        annotations) value.
+   *        name, flags, expires.
    *        If the value for an annotation is not set it will be removed.
    */
   setAnnotationsForItem: function PU_setAnnotationsForItem(aItemId, aAnnos) {
     var annosvc = this.annotations;
 
     aAnnos.forEach(function(anno) {
-      if (!anno.value) {
+      if (anno.value === undefined || anno.value === null) {
         annosvc.removeItemAnnotation(aItemId, anno.name);
-        return;
-      }
-      var flags = ("flags" in anno) ? anno.flags : 0;
-      var expires = ("expires" in anno) ?
-        anno.expires : Ci.nsIAnnotationService.EXPIRE_NEVER;
-      if (anno.type == annosvc.TYPE_BINARY) {
-        annosvc.setItemAnnotationBinary(aItemId, anno.name, anno.value,
-                                        anno.value.length, anno.mimeType,
-                                        flags, expires);
       }
       else {
+        let flags = ("flags" in anno) ? anno.flags : 0;
+        let expires = ("expires" in anno) ?
+          anno.expires : Ci.nsIAnnotationService.EXPIRE_NEVER;
         annosvc.setItemAnnotation(aItemId, anno.name, anno.value, flags,
                                   expires);
       }
@@ -2700,8 +2669,7 @@ PlacesEditBookmarkURITransaction.prototype = {
  *        id of the item where to set annotation
  * @param aAnnotationObject
  *        Object representing an annotation, containing the following
- *        properties: name, flags, expires, type, mimeType (only used for
- *        binary annotations), value.
+ *        properties: name, flags, expires, value.
  *        If value is null the annotation will be removed
  *
  * @return nsITransaction object
@@ -2723,9 +2691,9 @@ PlacesSetItemAnnotationTransaction.prototype = {
     let annoName = this.new.annotations[0].name;
     if (PlacesUtils.annotations.itemHasAnnotation(this.item.id, annoName)) {
       // fill the old anno if it is set
-      let flags = {}, expires = {}, mimeType = {}, type = {};
+      let flags = {}, expires = {}, type = {};
       PlacesUtils.annotations.getItemAnnotationInfo(this.item.id, annoName, flags,
-                                                    expires, mimeType, type);
+                                                    expires, type);
       let value = PlacesUtils.annotations.getItemAnnotation(this.item.id,
                                                             annoName);
       this.item.annotations = [{ name: annoName,
@@ -2737,7 +2705,6 @@ PlacesSetItemAnnotationTransaction.prototype = {
     else {
       // create an empty old anno
       this.item.annotations = [{ name: annoName,
-                                type: Ci.nsIAnnotationService.TYPE_STRING,
                                 flags: 0,
                                 value: null,
                                 expires: Ci.nsIAnnotationService.EXPIRE_NEVER }];
@@ -2760,8 +2727,7 @@ PlacesSetItemAnnotationTransaction.prototype = {
  *        URI of the page where to set annotation
  * @param aAnnotationObject
  *        Object representing an annotation, containing the following
- *        properties: name, flags, expires, type, mimeType (only used for
- *        binary annotations), value.
+ *        properties: name, flags, expires, value.
  *        If value is null the annotation will be removed
  *
  * @return nsITransaction object
@@ -2783,13 +2749,12 @@ PlacesSetPageAnnotationTransaction.prototype = {
     let annoName = this.new.annotations[0].name;
     if (PlacesUtils.annotations.pageHasAnnotation(this.item.uri, annoName)) {
       // fill the old anno if it is set
-      let flags = {}, expires = {}, mimeType = {}, type = {};
+      let flags = {}, expires = {}, type = {};
       PlacesUtils.annotations.getPageAnnotationInfo(this.item.uri, annoName, flags,
-                                                    expires, mimeType, type);
+                                                    expires, type);
       let value = PlacesUtils.annotations.getPageAnnotation(this.item.uri,
                                                             annoName);
       this.item.annotations = [{ name: annoName,
-                                type: type.value,
                                 flags: flags.value,
                                 value: value,
                                 expires: expires.value }];
diff --git a/toolkit/components/places/nsAnnoProtocolHandler.cpp b/toolkit/components/places/nsAnnoProtocolHandler.cpp
index 56d5606c8d92..ab670d86bc85 100644
--- a/toolkit/components/places/nsAnnoProtocolHandler.cpp
+++ b/toolkit/components/places/nsAnnoProtocolHandler.cpp
@@ -4,12 +4,13 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /**
- * Implementation of moz-anno: URLs for accessing annotation values. This just
- * reads binary data from the annotation service.
- *
- * There is a special case for favicons. Annotation URLs with the name "favicon"
- * will be sent to the favicon service. If the favicon service doesn't have the
+ * Implementation of moz-anno: URLs for accessing favicons.  The urls are sent
+ * to the favicon service.  If the favicon service doesn't have the
  * data, a stream containing the default favicon will be returned.
+ *
+ * The reference to annotations ("moz-anno") is a leftover from previous
+ * iterations of this component. As of now the moz-anno protocol is independent
+ * of annotations.
  */
 
 #include "nsAnnoProtocolHandler.h"
@@ -256,62 +257,18 @@ NS_IMETHODIMP
 nsAnnoProtocolHandler::NewChannel(nsIURI *aURI, nsIChannel **_retval)
 {
   NS_ENSURE_ARG_POINTER(aURI);
-  nsresult rv;
-
-  nsAutoCString path;
-  rv = aURI->GetPath(path);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  nsCOMPtr<nsIAnnotationService> annotationService = do_GetService(
-                              "@mozilla.org/browser/annotation-service;1", &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
 
   // annotation info
   nsCOMPtr<nsIURI> annoURI;
   nsAutoCString annoName;
-  rv = ParseAnnoURI(aURI, getter_AddRefs(annoURI), annoName);
+  nsresult rv = ParseAnnoURI(aURI, getter_AddRefs(annoURI), annoName);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  // If this is a favicon annotation, we create a different channel that will
-  // ask the favicon service for information about the favicon.
-  if (annoName.EqualsLiteral(FAVICON_ANNOTATION_NAME))
-    return NewFaviconChannel(aURI, annoURI, _retval);
+  // Only favicon annotation are supported.
+  if (!annoName.EqualsLiteral(FAVICON_ANNOTATION_NAME))
+    return NS_ERROR_INVALID_ARG;
 
-  // normal handling for annotations
-  uint8_t* data;
-  uint32_t dataLen;
-  nsAutoCString mimeType;
-
-  // get the data from the annotation service and hand it off to the stream
-  rv = annotationService->GetPageAnnotationBinary(annoURI, annoName, &data,
-                                                  &dataLen, mimeType);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  // disallow annotations with no MIME types
-  if (mimeType.IsEmpty()) {
-    NS_Free(data);
-    return NS_ERROR_NOT_AVAILABLE;
-  }
-
-  nsCOMPtr<nsIStringInputStream> stream = do_CreateInstance(
-                                          NS_STRINGINPUTSTREAM_CONTRACTID, &rv);
-  if (NS_FAILED(rv)) {
-    NS_Free(data);
-    return rv;
-  }
-  rv = stream->AdoptData((char*)data, dataLen);
-  if (NS_FAILED(rv)) {
-    NS_Free(data);
-    return rv;
-  }
-
-  nsCOMPtr<nsIChannel> channel;
-  rv = NS_NewInputStreamChannel(getter_AddRefs(channel), aURI, stream, mimeType);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  *_retval = channel;
-  NS_ADDREF(*_retval);
-  return NS_OK;
+  return NewFaviconChannel(aURI, annoURI, _retval);
 }
 
 
diff --git a/toolkit/components/places/nsAnnoProtocolHandler.h b/toolkit/components/places/nsAnnoProtocolHandler.h
index 705a5b3102f3..2a956c5e39ac 100644
--- a/toolkit/components/places/nsAnnoProtocolHandler.h
+++ b/toolkit/components/places/nsAnnoProtocolHandler.h
@@ -7,7 +7,6 @@
 #define nsAnnoProtocolHandler_h___
 
 #include "nsCOMPtr.h"
-#include "nsIAnnotationService.h"
 #include "nsIProtocolHandler.h"
 #include "nsIURI.h"
 #include "nsString.h"
diff --git a/toolkit/components/places/nsAnnotationService.cpp b/toolkit/components/places/nsAnnotationService.cpp
index 84784a1497ba..54e58fd5bd88 100644
--- a/toolkit/components/places/nsAnnotationService.cpp
+++ b/toolkit/components/places/nsAnnotationService.cpp
@@ -40,13 +40,12 @@ using namespace mozilla::places;
 const int32_t nsAnnotationService::kAnnoIndex_ID = 0;
 const int32_t nsAnnotationService::kAnnoIndex_PageOrItem = 1;
 const int32_t nsAnnotationService::kAnnoIndex_NameID = 2;
-const int32_t nsAnnotationService::kAnnoIndex_MimeType = 3;
-const int32_t nsAnnotationService::kAnnoIndex_Content = 4;
-const int32_t nsAnnotationService::kAnnoIndex_Flags = 5;
-const int32_t nsAnnotationService::kAnnoIndex_Expiration = 6;
-const int32_t nsAnnotationService::kAnnoIndex_Type = 7;
-const int32_t nsAnnotationService::kAnnoIndex_DateAdded = 8;
-const int32_t nsAnnotationService::kAnnoIndex_LastModified = 9;
+const int32_t nsAnnotationService::kAnnoIndex_Content = 3;
+const int32_t nsAnnotationService::kAnnoIndex_Flags = 4;
+const int32_t nsAnnotationService::kAnnoIndex_Expiration = 5;
+const int32_t nsAnnotationService::kAnnoIndex_Type = 6;
+const int32_t nsAnnotationService::kAnnoIndex_DateAdded = 7;
+const int32_t nsAnnotationService::kAnnoIndex_LastModified = 8;
 
 namespace mozilla {
 namespace places {
@@ -166,8 +165,6 @@ nsAnnotationService::SetAnnotationStringInternal(nsIURI* aURI,
 
   rv = statement->BindStringByName(NS_LITERAL_CSTRING("content"), aValue);
   NS_ENSURE_SUCCESS(rv, rv);
-  rv = statement->BindNullByName(NS_LITERAL_CSTRING("mime_type"));
-  NS_ENSURE_SUCCESS(rv, rv);
 
   rv = statement->Execute();
   NS_ENSURE_SUCCESS(rv, rv);
@@ -394,8 +391,6 @@ nsAnnotationService::SetAnnotationInt32Internal(nsIURI* aURI,
 
   rv = statement->BindInt32ByName(NS_LITERAL_CSTRING("content"), aValue);
   NS_ENSURE_SUCCESS(rv, rv);
-  rv = statement->BindNullByName(NS_LITERAL_CSTRING("mime_type"));
-  NS_ENSURE_SUCCESS(rv, rv);
 
   rv = statement->Execute();
   NS_ENSURE_SUCCESS(rv, rv);
@@ -466,8 +461,6 @@ nsAnnotationService::SetAnnotationInt64Internal(nsIURI* aURI,
 
   rv = statement->BindInt64ByName(NS_LITERAL_CSTRING("content"), aValue);
   NS_ENSURE_SUCCESS(rv, rv);
-  rv = statement->BindNullByName(NS_LITERAL_CSTRING("mime_type"));
-  NS_ENSURE_SUCCESS(rv, rv);
 
   rv = statement->Execute();
   NS_ENSURE_SUCCESS(rv, rv);
@@ -538,8 +531,6 @@ nsAnnotationService::SetAnnotationDoubleInternal(nsIURI* aURI,
 
   rv = statement->BindDoubleByName(NS_LITERAL_CSTRING("content"), aValue);
   NS_ENSURE_SUCCESS(rv, rv);
-  rv = statement->BindNullByName(NS_LITERAL_CSTRING("mime_type"));
-  NS_ENSURE_SUCCESS(rv, rv);
 
   rv = statement->Execute();
   NS_ENSURE_SUCCESS(rv, rv);
@@ -591,89 +582,6 @@ nsAnnotationService::SetItemAnnotationDouble(int64_t aItemId,
   return NS_OK;
 }
 
-
-nsresult
-nsAnnotationService::SetAnnotationBinaryInternal(nsIURI* aURI,
-                                                 int64_t aItemId,
-                                                 const nsACString& aName,
-                                                 const uint8_t* aData,
-                                                 uint32_t aDataLen,
-                                                 const nsACString& aMimeType,
-                                                 int32_t aFlags,
-                                                 uint16_t aExpiration)
-{
-  if (aMimeType.Length() == 0)
-    return NS_ERROR_INVALID_ARG;
-
-  mozStorageTransaction transaction(mDB->MainConn(), false);
-  nsCOMPtr<mozIStorageStatement> statement;
-  nsresult rv = StartSetAnnotation(aURI, aItemId, aName, aFlags, aExpiration,
-                                   nsIAnnotationService::TYPE_BINARY,
-                                   statement);
-  NS_ENSURE_SUCCESS(rv, rv);
-  mozStorageStatementScoper scoper(statement);
-
-  rv = statement->BindBlobByName(NS_LITERAL_CSTRING("content"), aData, aDataLen);
-  NS_ENSURE_SUCCESS(rv, rv);
-  rv = statement->BindUTF8StringByName(NS_LITERAL_CSTRING("mime_type"), aMimeType);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  rv = statement->Execute();
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  rv = transaction.Commit();
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  return NS_OK;
-}
-
-
-NS_IMETHODIMP
-nsAnnotationService::SetPageAnnotationBinary(nsIURI* aURI,
-                                             const nsACString& aName,
-                                             const uint8_t* aData,
-                                             uint32_t aDataLen,
-                                             const nsACString& aMimeType,
-                                             int32_t aFlags,
-                                             uint16_t aExpiration)
-{
-  NS_ENSURE_ARG(aURI);
-
-  nsresult rv = SetAnnotationBinaryInternal(aURI, 0, aName, aData, aDataLen,
-                                            aMimeType, aFlags, aExpiration);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  NOTIFY_ANNOS_OBSERVERS(OnPageAnnotationSet(aURI, aName));
-
-  return NS_OK;
-}
-
-
-NS_IMETHODIMP
-nsAnnotationService::SetItemAnnotationBinary(int64_t aItemId,
-                                             const nsACString& aName,
-                                             const uint8_t* aData,
-                                             uint32_t aDataLen,
-                                             const nsACString& aMimeType,
-                                             int32_t aFlags,
-                                             uint16_t aExpiration)
-{
-  NS_ENSURE_ARG_MIN(aItemId, 1);
-
-  if (aExpiration == EXPIRE_WITH_HISTORY)
-    return NS_ERROR_INVALID_ARG;
-
-  nsresult rv = SetAnnotationBinaryInternal(nullptr, aItemId, aName, aData,
-                                            aDataLen, aMimeType, aFlags,
-                                            aExpiration);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  NOTIFY_ANNOS_OBSERVERS(OnItemAnnotationSet(aItemId, aName));
-
-  return NS_OK;
-}
-
-
 NS_IMETHODIMP
 nsAnnotationService::GetPageAnnotationString(nsIURI* aURI,
                                              const nsACString& aName,
@@ -747,10 +655,6 @@ nsAnnotationService::GetPageAnnotation(nsIURI* aURI,
         rv = value->SetAsAString(valueString);
       break;
     }
-    case nsIAnnotationService::TYPE_BINARY: {
-      rv = NS_ERROR_INVALID_ARG;
-      break;
-    }
     default: {
       rv = NS_ERROR_UNEXPECTED;
       break;
@@ -795,10 +699,6 @@ nsAnnotationService::GetItemAnnotation(int64_t aItemId,
         rv = value->SetAsAString(valueString);
       break;
     }
-    case nsIAnnotationService::TYPE_BINARY: {
-      rv = NS_ERROR_INVALID_ARG;
-      break;
-    }
     default: {
       rv = NS_ERROR_UNEXPECTED;
       break;
@@ -978,66 +878,11 @@ nsAnnotationService::GetItemAnnotationDouble(int64_t aItemId,
 }
 
 
-NS_IMETHODIMP
-nsAnnotationService::GetPageAnnotationBinary(nsIURI* aURI,
-                                             const nsACString& aName,
-                                             uint8_t** _data,
-                                             uint32_t* _dataLen,
-                                             nsACString& _mimeType)
-{
-  NS_ENSURE_ARG(aURI);
-  NS_ENSURE_ARG_POINTER(_data);
-  NS_ENSURE_ARG_POINTER(_dataLen);
-
-  nsCOMPtr<mozIStorageStatement> statement;
-  nsresult rv = StartGetAnnotation(aURI, 0, aName, statement);
-  if (NS_FAILED(rv))
-    return rv;
-
-  mozStorageStatementScoper scoper(statement);
-  ENSURE_ANNO_TYPE(TYPE_BINARY, statement);
-  rv = statement->GetBlob(kAnnoIndex_Content, _dataLen, _data);
-  NS_ENSURE_SUCCESS(rv, rv);
-  rv = statement->GetUTF8String(kAnnoIndex_MimeType, _mimeType);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  return NS_OK;
-}
-
-
-NS_IMETHODIMP
-nsAnnotationService::GetItemAnnotationBinary(int64_t aItemId,
-                                             const nsACString& aName,
-                                             uint8_t** _data,
-                                             uint32_t* _dataLen,
-                                             nsACString& _mimeType)
-{
-  NS_ENSURE_ARG_MIN(aItemId, 1);
-  NS_ENSURE_ARG_POINTER(_data);
-  NS_ENSURE_ARG_POINTER(_dataLen);
-
-  nsCOMPtr<mozIStorageStatement> statement;
-  nsresult rv = StartGetAnnotation(nullptr, aItemId, aName, statement);
-  if (NS_FAILED(rv))
-    return rv;
-
-  mozStorageStatementScoper scoper(statement);
-  ENSURE_ANNO_TYPE(TYPE_BINARY, statement);
-  rv = statement->GetBlob(kAnnoIndex_Content, _dataLen, _data);
-  NS_ENSURE_SUCCESS(rv, rv);
-  rv = statement->GetUTF8String(kAnnoIndex_MimeType, _mimeType);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  return NS_OK;
-}
-
-
 NS_IMETHODIMP
 nsAnnotationService::GetPageAnnotationInfo(nsIURI* aURI,
                                            const nsACString& aName,
                                            int32_t* _flags,
                                            uint16_t* _expiration,
-                                           nsACString& _mimeType,
                                            uint16_t* _storageType)
 {
   NS_ENSURE_ARG(aURI);
@@ -1053,8 +898,6 @@ nsAnnotationService::GetPageAnnotationInfo(nsIURI* aURI,
   mozStorageStatementScoper scoper(statement);
   *_flags = statement->AsInt32(kAnnoIndex_Flags);
   *_expiration = (uint16_t)statement->AsInt32(kAnnoIndex_Expiration);
-  rv = statement->GetUTF8String(kAnnoIndex_MimeType, _mimeType);
-  NS_ENSURE_SUCCESS(rv, rv);
   int32_t type = (uint16_t)statement->AsInt32(kAnnoIndex_Type);
   if (type == 0) {
     // For annotations created before explicit typing,
@@ -1073,7 +916,6 @@ nsAnnotationService::GetItemAnnotationInfo(int64_t aItemId,
                                            const nsACString& aName,
                                            int32_t* _flags,
                                            uint16_t* _expiration,
-                                           nsACString& _mimeType,
                                            uint16_t* _storageType)
 {
   NS_ENSURE_ARG_MIN(aItemId, 1);
@@ -1089,8 +931,6 @@ nsAnnotationService::GetItemAnnotationInfo(int64_t aItemId,
   mozStorageStatementScoper scoper(statement);
   *_flags = statement->AsInt32(kAnnoIndex_Flags);
   *_expiration = (uint16_t)statement->AsInt32(kAnnoIndex_Expiration);
-  rv = statement->GetUTF8String(kAnnoIndex_MimeType, _mimeType);
-  NS_ENSURE_SUCCESS(rv, rv);
   int32_t type = (uint16_t)statement->AsInt32(kAnnoIndex_Type);
   if (type == 0) {
     // For annotations created before explicit typing,
@@ -1670,10 +1510,10 @@ nsAnnotationService::CopyPageAnnotations(nsIURI* aSourceURI,
 
   nsCOMPtr<mozIStorageStatement> copyStmt = mDB->GetStatement(
     "INSERT INTO moz_annos "
-    "(place_id, anno_attribute_id, mime_type, content, flags, expiration, "
+    "(place_id, anno_attribute_id, content, flags, expiration, "
      "type, dateAdded, lastModified) "
     "SELECT (SELECT id FROM moz_places WHERE url = :page_url), "
-           "anno_attribute_id, mime_type, content, flags, expiration, type, "
+           "anno_attribute_id, content, flags, expiration, type, "
            ":date, :date "
     "FROM moz_annos "
     "WHERE place_id = :page_id "
@@ -1751,9 +1591,9 @@ nsAnnotationService::CopyItemAnnotations(int64_t aSourceItemId,
 
   nsCOMPtr<mozIStorageStatement> copyStmt = mDB->GetStatement(
       "INSERT OR REPLACE INTO moz_items_annos "
-      "(item_id, anno_attribute_id, mime_type, content, flags, expiration, "
+      "(item_id, anno_attribute_id, content, flags, expiration, "
        "type, dateAdded, lastModified) "
-      "SELECT :dest_item_id, anno_attribute_id, mime_type, content, flags, expiration, "
+      "SELECT :dest_item_id, anno_attribute_id, content, flags, expiration, "
              "type, :date, :date "
       "FROM moz_items_annos "
       "WHERE item_id = :source_item_id "
@@ -1824,33 +1664,6 @@ nsAnnotationService::RemoveObserver(nsIAnnotationObserver* aObserver)
   return NS_OK;
 }
 
-
-// nsAnnotationService::GetAnnotationURI
-//
-// XXX: does not support item-annotations
-
-NS_IMETHODIMP
-nsAnnotationService::GetAnnotationURI(nsIURI* aURI,
-                                      const nsACString& aName,
-                                      nsIURI** _result)
-{
-  if (aName.IsEmpty())
-    return NS_ERROR_INVALID_ARG;
-
-  nsAutoCString annoSpec;
-  nsresult rv = aURI->GetSpec(annoSpec);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  nsAutoCString spec;
-  spec.AssignLiteral("moz-anno:");
-  spec += aName;
-  spec += NS_LITERAL_CSTRING(":");
-  spec += annoSpec;
-
-  return NS_NewURI(_result, spec);
-}
-
-
 nsresult
 nsAnnotationService::HasAnnotationInternal(nsIURI* aURI,
                                            int64_t aItemId,
@@ -1930,7 +1743,7 @@ nsAnnotationService::StartGetAnnotation(nsIURI* aURI,
 
   if (isItemAnnotation) {
     aStatement = mDB->GetStatement(
-      "SELECT a.id, a.item_id, :anno_name, a.mime_type, a.content, a.flags, "
+      "SELECT a.id, a.item_id, :anno_name, a.content, a.flags, "
              "a.expiration, a.type "
       "FROM moz_anno_attributes n "
       "JOIN moz_items_annos a ON a.anno_attribute_id = n.id "
@@ -1940,7 +1753,7 @@ nsAnnotationService::StartGetAnnotation(nsIURI* aURI,
   }
   else {
     aStatement = mDB->GetStatement(
-      "SELECT a.id, a.place_id, :anno_name, a.mime_type, a.content, a.flags, "
+      "SELECT a.id, a.place_id, :anno_name, a.content, a.flags, "
              "a.expiration, a.type "
       "FROM moz_anno_attributes n "
       "JOIN moz_annos a ON n.id = a.anno_attribute_id "
@@ -1977,7 +1790,7 @@ nsAnnotationService::StartGetAnnotation(nsIURI* aURI,
 
 /**
  * This does most of the setup work needed to set an annotation, except for
- * binding the the actual value and MIME type and executing the statement.
+ * binding the the actual value and executing the statement.
  * It will either update an existing annotation or insert a new one.
  *
  * @note The aStatement RESULT IS NOT ADDREFED.  This is just one of the class
@@ -2070,18 +1883,18 @@ nsAnnotationService::StartSetAnnotation(nsIURI* aURI,
   if (isItemAnnotation) {
     aStatement = mDB->GetStatement(
       "INSERT OR REPLACE INTO moz_items_annos "
-        "(id, item_id, anno_attribute_id, mime_type, content, flags, "
+        "(id, item_id, anno_attribute_id, content, flags, "
          "expiration, type, dateAdded, lastModified) "
-      "VALUES (:id, :fk, :name_id, :mime_type, :content, :flags, "
+      "VALUES (:id, :fk, :name_id, :content, :flags, "
       ":expiration, :type, :date_added, :last_modified)"
     );
   }
   else {
     aStatement = mDB->GetStatement(
       "INSERT OR REPLACE INTO moz_annos "
-        "(id, place_id, anno_attribute_id, mime_type, content, flags, "
+        "(id, place_id, anno_attribute_id, content, flags, "
          "expiration, type, dateAdded, lastModified) "
-      "VALUES (:id, :fk, :name_id, :mime_type, :content, :flags, "
+      "VALUES (:id, :fk, :name_id, :content, :flags, "
       ":expiration, :type, :date_added, :last_modified)"
     );
   }
@@ -2106,7 +1919,7 @@ nsAnnotationService::StartSetAnnotation(nsIURI* aURI,
   NS_ENSURE_SUCCESS(rv, rv);
   rv = aStatement->BindInt64ByName(NS_LITERAL_CSTRING("name_id"), nameID);
   NS_ENSURE_SUCCESS(rv, rv);
-  // MimeType and Content will be bound by the caller.
+
   rv = aStatement->BindInt32ByName(NS_LITERAL_CSTRING("flags"), aFlags);
   NS_ENSURE_SUCCESS(rv, rv);
   rv = aStatement->BindInt32ByName(NS_LITERAL_CSTRING("expiration"), aExpiration);
@@ -2116,8 +1929,8 @@ nsAnnotationService::StartSetAnnotation(nsIURI* aURI,
   rv = aStatement->BindInt64ByName(NS_LITERAL_CSTRING("last_modified"), PR_Now());
   NS_ENSURE_SUCCESS(rv, rv);
 
-  // on success, leave the statement open, the caller will set the value
-  // and MIME type and execute the statement
+  // On success, leave the statement open, the caller will set the value
+  // and execute the statement.
   setAnnoScoper.Abandon();
 
   return NS_OK;
diff --git a/toolkit/components/places/nsAnnotationService.h b/toolkit/components/places/nsAnnotationService.h
index 1b9816886b54..5a75dff28d86 100644
--- a/toolkit/components/places/nsAnnotationService.h
+++ b/toolkit/components/places/nsAnnotationService.h
@@ -92,7 +92,6 @@ protected:
   static const int kAnnoIndex_ID;
   static const int kAnnoIndex_PageOrItem;
   static const int kAnnoIndex_NameID;
-  static const int kAnnoIndex_MimeType;
   static const int kAnnoIndex_Content;
   static const int kAnnoIndex_Flags;
   static const int kAnnoIndex_Expiration;
@@ -142,14 +141,6 @@ protected:
                                        double aValue,
                                        int32_t aFlags,
                                        uint16_t aExpiration);
-  nsresult SetAnnotationBinaryInternal(nsIURI* aURI,
-                                       int64_t aItemId,
-                                       const nsACString& aName,
-                                       const uint8_t* aData,
-                                       uint32_t aDataLen,
-                                       const nsACString& aMimeType,
-                                       int32_t aFlags,
-                                       uint16_t aExpiration);
 
   nsresult RemoveAnnotationInternal(nsIURI* aURI,
                                     int64_t aItemId,
diff --git a/toolkit/components/places/nsIAnnotationService.idl b/toolkit/components/places/nsIAnnotationService.idl
index 0f018a5e583f..948f175b468f 100644
--- a/toolkit/components/places/nsIAnnotationService.idl
+++ b/toolkit/components/places/nsIAnnotationService.idl
@@ -32,7 +32,7 @@ interface nsIAnnotationObserver : nsISupports
                                  in AUTF8String aName);
 };
 
-[scriptable, uuid(c7f425cc-a063-49ef-9f4c-b08eb2f1730a)]
+[scriptable, uuid(D4CDAAB1-8EEC-47A8-B420-AD7CB333056A)]
 interface nsIAnnotationService : nsISupports
 {
     /**
@@ -80,7 +80,6 @@ interface nsIAnnotationService : nsISupports
     const unsigned short TYPE_INT32  = 1;
     const unsigned short TYPE_DOUBLE = 2;
     const unsigned short TYPE_STRING = 3;
-    const unsigned short TYPE_BINARY = 4;
     const unsigned short TYPE_INT64  = 5;
 
     /**
@@ -112,9 +111,7 @@ interface nsIAnnotationService : nsISupports
      * service, but are special cased in the protocol handler so they look like
      * annotations. Do not set favicons using this service, it will not work.
      *
-     * Binary annotations should be set using
-     * setItemAnnotationBinary/setPageAnnotationBinary. For other types, only
-     * C++ consumers may use the type-specific methods.
+     * Only C++ consumers may use the type-specific methods.
      *
      * @throws NS_ERROR_ILLEGAL_VALUE if the page or the bookmark doesn't exist.
      */
@@ -193,30 +190,11 @@ interface nsIAnnotationService : nsISupports
                                             in double aValue,
                                             in long aFlags,
                                             in unsigned short aExpiration);
-    /**
-     * Sets an annotation just like setAnnotationString, but takes binary data
-     * as input. You MUST supply a valid MIME type.
-     *
-     * @throws NS_ERROR_ILLEGAL_VALUE if the page or the bookmark doesn't exist.
-     */
-    void setPageAnnotationBinary(in nsIURI aURI, in AUTF8String aName,
-                                 [const,array,size_is(aDataLen)] in octet aData,
-                                 in unsigned long aDataLen,
-                                 in AUTF8String aMimeType,
-                                 in long aFlags,
-                                 in unsigned short aExpiration);
-    void setItemAnnotationBinary(in long long aItemId, in AUTF8String aName,
-                                 [const,array,size_is(aDataLen)] in octet aData,
-                                 in unsigned long aDataLen,
-                                 in AUTF8String aMimeType,
-                                 in long aFlags,
-                                 in unsigned short aExpiration);
 
     /**
      * Retrieves the value of a given annotation. Throws an error if the
-     * annotation does not exist. Throws for binary annotations, for which
-     * getPageAnnotationBinary/getItemAnnotationBinary should be used. C++
-     * consumers may use the type-specific methods.
+     * annotation does not exist. C++ consumers may use the type-specific
+     * methods.
      *
      * The type-specific methods throw if the given annotation is set in
      * a different type.
@@ -259,42 +237,24 @@ interface nsIAnnotationService : nsISupports
                                               in AUTF8String aName);
 
     /**
-     * @see getPageAnnotation. This also returns the
-     * MIME type.
-     */
-    void getPageAnnotationBinary(in nsIURI aURI,
-                                 in AUTF8String aName,
-                                 [array,size_is(aDataLen)] out octet aData,
-                                 out unsigned long aDataLen,
-                                 out AUTF8String aMimeType);
-    void getItemAnnotationBinary(in long long aItemId,
-                                 in AUTF8String aName,
-                                 [array,size_is(aDataLen)] out octet aData,
-                                 out unsigned long aDataLen,
-                                 out AUTF8String aMimeType);
-
-    /**
-     * Retrieves info about an existing annotation. aMimeType will be empty
-     * if the value was not binary data.
+     * Retrieves info about an existing annotation.
      *
      * aType will be one of TYPE_* constansts above
      *
      * example JS:
-     *   var flags = {}, exp = {}, mimeType = {};
-     *   annotator.getAnnotationInfo(myURI, "foo", flags, exp, mimeType);
+     *   var flags = {}, exp = {}, type = {};
+     *   annotator.getAnnotationInfo(myURI, "foo", flags, exp, type);
      *   // now you can use 'exp.value' and 'flags.value'
      */
     void getPageAnnotationInfo(in nsIURI aURI,
                                in AUTF8String aName,
                                out int32_t aFlags,
                                out unsigned short aExpiration,
-                               out AUTF8String aMimeType,
                                out unsigned short aType);
     void getItemAnnotationInfo(in long long aItemId,
                                in AUTF8String aName,
                                out long aFlags,
                                out unsigned short aExpiration,
-                               out AUTF8String aMimeType,
                                out unsigned short aType);
 
     /**
@@ -331,7 +291,6 @@ interface nsIAnnotationService : nsISupports
      * @param name
      *        The annotation to search for.
      * @return list of mozIAnnotation objects.
-     * @note binary annotations are not supported and thus skipped.
      */
     void getAnnotationsWithName(
         in AUTF8String name,
@@ -405,16 +364,6 @@ interface nsIAnnotationService : nsISupports
      * Removes an annotaton observer previously registered by addObserver.
      */
     void removeObserver(in nsIAnnotationObserver aObserver);
-
-    /**
-     * Returns a URI that can be used to access the given binary annotation.
-     * This function does NOT check that the annotation exists. Also, note that
-     * you can only load URIs for annotations that have have a valid MIME type
-     * set by setAnnotationBinary. No non-URI valid chars in name, especially
-     * colon, which will mess up parsing.
-     */
-    nsIURI getAnnotationURI(in nsIURI aURI,
-                            in AUTF8String aName);
 };
 
 /**
diff --git a/toolkit/components/places/nsNavHistoryResult.cpp b/toolkit/components/places/nsNavHistoryResult.cpp
index a5369e2f5682..85ac5d86dd3c 100644
--- a/toolkit/components/places/nsNavHistoryResult.cpp
+++ b/toolkit/components/places/nsNavHistoryResult.cpp
@@ -1146,32 +1146,29 @@ int32_t nsNavHistoryContainerResultNode::SortComparison_AnnotationLess(
           }                                                                   \
         }
 
-    // Surprising as it is, we don't support sorting by a binary annotation
-    if (annoType != nsIAnnotationService::TYPE_BINARY) {
-      if (annoType == nsIAnnotationService::TYPE_STRING) {
-        nsAutoString a_val, b_val;
-        GET_ANNOTATIONS_VALUES(GetItemAnnotationString,
-                               GetPageAnnotationString, a_val, b_val);
-        value = SortComparison_StringLess(a_val, b_val);
-      }
-      else if (annoType == nsIAnnotationService::TYPE_INT32) {
-        int32_t a_val = 0, b_val = 0;
-        GET_ANNOTATIONS_VALUES(GetItemAnnotationInt32,
-                               GetPageAnnotationInt32, &a_val, &b_val);
-        value = (a_val < b_val) ? -1 : (a_val > b_val) ? 1 : 0;
-      }
-      else if (annoType == nsIAnnotationService::TYPE_INT64) {
-        int64_t a_val = 0, b_val = 0;
-        GET_ANNOTATIONS_VALUES(GetItemAnnotationInt64,
-                               GetPageAnnotationInt64, &a_val, &b_val);
-        value = (a_val < b_val) ? -1 : (a_val > b_val) ? 1 : 0;
-      }
-      else if (annoType == nsIAnnotationService::TYPE_DOUBLE) {
-        double a_val = 0, b_val = 0;
-        GET_ANNOTATIONS_VALUES(GetItemAnnotationDouble,
-                               GetPageAnnotationDouble, &a_val, &b_val);
-        value = (a_val < b_val) ? -1 : (a_val > b_val) ? 1 : 0;
-      }
+    if (annoType == nsIAnnotationService::TYPE_STRING) {
+      nsAutoString a_val, b_val;
+      GET_ANNOTATIONS_VALUES(GetItemAnnotationString,
+                             GetPageAnnotationString, a_val, b_val);
+      value = SortComparison_StringLess(a_val, b_val);
+    }
+    else if (annoType == nsIAnnotationService::TYPE_INT32) {
+      int32_t a_val = 0, b_val = 0;
+      GET_ANNOTATIONS_VALUES(GetItemAnnotationInt32,
+                             GetPageAnnotationInt32, &a_val, &b_val);
+      value = (a_val < b_val) ? -1 : (a_val > b_val) ? 1 : 0;
+    }
+    else if (annoType == nsIAnnotationService::TYPE_INT64) {
+      int64_t a_val = 0, b_val = 0;
+      GET_ANNOTATIONS_VALUES(GetItemAnnotationInt64,
+                             GetPageAnnotationInt64, &a_val, &b_val);
+      value = (a_val < b_val) ? -1 : (a_val > b_val) ? 1 : 0;
+    }
+    else if (annoType == nsIAnnotationService::TYPE_DOUBLE) {
+      double a_val = 0, b_val = 0;
+      GET_ANNOTATIONS_VALUES(GetItemAnnotationDouble,
+                             GetPageAnnotationDouble, &a_val, &b_val);
+      value = (a_val < b_val) ? -1 : (a_val > b_val) ? 1 : 0;
     }
   }
 
diff --git a/toolkit/components/places/tests/queries/head_queries.js b/toolkit/components/places/tests/queries/head_queries.js
index d32cc932dccc..05169548f72f 100644
--- a/toolkit/components/places/tests/queries/head_queries.js
+++ b/toolkit/components/places/tests/queries/head_queries.js
@@ -148,36 +148,6 @@ function task_populateDB(aArray)
             }
           }
 
-          if (qdata.isPageBinaryAnnotation) {
-            if (qdata.removeAnnotation)
-              PlacesUtils.annotations.removePageAnnotation(uri(qdata.uri),
-                                                           qdata.annoName);
-            else {
-              PlacesUtils.annotations.setPageAnnotationBinary(uri(qdata.uri),
-                                                              qdata.annoName,
-                                                              qdata.binarydata,
-                                                              qdata.binaryDataLength,
-                                                              qdata.annoMimeType,
-                                                              qdata.annoFlags,
-                                                              qdata.annoExpiration);
-            }
-          }
-
-          if (qdata.isItemBinaryAnnotation) {
-            if (qdata.removeAnnotation)
-              PlacesUtils.annotations.removeItemAnnotation(qdata.itemId,
-                                                           qdata.annoName);
-            else {
-              PlacesUtils.annotations.setItemAnnotationBinary(qdata.itemId,
-                                                              qdata.annoName,
-                                                              qdata.binaryData,
-                                                              qdata.binaryDataLength,
-                                                              qdata.annoMimeType,
-                                                              qdata.annoFlags,
-                                                              qdata.annoExpiration);
-            }
-          }
-
           if (qdata.isFolder) {
             let folderId = PlacesUtils.bookmarks.createFolder(qdata.parentFolder,
                                                               qdata.title,
@@ -262,12 +232,6 @@ function queryData(obj) {
   this.annoExpiration = obj.annoExpiration ? obj.annoExpiration : 0;
   this.isItemAnnotation = obj.isItemAnnotation ? obj.isItemAnnotation : false;
   this.itemId = obj.itemId ? obj.itemId : 0;
-  this.isPageBinaryAnnotation = obj.isPageBinaryAnnotation ?
-                                obj.isPageBinaryAnnotation : false;
-  this.isItemBinaryAnnotation = obj.isItemBinaryAnnotation ?
-                                obj.isItemBinaryAnnotation : false;
-  this.binaryData = obj.binaryData ? obj.binaryData : null;
-  this.binaryDataLength = obj.binaryDataLength ? obj.binaryDataLength : 0;
   this.annoMimeType = obj.annoMimeType ? obj.annoMimeType : "";
   this.isTag = obj.isTag ? obj.isTag : false;
   this.tagArray = obj.tagArray ? obj.tagArray : null;
diff --git a/toolkit/components/places/tests/unit/test_annotations.js b/toolkit/components/places/tests/unit/test_annotations.js
index c6b950442405..fc39f73d7cc1 100644
--- a/toolkit/components/places/tests/unit/test_annotations.js
+++ b/toolkit/components/places/tests/unit/test_annotations.js
@@ -63,7 +63,6 @@ add_task(function test_execute()
   var testAnnoVal = "test";
 
   annosvc.addObserver(annoObserver);
-
   // create new string annotation
   try {
     annosvc.setPageAnnotation(testURI, testAnnoName, testAnnoVal, 0, 0);
@@ -77,7 +76,6 @@ add_task(function test_execute()
   do_check_true(annosvc.pageHasAnnotation(testURI, testAnnoName));
   var storedAnnoVal = annosvc.getPageAnnotation(testURI, testAnnoName);
   do_check_true(testAnnoVal === storedAnnoVal);
-
   // string item-annotation
   try {
     var lastModified = bmsvc.getItemLastModified(testItemId);
@@ -135,16 +133,14 @@ add_task(function test_execute()
   } catch(ex) {}
 
   // get annotation info
-  var flags = {}, exp = {}, mimeType = {}, storageType = {};
-  annosvc.getPageAnnotationInfo(testURI, testAnnoName, flags, exp, mimeType, storageType);
+  var flags = {}, exp = {}, storageType = {};
+  annosvc.getPageAnnotationInfo(testURI, testAnnoName, flags, exp, storageType);
   do_check_eq(flags.value, 0);
   do_check_eq(exp.value, 0);
-  do_check_eq(mimeType.value, null);
   do_check_eq(storageType.value, Ci.nsIAnnotationService.TYPE_STRING);
-  annosvc.getItemAnnotationInfo(testItemId, testAnnoName, flags, exp, mimeType, storageType);
+  annosvc.getItemAnnotationInfo(testItemId, testAnnoName, flags, exp, storageType);
   do_check_eq(flags.value, 0);
   do_check_eq(exp.value, 0);
-  do_check_eq(mimeType.value, null);
   do_check_eq(storageType.value, Ci.nsIAnnotationService.TYPE_STRING);
 
   // get annotation names for a uri
@@ -215,22 +211,18 @@ add_task(function test_execute()
   var int32Val = 23;
   annosvc.setPageAnnotation(testURI, int32Key, int32Val, 0, 0);
   do_check_true(annosvc.pageHasAnnotation(testURI, int32Key));
-  var flags = {}, exp = {}, mimeType = {}, storageType = {};
-  annosvc.getPageAnnotationInfo(testURI, int32Key, flags, exp, mimeType,
-                                storageType);
+  var flags = {}, exp = {}, storageType = {};
+  annosvc.getPageAnnotationInfo(testURI, int32Key, flags, exp, storageType);
   do_check_eq(flags.value, 0);
   do_check_eq(exp.value, 0);
-  do_check_eq(mimeType.value, null);
   do_check_eq(storageType.value, Ci.nsIAnnotationService.TYPE_INT32);
   var storedVal = annosvc.getPageAnnotation(testURI, int32Key);
   do_check_true(int32Val === storedVal);
   annosvc.setItemAnnotation(testItemId, int32Key, int32Val, 0, 0);
   do_check_true(annosvc.itemHasAnnotation(testItemId, int32Key));
-  annosvc.getItemAnnotationInfo(testItemId, int32Key, flags, exp, mimeType,
-                                storageType);
+  annosvc.getItemAnnotationInfo(testItemId, int32Key, flags, exp, storageType);
   do_check_eq(flags.value, 0);
   do_check_eq(exp.value, 0);
-  do_check_eq(mimeType.value, null);
   storedVal = annosvc.getItemAnnotation(testItemId, int32Key);
   do_check_true(int32Val === storedVal);
 
@@ -238,19 +230,16 @@ add_task(function test_execute()
   var int64Key = testAnnoName + "/types/Int64";
   var int64Val = 4294967296;
   annosvc.setPageAnnotation(testURI, int64Key, int64Val, 0, 0);
-  annosvc.getPageAnnotationInfo(testURI, int64Key, flags, exp, mimeType, storageType);
+  annosvc.getPageAnnotationInfo(testURI, int64Key, flags, exp, storageType);
   do_check_eq(flags.value, 0);
   do_check_eq(exp.value, 0);
-  do_check_eq(mimeType.value, null);
   storedVal = annosvc.getPageAnnotation(testURI, int64Key);
   do_check_true(int64Val === storedVal);
   annosvc.setItemAnnotation(testItemId, int64Key, int64Val, 0, 0);
   do_check_true(annosvc.itemHasAnnotation(testItemId, int64Key));
-  annosvc.getItemAnnotationInfo(testItemId, int64Key, flags, exp, mimeType,
-                                storageType);
+  annosvc.getItemAnnotationInfo(testItemId, int64Key, flags, exp, storageType);
   do_check_eq(flags.value, 0);
   do_check_eq(exp.value, 0);
-  do_check_eq(mimeType.value, null);
   storedVal = annosvc.getItemAnnotation(testItemId, int64Key);
   do_check_true(int64Val === storedVal);
 
@@ -258,59 +247,20 @@ add_task(function test_execute()
   var doubleKey = testAnnoName + "/types/Double";
   var doubleVal = 0.000002342;
   annosvc.setPageAnnotation(testURI, doubleKey, doubleVal, 0, 0);
-  annosvc.getPageAnnotationInfo(testURI, doubleKey, flags, exp, mimeType, storageType);
+  annosvc.getPageAnnotationInfo(testURI, doubleKey, flags, exp, storageType);
   do_check_eq(flags.value, 0);
   do_check_eq(exp.value, 0);
-  do_check_eq(mimeType.value, null);
   storedVal = annosvc.getPageAnnotation(testURI, doubleKey);
   do_check_true(doubleVal === storedVal);
   annosvc.setItemAnnotation(testItemId, doubleKey, doubleVal, 0, 0);
   do_check_true(annosvc.itemHasAnnotation(testItemId, doubleKey));
-  annosvc.getItemAnnotationInfo(testItemId, doubleKey, flags, exp, mimeType,
-                                storageType);
+  annosvc.getItemAnnotationInfo(testItemId, doubleKey, flags, exp, storageType);
   do_check_eq(flags.value, 0);
   do_check_eq(exp.value, 0);
-  do_check_eq(mimeType.value, null);
   do_check_eq(storageType.value, Ci.nsIAnnotationService.TYPE_DOUBLE);
   storedVal = annosvc.getItemAnnotation(testItemId, doubleKey);
   do_check_true(doubleVal === storedVal);
 
-  // test binary anno type
-  var binaryKey = testAnnoName + "/types/Binary";
-  var binaryVal = Array.prototype.map.call("splarg", function(x) { return x.charCodeAt(0); });
-  annosvc.setPageAnnotationBinary(testURI, binaryKey, binaryVal, binaryVal.length, "text/plain", 0, 0);
-  annosvc.getPageAnnotationInfo(testURI, binaryKey, flags, exp, mimeType, storageType);
-  do_check_eq(flags.value, 0);
-  do_check_eq(exp.value, 0);
-  do_check_eq(mimeType.value, "text/plain");
-  do_check_eq(storageType.value, Ci.nsIAnnotationService.TYPE_BINARY);
-  var data = {}, length = {};
-  annosvc.getPageAnnotationBinary(testURI, binaryKey, data, length, mimeType);
-  do_check_eq(binaryVal.toString(), data.value.toString());
-  do_check_eq(typeof data.value, "object");
-  annosvc.setItemAnnotationBinary(testItemId, binaryKey, binaryVal,
-                                  binaryVal.length, "text/plain", 0, 0);
-  annosvc.getItemAnnotationInfo(testItemId, binaryKey, flags, exp, mimeType,
-                                storageType);
-  do_check_eq(flags.value, 0);
-  do_check_eq(exp.value, 0);
-  do_check_eq(mimeType.value, "text/plain");
-  do_check_eq(storageType.value, Ci.nsIAnnotationService.TYPE_BINARY);
-  annosvc.getItemAnnotationBinary(testItemId, binaryKey, data, length,
-                                  mimeType);
-  do_check_eq(binaryVal.toString(), data.value.toString());
-  do_check_eq(typeof data.value, "object");
-
-  // test that binary-accessors throw for wrong types
-  try {
-    var data = {}, length = {}, mimeType = {};
-    annosvc.getPageAnnotationBinary(testURI, int32Key, data, length, mimeType);
-    do_throw("page-annotation binary accessor didn't throw for a wrong type!");
-    annosvc.getItemAnnotationBinary(testItemId, int32Key, data, length,
-                                    mimeType);
-    do_throw("item-annotation binary accessor didn't throw for a wrong type!");
-  } catch(ex) {}
-
   // test annotation removal
   annosvc.removePageAnnotation(testURI, int32Key);
 
diff --git a/toolkit/components/places/tests/unit/test_utils_setAnnotationsFor.js b/toolkit/components/places/tests/unit/test_utils_setAnnotationsFor.js
index 356b8c0185e8..664c49b5b013 100644
--- a/toolkit/components/places/tests/unit/test_utils_setAnnotationsFor.js
+++ b/toolkit/components/places/tests/unit/test_utils_setAnnotationsFor.js
@@ -22,19 +22,20 @@ function run_test() {
 
   // create annotations array
   var testAnnos = [{ name: "testAnno/test0",
-                     type: Ci.nsIAnnotationService.TYPE_STRING,
                      flags: 0,
                      value: "test0",
                      expires: Ci.nsIAnnotationService.EXPIRE_NEVER },
                    { name: "testAnno/test1",
-                     type: Ci.nsIAnnotationService.TYPE_STRING,
                      flags: 0,
                      value: "test1",
                      expires: Ci.nsIAnnotationService.EXPIRE_NEVER },
                    { name: "testAnno/test2",
-                     type: Ci.nsIAnnotationService.TYPE_STRING,
                      flags: 0,
                      value: "test2",
+                     expires: Ci.nsIAnnotationService.EXPIRE_NEVER },
+                   { name: "testAnno/test3",
+                     flags: 0,
+                     value: 0,
                      expires: Ci.nsIAnnotationService.EXPIRE_NEVER }];
 
   // Add item annotations
@@ -53,8 +54,12 @@ function run_test() {
     do_check_eq(as.getPageAnnotation(testURI, anno.name), anno.value);
   });
 
-  // To unset annotations we set their values to null
-  testAnnos.forEach(function(anno) { anno.value = null; });
+  // To unset annotations we unset their values or set them to
+  //null/undefined
+  testAnnos[0].value = null;
+  testAnnos[1].value = undefined;
+  delete testAnnos[2].value;
+  delete testAnnos[3].value;
 
   // Unset all item annotations
   PlacesUtils.setAnnotationsForItem(itemId, testAnnos);
diff --git a/toolkit/content/license.html b/toolkit/content/license.html
index 807dc172d43e..036a613dec47 100644
--- a/toolkit/content/license.html
+++ b/toolkit/content/license.html
@@ -117,6 +117,7 @@
       <li><a href="about:license#uszeged">University of Szeged License</a></li>      
       <li><a href="about:license#hunspell-en-US">US English Spellchecking Dictionary Licenses</a></li>
       <li><a href="about:license#v8">V8 License</a></li>
+      <li><a href="about:license#vtune">VTune License</a></li>
       <li><a href="about:license#webrtc">WebRTC License</a></li>
       <li><a href="about:license#xiph">Xiph.org Foundation License</a></li>
     </ul>
@@ -1343,7 +1344,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
     <h1><a id="firebug"></a>Firebug License</h1>
 
     <p>This license applies to the code
-    <span class="path">browser/devtools/webconsole/NetworkHelper.jsm</span>.</p>
+    <span class="path">toolkit/devtools/webconsole/network-helper.js</span>.</p>
 
 <pre>
 Copyright (c) 2007, Parakey Inc.
@@ -3302,6 +3303,44 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 
 
+    <hr>
+
+    <h1><a id="vtune"></a>VTune License</h1>
+
+    <p>This license applies to certain files in the directory
+    <span class="path">js/src/vtune</span>.</p>
+<pre>
+Copyright (c) 2005-2012 Intel Corporation. All rights reserved.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+  * Redistributions of source code must retain the above copyright
+    notice, this list of conditions and the following disclaimer.
+  * Redistributions in binary form must reproduce the above copyright
+    notice, this list of conditions and the following disclaimer in
+    the documentation and/or other materials provided with the
+    distribution.
+  * Neither the name of Intel Corporation nor the names of its
+    contributors may be used to endorse or promote products derived
+    from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+</pre>
+
+
     <hr>
 
     <h1><a id="webrtc"></a>WebRTC License</h1>
diff --git a/toolkit/devtools/Loader.jsm b/toolkit/devtools/Loader.jsm
index 7bf42308d50c..a194585ea7b3 100644
--- a/toolkit/devtools/Loader.jsm
+++ b/toolkit/devtools/Loader.jsm
@@ -28,11 +28,13 @@ this.EXPORTED_SYMBOLS = ["devtools"];
  */
 
 let loaderGlobals = {
+  btoa: btoa,
   console: console,
   _Iterator: Iterator,
   loader: {
     lazyGetter: XPCOMUtils.defineLazyGetter.bind(XPCOMUtils),
-    lazyImporter: XPCOMUtils.defineLazyModuleGetter.bind(XPCOMUtils)
+    lazyImporter: XPCOMUtils.defineLazyModuleGetter.bind(XPCOMUtils),
+    lazyServiceGetter: XPCOMUtils.defineLazyServiceGetter.bind(XPCOMUtils)
   }
 }
 
@@ -48,6 +50,7 @@ var BuiltinProvider = {
         "main": "resource:///modules/devtools/main.js",
         "devtools": "resource:///modules/devtools",
         "devtools/server": "resource://gre/modules/devtools/server",
+        "devtools/toolkit/webconsole": "resource://gre/modules/devtools/toolkit/webconsole",
 
         // Allow access to xpcshell test items from the loader.
         "xpcshell-test": "resource://test"
@@ -81,6 +84,7 @@ var SrcdirProvider = {
     let devtoolsURI = this.fileURI(devtoolsDir);
     let toolkitURI = this.fileURI(OS.Path.join(srcdir, "toolkit", "devtools"));
     let serverURI = this.fileURI(OS.Path.join(srcdir, "toolkit", "devtools", "server"));
+    let webconsoleURI = this.fileURI(OS.Path.join(srcdir, "toolkit", "devtools", "webconsole"));
     let mainURI = this.fileURI(OS.Path.join(srcdir, "browser", "devtools", "main.js"));
     this.loader = new loader.Loader({
       modules: {
@@ -89,6 +93,7 @@ var SrcdirProvider = {
       paths: {
         "": "resource://gre/modules/commonjs/",
         "devtools/server": serverURI,
+        "devtools/toolkit/webconsole": webconsoleURI,
         "devtools": devtoolsURI,
         "main": mainURI
       },
diff --git a/toolkit/devtools/client/dbg-client.jsm b/toolkit/devtools/client/dbg-client.jsm
index fc840c3f85bb..8d1172976ca6 100644
--- a/toolkit/devtools/client/dbg-client.jsm
+++ b/toolkit/devtools/client/dbg-client.jsm
@@ -28,8 +28,16 @@ XPCOMUtils.defineLazyServiceGetter(this, "socketTransportService",
                                    "@mozilla.org/network/socket-transport-service;1",
                                    "nsISocketTransportService");
 
-XPCOMUtils.defineLazyModuleGetter(this, "WebConsoleClient",
-                                  "resource://gre/modules/devtools/WebConsoleClient.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "devtools",
+                                  "resource://gre/modules/devtools/Loader.jsm");
+
+Object.defineProperty(this, "WebConsoleClient", {
+  get: function() {
+    return devtools.require("devtools/toolkit/webconsole/client").WebConsoleClient;
+  },
+  configurable: true,
+  enumerable: true
+});
 
 Components.utils.import("resource://gre/modules/devtools/DevToolsUtils.jsm");
 this.makeInfallible = DevToolsUtils.makeInfallible;
diff --git a/toolkit/devtools/server/actors/inspector.js b/toolkit/devtools/server/actors/inspector.js
index d5ebdb0a0ed2..967387c39c2d 100644
--- a/toolkit/devtools/server/actors/inspector.js
+++ b/toolkit/devtools/server/actors/inspector.js
@@ -63,6 +63,10 @@ const { Class } = require("sdk/core/heritage");
 
 const PSEUDO_CLASSES = [":hover", ":active", ":focus"];
 
+const HIDDEN_CLASS = "__fx-devtools-hide-shortcut__";
+
+const HELPER_SHEET = "." + HIDDEN_CLASS + " { visibility: hidden !important }";
+
 Cu.import("resource://gre/modules/Services.jsm");
 
 exports.register = function(handle) {
@@ -402,6 +406,11 @@ let NodeFront = protocol.FrontClass(NodeActor, {
     return (name in this._attrMap);
   },
 
+  get hidden() {
+    let cls = this.getAttribute("class");
+    return cls && cls.indexOf(HIDDEN_CLASS) > -1;
+  },
+
   get attributes() this._form.attrs,
 
   get pseudoClassLocks() this._form.pseudoClassLocks || [],
@@ -1291,6 +1300,33 @@ var WalkerActor = protocol.ActorClass({
     return true;
   },
 
+  _installHelperSheet: function(node) {
+    if (!this.installedHelpers) {
+      this.installedHelpers = new WeakMap;
+    }
+    let win = node.rawNode.ownerDocument.defaultView;
+    if (!this.installedHelpers.has(win)) {
+      let { Style } = require("sdk/stylesheet/style");
+      let { attach } = require("sdk/content/mod");
+      let style = Style({source: HELPER_SHEET, type: "agent" });
+      attach(style, win);
+      this.installedHelpers.set(win, style);
+    }
+  },
+
+  hideNode: method(function(node) {
+    this._installHelperSheet(node);
+    node.rawNode.classList.add(HIDDEN_CLASS);
+  }, {
+    request: { node: Arg(0, "domnode") }
+  }),
+
+  unhideNode: method(function(node) {
+    node.rawNode.classList.remove(HIDDEN_CLASS);
+  }, {
+    request: { node: Arg(0, "domnode") }
+  }),
+
   /**
    * Remove a pseudo-class lock from a node.
    *
diff --git a/toolkit/devtools/server/actors/script.js b/toolkit/devtools/server/actors/script.js
index d85f33a74c8d..bc66eaae760f 100644
--- a/toolkit/devtools/server/actors/script.js
+++ b/toolkit/devtools/server/actors/script.js
@@ -886,8 +886,12 @@ ThreadActor.prototype = {
 
       let { url, line, column } = form.where;
       let promise = this.sources.getOriginalLocation(url, line, column)
-        .then(function (aOrigLocation) {
+        .then((aOrigLocation) => {
           form.where = aOrigLocation;
+          let source = this.sources.source(form.where.url);
+          if (source) {
+            form.source = source.form();
+          }
         });
       promises.push(promise);
     }
@@ -2669,7 +2673,6 @@ FrameActor.prototype = {
         line: this.frame.script.getOffsetLine(this.frame.offset),
         column: getOffsetColumn(this.frame.offset, this.frame.script)
       };
-      form.isBlackBoxed = this.threadActor.sources.isBlackBoxed(this.frame.script.url)
     }
 
     if (!this.frame.older) {
diff --git a/toolkit/devtools/server/actors/tracer.js b/toolkit/devtools/server/actors/tracer.js
index eb3d76d0be0d..8885515dde77 100644
--- a/toolkit/devtools/server/actors/tracer.js
+++ b/toolkit/devtools/server/actors/tracer.js
@@ -286,7 +286,10 @@ TraceActor.prototype = {
       sequence: this._sequence++
     };
 
-    this._handleEvent(TraceTypes.Events.exitFrame, packet, { value: aValue });
+    this._handleEvent(TraceTypes.Events.exitFrame, packet, {
+      value: aValue,
+      startTime: this._startTime
+    });
 
     this.conn.send(packet);
   }
@@ -439,10 +442,14 @@ TraceTypes.register("name", TraceTypes.Events.enterFrame, function({ frame }) {
     : "(" + frame.type + ")";
 });
 
-TraceTypes.register("callsite", TraceTypes.Events.enterFrame, function({ frame }) {
+TraceTypes.register("location", TraceTypes.Events.enterFrame, function({ frame }) {
   if (!frame.script) {
     return undefined;
   }
+  // We should return the location of the start of the script, but
+  // Debugger.Script does not provide complete start locations
+  // (bug 901138). Instead, return the current offset (the location of
+  // the first statement in the function).
   return {
     url: frame.script.url,
     line: frame.script.getOffsetLine(frame.offset),
@@ -450,6 +457,18 @@ TraceTypes.register("callsite", TraceTypes.Events.enterFrame, function({ frame }
   };
 });
 
+TraceTypes.register("callsite", TraceTypes.Events.enterFrame, function({ frame }) {
+  let older = frame.older;
+  if (!older || !older.script) {
+    return undefined;
+  }
+  return {
+    url: older.script.url,
+    line: older.script.getOffsetLine(older.offset),
+    column: getOffsetColumn(older.offset, older.script)
+  };
+});
+
 TraceTypes.register("time", TraceTypes.Events.enterFrame, timeSinceTraceStarted);
 TraceTypes.register("time", TraceTypes.Events.exitFrame, timeSinceTraceStarted);
 
@@ -461,11 +480,8 @@ TraceTypes.register("arguments", TraceTypes.Events.enterFrame, function({ frame
   if (!frame.arguments) {
     return undefined;
   }
-  let objectPool = [];
-  let objToId = new Map();
   let args = Array.prototype.slice.call(frame.arguments);
-  let values = args.map(arg => createValueGrip(arg, objectPool, objToId));
-  return { values: values, objectPool: objectPool };
+  return args.map(arg => createValueGrip(arg, true));
 });
 
 TraceTypes.register("return", TraceTypes.Events.exitFrame,
@@ -512,8 +528,8 @@ function timeSinceTraceStarted({ startTime }) {
 }
 
 /**
- * Creates a pool of object descriptors and a value grip for the given
- * completion value, to be serialized by JSON.stringify.
+ * Creates a value grip for the given completion value, to be
+ * serialized by JSON.stringify.
  *
  * @param aType string
  *        The type of completion value to serialize (return, throw, or yield).
@@ -522,10 +538,7 @@ function serializeCompletionValue(aType, { value }) {
   if (typeof value[aType] === "undefined") {
     return undefined;
   }
-  let objectPool = [];
-  let objToId = new Map();
-  let valueGrip = createValueGrip(value[aType], objectPool, objToId);
-  return { value: valueGrip, objectPool: objectPool };
+  return createValueGrip(value[aType], true);
 }
 
 
@@ -533,22 +546,18 @@ function serializeCompletionValue(aType, { value }) {
 // for use in serialization rather than object actor requests.
 
 /**
- * Create a grip for the given debuggee value. If the value is an object, will
- * create an object descriptor in the given object pool.
+ * Create a grip for the given debuggee value.
  *
  * @param aValue Debugger.Object|primitive
  *        The value to describe with the created grip.
  *
- * @param aPool [ObjectDescriptor]
- *        The pool of objects that may be referenced by |aValue|.
- *
- * @param aObjectToId Map
- *        A map from Debugger.Object instances to indices into the pool.
+ * @param aUseDescriptor boolean
+ *        If true, creates descriptors for objects rather than grips.
  *
  * @return ValueGrip
  *        A primitive value or a grip object.
  */
-function createValueGrip(aValue, aPool, aObjectToId) {
+function createValueGrip(aValue, aUseDescriptor) {
   let type = typeof aValue;
 
   if (type === "string" && aValue.length >= DebuggerServer.LONG_STRING_LENGTH) {
@@ -572,8 +581,7 @@ function createValueGrip(aValue, aPool, aObjectToId) {
   }
 
   if (typeof(aValue) === "object") {
-    createObjectDescriptor(aValue, aPool, aObjectToId);
-    return { type: "object", objectId: aObjectToId.get(aValue) };
+    return aUseDescriptor ? objectDescriptor(aValue) : objectGrip(aValue);
   }
 
   reportException("TraceActor",
@@ -582,70 +590,77 @@ function createValueGrip(aValue, aPool, aObjectToId) {
 }
 
 /**
- * Create an object descriptor in the object pool for the given debuggee object,
- * if it is not already present.
+ * Create a grip for the given debuggee object.
  *
  * @param aObject Debugger.Object
- *        The object to describe with the created descriptor.
- *
- * @param aPool [ObjectDescriptor]
- *        The pool of objects that may be referenced by |aObject|.
- *
- * @param aObjectToId Map
- *        A map from Debugger.Object instances to indices into the pool.
+ *        The object to describe with the created grip.
  */
-function createObjectDescriptor(aObject, aPool, aObjectToId) {
-  if (aObjectToId.has(aObject)) {
-    return;
-  }
-
-  aObjectToId.set(aObject, aPool.length);
-  let desc = Object.create(null);
-  aPool.push(desc);
-
-  // Add properties which object actors include in object grips.
-  desc.class = aObject.class;
-  desc.extensible = aObject.isExtensible();
-  desc.frozen = aObject.isFrozen();
-  desc.sealed = aObject.isSealed();
+function objectGrip(aObject) {
+  let g = {
+    "type": "object",
+    "class": aObject.class,
+    "extensible": aObject.isExtensible(),
+    "frozen": aObject.isFrozen(),
+    "sealed": aObject.isSealed()
+  };
 
   // Add additional properties for functions.
   if (aObject.class === "Function") {
     if (aObject.name) {
-      desc.name = aObject.name;
+      g.name = aObject.name;
     }
     if (aObject.displayName) {
-      desc.displayName = aObject.displayName;
+      g.displayName = aObject.displayName;
     }
 
     // Check if the developer has added a de-facto standard displayName
     // property for us to use.
     let name = aObject.getOwnPropertyDescriptor("displayName");
     if (name && name.value && typeof name.value == "string") {
-      desc.userDisplayName = createValueGrip(name.value, aObject, aPool, aObjectToId);
+      g.userDisplayName = createValueGrip(name.value, aObject);
+    }
+
+    // Add source location information.
+    if (aObject.script) {
+      g.url = aObject.script.url;
+      g.line = aObject.script.startLine;
     }
   }
 
+  return g;
+}
+
+/**
+ * Create a descriptor for the given debuggee object. Descriptors are
+ * identical to grips, with the addition of the prototype,
+ * ownProperties, and safeGetterValues properties.
+ *
+ * @param aObject Debugger.Object
+ *        The object to describe with the created descriptor.
+ */
+function objectDescriptor(aObject) {
+  let desc = objectGrip(aObject);
   let ownProperties = Object.create(null);
-  let propNames;
+  let names;
   try {
-    propNames = aObject.getOwnPropertyNames();
+    names = aObject.getOwnPropertyNames();
   } catch(ex) {
     // The above can throw if aObject points to a dead object.
     // TODO: we should use Cu.isDeadWrapper() - see bug 885800.
     desc.prototype = createValueGrip(null);
     desc.ownProperties = ownProperties;
     desc.safeGetterValues = Object.create(null);
-    return;
+    return desc;
+  }
+  for (let name of names) {
+    ownProperties[name] = propertyDescriptor(name, aObject);
   }
 
-  for (let name of propNames) {
-    ownProperties[name] = createPropertyDescriptor(name, aObject, aPool, aObjectToId);
-  }
-
-  desc.prototype = createValueGrip(aObject.proto, aPool, aObjectToId);
+  desc.prototype = createValueGrip(aObject.proto);
   desc.ownProperties = ownProperties;
-  desc.safeGetterValues = findSafeGetterValues(ownProperties, aObject, aPool, aObjectToId);
+  desc.safeGetterValues = findSafeGetterValues(ownProperties, aObject);
+
+  return desc;
 }
 
 /**
@@ -658,16 +673,10 @@ function createObjectDescriptor(aObject, aPool, aObjectToId) {
  * @param aObject Debugger.Object
  *        The object whose property the descriptor is generated for.
  *
- * @param aPool [ObjectDescriptor]
- *        The pool of objects that may be referenced by this property.
- *
- * @param aObjectToId Map
- *        A map from Debugger.Object instances to indices into the pool.
- *
  * @return object
  *         The property descriptor for the property |aName| in |aObject|.
  */
-function createPropertyDescriptor(aName, aObject, aPool, aObjectToId) {
+function propertyDescriptor(aName, aObject) {
   let desc;
   try {
     desc = aObject.getOwnPropertyDescriptor(aName);
@@ -683,6 +692,10 @@ function createPropertyDescriptor(aName, aObject, aPool, aObjectToId) {
     };
   }
 
+  if (!desc) {
+    return undefined;
+  }
+
   let retval = {
     configurable: desc.configurable,
     enumerable: desc.enumerable
@@ -690,13 +703,13 @@ function createPropertyDescriptor(aName, aObject, aPool, aObjectToId) {
 
   if ("value" in desc) {
     retval.writable = desc.writable;
-    retval.value = createValueGrip(desc.value, aPool, aObjectToId);
+    retval.value = createValueGrip(desc.value);
   } else {
     if ("get" in desc) {
-      retval.get = createValueGrip(desc.get, aPool, aObjectToId);
+      retval.get = createValueGrip(desc.get);
     }
     if ("set" in desc) {
-      retval.set = createValueGrip(desc.set, aPool, aObjectToId);
+      retval.set = createValueGrip(desc.set);
     }
   }
   return retval;
@@ -711,16 +724,10 @@ function createPropertyDescriptor(aName, aObject, aPool, aObjectToId) {
  * @param Debugger.Object object
  *        The object to find safe getter values for.
  *
- * @param aPool [ObjectDescriptor]
- *        The pool of objects that may be referenced by |aObject| getters.
- *
- * @param aObjectToId Map
- *        A map from Debugger.Object instances to indices into the pool.
- *
  * @return object
  *         An object that maps property names to safe getter descriptors.
  */
-function findSafeGetterValues(aOwnProperties, aObject, aPool, aObjectToId) {
+function findSafeGetterValues(aOwnProperties, aObject) {
   let safeGetterValues = Object.create(null);
   let obj = aObject;
   let level = 0;
@@ -759,7 +766,7 @@ function findSafeGetterValues(aOwnProperties, aObject, aPool, aObjectToId) {
         // return undefined and should be ignored.
         if (getterValue !== undefined) {
           safeGetterValues[name] = {
-            getterValue: createValueGrip(getterValue, aPool, aObjectToId),
+            getterValue: createValueGrip(getterValue),
             getterPrototypeLevel: level,
             enumerable: desc.enumerable,
             writable: level == 0 ? desc.writable : true,
diff --git a/toolkit/devtools/server/actors/webconsole.js b/toolkit/devtools/server/actors/webconsole.js
index 4900fbb0d730..982e44e594e8 100644
--- a/toolkit/devtools/server/actors/webconsole.js
+++ b/toolkit/devtools/server/actors/webconsole.js
@@ -12,33 +12,29 @@ let Cu = Components.utils;
 
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 
+let devtools = Cu.import("resource://gre/modules/devtools/Loader.jsm", {}).devtools;
+
 XPCOMUtils.defineLazyModuleGetter(this, "Services",
                                   "resource://gre/modules/Services.jsm");
 
-XPCOMUtils.defineLazyModuleGetter(this, "WebConsoleUtils",
-                                  "resource://gre/modules/devtools/WebConsoleUtils.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "ConsoleServiceListener",
-                                  "resource://gre/modules/devtools/WebConsoleUtils.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "ConsoleAPIListener",
-                                  "resource://gre/modules/devtools/WebConsoleUtils.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "ConsoleProgressListener",
-                                  "resource://gre/modules/devtools/WebConsoleUtils.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "JSTermHelpers",
-                                  "resource://gre/modules/devtools/WebConsoleUtils.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "JSPropertyProvider",
-                                  "resource://gre/modules/devtools/WebConsoleUtils.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "NetworkMonitor",
-                                  "resource://gre/modules/devtools/WebConsoleUtils.jsm");
-
 XPCOMUtils.defineLazyModuleGetter(this, "ConsoleAPIStorage",
                                   "resource://gre/modules/ConsoleAPIStorage.jsm");
 
+for (let name of ["WebConsoleUtils", "ConsoleServiceListener",
+                  "ConsoleAPIListener", "ConsoleProgressListener",
+                  "JSTermHelpers", "JSPropertyProvider", "NetworkMonitor"]) {
+  Object.defineProperty(this, name, {
+    get: function(prop) {
+      if (prop == "WebConsoleUtils") {
+        prop = "Utils";
+      }
+      return devtools.require("devtools/toolkit/webconsole/utils")[prop];
+    }.bind(null, name),
+    configurable: true,
+    enumerable: true
+  });
+}
+
 
 /**
  * The WebConsoleActor implements capabilities needed for the Web Console
@@ -1004,7 +1000,7 @@ WebConsoleActor.prototype =
    * is about to be recorded.
    *
    * @see NetworkEventActor
-   * @see NetworkMonitor from WebConsoleUtils.jsm
+   * @see NetworkMonitor from webconsole/utils.js
    *
    * @param object aEvent
    *        The initial network request event information.
diff --git a/toolkit/devtools/server/tests/mochitest/Makefile.in b/toolkit/devtools/server/tests/mochitest/Makefile.in
index 9f93bfbfc3d2..ee7fe93c5b09 100644
--- a/toolkit/devtools/server/tests/mochitest/Makefile.in
+++ b/toolkit/devtools/server/tests/mochitest/Makefile.in
@@ -16,6 +16,7 @@ MOCHITEST_CHROME_FILES	= \
 	inspector-traversal-data.html \
 	test_inspector-changeattrs.html \
 	test_inspector-changevalue.html \
+	test_inspector-hide.html \
 	test_inspector-insert.html \
 	test_inspector-mutations-attr.html \
 	test_inspector-mutations-childlist.html \
diff --git a/toolkit/devtools/server/tests/mochitest/test_inspector-hide.html b/toolkit/devtools/server/tests/mochitest/test_inspector-hide.html
new file mode 100644
index 000000000000..a073ddac41b6
--- /dev/null
+++ b/toolkit/devtools/server/tests/mochitest/test_inspector-hide.html
@@ -0,0 +1,79 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug </title>
+
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css">
+  <script type="application/javascript;version=1.8" src="inspector-helpers.js"></script>
+  <script type="application/javascript;version=1.8">
+Components.utils.import("resource://gre/modules/devtools/Loader.jsm");
+
+const promise = devtools.require("sdk/core/promise");
+const inspector = devtools.require("devtools/server/actors/inspector");
+
+window.onload = function() {
+  SimpleTest.waitForExplicitFinish();
+  runNextTest();
+}
+
+var gWalker = null;
+var gClient = null;
+
+addTest(function setup() {
+  let url = document.getElementById("inspectorContent").href;
+  attachURL(url, function(err, client, tab, doc) {
+    gInspectee = doc;
+    let {InspectorFront} = devtools.require("devtools/server/actors/inspector");
+    let inspector = InspectorFront(client, tab);
+    promiseDone(inspector.getWalker().then(walker => {
+      ok(walker, "getWalker() should return an actor.");
+      gClient = client;
+      gWalker = walker;
+    }).then(runNextTest));
+  });
+});
+
+addTest(function testRearrange() {
+  let listFront = null;
+  let listNode = gInspectee.querySelector("#longlist");
+
+  promiseDone(gWalker.querySelector(gWalker.rootNode, "#longlist").then(front => {
+    listFront = front;
+  }).then(() => {
+    let computed = gInspectee.defaultView.getComputedStyle(listNode);
+    ok(computed.visibility, "visible", "Node should be visible to start with");
+    return gWalker.hideNode(listFront);
+  }).then(response => {
+    let computed = gInspectee.defaultView.getComputedStyle(listNode);
+    ok(computed.visibility, "hidden", "Node should be hidden");
+    return gWalker.unhideNode(listFront);
+  }).then(() => {
+    let computed = gInspectee.defaultView.getComputedStyle(listNode);
+    ok(computed.visibility, "visible", "Node should be visible again.");
+  }).then(runNextTest));
+});
+
+addTest(function cleanup() {
+  delete gWalker;
+  delete gClient;
+  runNextTest();
+});
+
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=">Mozilla Bug </a>
+<a id="inspectorContent" target="_blank" href="inspector-traversal-data.html">Test Document</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+</pre>
+</body>
+</html>
diff --git a/toolkit/devtools/server/tests/unit/test_blackboxing-01.js b/toolkit/devtools/server/tests/unit/test_blackboxing-01.js
index e6ff25ab53a5..72c055f6cc19 100644
--- a/toolkit/devtools/server/tests/unit/test_blackboxing-01.js
+++ b/toolkit/devtools/server/tests/unit/test_blackboxing-01.js
@@ -83,7 +83,7 @@ function test_black_box_default() {
                     "Should step into `doStuff`.");
       },
       function onDebuggerStatementFrames(aFrames) {
-        do_check_true(!aFrames.some(f => f.isBlackBoxed));
+        do_check_true(!aFrames.some(f => f.source.isBlackBoxed));
       },
       test_black_boxing.bind(null, sourceClient)
     );
@@ -108,9 +108,9 @@ function test_black_boxing(aSourceClient) {
       function onDebuggerStatementFrames(aFrames) {
         for (let f of aFrames) {
           if (f.where.url == BLACK_BOXED_URL) {
-            do_check_true(f.isBlackBoxed, "Should be black boxed");
+            do_check_true(f.source.isBlackBoxed, "Should be black boxed");
           } else {
-            do_check_true(!f.isBlackBoxed, "Should not be black boxed")
+            do_check_true(!f.source.isBlackBoxed, "Should not be black boxed")
           }
         }
       },
@@ -133,7 +133,7 @@ function test_unblack_boxing(aSourceClient) {
                     "Should step into `doStuff`.");
       },
       function onDebuggerStatementFrames(aFrames) {
-        do_check_true(!aFrames.some(f => f.isBlackBoxed));
+        do_check_true(!aFrames.some(f => f.source.isBlackBoxed));
       },
       finishClient.bind(null, gClient)
     );
diff --git a/toolkit/devtools/server/tests/unit/test_trace_actor-04.js b/toolkit/devtools/server/tests/unit/test_trace_actor-04.js
index c7d2c2ef828d..265406496b13 100644
--- a/toolkit/devtools/server/tests/unit/test_trace_actor-04.js
+++ b/toolkit/devtools/server/tests/unit/test_trace_actor-04.js
@@ -40,6 +40,8 @@ function test_enter_exit_frame()
                 'enteredFrame response should have type "enteredFrame"');
     do_check_eq(typeof aPacket.sequence, "number",
                 'enteredFrame response should have sequence number');
+    do_check_true(!isNaN(aPacket.sequence),
+                  'enteredFrame sequence should be a number');
     do_check_eq(typeof aPacket.name, "string",
                 'enteredFrame response should have function name');
     packetNames[aPacket.sequence] = aPacket.name;
@@ -51,6 +53,8 @@ function test_enter_exit_frame()
                 'exitedFrame response should have type "exitedFrame"');
     do_check_eq(typeof aPacket.sequence, "number",
                 'exitedFrame response should have sequence number');
+    do_check_true(!isNaN(aPacket.sequence),
+                  'exitedFrame sequence should be a number');
   });
 
   start_trace()
diff --git a/toolkit/devtools/server/tests/unit/test_trace_actor-05.js b/toolkit/devtools/server/tests/unit/test_trace_actor-05.js
index 17a740074139..9bd489817633 100644
--- a/toolkit/devtools/server/tests/unit/test_trace_actor-05.js
+++ b/toolkit/devtools/server/tests/unit/test_trace_actor-05.js
@@ -2,8 +2,8 @@
  http://creativecommons.org/publicdomain/zero/1.0/ */
 
 /**
- * Simple tests for "callsite", "time", "parameterNames", "arguments",
- * and "return" trace types.
+ * Simple tests for "location", "callsite", "time", "parameterNames",
+ * "arguments", and "return" trace types.
  */
 
 let {defer} = devtools.require("sdk/core/promise");
@@ -28,6 +28,29 @@ function run_test()
   do_test_pending();
 }
 
+function check_number(value, name)
+{
+  do_check_eq(typeof value, "number", name + ' should be a number');
+  do_check_true(!isNaN(value), name + ' should be a number');
+}
+
+function check_location(actual, expected, name)
+{
+  do_check_eq(typeof actual, "object",
+              name + ' missing expected source location');
+
+  check_number(actual.line, name + ' line');
+  check_number(actual.column, name + ' column');
+
+  do_check_eq(actual.url, expected.url,
+              name + ' location should have url ' + expected.url);
+  do_check_eq(actual.line, expected.line,
+              name + ' location should have source line of ' + expected.line);
+  do_check_eq(actual.column, expected.column,
+              name + ' location should have source column of ' + expected.line);
+
+}
+
 function test_enter_exit_frame()
 {
   let packets = [];
@@ -35,24 +58,30 @@ function test_enter_exit_frame()
   gTraceClient.addListener("enteredFrame", function(aEvent, aPacket) {
     do_check_eq(aPacket.type, "enteredFrame",
                 'enteredFrame response should have type "enteredFrame"');
-    do_check_eq(typeof aPacket.sequence, "number",
-                'enteredFrame response should have sequence number');
     do_check_eq(typeof aPacket.name, "string",
                 'enteredFrame response should have function name');
-    do_check_eq(typeof aPacket.callsite, "object",
-                'enteredFrame response should have callsite');
-    do_check_eq(typeof aPacket.time, "number",
-                'enteredFrame response should have time');
+    do_check_eq(typeof aPacket.location, "object",
+                'enteredFrame response should have source location');
+
+    check_number(aPacket.sequence, 'enteredFrame sequence');
+    check_number(aPacket.time, 'enteredFrame time');
+    check_number(aPacket.location.line, 'enteredFrame source line');
+    check_number(aPacket.location.column, 'enteredFrame source column');
+    if (aPacket.callsite) {
+      check_number(aPacket.callsite.line, 'enteredFrame callsite line');
+      check_number(aPacket.callsite.column, 'enteredFrame callsite column');
+    }
+
     packets[aPacket.sequence] = aPacket;
   });
 
   gTraceClient.addListener("exitedFrame", function(aEvent, aPacket) {
     do_check_eq(aPacket.type, "exitedFrame",
                 'exitedFrame response should have type "exitedFrame"');
-    do_check_eq(typeof aPacket.sequence, "number",
-                'exitedFrame response should have sequence number');
-    do_check_eq(typeof aPacket.time, "number",
-                'exitedFrame response should have time');
+
+    check_number(aPacket.sequence, 'exitedFrame sequence');
+    check_number(aPacket.time, 'exitedFrame time');
+
     packets[aPacket.sequence] = aPacket;
   });
 
@@ -60,28 +89,42 @@ function test_enter_exit_frame()
     .then(eval_code)
     .then(stop_trace)
     .then(function() {
-      do_check_eq(packets[2].name, "foo",
-                  'Third packet in sequence should be entry to "foo" frame');
+      let url = getFileUrl("tracerlocations.js");
 
-      do_check_eq(typeof packets[2].parameterNames, "object",
+      check_location(packets[0].location, { url: url, line: 1, column: 0 },
+                    'global entry packet');
+
+      do_check_eq(packets[1].name, "foo",
+                  'Second packet in sequence should be entry to "foo" frame');
+
+      // foo's definition is at tracerlocations.js:3:0, but
+      // Debugger.Script does not provide complete definition
+      // locations (bug 901138). tracerlocations.js:4:2 is the first
+      // statement in the function (used as an approximation).
+      check_location(packets[1].location, { url: url, line: 4, column: 2 },
+                     'foo source');
+      check_location(packets[1].callsite, { url: url, line: 8, column: 0 },
+                     'foo callsite');
+
+      do_check_eq(typeof packets[1].parameterNames, "object",
                   'foo entry packet should have parameterNames');
-      do_check_eq(packets[2].parameterNames.length, 1,
+      do_check_eq(packets[1].parameterNames.length, 1,
                   'foo should have only one formal parameter');
-      do_check_eq(packets[2].parameterNames[0], "x",
+      do_check_eq(packets[1].parameterNames[0], "x",
                   'foo should have formal parameter "x"');
 
-      do_check_eq(typeof packets[2].arguments, "object",
+      do_check_eq(typeof packets[1].arguments, "object",
                   'foo entry packet should have arguments');
-      do_check_eq(typeof packets[2].arguments.values, "object",
-                  'foo arguments object should have values array');
-      do_check_eq(packets[2].arguments.values.length, 1,
+      do_check_true(Array.isArray(packets[1].arguments),
+                    'foo entry packet arguments should be an array');
+      do_check_eq(packets[1].arguments.length, 1,
                   'foo should have only one actual parameter');
-      do_check_eq(packets[2].arguments.values[0], 42,
+      do_check_eq(packets[1].arguments[0], 42,
                   'foo should have actual parameter 42');
 
-      do_check_eq(typeof packets[3].return, "object",
+      do_check_eq(typeof packets[2].return, "string",
                   'Fourth packet in sequence should be exit from "foo" frame');
-      do_check_eq(packets[3].return.value, "bar",
+      do_check_eq(packets[2].return, "bar",
                   'foo should return "bar"');
 
       finishClient(gClient);
@@ -92,7 +135,7 @@ function start_trace()
 {
   let deferred = defer();
   gTraceClient.startTrace(
-    ["name", "callsite", "time", "parameterNames", "arguments", "return"],
+    ["name", "location", "callsite", "time", "parameterNames", "arguments", "return"],
     null,
     function() { deferred.resolve(); });
   return deferred.promise;
@@ -100,12 +143,9 @@ function start_trace()
 
 function eval_code()
 {
-  gDebuggee.eval("(" + function() {
-    function foo(x) {
-      return "bar";
-    }
-    foo(42);
-  } + ")()");
+  let code = readFile("tracerlocations.js");
+  Components.utils.evalInSandbox(code, gDebuggee, "1.8",
+                                getFileUrl("tracerlocations.js"), 1);
 }
 
 function stop_trace()
diff --git a/toolkit/devtools/server/tests/unit/test_trace_actor-06.js b/toolkit/devtools/server/tests/unit/test_trace_actor-06.js
index 22fd98431a4c..3df0372e82db 100644
--- a/toolkit/devtools/server/tests/unit/test_trace_actor-06.js
+++ b/toolkit/devtools/server/tests/unit/test_trace_actor-06.js
@@ -2,8 +2,8 @@
  http://creativecommons.org/publicdomain/zero/1.0/ */
 
 /**
- * Tests that objects, nested objects, and circular references are
- * correctly serialized and sent in exitedFrame packets.
+ * Tests that objects are correctly serialized and sent in exitedFrame
+ * packets.
  */
 
 let {defer} = devtools.require("sdk/core/promise");
@@ -30,24 +30,51 @@ function run_test()
 
 function test_enter_exit_frame()
 {
-  let packetsSeen = 0;
-
   gTraceClient.addListener("exitedFrame", function(aEvent, aPacket) {
     if (aPacket.sequence === 3) {
-      do_check_eq(typeof aPacket.return, "object",
+      let obj = aPacket.return;
+      do_check_eq(typeof obj, "object",
                   'exitedFrame response should have return value');
+      do_check_eq(typeof obj.prototype, "object",
+                  'return value should have prototype');
+      do_check_eq(typeof obj.ownProperties, "object",
+                  'return value should have ownProperties list');
+      do_check_eq(typeof obj.safeGetterValues, "object",
+                  'return value should have safeGetterValues');
 
-      let objPool = aPacket.return.objectPool;
-      let retval = objPool[aPacket.return.value.objectId];
-      let obj = objPool[retval.ownProperties.obj.value.objectId];
+      do_check_eq(typeof obj.ownProperties.num, "object",
+                  'return value should have property "num"');
+      do_check_eq(typeof obj.ownProperties.str, "object",
+                  'return value should have property "str"');
+      do_check_eq(typeof obj.ownProperties.bool, "object",
+                  'return value should have property "bool"');
+      do_check_eq(typeof obj.ownProperties.undef, "object",
+                  'return value should have property "undef"');
+      do_check_eq(typeof obj.ownProperties.undef.value, "object",
+                  'return value property "undef" should be a grip');
+      do_check_eq(typeof obj.ownProperties.nil, "object",
+                  'return value should have property "nil"');
+      do_check_eq(typeof obj.ownProperties.nil.value, "object",
+                  'return value property "nil" should be a grip');
+      do_check_eq(typeof obj.ownProperties.obj, "object",
+                  'return value should have property "obj"');
+      do_check_eq(typeof obj.ownProperties.obj.value, "object",
+                  'return value property "obj" should be a grip');
+      do_check_eq(typeof obj.ownProperties.arr, "object",
+                  'return value should have property "arr"');
+      do_check_eq(typeof obj.ownProperties.arr.value, "object",
+                  'return value property "arr" should be a grip');
 
-      do_check_eq(retval.ownProperties.num.value, 25);
-      do_check_eq(retval.ownProperties.str.value, "foo");
-      do_check_eq(retval.ownProperties.bool.value, false);
-      do_check_eq(retval.ownProperties.undef.value.type, "undefined");
-      do_check_eq(retval.ownProperties.nil.value.type, "null");
-      do_check_eq(obj.ownProperties.self.value.objectId,
-                  retval.ownProperties.obj.value.objectId);
+      do_check_eq(obj.prototype.type, "object");
+      do_check_eq(obj.ownProperties.num.value, 25);
+      do_check_eq(obj.ownProperties.str.value, "foo");
+      do_check_eq(obj.ownProperties.bool.value, false);
+      do_check_eq(obj.ownProperties.undef.value.type, "undefined");
+      do_check_eq(obj.ownProperties.nil.value.type, "null");
+      do_check_eq(obj.ownProperties.obj.value.type, "object");
+      do_check_eq(obj.ownProperties.obj.value.class, "Object");
+      do_check_eq(obj.ownProperties.arr.value.type, "object");
+      do_check_eq(obj.ownProperties.arr.value.class, "Array");
     }
   });
 
@@ -70,18 +97,18 @@ function eval_code()
 {
   gDebuggee.eval("(" + function() {
     function foo() {
-      let obj = Object.create(null);
+      let obj = {};
       obj.self = obj;
 
-      let retval = Object.create(null);
-      retval.num = 25;
-      retval.str = "foo";
-      retval.bool = false;
-      retval.undef = undefined;
-      retval.nil = null;
-      retval.obj = obj;
-
-      return retval;
+      return {
+        num: 25,
+        str: "foo",
+        bool: false,
+        undef: undefined,
+        nil: null,
+        obj: obj,
+        arr: [1,2,3,4,5]
+      };
     }
     foo();
   } + ")()");
diff --git a/toolkit/devtools/server/tests/unit/test_trace_actor-07.js b/toolkit/devtools/server/tests/unit/test_trace_actor-07.js
deleted file mode 100644
index 5b3899212c2e..000000000000
--- a/toolkit/devtools/server/tests/unit/test_trace_actor-07.js
+++ /dev/null
@@ -1,99 +0,0 @@
-/* Any copyright is dedicated to the Public Domain.
- http://creativecommons.org/publicdomain/zero/1.0/ */
-
-/**
- * Tests that chained object prototypes are correctly serialized and
- * sent in exitedFrame packets.
- */
-
-let {defer} = devtools.require("sdk/core/promise");
-
-var gDebuggee;
-var gClient;
-var gTraceClient;
-
-function run_test()
-{
-  initTestTracerServer();
-  gDebuggee = addTestGlobal("test-tracer-actor");
-  gClient = new DebuggerClient(DebuggerServer.connectPipe());
-  gClient.connect(function() {
-    attachTestTab(gClient, "test-tracer-actor", function(aResponse, aTabClient) {
-      gClient.attachTracer(aResponse.traceActor, function(aResponse, aTraceClient) {
-        gTraceClient = aTraceClient;
-        test_enter_exit_frame();
-      });
-    });
-  });
-  do_test_pending();
-}
-
-function test_enter_exit_frame()
-{
-  let packetsSeen = 0;
-
-  gTraceClient.addListener("exitedFrame", function(aEvent, aPacket) {
-    if (aPacket.sequence === 3) {
-      do_check_eq(typeof aPacket.return, "object",
-                  'exitedFrame response should have return value');
-
-      let objPool = aPacket.return.objectPool;
-      let obj = objPool[aPacket.return.value.objectId];
-      let propObj = objPool[obj.ownProperties.b.value.objectId];
-      let proto = objPool[obj.prototype.objectId];
-      let protoProto = objPool[proto.prototype.objectId];
-
-      do_check_eq(obj.ownProperties.a.value, 1);
-      do_check_eq(propObj.ownProperties.c.value, "c");
-      do_check_eq(proto.ownProperties.d.value, "foo");
-      do_check_eq(proto.ownProperties.e.value, 42);
-      do_check_eq(protoProto.ownProperties.f.value, 2);
-    }
-  });
-
-  start_trace()
-    .then(eval_code)
-    .then(stop_trace)
-    .then(function() {
-      finishClient(gClient);
-    });
-}
-
-function start_trace()
-{
-  let deferred = defer();
-  gTraceClient.startTrace(["return"], null, function() { deferred.resolve(); });
-  return deferred.promise;
-}
-
-function eval_code()
-{
-  gDebuggee.eval("(" + function() {
-    function foo() {
-      let protoProto = Object.create(null);
-      protoProto.f = 2;
-
-      let proto = Object.create(protoProto);
-      proto.d = "foo";
-      proto.e = 42;
-
-      let obj = Object.create(proto);
-      obj.a = 1;
-
-      let propObj = Object.create(null);
-      propObj.c = "c";
-
-      obj.b = propObj;
-
-      return obj;
-    }
-    foo();
-  } + ")()");
-}
-
-function stop_trace()
-{
-  let deferred = defer();
-  gTraceClient.stopTrace(null, function() { deferred.resolve(); });
-  return deferred.promise;
-}
diff --git a/toolkit/devtools/server/tests/unit/tracerlocations.js b/toolkit/devtools/server/tests/unit/tracerlocations.js
new file mode 100644
index 000000000000..aa4677c0f70a
--- /dev/null
+++ b/toolkit/devtools/server/tests/unit/tracerlocations.js
@@ -0,0 +1,8 @@
+// For JS Tracer tests dealing with source locations.
+
+function foo(x) {
+  x += 6;
+  return "bar";
+}
+
+foo(42);
diff --git a/toolkit/devtools/server/tests/unit/xpcshell.ini b/toolkit/devtools/server/tests/unit/xpcshell.ini
index 55a78cada737..56ba4f6d6257 100644
--- a/toolkit/devtools/server/tests/unit/xpcshell.ini
+++ b/toolkit/devtools/server/tests/unit/xpcshell.ini
@@ -157,4 +157,3 @@ reason = bug 820380
 [test_trace_actor-04.js]
 [test_trace_actor-05.js]
 [test_trace_actor-06.js]
-[test_trace_actor-07.js]
diff --git a/toolkit/devtools/webconsole/Makefile.in b/toolkit/devtools/webconsole/Makefile.in
index 6ef493c75712..fe3837d47564 100644
--- a/toolkit/devtools/webconsole/Makefile.in
+++ b/toolkit/devtools/webconsole/Makefile.in
@@ -12,4 +12,4 @@ include $(DEPTH)/config/autoconf.mk
 include $(topsrcdir)/config/rules.mk
 
 libs::
-	$(INSTALL) $(IFLAGS1) $(srcdir)/*.jsm $(FINAL_TARGET)/modules/devtools
+	$(INSTALL) $(IFLAGS1) $(srcdir)/*.js $(FINAL_TARGET)/modules/devtools/toolkit/webconsole
diff --git a/toolkit/devtools/webconsole/WebConsoleClient.jsm b/toolkit/devtools/webconsole/client.js
similarity index 96%
rename from toolkit/devtools/webconsole/WebConsoleClient.jsm
rename to toolkit/devtools/webconsole/client.js
index 237b91877a50..91ab696bc7b4 100644
--- a/toolkit/devtools/webconsole/WebConsoleClient.jsm
+++ b/toolkit/devtools/webconsole/client.js
@@ -6,16 +6,9 @@
 
 "use strict";
 
-const Cc = Components.classes;
-const Ci = Components.interfaces;
-const Cu = Components.utils;
+const {Cc, Ci, Cu} = require("chrome");
 
-Cu.import("resource://gre/modules/XPCOMUtils.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "LongStringClient",
-                                  "resource://gre/modules/devtools/dbg-client.jsm");
-
-this.EXPORTED_SYMBOLS = ["WebConsoleClient"];
+loader.lazyImporter(this, "LongStringClient", "resource://gre/modules/devtools/dbg-client.jsm");
 
 /**
  * A WebConsoleClient is used as a front end for the WebConsoleActor that is
@@ -26,12 +19,13 @@ this.EXPORTED_SYMBOLS = ["WebConsoleClient"];
  * @param string aActor
  *        The WebConsoleActor ID.
  */
-this.WebConsoleClient = function WebConsoleClient(aDebuggerClient, aActor)
+function WebConsoleClient(aDebuggerClient, aActor)
 {
   this._actor = aActor;
   this._client = aDebuggerClient;
   this._longStrings = {};
 }
+exports.WebConsoleClient = WebConsoleClient;
 
 WebConsoleClient.prototype = {
   _longStrings: null,
diff --git a/toolkit/devtools/webconsole/NetworkHelper.jsm b/toolkit/devtools/webconsole/network-helper.js
similarity index 95%
rename from toolkit/devtools/webconsole/NetworkHelper.jsm
rename to toolkit/devtools/webconsole/network-helper.js
index ea2e06d88ffd..ed13f3e1a05c 100644
--- a/toolkit/devtools/webconsole/NetworkHelper.jsm
+++ b/toolkit/devtools/webconsole/network-helper.js
@@ -52,19 +52,8 @@
  *  Mihai Sucan (Mozilla Corp.)
  */
 
-const Cc = Components.classes;
-const Ci = Components.interfaces;
-const Cu = Components.utils;
-
-Cu.import("resource://gre/modules/XPCOMUtils.jsm");
-
-XPCOMUtils.defineLazyGetter(this, "NetUtil", function () {
-  var obj = {};
-  Cu.import("resource://gre/modules/NetUtil.jsm", obj);
-  return obj.NetUtil;
-});
-
-this.EXPORTED_SYMBOLS = ["NetworkHelper"];
+const {Cc, Ci, Cu} = require("chrome");
+loader.lazyImporter(this, "NetUtil", "resource://gre/modules/NetUtil.jsm");
 
 /**
  * Helper object for networking stuff.
@@ -72,9 +61,7 @@ this.EXPORTED_SYMBOLS = ["NetworkHelper"];
  * Most of the following functions have been taken from the Firebug source. They
  * have been modified to match the Firefox coding rules.
  */
-
-this.NetworkHelper =
-{
+let NetworkHelper = {
   /**
    * Converts aText with a given aCharset to unicode.
    *
@@ -268,8 +255,7 @@ this.NetworkHelper =
       let contentCharset = aChannel.contentCharset || aCharset;
 
       // Read the content of the stream using contentCharset as encoding.
-      aCallback(NetworkHelper.readAndConvertFromStream(aInputStream,
-                                                       contentCharset));
+      aCallback(this.readAndConvertFromStream(aInputStream, contentCharset));
     });
   },
 
@@ -438,7 +424,7 @@ this.NetworkHelper =
       return true;
     }
 
-    switch (NetworkHelper.mimeCategoryMap[aMimeType]) {
+    switch (this.mimeCategoryMap[aMimeType]) {
       case "txt":
       case "js":
       case "json":
@@ -452,4 +438,8 @@ this.NetworkHelper =
         return false;
     }
   },
+};
+
+for (let prop of Object.getOwnPropertyNames(NetworkHelper)) {
+  exports[prop] = NetworkHelper[prop];
 }
diff --git a/toolkit/devtools/webconsole/test/common.js b/toolkit/devtools/webconsole/test/common.js
index 2e4d2db3e371..9972a1677e7d 100644
--- a/toolkit/devtools/webconsole/test/common.js
+++ b/toolkit/devtools/webconsole/test/common.js
@@ -9,7 +9,12 @@ const XHTML_NS = "http://www.w3.org/1999/xhtml";
 
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/ConsoleAPIStorage.jsm");
-Cu.import("resource://gre/modules/devtools/WebConsoleUtils.jsm");
+
+let devtools = Cu.import("resource://gre/modules/devtools/Loader.jsm", {}).devtools;
+let WebConsoleUtils = devtools.require("devtools/toolkit/webconsole/utils").Utils;
+
+let {ConsoleServiceListener, ConsoleAPIListener} =
+  devtools.require("devtools/toolkit/webconsole/utils");
 
 function initCommon()
 {
diff --git a/toolkit/devtools/webconsole/WebConsoleUtils.jsm b/toolkit/devtools/webconsole/utils.js
similarity index 96%
rename from toolkit/devtools/webconsole/WebConsoleUtils.jsm
rename to toolkit/devtools/webconsole/utils.js
index 1facdb2933f2..2df725bc16c6 100644
--- a/toolkit/devtools/webconsole/WebConsoleUtils.jsm
+++ b/toolkit/devtools/webconsole/utils.js
@@ -6,45 +6,24 @@
 
 "use strict";
 
-const Cc = Components.classes;
-const Ci = Components.interfaces;
-const Cu = Components.utils;
+const {Cc, Ci, Cu} = require("chrome");
 
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 
-XPCOMUtils.defineLazyModuleGetter(this, "Services",
-                                  "resource://gre/modules/Services.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "ConsoleAPIStorage",
-                                  "resource://gre/modules/ConsoleAPIStorage.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "NetUtil",
-                                  "resource://gre/modules/NetUtil.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "NetworkHelper",
-                                  "resource://gre/modules/devtools/NetworkHelper.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "PrivateBrowsingUtils",
-                                  "resource://gre/modules/PrivateBrowsingUtils.jsm");
-
-XPCOMUtils.defineLazyServiceGetter(this, "gActivityDistributor",
-                                   "@mozilla.org/network/http-activity-distributor;1",
-                                   "nsIHttpActivityDistributor");
+loader.lazyGetter(this, "NetworkHelper", () => require("devtools/toolkit/webconsole/network-helper"));
+loader.lazyImporter(this, "Services", "resource://gre/modules/Services.jsm");
+loader.lazyImporter(this, "ConsoleAPIStorage", "resource://gre/modules/ConsoleAPIStorage.jsm");
+loader.lazyImporter(this, "NetUtil", "resource://gre/modules/NetUtil.jsm");
+loader.lazyImporter(this, "PrivateBrowsingUtils", "resource://gre/modules/PrivateBrowsingUtils.jsm");
+loader.lazyServiceGetter(this, "gActivityDistributor",
+                         "@mozilla.org/network/http-activity-distributor;1",
+                         "nsIHttpActivityDistributor");
 
 // TODO: Bug 842672 - toolkit/ imports modules from browser/.
 // Note that these are only used in JSTermHelpers, see $0 and pprint().
-XPCOMUtils.defineLazyModuleGetter(this, "gDevTools",
-                                  "resource:///modules/devtools/gDevTools.jsm");
-XPCOMUtils.defineLazyModuleGetter(this, "devtools",
-                                  "resource://gre/modules/devtools/Loader.jsm");
-
-XPCOMUtils.defineLazyModuleGetter(this, "VariablesView",
-                                  "resource:///modules/devtools/VariablesView.jsm");
-
-this.EXPORTED_SYMBOLS = ["WebConsoleUtils", "JSPropertyProvider", "JSTermHelpers",
-                         "ConsoleServiceListener", "ConsoleAPIListener",
-                         "NetworkResponseListener", "NetworkMonitor",
-                         "ConsoleProgressListener"];
+loader.lazyImporter(this, "gDevTools", "resource:///modules/devtools/gDevTools.jsm");
+loader.lazyImporter(this, "devtools", "resource://gre/modules/devtools/Loader.jsm");
+loader.lazyImporter(this, "VariablesView", "resource:///modules/devtools/VariablesView.jsm");
 
 // Match the function name from the result of toString() or toSource().
 //
@@ -57,7 +36,7 @@ const REGEX_MATCH_FUNCTION_NAME = /^\(?function\s+([^(\s]+)\s*\(/;
 // Match the function arguments from the result of toString() or toSource().
 const REGEX_MATCH_FUNCTION_ARGS = /^\(?function\s*[^\s(]*\s*\((.+?)\)/;
 
-this.WebConsoleUtils = {
+let WebConsoleUtils = {
   /**
    * Convenience function to unwrap a wrapped object.
    *
@@ -263,7 +242,7 @@ this.WebConsoleUtils = {
     let desc = null;
     while (aObject) {
       try {
-        if (desc = Object.getOwnPropertyDescriptor(aObject, aProp)) {
+        if ((desc = Object.getOwnPropertyDescriptor(aObject, aProp))) {
           break;
         }
       }
@@ -511,6 +490,7 @@ this.WebConsoleUtils = {
     return aGrip && typeof(aGrip) == "object" && aGrip.actor;
   },
 };
+exports.Utils = WebConsoleUtils;
 
 //////////////////////////////////////////////////////////////////////////
 // Localization
@@ -601,7 +581,7 @@ WebConsoleUtils.l10n.prototype = {
 // JS Completer
 //////////////////////////////////////////////////////////////////////////
 
-this.JSPropertyProvider = (function _JSPP(WCU) {
+(function _JSPP(WCU) {
 const STATE_NORMAL = 0;
 const STATE_QUOTE = 2;
 const STATE_DQUOTE = 3;
@@ -906,7 +886,7 @@ function getMatchedProps(aObj, aOptions = {matchProp: ""})
 }
 
 
-return JSPropertyProvider;
+exports.JSPropertyProvider = JSPropertyProvider;
 })(WebConsoleUtils);
 
 ///////////////////////////////////////////////////////////////////////////////
@@ -923,14 +903,15 @@ return JSPropertyProvider;
  *        for filtering out messages that belong to other windows.
  * @param object aListener
  *        The listener object must have one method:
- *        - onConsoleServiceMessage(). This method is invoked with one argument, the
- *        nsIConsoleMessage, whenever a relevant message is received.
+ *        - onConsoleServiceMessage(). This method is invoked with one argument,
+ *        the nsIConsoleMessage, whenever a relevant message is received.
  */
-this.ConsoleServiceListener = function ConsoleServiceListener(aWindow, aListener)
+function ConsoleServiceListener(aWindow, aListener)
 {
   this.window = aWindow;
   this.listener = aListener;
 }
+exports.ConsoleServiceListener = ConsoleServiceListener;
 
 ConsoleServiceListener.prototype =
 {
@@ -1096,11 +1077,12 @@ ConsoleServiceListener.prototype =
  *        Console API message that comes from the observer service, whenever
  *        a relevant console API call is received.
  */
-this.ConsoleAPIListener = function ConsoleAPIListener(aWindow, aOwner)
+function ConsoleAPIListener(aWindow, aOwner)
 {
   this.window = aWindow;
   this.owner = aOwner;
 }
+exports.ConsoleAPIListener = ConsoleAPIListener;
 
 ConsoleAPIListener.prototype =
 {
@@ -1214,7 +1196,7 @@ ConsoleAPIListener.prototype =
  * @param object aOwner
  *        The owning object.
  */
-this.JSTermHelpers = function JSTermHelpers(aOwner)
+function JSTermHelpers(aOwner)
 {
   /**
    * Find a node by ID.
@@ -1255,12 +1237,12 @@ this.JSTermHelpers = function JSTermHelpers(aOwner)
   {
     let nodes = new aOwner.window.wrappedJSObject.Array();
     let doc = aOwner.window.document;
-    let aContext = aContext || doc;
+    aContext = aContext || doc;
 
     let results = doc.evaluate(aXPath, aContext, null,
                                Ci.nsIDOMXPathResult.ANY_TYPE, null);
     let node;
-    while (node = results.iterateNext()) {
+    while ((node = results.iterateNext())) {
       nodes.push(node);
     }
 
@@ -1389,7 +1371,7 @@ this.JSTermHelpers = function JSTermHelpers(aOwner)
         type: "error",
         message: "helperFuncUnsupportedTypeError",
       };
-      return;
+      return null;
     }
 
     aOwner.helperResult = { rawOutput: true };
@@ -1433,10 +1415,10 @@ this.JSTermHelpers = function JSTermHelpers(aOwner)
     aOwner.helperResult = { rawOutput: true };
     return String(aString);
   };
-};
+}
+exports.JSTermHelpers = JSTermHelpers;
 
-
-(function(_global, WCU) {
+(function(WCU) {
 ///////////////////////////////////////////////////////////////////////////////
 // Network logging
 ///////////////////////////////////////////////////////////////////////////////
@@ -2346,9 +2328,9 @@ NetworkMonitor.prototype = {
   },
 };
 
-_global.NetworkMonitor = NetworkMonitor;
-_global.NetworkResponseListener = NetworkResponseListener;
-})(this, WebConsoleUtils);
+exports.NetworkMonitor = NetworkMonitor;
+exports.NetworkResponseListener = NetworkResponseListener;
+})(WebConsoleUtils);
 
 /**
  * A WebProgressListener that listens for location changes.
@@ -2364,12 +2346,12 @@ _global.NetworkResponseListener = NetworkResponseListener;
  *        - onFileActivity(aFileURI)
  *        - onLocationChange(aState, aTabURI, aPageTitle)
  */
-this.ConsoleProgressListener =
- function ConsoleProgressListener(aWindow, aOwner)
+function ConsoleProgressListener(aWindow, aOwner)
 {
   this.window = aWindow;
   this.owner = aOwner;
 }
+exports.ConsoleProgressListener = ConsoleProgressListener;
 
 ConsoleProgressListener.prototype = {
   /**
diff --git a/toolkit/xre/nsWindowsDllInterceptor.h b/toolkit/xre/nsWindowsDllInterceptor.h
index 71731717d3ea..c5fd80f2afe5 100644
--- a/toolkit/xre/nsWindowsDllInterceptor.h
+++ b/toolkit/xre/nsWindowsDllInterceptor.h
@@ -393,6 +393,8 @@ protected:
       }
     }
 #elif defined(_M_X64)
+    byteptr_t directJmpAddr;
+
     while (nBytes < 13) {
 
       // if found JMP 32bit offset, next bytes must be NOP 
@@ -478,11 +480,24 @@ protected:
           }
         } else if (origBytes[nBytes] == 0xc7) {
           // MOV r/m64, imm32
-          if (origBytes[nBytes + 1] & 0xf8 == 0x40) {
+          if ((origBytes[nBytes + 1] & 0xf8) == 0x40) {
             nBytes += 6;
           } else {
             return;
           }
+        } else if (origBytes[nBytes] == 0xff) {
+          pJmp32 = nBytes - 1;
+          // JMP /4
+          if ((origBytes[nBytes+1] & 0xc0) == 0x0 &&
+              (origBytes[nBytes+1] & 0x07) == 0x5) {
+            // [rip+disp32]
+            // convert JMP 32bit offset to JMP 64bit direct
+            directJmpAddr = (byteptr_t)*((uint64_t*)(origBytes + nBytes + 6 + (*((uint32_t*)(origBytes + nBytes + 2)))));
+            nBytes += 6;
+          } else {
+            // not support yet!
+            return;
+          }
         } else {
           // not support yet!
           return;
@@ -501,6 +516,8 @@ protected:
         nBytes++;
       } else if (origBytes[nBytes] == 0xe9) {
         pJmp32 = nBytes;
+        // convert JMP 32bit offset to JMP 64bit direct
+        directJmpAddr = origBytes + pJmp32 + 5 + (*((uint32_t*)(origBytes + pJmp32 + 1)));
         // jmp 32bit offset
         nBytes += 5;
       } else if (origBytes[nBytes] == 0xff) {
@@ -547,8 +564,6 @@ protected:
 #elif defined(_M_X64)
     // If JMP32 opcode found, we don't insert to trampoline jump 
     if (pJmp32 >= 0) {
-      // convert JMP 32bit offset to JMP 64bit direct
-      byteptr_t directJmpAddr = origBytes + pJmp32 + 5 + (*((LONG*)(origBytes+pJmp32+1)));
       // mov r11, address
       tramp[pJmp32]   = 0x49;
       tramp[pJmp32+1] = 0xbb;
diff --git a/widget/windows/nsWindow.cpp b/widget/windows/nsWindow.cpp
index 5f7bfe977c7c..7d71a6123756 100644
--- a/widget/windows/nsWindow.cpp
+++ b/widget/windows/nsWindow.cpp
@@ -6551,6 +6551,20 @@ nsWindow::StartAllowingD3D9(bool aReinitialize)
   }
 }
 
+mozilla::layers::LayersBackend
+nsWindow::GetPreferredCompositorBackend()
+{
+  LayerManagerPrefs prefs;
+  GetLayerManagerPrefs(&prefs);
+  if (prefs.mDisableAcceleration) {
+    return mozilla::layers::LAYERS_BASIC;
+  }
+  if (prefs.mPreferD3D9) {
+    return mozilla::layers::LAYERS_D3D9;
+  }
+  return mozilla::layers::LAYERS_D3D11;
+}
+
 bool
 nsWindow::HasBogusPopupsDropShadowOnMultiMonitor() {
   if (sHasBogusPopupsDropShadowOnMultiMonitor == TRI_UNKNOWN) {
diff --git a/widget/windows/nsWindow.h b/widget/windows/nsWindow.h
index 226b5b19fc6a..ad9586092e39 100644
--- a/widget/windows/nsWindow.h
+++ b/widget/windows/nsWindow.h
@@ -273,7 +273,7 @@ public:
 
   bool                    const DestroyCalled() { return mDestroyCalled; }
 
-  virtual mozilla::layers::LayersBackend GetPreferredCompositorBackend() { return mozilla::layers::LAYERS_D3D11; }
+  virtual mozilla::layers::LayersBackend GetPreferredCompositorBackend();
 
 protected:
 
diff --git a/widget/windows/winrt/FrameworkView.cpp b/widget/windows/winrt/FrameworkView.cpp
index e955c74e89d8..f4878363f273 100644
--- a/widget/windows/winrt/FrameworkView.cpp
+++ b/widget/windows/winrt/FrameworkView.cpp
@@ -368,6 +368,7 @@ FrameworkView::OnSoftkeyboardHidden(IInputPane* aSender,
   sKeyboardIsVisible = false;
   memset(&sKeyboardRect, 0, sizeof(Rect));
   MetroUtils::FireObserver("metro_softkeyboard_hidden");
+  aArgs->put_EnsuredFocusedElementInView(true);
   return S_OK;
 }
 
@@ -381,6 +382,7 @@ FrameworkView::OnSoftkeyboardShown(IInputPane* aSender,
   sKeyboardIsVisible = true;
   aSender->get_OccludedRect(&sKeyboardRect);
   MetroUtils::FireObserver("metro_softkeyboard_shown");
+  aArgs->put_EnsuredFocusedElementInView(true);
   return S_OK;
 }
 
@@ -500,9 +502,14 @@ HRESULT
 FrameworkView::OnAutomationProviderRequested(ICoreWindow* aSender,
                                              IAutomationProviderRequestedEventArgs* aArgs)
 {
+  LogFunction();
   if (!EnsureAutomationProviderCreated())
     return E_FAIL;
-  aArgs->put_AutomationProvider(mAutomationProvider.Get());
+  Log("OnAutomationProviderRequested %X", mAutomationProvider.Get());
+  HRESULT hr = aArgs->put_AutomationProvider(mAutomationProvider.Get());
+  if (FAILED(hr)) {
+    Log("put failed? %X", hr);
+  }
   return S_OK;
 }
 
diff --git a/widget/windows/winrt/MetroAppShell.cpp b/widget/windows/winrt/MetroAppShell.cpp
index 5ec1823209bf..c3761db3ec0d 100644
--- a/widget/windows/winrt/MetroAppShell.cpp
+++ b/widget/windows/winrt/MetroAppShell.cpp
@@ -124,12 +124,14 @@ ProcessNativeEvents(CoreProcessEventsOption eventOption)
   dispatcher->ProcessEvents(eventOption);
 }
 
+// static
 void
 MetroAppShell::ProcessOneNativeEventIfPresent()
 {
   ProcessNativeEvents(CoreProcessEventsOption::CoreProcessEventsOption_ProcessOneIfPresent);
 }
 
+// static
 void
 MetroAppShell::ProcessAllNativeEventsPresent()
 {
diff --git a/widget/windows/winrt/MetroInput.cpp b/widget/windows/winrt/MetroInput.cpp
index 9ab2f0e3287b..08a4ae62887e 100644
--- a/widget/windows/winrt/MetroInput.cpp
+++ b/widget/windows/winrt/MetroInput.cpp
@@ -10,6 +10,7 @@
 #include "nsTArray.h" // Touch lists
 #include "nsIDOMSimpleGestureEvent.h" // Constants for gesture events
 #include "InputData.h"
+#include "UIABridgePrivate.h"
 
 // System headers (alphabetical)
 #include <windows.ui.core.h> // ABI::Window::UI::Core namespace
diff --git a/widget/windows/winrt/MetroWidget.cpp b/widget/windows/winrt/MetroWidget.cpp
index c3901c829e41..16cb3b6694b7 100644
--- a/widget/windows/winrt/MetroWidget.cpp
+++ b/widget/windows/winrt/MetroWidget.cpp
@@ -29,6 +29,7 @@
 #ifdef MOZ_CRASHREPORTER
 #include "nsExceptionHandler.h"
 #endif
+#include "UIABridgePrivate.h"
 
 using namespace Microsoft::WRL;
 using namespace Microsoft::WRL::Wrappers;
@@ -54,8 +55,18 @@ extern PRLogModuleInfo* gWindowsLog;
 
 static uint32_t gInstanceCount = 0;
 const PRUnichar* kMetroSubclassThisProp = L"MetroSubclassThisProp";
+HWND MetroWidget::sICoreHwnd = NULL;
 static const UINT sDefaultBrowserMsgID = RegisterWindowMessageW(L"DefaultBrowserClosing");
 
+// WM_GETOBJECT id pulled from uia headers
+#define UiaRootObjectId -25
+
+namespace mozilla {
+namespace widget {
+namespace winrt {
+extern ComPtr<IUIABridge> gProviderRoot;
+} } }
+
 namespace {
 
   void SendInputs(uint32_t aModifiers, INPUT* aExtraInputs, uint32_t aExtraInputsLen)
@@ -675,6 +686,30 @@ MetroWidget::WindowProcedure(HWND aWnd, UINT aMsg, WPARAM aWParam, LPARAM aLPara
       break;
     }
 
+    case WM_GETOBJECT:
+    {
+      DWORD dwObjId = (LPARAM)(DWORD) aLParam;
+      // Passing this to CallWindowProc can result in a failure due to a timing issue
+      // in winrt core window server code, so we call it directly here. Also, it's not
+      // clear Windows::UI::Core::WindowServer::OnAutomationProviderRequestedEvent is
+      // compatible with metro enabled desktop browsers, it makes an initial call to
+      // UiaReturnRawElementProvider passing the return result from FrameworkView
+      // OnAutomationProviderRequested as the hwnd (me scratches head) which results in
+      // GetLastError always being set to invalid handle (6) after CallWindowProc returns.
+      if (dwObjId == UiaRootObjectId) {
+        NS_ASSERTION(gProviderRoot.Get(), "gProviderRoot is null??");
+        ComPtr<IRawElementProviderSimple> simple;
+        gProviderRoot.As(&simple);
+        LRESULT res = UiaReturnRawElementProvider(aWnd, aWParam, aLParam, simple.Get());
+        if (res) {
+          return res;
+        }
+        NS_ASSERTION(res, "UiaReturnRawElementProvider failed!");
+        Log("UiaReturnRawElementProvider failed! GetLastError=%X", GetLastError());
+      }
+      break;
+    }
+
     default:
     {
       if (aWParam == WM_USER_TSF_TEXTCHANGE) {
@@ -717,6 +752,7 @@ MetroWidget::FindMetroWindow()
 
   // subclass it
   SetSubclass();
+  sICoreHwnd = mWnd;
   return;
 }
 
diff --git a/widget/windows/winrt/MetroWidget.h b/widget/windows/winrt/MetroWidget.h
index 46859d7652bd..7aa27491865b 100644
--- a/widget/windows/winrt/MetroWidget.h
+++ b/widget/windows/winrt/MetroWidget.h
@@ -66,6 +66,8 @@ public:
 
   NS_DECL_ISUPPORTS_INHERITED
 
+  static HWND GetICoreWindowHWND() { return sICoreHwnd; }
+
   // nsWindowBase
   virtual void InitEvent(nsGUIEvent& aEvent, nsIntPoint* aPoint = nullptr) MOZ_OVERRIDE;
   virtual bool DispatchWindowEvent(nsGUIEvent* aEvent) MOZ_OVERRIDE;
@@ -232,6 +234,7 @@ protected:
   nsIntRegion mInvalidatedRegion;
   nsCOMPtr<nsIdleService> mIdleService;
   HWND mWnd;
+  static HWND sICoreHwnd;
   WNDPROC mMetroWndProc;
   bool mTempBasicLayerInUse;
   Microsoft::WRL::ComPtr<mozilla::widget::winrt::MetroInput> mMetroInput;
diff --git a/widget/windows/winrt/UIABridge.cpp b/widget/windows/winrt/UIABridge.cpp
index b50549b4510f..dbf4f4406854 100644
--- a/widget/windows/winrt/UIABridge.cpp
+++ b/widget/windows/winrt/UIABridge.cpp
@@ -6,6 +6,7 @@
 #include "UIABridge.h"
 #include "MetroUtils.h"
 #include "UIABridgePrivate.h"
+#include "MetroWidget.h"
 
 #include <wrl.h>
 #include <OAIdl.h>
@@ -35,7 +36,6 @@ using namespace ABI::Windows::System;
  const type name = {l,w1,w2,{b1,b2,b3,b4,b5,b6,b7,b8}}
 MIDL_DEFINE_GUID(IID, IID_IUIABridge, 0xc78b35b5, 0x5db, 0x43aa, 0xae, 0x73, 0x94, 0xc2, 0x33, 0xa9, 0x3c, 0x98);
 
-
 namespace mozilla {
 namespace widget {
 namespace winrt {
@@ -43,7 +43,7 @@ namespace winrt {
 #define ProviderOptions_UseClientCoordinates (ProviderOptions)0x100
 
 static int gIDIndex = 2;
-static ComPtr<IUIABridge> gProviderRoot = nullptr;
+ComPtr<IUIABridge> gProviderRoot = nullptr;
 static ComPtr<IUIAElement> gElement = nullptr;
 
 HRESULT
@@ -113,6 +113,8 @@ UIABridge::Disconnect()
   mAccessible = nullptr;
 #endif
   mWindow = nullptr;
+  gElement = nullptr;
+  gProviderRoot = nullptr;
   return S_OK;
 }
 
@@ -155,7 +157,7 @@ static bool
 ChildHasFocus(nsCOMPtr<nsIAccessible>& aChild)
 {
   Accessible* access = (Accessible*)aChild.get();
-  Log("Focus element flags: %d %d %d",
+  Log("Focus element flags: editable:%d focusable:%d readonly:%d",
     ((access->NativeState() & mozilla::a11y::states::EDITABLE) > 0),
     ((access->NativeState() & mozilla::a11y::states::FOCUSABLE) > 0),
     ((access->NativeState() & mozilla::a11y::states::READONLY) > 0));
@@ -163,37 +165,10 @@ ChildHasFocus(nsCOMPtr<nsIAccessible>& aChild)
            ((access->NativeState() & mozilla::a11y::states::READONLY) == 0));
 }
 
-// Accessibility calls here to let us know about focus related changes.
-// The only event we are concerned with is lost focus, so that we can
-// signal UIA that the focus on our child has been lost.
 HRESULT
 UIABridge::FocusChangeEvent()
 {
   LogFunction();
-
-  if (!Connected()) {
-    return UIA_E_ELEMENTNOTAVAILABLE;
-  }
-
-  nsCOMPtr<nsIAccessible> child;
-  nsresult rv = mAccessible->GetFocusedChild(getter_AddRefs(child));
-  if (!child) {
-    return S_OK;
-  }
-
-  DumpChildInfo(child);
-
-  if (!ChildHasFocus(child)) {
-    ComPtr<IUIAElement> element;
-    gElement.As(&element);
-    if (!element) {
-      return S_OK;
-    }
-
-    element->ClearFocus();
-    UiaRaiseAutomationEvent(this, UIA_AutomationFocusChangedEventId);
-  }
-
   return S_OK;
 }
 
@@ -225,6 +200,7 @@ UIABridge::GetFocus(IRawElementProviderFragment ** retVal)
   nsCOMPtr<nsIAccessible> child;
   nsresult rv = mAccessible->GetFocusedChild(getter_AddRefs(child));
   if (!child) {
+    Log("mAccessible->GetFocusedChild failed.");
     return S_OK;
   }
 
@@ -233,6 +209,7 @@ UIABridge::GetFocus(IRawElementProviderFragment ** retVal)
   ComPtr<IUIAElement> element;
   gElement.As(&element);
   if (!element) {
+    Log("gElement as IUIAElement failed.");
     return S_OK;
   }
 
@@ -259,15 +236,20 @@ UIABridge::Navigate(NavigateDirection direction, IRawElementProviderFragment **
 
   switch(direction) {
     case NavigateDirection_Parent:
+    Log("UIABridge::Navigate NavigateDirection_Parent");
     break;
     case NavigateDirection_NextSibling:
+    Log("UIABridge::Navigate NavigateDirection_NextSibling");
     break;
     case NavigateDirection_PreviousSibling:
+    Log("UIABridge::Navigate NavigateDirection_PreviousSibling");
     break;
     case NavigateDirection_FirstChild:
+    Log("UIABridge::Navigate NavigateDirection_FirstChild");
     gElement.Get()->QueryInterface(IID_PPV_ARGS(retVal));
     break;
     case NavigateDirection_LastChild:
+    Log("UIABridge::Navigate NavigateDirection_LastChild");
     gElement.Get()->QueryInterface(IID_PPV_ARGS(retVal));
     break;
   }
@@ -279,6 +261,7 @@ UIABridge::Navigate(NavigateDirection direction, IRawElementProviderFragment **
 HRESULT
 UIABridge::GetRuntimeId(SAFEARRAY ** retVal)
 {
+  LogFunction();
   if (!Connected()) {
     return UIA_E_ELEMENTNOTAVAILABLE;
   }
@@ -349,6 +332,7 @@ UIABridge::get_FragmentRoot(IRawElementProviderFragmentRoot ** retVal)
 HRESULT
 UIABridge::get_ProviderOptions(ProviderOptions * pRetVal)
 {
+  LogFunction();
   if (!Connected()) {
     return E_FAIL;
   }
@@ -373,16 +357,44 @@ UIABridge::GetPatternProvider(PATTERNID patternId, IUnknown **ppRetVal)
 HRESULT
 UIABridge::GetPropertyValue(PROPERTYID idProp, VARIANT * pRetVal)
 {
-  LogFunction();
   pRetVal->vt = VT_EMPTY;
 
-  // native hwnd
-  if (idProp == 30020) {
-    return S_OK;
+  switch (idProp) {
+    case UIA_AutomationIdPropertyId:
+    Log("UIABridge::GetPropertyValue: idProp=UIA_AutomationIdPropertyId");
+    break;
+    case UIA_ControlTypePropertyId:
+    Log("UIABridge::GetPropertyValue: idProp=UIA_ControlTypePropertyId");
+    break;
+    case UIA_IsKeyboardFocusablePropertyId:
+    Log("UIABridge::GetPropertyValue: idProp=UIA_IsKeyboardFocusablePropertyId");
+    break;
+    case UIA_IsContentElementPropertyId:
+    Log("UIABridge::GetPropertyValue: idProp=UIA_IsContentElementPropertyId");
+    break;
+    case UIA_IsControlElementPropertyId:
+    Log("UIABridge::GetPropertyValue: idProp=UIA_IsControlElementPropertyId");
+    break;
+    case UIA_IsEnabledPropertyId:
+    Log("UIABridge::GetPropertyValue: idProp=UIA_IsEnabledPropertyId");
+    break;
+    case UIA_HasKeyboardFocusPropertyId:
+    Log("UIABridge::GetPropertyValue: idProp=UIA_HasKeyboardFocusPropertyId");
+    break;
+    case UIA_NamePropertyId:
+    Log("UIABridge::GetPropertyValue: idProp=UIA_NamePropertyId");
+    break;
+    case UIA_IsPasswordPropertyId:
+    Log("UIABridge::GetPropertyValue: idProp=UIA_IsPasswordPropertyId");
+    break;
+    case UIA_NativeWindowHandlePropertyId:
+    Log("UIABridge::GetPropertyValue: idProp=UIA_NativeWindowHandlePropertyId");
+    break;
+    default:
+    Log("UIABridge::GetPropertyValue: idProp=%d", idProp);
+    break;
   }
 
-  Log("UIABridge::GetPropertyValue: idProp=%d", idProp);
-
   if (!Connected()) {
     return E_FAIL;
   }
@@ -422,6 +434,8 @@ UIABridge::GetPropertyValue(PROPERTYID idProp, VARIANT * pRetVal)
       break;
 
     case UIA_NativeWindowHandlePropertyId:
+    pRetVal->vt = VT_I4;
+    pRetVal->lVal = (LONG)MetroWidget::GetICoreWindowHWND();
     break;
 
     default:
@@ -455,6 +469,9 @@ UIATextElement::SetFocusInternal(LONG_PTR aAccessible)
   LogFunction();
 #if defined(ACCESSIBILITY)
   NS_ASSERTION(mAccessItem, "Bad accessible pointer");
+  if (mAccessItem == (nsIAccessible*)aAccessible) {
+    return E_UNEXPECTED;
+  }
   mAccessItem = (nsIAccessible*)aAccessible;
   return S_OK;
 #endif
@@ -496,6 +513,7 @@ UIATextElement::Navigate(NavigateDirection direction, IRawElementProviderFragmen
 HRESULT
 UIATextElement::GetRuntimeId(SAFEARRAY ** retVal)
 {
+  LogFunction();
   int runtimeId[2] = { UiaAppendRuntimeId, mIndexID };
   *retVal = SafeArrayCreateVector(VT_I4, 0, ARRAYSIZE(runtimeId));
   if (*retVal != nullptr) {
@@ -520,10 +538,13 @@ UIATextElement::get_BoundingRectangle(UiaRect * retVal)
   // bounds are in physical pixels
   int32_t docX = 0, docY = 0, docWidth = 0, docHeight = 0;
   mAccessItem->GetBounds(&docX, &docY, &docWidth, &docHeight);
+  
   retVal->left = (float)docX;
   retVal->top = (float)docY;
   retVal->width = (float)docWidth;
   retVal->height = (float)docHeight;
+
+  Log("get_BoundingRectangle: left=%d top=%d right=%d bottom=%d", docX, docY, docX + docWidth, docY + docHeight);
   return S_OK;
 }
 
@@ -587,15 +608,45 @@ UIATextElement::GetPatternProvider(PATTERNID patternId, IUnknown **ppRetVal)
 HRESULT
 UIATextElement::GetPropertyValue(PROPERTYID idProp, VARIANT * pRetVal)
 {
-  LogFunction();
   pRetVal->vt = VT_EMPTY;
 
-  // native hwnd
+  // native hwnd, we don't have one for elements
   if (idProp == 30020) {
     return S_OK;
   }
 
-  Log("UIATextElement::GetPropertyValue: idProp=%d", idProp);
+  switch (idProp) {
+    case UIA_AutomationIdPropertyId:
+    Log("UIATextElement::GetPropertyValue: idProp=UIA_AutomationIdPropertyId");
+    break;
+    case UIA_ControlTypePropertyId:
+    Log("UIATextElement::GetPropertyValue: idProp=UIA_ControlTypePropertyId");
+    break;
+    case UIA_IsKeyboardFocusablePropertyId:
+    Log("UIATextElement::GetPropertyValue: idProp=UIA_IsKeyboardFocusablePropertyId");
+    break;
+    case UIA_IsContentElementPropertyId:
+    Log("UIATextElement::GetPropertyValue: idProp=UIA_IsContentElementPropertyId");
+    break;
+    case UIA_IsControlElementPropertyId:
+    Log("UIATextElement::GetPropertyValue: idProp=UIA_IsControlElementPropertyId");
+    break;
+    case UIA_IsEnabledPropertyId:
+    Log("UIATextElement::GetPropertyValue: idProp=UIA_IsEnabledPropertyId");
+    break;
+    case UIA_HasKeyboardFocusPropertyId:
+    Log("UIATextElement::GetPropertyValue: idProp=UIA_HasKeyboardFocusPropertyId");
+    break;
+    case UIA_NamePropertyId:
+    Log("UIATextElement::GetPropertyValue: idProp=UIA_NamePropertyId");
+    break;
+    case UIA_IsPasswordPropertyId:
+    Log("UIATextElement::GetPropertyValue: idProp=UIA_IsPasswordPropertyId");
+    break;
+    default:
+    Log("UIATextElement::GetPropertyValue: idProp=%d", idProp);
+    break;
+  }
 
   switch (idProp) {
     case UIA_AutomationIdPropertyId:
@@ -605,7 +656,7 @@ UIATextElement::GetPropertyValue(PROPERTYID idProp, VARIANT * pRetVal)
 
     case UIA_ControlTypePropertyId:
       pRetVal->vt = VT_I4;
-      pRetVal->lVal = UIA_DocumentControlTypeId;
+      pRetVal->lVal = UIA_EditControlTypeId;
       break;
 
     case UIA_IsTextPatternAvailablePropertyId:
diff --git a/widget/xpwidgets/nsBaseWidget.cpp b/widget/xpwidgets/nsBaseWidget.cpp
index 08cea5de1576..7be746444d64 100644
--- a/widget/xpwidgets/nsBaseWidget.cpp
+++ b/widget/xpwidgets/nsBaseWidget.cpp
@@ -947,10 +947,11 @@ void nsBaseWidget::CreateCompositor(int aWidth, int aHeight)
   PLayerTransactionChild* shadowManager;
   mozilla::layers::LayersBackend backendHint = GetPreferredCompositorBackend();
 
+  bool success;
   shadowManager = mCompositorChild->SendPLayerTransactionConstructor(
-    backendHint, 0, &textureFactoryIdentifier);
+    backendHint, 0, &textureFactoryIdentifier, &success);
 
-  if (shadowManager) {
+  if (success) {
     ShadowLayerForwarder* lf = lm->AsShadowForwarder();
     if (!lf) {
       delete lm;
@@ -965,7 +966,6 @@ void nsBaseWidget::CreateCompositor(int aWidth, int aHeight)
     return;
   }
 
-  // Failed to create a compositor!
   NS_WARNING("Failed to create an OMT compositor.");
   DestroyCompositor();
   // Compositor child had the only reference to LayerManager and will have
diff --git a/xpcom/base/CycleCollectedJSRuntime.cpp b/xpcom/base/CycleCollectedJSRuntime.cpp
index e56788d0f34b..077bbe442d39 100644
--- a/xpcom/base/CycleCollectedJSRuntime.cpp
+++ b/xpcom/base/CycleCollectedJSRuntime.cpp
@@ -65,7 +65,6 @@
 #include "nsCycleCollectionParticipant.h"
 #include "nsCycleCollector.h"
 #include "nsDOMJSUtils.h"
-#include "nsLayoutStatics.h"
 #include "xpcpublic.h"
 
 using namespace mozilla;
@@ -478,10 +477,10 @@ CycleCollectedJSRuntime::CycleCollectedJSRuntime(uint32_t aMaxbytes,
                                                  bool aExpectUnrootedGlobals)
   : mGCThingCycleCollectorGlobal(sGCThingCycleCollectorGlobal),
     mJSZoneCycleCollectorGlobal(sJSZoneCycleCollectorGlobal),
-    mJSRuntime(nullptr)
+    mJSRuntime(nullptr),
+    mExpectUnrootedGlobals(aExpectUnrootedGlobals)
 #ifdef DEBUG
   , mObjectToUnlink(nullptr)
-  , mExpectUnrootedGlobals(aExpectUnrootedGlobals)
 #endif
 {
   mJSRuntime = JS_NewRuntime(aMaxbytes, aUseHelperThreads);
@@ -494,6 +493,7 @@ CycleCollectedJSRuntime::CycleCollectedJSRuntime(uint32_t aMaxbytes,
   }
   JS_SetGrayGCRootsTracer(mJSRuntime, TraceGrayJS, this);
   JS_SetGCCallback(mJSRuntime, GCCallback, this);
+  JS_SetContextCallback(mJSRuntime, ContextCallback, this);
 
   mJSHolders.Init(512);
 
@@ -795,6 +795,18 @@ CycleCollectedJSRuntime::GCCallback(JSRuntime* aRuntime,
   self->OnGC(aStatus);
 }
 
+/* static */ JSBool
+CycleCollectedJSRuntime::ContextCallback(JSContext* aContext,
+                                         unsigned aOperation,
+                                         void* aData)
+{
+  CycleCollectedJSRuntime* self = static_cast<CycleCollectedJSRuntime*>(aData);
+
+  MOZ_ASSERT(JS_GetRuntime(aContext) == self->Runtime());
+
+  return self->OnContext(aContext, aOperation);
+}
+
 struct JsGcTracer : public TraceCallbacks
 {
   virtual void Trace(JS::Heap<JS::Value> *p, const char *name, void *closure) const MOZ_OVERRIDE {
@@ -837,11 +849,7 @@ CycleCollectedJSRuntime::TraceNativeGrayRoots(JSTracer* aTracer)
 void
 CycleCollectedJSRuntime::AddJSHolder(void* aHolder, nsScriptObjectTracer* aTracer)
 {
-  bool wasEmpty = mJSHolders.Count() == 0;
   mJSHolders.Put(aHolder, aTracer);
-  if (wasEmpty && mJSHolders.Count() == 1) {
-    nsLayoutStatics::AddRef();
-  }
 }
 
 void
@@ -856,11 +864,7 @@ CycleCollectedJSRuntime::RemoveJSHolder(void* aHolder)
     AssertNoObjectsToTrace(aHolder);
   }
 #endif
-  bool hadOne = mJSHolders.Count() == 1;
   mJSHolders.Remove(aHolder);
-  if (hadOne && mJSHolders.Count() == 0) {
-    nsLayoutStatics::Release();
-  }
 }
 
 #ifdef DEBUG
@@ -966,6 +970,10 @@ CycleCollectedJSRuntime::BeginCycleCollection(nsCycleCollectionNoteRootCallback
 bool
 CycleCollectedJSRuntime::UsefulToMergeZones() const
 {
+  if (!NS_IsMainThread()) {
+    return false;
+  }
+
   JSContext* iter = nullptr;
   JSContext* cx;
   JSAutoRequest ar(nsContentUtils::GetSafeJSContext());
@@ -1032,6 +1040,13 @@ CycleCollectedJSRuntime::DeferredFinalize(nsISupports* aSupports)
   mDeferredSupports.AppendElement(aSupports);
 }
 
+void
+CycleCollectedJSRuntime::DumpJSHeap(FILE* file)
+{
+  js::DumpHeapComplete(Runtime(), file);
+}
+
+
 bool
 ReleaseSliceNow(uint32_t aSlice, void* aData)
 {
@@ -1179,6 +1194,18 @@ CycleCollectedJSRuntime::OnGC(JSGCStatus aStatus)
   switch (aStatus) {
     case JSGC_BEGIN:
     {
+      // XXXkhuey do we still need this?
+      // We seem to sometime lose the unrooted global flag. Restore it
+      // here. FIXME: bug 584495.
+      if (mExpectUnrootedGlobals){
+        JSContext* iter = nullptr;
+        while (JSContext* acx = JS_ContextIterator(Runtime(), &iter)) {
+          if (!js::HasUnrootedGlobal(acx)) {
+            JS_ToggleOptions(acx, JSOPTION_UNROOTED_GLOBAL);
+          }
+        }
+      }
+
       break;
     }
     case JSGC_END:
@@ -1205,3 +1232,15 @@ CycleCollectedJSRuntime::OnGC(JSGCStatus aStatus)
 
   CustomGCCallback(aStatus);
 }
+
+bool
+CycleCollectedJSRuntime::OnContext(JSContext* aCx, unsigned aOperation)
+{
+  if (mExpectUnrootedGlobals && aOperation == JSCONTEXT_NEW) {
+    // XXXkhuey bholley is going to make this go away, but for now XPConnect
+    // needs it.
+    JS_ToggleOptions(aCx, JSOPTION_UNROOTED_GLOBAL);
+  }
+
+  return CustomContextCallback(aCx, aOperation);
+}
diff --git a/xpcom/base/CycleCollectedJSRuntime.h b/xpcom/base/CycleCollectedJSRuntime.h
index 898490150e92..729623e5a373 100644
--- a/xpcom/base/CycleCollectedJSRuntime.h
+++ b/xpcom/base/CycleCollectedJSRuntime.h
@@ -84,7 +84,7 @@ class CycleCollectedJSRuntime
 protected:
   CycleCollectedJSRuntime(uint32_t aMaxbytes,
                           JSUseHelperThreads aUseHelperThreads,
-                          bool aExpectRootedGlobals);
+                          bool aExpectUnrootedGlobals);
   virtual ~CycleCollectedJSRuntime();
 
   JSRuntime* Runtime() const
@@ -96,10 +96,14 @@ protected:
   size_t SizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
   void UnmarkSkippableJSHolders();
 
-  virtual void TraverseAdditionalNativeRoots(nsCycleCollectionNoteRootCallback& aCb) = 0;
-  virtual void TraceAdditionalNativeGrayRoots(JSTracer* aTracer) = 0;
+  virtual void TraverseAdditionalNativeRoots(nsCycleCollectionNoteRootCallback& aCb) {}
+  virtual void TraceAdditionalNativeGrayRoots(JSTracer* aTracer) {}
 
   virtual void CustomGCCallback(JSGCStatus aStatus) {}
+  virtual bool CustomContextCallback(JSContext* aCx, unsigned aOperation)
+  {
+    return true; // Don't block context creation.
+  }
 
 private:
 
@@ -109,7 +113,10 @@ private:
 
   virtual bool
   DescribeCustomObjects(JSObject* aObject, js::Class* aClasp,
-                        char (&aName)[72]) const = 0;
+                        char (&aName)[72]) const
+  {
+    return false; // We did nothing.
+  }
 
   void
   NoteGCThingJSChildren(void* aThing, JSGCTraceKind aTraceKind,
@@ -121,8 +128,10 @@ private:
 
   virtual bool
   NoteCustomGCThingXPCOMChildren(js::Class* aClasp, JSObject* aObj,
-                                 nsCycleCollectionTraversalCallback& aCb) const = 0;
-
+                                 nsCycleCollectionTraversalCallback& aCb) const
+  {
+    return false; // We did nothing.
+  }
 
   enum TraverseSelect {
       TRAVERSE_CPP,
@@ -150,6 +159,8 @@ private:
   static void TraceBlackJS(JSTracer* aTracer, void* aData);
   static void TraceGrayJS(JSTracer* aTracer, void* aData);
   static void GCCallback(JSRuntime* aRuntime, JSGCStatus aStatus, void* aData);
+  static JSBool ContextCallback(JSContext* aCx, unsigned aOperation,
+                                void* aData);
 
   virtual void TraceNativeBlackRoots(JSTracer* aTracer) { };
   void TraceNativeGrayRoots(JSTracer* aTracer);
@@ -162,6 +173,7 @@ private:
   void FinalizeDeferredThings(DeferredFinalizeType aType);
 
   void OnGC(JSGCStatus aStatus);
+  bool OnContext(JSContext* aCx, unsigned aOperation);
 
 public:
   void AddJSHolder(void* aHolder, nsScriptObjectTracer* aTracer);
@@ -196,6 +208,10 @@ public:
                         void* aThing);
   void DeferredFinalize(nsISupports* aSupports);
 
+  void DumpJSHeap(FILE* aFile);
+  
+  virtual void DispatchDeferredDeletion(bool aContinuation) = 0;
+
 private:
   JSGCThingParticipant mGCThingCycleCollectorGlobal;
 
@@ -212,9 +228,10 @@ private:
 
   nsRefPtr<IncrementalFinalizeRunnable> mFinalizeRunnable;
 
+  bool mExpectUnrootedGlobals;
+
 #ifdef DEBUG
   void* mObjectToUnlink;
-  bool mExpectUnrootedGlobals;
 #endif
 };
 
diff --git a/xpcom/base/nsCycleCollector.cpp b/xpcom/base/nsCycleCollector.cpp
index d97d809029c0..ec8db328e90b 100644
--- a/xpcom/base/nsCycleCollector.cpp
+++ b/xpcom/base/nsCycleCollector.cpp
@@ -903,76 +903,7 @@ enum ccType {
     ShutdownCC   /* Shutdown CC, used for finding leaks. */
 };
 
-class nsCycleCollector;
-
-class nsCycleCollectorRunner : public nsRunnable
-{
-    nsCycleCollector *mCollector;
-    CCThreadingModel mModel;
-    nsICycleCollectorListener *mListener;
-    nsCOMPtr<nsIThread> mThread;
-    Mutex mLock;
-    CondVar mRequest;
-    CondVar mReply;
-    bool mRunning;
-    bool mShutdown;
-    bool mCollected;
-    ccType mCCType;
-
-public:
-    nsCycleCollectorRunner(nsCycleCollector *collector,
-                           CCThreadingModel aModel)
-        : mCollector(collector),
-          mModel(aModel),
-          mListener(nullptr),
-          mLock("cycle collector lock"),
-          mRequest(mLock, "cycle collector request condvar"),
-          mReply(mLock, "cycle collector reply condvar"),
-          mRunning(false),
-          mShutdown(false),
-          mCollected(false),
-          mCCType(ScheduledCC)
-    {
-        MOZ_ASSERT(NS_IsMainThread(), "Wrong thread!");
-    }
-
-    NS_IMETHOD Run();
-
-    nsresult Init()
-    {
-        if (mModel == CCSingleThread)
-            return NS_OK;
-
-        return NS_NewThread(getter_AddRefs(mThread), this);
-    }
-
-    void Collect(ccType aCCType,
-                 nsCycleCollectorResults *aResults,
-                 nsICycleCollectorListener *aListener);
-
-    void Shutdown()
-    {
-        MOZ_ASSERT(NS_IsMainThread(), "Wrong thread!");
-
-        if (!mThread)
-            return;
-
-        MutexAutoLock autoLock(mLock);
-
-        mShutdown = true;
-
-        if (!mRunning)
-            return;
-
-        mRunning = false;
-        mRequest.Notify();
-        mReply.Wait();
-
-        nsCOMPtr<nsIThread> thread;
-        thread.swap(mThread);
-        thread->Shutdown();
-    }
-};
+class nsCycleCollectorRunner;
 
 ////////////////////////////////////////////////////////////////////////
 // Top level structure for the cycle collector.
@@ -995,14 +926,12 @@ class nsCycleCollector
 
     // Strong reference
     nsCycleCollectorRunner *mRunner;
-    PRThread* mThread;
+    nsIThread* mThread;
 
 public:
     nsCycleCollectorParams mParams;
 
 private:
-    nsRefPtr<AsyncFreeSnowWhite> mAsyncSnowWhiteFreer;
-
     nsTArray<PtrInfo*> *mWhiteNodes;
     uint32_t mWhiteNodeCount;
 
@@ -1080,18 +1009,8 @@ public:
     bool BeginCollection(ccType aCCType, nsICycleCollectorListener *aListener);
     bool FinishCollection(nsICycleCollectorListener *aListener);
 
-    AsyncFreeSnowWhite* AsyncSnowWhiteFreer()
-    {
-        return mAsyncSnowWhiteFreer;
-    }
-
     bool FreeSnowWhite(bool aUntilNoSWInPurpleBuffer);
 
-    // If there is a cycle collector available in the current thread,
-    // this calls FreeSnowWhite(false). Returns true if some
-    // snow-white objects were found.
-    static bool TryToFreeSnowWhite();
-
     uint32_t SuspectedCount();
     void Shutdown();
 
@@ -1111,6 +1030,75 @@ public:
                              size_t *aPurpleBufferSize) const;
 };
 
+class nsCycleCollectorRunner : public nsRunnable
+{
+    nsCycleCollector *mCollector;
+    CCThreadingModel mModel;
+    nsICycleCollectorListener *mListener;
+    nsCOMPtr<nsIThread> mThread;
+    Mutex mLock;
+    CondVar mRequest;
+    CondVar mReply;
+    bool mRunning;
+    bool mShutdown;
+    bool mCollected;
+    ccType mCCType;
+
+public:
+    nsCycleCollectorRunner(nsCycleCollector *collector,
+                           CCThreadingModel aModel)
+        : mCollector(collector),
+          mModel(aModel),
+          mListener(nullptr),
+          mLock("cycle collector lock"),
+          mRequest(mLock, "cycle collector request condvar"),
+          mReply(mLock, "cycle collector reply condvar"),
+          mRunning(false),
+          mShutdown(false),
+          mCollected(false),
+          mCCType(ScheduledCC)
+    {
+        collector->CheckThreadSafety();
+    }
+
+    NS_IMETHOD Run();
+
+    nsresult Init()
+    {
+        if (mModel == CCSingleThread)
+            return NS_OK;
+
+        return NS_NewThread(getter_AddRefs(mThread), this);
+    }
+
+    void Collect(ccType aCCType,
+                 nsCycleCollectorResults *aResults,
+                 nsICycleCollectorListener *aListener);
+
+    void Shutdown()
+    {
+        mCollector->CheckThreadSafety();
+
+        if (!mThread)
+            return;
+
+        MutexAutoLock autoLock(mLock);
+
+        mShutdown = true;
+
+        if (!mRunning)
+            return;
+
+        mRunning = false;
+        mRequest.Notify();
+        mReply.Wait();
+
+        nsCOMPtr<nsIThread> thread;
+        thread.swap(mThread);
+        thread->Shutdown();
+    }
+};
+
 NS_IMETHODIMP
 nsCycleCollectorRunner::Run()
 {
@@ -1160,7 +1148,7 @@ nsCycleCollectorRunner::Collect(ccType aCCType,
                                 nsCycleCollectorResults *aResults,
                                 nsICycleCollectorListener *aListener)
 {
-    MOZ_ASSERT(NS_IsMainThread(), "Wrong thread!");
+    mCollector->CheckThreadSafety();
 
     // On a WantAllTraces CC, force a synchronous global GC to prevent
     // hijinks from ForgetSkippable and compartmental GCs.
@@ -1447,7 +1435,9 @@ public:
         gcLogFile->OpenANSIFileDesc("w", &gcLogANSIFile);
         NS_ENSURE_STATE(gcLogANSIFile);
         MozillaRegisterDebugFILE(gcLogANSIFile);
-        xpc::DumpJSHeap(gcLogANSIFile);
+        CollectorData *data = sCollectorData.get();
+        if (data && data->mRuntime)
+            data->mRuntime->DumpJSHeap(gcLogANSIFile);
         MozillaUnRegisterDebugFILE(gcLogANSIFile);
         fclose(gcLogANSIFile);
 
@@ -2181,44 +2171,6 @@ MayHaveChild(void *o, nsCycleCollectionParticipant* cp)
     return cf.MayHaveChild();
 }
 
-class AsyncFreeSnowWhite : public nsRunnable
-{
-public:
-  NS_IMETHOD Run()
-  {
-      TimeStamp start = TimeStamp::Now();
-      bool hadSnowWhiteObjects = nsCycleCollector::TryToFreeSnowWhite();
-      Telemetry::Accumulate(Telemetry::CYCLE_COLLECTOR_ASYNC_SNOW_WHITE_FREEING,
-                            uint32_t((TimeStamp::Now() - start).ToMilliseconds()));
-      if (hadSnowWhiteObjects && !mContinuation) {
-          mContinuation = true;
-          if (NS_FAILED(NS_DispatchToCurrentThread(this))) {
-              mActive = false;
-          }
-      } else {
-          mActive = false;
-      }
-      return NS_OK;
-  }
-
-  static void Dispatch(nsCycleCollector* aCollector, bool aContinuation = false)
-  {
-      AsyncFreeSnowWhite* swf = aCollector->AsyncSnowWhiteFreer();
-      if (swf->mContinuation) {
-          swf->mContinuation = aContinuation;
-      }
-      if (!swf->mActive && NS_SUCCEEDED(NS_DispatchToCurrentThread(swf))) {
-          swf->mActive = true;
-      }
-  }
-
-  AsyncFreeSnowWhite() : mContinuation(false), mActive(false) {}
-
-public:
-  bool mContinuation;
-  bool mActive;
-};
-
 struct SnowWhiteObject
 {
   void* mPointer;
@@ -2300,7 +2252,7 @@ public:
         }
         if (HasSnowWhiteObjects()) {
             // Effectively a continuation.
-            AsyncFreeSnowWhite::Dispatch(mCollector, true);
+            nsCycleCollector_dispatchDeferredDeletion(true);
         }
     }
 
@@ -2313,7 +2265,7 @@ public:
                 SnowWhiteKiller::Visit(aBuffer, aEntry);
             } else if (!mDispatchedDeferredDeletion) {
                 mDispatchedDeferredDeletion = true;
-                nsCycleCollector_dispatchDeferredDeletion();
+                nsCycleCollector_dispatchDeferredDeletion(false);
             }
             return;
         }
@@ -2362,15 +2314,6 @@ nsCycleCollector::FreeSnowWhite(bool aUntilNoSWInPurpleBuffer)
     return hadSnowWhiteObjects;
 }
 
-/* static */ bool
-nsCycleCollector::TryToFreeSnowWhite()
-{
-  CollectorData* data = sCollectorData.get();
-  return data->mCollector ?
-      data->mCollector->FreeSnowWhite(false) :
-      false;
-}
-
 void
 nsCycleCollector::SelectPurple(GCGraphBuilder &builder)
 {
@@ -2647,7 +2590,7 @@ nsCycleCollector::CollectWhite(nsICycleCollectorListener *aListener)
     }
     timeLog.Checkpoint("CollectWhite::Unroot");
 
-    nsCycleCollector_dispatchDeferredDeletion();
+    nsCycleCollector_dispatchDeferredDeletion(false);
 
     return count > 0;
 }
@@ -2737,8 +2680,7 @@ nsCycleCollector::nsCycleCollector(CCThreadingModel aModel) :
     mResults(nullptr),
     mJSRuntime(nullptr),
     mRunner(nullptr),
-    mThread(PR_GetCurrentThread()),
-    mAsyncSnowWhiteFreer(new AsyncFreeSnowWhite()),
+    mThread(NS_GetCurrentThread()),
     mWhiteNodes(nullptr),
     mWhiteNodeCount(0),
     mVisitedRefCounted(0),
@@ -2843,7 +2785,10 @@ void
 nsCycleCollector::CheckThreadSafety()
 {
 #ifdef DEBUG
-    MOZ_ASSERT(mThread == PR_GetCurrentThread());
+    nsIThread* currentThread = NS_GetCurrentThread();
+    // XXXkhuey we can be called so late in shutdown that NS_GetCurrentThread
+    // returns null (after the thread manager has shut down)
+    MOZ_ASSERT(mThread == currentThread || !currentThread);
 #endif
 }
 
@@ -2856,8 +2801,7 @@ nsCycleCollector::CheckThreadSafety()
 void
 nsCycleCollector::FixGrayBits(bool aForceGC)
 {
-    MOZ_ASSERT(NS_IsMainThread(),
-               "nsCycleCollector::FixGrayBits() must be called on the main thread.");
+    CheckThreadSafety();
 
     if (!mJSRuntime)
         return;
@@ -3377,12 +3321,28 @@ nsCycleCollector_forgetSkippable(bool aRemoveChildlessNodes,
 }
 
 void
-nsCycleCollector_dispatchDeferredDeletion()
+nsCycleCollector_dispatchDeferredDeletion(bool aContinuation)
 {
-    CollectorData* data = sCollectorData.get();
-    if (data && data->mCollector) {
-        AsyncFreeSnowWhite::Dispatch(data->mCollector);
+    CollectorData *data = sCollectorData.get();
+
+    if (!data || !data->mRuntime) {
+        return;
     }
+
+    data->mRuntime->DispatchDeferredDeletion(aContinuation);
+}
+
+bool
+nsCycleCollector_doDeferredDeletion()
+{
+    CollectorData *data = sCollectorData.get();
+
+    // We should have started the cycle collector by now.
+    MOZ_ASSERT(data);
+    MOZ_ASSERT(data->mCollector);
+    MOZ_ASSERT(data->mRuntime);
+
+    return data->mCollector->FreeSnowWhite(false);
 }
 
 void
diff --git a/xpcom/base/nsCycleCollector.h b/xpcom/base/nsCycleCollector.h
index 23571c73da87..96b4d27cd0fa 100644
--- a/xpcom/base/nsCycleCollector.h
+++ b/xpcom/base/nsCycleCollector.h
@@ -57,7 +57,8 @@ void nsCycleCollector_setForgetSkippableCallback(CC_ForgetSkippableCallback aCB)
 void nsCycleCollector_forgetSkippable(bool aRemoveChildlessNodes = false,
                                       bool aAsyncSnowWhiteFreeing = false);
 
-void nsCycleCollector_dispatchDeferredDeletion();
+void nsCycleCollector_dispatchDeferredDeletion(bool aContinuation = false);
+bool nsCycleCollector_doDeferredDeletion();
 
 void nsCycleCollector_collect(bool aManuallyTriggered,
                               nsCycleCollectorResults *aResults,
diff --git a/xpcom/threads/nsIThreadPool.idl b/xpcom/threads/nsIThreadPool.idl
index c90ce200ef9d..6a9b9977a935 100644
--- a/xpcom/threads/nsIThreadPool.idl
+++ b/xpcom/threads/nsIThreadPool.idl
@@ -36,6 +36,8 @@ interface nsIThreadPool : nsIEventTarget
    * thread (usually the thread that created this thread pool).  When this
    * function returns, the thread pool and all of its threads will be shutdown,
    * and it will no longer be possible to dispatch tasks to the thread pool.
+   *
+   * As a side effect, events on the current thread will be processed.
    */
   void shutdown();