diff --git a/CLOBBER b/CLOBBER
index 69a1240162c7..26d5373f69ce 100644
--- a/CLOBBER
+++ b/CLOBBER
@@ -15,4 +15,4 @@
 #
 # Note: The description below will be part of the error message shown to users.
 #
-Bug 847120 needs a clobber
+Bug 825341 appears to need a clobber
diff --git a/accessible/src/generic/HyperTextAccessible.cpp b/accessible/src/generic/HyperTextAccessible.cpp
index 5382a6b44c86..fbebe08fdd42 100644
--- a/accessible/src/generic/HyperTextAccessible.cpp
+++ b/accessible/src/generic/HyperTextAccessible.cpp
@@ -235,6 +235,7 @@ HyperTextAccessible::GetPosAndText(int32_t& aStartOffset, int32_t& aEndOffset,
   }
 
   nsIFrame *startFrame = nullptr;
+ nsIFrame* endFrame = nullptr;
   if (aEndFrame) {
     *aEndFrame = nullptr;
   }
@@ -264,6 +265,7 @@ HyperTextAccessible::GetPosAndText(int32_t& aStartOffset, int32_t& aEndOffset,
       continue;
     }
     nsIFrame *primaryFrame = frame;
+    endFrame = frame;
     if (nsAccUtils::IsText(childAcc)) {
       // We only need info up to rendered offset -- that is what we're
       // converting to content offset
@@ -389,9 +391,9 @@ HyperTextAccessible::GetPosAndText(int32_t& aStartOffset, int32_t& aEndOffset,
     NS_IF_ADDREF(*aStartAcc = lastAccessible);
   }
   if (aEndFrame && !*aEndFrame) {
-    *aEndFrame = startFrame;
-    if (aStartAcc && aEndAcc)
-      NS_IF_ADDREF(*aEndAcc = *aStartAcc);
+    *aEndFrame = endFrame;
+    if (aEndAcc && !*aEndAcc)
+      NS_IF_ADDREF(*aEndAcc = lastAccessible);
   }
 
   return startFrame;
@@ -1824,7 +1826,7 @@ HyperTextAccessible::SetSelectionBounds(int32_t aSelectionNum,
 
   nsRefPtr<nsRange> range;
   if (aSelectionNum == rangeCount)
-    range = new nsRange();
+    range = new nsRange(mContent);
   else
     range = domSel->GetRangeAt(aSelectionNum);
 
@@ -1886,7 +1888,7 @@ HyperTextAccessible::ScrollSubstringTo(int32_t aStartIndex, int32_t aEndIndex,
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsRefPtr<nsRange> range = new nsRange();
+  nsRefPtr<nsRange> range = new nsRange(mContent);
   nsresult rv = HypertextOffsetsToDOMRange(aStartIndex, aEndIndex, range);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -1910,7 +1912,7 @@ HyperTextAccessible::ScrollSubstringToPoint(int32_t aStartIndex,
   nsIntPoint coords = nsAccUtils::ConvertToScreenCoords(aX, aY, aCoordinateType,
                                                         this);
 
-  nsRefPtr<nsRange> range = new nsRange();
+  nsRefPtr<nsRange> range = new nsRange(mContent);
   nsresult rv = HypertextOffsetsToDOMRange(aStartIndex, aEndIndex, range);
   NS_ENSURE_SUCCESS(rv, rv);
 
diff --git a/accessible/src/windows/msaa/TextLeafAccessibleWrap.cpp b/accessible/src/windows/msaa/TextLeafAccessibleWrap.cpp
index eac78d1b3cd6..8c0786a27897 100644
--- a/accessible/src/windows/msaa/TextLeafAccessibleWrap.cpp
+++ b/accessible/src/windows/msaa/TextLeafAccessibleWrap.cpp
@@ -158,7 +158,7 @@ TextLeafAccessibleWrap::scrollToSubstring(
   if (IsDefunct())
     return E_FAIL;
 
-  nsRefPtr<nsRange> range = new nsRange();
+  nsRefPtr<nsRange> range = new nsRange(mContent);
   if (NS_FAILED(range->SetStart(mContent, aStartIndex)))
       return E_FAIL;
 
diff --git a/accessible/tests/mochitest/editabletext/test_1.html b/accessible/tests/mochitest/editabletext/test_1.html
index c6efd061add9..0dadddf482e9 100644
--- a/accessible/tests/mochitest/editabletext/test_1.html
+++ b/accessible/tests/mochitest/editabletext/test_1.html
@@ -20,9 +20,9 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=452161
 
   <script type="application/javascript">
     if (navigator.platform.startsWith("Mac")) {
-      SimpleTest.expectAssertions(0, 3);
+      SimpleTest.expectAssertions(0, 1);
     } else {
-      SimpleTest.expectAssertions(3);
+      SimpleTest.expectAssertions(1);
     }
 
     function addTestEditable(aID, aTestRun, aTrailChar)
diff --git a/accessible/tests/mochitest/text/test_hypertext.html b/accessible/tests/mochitest/text/test_hypertext.html
index c965de489ed1..6e840101892d 100644
--- a/accessible/tests/mochitest/text/test_hypertext.html
+++ b/accessible/tests/mochitest/text/test_hypertext.html
@@ -74,6 +74,15 @@
       testCharacterCount(IDs, 5);
       testText(IDs, 0, 5, "1.foo");
 
+      testText(["testbr"], 0, 4, "foo\n");
+
+      testTextAtOffset(2, nsIAccessibleText.BOUNDARY_CHAR, "o", 2, 3, "testbr",
+                       kOk, kOk, kOk);
+      testTextAtOffset(2, nsIAccessibleText.BOUNDARY_WORD_START, "foo\n", 0, 4,
+                       "testbr", kTodo, kOk, kTodo);
+      testTextBeforeOffset(2, nsIAccessibleText.BOUNDARY_LINE_START, "foo\n",
+                           0, 4, "testbr", kTodo, kOk, kTodo);
+
       SimpleTest.finish();
     }
 
@@ -122,5 +131,7 @@
 <h6 role="presentation" class="gencontent">heading</h6>
   </div>
 
+  <div id="testbr">foo<br/></div>
+
 </body>
 </html>
diff --git a/b2g/app/b2g.js b/b2g/app/b2g.js
index 3e69bedfc266..b4b11c76ee2b 100644
--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -396,7 +396,7 @@ pref("dom.mozAlarms.enabled", true);
 // NetworkStats
 #ifdef MOZ_B2G_RIL
 pref("dom.mozNetworkStats.enabled", true);
-pref("ril.lastKnownMcc", 724);
+pref("ril.lastKnownMcc", "724");
 #endif
 
 // WebSettings
diff --git a/browser/components/preferences/permissions.js b/browser/components/preferences/permissions.js
index 3a33e78588cd..7ad74b992318 100644
--- a/browser/components/preferences/permissions.js
+++ b/browser/components/preferences/permissions.js
@@ -66,6 +66,9 @@ var gPermissionManager = {
     case nsIPermissionManager.DENY_ACTION:
       stringKey = "cannot";
       break;
+    case nsICookiePermission.ACCESS_ALLOW_FIRST_PARTY_ONLY:
+      stringKey = "canAccessFirstParty";
+      break;
     case nsICookiePermission.ACCESS_SESSION:
       stringKey = "canSession";
       break;
diff --git a/browser/components/search/test/browser_contextmenu.js b/browser/components/search/test/browser_contextmenu.js
index 3e4b74a8d0e8..c7bfe8c82780 100644
--- a/browser/components/search/test/browser_contextmenu.js
+++ b/browser/components/search/test/browser_contextmenu.js
@@ -20,7 +20,7 @@ function test() {
         //ss.currentEngine = engine;
         break;
       case "engine-current":
-        ok(ss.currentEngine.name == ENGINE_NAME, "currentEngine set");
+        is(ss.currentEngine.name, ENGINE_NAME, "currentEngine set");
         startTest();
         break;
       case "engine-removed":
@@ -40,16 +40,16 @@ function test() {
     ok(contextMenu, "Got context menu XUL");
 
     doOnloadOnce(testContextMenu);
-    var tab = gBrowser.addTab("data:text/plain,test%20search");
+    var tab = gBrowser.addTab("data:text/plain;charset=utf8,test%20search");
     gBrowser.selectedTab = tab;
   }
 
   function testContextMenu() {
-    function rightClickOnDocument(){
+    function rightClickOnDocument() {
+      waitForBrowserContextMenu(checkContextMenu);
       var clickTarget = content.document.body;
       var eventDetails = { type: "contextmenu", button: 2 };
       EventUtils.synthesizeMouseAtCenter(clickTarget, eventDetails, content);
-      SimpleTest.executeSoon(checkContextMenu);
     }
 
     // check the search menu item and then perform a search
diff --git a/browser/components/search/test/head.js b/browser/components/search/test/head.js
index afffbe3b4563..103b91faa1d2 100644
--- a/browser/components/search/test/head.js
+++ b/browser/components/search/test/head.js
@@ -17,3 +17,16 @@ function isSubObjectOf(expectedObj, actualObj, name) {
     }
   }
 }
+
+function waitForPopupShown(aPopupId, aCallback) {
+  let popup = document.getElementById(aPopupId);
+  function onPopupShown() {
+    popup.removeEventListener("popupshown", onPopupShown);
+    SimpleTest.executeSoon(aCallback);
+  }
+  popup.addEventListener("popupshown", onPopupShown);
+}
+
+function waitForBrowserContextMenu(aCallback) {
+  waitForPopupShown(gBrowser.selectedBrowser.contextMenu, aCallback);
+}
diff --git a/browser/locales/en-US/chrome/browser/preferences/preferences.properties b/browser/locales/en-US/chrome/browser/preferences/preferences.properties
index 1066a46fe205..e949b4ec138d 100644
--- a/browser/locales/en-US/chrome/browser/preferences/preferences.properties
+++ b/browser/locales/en-US/chrome/browser/preferences/preferences.properties
@@ -88,6 +88,7 @@ forSecureOnly=Encrypted connections only
 forAnyConnection=Any type of connection
 expireAtEndOfSession=At end of session
 can=Allow
+canAccessFirstParty=Allow first party only
 canSession=Allow for Session
 cannot=Block
 noCookieSelected=<no cookie selected>
@@ -130,4 +131,4 @@ syncUnlinkConfirm.label=Unlink
 # LOCALIZATION NOTE (featureEnableRequiresRestart, featureDisableRequiresRestart, restartTitle): %S = brandShortName
 featureEnableRequiresRestart=%S must restart to enable this feature.
 featureDisableRequiresRestart=%S must restart to disable this feature.
-shouldRestartTitle=Restart %S
\ No newline at end of file
+shouldRestartTitle=Restart %S
diff --git a/browser/metro/components/ContentPermissionPrompt.js b/browser/metro/components/ContentPermissionPrompt.js
index e14053fdd387..16ae1bfedb62 100644
--- a/browser/metro/components/ContentPermissionPrompt.js
+++ b/browser/metro/components/ContentPermissionPrompt.js
@@ -39,17 +39,20 @@ ContentPermissionPrompt.prototype = {
      return chromeWin;
   },
 
+  getChromeWindowForRequest: function getChromeWindowForRequest(aRequest) {
+    if (aRequest.window)
+      return this.getChromeWindow(aRequest.window.top).wrappedJSObject;
+    return aRequest.element.ownerDocument.defaultView;
+  },
+
   getNotificationBoxForRequest: function getNotificationBoxForRequest(request) {
-    let notificationBox = null;
+    let chromeWin = this.getChromeWindowForRequest(request);
     if (request.window) {
       let requestingWindow = request.window.top;
-      let chromeWin = this.getChromeWindow(requestingWindow).wrappedJSObject;
       let windowID = request.window.QueryInterface(Ci.nsIInterfaceRequestor).getInterface(Ci.nsIDOMWindowUtils).currentInnerWindowID;
       let browser = chromeWin.Browser.getBrowserForWindowId(windowID);
       return chromeWin.getNotificationBox(browser);
     }
-
-    let chromeWin = request.element.ownerDocument.defaultView;
     return chromeWin.Browser.getNotificationBox(request.element);
   },
 
@@ -113,6 +116,20 @@ ContentPermissionPrompt.prototype = {
                                                     icon,
                                                     notificationBox.PRIORITY_WARNING_MEDIUM,
                                                     buttons);
+
+    if (request.type == "geolocation") {
+      // Add the "learn more" link.
+      let link = newBar.ownerDocument.createElement("label");
+      link.setAttribute("value", browserBundle.GetStringFromName("geolocation.learnMore"));
+      link.setAttribute("class", "text-link notification-link");
+      newBar.insertBefore(link, newBar.firstChild);
+
+      let win = this.getChromeWindowForRequest(request);
+      link.addEventListener("click", function() {
+        let url = Services.urlFormatter.formatURLPref("browser.geolocation.warning.infoURL");
+        win.BrowserUI.newTab(url, win.Browser.selectedTab);
+      });
+    }
   }
 };
 
diff --git a/browser/metro/locales/en-US/chrome/browser.properties b/browser/metro/locales/en-US/chrome/browser.properties
index b799c18351b3..27d6acdca569 100644
--- a/browser/metro/locales/en-US/chrome/browser.properties
+++ b/browser/metro/locales/en-US/chrome/browser.properties
@@ -50,6 +50,8 @@ contentPermissions.neverForSite=Never for this Site
 geolocation2.allow=Share Location
 geolocation2.wantsTo=Share your location with %S?
 
+geolocation.learnMore=Learn more…
+
 # Error Console
 typeError=Error:
 typeWarning=Warning:
diff --git a/browser/metro/theme/browser.css b/browser/metro/theme/browser.css
index f3faa66d6edb..d70cb90c018d 100644
--- a/browser/metro/theme/browser.css
+++ b/browser/metro/theme/browser.css
@@ -644,11 +644,6 @@ flyoutpanel > settings:first-child {
   background-position: right bottom;
 }
 
-#about-flyoutpanel label.text-link {
-  text-decoration: none;
-  color: #1167bd;
-}
-
 #about-product-label {
  font-weight: bold;
 }
diff --git a/browser/metro/theme/platform.css b/browser/metro/theme/platform.css
index e979ad888734..61f51ac1abec 100644
--- a/browser/metro/theme/platform.css
+++ b/browser/metro/theme/platform.css
@@ -16,6 +16,11 @@
   font-size: @font_normal@;
 }
 
+.text-link {
+  text-decoration: none;
+  color: #1167bd;
+}
+
 textbox,
 menulist {
   -moz-appearance: none;
@@ -44,7 +49,6 @@ menulist:not([disabled]):hover:active {
   background: @field_foreground_color@;
 }
 
-
 /* Button ------------------------------------------------------------------ */
 
 button {
@@ -433,6 +437,11 @@ notification {
   -moz-image-region: rect(0, 120px, 40px, 80px);
 }
 
+.notification-link {
+  /* Make the link take up all the space before the buttons. */
+  -moz-box-flex: 9999;
+}
+
 
 /* Rich Grid ---------------------------------------------------------------- */
 
diff --git a/build/automation.py.in b/build/automation.py.in
index 484970d562d9..028b1ed6e05e 100644
--- a/build/automation.py.in
+++ b/build/automation.py.in
@@ -468,6 +468,7 @@ user_pref("test.mousescroll", true);
 user_pref("security.default_personal_cert", "Select Automatically"); // Need to client auth test be w/o any dialogs
 user_pref("network.http.prompt-temp-redirect", false);
 user_pref("media.cache_size", 100);
+user_pref("media.volume_scale", "0.01");
 user_pref("security.warn_viewing_mixed", false);
 user_pref("app.update.enabled", false);
 user_pref("app.update.staging.enabled", false);
diff --git a/configure.in b/configure.in
index 3e4cf8659912..c093ef05cacc 100644
--- a/configure.in
+++ b/configure.in
@@ -8279,6 +8279,9 @@ if test "$MOZ_ENABLE_SKIA"; then
   AC_DEFINE(USE_SKIA)
   if test "${MOZ_WIDGET_TOOLKIT}" = "android" -o x"$MOZ_WIDGET_TOOLKIT" = x"gonk"; then
     AC_DEFINE(SK_BUILD_FOR_ANDROID_NDK)
+  elif test "$OS_ARCH" = "WINNT"; then
+    AC_DEFINE(SKIA_DLL)
+    AC_DEFINE(GR_DLL)
   fi
 else
   MOZ_SKIA_LIBS=
diff --git a/content/base/public/Element.h b/content/base/public/Element.h
index 4775ee005b4d..85d5b21682c3 100644
--- a/content/base/public/Element.h
+++ b/content/base/public/Element.h
@@ -887,8 +887,8 @@ public:
                            nsIDOMHTMLCollection** aResult);
   void GetClassList(nsISupports** aClassList);
 
-  virtual JSObject* WrapObject(JSContext *aCx, JSObject *aScope,
-                               bool *aTriedToWrap) MOZ_FINAL;
+  virtual JSObject* WrapObject(JSContext *aCx,
+                               JSObject *aScope) MOZ_FINAL MOZ_OVERRIDE;
 
   /**
    * Locate an nsIEditor rooted at this content node, if there is one.
diff --git a/content/base/public/FragmentOrElement.h b/content/base/public/FragmentOrElement.h
index ec45e9e92441..2a6bb9b83b51 100644
--- a/content/base/public/FragmentOrElement.h
+++ b/content/base/public/FragmentOrElement.h
@@ -54,8 +54,7 @@ public:
   NS_DECL_CYCLE_COLLECTION_SKIPPABLE_SCRIPT_HOLDER_CLASS(nsChildContentList)
 
   // nsWrapperCache
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap);
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
   // nsIDOMNodeList interface
   NS_DECL_NSIDOMNODELIST
diff --git a/content/base/public/nsContentUtils.h b/content/base/public/nsContentUtils.h
index e1a45d8c5a74..94c4e271a16e 100644
--- a/content/base/public/nsContentUtils.h
+++ b/content/base/public/nsContentUtils.h
@@ -112,6 +112,7 @@ namespace layers {
 } // namespace layers
 
 namespace dom {
+class DocumentFragment;
 class Element;
 } // namespace dom
 
@@ -366,6 +367,7 @@ public:
 
   // Check if the (JS) caller can access aNode.
   static bool CanCallerAccess(nsIDOMNode *aNode);
+  static bool CanCallerAccess(nsINode* aNode);
 
   // Check if the (JS) caller can access aWindow.
   // aWindow can be either outer or inner window.
@@ -1084,6 +1086,10 @@ public:
                                            const nsAString& aFragment,
                                            bool aPreventScriptExecution,
                                            nsIDOMDocumentFragment** aReturn);
+  static already_AddRefed<mozilla::dom::DocumentFragment>
+  CreateContextualFragment(nsINode* aContextNode, const nsAString& aFragment,
+                           bool aPreventScriptExecution,
+                           mozilla::ErrorResult& aRv);
 
   /**
    * Invoke the fragment parsing algorithm (innerHTML) using the HTML parser.
diff --git a/content/base/public/nsDOMFile.h b/content/base/public/nsDOMFile.h
index b5025117e67a..76a6119cb8f8 100644
--- a/content/base/public/nsDOMFile.h
+++ b/content/base/public/nsDOMFile.h
@@ -437,8 +437,7 @@ public:
 
   NS_DECL_NSIDOMFILELIST
 
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap);
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
   nsISupports* GetParentObject()
   {
diff --git a/content/base/public/nsIDocument.h b/content/base/public/nsIDocument.h
index 9f9fda09e60d..120d937a8c1c 100644
--- a/content/base/public/nsIDocument.h
+++ b/content/base/public/nsIDocument.h
@@ -2472,6 +2472,10 @@ nsresult
 NS_NewVideoDocument(nsIDocument** aInstancePtrResult);
 #endif
 
+already_AddRefed<mozilla::dom::DocumentFragment>
+NS_NewDocumentFragment(nsNodeInfoManager* aNodeInfoManager,
+                       mozilla::ErrorResult& aRv);
+
 nsresult
 NS_NewDocumentFragment(nsIDOMDocumentFragment** aInstancePtrResult,
                        nsNodeInfoManager *aNodeInfoManager);
diff --git a/content/base/public/nsINode.h b/content/base/public/nsINode.h
index b5abfc7fe025..98e5943f0811 100644
--- a/content/base/public/nsINode.h
+++ b/content/base/public/nsINode.h
@@ -379,8 +379,7 @@ public:
    */
   virtual bool IsNodeOfType(uint32_t aFlags) const = 0;
 
-  virtual JSObject* WrapObject(JSContext *aCx, JSObject *aScope,
-                               bool *aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
 protected:
   /**
@@ -388,11 +387,9 @@ protected:
    * does some additional checks and fix-up that's common to all nodes. WrapNode
    * should just call the DOM binding's Wrap function.
    */
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap)
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope)
   {
     MOZ_ASSERT(!IsDOMBinding(), "Someone forgot to override WrapNode");
-    *aTriedToWrap = false;
     return nullptr;
   }
 
diff --git a/content/base/public/nsIObjectLoadingContent.idl b/content/base/public/nsIObjectLoadingContent.idl
index d5f16fc43dec..18dd2caf2db6 100644
--- a/content/base/public/nsIObjectLoadingContent.idl
+++ b/content/base/public/nsIObjectLoadingContent.idl
@@ -25,7 +25,7 @@ interface nsIURI;
  * interface to mirror this interface when changing it.
  */
 
-[scriptable, uuid(e9102696-4bb4-4a98-a31f-be9da5a3d18e)]
+[scriptable, uuid(b6c5ae8a-5e30-41f1-975a-be73cd6f71db)]
 interface nsIObjectLoadingContent : nsISupports
 {
   /**
@@ -165,6 +165,12 @@ interface nsIObjectLoadingContent : nsISupports
 
   readonly attribute unsigned long pluginFallbackType;
 
+  /**
+   * If this object currently owns a running plugin, regardless of whether or
+   * not one is pending spawn/despawn.
+   */
+  readonly attribute bool hasRunningPlugin;
+
   /**
    * This method will disable the play-preview plugin state.
    */
diff --git a/content/base/src/Comment.cpp b/content/base/src/Comment.cpp
index 8cb9514962c1..94c6062f64e3 100644
--- a/content/base/src/Comment.cpp
+++ b/content/base/src/Comment.cpp
@@ -82,9 +82,9 @@ Comment::List(FILE* out, int32_t aIndent) const
 #endif
 
 JSObject*
-Comment::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+Comment::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return CommentBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return CommentBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/base/src/Comment.h b/content/base/src/Comment.h
index ab912daaf8d4..37dd4046c721 100644
--- a/content/base/src/Comment.h
+++ b/content/base/src/Comment.h
@@ -54,8 +54,7 @@ public:
 #endif
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/base/src/DOMImplementation.cpp b/content/base/src/DOMImplementation.cpp
index 84772bda8ec6..12903de388ce 100644
--- a/content/base/src/DOMImplementation.cpp
+++ b/content/base/src/DOMImplementation.cpp
@@ -25,10 +25,9 @@ NS_IMPL_CYCLE_COLLECTING_ADDREF(DOMImplementation)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(DOMImplementation)
 
 JSObject*
-DOMImplementation::WrapObject(JSContext* aCx, JSObject* aScope,
-                              bool* aTriedToWrap)
+DOMImplementation::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return DOMImplementationBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return DOMImplementationBinding::Wrap(aCx, aScope, this);
 }
 
 bool
diff --git a/content/base/src/DOMImplementation.h b/content/base/src/DOMImplementation.h
index 071443d21719..1fe041527281 100644
--- a/content/base/src/DOMImplementation.h
+++ b/content/base/src/DOMImplementation.h
@@ -52,8 +52,7 @@ public:
     return mOwner;
   }
 
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope,
-                               bool* aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   bool HasFeature(const nsAString& aFeature, const nsAString& aVersion);
 
diff --git a/content/base/src/DocumentFragment.cpp b/content/base/src/DocumentFragment.cpp
index 7cd5f0c93b1e..d3645110caaa 100644
--- a/content/base/src/DocumentFragment.cpp
+++ b/content/base/src/DocumentFragment.cpp
@@ -21,21 +21,34 @@
 nsresult
 NS_NewDocumentFragment(nsIDOMDocumentFragment** aInstancePtrResult,
                        nsNodeInfoManager *aNodeInfoManager)
+{
+  mozilla::ErrorResult rv;
+  *aInstancePtrResult = NS_NewDocumentFragment(aNodeInfoManager, rv).get();
+  return rv.ErrorCode();
+}
+
+already_AddRefed<mozilla::dom::DocumentFragment>
+NS_NewDocumentFragment(nsNodeInfoManager* aNodeInfoManager,
+                       mozilla::ErrorResult& aRv)
 {
   using namespace mozilla::dom;
 
-  NS_ENSURE_ARG(aNodeInfoManager);
+  if (!aNodeInfoManager) {
+    aRv.Throw(NS_ERROR_INVALID_ARG);
+    return nullptr;
+  }
 
-  nsCOMPtr<nsINodeInfo> nodeInfo;
-  nodeInfo = aNodeInfoManager->GetNodeInfo(nsGkAtoms::documentFragmentNodeName,
-                                           nullptr, kNameSpaceID_None,
-                                           nsIDOMNode::DOCUMENT_FRAGMENT_NODE);
-  NS_ENSURE_TRUE(nodeInfo, NS_ERROR_OUT_OF_MEMORY);
+  nsCOMPtr<nsINodeInfo> nodeInfo =
+    aNodeInfoManager->GetNodeInfo(nsGkAtoms::documentFragmentNodeName,
+                                  nullptr, kNameSpaceID_None,
+                                  nsIDOMNode::DOCUMENT_FRAGMENT_NODE);
+  if (!nodeInfo) {
+    aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
+    return nullptr;
+  }
 
-  DocumentFragment *it = new DocumentFragment(nodeInfo.forget());
-  NS_ADDREF(*aInstancePtrResult = it);
-
-  return NS_OK;
+  nsRefPtr<DocumentFragment> it = new DocumentFragment(nodeInfo.forget());
+  return it.forget();
 }
 
 namespace mozilla {
@@ -54,9 +67,9 @@ DocumentFragment::DocumentFragment(already_AddRefed<nsINodeInfo> aNodeInfo)
 }
 
 JSObject*
-DocumentFragment::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+DocumentFragment::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return DocumentFragmentBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return DocumentFragmentBinding::Wrap(aCx, aScope, this);
 }
 
 bool
diff --git a/content/base/src/DocumentFragment.h b/content/base/src/DocumentFragment.h
index 337035b09228..d3b6035372ab 100644
--- a/content/base/src/DocumentFragment.h
+++ b/content/base/src/DocumentFragment.h
@@ -41,8 +41,7 @@ public:
   {
   }
 
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap);
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
   // nsIContent
   virtual already_AddRefed<nsINodeInfo>
diff --git a/content/base/src/DocumentType.cpp b/content/base/src/DocumentType.cpp
index 1cdc4a441da1..0a1e2b1683f9 100644
--- a/content/base/src/DocumentType.cpp
+++ b/content/base/src/DocumentType.cpp
@@ -64,9 +64,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-DocumentType::WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap)
+DocumentType::WrapNode(JSContext *cx, JSObject *scope)
 {
-  return DocumentTypeBinding::Wrap(cx, scope, this, triedToWrap);
+  return DocumentTypeBinding::Wrap(cx, scope, this);
 }
 
 DocumentType::DocumentType(already_AddRefed<nsINodeInfo> aNodeInfo,
diff --git a/content/base/src/DocumentType.h b/content/base/src/DocumentType.h
index ece7f4e7f148..5474c7f8cdc5 100644
--- a/content/base/src/DocumentType.h
+++ b/content/base/src/DocumentType.h
@@ -76,7 +76,7 @@ public:
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
 protected:
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
   nsString mPublicId;
   nsString mSystemId;
diff --git a/content/base/src/Element.cpp b/content/base/src/Element.cpp
index f8d0cfa6f977..98b9ed177caa 100644
--- a/content/base/src/Element.cpp
+++ b/content/base/src/Element.cpp
@@ -339,10 +339,9 @@ Element::GetBindingURL(nsIDocument *aDocument, css::URLValue **aResult)
 }
 
 JSObject*
-Element::WrapObject(JSContext *aCx, JSObject *aScope,
-                    bool *aTriedToWrap)
+Element::WrapObject(JSContext *aCx, JSObject *aScope)
 {
-  JSObject* obj = nsINode::WrapObject(aCx, aScope, aTriedToWrap);
+  JSObject* obj = nsINode::WrapObject(aCx, aScope);
   if (!obj) {
     return nullptr;
   }
diff --git a/content/base/src/EventSource.cpp b/content/base/src/EventSource.cpp
index a2e91a9f866c..ffda0845d7dd 100644
--- a/content/base/src/EventSource.cpp
+++ b/content/base/src/EventSource.cpp
@@ -278,9 +278,9 @@ EventSource::Init(nsISupports* aOwner,
 }
 
 /* virtual */ JSObject*
-EventSource::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+EventSource::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return EventSourceBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return EventSourceBinding::Wrap(aCx, aScope, this);
 }
 
 /* static */ already_AddRefed<EventSource>
diff --git a/content/base/src/EventSource.h b/content/base/src/EventSource.h
index 30048bd34000..8e5c91bacd32 100644
--- a/content/base/src/EventSource.h
+++ b/content/base/src/EventSource.h
@@ -66,7 +66,7 @@ public:
 
   // nsWrapperCache
   virtual JSObject*
-  WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE;
+  WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   // WebIDL
   nsPIDOMWindow*
diff --git a/content/base/src/FragmentOrElement.cpp b/content/base/src/FragmentOrElement.cpp
index 1a83cac3edf7..66da7514ec03 100644
--- a/content/base/src/FragmentOrElement.cpp
+++ b/content/base/src/FragmentOrElement.cpp
@@ -381,10 +381,9 @@ NS_INTERFACE_TABLE_HEAD(nsChildContentList)
 NS_INTERFACE_MAP_END
 
 JSObject*
-nsChildContentList::WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap)
+nsChildContentList::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return NodeListBinding::Wrap(cx, scope, this, triedToWrap);
+  return NodeListBinding::Wrap(cx, scope, this);
 }
 
 NS_IMETHODIMP
diff --git a/content/base/src/WebSocket.cpp b/content/base/src/WebSocket.cpp
index 71645cc86d6d..ca8b49a036da 100644
--- a/content/base/src/WebSocket.cpp
+++ b/content/base/src/WebSocket.cpp
@@ -476,9 +476,9 @@ WebSocket::~WebSocket()
 }
 
 JSObject*
-WebSocket::WrapObject(JSContext* cx, JSObject* scope, bool* triedToWrap)
+WebSocket::WrapObject(JSContext* cx, JSObject* scope)
 {
-  return WebSocketBinding::Wrap(cx, scope, this, triedToWrap);
+  return WebSocketBinding::Wrap(cx, scope, this);
 }
 
 //---------------------------------------------------------------------------
diff --git a/content/base/src/WebSocket.h b/content/base/src/WebSocket.h
index 03ba1d5ed5aa..a8cc41aeaea0 100644
--- a/content/base/src/WebSocket.h
+++ b/content/base/src/WebSocket.h
@@ -86,9 +86,7 @@ public:
   // nsWrapperCache
   nsPIDOMWindow* GetParentObject() { return GetOwner(); }
 
-  JSObject* WrapObject(JSContext *cx,
-                       JSObject *scope,
-                       bool *triedToWrap);
+  JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 public: // static helpers:
 
diff --git a/content/base/src/nsContentList.cpp b/content/base/src/nsContentList.cpp
index 63f1f79a527b..c51970066421 100644
--- a/content/base/src/nsContentList.cpp
+++ b/content/base/src/nsContentList.cpp
@@ -155,10 +155,9 @@ NS_IMPL_ADDREF_INHERITED(nsSimpleContentList, nsBaseContentList)
 NS_IMPL_RELEASE_INHERITED(nsSimpleContentList, nsBaseContentList)
 
 JSObject*
-nsSimpleContentList::WrapObject(JSContext *cx, JSObject *scope,
-                                bool *triedToWrap)
+nsSimpleContentList::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return NodeListBinding::Wrap(cx, scope, this, triedToWrap);
+  return NodeListBinding::Wrap(cx, scope, this);
 }
 
 // nsFormContentList
@@ -289,18 +288,16 @@ const nsCacheableFuncStringContentList::ContentListType
 #endif
 
 JSObject*
-nsCacheableFuncStringNodeList::WrapObject(JSContext *cx, JSObject *scope,
-                                          bool *triedToWrap)
+nsCacheableFuncStringNodeList::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return NodeListBinding::Wrap(cx, scope, this, triedToWrap);
+  return NodeListBinding::Wrap(cx, scope, this);
 }
 
 
 JSObject*
-nsCacheableFuncStringHTMLCollection::WrapObject(JSContext *cx, JSObject *scope,
-                                                bool *triedToWrap)
+nsCacheableFuncStringHTMLCollection::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return HTMLCollectionBinding::Wrap(cx, scope, this, triedToWrap);
+  return HTMLCollectionBinding::Wrap(cx, scope, this);
 }
 
 // Hashtable for storing nsCacheableFuncStringContentList
@@ -516,9 +513,9 @@ nsContentList::~nsContentList()
 }
 
 JSObject*
-nsContentList::WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap)
+nsContentList::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return HTMLCollectionBinding::Wrap(cx, scope, this, triedToWrap);
+  return HTMLCollectionBinding::Wrap(cx, scope, this);
 }
 
 NS_IMPL_ISUPPORTS_INHERITED3(nsContentList, nsBaseContentList,
diff --git a/content/base/src/nsContentList.h b/content/base/src/nsContentList.h
index 26b08a15e367..d4b73b29c4c0 100644
--- a/content/base/src/nsContentList.h
+++ b/content/base/src/nsContentList.h
@@ -105,8 +105,8 @@ public:
 
   virtual int32_t IndexOf(nsIContent *aContent, bool aDoFlush);
 
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap) = 0;
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope)
+    MOZ_OVERRIDE = 0;
 
 protected:
   nsTArray< nsCOMPtr<nsIContent> > mElements;
@@ -129,8 +129,7 @@ public:
   {
     return mRoot;
   }
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap);
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 private:
   // This has to be a strong reference, the root might go away before the list.
@@ -261,8 +260,7 @@ public:
 
   // nsWrapperCache
   using nsWrapperCache::GetWrapperPreserveColor;
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap);
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
   // nsIDOMHTMLCollection
   NS_DECL_NSIDOMHTMLCOLLECTION
@@ -539,8 +537,7 @@ public:
 #endif
   }
 
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap);
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 #ifdef DEBUG
   static const ContentListType sType;
@@ -564,8 +561,7 @@ public:
 #endif
   }
 
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap);
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 #ifdef DEBUG
   static const ContentListType sType;
diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
index a688cc63d7ed..2739d2d59999 100644
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -168,6 +168,7 @@
 #include "nsSVGFeatures.h"
 #include "MediaDecoder.h"
 #include "DecoderTraits.h"
+#include "mozilla/dom/DocumentFragment.h"
 
 #include "nsWrapperCacheInlines.h"
 #include "nsViewportInfo.h"
@@ -1588,6 +1589,15 @@ nsContentUtils::CanCallerAccess(nsIPrincipal* aSubjectPrincipal,
 // static
 bool
 nsContentUtils::CanCallerAccess(nsIDOMNode *aNode)
+{
+  nsCOMPtr<nsINode> node = do_QueryInterface(aNode);
+  NS_ENSURE_TRUE(node, false);
+  return CanCallerAccess(node);
+}
+
+// static
+bool
+nsContentUtils::CanCallerAccess(nsINode* aNode)
 {
   // XXXbz why not check the IsCapabilityEnabled thing up front, and not bother
   // with the system principal games?  But really, there should be a simpler
@@ -1602,10 +1612,7 @@ nsContentUtils::CanCallerAccess(nsIDOMNode *aNode)
     return true;
   }
 
-  nsCOMPtr<nsINode> node = do_QueryInterface(aNode);
-  NS_ENSURE_TRUE(node, false);
-
-  return CanCallerAccess(subjectPrincipal, node->NodePrincipal());
+  return CanCallerAccess(subjectPrincipal, aNode->NodePrincipal());
 }
 
 // static
@@ -4045,8 +4052,22 @@ nsContentUtils::CreateContextualFragment(nsINode* aContextNode,
                                          bool aPreventScriptExecution,
                                          nsIDOMDocumentFragment** aReturn)
 {
-  *aReturn = nullptr;
-  NS_ENSURE_ARG(aContextNode);
+  ErrorResult rv;
+  *aReturn = CreateContextualFragment(aContextNode, aFragment,
+                                      aPreventScriptExecution, rv).get();
+  return rv.ErrorCode();
+}
+
+already_AddRefed<DocumentFragment>
+nsContentUtils::CreateContextualFragment(nsINode* aContextNode,
+                                         const nsAString& aFragment,
+                                         bool aPreventScriptExecution,
+                                         ErrorResult& aRv)
+{
+  if (!aContextNode) {
+    aRv.Throw(NS_ERROR_INVALID_ARG);
+    return nullptr;
+  }
 
   // If we don't have a document here, we can't get the right security context
   // for compiling event handlers... so just bail out.
@@ -4058,8 +4079,8 @@ nsContentUtils::CreateContextualFragment(nsINode* aContextNode,
 #endif
 
   if (isHTML) {
-    nsCOMPtr<nsIDOMDocumentFragment> frag;
-    NS_NewDocumentFragment(getter_AddRefs(frag), document->NodeInfoManager());
+    nsRefPtr<DocumentFragment> frag =
+      NS_NewDocumentFragment(document->NodeInfoManager(), aRv);
     
     nsCOMPtr<nsIContent> contextAsContent = do_QueryInterface(aContextNode);
     if (contextAsContent && !contextAsContent->IsElement()) {
@@ -4070,28 +4091,23 @@ nsContentUtils::CreateContextualFragment(nsINode* aContextNode,
       }
     }
     
-    nsresult rv;
-    nsCOMPtr<nsIContent> fragment = do_QueryInterface(frag);
     if (contextAsContent && !contextAsContent->IsHTML(nsGkAtoms::html)) {
-      rv = ParseFragmentHTML(aFragment,
-                             fragment,
-                             contextAsContent->Tag(),
-                             contextAsContent->GetNameSpaceID(),
-                             (document->GetCompatibilityMode() ==
+      aRv = ParseFragmentHTML(aFragment, frag,
+                              contextAsContent->Tag(),
+                              contextAsContent->GetNameSpaceID(),
+                              (document->GetCompatibilityMode() ==
                                eCompatibility_NavQuirks),
-                             aPreventScriptExecution);
+                              aPreventScriptExecution);
     } else {
-      rv = ParseFragmentHTML(aFragment,
-                             fragment,
-                             nsGkAtoms::body,
-                             kNameSpaceID_XHTML,
-                             (document->GetCompatibilityMode() ==
+      aRv = ParseFragmentHTML(aFragment, frag,
+                              nsGkAtoms::body,
+                              kNameSpaceID_XHTML,
+                              (document->GetCompatibilityMode() ==
                                eCompatibility_NavQuirks),
-                             aPreventScriptExecution);
+                              aPreventScriptExecution);
     }
 
-    frag.forget(aReturn);
-    return rv;
+    return frag.forget();
   }
 
   nsAutoTArray<nsString, 32> tagStack;
@@ -4103,7 +4119,10 @@ nsContentUtils::CreateContextualFragment(nsINode* aContextNode,
 
   while (content && content->IsElement()) {
     nsString& tagName = *tagStack.AppendElement();
-    NS_ENSURE_TRUE(&tagName, NS_ERROR_OUT_OF_MEMORY);
+    if (!&tagName) {
+      aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
+      return nullptr;
+    }
 
     tagName = content->NodeInfo()->QualifiedName();
 
@@ -4149,11 +4168,10 @@ nsContentUtils::CreateContextualFragment(nsINode* aContextNode,
     content = content->GetParent();
   }
 
-  return ParseFragmentXML(aFragment,
-                          document,
-                          tagStack,
-                          aPreventScriptExecution,
-                          aReturn);
+  nsCOMPtr<nsIDOMDocumentFragment> frag;
+  aRv = ParseFragmentXML(aFragment, document, tagStack,
+                         aPreventScriptExecution, getter_AddRefs(frag));
+  return static_cast<DocumentFragment*>(frag.forget().get());
 }
 
 /* static */
diff --git a/content/base/src/nsCopySupport.cpp b/content/base/src/nsCopySupport.cpp
index 9e625028c081..b8ec7f4a55a8 100644
--- a/content/base/src/nsCopySupport.cpp
+++ b/content/base/src/nsCopySupport.cpp
@@ -294,7 +294,7 @@ nsCopySupport::GetTransferableForNode(nsINode* aNode,
   NS_ENSURE_SUCCESS(rv, rv);
   nsCOMPtr<nsIDOMNode> node = do_QueryInterface(aNode);
   NS_ENSURE_TRUE(node, NS_ERROR_FAILURE);
-  nsRefPtr<nsRange> range = new nsRange();
+  nsRefPtr<nsRange> range = new nsRange(aNode);
   rv = range->SelectNode(node);
   NS_ENSURE_SUCCESS(rv, rv);
   rv = selection->AddRange(range);
diff --git a/content/base/src/nsDOMCaretPosition.cpp b/content/base/src/nsDOMCaretPosition.cpp
index 5a287d94103a..35711b4a9269 100644
--- a/content/base/src/nsDOMCaretPosition.cpp
+++ b/content/base/src/nsDOMCaretPosition.cpp
@@ -22,10 +22,9 @@ nsINode* nsDOMCaretPosition::GetOffsetNode() const
 }
 
 JSObject*
-nsDOMCaretPosition::WrapObject(JSContext *aCx, JSObject *aScope,
-                              bool *aTried)
+nsDOMCaretPosition::WrapObject(JSContext *aCx, JSObject *aScope)
 {
-  return mozilla::dom::CaretPositionBinding::Wrap(aCx, aScope, this, aTried);
+  return mozilla::dom::CaretPositionBinding::Wrap(aCx, aScope, this);
 }
 
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_1(nsDOMCaretPosition, mOffsetNode)
diff --git a/content/base/src/nsDOMCaretPosition.h b/content/base/src/nsDOMCaretPosition.h
index c25b4263ce9b..2caef48eeb20 100644
--- a/content/base/src/nsDOMCaretPosition.h
+++ b/content/base/src/nsDOMCaretPosition.h
@@ -51,7 +51,7 @@ public:
     return GetOffsetNode();
   }
 
-  virtual JSObject* WrapObject(JSContext *aCx, JSObject *aScope, bool *aTried)
+  virtual JSObject* WrapObject(JSContext *aCx, JSObject *aScope)
     MOZ_OVERRIDE MOZ_FINAL;
 
 protected:
diff --git a/content/base/src/nsDOMFile.cpp b/content/base/src/nsDOMFile.cpp
index 0167f424cd15..2601738b7c8c 100644
--- a/content/base/src/nsDOMFile.cpp
+++ b/content/base/src/nsDOMFile.cpp
@@ -741,10 +741,9 @@ NS_IMPL_CYCLE_COLLECTING_ADDREF(nsDOMFileList)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsDOMFileList)
 
 JSObject*
-nsDOMFileList::WrapObject(JSContext *cx, JSObject *scope,
-                          bool *triedToWrap)
+nsDOMFileList::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return FileListBinding::Wrap(cx, scope, this, triedToWrap);
+  return FileListBinding::Wrap(cx, scope, this);
 }
 
 NS_IMETHODIMP
diff --git a/content/base/src/nsDOMMutationObserver.h b/content/base/src/nsDOMMutationObserver.h
index 7fb00563d18f..a9694ad82342 100644
--- a/content/base/src/nsDOMMutationObserver.h
+++ b/content/base/src/nsDOMMutationObserver.h
@@ -44,11 +44,9 @@ public:
     return mOwner;
   }
 
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope,
-                               bool* aTriedToWrap)
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE
   {
-    return mozilla::dom::MutationRecordBinding::Wrap(aCx, aScope, this,
-                                                     aTriedToWrap);
+    return mozilla::dom::MutationRecordBinding::Wrap(aCx, aScope, this);
   }
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
@@ -359,11 +357,9 @@ public:
               mozilla::dom::MutationCallback& aCb,
               mozilla::ErrorResult& aRv);
 
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope,
-                               bool* aTriedToWrap)
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE
   {
-    return mozilla::dom::MutationObserverBinding::Wrap(aCx, aScope,
-                                                       this, aTriedToWrap);
+    return mozilla::dom::MutationObserverBinding::Wrap(aCx, aScope, this);
   }
 
   nsISupports* GetParentObject() const
diff --git a/content/base/src/nsDOMParser.h b/content/base/src/nsDOMParser.h
index 3a65f74a3999..6c03965e0f4e 100644
--- a/content/base/src/nsDOMParser.h
+++ b/content/base/src/nsDOMParser.h
@@ -67,11 +67,9 @@ public:
     return mOwner;
   }
 
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope,
-                               bool* aTriedToWrap) MOZ_OVERRIDE
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE
   {
-    return mozilla::dom::DOMParserBinding::Wrap(aCx, aScope, this,
-                                                aTriedToWrap);
+    return mozilla::dom::DOMParserBinding::Wrap(aCx, aScope, this);
   }
 
 private:
diff --git a/content/base/src/nsDOMSerializer.h b/content/base/src/nsDOMSerializer.h
index 6284a0815f62..845b09b092ff 100644
--- a/content/base/src/nsDOMSerializer.h
+++ b/content/base/src/nsDOMSerializer.h
@@ -49,11 +49,9 @@ public:
     return mOwner;
   }
 
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope,
-                               bool* aTriedToWrap) MOZ_OVERRIDE
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE
   {
-    return mozilla::dom::XMLSerializerBinding::Wrap(aCx, aScope, this,
-                                                    aTriedToWrap);
+    return mozilla::dom::XMLSerializerBinding::Wrap(aCx, aScope, this);
   }
 
 private:
diff --git a/content/base/src/nsDOMSettableTokenList.cpp b/content/base/src/nsDOMSettableTokenList.cpp
index 4a5593bb5c69..e7fb5f41ead4 100644
--- a/content/base/src/nsDOMSettableTokenList.cpp
+++ b/content/base/src/nsDOMSettableTokenList.cpp
@@ -21,9 +21,7 @@ nsDOMSettableTokenList::SetValue(const nsAString& aValue, mozilla::ErrorResult&
 }
 
 JSObject*
-nsDOMSettableTokenList::WrapObject(JSContext *cx, JSObject *scope,
-                                   bool *triedToWrap)
+nsDOMSettableTokenList::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return mozilla::dom::DOMSettableTokenListBinding::Wrap(cx, scope, this,
-                                                         triedToWrap);
+  return mozilla::dom::DOMSettableTokenListBinding::Wrap(cx, scope, this);
 }
diff --git a/content/base/src/nsDOMSettableTokenList.h b/content/base/src/nsDOMSettableTokenList.h
index 158ab58e1f94..1a33942c8a8f 100644
--- a/content/base/src/nsDOMSettableTokenList.h
+++ b/content/base/src/nsDOMSettableTokenList.h
@@ -22,8 +22,7 @@ public:
   nsDOMSettableTokenList(mozilla::dom::Element* aElement, nsIAtom* aAttrAtom)
     : nsDOMTokenList(aElement, aAttrAtom) {}
 
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap);
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
   // WebIDL
   void GetValue(nsAString& aResult) { Stringify(aResult); }
diff --git a/content/base/src/nsDOMTokenList.cpp b/content/base/src/nsDOMTokenList.cpp
index 5107b00a41cd..56d1b0c691ce 100644
--- a/content/base/src/nsDOMTokenList.cpp
+++ b/content/base/src/nsDOMTokenList.cpp
@@ -261,8 +261,8 @@ nsDOMTokenList::Stringify(nsAString& aResult)
 }
 
 JSObject*
-nsDOMTokenList::WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap)
+nsDOMTokenList::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return DOMTokenListBinding::Wrap(cx, scope, this, triedToWrap);
+  return DOMTokenListBinding::Wrap(cx, scope, this);
 }
 
diff --git a/content/base/src/nsDOMTokenList.h b/content/base/src/nsDOMTokenList.h
index 3fd03f671204..08f190777c78 100644
--- a/content/base/src/nsDOMTokenList.h
+++ b/content/base/src/nsDOMTokenList.h
@@ -40,8 +40,7 @@ public:
 
   void DropReference();
 
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap);
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
   Element* GetParentObject()
   {
diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index 70f6b384fc7d..a339a6d9127a 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -5573,7 +5573,7 @@ nsDocument::CreateRange(nsIDOMRange** aReturn)
 already_AddRefed<nsRange>
 nsIDocument::CreateRange(ErrorResult& rv)
 {
-  nsRefPtr<nsRange> range = new nsRange();
+  nsRefPtr<nsRange> range = new nsRange(this);
   nsresult res = range->Set(this, 0, this, 0);
   if (NS_FAILED(res)) {
     rv.Throw(res);
diff --git a/content/base/src/nsFormData.cpp b/content/base/src/nsFormData.cpp
index a6eb47918337..cad2ab25d867 100644
--- a/content/base/src/nsFormData.cpp
+++ b/content/base/src/nsFormData.cpp
@@ -102,9 +102,9 @@ nsFormData::Append(const nsAString& aName, nsIVariant* aValue)
 }
 
 /* virtual */ JSObject*
-nsFormData::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+nsFormData::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return FormDataBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return FormDataBinding::Wrap(aCx, aScope, this);
 }
 
 /* static */ already_AddRefed<nsFormData>
diff --git a/content/base/src/nsFormData.h b/content/base/src/nsFormData.h
index bc0c63db60f3..26131294ff54 100644
--- a/content/base/src/nsFormData.h
+++ b/content/base/src/nsFormData.h
@@ -41,7 +41,7 @@ public:
 
   // nsWrapperCache
   virtual JSObject*
-  WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE;
+  WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   // WebIDL
   nsISupports*
diff --git a/content/base/src/nsINode.cpp b/content/base/src/nsINode.cpp
index 9dbf36013b1c..aa2effaef5f4 100644
--- a/content/base/src/nsINode.cpp
+++ b/content/base/src/nsINode.cpp
@@ -2346,7 +2346,7 @@ nsINode::QuerySelectorAll(const nsAString& aSelector, ErrorResult& aResult)
 }
 
 JSObject*
-nsINode::WrapObject(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+nsINode::WrapObject(JSContext *aCx, JSObject *aScope)
 {
   MOZ_ASSERT(IsDOMBinding());
 
@@ -2364,11 +2364,10 @@ nsINode::WrapObject(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
       !hasHadScriptHandlingObject &&
       !nsContentUtils::IsCallerChrome()) {
     Throw<true>(aCx, NS_ERROR_UNEXPECTED);
-    *aTriedToWrap = true;
     return nullptr;
   }
 
-  JSObject* obj = WrapNode(aCx, aScope, aTriedToWrap);
+  JSObject* obj = WrapNode(aCx, aScope);
   if (obj && ChromeOnlyAccess() &&
       !nsContentUtils::IsSystemPrincipal(NodePrincipal()))
   {
diff --git a/content/base/src/nsObjectLoadingContent.cpp b/content/base/src/nsObjectLoadingContent.cpp
index 8dc9f9c76bff..1e305da76d95 100644
--- a/content/base/src/nsObjectLoadingContent.cpp
+++ b/content/base/src/nsObjectLoadingContent.cpp
@@ -2645,6 +2645,14 @@ nsObjectLoadingContent::GetPluginFallbackType(uint32_t* aPluginFallbackType)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsObjectLoadingContent::GetHasRunningPlugin(bool *aHasPlugin)
+{
+  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome(), NS_ERROR_NOT_AVAILABLE);
+  *aHasPlugin = HasRunningPlugin();
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsObjectLoadingContent::CancelPlayPreview()
 {
@@ -2652,7 +2660,7 @@ nsObjectLoadingContent::CancelPlayPreview()
     return NS_ERROR_NOT_AVAILABLE;
 
   mPlayPreviewCanceled = true;
-  
+
   // If we're in play preview state already, reload
   if (mType == eType_Null && mFallbackType == eFallbackPlayPreview) {
     return LoadObject(true, true);
diff --git a/content/base/src/nsObjectLoadingContent.h b/content/base/src/nsObjectLoadingContent.h
index 8aeefe9a09e8..33218b52ffac 100644
--- a/content/base/src/nsObjectLoadingContent.h
+++ b/content/base/src/nsObjectLoadingContent.h
@@ -197,6 +197,10 @@ class nsObjectLoadingContent : public nsImageLoadingContent
     {
       return mFallbackType;
     }
+    bool HasRunningPlugin() const
+    {
+      return !!mInstanceOwner;
+    }
     void CancelPlayPreview(mozilla::ErrorResult& aRv)
     {
       aRv = CancelPlayPreview();
diff --git a/content/base/src/nsRange.cpp b/content/base/src/nsRange.cpp
index 4c93f250b326..062e63428ec5 100644
--- a/content/base/src/nsRange.cpp
+++ b/content/base/src/nsRange.cpp
@@ -29,27 +29,23 @@
 #include "nsLayoutUtils.h"
 #include "nsTextFrame.h"
 #include "nsFontFaceList.h"
+#include "mozilla/dom/DocumentFragment.h"
+#include "mozilla/dom/RangeBinding.h"
 #include "mozilla/Telemetry.h"
 #include "mozilla/Likely.h"
 
 using namespace mozilla;
 
+JSObject*
+nsRange::WrapObject(JSContext* aCx, JSObject* aScope)
+{
+  return dom::RangeBinding::Wrap(aCx, aScope, this);
+}
+
 /******************************************************
  * stack based utilty class for managing monitor
  ******************************************************/
 
-// NS_ERROR_DOM_NOT_OBJECT_ERR is not the correct one to throw, but spec doesn't say
-// what is
-#define VALIDATE_ACCESS(node_)                                                     \
-  PR_BEGIN_MACRO                                                                   \
-    if (!node_) {                                                                  \
-      return NS_ERROR_DOM_NOT_OBJECT_ERR;                                          \
-    }                                                                              \
-    if (!nsContentUtils::CanCallerAccess(node_)) {                                 \
-      return NS_ERROR_DOM_SECURITY_ERR;                                            \
-    }                                                                              \
-  PR_END_MACRO
-
 static void InvalidateAllFrames(nsINode* aNode)
 {
   NS_PRECONDITION(aNode, "bad arg");
@@ -224,9 +220,12 @@ nsRange::CreateRange(nsIDOMNode* aStartParent, int32_t aStartOffset,
   MOZ_ASSERT(aRange);
   *aRange = NULL;
 
-  nsRefPtr<nsRange> range = new nsRange();
+  nsCOMPtr<nsINode> startParent = do_QueryInterface(aStartParent);
+  NS_ENSURE_ARG_POINTER(startParent);
 
-  nsresult rv = range->SetStart(aStartParent, aStartOffset);
+  nsRefPtr<nsRange> range = new nsRange(startParent);
+
+  nsresult rv = range->SetStart(startParent, aStartOffset);
   NS_ENSURE_SUCCESS(rv, rv);
 
   rv = range->SetEnd(aEndParent, aEndOffset);
@@ -260,6 +259,7 @@ DOMCI_DATA(Range, nsRange)
 
 // QueryInterface implementation for nsRange
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsRange)
+  NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsIDOMRange)
   NS_INTERFACE_MAP_ENTRY(nsIMutationObserver)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIDOMRange)
@@ -267,15 +267,24 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsRange)
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsRange)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mOwner);
   tmp->Reset();
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsRange)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mOwner)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mStartParent)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mEndParent)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mRoot)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
+NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsRange)
+  NS_IMPL_CYCLE_COLLECTION_TRACE_PRESERVED_WRAPPER
+NS_IMPL_CYCLE_COLLECTION_TRACE_END
+
+
 static void
 RangeHashTableDtor(void* aObject, nsIAtom* aPropertyName, void* aPropertyValue,
                    void* aData)
@@ -687,58 +696,78 @@ nsRange::ParentChainChanged(nsIContent *aContent)
 NS_IMETHODIMP
 nsRange::IsPointInRange(nsIDOMNode* aParent, int32_t aOffset, bool* aResult)
 {
-  int16_t compareResult = 0;
-  nsresult rv = ComparePoint(aParent, aOffset, &compareResult);
-  // If the node isn't in the range's document, it clearly isn't in the range.
-  if (rv == NS_ERROR_DOM_WRONG_DOCUMENT_ERR) {
-    *aResult = false;
-    return NS_OK;
+  nsCOMPtr<nsINode> parent = do_QueryInterface(aParent);
+  if (!parent) {
+    return NS_ERROR_DOM_NOT_OBJECT_ERR;
   }
 
-  *aResult = compareResult == 0;
-
-  return rv;
+  ErrorResult rv;
+  *aResult = IsPointInRange(*parent, aOffset, rv);
+  return rv.ErrorCode();
 }
-  
+
+bool
+nsRange::IsPointInRange(nsINode& aParent, uint32_t aOffset, ErrorResult& aRv)
+{
+  uint16_t compareResult = ComparePoint(aParent, aOffset, aRv);
+  // If the node isn't in the range's document, it clearly isn't in the range.
+  if (aRv.ErrorCode() == NS_ERROR_DOM_WRONG_DOCUMENT_ERR) {
+    aRv = NS_OK;
+    return false;
+  }
+
+  return compareResult == 0;
+}
+
 // returns -1 if point is before range, 0 if point is in range,
 // 1 if point is after range.
 NS_IMETHODIMP
 nsRange::ComparePoint(nsIDOMNode* aParent, int32_t aOffset, int16_t* aResult)
 {
-  // our range is in a good state?
-  if (!mIsPositioned) 
-    return NS_ERROR_NOT_INITIALIZED;
-
   nsCOMPtr<nsINode> parent = do_QueryInterface(aParent);
   NS_ENSURE_TRUE(parent, NS_ERROR_DOM_HIERARCHY_REQUEST_ERR);
 
-  if (!nsContentUtils::ContentIsDescendantOf(parent, mRoot)) {
-    return NS_ERROR_DOM_WRONG_DOCUMENT_ERR;
-  }
-  
-  if (parent->NodeType() == nsIDOMNode::DOCUMENT_TYPE_NODE) {
-    return NS_ERROR_DOM_INVALID_NODE_TYPE_ERR;
+  ErrorResult rv;
+  *aResult = ComparePoint(*parent, aOffset, rv);
+  return rv.ErrorCode();
+}
+
+int16_t
+nsRange::ComparePoint(nsINode& aParent, uint32_t aOffset, ErrorResult& aRv)
+{
+  // our range is in a good state?
+  if (!mIsPositioned) {
+    aRv.Throw(NS_ERROR_NOT_INITIALIZED);
+    return 0;
   }
 
-  if (aOffset < 0 || uint32_t(aOffset) > parent->Length()) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
+  if (!nsContentUtils::ContentIsDescendantOf(&aParent, mRoot)) {
+    aRv.Throw(NS_ERROR_DOM_WRONG_DOCUMENT_ERR);
+    return 0;
   }
-  
+
+  if (aParent.NodeType() == nsIDOMNode::DOCUMENT_TYPE_NODE) {
+    aRv.Throw(NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
+    return 0;
+  }
+
+  if (aOffset > aParent.Length()) {
+    aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    return 0;
+  }
+
   int32_t cmp;
-  if ((cmp = nsContentUtils::ComparePoints(parent, aOffset,
+  if ((cmp = nsContentUtils::ComparePoints(&aParent, aOffset,
                                            mStartParent, mStartOffset)) <= 0) {
-    
-    *aResult = cmp;
+
+    return cmp;
   }
-  else if (nsContentUtils::ComparePoints(mEndParent, mEndOffset,
-                                         parent, aOffset) == -1) {
-    *aResult = 1;
+  if (nsContentUtils::ComparePoints(mEndParent, mEndOffset,
+                                    &aParent, aOffset) == -1) {
+    return 1;
   }
-  else {
-    *aResult = 0;
-  }
-  
-  return NS_OK;
+
+  return 0;
 }
 
 NS_IMETHODIMP
@@ -750,35 +779,45 @@ nsRange::IntersectsNode(nsIDOMNode* aNode, bool* aResult)
   // TODO: This should throw a TypeError.
   NS_ENSURE_ARG(node);
 
-  NS_ENSURE_TRUE(mIsPositioned, NS_ERROR_NOT_INITIALIZED);
+  ErrorResult rv;
+  *aResult = IntersectsNode(*node, rv);
+  return rv.ErrorCode();
+}
+
+bool
+nsRange::IntersectsNode(nsINode& aNode, ErrorResult& aRv)
+{
+  if (!mIsPositioned) {
+    aRv.Throw(NS_ERROR_NOT_INITIALIZED);
+    return false;
+  }
 
   // Step 3.
-  nsINode* parent = node->GetParentNode();
+  nsINode* parent = aNode.GetParentNode();
   if (!parent) {
     // Steps 2 and 4. 
     // |parent| is null, so |node|'s root is |node| itself.
-    *aResult = (GetRoot() == node);
-    return NS_OK;
+    return GetRoot() == &aNode;
   }
 
   // Step 5.
-  int32_t nodeIndex = parent->IndexOf(node);
+  int32_t nodeIndex = parent->IndexOf(&aNode);
 
   // Steps 6-7.
   // Note: if disconnected is true, ComparePoints returns 1.
   bool disconnected = false;
-  *aResult = nsContentUtils::ComparePoints(mStartParent, mStartOffset,
-                                           parent, nodeIndex + 1,
-                                           &disconnected) < 0 &&
-             nsContentUtils::ComparePoints(parent, nodeIndex,
-                                           mEndParent, mEndOffset,
-                                           &disconnected) < 0;
+  bool result = nsContentUtils::ComparePoints(mStartParent, mStartOffset,
+                                             parent, nodeIndex + 1,
+                                             &disconnected) < 0 &&
+               nsContentUtils::ComparePoints(parent, nodeIndex,
+                                             mEndParent, mEndOffset,
+                                             &disconnected) < 0;
 
   // Step 2.
   if (disconnected) {
-    *aResult = false;
+    result = false;
   }
-  return NS_OK;
+  return result;
 }
 
 /******************************************************
@@ -855,6 +894,14 @@ nsRange::DoSetRange(nsINode* aStartN, int32_t aStartOffset,
   mRoot = aRoot;
 }
 
+static int32_t
+IndexOf(nsINode* aChild)
+{
+  nsINode* parent = aChild->GetParentNode();
+
+  return parent ? parent->IndexOf(aChild) : -1;
+}
+
 static int32_t
 IndexOf(nsIDOMNode* aChildNode)
 {
@@ -864,11 +911,7 @@ IndexOf(nsIDOMNode* aChildNode)
   if (!child) {
     return -1;
   }
-
-  nsINode *parent = child->GetParentNode();
-
-  // finally we get the index
-  return parent ? parent->IndexOf(child) : -1;
+  return IndexOf(child);
 }
 
 nsINode*
@@ -898,6 +941,17 @@ nsRange::GetStartContainer(nsIDOMNode** aStartParent)
   return CallQueryInterface(mStartParent, aStartParent);
 }
 
+nsINode*
+nsRange::GetStartContainer(ErrorResult& aRv) const
+{
+  if (!mIsPositioned) {
+    aRv.Throw(NS_ERROR_NOT_INITIALIZED);
+    return nullptr;
+  }
+
+  return mStartParent;
+}
+
 NS_IMETHODIMP
 nsRange::GetStartOffset(int32_t* aStartOffset)
 {
@@ -909,6 +963,17 @@ nsRange::GetStartOffset(int32_t* aStartOffset)
   return NS_OK;
 }
 
+uint32_t
+nsRange::GetStartOffset(ErrorResult& aRv) const
+{
+  if (!mIsPositioned) {
+    aRv.Throw(NS_ERROR_NOT_INITIALIZED);
+    return 0;
+  }
+
+  return mStartOffset;
+}
+
 NS_IMETHODIMP
 nsRange::GetEndContainer(nsIDOMNode** aEndParent)
 {
@@ -918,6 +983,17 @@ nsRange::GetEndContainer(nsIDOMNode** aEndParent)
   return CallQueryInterface(mEndParent, aEndParent);
 }
 
+nsINode*
+nsRange::GetEndContainer(ErrorResult& aRv) const
+{
+  if (!mIsPositioned) {
+    aRv.Throw(NS_ERROR_NOT_INITIALIZED);
+    return nullptr;
+  }
+
+  return mEndParent;
+}
+
 NS_IMETHODIMP
 nsRange::GetEndOffset(int32_t* aEndOffset)
 {
@@ -929,6 +1005,17 @@ nsRange::GetEndOffset(int32_t* aEndOffset)
   return NS_OK;
 }
 
+uint32_t
+nsRange::GetEndOffset(ErrorResult& aRv) const
+{
+  if (!mIsPositioned) {
+    aRv.Throw(NS_ERROR_NOT_INITIALIZED);
+    return 0;
+  }
+
+  return mEndOffset;
+}
+
 NS_IMETHODIMP
 nsRange::GetCollapsed(bool* aIsCollapsed)
 {
@@ -940,19 +1027,29 @@ nsRange::GetCollapsed(bool* aIsCollapsed)
   return NS_OK;
 }
 
+nsINode*
+nsRange::GetCommonAncestorContainer(ErrorResult& aRv) const
+{
+  if (!mIsPositioned) {
+    aRv.Throw(NS_ERROR_NOT_INITIALIZED);
+    return nullptr;
+  }
+
+  return nsContentUtils::GetCommonAncestor(mStartParent, mEndParent);
+}
+
 NS_IMETHODIMP
 nsRange::GetCommonAncestorContainer(nsIDOMNode** aCommonParent)
 {
-  *aCommonParent = nullptr;
-  if (!mIsPositioned)
-    return NS_ERROR_NOT_INITIALIZED;
-
-  nsINode* container = nsContentUtils::GetCommonAncestor(mStartParent, mEndParent);
-  if (container) {
-    return CallQueryInterface(container, aCommonParent);
+  ErrorResult rv;
+  nsINode* commonAncestor = GetCommonAncestorContainer(rv);
+  if (commonAncestor) {
+    NS_ADDREF(*aCommonParent = commonAncestor->AsDOMNode());
+  } else {
+    *aCommonParent = nullptr;
   }
 
-  return NS_ERROR_NOT_INITIALIZED;
+  return rv.ErrorCode();
 }
 
 nsINode*
@@ -1003,14 +1100,29 @@ nsRange::IsValidBoundary(nsINode* aNode)
   return root;
 }
 
+void
+nsRange::SetStart(nsINode& aNode, uint32_t aOffset, ErrorResult& aRv)
+{
+ if (!nsContentUtils::CanCallerAccess(&aNode)) {
+    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
+    return;
+  }
+
+  AutoInvalidateSelection atEndOfBlock(this);
+  aRv = SetStart(&aNode, aOffset);
+}
+
 NS_IMETHODIMP
 nsRange::SetStart(nsIDOMNode* aParent, int32_t aOffset)
 {
-  VALIDATE_ACCESS(aParent);
-
   nsCOMPtr<nsINode> parent = do_QueryInterface(aParent);
-  AutoInvalidateSelection atEndOfBlock(this);
-  return SetStart(parent, aOffset);
+  if (!parent) {
+    return NS_ERROR_DOM_NOT_OBJECT_ERR;
+  }
+
+  ErrorResult rv;
+  SetStart(*parent, aOffset, rv);
+  return rv.ErrorCode();
 }
 
 /* virtual */ nsresult
@@ -1038,44 +1150,79 @@ nsRange::SetStart(nsINode* aParent, int32_t aOffset)
   return NS_OK;
 }
 
+void
+nsRange::SetStartBefore(nsINode& aNode, ErrorResult& aRv)
+{
+  if (!nsContentUtils::CanCallerAccess(&aNode)) {
+    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
+    return;
+  }
+
+  AutoInvalidateSelection atEndOfBlock(this);
+  aRv = SetStart(aNode.GetParentNode(), IndexOf(&aNode));
+}
+
 NS_IMETHODIMP
 nsRange::SetStartBefore(nsIDOMNode* aSibling)
 {
-  VALIDATE_ACCESS(aSibling);
-  
-  nsCOMPtr<nsIDOMNode> parent;
-  nsresult rv = aSibling->GetParentNode(getter_AddRefs(parent));
-  if (NS_FAILED(rv) || !parent) {
-    return NS_ERROR_DOM_INVALID_NODE_TYPE_ERR;
+  nsCOMPtr<nsINode> sibling = do_QueryInterface(aSibling);
+  if (!sibling) {
+    return NS_ERROR_DOM_NOT_OBJECT_ERR;
   }
 
-  return SetStart(parent, IndexOf(aSibling));
+  ErrorResult rv;
+  SetStartBefore(*sibling, rv);
+  return rv.ErrorCode();
+}
+
+void
+nsRange::SetStartAfter(nsINode& aNode, ErrorResult& aRv)
+{
+  if (!nsContentUtils::CanCallerAccess(&aNode)) {
+    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
+    return;
+  }
+
+  AutoInvalidateSelection atEndOfBlock(this);
+  aRv = SetStart(aNode.GetParentNode(), IndexOf(&aNode) + 1);
 }
 
 NS_IMETHODIMP
 nsRange::SetStartAfter(nsIDOMNode* aSibling)
 {
-  VALIDATE_ACCESS(aSibling);
-
-  nsCOMPtr<nsIDOMNode> nParent;
-  nsresult res = aSibling->GetParentNode(getter_AddRefs(nParent));
-  if (NS_FAILED(res) || !nParent) {
-    return NS_ERROR_DOM_INVALID_NODE_TYPE_ERR;
+  nsCOMPtr<nsINode> sibling = do_QueryInterface(aSibling);
+  if (!sibling) {
+    return NS_ERROR_DOM_NOT_OBJECT_ERR;
   }
 
-  return SetStart(nParent, IndexOf(aSibling) + 1);
+  ErrorResult rv;
+  SetStartAfter(*sibling, rv);
+  return rv.ErrorCode();
+}
+
+void
+nsRange::SetEnd(nsINode& aNode, uint32_t aOffset, ErrorResult& aRv)
+{
+ if (!nsContentUtils::CanCallerAccess(&aNode)) {
+    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
+    return;
+  }
+  AutoInvalidateSelection atEndOfBlock(this);
+  aRv = SetEnd(&aNode, aOffset);
 }
 
 NS_IMETHODIMP
 nsRange::SetEnd(nsIDOMNode* aParent, int32_t aOffset)
 {
-  VALIDATE_ACCESS(aParent);
-
-  AutoInvalidateSelection atEndOfBlock(this);
   nsCOMPtr<nsINode> parent = do_QueryInterface(aParent);
-  return SetEnd(parent, aOffset);
-}
+  if (!parent) {
+    return NS_ERROR_DOM_NOT_OBJECT_ERR;
+  }
 
+  ErrorResult rv;
+  SetEnd(*parent, aOffset, rv);
+  return rv.ErrorCode();
+}
 
 /* virtual */ nsresult
 nsRange::SetEnd(nsINode* aParent, int32_t aOffset)
@@ -1102,32 +1249,54 @@ nsRange::SetEnd(nsINode* aParent, int32_t aOffset)
   return NS_OK;
 }
 
+void
+nsRange::SetEndBefore(nsINode& aNode, ErrorResult& aRv)
+{
+  if (!nsContentUtils::CanCallerAccess(&aNode)) {
+    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
+    return;
+  }
+
+  AutoInvalidateSelection atEndOfBlock(this);
+  aRv = SetEnd(aNode.GetParentNode(), IndexOf(&aNode));
+}
+
 NS_IMETHODIMP
 nsRange::SetEndBefore(nsIDOMNode* aSibling)
 {
-  VALIDATE_ACCESS(aSibling);
-  
-  nsCOMPtr<nsIDOMNode> nParent;
-  nsresult rv = aSibling->GetParentNode(getter_AddRefs(nParent));
-  if (NS_FAILED(rv) || !nParent) {
-    return NS_ERROR_DOM_INVALID_NODE_TYPE_ERR;
+  nsCOMPtr<nsINode> sibling = do_QueryInterface(aSibling);
+  if (!sibling) {
+    return NS_ERROR_DOM_NOT_OBJECT_ERR;
   }
 
-  return SetEnd(nParent, IndexOf(aSibling));
+  ErrorResult rv;
+  SetEndBefore(*sibling, rv);
+  return rv.ErrorCode();
+}
+
+void
+nsRange::SetEndAfter(nsINode& aNode, ErrorResult& aRv)
+{
+  if (!nsContentUtils::CanCallerAccess(&aNode)) {
+    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
+    return;
+  }
+
+  AutoInvalidateSelection atEndOfBlock(this);
+  aRv = SetEnd(aNode.GetParentNode(), IndexOf(&aNode) + 1);
 }
 
 NS_IMETHODIMP
 nsRange::SetEndAfter(nsIDOMNode* aSibling)
 {
-  VALIDATE_ACCESS(aSibling);
-  
-  nsCOMPtr<nsIDOMNode> nParent;
-  nsresult res = aSibling->GetParentNode(getter_AddRefs(nParent));
-  if (NS_FAILED(res) || !nParent) {
-    return NS_ERROR_DOM_INVALID_NODE_TYPE_ERR;
+  nsCOMPtr<nsINode> sibling = do_QueryInterface(aSibling);
+  if (!sibling) {
+    return NS_ERROR_DOM_NOT_OBJECT_ERR;
   }
 
-  return SetEnd(nParent, IndexOf(aSibling) + 1);
+  ErrorResult rv;
+  SetEndAfter(*sibling, rv);
+  return rv.ErrorCode();
 }
 
 NS_IMETHODIMP
@@ -1148,39 +1317,66 @@ nsRange::Collapse(bool aToStart)
 NS_IMETHODIMP
 nsRange::SelectNode(nsIDOMNode* aN)
 {
-  VALIDATE_ACCESS(aN);
-  
   nsCOMPtr<nsINode> node = do_QueryInterface(aN);
   NS_ENSURE_TRUE(node, NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
 
-  nsINode* parent = node->GetParentNode();
-  nsINode* newRoot = IsValidBoundary(parent);
-  NS_ENSURE_TRUE(newRoot, NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
+  ErrorResult rv;
+  SelectNode(*node, rv);
+  return rv.ErrorCode();
+}
 
-  int32_t index = parent->IndexOf(node);
+void
+nsRange::SelectNode(nsINode& aNode, ErrorResult& aRv)
+{
+  if (!nsContentUtils::CanCallerAccess(&aNode)) {
+    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
+    return;
+  }
+
+  nsINode* parent = aNode.GetParentNode();
+  nsINode* newRoot = IsValidBoundary(parent);
+  if (!newRoot) {
+    aRv.Throw(NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
+    return;
+  }
+
+  int32_t index = parent->IndexOf(&aNode);
   if (index < 0) {
-    return NS_ERROR_DOM_INVALID_NODE_TYPE_ERR;
+    aRv.Throw(NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
+    return;
   }
 
   AutoInvalidateSelection atEndOfBlock(this);
   DoSetRange(parent, index, parent, index + 1, newRoot);
-  
-  return NS_OK;
 }
 
 NS_IMETHODIMP
 nsRange::SelectNodeContents(nsIDOMNode* aN)
 {
-  VALIDATE_ACCESS(aN);
-
   nsCOMPtr<nsINode> node = do_QueryInterface(aN);
-  nsINode* newRoot = IsValidBoundary(node);
-  NS_ENSURE_TRUE(newRoot, NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
-  
+  NS_ENSURE_TRUE(node, NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
+
+  ErrorResult rv;
+  SelectNodeContents(*node, rv);
+  return rv.ErrorCode();
+}
+
+void
+nsRange::SelectNodeContents(nsINode& aNode, ErrorResult& aRv)
+{
+  if (!nsContentUtils::CanCallerAccess(&aNode)) {
+    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
+    return;
+  }
+
+  nsINode* newRoot = IsValidBoundary(&aNode);
+  if (!newRoot) {
+    aRv.Throw(NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
+    return;
+  }
+
   AutoInvalidateSelection atEndOfBlock(this);
-  DoSetRange(node, 0, node, node->Length(), newRoot);
-  
-  return NS_OK;
+  DoSetRange(&aNode, 0, &aNode, aNode.Length(), newRoot);
 }
 
 // The Subtree Content Iterator only returns subtrees that are
@@ -1584,28 +1780,27 @@ ValidateCurrentNode(nsRange* aRange, RangeSubtreeIterator& aIter)
   return NS_SUCCEEDED(res) && !before && !after;
 }
 
-nsresult nsRange::CutContents(nsIDOMDocumentFragment** aFragment)
+nsresult
+nsRange::CutContents(dom::DocumentFragment** aFragment)
 { 
   if (aFragment) {
     *aFragment = nullptr;
   }
 
-  nsresult rv;
-
   nsCOMPtr<nsIDocument> doc = mStartParent->OwnerDoc();
 
   nsCOMPtr<nsIDOMNode> commonAncestor;
-  rv = GetCommonAncestorContainer(getter_AddRefs(commonAncestor));
+  nsresult rv = GetCommonAncestorContainer(getter_AddRefs(commonAncestor));
   NS_ENSURE_SUCCESS(rv, rv);
 
   // If aFragment isn't null, create a temporary fragment to hold our return.
-  nsCOMPtr<nsIDOMDocumentFragment> retval;
+  nsRefPtr<dom::DocumentFragment> retval;
   if (aFragment) {
-    rv = NS_NewDocumentFragment(getter_AddRefs(retval),
-                                doc->NodeInfoManager());
-    NS_ENSURE_SUCCESS(rv, rv);
+    ErrorResult error;
+    retval = NS_NewDocumentFragment(doc->NodeInfoManager(), error);
+    NS_ENSURE_SUCCESS(error.ErrorCode(), error.ErrorCode());
   }
-  nsCOMPtr<nsIDOMNode> commonCloneAncestor(do_QueryInterface(retval));
+  nsCOMPtr<nsIDOMNode> commonCloneAncestor = retval.get();
 
   // Batch possible DOMSubtreeModified events.
   mozAutoSubtreeModified subtree(mRoot ? mRoot->OwnerDoc(): nullptr, nullptr);
@@ -1875,11 +2070,28 @@ nsRange::DeleteContents()
   return CutContents(nullptr);
 }
 
+void
+nsRange::DeleteContents(ErrorResult& aRv)
+{
+  aRv = CutContents(nullptr);
+}
+
 NS_IMETHODIMP
 nsRange::ExtractContents(nsIDOMDocumentFragment** aReturn)
 {
   NS_ENSURE_ARG_POINTER(aReturn);
-  return CutContents(aReturn);
+  nsRefPtr<dom::DocumentFragment> fragment;
+  nsresult rv = CutContents(getter_AddRefs(fragment));
+  fragment.forget(aReturn);
+  return rv;
+}
+
+already_AddRefed<dom::DocumentFragment>
+nsRange::ExtractContents(ErrorResult& rv)
+{
+  nsRefPtr<dom::DocumentFragment> fragment;
+  rv = CutContents(getter_AddRefs(fragment));
+  return fragment.forget();
 }
 
 NS_IMETHODIMP
@@ -1889,8 +2101,19 @@ nsRange::CompareBoundaryPoints(uint16_t aHow, nsIDOMRange* aOtherRange,
   nsRange* otherRange = static_cast<nsRange*>(aOtherRange);
   NS_ENSURE_TRUE(otherRange, NS_ERROR_NULL_POINTER);
 
-  if (!mIsPositioned || !otherRange->IsPositioned())
-    return NS_ERROR_NOT_INITIALIZED;
+  ErrorResult rv;
+  *aCmpRet = CompareBoundaryPoints(aHow, *otherRange, rv);
+  return rv.ErrorCode();
+}
+
+int16_t
+nsRange::CompareBoundaryPoints(uint16_t aHow, nsRange& aOtherRange,
+                               ErrorResult& rv)
+{
+  if (!mIsPositioned || !aOtherRange.IsPositioned()) {
+    rv.Throw(NS_ERROR_NOT_INITIALIZED);
+    return 0;
+  }
 
   nsINode *ourNode, *otherNode;
   int32_t ourOffset, otherOffset;
@@ -1899,39 +2122,40 @@ nsRange::CompareBoundaryPoints(uint16_t aHow, nsIDOMRange* aOtherRange,
     case nsIDOMRange::START_TO_START:
       ourNode = mStartParent;
       ourOffset = mStartOffset;
-      otherNode = otherRange->GetStartParent();
-      otherOffset = otherRange->StartOffset();
+      otherNode = aOtherRange.GetStartParent();
+      otherOffset = aOtherRange.StartOffset();
       break;
     case nsIDOMRange::START_TO_END:
       ourNode = mEndParent;
       ourOffset = mEndOffset;
-      otherNode = otherRange->GetStartParent();
-      otherOffset = otherRange->StartOffset();
+      otherNode = aOtherRange.GetStartParent();
+      otherOffset = aOtherRange.StartOffset();
       break;
     case nsIDOMRange::END_TO_START:
       ourNode = mStartParent;
       ourOffset = mStartOffset;
-      otherNode = otherRange->GetEndParent();
-      otherOffset = otherRange->EndOffset();
+      otherNode = aOtherRange.GetEndParent();
+      otherOffset = aOtherRange.EndOffset();
       break;
     case nsIDOMRange::END_TO_END:
       ourNode = mEndParent;
       ourOffset = mEndOffset;
-      otherNode = otherRange->GetEndParent();
-      otherOffset = otherRange->EndOffset();
+      otherNode = aOtherRange.GetEndParent();
+      otherOffset = aOtherRange.EndOffset();
       break;
     default:
       // We were passed an illegal value
-      return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
+      rv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+      return 0;
   }
 
-  if (mRoot != otherRange->GetRoot())
-    return NS_ERROR_DOM_WRONG_DOCUMENT_ERR;
+  if (mRoot != aOtherRange.GetRoot()) {
+    rv.Throw(NS_ERROR_DOM_WRONG_DOCUMENT_ERR);
+    return 0;
+  }
 
-  *aCmpRet = nsContentUtils::ComparePoints(ourNode, ourOffset,
-                                           otherNode, otherOffset);
-
-  return NS_OK;
+  return nsContentUtils::ComparePoints(ourNode, ourOffset,
+                                       otherNode, otherOffset);
 }
 
 /* static */ nsresult
@@ -1988,45 +2212,58 @@ nsRange::CloneParentsBetween(nsIDOMNode *aAncestor,
 NS_IMETHODIMP
 nsRange::CloneContents(nsIDOMDocumentFragment** aReturn)
 {
-  nsresult res;
+  ErrorResult rv;
+  *aReturn = CloneContents(rv).get();
+  return rv.ErrorCode();
+}
+
+already_AddRefed<dom::DocumentFragment>
+nsRange::CloneContents(ErrorResult& aRv)
+{
   nsCOMPtr<nsIDOMNode> commonAncestor;
-  res = GetCommonAncestorContainer(getter_AddRefs(commonAncestor));
-  if (NS_FAILED(res)) return res;
+  aRv = GetCommonAncestorContainer(getter_AddRefs(commonAncestor));
+  MOZ_ASSERT(!aRv.Failed(), "GetCommonAncestorContainer() shouldn't fail!");
 
   nsCOMPtr<nsIDOMDocument> document =
     do_QueryInterface(mStartParent->OwnerDoc());
   NS_ASSERTION(document, "CloneContents needs a document to continue.");
-  if (!document) return NS_ERROR_FAILURE;
+  if (!document) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return nullptr;
+  }
 
   // Create a new document fragment in the context of this document,
   // which might be null
 
-  nsCOMPtr<nsIDOMDocumentFragment> clonedFrag;
 
   nsCOMPtr<nsIDocument> doc(do_QueryInterface(document));
 
-  res = NS_NewDocumentFragment(getter_AddRefs(clonedFrag),
-                               doc->NodeInfoManager());
-  if (NS_FAILED(res)) return res;
+  nsRefPtr<dom::DocumentFragment> clonedFrag =
+    NS_NewDocumentFragment(doc->NodeInfoManager(), aRv);
+  if (aRv.Failed()) {
+    return nullptr;
+  }
 
-  nsCOMPtr<nsIDOMNode> commonCloneAncestor(do_QueryInterface(clonedFrag));
-  if (!commonCloneAncestor) return NS_ERROR_FAILURE;
+  nsCOMPtr<nsIDOMNode> commonCloneAncestor = clonedFrag.get();
+  if (!commonCloneAncestor) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return nullptr;
+  }
 
   // Create and initialize a subtree iterator that will give
   // us all the subtrees within the range.
 
   RangeSubtreeIterator iter;
 
-  res = iter.Init(this);
-  if (NS_FAILED(res)) return res;
+  aRv = iter.Init(this);
+  if (aRv.Failed()) {
+    return nullptr;
+  }
 
   if (iter.IsDone())
   {
     // There's nothing to add to the doc frag, we must be done!
-
-    *aReturn = clonedFrag;
-    NS_IF_ADDREF(*aReturn);
-    return NS_OK;
+    return clonedFrag.forget();
   }
 
   iter.First();
@@ -2054,8 +2291,10 @@ nsRange::CloneContents(nsIDOMDocumentFragment** aReturn)
     // Clone the current subtree!
 
     nsCOMPtr<nsIDOMNode> clone;
-    res = node->CloneNode(deepClone, 1, getter_AddRefs(clone));
-    if (NS_FAILED(res)) return res;
+    aRv = node->CloneNode(deepClone, 1, getter_AddRefs(clone));
+    if (aRv.Failed()) {
+      return nullptr;
+    }
 
     // If it's CharacterData, make sure we only clone what
     // is in the range.
@@ -2073,13 +2312,17 @@ nsRange::CloneContents(nsIDOMDocumentFragment** aReturn)
         // data after it.
 
         uint32_t dataLength = 0;
-        res = charData->GetLength(&dataLength);
-        if (NS_FAILED(res)) return res;
+        aRv = charData->GetLength(&dataLength);
+        if (aRv.Failed()) {
+          return nullptr;
+        }
 
         if (dataLength > (uint32_t)mEndOffset)
         {
-          res = charData->DeleteData(mEndOffset, dataLength - mEndOffset);
-          if (NS_FAILED(res)) return res;
+          aRv = charData->DeleteData(mEndOffset, dataLength - mEndOffset);
+          if (aRv.Failed()) {
+            return nullptr;
+          }
         }
       }       
 
@@ -2090,8 +2333,10 @@ nsRange::CloneContents(nsIDOMDocumentFragment** aReturn)
 
         if (mStartOffset > 0)
         {
-          res = charData->DeleteData(0, mStartOffset);
-          if (NS_FAILED(res)) return res;
+          aRv = charData->DeleteData(0, mStartOffset);
+          if (aRv.Failed()) {
+            return nullptr;
+          }
         }
       }
     }
@@ -2100,11 +2345,13 @@ nsRange::CloneContents(nsIDOMDocumentFragment** aReturn)
 
     nsCOMPtr<nsIDOMNode> closestAncestor, farthestAncestor;
 
-    res = CloneParentsBetween(commonAncestor, node,
+    aRv = CloneParentsBetween(commonAncestor, node,
                               getter_AddRefs(closestAncestor),
                               getter_AddRefs(farthestAncestor));
 
-    if (NS_FAILED(res)) return res;
+    if (aRv.Failed()) {
+      return nullptr;
+    }
 
     // Hook the parent hierarchy/context of the subtree into the clone tree.
 
@@ -2112,10 +2359,12 @@ nsRange::CloneContents(nsIDOMDocumentFragment** aReturn)
 
     if (farthestAncestor)
     {
-      res = commonCloneAncestor->AppendChild(farthestAncestor,
+      aRv = commonCloneAncestor->AppendChild(farthestAncestor,
                                              getter_AddRefs(tmpNode));
 
-      if (NS_FAILED(res)) return res;
+      if (aRv.Failed()) {
+        return nullptr;
+      }
     }
 
     // Place the cloned subtree into the cloned doc frag tree!
@@ -2125,16 +2374,18 @@ nsRange::CloneContents(nsIDOMDocumentFragment** aReturn)
       // Append the subtree under closestAncestor since it is the
       // immediate parent of the subtree.
 
-      res = closestAncestor->AppendChild(clone, getter_AddRefs(tmpNode));
+      aRv = closestAncestor->AppendChild(clone, getter_AddRefs(tmpNode));
     }
     else
     {
       // If we get here, there is no missing parent hierarchy between 
       // commonAncestor and node, so just append clone to commonCloneAncestor.
 
-      res = commonCloneAncestor->AppendChild(clone, getter_AddRefs(tmpNode));
+      aRv = commonCloneAncestor->AppendChild(clone, getter_AddRefs(tmpNode));
+    }
+    if (aRv.Failed()) {
+      return nullptr;
     }
-    if (NS_FAILED(res)) return res;
 
     // Get the next subtree to be processed. The idea here is to setup
     // the parameters for the next iteration of the loop.
@@ -2145,42 +2396,56 @@ nsRange::CloneContents(nsIDOMDocumentFragment** aReturn)
       break; // We must be done!
 
     nsCOMPtr<nsIDOMNode> nextNode(iter.GetCurrentNode());
-    if (!nextNode) return NS_ERROR_FAILURE;
+    if (!nextNode) {
+      aRv.Throw(NS_ERROR_FAILURE);
+      return nullptr;
+    }
 
     // Get node and nextNode's common parent.
     nsContentUtils::GetCommonAncestor(node, nextNode, getter_AddRefs(commonAncestor));
 
-    if (!commonAncestor)
-      return NS_ERROR_FAILURE;
+    if (!commonAncestor) {
+      aRv.Throw(NS_ERROR_FAILURE);
+      return nullptr;
+    }
 
     // Find the equivalent of commonAncestor in the cloned tree!
 
     while (node && node != commonAncestor)
     {
       tmpNode = node;
-      res = tmpNode->GetParentNode(getter_AddRefs(node));
-      if (NS_FAILED(res)) return res;
-      if (!node) return NS_ERROR_FAILURE;
+      aRv = tmpNode->GetParentNode(getter_AddRefs(node));
+      if (aRv.Failed()) {
+        return nullptr;
+      }
+
+      if (!node) {
+        aRv.Throw(NS_ERROR_FAILURE);
+        return nullptr;
+      }
 
       tmpNode = clone;
-      res = tmpNode->GetParentNode(getter_AddRefs(clone));
-      if (NS_FAILED(res)) return res;
-      if (!clone) return NS_ERROR_FAILURE;
+      aRv = tmpNode->GetParentNode(getter_AddRefs(clone));
+      if (aRv.Failed()) {
+        return nullptr;
+      }
+
+      if (!clone) {
+        aRv.Throw(NS_ERROR_FAILURE);
+        return nullptr;
+      }
     }
 
     commonCloneAncestor = clone;
   }
 
-  *aReturn = clonedFrag;
-  NS_IF_ADDREF(*aReturn);
-
-  return NS_OK;
+  return clonedFrag.forget();
 }
 
 already_AddRefed<nsRange>
 nsRange::CloneRange() const
 {
-  nsRefPtr<nsRange> range = new nsRange();
+  nsRefPtr<nsRange> range = new nsRange(mOwner);
 
   range->SetMaySpanAnonymousSubtrees(mMaySpanAnonymousSubtrees);
 
@@ -2199,15 +2464,31 @@ nsRange::CloneRange(nsIDOMRange** aReturn)
 NS_IMETHODIMP
 nsRange::InsertNode(nsIDOMNode* aNode)
 {
-  VALIDATE_ACCESS(aNode);
-  
-  nsresult res;
-  int32_t tStartOffset;
-  this->GetStartOffset(&tStartOffset);
+  nsCOMPtr<nsINode> node = do_QueryInterface(aNode);
+  if (!node) {
+    return NS_ERROR_DOM_NOT_OBJECT_ERR;
+  }
+
+  ErrorResult rv;
+  InsertNode(*node, rv);
+  return rv.ErrorCode();
+}
+
+void
+nsRange::InsertNode(nsINode& aNode, ErrorResult& aRv)
+{
+  if (!nsContentUtils::CanCallerAccess(&aNode)) {
+    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
+    return;
+  }
+
+  int32_t tStartOffset = StartOffset();
 
   nsCOMPtr<nsIDOMNode> tStartContainer;
-  res = this->GetStartContainer(getter_AddRefs(tStartContainer));
-  NS_ENSURE_SUCCESS(res, res);
+  aRv = this->GetStartContainer(getter_AddRefs(tStartContainer));
+  if (aRv.Failed()) {
+    return;
+  }
 
   // This is the node we'll be inserting before, and its parent
   nsCOMPtr<nsIDOMNode> referenceNode;
@@ -2216,22 +2497,34 @@ nsRange::InsertNode(nsIDOMNode* aNode)
   nsCOMPtr<nsIDOMText> startTextNode(do_QueryInterface(tStartContainer));
   nsCOMPtr<nsIDOMNodeList> tChildList;
   if (startTextNode) {
-    res = tStartContainer->GetParentNode(getter_AddRefs(referenceParentNode));
-    NS_ENSURE_SUCCESS(res, res);
-    NS_ENSURE_TRUE(referenceParentNode, NS_ERROR_DOM_HIERARCHY_REQUEST_ERR);
+    aRv = tStartContainer->GetParentNode(getter_AddRefs(referenceParentNode));
+    if (aRv.Failed()) {
+      return;
+    }
+
+    if (!referenceParentNode) {
+      aRv.Throw(NS_ERROR_DOM_HIERARCHY_REQUEST_ERR);
+      return;
+    }
 
     nsCOMPtr<nsIDOMText> secondPart;
-    res = startTextNode->SplitText(tStartOffset, getter_AddRefs(secondPart));
-    NS_ENSURE_SUCCESS(res, res);
+    aRv = startTextNode->SplitText(tStartOffset, getter_AddRefs(secondPart));
+    if (aRv.Failed()) {
+      return;
+    }
 
     referenceNode = secondPart;
   } else {
-    res = tStartContainer->GetChildNodes(getter_AddRefs(tChildList));
-    NS_ENSURE_SUCCESS(res, res);
+    aRv = tStartContainer->GetChildNodes(getter_AddRefs(tChildList));
+    if (aRv.Failed()) {
+      return;
+    }
 
     // find the insertion point in the DOM and insert the Node
-    res = tChildList->Item(tStartOffset, getter_AddRefs(referenceNode));
-    NS_ENSURE_SUCCESS(res, res);
+    aRv = tChildList->Item(tStartOffset, getter_AddRefs(referenceNode));
+    if (aRv.Failed()) {
+      return;
+    }
   }
 
   // We might need to update the end to include the new node (bug 433662).
@@ -2243,36 +2536,61 @@ nsRange::InsertNode(nsIDOMNode* aNode)
     newOffset = IndexOf(referenceNode);
   } else {
     uint32_t length;
-    res = tChildList->GetLength(&length);
-    NS_ENSURE_SUCCESS(res, res);
+    aRv = tChildList->GetLength(&length);
+    if (aRv.Failed()) {
+      return;
+    }
+
     newOffset = length;
   }
 
-  nsCOMPtr<nsINode> node = do_QueryInterface(aNode);
-  NS_ENSURE_STATE(node);
-  if (node->NodeType() == nsIDOMNode::DOCUMENT_FRAGMENT_NODE) {
-    newOffset += node->GetChildCount();
+  if (aNode.NodeType() == nsIDOMNode::DOCUMENT_FRAGMENT_NODE) {
+    newOffset += aNode.GetChildCount();
   } else {
     newOffset++;
   }
 
   // Now actually insert the node
   nsCOMPtr<nsIDOMNode> tResultNode;
-  res = referenceParentNode->InsertBefore(aNode, referenceNode, getter_AddRefs(tResultNode));
-  NS_ENSURE_SUCCESS(res, res);
+  nsCOMPtr<nsIDOMNode> node = aNode.AsDOMNode();
+  if (!node) {
+    aRv.Throw(NS_ERROR_DOM_NOT_OBJECT_ERR);
+    return;
+  }
+  aRv = referenceParentNode->InsertBefore(node, referenceNode, getter_AddRefs(tResultNode));
+  if (aRv.Failed()) {
+    return;
+  }
 
   if (Collapsed()) {
-    return SetEnd(referenceParentNode, newOffset);
+    aRv = SetEnd(referenceParentNode, newOffset);
   }
-  return NS_OK;
 }
 
 NS_IMETHODIMP
 nsRange::SurroundContents(nsIDOMNode* aNewParent)
 {
-  VALIDATE_ACCESS(aNewParent);
+  nsCOMPtr<nsINode> node = do_QueryInterface(aNewParent);
+  if (!node) {
+    return NS_ERROR_DOM_NOT_OBJECT_ERR;
+  }
+  ErrorResult rv;
+  SurroundContents(*node, rv);
+  return rv.ErrorCode();
+}
 
-  NS_ENSURE_TRUE(mRoot, NS_ERROR_DOM_INVALID_STATE_ERR);
+void
+nsRange::SurroundContents(nsINode& aNewParent, ErrorResult& aRv)
+{
+  if (!nsContentUtils::CanCallerAccess(&aNewParent)) {
+    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
+    return;
+  }
+
+  if (!mRoot) {
+    aRv.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
+    return;
+  }
   // INVALID_STATE_ERROR: Raised if the Range partially selects a non-text
   // node.
   if (mStartParent != mEndParent) {
@@ -2280,78 +2598,88 @@ nsRange::SurroundContents(nsIDOMNode* aNewParent)
     bool endIsText = mEndParent->IsNodeOfType(nsINode::eTEXT);
     nsINode* startGrandParent = mStartParent->GetParentNode();
     nsINode* endGrandParent = mEndParent->GetParentNode();
-    NS_ENSURE_TRUE((startIsText && endIsText &&
-                    startGrandParent &&
-                    startGrandParent == endGrandParent) ||
-                   (startIsText &&
-                    startGrandParent &&
-                    startGrandParent == mEndParent) ||
-                   (endIsText &&
-                    endGrandParent &&
-                    endGrandParent == mStartParent),
-                   NS_ERROR_DOM_INVALID_STATE_ERR);
+    if (!((startIsText && endIsText &&
+           startGrandParent &&
+           startGrandParent == endGrandParent) ||
+          (startIsText &&
+           startGrandParent &&
+           startGrandParent == mEndParent) ||
+          (endIsText &&
+           endGrandParent &&
+           endGrandParent == mStartParent))) {
+      aRv.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
+      return;
+    }
   }
 
   // INVALID_NODE_TYPE_ERROR if aNewParent is something that can't be inserted
   // (Document, DocumentType, DocumentFragment)
-  uint16_t nodeType;
-  nsresult res = aNewParent->GetNodeType(&nodeType);
-  if (NS_FAILED(res)) return res;
+  uint16_t nodeType = aNewParent.NodeType();
   if (nodeType == nsIDOMNode::DOCUMENT_NODE ||
       nodeType == nsIDOMNode::DOCUMENT_TYPE_NODE ||
       nodeType == nsIDOMNode::DOCUMENT_FRAGMENT_NODE) {
-    return NS_ERROR_DOM_INVALID_NODE_TYPE_ERR;
+    aRv.Throw(NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
+    return;
   }
 
   // Extract the contents within the range.
 
   nsCOMPtr<nsIDOMDocumentFragment> docFrag;
 
-  res = ExtractContents(getter_AddRefs(docFrag));
+  aRv = ExtractContents(getter_AddRefs(docFrag));
 
-  if (NS_FAILED(res)) return res;
-  if (!docFrag) return NS_ERROR_FAILURE;
+  if (aRv.Failed()) {
+    return;
+  }
+
+  if (!docFrag) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return;
+  }
 
   // Spec says we need to remove all of aNewParent's
   // children prior to insertion.
 
-  nsCOMPtr<nsIDOMNodeList> children;
-  res = aNewParent->GetChildNodes(getter_AddRefs(children));
+  nsCOMPtr<nsINodeList> children = aNewParent.ChildNodes();
+  if (!children) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return;
+  }
 
-  if (NS_FAILED(res)) return res;
-  if (!children) return NS_ERROR_FAILURE;
-
-  uint32_t numChildren = 0;
-  res = children->GetLength(&numChildren);
-  if (NS_FAILED(res)) return res;
+  uint32_t numChildren = children->Length();
 
   nsCOMPtr<nsIDOMNode> tmpNode;
 
   while (numChildren)
   {
-    nsCOMPtr<nsIDOMNode> child;
-    res = children->Item(--numChildren, getter_AddRefs(child));
+    nsCOMPtr<nsINode> child = children->Item(--numChildren);
+    if (!child) {
+      aRv.Throw(NS_ERROR_FAILURE);
+      return;
+    }
 
-    if (NS_FAILED(res)) return res;
-    if (!child) return NS_ERROR_FAILURE;
-
-    res = aNewParent->RemoveChild(child, getter_AddRefs(tmpNode));
-    if (NS_FAILED(res)) return res;
+    aNewParent.RemoveChild(*child, aRv);
+    if (aRv.Failed()) {
+      return;
+    }
   }
 
   // Insert aNewParent at the range's start point.
 
-  res = InsertNode(aNewParent);
-  if (NS_FAILED(res)) return res;
+  InsertNode(aNewParent, aRv);
+  if (aRv.Failed()) {
+    return;
+  }
 
   // Append the content we extracted under aNewParent.
-
-  res = aNewParent->AppendChild(docFrag, getter_AddRefs(tmpNode));
-  if (NS_FAILED(res)) return res;
+  aRv = aNewParent.AsDOMNode()->AppendChild(docFrag, getter_AddRefs(tmpNode));
+  if (aRv.Failed()) {
+    return;
+  }
 
   // Select aNewParent, and its contents.
 
-  return SelectNode(aNewParent);
+  SelectNode(aNewParent, aRv);
 }
 
 NS_IMETHODIMP
@@ -2462,6 +2790,18 @@ nsRange::CreateContextualFragment(const nsAString& aFragment,
   return NS_ERROR_FAILURE;
 }
 
+already_AddRefed<dom::DocumentFragment>
+nsRange::CreateContextualFragment(const nsAString& aFragment, ErrorResult& aRv)
+{
+  if (!mIsPositioned) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return nullptr;
+  }
+
+  return nsContentUtils::CreateContextualFragment(mStartParent, aFragment,
+                                                  false, aRv);
+}
+
 static void ExtractRectFromOffset(nsIFrame* aFrame,
                                   const nsIFrame* aRelativeTo, 
                                   const int32_t aOffset, nsRect* aR, bool aKeepLeft)
@@ -2594,51 +2934,54 @@ static void CollectClientRects(nsLayoutUtils::RectCallback* aCollector,
 NS_IMETHODIMP
 nsRange::GetBoundingClientRect(nsIDOMClientRect** aResult)
 {
-  *aResult = nullptr;
-
-  // Weak ref, since we addref it below
-  nsClientRect* rect = new nsClientRect();
-  if (!rect)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aResult = rect);
+  *aResult = GetBoundingClientRect().get();
+  return NS_OK;
+}
 
+already_AddRefed<nsIDOMClientRect>
+nsRange::GetBoundingClientRect()
+{
+  nsRefPtr<nsClientRect> rect = new nsClientRect();
   if (!mStartParent)
-    return NS_OK;
+    return rect.forget();
 
   nsLayoutUtils::RectAccumulator accumulator;
-  
   CollectClientRects(&accumulator, this, mStartParent, mStartOffset, 
     mEndParent, mEndOffset);
 
   nsRect r = accumulator.mResultRect.IsEmpty() ? accumulator.mFirstRect : 
     accumulator.mResultRect;
   rect->SetLayoutRect(r);
-  return NS_OK;
+  return rect.forget();
 }
 
 NS_IMETHODIMP
 nsRange::GetClientRects(nsIDOMClientRectList** aResult)
 {
-  *aResult = nullptr;
+  ErrorResult rv;
+  *aResult = GetClientRects(rv).get();
+  return rv.ErrorCode();
+}
 
+already_AddRefed<nsClientRectList>
+nsRange::GetClientRects(ErrorResult& rv)
+{
   if (!mStartParent)
-    return NS_OK;
+    return nullptr;
 
   nsRefPtr<nsClientRectList> rectList =
     new nsClientRectList(static_cast<nsIDOMRange*>(this));
-  if (!rectList)
-    return NS_ERROR_OUT_OF_MEMORY;
 
   nsLayoutUtils::RectListBuilder builder(rectList);
 
   CollectClientRects(&builder, this, mStartParent, mStartOffset, 
     mEndParent, mEndOffset);
 
-  if (NS_FAILED(builder.mRV))
-    return builder.mRV;
-  rectList.forget(aResult);
-  return NS_OK;
+  if (NS_FAILED(builder.mRV)) {
+    rv.Throw(builder.mRV);
+    return nullptr;
+  }
+  return rectList.forget();
 }
 
 NS_IMETHODIMP
diff --git a/content/base/src/nsRange.h b/content/base/src/nsRange.h
index 7a84e41c5abf..5e7e8babfc2c 100644
--- a/content/base/src/nsRange.h
+++ b/content/base/src/nsRange.h
@@ -12,17 +12,32 @@
 
 #include "nsIDOMRange.h"
 #include "nsCOMPtr.h"
-#include "nsIDOMDocumentFragment.h"
 #include "nsINode.h"
+#include "nsIDocument.h"
 #include "nsIDOMNode.h"
 #include "prmon.h"
 #include "nsStubMutationObserver.h"
+#include "nsWrapperCache.h"
+#include "mozilla/Attributes.h"
 
-class nsRange : public nsIDOMRange,
-                public nsStubMutationObserver
+class nsClientRectList;
+class nsIDOMDocumentFragment;
+
+namespace mozilla {
+class ErrorResult;
+namespace dom {
+class DocumentFragment;
+}
+}
+
+class nsRange MOZ_FINAL : public nsIDOMRange,
+                          public nsStubMutationObserver,
+                          public nsWrapperCache
 {
+  typedef mozilla::ErrorResult ErrorResult;
+
 public:
-  nsRange()
+  nsRange(nsINode* aNode)
     : mRoot(nullptr)
     , mStartOffset(0)
     , mEndOffset(0)
@@ -36,7 +51,11 @@ public:
     , mAssertNextInsertOrAppendIndex(-1)
     , mAssertNextInsertOrAppendNode(nullptr)
 #endif
-  {}
+  {
+    SetIsDOMBinding();
+    MOZ_ASSERT(aNode, "range isn't in a document!");
+    mOwner = aNode->OwnerDoc();
+  }
   virtual ~nsRange();
 
   static nsresult CreateRange(nsIDOMNode* aStartParent, int32_t aStartOffset,
@@ -47,7 +66,7 @@ public:
                               nsIDOMRange** aRange);
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
-  NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsRange, nsIDOMRange)
+  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_AMBIGUOUS(nsRange, nsIDOMRange)
 
   // nsIDOMRange interface
   NS_DECL_NSIDOMRANGE
@@ -82,12 +101,6 @@ public:
     return mIsPositioned;
   }
 
-  bool Collapsed() const
-  {
-    return mIsPositioned && mStartParent == mEndParent &&
-           mStartOffset == mEndOffset;
-  }
-
   void SetMaySpanAnonymousSubtrees(bool aMaySpanAnonymousSubtrees)
   {
     mMaySpanAnonymousSubtrees = aMaySpanAnonymousSubtrees;
@@ -146,6 +159,45 @@ public:
   NS_DECL_NSIMUTATIONOBSERVER_PARENTCHAINCHANGED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTAPPENDED
 
+  // WebIDL
+  bool Collapsed() const
+  {
+    return mIsPositioned && mStartParent == mEndParent &&
+           mStartOffset == mEndOffset;
+  }
+  already_AddRefed<mozilla::dom::DocumentFragment>
+  CreateContextualFragment(const nsAString& aString, ErrorResult& aError);
+  already_AddRefed<mozilla::dom::DocumentFragment>
+  CloneContents(ErrorResult& aErr);
+  int16_t CompareBoundaryPoints(uint16_t aHow, nsRange& aOther,
+                                ErrorResult& aErr);
+  int16_t ComparePoint(nsINode& aParent, uint32_t aOffset, ErrorResult& aErr);
+  void DeleteContents(ErrorResult& aRv);
+  already_AddRefed<mozilla::dom::DocumentFragment>
+    ExtractContents(ErrorResult& aErr);
+  nsINode* GetCommonAncestorContainer(ErrorResult& aRv) const;
+  nsINode* GetStartContainer(ErrorResult& aRv) const;
+  uint32_t GetStartOffset(ErrorResult& aRv) const;
+  nsINode* GetEndContainer(ErrorResult& aRv) const;
+  uint32_t GetEndOffset(ErrorResult& aRv) const;
+  void InsertNode(nsINode& aNode, ErrorResult& aErr);
+  bool IntersectsNode(nsINode& aNode, ErrorResult& aRv);
+  bool IsPointInRange(nsINode& aParent, uint32_t aOffset, ErrorResult& aErr);
+  void SelectNode(nsINode& aNode, ErrorResult& aErr);
+  void SelectNodeContents(nsINode& aNode, ErrorResult& aErr);
+  void SetEnd(nsINode& aNode, uint32_t aOffset, ErrorResult& aErr);
+  void SetEndAfter(nsINode& aNode, ErrorResult& aErr);
+  void SetEndBefore(nsINode& aNode, ErrorResult& aErr);
+  void SetStart(nsINode& aNode, uint32_t aOffset, ErrorResult& aErr);
+  void SetStartAfter(nsINode& aNode, ErrorResult& aErr);
+  void SetStartBefore(nsINode& aNode, ErrorResult& aErr);
+  void SurroundContents(nsINode& aNode, ErrorResult& aErr);
+  already_AddRefed<nsIDOMClientRect> GetBoundingClientRect();
+  already_AddRefed<nsClientRectList> GetClientRects(ErrorResult& aErr);
+
+  nsINode* GetParentObject() const { return mOwner; }
+  virtual JSObject* WrapObject(JSContext* cx, JSObject* scope) MOZ_OVERRIDE MOZ_FINAL;
+
 private:
   // no copy's or assigns
   nsRange(const nsRange&);
@@ -157,7 +209,7 @@ private:
    * @param aFragment nsIDOMDocumentFragment containing the nodes.
    *                  May be null to indicate the caller doesn't want a fragment.
    */
-  nsresult CutContents(nsIDOMDocumentFragment** frag);
+  nsresult CutContents(mozilla::dom::DocumentFragment** frag);
 
   static nsresult CloneParentsBetween(nsIDOMNode *aAncestor,
                                       nsIDOMNode *aNode,
@@ -224,7 +276,8 @@ protected:
 #endif
     static bool mIsNested;
   };
-  
+
+  nsCOMPtr<nsIDocument> mOwner;
   nsCOMPtr<nsINode> mRoot;
   nsCOMPtr<nsINode> mStartParent;
   nsCOMPtr<nsINode> mEndParent;
diff --git a/content/base/src/nsTextNode.cpp b/content/base/src/nsTextNode.cpp
index d39054f13d1f..037e0f0262cf 100644
--- a/content/base/src/nsTextNode.cpp
+++ b/content/base/src/nsTextNode.cpp
@@ -121,9 +121,9 @@ NS_IMPL_ISUPPORTS_INHERITED3(nsTextNode, nsGenericDOMDataNode, nsIDOMNode,
                              nsIDOMText, nsIDOMCharacterData)
 
 JSObject*
-nsTextNode::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+nsTextNode::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return TextBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return TextBinding::Wrap(aCx, aScope, this);
 }
 
 bool
diff --git a/content/base/src/nsTextNode.h b/content/base/src/nsTextNode.h
index 698d36a4cdd1..41f13d850006 100644
--- a/content/base/src/nsTextNode.h
+++ b/content/base/src/nsTextNode.h
@@ -66,8 +66,7 @@ public:
 #endif
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 };
 
 #endif // nsTextNode_h
diff --git a/content/base/src/nsXMLHttpRequest.h b/content/base/src/nsXMLHttpRequest.h
index 79d5c1e509c2..42a1caac46ae 100644
--- a/content/base/src/nsXMLHttpRequest.h
+++ b/content/base/src/nsXMLHttpRequest.h
@@ -94,10 +94,9 @@ public:
   NS_FORWARD_NSIDOMEVENTTARGET(nsXHREventTarget::)
   NS_DECL_NSIXMLHTTPREQUESTUPLOAD
 
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap)
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE
   {
-    return mozilla::dom::XMLHttpRequestUploadBinding::Wrap(cx, scope, this, triedToWrap);
+    return mozilla::dom::XMLHttpRequestUploadBinding::Wrap(cx, scope, this);
   }
   nsISupports* GetParentObject()
   {
@@ -132,10 +131,9 @@ public:
   nsXMLHttpRequest();
   virtual ~nsXMLHttpRequest();
 
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap)
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE
   {
-    return mozilla::dom::XMLHttpRequestBinding::Wrap(cx, scope, this, triedToWrap);
+    return mozilla::dom::XMLHttpRequestBinding::Wrap(cx, scope, this);
   }
   nsISupports* GetParentObject()
   {
diff --git a/content/base/test/Makefile.in b/content/base/test/Makefile.in
index a9a6fe1b7c53..60f89a5be836 100644
--- a/content/base/test/Makefile.in
+++ b/content/base/test/Makefile.in
@@ -618,6 +618,7 @@ MOCHITEST_FILES_C= \
 		file_bothCSPheaders.html^headers^ \
 		badMessageEvent2.eventsource \
 		badMessageEvent2.eventsource^headers^ \
+		test_object.html \
 		$(NULL)
 
 # OOP tests don't work on Windows (bug 763081) or native-fennec
diff --git a/content/base/test/fake_plugin.tst b/content/base/test/fake_plugin.tst
new file mode 100644
index 000000000000..b3d41aed8d67
--- /dev/null
+++ b/content/base/test/fake_plugin.tst
@@ -0,0 +1 @@
+This is used in test_object.html to test loading by extension (.tst -> application/x-test).
diff --git a/content/base/test/test_object.html b/content/base/test/test_object.html
new file mode 100644
index 000000000000..2f2d545f7323
--- /dev/null
+++ b/content/base/test/test_object.html
@@ -0,0 +1,505 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Plugin instantiation</title>
+    <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+    <script type="application/javascript" src="/tests/SimpleTest/SpecialPowers.js"></script>
+    <meta charset="utf-8">
+  <body onload="onLoad()">
+    <script class="testbody" type="text/javascript;version=1.8">
+
+      "use strict";
+      SimpleTest.waitForExplicitFinish();
+
+      // This can go away once embed also is on WebIDL
+      let OBJLC = Components.interfaces.nsIObjectLoadingContent;
+
+      // Use string modes in this test to make the test easier to read/debug.
+      // nsIObjectLoadingContent refers to this as "type", but I am using "mode"
+      // in the test to avoid confusing with content-type.
+      let prettyModes = {};
+      prettyModes[OBJLC.TYPE_LOADING] = "loading";
+      prettyModes[OBJLC.TYPE_IMAGE] = "image";
+      prettyModes[OBJLC.TYPE_PLUGIN] = "plugin";
+      prettyModes[OBJLC.TYPE_DOCUMENT] = "document";
+      prettyModes[OBJLC.TYPE_NULL] = "none";
+
+      let body = document.body;
+      // A single-pixel white png
+      let testPNG = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAAAAAA6fptVAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAB3RJTUUH3AoIFiETNqbNRQAAAB1pVFh0Q29tbWVudAAAAAAAQ3JlYXRlZCB3aXRoIEdJTVBkLmUHAAAACklEQVQIHWP4DwABAQEANl9ngAAAAABJRU5ErkJggg==';
+      // An empty, but valid, SVG
+      let testSVG = 'data:image/svg+xml,<?xml version="1.0" encoding="UTF-8"?><svg xmlns="http://www.w3.org/2000/svg" width="100" height="100"></svg>';
+      // executeSoon wrapper to count pending callbacks
+      let pendingCalls = 0;
+      let afterPendingCalls = false;
+
+      function runWhenDone(func) {
+        if (!pendingCalls)
+          func();
+        else
+          afterPendingCalls = func;
+      }
+      function runSoon(func) {
+        pendingCalls++;
+        SimpleTest.executeSoon(function() {
+          func();
+          if (--pendingCalls < 1 && afterPendingCalls)
+            afterPendingCalls();
+        });
+      }
+      function src(obj, state, uri) {
+        // If we have a running plugin, src changing should always throw it out,
+        // even if it causes us to load the same plugin again.
+        if (uri && runningPlugin(obj, state)) {
+          if (!state.oldPlugins)
+            state.oldPlugins = [];
+          try {
+            state.oldPlugins.push(obj.getObjectValue());
+          } catch (e) {
+            ok(false, "Running plugin but cannot call getObjectValue?");
+          }
+        }
+
+        var srcattr;
+        if (state.tagName == "object")
+          srcattr = "data";
+        else if (state.tagName == "embed")
+          srcattr = "src";
+        else
+          ok(false, "Internal test fail: Why are we setting the src of an applet");
+
+        // Plugins should always go away immediately on src/data change
+        state.initialPlugin = false;
+        if (uri === null) {
+          removeAttr(obj, srcattr);
+          // TODO Bug 767631 - we don't trigger loadObject on UnsetAttr :(
+          forceReload(obj, state);
+        } else {
+          setAttr(obj, srcattr, uri);
+        }
+      }
+      // We have to be careful not to reach past the nsObjectLoadingContent
+      // prototype to touch generic element attributes, as this will try to
+      // spawn the plugin, breaking our ability to test for that.
+      function getAttr(obj, attr) {
+        return document.body.constructor.prototype.getAttribute.call(obj, attr);
+      }
+      function setAttr(obj, attr, val) {
+        return document.body.constructor.prototype.setAttribute.call(obj, attr, val);
+      }
+      function hasAttr(obj, attr) {
+        return document.body.constructor.prototype.hasAttribute.call(obj, attr);
+      }
+      function removeAttr(obj, attr) {
+        return document.body.constructor.prototype.removeAttribute.call(obj, attr);
+      }
+      function setDisplay(obj, val) {
+        if (val)
+          removeAttr(obj, 'style');
+        else
+          setAttr(obj, 'style', "display none;");
+      }
+      function displayed(obj) {
+        // Hacky, but that's all we use style for.
+        return !hasAttr(obj, 'style');
+      }
+      function actualType(obj, state) {
+        return state.getActualType.call(obj);
+      }
+      function getMode(obj, state) {
+        return prettyModes[state.getDisplayedType.call(obj)];
+      }
+      function runningPlugin(obj, state) {
+        return state.getHasRunningPlugin.call(obj);
+      }
+
+      // TODO this is hacky and might hide some failures, but is needed until
+      // Bug 767635 lands -- which itself will probably mean tweaking this test.
+      function forceReload(obj, state) {
+        let attr;
+        if (state.tagName == "object")
+          attr = "data";
+        else if (state.tagName == "embed")
+          attr = "src";
+
+        if (attr && hasAttr(obj, attr)) {
+          src(obj, state, getAttr(obj, attr));
+        } else if (body.contains(obj)) {
+          body.appendChild(obj);
+        } else {
+          // Out of document nodes without data attributes simply can't be
+          // reloaded currently. Bug 767635
+        }
+      };
+
+      // Make a list of combinations of sub-lists, e.g.:
+      // [ [a, b], [c, d] ]
+      // ->
+      // [ [a, c], [a, d], [b, c], [b, d] ]
+      function eachList() {
+        let all = [];
+        if (!arguments.length)
+          return all;
+        let list = Array.prototype.slice.call(arguments, 0);
+        for (let c of list[0]) {
+          if (list.length > 1) {
+            for (let x of eachList.apply(this,list.slice(1))) {
+              all.push((c.length ? [c] : []).concat(x));
+            }
+          } else if (c.length) {
+            all.push([c]);
+          }
+        }
+        return all;
+      }
+
+      let states = {
+        svg: function(obj, state) {
+          removeAttr(obj, "type");
+          src(obj, state, testSVG);
+          state.noChannel = false;
+          state.expectedType = "image/svg";
+          // SVGs are actually image-like subdocuments
+          state.expectedMode = "document";
+        },
+        image: function(obj, state) {
+          removeAttr(obj, "type");
+          src(obj, state, testPNG);
+          state.noChannel = false;
+          state.expectedMode = "image";
+          state.expectedType = "image/png";
+        },
+        plugin: function(obj, state) {
+          removeAttr(obj, "type");
+          src(obj, state, "data:application/x-test,foo");
+          state.noChannel = false;
+          state.expectedType = "application/x-test";
+          state.expectedMode = "plugin";
+        },
+        pluginExtension: function(obj, state) {
+          src(obj, state, "./fake_plugin.tst");
+          state.expectedMode = "plugin";
+          state.pluginExtension = true;
+          state.noChannel = false;
+        },
+        document: function(obj, state) {
+          removeAttr(obj, "type");
+          src(obj, state, "data:text/plain,I am a document");
+          state.noChannel = false;
+          state.expectedType = "text/plain";
+          state.expectedMode = "document";
+        },
+        fallback: function(obj, state) {
+          removeAttr(obj, "type");
+          state.expectedType = "application/x-unknown";
+          state.expectedMode = "none";
+          state.noChannel = true;
+          src(obj, state, null);
+        },
+        addToDoc: function(obj, state) {
+          body.appendChild(obj);
+        },
+        removeFromDoc: function(obj, state) {
+          if (body.contains(obj))
+            body.removeChild(obj);
+        },
+        // Set the proper type
+        setType: function(obj, state) {
+          if (state.expectedType) {
+            state.badType = false;
+            setAttr(obj, 'type', state.expectedType);
+            forceReload(obj, state);
+          }
+        },
+        // Set an improper type
+        setWrongType: function(obj, state) {
+          // This should break no-channel-plugins but nothing else
+          state.badType = true;
+          setAttr(obj, 'type', "application/x-unknown");
+          forceReload(obj, state);
+        },
+        // Set a plugin type
+        setPluginType: function(obj, state) {
+          // If an object/embed has a type set to a plugin type, it should not
+          // use the channel type.
+          state.badType = false;
+          setAttr(obj, 'type', 'application/x-test');
+          state.expectedType = "application/x-test";
+          state.expectedMode = "plugin";
+          forceReload(obj, state);
+        },
+        noChannel: function(obj, state) {
+          src(obj, state, null);
+          state.noChannel = true;
+          state.pluginExtension = false;
+        },
+        displayNone: function(obj, state) {
+          setDisplay(obj, "none");
+        },
+        displayInherit: function(obj, state) {
+          setDisplay(obj, "inherit");
+        }
+      };
+
+
+      function testObject(obj, state) {
+        // If our test combination both sets noChannel but no explicit type
+        // it shouldn't load ever.
+        let expectedMode = state.expectedMode;
+        let actualMode = getMode(obj, state);
+
+        if (state.noChannel && !getAttr(obj, 'type')) {
+          // Some combinations of test both set no type and no channel. This is
+          // worth testing with the various combinations, but shouldn't load.
+          expectedMode = "none";
+        }
+
+        // Embed tags should always try to load a plugin by type or extension
+        // before falling back to opening a channel. See bug 803159
+        if (state.tagName == "embed" &&
+            (getAttr(obj, 'type') == "application/x-test" || state.pluginExtension)) {
+          state.noChannel = true;
+        }
+
+        // with state.loading, unless we're loading with no channel, these types
+        // should still be in loading state pending a channel.
+        if (state.loading && (expectedMode == "image" || expectedMode == "document" ||
+                             (expectedMode == "plugin" && !state.initialPlugin && !state.noChannel))) {
+          expectedMode = "loading";
+        }
+
+        // With the exception of plugins with a proper type, nothing should
+        // load without a channel
+        if (state.noChannel && (expectedMode != "plugin" || state.badType) &&
+            body.contains(obj)) {
+          expectedMode = "none";
+        }
+
+        // embed tags should reject documents, except for SVG images which
+        // render as such
+        if (state.tagName == "embed" && expectedMode == "document" &&
+            actualType(obj, state) != "image/svg+xml") {
+          expectedMode = "none";
+        }
+
+        // Embeds with a plugin type should skip opening a channel prior to
+        // loading, taking only type into account.
+        if (state.tagName == 'embed' && getAttr(obj, 'type') == 'application/x-test' &&
+            body.contains(obj)) {
+          expectedMode = "plugin";
+        }
+
+        if (!body.contains(obj)
+            && (!state.loading || expectedMode != "image")
+            && (!state.initialPlugin || expectedMode != "plugin")) {
+          // Images are handled by nsIImageLoadingContent so we dont track
+          // their state change as they're detached and reattached. All other
+          // types switch to state "loading", and are completely unloaded
+          expectedMode = "loading";
+        }
+
+        is(actualMode, expectedMode, "check loaded mode");
+
+        // If we're a plugin, check that we spawned successfully
+        // Except for _loading...
+        let shouldSpawn = expectedMode == "plugin" && (!state.loading || state.initialPlugin);
+        let didSpawn = runningPlugin(obj, state);
+        is(didSpawn, !!shouldSpawn, "check plugin spawned is " + !!shouldSpawn);
+
+        // If we are a plugin, scripting should work. If we're not spawned we
+        // should spawn synchronously.
+        if (expectedMode == "plugin") {
+          let scripted = false;
+          try {
+            let x = obj.getObjectValue();
+            scripted = true;
+          } catch(e) {}
+          ok(scripted, "check plugin scriptability");
+        }
+
+        // If this tag previously had other spawned plugins, make sure it
+        // respawned between then and now
+        if (state.oldPlugins && didSpawn) {
+          let didRespawn = false;
+          for (let oldp of state.oldPlugins) {
+            // If this returns false or throws, it's not the same plugin
+            try {
+              didRespawn = !obj.checkObjectValue(oldp);
+            } catch (e) {
+              didRespawn = true;
+            }
+          }
+          is(didRespawn, true, "Plugin should have re-spawned since old state ("+state.oldPlugins.length+")");
+        }
+      }
+
+      let total = 0;
+      let test_modes = {
+        // Just apply from_state then to_state
+        "immediate": function(obj, from_state, to_state, state) {
+          for (let from of from_state)
+            states[from](obj, state);
+          for (let to of to_state)
+            states[to](obj, state);
+
+          // We don't spin the event loop between applying to_state and
+          // running tests, so some types are still loading
+          state.loading = true;
+          info("["+(++total)+"] Testing [ " + from_state + " ] -> [ " + to_state + " ] / " + state.tagName + " / immediate");
+          testObject(obj, state);
+
+          if (body.contains(obj))
+            body.removeChild(obj);
+
+        },
+        // Apply states, spin event loop, run tests.
+        "cycle": function(obj, from_state, to_state, state) {
+          for (let from of from_state)
+            states[from](obj, state);
+          for (let to of to_state)
+            states[to](obj, state);
+          // Because re-appending to the document creates a script blocker, but
+          // plugins spawn asynchronously, we need to return to the event loop
+          // twice to ensure the plugin has been given a chance to lazily spawn.
+          runSoon(function() { runSoon(function() {
+            info("["+(++total)+"] Testing [ " + from_state + " ] -> [ " + to_state + " ] / " + state.tagName + " / cycle");
+            testObject(obj, state);
+
+            if (body.contains(obj))
+              body.removeChild(obj);
+          }); });
+        },
+        // Apply initial state, spin event loop, apply final state, spin event
+        // loop again.
+        "cycleboth": function(obj, from_state, to_state, state) {
+          for (let from of from_state) {
+            states[from](obj, state);
+          }
+          runSoon(function() {
+            for (let to of to_state) {
+              states[to](obj, state);
+            }
+            // Because re-appending to the document creates a script blocker,
+            // but plugins spawn asynchronously, we need to return to the event
+            // loop twice to ensure the plugin has been given a chance to lazily
+            // spawn.
+            runSoon(function() { runSoon(function() {
+              info("["+(++total)+"] Testing [ " + from_state + " ] -> [ " + to_state + " ] / " + state.tagName + " / cycleboth");
+              testObject(obj, state);
+
+              if (body.contains(obj))
+                body.removeChild(obj);
+            }); });
+          });
+        },
+        // Apply initial state, spin event loop, apply later state, test
+        // immediately
+        "cyclefirst": function(obj, from_state, to_state, state) {
+          for (let from of from_state) {
+            states[from](obj, state);
+          }
+          runSoon(function() {
+            state.initialPlugin = runningPlugin(obj, state);
+            for (let to of to_state) {
+              states[to](obj, state);
+            }
+            info("["+(++total)+"] Testing [ " + from_state + " ] -> [ " + to_state + " ] / " + state.tagName + " / cyclefirst");
+            // We don't spin the event loop between applying to_state and
+            // running tests, so some types are still loading
+            state.loading = true;
+            testObject(obj, state);
+
+            if (body.contains(obj))
+              body.removeChild(obj);
+          });
+        },
+      };
+
+      function test(testdat) {
+        for (let from_state of testdat['from_states']) {
+          for (let to_state of testdat['to_states']) {
+            for (let mode of testdat['test_modes']) {
+              for (let type of testdat['tag_types']) {
+                runSoon(function () {
+                  let obj = document.createElement(type);
+                  obj.width = 1; obj.height = 1;
+                  let state = {};
+                  state.noChannel = true;
+                  state.tagName = type;
+                  // Part of the test checks whether a plugin spawned or not,
+                  // but touching the object prototype will attempt to
+                  // synchronously spawn a plugin!  We use this terrible hack to
+                  // get a privileged getter for the attributes we want to touch
+                  // prior to applying any attributes.
+                  // TODO when embed goes away we wont need to check for
+                  //      QueryInterface any longer.
+                  var lookup_on = obj.QueryInterface ? obj.QueryInterface(OBJLC): obj;
+                  state.getDisplayedType = SpecialPowers.do_lookupGetter(lookup_on, 'displayedType');
+                  state.getHasRunningPlugin = SpecialPowers.do_lookupGetter(lookup_on, 'hasRunningPlugin');
+                  state.getActualType = SpecialPowers.do_lookupGetter(lookup_on, 'actualType');
+                  test_modes[mode](obj, from_state, to_state, state);
+                });
+              }
+            }
+          }
+        }
+      }
+
+      function onLoad() {
+        // Generic tests
+        test({
+          'tag_types': [ 'embed', 'object' ],
+          // In all three modes
+          'test_modes': [ 'immediate', 'cycle', 'cyclefirst', 'cycleboth' ],
+          // Starting from a blank tag in and out of the document, a loading
+          // plugin, and no-channel plugin (initial types only really have
+          // odd cases with plugins)
+          'from_states': [
+            [ 'addToDoc' ],
+            [ 'plugin' ],
+            [ 'plugin', 'addToDoc' ],
+            [ 'plugin', 'noChannel', 'setType', 'addToDoc' ],
+            [],
+          ],
+          // To various combinations of loaded objects
+          'to_states': eachList(
+            [ 'svg', 'image', 'plugin', 'document', '' ],
+            [ 'setType', 'setWrongType', 'setPluginType', '' ],
+            [ 'noChannel', '' ],
+            [ 'displayNone', 'displayInherit', '' ]
+          )});
+        // Special case test for embed tags with plugin-by-extension
+        // TODO object tags should be tested here too -- they have slightly
+        //      different behavior, but waiting on a file load requires a loaded
+        //      event handler and wont work with just our event loop spinning.
+        test({
+          'tag_types': [ 'embed' ],
+          'test_modes': [ 'immediate', 'cyclefirst', 'cycle', 'cycleboth' ],
+          'from_states': eachList(
+            [ 'svg', 'plugin', 'image', 'document' ],
+            [ 'addToDoc' ]
+          ),
+          // Set extension along with valid ty
+          'to_states': [
+            [ 'pluginExtension' ]
+          ]});
+        // Test plugin add/remove from document with adding/removing frame, with
+        // and without a channel.
+        test({
+          'tag_types': [ 'embed', 'object' ], // Ideally we'd test object too, but this gets exponentially long.
+          'test_modes': [ 'immediate', 'cyclefirst', 'cycle' ],
+          'from_states': [ [ 'displayNone', 'plugin', 'addToDoc' ],
+                           [ 'displayNone', 'plugin', 'noChannel', 'addToDoc' ],
+                           [ 'plugin', 'noChannel', 'addToDoc' ],
+                           [ 'plugin', 'noChannel' ] ],
+          'to_states': eachList(
+            [ 'displayNone', '' ],
+            [ 'removeFromDoc' ],
+            [ 'image', 'displayNone', '' ],
+            [ 'image', 'displayNone', '' ],
+            [ 'addToDoc' ],
+            [ 'displayInherit' ]
+          )});
+        runWhenDone(function() SimpleTest.finish());
+      }
+    </script>
diff --git a/content/canvas/src/CanvasRenderingContext2D.cpp b/content/canvas/src/CanvasRenderingContext2D.cpp
index 43bd4e069265..044c60d6b89c 100644
--- a/content/canvas/src/CanvasRenderingContext2D.cpp
+++ b/content/canvas/src/CanvasRenderingContext2D.cpp
@@ -569,10 +569,9 @@ CanvasRenderingContext2D::~CanvasRenderingContext2D()
 }
 
 JSObject*
-CanvasRenderingContext2D::WrapObject(JSContext *cx, JSObject *scope,
-                                     bool *triedToWrap)
+CanvasRenderingContext2D::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return CanvasRenderingContext2DBinding::Wrap(cx, scope, this, triedToWrap);
+  return CanvasRenderingContext2DBinding::Wrap(cx, scope, this);
 }
 
 bool
diff --git a/content/canvas/src/CanvasRenderingContext2D.h b/content/canvas/src/CanvasRenderingContext2D.h
index 53cfdc4e9e11..210400b9f25d 100644
--- a/content/canvas/src/CanvasRenderingContext2D.h
+++ b/content/canvas/src/CanvasRenderingContext2D.h
@@ -139,8 +139,7 @@ public:
   CanvasRenderingContext2D();
   virtual ~CanvasRenderingContext2D();
 
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap);
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
   HTMLCanvasElement* GetCanvas() const
   {
diff --git a/content/canvas/src/WebGLBuffer.cpp b/content/canvas/src/WebGLBuffer.cpp
index c7b93b51ee80..f51dd1e5ca26 100644
--- a/content/canvas/src/WebGLBuffer.cpp
+++ b/content/canvas/src/WebGLBuffer.cpp
@@ -56,8 +56,8 @@ WebGLBuffer::ElementArrayCacheBufferSubData(size_t pos, const void* ptr, size_t
 }
 
 JSObject*
-WebGLBuffer::WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap) {
-    return dom::WebGLBufferBinding::Wrap(cx, scope, this, triedToWrap);
+WebGLBuffer::WrapObject(JSContext *cx, JSObject *scope) {
+    return dom::WebGLBufferBinding::Wrap(cx, scope, this);
 }
 
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_0(WebGLBuffer)
diff --git a/content/canvas/src/WebGLBuffer.h b/content/canvas/src/WebGLBuffer.h
index f0b9fa6a8180..c20034ce264b 100644
--- a/content/canvas/src/WebGLBuffer.h
+++ b/content/canvas/src/WebGLBuffer.h
@@ -56,7 +56,7 @@ public:
         return Context();
     }
 
-    virtual JSObject* WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap);
+    virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
     NS_DECL_CYCLE_COLLECTING_ISUPPORTS
     NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(WebGLBuffer)
diff --git a/content/canvas/src/WebGLContext.cpp b/content/canvas/src/WebGLContext.cpp
index 35455eb63321..f35c95be2d35 100644
--- a/content/canvas/src/WebGLContext.cpp
+++ b/content/canvas/src/WebGLContext.cpp
@@ -207,11 +207,9 @@ WebGLContext::~WebGLContext()
 }
 
 JSObject*
-WebGLContext::WrapObject(JSContext *cx, JSObject *scope,
-                         bool *triedToWrap)
+WebGLContext::WrapObject(JSContext *cx, JSObject *scope)
 {
-    return dom::WebGLRenderingContextBinding::Wrap(cx, scope, this,
-                                                   triedToWrap);
+    return dom::WebGLRenderingContextBinding::Wrap(cx, scope, this);
 }
 
 void
diff --git a/content/canvas/src/WebGLContext.h b/content/canvas/src/WebGLContext.h
index cad66fa8b9ab..6d0fb2766c59 100644
--- a/content/canvas/src/WebGLContext.h
+++ b/content/canvas/src/WebGLContext.h
@@ -196,8 +196,7 @@ public:
     NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_AMBIGUOUS(WebGLContext,
                                                            nsIDOMWebGLRenderingContext)
 
-    virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                                 bool *triedToWrap);
+    virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
     NS_DECL_NSIDOMWEBGLRENDERINGCONTEXT
 
diff --git a/content/canvas/src/WebGLExtensions.h b/content/canvas/src/WebGLExtensions.h
index 8e12cd131c79..02fc68a0ec87 100644
--- a/content/canvas/src/WebGLExtensions.h
+++ b/content/canvas/src/WebGLExtensions.h
@@ -28,12 +28,12 @@ public:
 };
 
 #define DECL_WEBGL_EXTENSION_GOOP \
-    JSObject* WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap);
+    JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 #define IMPL_WEBGL_EXTENSION_GOOP(WebGLExtensionType) \
     JSObject* \
-    WebGLExtensionType::WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap) { \
-        return dom::WebGLExtensionType##Binding::Wrap(cx, scope, this, triedToWrap); \
+    WebGLExtensionType::WrapObject(JSContext *cx, JSObject *scope) { \
+        return dom::WebGLExtensionType##Binding::Wrap(cx, scope, this); \
     }
 
 class WebGLExtensionCompressedTextureATC
diff --git a/content/canvas/src/WebGLFramebuffer.cpp b/content/canvas/src/WebGLFramebuffer.cpp
index 0126d82edd29..cb851bcd4e26 100644
--- a/content/canvas/src/WebGLFramebuffer.cpp
+++ b/content/canvas/src/WebGLFramebuffer.cpp
@@ -11,8 +11,8 @@
 using namespace mozilla;
 
 JSObject*
-WebGLFramebuffer::WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap) {
-    return dom::WebGLFramebufferBinding::Wrap(cx, scope, this, triedToWrap);
+WebGLFramebuffer::WrapObject(JSContext *cx, JSObject *scope) {
+    return dom::WebGLFramebufferBinding::Wrap(cx, scope, this);
 }
 
 WebGLFramebuffer::WebGLFramebuffer(WebGLContext *context)
diff --git a/content/canvas/src/WebGLFramebuffer.h b/content/canvas/src/WebGLFramebuffer.h
index e669a5c35c89..c9060ae957d8 100644
--- a/content/canvas/src/WebGLFramebuffer.h
+++ b/content/canvas/src/WebGLFramebuffer.h
@@ -158,7 +158,7 @@ public:
         return Context();
     }
 
-    virtual JSObject* WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap);
+    virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
     NS_DECL_CYCLE_COLLECTING_ISUPPORTS
     NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(WebGLFramebuffer)
diff --git a/content/canvas/src/WebGLProgram.cpp b/content/canvas/src/WebGLProgram.cpp
index c1ba24b07801..2bd59e8fbe83 100644
--- a/content/canvas/src/WebGLProgram.cpp
+++ b/content/canvas/src/WebGLProgram.cpp
@@ -44,8 +44,8 @@ static bool SplitLastSquareBracket(nsACString& string, nsCString& bracketPart)
 }
 
 JSObject*
-WebGLProgram::WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap) {
-    return dom::WebGLProgramBinding::Wrap(cx, scope, this, triedToWrap);
+WebGLProgram::WrapObject(JSContext *cx, JSObject *scope) {
+    return dom::WebGLProgramBinding::Wrap(cx, scope, this);
 }
 
 WebGLProgram::WebGLProgram(WebGLContext *context)
diff --git a/content/canvas/src/WebGLProgram.h b/content/canvas/src/WebGLProgram.h
index 88b00176c191..18fa4da03346 100644
--- a/content/canvas/src/WebGLProgram.h
+++ b/content/canvas/src/WebGLProgram.h
@@ -102,7 +102,7 @@ public:
         return Context();
     }
 
-    virtual JSObject* WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap);
+    virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
     NS_DECL_CYCLE_COLLECTING_ISUPPORTS
     NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(WebGLProgram)
diff --git a/content/canvas/src/WebGLRenderbuffer.cpp b/content/canvas/src/WebGLRenderbuffer.cpp
index 129c71472afb..821ffc8d3903 100644
--- a/content/canvas/src/WebGLRenderbuffer.cpp
+++ b/content/canvas/src/WebGLRenderbuffer.cpp
@@ -11,8 +11,8 @@
 using namespace mozilla;
 
 JSObject*
-WebGLRenderbuffer::WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap) {
-    return dom::WebGLRenderbufferBinding::Wrap(cx, scope, this, triedToWrap);
+WebGLRenderbuffer::WrapObject(JSContext *cx, JSObject *scope) {
+    return dom::WebGLRenderbufferBinding::Wrap(cx, scope, this);
 }
 
 WebGLRenderbuffer::WebGLRenderbuffer(WebGLContext *context)
diff --git a/content/canvas/src/WebGLRenderbuffer.h b/content/canvas/src/WebGLRenderbuffer.h
index afb740aaf6bd..d1ad5ccaa0bd 100644
--- a/content/canvas/src/WebGLRenderbuffer.h
+++ b/content/canvas/src/WebGLRenderbuffer.h
@@ -50,7 +50,7 @@ public:
         return Context();
     }
 
-    virtual JSObject* WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap);
+    virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
     NS_DECL_CYCLE_COLLECTING_ISUPPORTS
     NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(WebGLRenderbuffer)
diff --git a/content/canvas/src/WebGLShader.cpp b/content/canvas/src/WebGLShader.cpp
index 54adefb05797..20de0f042dc7 100644
--- a/content/canvas/src/WebGLShader.cpp
+++ b/content/canvas/src/WebGLShader.cpp
@@ -11,8 +11,8 @@
 using namespace mozilla;
 
 JSObject*
-WebGLShader::WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap) {
-    return dom::WebGLShaderBinding::Wrap(cx, scope, this, triedToWrap);
+WebGLShader::WrapObject(JSContext *cx, JSObject *scope) {
+    return dom::WebGLShaderBinding::Wrap(cx, scope, this);
 }
 
 WebGLShader::WebGLShader(WebGLContext *context, WebGLenum stype)
diff --git a/content/canvas/src/WebGLShader.h b/content/canvas/src/WebGLShader.h
index 0a7e421dec7a..ee15507639c3 100644
--- a/content/canvas/src/WebGLShader.h
+++ b/content/canvas/src/WebGLShader.h
@@ -115,7 +115,7 @@ public:
         return Context();
     }
 
-    virtual JSObject* WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap);
+    virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
     NS_DECL_CYCLE_COLLECTING_ISUPPORTS
     NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(WebGLShader)
diff --git a/content/canvas/src/WebGLTexture.cpp b/content/canvas/src/WebGLTexture.cpp
index 6eadd364e612..bcf00dd1b0e3 100644
--- a/content/canvas/src/WebGLTexture.cpp
+++ b/content/canvas/src/WebGLTexture.cpp
@@ -12,8 +12,8 @@
 using namespace mozilla;
 
 JSObject*
-WebGLTexture::WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap) {
-    return dom::WebGLTextureBinding::Wrap(cx, scope, this, triedToWrap);
+WebGLTexture::WrapObject(JSContext *cx, JSObject *scope) {
+    return dom::WebGLTextureBinding::Wrap(cx, scope, this);
 }
 
 WebGLTexture::WebGLTexture(WebGLContext *context)
diff --git a/content/canvas/src/WebGLTexture.h b/content/canvas/src/WebGLTexture.h
index 971a4ff75fd9..f6448846fabc 100644
--- a/content/canvas/src/WebGLTexture.h
+++ b/content/canvas/src/WebGLTexture.h
@@ -52,7 +52,7 @@ public:
         return Context();
     }
 
-    virtual JSObject* WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap);
+    virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
     NS_DECL_CYCLE_COLLECTING_ISUPPORTS
     NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(WebGLTexture)
diff --git a/content/events/public/nsEventNameList.h b/content/events/public/nsEventNameList.h
index ae50e5f9774f..cb488cd99c4d 100644
--- a/content/events/public/nsEventNameList.h
+++ b/content/events/public/nsEventNameList.h
@@ -671,27 +671,27 @@ NON_IDL_EVENT(underflow,
 NON_IDL_EVENT(SVGLoad,
               NS_SVG_LOAD,
               EventNameType_None,
-              NS_SVG_EVENT)
+              NS_EVENT)
 NON_IDL_EVENT(SVGUnload,
               NS_SVG_UNLOAD,
               EventNameType_None,
-              NS_SVG_EVENT)
+              NS_EVENT)
 NON_IDL_EVENT(SVGAbort,
               NS_SVG_ABORT,
               EventNameType_None,
-              NS_SVG_EVENT)
+              NS_EVENT)
 NON_IDL_EVENT(SVGError,
               NS_SVG_ERROR,
               EventNameType_None,
-              NS_SVG_EVENT)
+              NS_EVENT)
 NON_IDL_EVENT(SVGResize,
               NS_SVG_RESIZE,
               EventNameType_None,
-              NS_SVG_EVENT)
+              NS_EVENT)
 NON_IDL_EVENT(SVGScroll,
               NS_SVG_SCROLL,
               EventNameType_None,
-              NS_SVG_EVENT)
+              NS_EVENT)
 
 NON_IDL_EVENT(SVGZoom,
               NS_SVG_ZOOM,
diff --git a/content/events/src/nsContentEventHandler.cpp b/content/events/src/nsContentEventHandler.cpp
index 45011d852200..de978925bf4c 100644
--- a/content/events/src/nsContentEventHandler.cpp
+++ b/content/events/src/nsContentEventHandler.cpp
@@ -515,7 +515,7 @@ nsContentEventHandler::OnQueryTextContent(nsQueryContentEvent* aEvent)
   NS_ASSERTION(aEvent->mReply.mString.IsEmpty(),
                "The reply string must be empty");
 
-  nsRefPtr<nsRange> range = new nsRange();
+  nsRefPtr<nsRange> range = new nsRange(mRootContent);
   rv = SetRangeFromFlatTextOffset(range, aEvent->mInput.mOffset,
                                   aEvent->mInput.mLength, false);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -572,7 +572,7 @@ nsContentEventHandler::OnQueryTextRect(nsQueryContentEvent* aEvent)
   if (NS_FAILED(rv))
     return rv;
 
-  nsRefPtr<nsRange> range = new nsRange();
+  nsRefPtr<nsRange> range = new nsRange(mRootContent);
   rv = SetRangeFromFlatTextOffset(range, aEvent->mInput.mOffset,
                                   aEvent->mInput.mLength, true);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -716,7 +716,7 @@ nsContentEventHandler::OnQueryCaretRect(nsQueryContentEvent* aEvent)
   }
 
   // Otherwise, we should set the guessed caret rect.
-  nsRefPtr<nsRange> range = new nsRange();
+  nsRefPtr<nsRange> range = new nsRange(mRootContent);
   rv = SetRangeFromFlatTextOffset(range, aEvent->mInput.mOffset, 0, true);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -899,9 +899,10 @@ nsContentEventHandler::GetFlatTextOffsetOfRange(nsIContent* aRootContent,
                                                 int32_t aNodeOffset,
                                                 uint32_t* aNativeOffset)
 {
+  NS_ENSURE_STATE(aRootContent);
   NS_ASSERTION(aNativeOffset, "param is invalid");
 
-  nsRefPtr<nsRange> prev = new nsRange();
+  nsRefPtr<nsRange> prev = new nsRange(aRootContent);
   nsCOMPtr<nsIDOMNode> rootDOMNode(do_QueryInterface(aRootContent));
   prev->SetStart(rootDOMNode, 0);
 
@@ -1033,7 +1034,7 @@ nsContentEventHandler::OnSelectionEvent(nsSelectionEvent* aEvent)
   }
 
   // Get range from offset and length
-  nsRefPtr<nsRange> range = new nsRange();
+  nsRefPtr<nsRange> range = new nsRange(mRootContent);
   NS_ENSURE_TRUE(range, NS_ERROR_OUT_OF_MEMORY);
   rv = SetRangeFromFlatTextOffset(range, aEvent->mOffset, aEvent->mLength,
                                   aEvent->mExpandToClusterBoundary);
diff --git a/content/events/src/nsDOMEvent.cpp b/content/events/src/nsDOMEvent.cpp
index 1aef763308c8..4697e37db37e 100644
--- a/content/events/src/nsDOMEvent.cpp
+++ b/content/events/src/nsDOMEvent.cpp
@@ -760,13 +760,6 @@ nsDOMEvent::DuplicatePrivateData()
                                static_cast<nsUIEvent*>(mEvent)->detail);
       break;
     }
-    case NS_SVG_EVENT:
-    {
-      newEvent = new nsEvent(false, msg);
-      NS_ENSURE_TRUE(newEvent, NS_ERROR_OUT_OF_MEMORY);
-      newEvent->eventStructType = NS_SVG_EVENT;
-      break;
-    }
     case NS_SVGZOOM_EVENT:
     {
       newEvent = new nsGUIEvent(false, msg, nullptr);
diff --git a/content/events/src/nsDOMEvent.h b/content/events/src/nsDOMEvent.h
index 4811df1c0e06..7ed881797cca 100644
--- a/content/events/src/nsDOMEvent.h
+++ b/content/events/src/nsDOMEvent.h
@@ -79,9 +79,9 @@ public:
     return mOwner;
   }
 
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE
   {
-    return mozilla::dom::EventBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+    return mozilla::dom::EventBinding::Wrap(aCx, aScope, this);
   }
 
   // nsIDOMEvent Interface
@@ -176,6 +176,11 @@ public:
     return d;
   }
 
+  bool MultipleActionsPrevented()
+  {
+    return mEvent->mFlags.mMultipleActionsPrevented;
+  }
+
   bool IsTrusted()
   {
     bool i;
diff --git a/content/events/src/nsEventDispatcher.cpp b/content/events/src/nsEventDispatcher.cpp
index 863800a5385d..fb2d63b0815d 100644
--- a/content/events/src/nsEventDispatcher.cpp
+++ b/content/events/src/nsEventDispatcher.cpp
@@ -744,9 +744,6 @@ nsEventDispatcher::CreateEvent(mozilla::dom::EventTarget* aOwner,
     case NS_CLIPBOARD_EVENT:
       return NS_NewDOMClipboardEvent(aDOMEvent, aOwner, aPresContext,
                                      static_cast<nsClipboardEvent*>(aEvent));
-    case NS_SVG_EVENT:
-      return NS_NewDOMSVGEvent(aDOMEvent, aOwner, aPresContext,
-                               aEvent);
     case NS_SVGZOOM_EVENT:
       return NS_NewDOMSVGZoomEvent(aDOMEvent, aOwner, aPresContext,
                                    static_cast<nsGUIEvent*>(aEvent));
@@ -807,11 +804,10 @@ nsEventDispatcher::CreateEvent(mozilla::dom::EventTarget* aOwner,
     return NS_NewDOMUIEvent(aDOMEvent, aOwner, aPresContext, nullptr);
   if (aEventType.LowerCaseEqualsLiteral("event") ||
       aEventType.LowerCaseEqualsLiteral("events") ||
-      aEventType.LowerCaseEqualsLiteral("htmlevents"))
-    return NS_NewDOMEvent(aDOMEvent, aOwner, aPresContext, nullptr);
-  if (aEventType.LowerCaseEqualsLiteral("svgevent") ||
+      aEventType.LowerCaseEqualsLiteral("htmlevents") ||
+      aEventType.LowerCaseEqualsLiteral("svgevent") ||
       aEventType.LowerCaseEqualsLiteral("svgevents"))
-    return NS_NewDOMSVGEvent(aDOMEvent, aOwner, aPresContext, nullptr);
+    return NS_NewDOMEvent(aDOMEvent, aOwner, aPresContext, nullptr);
   if (aEventType.LowerCaseEqualsLiteral("svgzoomevent") ||
       aEventType.LowerCaseEqualsLiteral("svgzoomevents"))
     return NS_NewDOMSVGZoomEvent(aDOMEvent, aOwner, aPresContext, nullptr);
diff --git a/content/events/src/nsPaintRequest.cpp b/content/events/src/nsPaintRequest.cpp
index f5f2ddd776de..5db9d5b67b14 100644
--- a/content/events/src/nsPaintRequest.cpp
+++ b/content/events/src/nsPaintRequest.cpp
@@ -25,9 +25,9 @@ NS_IMPL_CYCLE_COLLECTING_ADDREF(nsPaintRequest)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsPaintRequest)
 
 /* virtual */ JSObject*
-nsPaintRequest::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+nsPaintRequest::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return PaintRequestBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return PaintRequestBinding::Wrap(aCx, aScope, this);
 }
 
 already_AddRefed<nsClientRect>
@@ -65,11 +65,9 @@ NS_IMPL_CYCLE_COLLECTING_ADDREF(nsPaintRequestList)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsPaintRequestList)
 
 JSObject*
-nsPaintRequestList::WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap)
+nsPaintRequestList::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return mozilla::dom::PaintRequestListBinding::Wrap(cx, scope, this,
-                                                     triedToWrap);
+  return mozilla::dom::PaintRequestListBinding::Wrap(cx, scope, this);
 }
 
 NS_IMETHODIMP    
diff --git a/content/events/src/nsPaintRequest.h b/content/events/src/nsPaintRequest.h
index 6d312db32c2b..ffad00c02c66 100644
--- a/content/events/src/nsPaintRequest.h
+++ b/content/events/src/nsPaintRequest.h
@@ -29,8 +29,7 @@ public:
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(nsPaintRequest)
   NS_DECL_NSIDOMPAINTREQUEST
 
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope,
-                               bool* aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   nsIDOMEvent* GetParentObject() const
   {
@@ -66,8 +65,7 @@ public:
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(nsPaintRequestList)
   NS_DECL_NSIDOMPAINTREQUESTLIST
   
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap);
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
   nsISupports* GetParentObject()
   {
     return mParent;
diff --git a/content/html/content/public/nsIHTMLCollection.h b/content/html/content/public/nsIHTMLCollection.h
index c7f83634985f..53b3e73963f3 100644
--- a/content/html/content/public/nsIHTMLCollection.h
+++ b/content/html/content/public/nsIHTMLCollection.h
@@ -76,8 +76,7 @@ public:
     CallQueryInterface(this, &cache);
     return cache->GetWrapperPreserveColor();
   }
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap) = 0;
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) = 0;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsIHTMLCollection, NS_IHTMLCOLLECTION_IID)
diff --git a/content/html/content/src/HTMLAnchorElement.cpp b/content/html/content/src/HTMLAnchorElement.cpp
index cf581c859eb6..845c054e6bbe 100644
--- a/content/html/content/src/HTMLAnchorElement.cpp
+++ b/content/html/content/src/HTMLAnchorElement.cpp
@@ -57,9 +57,9 @@ NS_HTML_CONTENT_INTERFACE_MAP_END
 NS_IMPL_ELEMENT_CLONE(HTMLAnchorElement)
 
 JSObject*
-HTMLAnchorElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+HTMLAnchorElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return HTMLAnchorElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLAnchorElementBinding::Wrap(aCx, aScope, this);
 }
 
 NS_IMPL_STRING_ATTR(HTMLAnchorElement, Charset, charset)
diff --git a/content/html/content/src/HTMLAnchorElement.h b/content/html/content/src/HTMLAnchorElement.h
index 74ee0c0a0695..17b2eb369222 100644
--- a/content/html/content/src/HTMLAnchorElement.h
+++ b/content/html/content/src/HTMLAnchorElement.h
@@ -201,8 +201,7 @@ public:
 protected:
   virtual void GetItemValueText(nsAString& text);
   virtual void SetItemValueText(const nsAString& text);
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLAreaElement.cpp b/content/html/content/src/HTMLAreaElement.cpp
index e2d33191db67..48839c50edef 100644
--- a/content/html/content/src/HTMLAreaElement.cpp
+++ b/content/html/content/src/HTMLAreaElement.cpp
@@ -244,9 +244,9 @@ HTMLAreaElement::SizeOfExcludingThis(nsMallocSizeOfFun aMallocSizeOf) const
 }
 
 JSObject*
-HTMLAreaElement::WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+HTMLAreaElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLAreaElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLAreaElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLAreaElement.h b/content/html/content/src/HTMLAreaElement.h
index 80ddd0c94e96..7d6669bd617d 100644
--- a/content/html/content/src/HTMLAreaElement.h
+++ b/content/html/content/src/HTMLAreaElement.h
@@ -161,8 +161,7 @@ public:
   }
 
 protected:
-  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope,
-                             bool* aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   virtual void GetItemValueText(nsAString& text);
   virtual void SetItemValueText(const nsAString& text);
diff --git a/content/html/content/src/HTMLBRElement.cpp b/content/html/content/src/HTMLBRElement.cpp
index f2da13cbc8d1..625b93ecd164 100644
--- a/content/html/content/src/HTMLBRElement.cpp
+++ b/content/html/content/src/HTMLBRElement.cpp
@@ -106,10 +106,9 @@ HTMLBRElement::GetAttributeMappingFunction() const
 }
 
 JSObject*
-HTMLBRElement::WrapNode(JSContext *aCx, JSObject *aScope,
-                        bool* aTriedToWrap)
+HTMLBRElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return HTMLBRElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLBRElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLBRElement.h b/content/html/content/src/HTMLBRElement.h
index e7d08cca0216..e492607e363a 100644
--- a/content/html/content/src/HTMLBRElement.h
+++ b/content/html/content/src/HTMLBRElement.h
@@ -53,8 +53,7 @@ public:
     return SetHTMLAttr(nsGkAtoms::clear, aClear, aError);
   }
 
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap);
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLBodyElement.cpp b/content/html/content/src/HTMLBodyElement.cpp
index c0e8e3bed158..d87d44dbf5c3 100644
--- a/content/html/content/src/HTMLBodyElement.cpp
+++ b/content/html/content/src/HTMLBodyElement.cpp
@@ -194,9 +194,9 @@ HTMLBodyElement::~HTMLBodyElement()
 }
 
 JSObject*
-HTMLBodyElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+HTMLBodyElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return HTMLBodyElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLBodyElementBinding::Wrap(aCx, aScope, this);
 }
 
 NS_IMPL_ADDREF_INHERITED(HTMLBodyElement, Element)
diff --git a/content/html/content/src/HTMLBodyElement.h b/content/html/content/src/HTMLBodyElement.h
index fddaa1565f0b..e96ce501d499 100644
--- a/content/html/content/src/HTMLBodyElement.h
+++ b/content/html/content/src/HTMLBodyElement.h
@@ -149,8 +149,7 @@ private:
   nsresult GetColorHelper(nsIAtom* aAtom, nsAString& aColor);
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
   nsRefPtr<BodyRule> mContentStyleRule;
 };
diff --git a/content/html/content/src/HTMLButtonElement.cpp b/content/html/content/src/HTMLButtonElement.cpp
index 59fdb178989b..4662a55bd50f 100644
--- a/content/html/content/src/HTMLButtonElement.cpp
+++ b/content/html/content/src/HTMLButtonElement.cpp
@@ -548,10 +548,9 @@ HTMLButtonElement::IntrinsicState() const
 }
 
 JSObject*
-HTMLButtonElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                            bool* aTriedToWrap)
+HTMLButtonElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLButtonElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLButtonElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLButtonElement.h b/content/html/content/src/HTMLButtonElement.h
index 51e53f93773b..05543831c846 100644
--- a/content/html/content/src/HTMLButtonElement.h
+++ b/content/html/content/src/HTMLButtonElement.h
@@ -60,7 +60,7 @@ public:
   virtual nsresult Clone(nsINodeInfo* aNodeInfo, nsINode** aResult) const;
   virtual nsIDOMNode* AsDOMNode() { return this; }
   virtual JSObject*
-  WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE;
+  WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   // nsIContent
   virtual nsresult BindToTree(nsIDocument* aDocument, nsIContent* aParent,
diff --git a/content/html/content/src/HTMLDataElement.cpp b/content/html/content/src/HTMLDataElement.cpp
index 25d9f73b693c..a27dd35fc20c 100644
--- a/content/html/content/src/HTMLDataElement.cpp
+++ b/content/html/content/src/HTMLDataElement.cpp
@@ -34,9 +34,9 @@ NS_HTML_CONTENT_INTERFACE_MAP_END
 NS_IMPL_ELEMENT_CLONE(HTMLDataElement)
 
 JSObject*
-HTMLDataElement::WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+HTMLDataElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLDataElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLDataElementBinding::Wrap(aCx, aScope, this);
 }
 
 void
diff --git a/content/html/content/src/HTMLDataElement.h b/content/html/content/src/HTMLDataElement.h
index 6bf6dd87df5e..011cb6a5ba05 100644
--- a/content/html/content/src/HTMLDataElement.h
+++ b/content/html/content/src/HTMLDataElement.h
@@ -49,8 +49,7 @@ public:
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
 protected:
-  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope,
-                             bool* aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLDataListElement.cpp b/content/html/content/src/HTMLDataListElement.cpp
index 2c9b02618b2b..c5fb101916d1 100644
--- a/content/html/content/src/HTMLDataListElement.cpp
+++ b/content/html/content/src/HTMLDataListElement.cpp
@@ -16,10 +16,9 @@ HTMLDataListElement::~HTMLDataListElement()
 }
 
 JSObject*
-HTMLDataListElement::WrapNode(JSContext *aCx, JSObject *aScope,
-                              bool *aTriedToWrap)
+HTMLDataListElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return HTMLDataListElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLDataListElementBinding::Wrap(aCx, aScope, this);
 }
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(HTMLDataListElement,
diff --git a/content/html/content/src/HTMLDataListElement.h b/content/html/content/src/HTMLDataListElement.h
index 71f0fc8212c3..9e6b17193033 100644
--- a/content/html/content/src/HTMLDataListElement.h
+++ b/content/html/content/src/HTMLDataListElement.h
@@ -59,8 +59,7 @@ public:
 
   virtual nsIDOMNode* AsDOMNode() { return this; }
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
   // <option>'s list inside the datalist element.
   nsRefPtr<nsContentList> mOptions;
diff --git a/content/html/content/src/HTMLDivElement.cpp b/content/html/content/src/HTMLDivElement.cpp
index fc2020697b4a..60616c05b445 100644
--- a/content/html/content/src/HTMLDivElement.cpp
+++ b/content/html/content/src/HTMLDivElement.cpp
@@ -33,9 +33,9 @@ NS_HTML_CONTENT_INTERFACE_MAP_END
 NS_IMPL_ELEMENT_CLONE(HTMLDivElement)
 
 JSObject*
-HTMLDivElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+HTMLDivElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return dom::HTMLDivElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return dom::HTMLDivElementBinding::Wrap(aCx, aScope, this);
 }
 
 bool
diff --git a/content/html/content/src/HTMLDivElement.h b/content/html/content/src/HTMLDivElement.h
index cd09a068e4f8..48fd2677fbf4 100644
--- a/content/html/content/src/HTMLDivElement.h
+++ b/content/html/content/src/HTMLDivElement.h
@@ -69,8 +69,7 @@ public:
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLElement.cpp b/content/html/content/src/HTMLElement.cpp
index 9dec72c6bc45..56254c91e12a 100644
--- a/content/html/content/src/HTMLElement.cpp
+++ b/content/html/content/src/HTMLElement.cpp
@@ -38,8 +38,7 @@ public:
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 };
 
 HTMLElement::HTMLElement(already_AddRefed<nsINodeInfo> aNodeInfo)
@@ -83,9 +82,9 @@ HTMLElement::GetInnerHTML(nsAString& aInnerHTML, ErrorResult& aError)
 }
 
 JSObject*
-HTMLElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+HTMLElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return dom::HTMLElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return dom::HTMLElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLFieldSetElement.cpp b/content/html/content/src/HTMLFieldSetElement.cpp
index 2849f380ecb2..a5a655556c45 100644
--- a/content/html/content/src/HTMLFieldSetElement.cpp
+++ b/content/html/content/src/HTMLFieldSetElement.cpp
@@ -244,10 +244,9 @@ HTMLFieldSetElement::NotifyElementsForFirstLegendChange(bool aNotify)
 }
 
 JSObject*
-HTMLFieldSetElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                              bool* aTriedToWrap)
+HTMLFieldSetElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLFieldSetElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLFieldSetElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLFieldSetElement.h b/content/html/content/src/HTMLFieldSetElement.h
index 0d7401904a1d..62aaa396eac0 100644
--- a/content/html/content/src/HTMLFieldSetElement.h
+++ b/content/html/content/src/HTMLFieldSetElement.h
@@ -107,8 +107,7 @@ public:
   // XPCOM SetCustomValidity is OK for us
 
 protected:
-  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope,
-                             bool* aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
 private:
 
diff --git a/content/html/content/src/HTMLFontElement.cpp b/content/html/content/src/HTMLFontElement.cpp
index 515c5d663b66..b845f184f39f 100644
--- a/content/html/content/src/HTMLFontElement.cpp
+++ b/content/html/content/src/HTMLFontElement.cpp
@@ -22,9 +22,9 @@ HTMLFontElement::~HTMLFontElement()
 }
 
 JSObject*
-HTMLFontElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+HTMLFontElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return HTMLFontElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLFontElementBinding::Wrap(aCx, aScope, this);
 }
 
 NS_IMPL_ADDREF_INHERITED(HTMLFontElement, Element)
diff --git a/content/html/content/src/HTMLFontElement.h b/content/html/content/src/HTMLFontElement.h
index 40540734cd23..5229405de629 100644
--- a/content/html/content/src/HTMLFontElement.h
+++ b/content/html/content/src/HTMLFontElement.h
@@ -72,8 +72,7 @@ public:
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLFrameElement.cpp b/content/html/content/src/HTMLFrameElement.cpp
index ba8e463bd40d..da6e12076c9b 100644
--- a/content/html/content/src/HTMLFrameElement.cpp
+++ b/content/html/content/src/HTMLFrameElement.cpp
@@ -117,10 +117,9 @@ HTMLFrameElement::GetAttributeMappingFunction() const
 }
 
 JSObject*
-HTMLFrameElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                           bool* aTriedToWrap)
+HTMLFrameElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLFrameElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLFrameElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace mozilla
diff --git a/content/html/content/src/HTMLFrameElement.h b/content/html/content/src/HTMLFrameElement.h
index c6ff2f8002cc..fdd72afa5147 100644
--- a/content/html/content/src/HTMLFrameElement.h
+++ b/content/html/content/src/HTMLFrameElement.h
@@ -106,8 +106,7 @@ public:
   using nsGenericHTMLFrameElement::GetContentWindow;
 
 protected:
-  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope,
-                             bool* aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLFrameSetElement.cpp b/content/html/content/src/HTMLFrameSetElement.cpp
index 993a3c941786..812cfcab41a0 100644
--- a/content/html/content/src/HTMLFrameSetElement.cpp
+++ b/content/html/content/src/HTMLFrameSetElement.cpp
@@ -18,10 +18,9 @@ HTMLFrameSetElement::~HTMLFrameSetElement()
 }
 
 JSObject*
-HTMLFrameSetElement::WrapNode(JSContext *aCx, JSObject *aScope,
-                              bool *aTriedToWrap)
+HTMLFrameSetElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return HTMLFrameSetElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLFrameSetElementBinding::Wrap(aCx, aScope, this);
 }
 
 NS_IMPL_ADDREF_INHERITED(HTMLFrameSetElement, Element)
diff --git a/content/html/content/src/HTMLFrameSetElement.h b/content/html/content/src/HTMLFrameSetElement.h
index 9dced49f0444..b7ba57965336 100644
--- a/content/html/content/src/HTMLFrameSetElement.h
+++ b/content/html/content/src/HTMLFrameSetElement.h
@@ -151,8 +151,7 @@ public:
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
 private:
   nsresult ParseRowCol(const nsAString& aValue,
diff --git a/content/html/content/src/HTMLHRElement.cpp b/content/html/content/src/HTMLHRElement.cpp
index d2fd652176c2..fe24649bd1e2 100644
--- a/content/html/content/src/HTMLHRElement.cpp
+++ b/content/html/content/src/HTMLHRElement.cpp
@@ -267,10 +267,9 @@ HTMLHRElement::GetAttributeMappingFunction() const
 }
 
 JSObject*
-HTMLHRElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                        bool* aTriedToWrap)
+HTMLHRElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLHRElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLHRElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace mozilla
diff --git a/content/html/content/src/HTMLHRElement.h b/content/html/content/src/HTMLHRElement.h
index 735147f87536..19db9564f761 100644
--- a/content/html/content/src/HTMLHRElement.h
+++ b/content/html/content/src/HTMLHRElement.h
@@ -82,8 +82,7 @@ public:
   }
 
 protected:
-  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope,
-                             bool* aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLHeadingElement.cpp b/content/html/content/src/HTMLHeadingElement.cpp
index 47984da93e9e..ce2a53745838 100644
--- a/content/html/content/src/HTMLHeadingElement.cpp
+++ b/content/html/content/src/HTMLHeadingElement.cpp
@@ -37,9 +37,9 @@ NS_HTML_CONTENT_INTERFACE_MAP_END
 NS_IMPL_ELEMENT_CLONE(HTMLHeadingElement)
 
 JSObject*
-HTMLHeadingElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+HTMLHeadingElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return HTMLHeadingElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLHeadingElementBinding::Wrap(aCx, aScope, this);
 }
 
 NS_IMPL_STRING_ATTR(HTMLHeadingElement, Align, align)
diff --git a/content/html/content/src/HTMLHeadingElement.h b/content/html/content/src/HTMLHeadingElement.h
index fb8039ee85de..66a560d4abc2 100644
--- a/content/html/content/src/HTMLHeadingElement.h
+++ b/content/html/content/src/HTMLHeadingElement.h
@@ -51,8 +51,7 @@ public:
   // use from WebIDL.
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 };
 
 } // namespace mozilla
diff --git a/content/html/content/src/HTMLImageElement.cpp b/content/html/content/src/HTMLImageElement.cpp
index a75f9a707d53..13f6f92875a8 100644
--- a/content/html/content/src/HTMLImageElement.cpp
+++ b/content/html/content/src/HTMLImageElement.cpp
@@ -574,10 +574,9 @@ HTMLImageElement::GetCORSMode()
 }
 
 JSObject*
-HTMLImageElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                           bool* aTriedToWrap)
+HTMLImageElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLImageElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLImageElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLImageElement.h b/content/html/content/src/HTMLImageElement.h
index 7e3715f17408..ae789569ef43 100644
--- a/content/html/content/src/HTMLImageElement.h
+++ b/content/html/content/src/HTMLImageElement.h
@@ -168,8 +168,7 @@ protected:
   nsIntPoint GetXY();
   virtual void GetItemValueText(nsAString& text);
   virtual void SetItemValueText(const nsAString& text);
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLLIElement.cpp b/content/html/content/src/HTMLLIElement.cpp
index 645c245db654..fed2e445ceb6 100644
--- a/content/html/content/src/HTMLLIElement.cpp
+++ b/content/html/content/src/HTMLLIElement.cpp
@@ -117,9 +117,9 @@ HTMLLIElement::GetAttributeMappingFunction() const
 }
 
 JSObject*
-HTMLLIElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+HTMLLIElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return HTMLLIElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLLIElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLLIElement.h b/content/html/content/src/HTMLLIElement.h
index 1a4a08efe068..43c08da5d81e 100644
--- a/content/html/content/src/HTMLLIElement.h
+++ b/content/html/content/src/HTMLLIElement.h
@@ -67,8 +67,7 @@ public:
   }
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLLabelElement.cpp b/content/html/content/src/HTMLLabelElement.cpp
index b41c4344c5b6..3085ade1c59f 100644
--- a/content/html/content/src/HTMLLabelElement.cpp
+++ b/content/html/content/src/HTMLLabelElement.cpp
@@ -23,9 +23,9 @@ HTMLLabelElement::~HTMLLabelElement()
 }
 
 JSObject*
-HTMLLabelElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+HTMLLabelElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return HTMLLabelElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLLabelElementBinding::Wrap(aCx, aScope, this);
 }
 
 // nsISupports 
diff --git a/content/html/content/src/HTMLLabelElement.h b/content/html/content/src/HTMLLabelElement.h
index 9c48b759bf7a..920129d4754e 100644
--- a/content/html/content/src/HTMLLabelElement.h
+++ b/content/html/content/src/HTMLLabelElement.h
@@ -77,8 +77,7 @@ public:
 
   nsGenericHTMLElement* GetLabeledElement() const;
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
   nsGenericHTMLElement* GetFirstLabelableDescendant() const;
 
diff --git a/content/html/content/src/HTMLLegendElement.cpp b/content/html/content/src/HTMLLegendElement.cpp
index e57ae0eabdb3..5adeedb2ba59 100644
--- a/content/html/content/src/HTMLLegendElement.cpp
+++ b/content/html/content/src/HTMLLegendElement.cpp
@@ -174,10 +174,9 @@ HTMLLegendElement::GetForm()
 }
 
 JSObject*
-HTMLLegendElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                            bool* aTriedToWrap)
+HTMLLegendElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLLegendElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLLegendElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLLegendElement.h b/content/html/content/src/HTMLLegendElement.h
index 9914bd4558a1..c25797cc9be0 100644
--- a/content/html/content/src/HTMLLegendElement.h
+++ b/content/html/content/src/HTMLLegendElement.h
@@ -99,8 +99,7 @@ public:
   }
 
 protected:
-  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope,
-                             bool* aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   /**
    * Get the fieldset content element that contains this legend.
diff --git a/content/html/content/src/HTMLLinkElement.cpp b/content/html/content/src/HTMLLinkElement.cpp
index d36416663217..65ae7e6def8e 100644
--- a/content/html/content/src/HTMLLinkElement.cpp
+++ b/content/html/content/src/HTMLLinkElement.cpp
@@ -426,9 +426,9 @@ HTMLLinkElement::SizeOfExcludingThis(nsMallocSizeOfFun aMallocSizeOf) const
 }
 
 JSObject*
-HTMLLinkElement::WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+HTMLLinkElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLLinkElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLLinkElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLLinkElement.h b/content/html/content/src/HTMLLinkElement.h
index fdab355eaaf9..43524f537046 100644
--- a/content/html/content/src/HTMLLinkElement.h
+++ b/content/html/content/src/HTMLLinkElement.h
@@ -59,7 +59,7 @@ public:
   virtual nsresult Clone(nsINodeInfo* aNodeInfo, nsINode** aResult) const;
   virtual nsIDOMNode* AsDOMNode() { return this; }
   virtual JSObject*
-  WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE;
+  WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   // nsIContent
   virtual nsresult BindToTree(nsIDocument* aDocument, nsIContent* aParent,
diff --git a/content/html/content/src/HTMLMapElement.cpp b/content/html/content/src/HTMLMapElement.cpp
index db0b24cf1193..d3eed872a304 100644
--- a/content/html/content/src/HTMLMapElement.cpp
+++ b/content/html/content/src/HTMLMapElement.cpp
@@ -68,9 +68,9 @@ NS_IMPL_STRING_ATTR(HTMLMapElement, Name, name)
 
 
 JSObject*
-HTMLMapElement::WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+HTMLMapElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLMapElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLMapElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLMapElement.h b/content/html/content/src/HTMLMapElement.h
index 27805a50f954..a128496fd8e2 100644
--- a/content/html/content/src/HTMLMapElement.h
+++ b/content/html/content/src/HTMLMapElement.h
@@ -52,7 +52,7 @@ public:
   nsIHTMLCollection* Areas();
 
   virtual JSObject*
-  WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE;
+  WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
 protected:
   nsRefPtr<nsContentList> mAreas;
diff --git a/content/html/content/src/HTMLMenuElement.cpp b/content/html/content/src/HTMLMenuElement.cpp
index 15cffe21a2a7..6c6cd2a61fa3 100644
--- a/content/html/content/src/HTMLMenuElement.cpp
+++ b/content/html/content/src/HTMLMenuElement.cpp
@@ -267,10 +267,9 @@ HTMLMenuElement::AddSeparator(nsIMenuBuilder* aBuilder, int8_t& aSeparator)
 }
 
 JSObject*
-HTMLMenuElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                          bool* aTriedToWrap)
+HTMLMenuElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLMenuElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLMenuElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLMenuElement.h b/content/html/content/src/HTMLMenuElement.h
index e0b788f35bca..ba667575c6c0 100644
--- a/content/html/content/src/HTMLMenuElement.h
+++ b/content/html/content/src/HTMLMenuElement.h
@@ -82,8 +82,7 @@ public:
   // The XPCOM Build is OK for us
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
 
 protected:
diff --git a/content/html/content/src/HTMLMenuItemElement.cpp b/content/html/content/src/HTMLMenuItemElement.cpp
index 7ea85967b4f2..e2683da99c1b 100644
--- a/content/html/content/src/HTMLMenuItemElement.cpp
+++ b/content/html/content/src/HTMLMenuItemElement.cpp
@@ -491,10 +491,9 @@ HTMLMenuItemElement::InitChecked()
 }
 
 JSObject*
-HTMLMenuItemElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                              bool* aTriedToWrap)
+HTMLMenuItemElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLMenuItemElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLMenuItemElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLMenuItemElement.h b/content/html/content/src/HTMLMenuItemElement.h
index 0d75645b0b94..938aa6b2e7b3 100644
--- a/content/html/content/src/HTMLMenuItemElement.h
+++ b/content/html/content/src/HTMLMenuItemElement.h
@@ -126,8 +126,7 @@ public:
   }
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
 
 protected:
diff --git a/content/html/content/src/HTMLMetaElement.cpp b/content/html/content/src/HTMLMetaElement.cpp
index a75d78f9f742..aacb069e523e 100644
--- a/content/html/content/src/HTMLMetaElement.cpp
+++ b/content/html/content/src/HTMLMetaElement.cpp
@@ -99,9 +99,9 @@ HTMLMetaElement::CreateAndDispatchEvent(nsIDocument* aDoc,
 }
 
 JSObject*
-HTMLMetaElement::WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+HTMLMetaElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLMetaElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLMetaElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLMetaElement.h b/content/html/content/src/HTMLMetaElement.h
index ed41e9b5d525..a2e303d85032 100644
--- a/content/html/content/src/HTMLMetaElement.h
+++ b/content/html/content/src/HTMLMetaElement.h
@@ -67,7 +67,7 @@ public:
   }
 
   virtual JSObject*
-  WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE;
+  WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
 protected:
   virtual void GetItemValueText(nsAString& text);
diff --git a/content/html/content/src/HTMLMeterElement.cpp b/content/html/content/src/HTMLMeterElement.cpp
index 5de3981f0557..49a4da63ab96 100644
--- a/content/html/content/src/HTMLMeterElement.cpp
+++ b/content/html/content/src/HTMLMeterElement.cpp
@@ -350,10 +350,9 @@ HTMLMeterElement::GetOptimumState() const
 }
 
 JSObject*
-HTMLMeterElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                           bool* aTriedToWrap)
+HTMLMeterElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLMeterElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLMeterElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLMeterElement.h b/content/html/content/src/HTMLMeterElement.h
index c27dcdab15b7..b2a907046245 100644
--- a/content/html/content/src/HTMLMeterElement.h
+++ b/content/html/content/src/HTMLMeterElement.h
@@ -93,8 +93,7 @@ public:
   }
 
 protected:
-  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope,
-                             bool* aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
 private:
 
diff --git a/content/html/content/src/HTMLModElement.cpp b/content/html/content/src/HTMLModElement.cpp
index e616266524d5..47653964a7de 100644
--- a/content/html/content/src/HTMLModElement.cpp
+++ b/content/html/content/src/HTMLModElement.cpp
@@ -42,9 +42,9 @@ NS_IMPL_URI_ATTR(HTMLModElement, Cite, cite)
 NS_IMPL_STRING_ATTR(HTMLModElement, DateTime, datetime)
 
 JSObject*
-HTMLModElement::WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+HTMLModElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLModElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLModElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLModElement.h b/content/html/content/src/HTMLModElement.h
index 901807f9bed9..5e1c693f5598 100644
--- a/content/html/content/src/HTMLModElement.h
+++ b/content/html/content/src/HTMLModElement.h
@@ -54,7 +54,7 @@ public:
   }
 
   virtual JSObject*
-  WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE;
+  WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLObjectElement.cpp b/content/html/content/src/HTMLObjectElement.cpp
index eec104278852..d50f35d5eacd 100644
--- a/content/html/content/src/HTMLObjectElement.cpp
+++ b/content/html/content/src/HTMLObjectElement.cpp
@@ -453,10 +453,9 @@ HTMLObjectElement::CopyInnerTo(Element* aDest)
 }
 
 JSObject*
-HTMLObjectElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                            bool* aTriedToWrap)
+HTMLObjectElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  JSObject* obj = HTMLObjectElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  JSObject* obj = HTMLObjectElementBinding::Wrap(aCx, aScope, this);
   if (!obj) {
     return nullptr;
   }
diff --git a/content/html/content/src/HTMLObjectElement.h b/content/html/content/src/HTMLObjectElement.h
index b394322b8812..306c55133f2a 100644
--- a/content/html/content/src/HTMLObjectElement.h
+++ b/content/html/content/src/HTMLObjectElement.h
@@ -245,8 +245,7 @@ private:
   virtual void GetItemValueText(nsAString& text);
   virtual void SetItemValueText(const nsAString& text);
 
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
   virtual JSObject* GetCanonicalPrototype(JSContext* aCx,
                                           JSObject* aGlobal) MOZ_OVERRIDE;
 
diff --git a/content/html/content/src/HTMLOptGroupElement.cpp b/content/html/content/src/HTMLOptGroupElement.cpp
index 2f415f4f0af9..2c858dae5b57 100644
--- a/content/html/content/src/HTMLOptGroupElement.cpp
+++ b/content/html/content/src/HTMLOptGroupElement.cpp
@@ -157,10 +157,9 @@ HTMLOptGroupElement::IntrinsicState() const
 }
 
 JSObject*
-HTMLOptGroupElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                              bool* aTriedToWrap)
+HTMLOptGroupElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLOptGroupElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLOptGroupElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLOptGroupElement.h b/content/html/content/src/HTMLOptGroupElement.h
index cb2ba450eafe..4df53e76a39b 100644
--- a/content/html/content/src/HTMLOptGroupElement.h
+++ b/content/html/content/src/HTMLOptGroupElement.h
@@ -71,8 +71,7 @@ public:
   }
 
 protected:
-  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope,
-                             bool* aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
 protected:
 
diff --git a/content/html/content/src/HTMLOptionElement.cpp b/content/html/content/src/HTMLOptionElement.cpp
index bdff14765f16..70fce3fe3657 100644
--- a/content/html/content/src/HTMLOptionElement.cpp
+++ b/content/html/content/src/HTMLOptionElement.cpp
@@ -449,9 +449,9 @@ HTMLOptionElement::CopyInnerTo(Element* aDest)
 }
 
 JSObject*
-HTMLOptionElement::WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+HTMLOptionElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLOptionElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLOptionElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLOptionElement.h b/content/html/content/src/HTMLOptionElement.h
index 739c154cf594..3387a64121bb 100644
--- a/content/html/content/src/HTMLOptionElement.h
+++ b/content/html/content/src/HTMLOptionElement.h
@@ -130,8 +130,7 @@ public:
   }
 
 protected:
-  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope,
-                             bool* aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   /**
    * Get the select content element that contains this option, this
diff --git a/content/html/content/src/HTMLOutputElement.cpp b/content/html/content/src/HTMLOutputElement.cpp
index 82f15e8bd854..7a8a9aa22e49 100644
--- a/content/html/content/src/HTMLOutputElement.cpp
+++ b/content/html/content/src/HTMLOutputElement.cpp
@@ -254,10 +254,9 @@ void HTMLOutputElement::ContentRemoved(nsIDocument* aDocument,
 }
 
 JSObject*
-HTMLOutputElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                            bool* aTriedToWrap)
+HTMLOutputElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLOutputElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLOutputElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLOutputElement.h b/content/html/content/src/HTMLOutputElement.h
index 143a87d3130f..fd544893d5d1 100644
--- a/content/html/content/src/HTMLOutputElement.h
+++ b/content/html/content/src/HTMLOutputElement.h
@@ -73,7 +73,7 @@ public:
 
   virtual nsIDOMNode* AsDOMNode() { return this; }
   virtual JSObject*
-  WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE;
+  WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   // WebIDL
   nsDOMSettableTokenList* HtmlFor();
diff --git a/content/html/content/src/HTMLParagraphElement.cpp b/content/html/content/src/HTMLParagraphElement.cpp
index 0c7c26bbee86..581077b07901 100644
--- a/content/html/content/src/HTMLParagraphElement.cpp
+++ b/content/html/content/src/HTMLParagraphElement.cpp
@@ -75,9 +75,9 @@ HTMLParagraphElement::GetAttributeMappingFunction() const
 }
 
 JSObject*
-HTMLParagraphElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+HTMLParagraphElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return HTMLParagraphElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLParagraphElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLParagraphElement.h b/content/html/content/src/HTMLParagraphElement.h
index 1991b43b6060..3051076e7d50 100644
--- a/content/html/content/src/HTMLParagraphElement.h
+++ b/content/html/content/src/HTMLParagraphElement.h
@@ -59,8 +59,7 @@ public:
   }
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLPreElement.cpp b/content/html/content/src/HTMLPreElement.cpp
index bb0f6e153080..7a563af45160 100644
--- a/content/html/content/src/HTMLPreElement.cpp
+++ b/content/html/content/src/HTMLPreElement.cpp
@@ -122,9 +122,9 @@ HTMLPreElement::GetAttributeMappingFunction() const
 }
 
 JSObject*
-HTMLPreElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+HTMLPreElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return HTMLPreElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLPreElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLPreElement.h b/content/html/content/src/HTMLPreElement.h
index 7fe1aedcf4d1..65b3303d2117 100644
--- a/content/html/content/src/HTMLPreElement.h
+++ b/content/html/content/src/HTMLPreElement.h
@@ -63,8 +63,7 @@ public:
   }
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLProgressElement.cpp b/content/html/content/src/HTMLProgressElement.cpp
index 0b0b2e0dcd25..aabd96294de4 100644
--- a/content/html/content/src/HTMLProgressElement.cpp
+++ b/content/html/content/src/HTMLProgressElement.cpp
@@ -148,10 +148,9 @@ HTMLProgressElement::IsIndeterminate() const
 }
 
 JSObject*
-HTMLProgressElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                              bool* aTriedToWrap)
+HTMLProgressElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLProgressElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLProgressElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLProgressElement.h b/content/html/content/src/HTMLProgressElement.h
index 73ac3a2411a5..d2923750134b 100644
--- a/content/html/content/src/HTMLProgressElement.h
+++ b/content/html/content/src/HTMLProgressElement.h
@@ -61,8 +61,7 @@ public:
   double Position() const;
 
 protected:
-  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope,
-                             bool* aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
 protected:
   /**
diff --git a/content/html/content/src/HTMLPropertiesCollection.cpp b/content/html/content/src/HTMLPropertiesCollection.cpp
index 885383410c60..ab19d3ae84f7 100644
--- a/content/html/content/src/HTMLPropertiesCollection.cpp
+++ b/content/html/content/src/HTMLPropertiesCollection.cpp
@@ -103,10 +103,9 @@ HTMLPropertiesCollection::SetDocument(nsIDocument* aDocument) {
 }
 
 JSObject*
-HTMLPropertiesCollection::WrapObject(JSContext* cx, JSObject* scope,
-                                     bool* triedToWrap)
+HTMLPropertiesCollection::WrapObject(JSContext* cx, JSObject* scope)
 {
-  return HTMLPropertiesCollectionBinding::Wrap(cx, scope, this, triedToWrap);
+  return HTMLPropertiesCollectionBinding::Wrap(cx, scope, this);
 }
 
 NS_IMETHODIMP
@@ -412,9 +411,9 @@ PropertyNodeList::GetParentObject()
 }
 
 JSObject*
-PropertyNodeList::WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap)
+PropertyNodeList::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return PropertyNodeListBinding::Wrap(cx, scope, this, triedToWrap);
+  return PropertyNodeListBinding::Wrap(cx, scope, this);
 }
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(PropertyNodeList)
diff --git a/content/html/content/src/HTMLPropertiesCollection.h b/content/html/content/src/HTMLPropertiesCollection.h
index 86052eff5790..95e3b8b459d6 100644
--- a/content/html/content/src/HTMLPropertiesCollection.h
+++ b/content/html/content/src/HTMLPropertiesCollection.h
@@ -56,8 +56,7 @@ public:
   virtual ~HTMLPropertiesCollection();
 
   using nsWrapperCache::GetWrapperPreserveColor;
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap);
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
   virtual Element* GetElementAt(uint32_t aIndex);
 
@@ -133,8 +132,7 @@ public:
                    nsIContent* aRoot, const nsAString& aName);
   virtual ~PropertyNodeList();
 
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap);
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
   void SetDocument(nsIDocument* aDocument);
 
diff --git a/content/html/content/src/HTMLScriptElement.cpp b/content/html/content/src/HTMLScriptElement.cpp
index 38eb0cb34d74..2f367c7ad4b7 100644
--- a/content/html/content/src/HTMLScriptElement.cpp
+++ b/content/html/content/src/HTMLScriptElement.cpp
@@ -30,9 +30,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-HTMLScriptElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+HTMLScriptElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return HTMLScriptElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLScriptElementBinding::Wrap(aCx, aScope, this);
 }
 
 HTMLScriptElement::HTMLScriptElement(already_AddRefed<nsINodeInfo> aNodeInfo,
diff --git a/content/html/content/src/HTMLScriptElement.h b/content/html/content/src/HTMLScriptElement.h
index 17530fb69922..4dbf940c9db8 100644
--- a/content/html/content/src/HTMLScriptElement.h
+++ b/content/html/content/src/HTMLScriptElement.h
@@ -85,8 +85,7 @@ public:
   void SetAsync(bool aValue, ErrorResult& rv);
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
   // nsScriptElement
   virtual bool HasScriptContent();
 };
diff --git a/content/html/content/src/HTMLSharedElement.cpp b/content/html/content/src/HTMLSharedElement.cpp
index e42721d541f4..0f31046bfd3f 100644
--- a/content/html/content/src/HTMLSharedElement.cpp
+++ b/content/html/content/src/HTMLSharedElement.cpp
@@ -327,26 +327,26 @@ HTMLSharedElement::GetAttributeMappingFunction() const
 }
 
 JSObject*
-HTMLSharedElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+HTMLSharedElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
   if (mNodeInfo->Equals(nsGkAtoms::param)) {
-    return HTMLParamElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+    return HTMLParamElementBinding::Wrap(aCx, aScope, this);
   }
   if (mNodeInfo->Equals(nsGkAtoms::base)) {
-    return HTMLBaseElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+    return HTMLBaseElementBinding::Wrap(aCx, aScope, this);
   }
   if (mNodeInfo->Equals(nsGkAtoms::dir)) {
-    return HTMLDirectoryElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+    return HTMLDirectoryElementBinding::Wrap(aCx, aScope, this);
   }
   if (mNodeInfo->Equals(nsGkAtoms::q) ||
       mNodeInfo->Equals(nsGkAtoms::blockquote)) {
-    return HTMLQuoteElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+    return HTMLQuoteElementBinding::Wrap(aCx, aScope, this);
   }
   if (mNodeInfo->Equals(nsGkAtoms::head)) {
-    return HTMLHeadElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+    return HTMLHeadElementBinding::Wrap(aCx, aScope, this);
   }
   MOZ_ASSERT(mNodeInfo->Equals(nsGkAtoms::html));
-  return HTMLHtmlElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLHtmlElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace mozilla
diff --git a/content/html/content/src/HTMLSharedElement.h b/content/html/content/src/HTMLSharedElement.h
index 6aa773df9c11..e151cc80e7f5 100644
--- a/content/html/content/src/HTMLSharedElement.h
+++ b/content/html/content/src/HTMLSharedElement.h
@@ -197,8 +197,7 @@ public:
   }
 
 protected:
-  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope,
-                             bool* aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 };
 
 } // namespace mozilla
diff --git a/content/html/content/src/HTMLSharedListElement.cpp b/content/html/content/src/HTMLSharedListElement.cpp
index 8abb3f325de0..653df65de23c 100644
--- a/content/html/content/src/HTMLSharedListElement.cpp
+++ b/content/html/content/src/HTMLSharedListElement.cpp
@@ -150,17 +150,16 @@ HTMLSharedListElement::GetAttributeMappingFunction() const
 }
 
 JSObject*
-HTMLSharedListElement::WrapNode(JSContext *aCx, JSObject *aScope,
-                                bool *aTriedToWrap)
+HTMLSharedListElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
   if (mNodeInfo->Equals(nsGkAtoms::ol)) {
-    return HTMLOListElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+    return HTMLOListElementBinding::Wrap(aCx, aScope, this);
   }
   if (mNodeInfo->Equals(nsGkAtoms::dl)) {
-    return HTMLDListElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+    return HTMLDListElementBinding::Wrap(aCx, aScope, this);
   }
   MOZ_ASSERT(mNodeInfo->Equals(nsGkAtoms::ul));
-  return HTMLUListElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLUListElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLSharedListElement.h b/content/html/content/src/HTMLSharedListElement.h
index 68d485b2e603..6f8bb771213e 100644
--- a/content/html/content/src/HTMLSharedListElement.h
+++ b/content/html/content/src/HTMLSharedListElement.h
@@ -96,8 +96,7 @@ public:
   }
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLSourceElement.cpp b/content/html/content/src/HTMLSourceElement.cpp
index e083af724c75..e0918341e8c6 100644
--- a/content/html/content/src/HTMLSourceElement.cpp
+++ b/content/html/content/src/HTMLSourceElement.cpp
@@ -77,10 +77,9 @@ HTMLSourceElement::BindToTree(nsIDocument *aDocument,
 }
 
 JSObject*
-HTMLSourceElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                            bool* aTriedToWrap)
+HTMLSourceElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLSourceElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLSourceElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLSourceElement.h b/content/html/content/src/HTMLSourceElement.h
index fd74318b0af8..69e5ecdfe82e 100644
--- a/content/html/content/src/HTMLSourceElement.h
+++ b/content/html/content/src/HTMLSourceElement.h
@@ -75,8 +75,7 @@ public:
   }
 
 protected:
-  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope,
-                             bool* aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
 protected:
   virtual void GetItemValueText(nsAString& text);
diff --git a/content/html/content/src/HTMLSpanElement.cpp b/content/html/content/src/HTMLSpanElement.cpp
index c8e09e337333..b94e42d5b633 100644
--- a/content/html/content/src/HTMLSpanElement.cpp
+++ b/content/html/content/src/HTMLSpanElement.cpp
@@ -34,9 +34,9 @@ NS_HTML_CONTENT_INTERFACE_MAP_END
 NS_IMPL_ELEMENT_CLONE(HTMLSpanElement)
 
 JSObject*
-HTMLSpanElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+HTMLSpanElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return HTMLSpanElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLSpanElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLSpanElement.h b/content/html/content/src/HTMLSpanElement.h
index 36cb010fac5e..aae7b1e22b94 100644
--- a/content/html/content/src/HTMLSpanElement.h
+++ b/content/html/content/src/HTMLSpanElement.h
@@ -45,8 +45,7 @@ public:
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLStyleElement.cpp b/content/html/content/src/HTMLStyleElement.cpp
index 57ee34b6828d..92465271cf6b 100644
--- a/content/html/content/src/HTMLStyleElement.cpp
+++ b/content/html/content/src/HTMLStyleElement.cpp
@@ -282,10 +282,9 @@ HTMLStyleElement::GetStyleSheetInfo(nsAString& aTitle,
 }
 
 JSObject*
-HTMLStyleElement::WrapNode(JSContext *aCx, JSObject *aScope,
-                           bool *aTriedToWrap)
+HTMLStyleElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return HTMLStyleElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLStyleElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLStyleElement.h b/content/html/content/src/HTMLStyleElement.h
index efbf105fa47b..50fa3ba81940 100644
--- a/content/html/content/src/HTMLStyleElement.h
+++ b/content/html/content/src/HTMLStyleElement.h
@@ -92,8 +92,7 @@ public:
     SetHTMLBoolAttr(nsGkAtoms::scoped, aScoped, aError);
   }
 
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap);
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
   virtual nsIDOMNode* AsDOMNode() { return this; }
 protected:
diff --git a/content/html/content/src/HTMLTableCaptionElement.cpp b/content/html/content/src/HTMLTableCaptionElement.cpp
index 78f4c957e3d5..df92c9f0a2fd 100644
--- a/content/html/content/src/HTMLTableCaptionElement.cpp
+++ b/content/html/content/src/HTMLTableCaptionElement.cpp
@@ -21,10 +21,9 @@ HTMLTableCaptionElement::~HTMLTableCaptionElement()
 }
 
 JSObject*
-HTMLTableCaptionElement::WrapNode(JSContext *aCx, JSObject *aScope,
-                                  bool *aTriedToWrap)
+HTMLTableCaptionElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return HTMLTableCaptionElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLTableCaptionElementBinding::Wrap(aCx, aScope, this);
 }
 
 NS_IMPL_ADDREF_INHERITED(HTMLTableCaptionElement, Element)
diff --git a/content/html/content/src/HTMLTableCaptionElement.h b/content/html/content/src/HTMLTableCaptionElement.h
index 56c4ae62bd22..8baa1147c6f1 100644
--- a/content/html/content/src/HTMLTableCaptionElement.h
+++ b/content/html/content/src/HTMLTableCaptionElement.h
@@ -58,8 +58,7 @@ public:
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLTableCellElement.cpp b/content/html/content/src/HTMLTableCellElement.cpp
index e6ba1e332dbe..d91a528534f8 100644
--- a/content/html/content/src/HTMLTableCellElement.cpp
+++ b/content/html/content/src/HTMLTableCellElement.cpp
@@ -25,10 +25,9 @@ HTMLTableCellElement::~HTMLTableCellElement()
 }
 
 JSObject*
-HTMLTableCellElement::WrapNode(JSContext *aCx, JSObject *aScope,
-                               bool *aTriedToWrap)
+HTMLTableCellElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return HTMLTableCellElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLTableCellElementBinding::Wrap(aCx, aScope, this);
 }
 
 NS_IMPL_ADDREF_INHERITED(HTMLTableCellElement, Element)
diff --git a/content/html/content/src/HTMLTableCellElement.h b/content/html/content/src/HTMLTableCellElement.h
index c34c495bf4e2..866031df3df3 100644
--- a/content/html/content/src/HTMLTableCellElement.h
+++ b/content/html/content/src/HTMLTableCellElement.h
@@ -166,8 +166,7 @@ public:
 
   virtual nsIDOMNode* AsDOMNode() { return this; }
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
   HTMLTableElement* GetTable() const;
 
diff --git a/content/html/content/src/HTMLTableColElement.cpp b/content/html/content/src/HTMLTableColElement.cpp
index 3a38915447ac..3ad33ab5d289 100644
--- a/content/html/content/src/HTMLTableColElement.cpp
+++ b/content/html/content/src/HTMLTableColElement.cpp
@@ -25,10 +25,9 @@ HTMLTableColElement::~HTMLTableColElement()
 }
 
 JSObject*
-HTMLTableColElement::WrapNode(JSContext *aCx, JSObject *aScope,
-                              bool *aTriedToWrap)
+HTMLTableColElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return HTMLTableColElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLTableColElementBinding::Wrap(aCx, aScope, this);
 }
 
 NS_IMPL_ADDREF_INHERITED(HTMLTableColElement, Element)
diff --git a/content/html/content/src/HTMLTableColElement.h b/content/html/content/src/HTMLTableColElement.h
index dc8ba768ee90..595dbf01633e 100644
--- a/content/html/content/src/HTMLTableColElement.h
+++ b/content/html/content/src/HTMLTableColElement.h
@@ -99,8 +99,7 @@ public:
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLTableElement.cpp b/content/html/content/src/HTMLTableElement.cpp
index caa63dfc93f5..9ca7080aef5a 100644
--- a/content/html/content/src/HTMLTableElement.cpp
+++ b/content/html/content/src/HTMLTableElement.cpp
@@ -51,11 +51,9 @@ public:
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(TableRowsCollection)
 
   // nsWrapperCache
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap)
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE
   {
-    return mozilla::dom::HTMLCollectionBinding::Wrap(cx, scope, this,
-                                                     triedToWrap);
+    return mozilla::dom::HTMLCollectionBinding::Wrap(cx, scope, this);
   }
 
 protected:
@@ -321,9 +319,9 @@ HTMLTableElement::~HTMLTableElement()
 }
 
 JSObject*
-HTMLTableElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+HTMLTableElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return HTMLTableElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLTableElementBinding::Wrap(aCx, aScope, this);
 }
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(HTMLTableElement, nsGenericHTMLElement)
diff --git a/content/html/content/src/HTMLTableElement.h b/content/html/content/src/HTMLTableElement.h
index 7480cf5d000b..2fc17021f917 100644
--- a/content/html/content/src/HTMLTableElement.h
+++ b/content/html/content/src/HTMLTableElement.h
@@ -203,8 +203,7 @@ public:
   nsMappedAttributes* GetAttributesMappedForCell();
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
   nsIContent* GetChild(nsIAtom *aTag) const
   {
diff --git a/content/html/content/src/HTMLTableRowElement.cpp b/content/html/content/src/HTMLTableRowElement.cpp
index d3db8c37f9a4..67e5fa24330a 100644
--- a/content/html/content/src/HTMLTableRowElement.cpp
+++ b/content/html/content/src/HTMLTableRowElement.cpp
@@ -21,10 +21,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-HTMLTableRowElement::WrapNode(JSContext *aCx, JSObject *aScope,
-                              bool *aTriedToWrap)
+HTMLTableRowElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return HTMLTableRowElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLTableRowElementBinding::Wrap(aCx, aScope, this);
 }
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(HTMLTableRowElement,
diff --git a/content/html/content/src/HTMLTableRowElement.h b/content/html/content/src/HTMLTableRowElement.h
index 716b94d07696..3eec9c732aac 100644
--- a/content/html/content/src/HTMLTableRowElement.h
+++ b/content/html/content/src/HTMLTableRowElement.h
@@ -105,7 +105,7 @@ public:
                                                      nsGenericHTMLElement)
 
 protected:
-  JSObject* WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap);
+  JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
   already_AddRefed<nsIDOMHTMLTableSectionElement> GetSection() const;
   HTMLTableElement* GetTable() const;
diff --git a/content/html/content/src/HTMLTableSectionElement.cpp b/content/html/content/src/HTMLTableSectionElement.cpp
index e36283bbf1e8..58e58ca1f1a8 100644
--- a/content/html/content/src/HTMLTableSectionElement.cpp
+++ b/content/html/content/src/HTMLTableSectionElement.cpp
@@ -21,10 +21,9 @@ namespace dom {
 // you will see the phrases "rowgroup" and "section" used interchangably
 
 JSObject*
-HTMLTableSectionElement::WrapNode(JSContext *aCx, JSObject *aScope,
-                                  bool *aTriedToWrap)
+HTMLTableSectionElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return HTMLTableSectionElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLTableSectionElementBinding::Wrap(aCx, aScope, this);
 }
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(HTMLTableSectionElement,
diff --git a/content/html/content/src/HTMLTableSectionElement.h b/content/html/content/src/HTMLTableSectionElement.h
index 08776c9527d4..e130410ba8c7 100644
--- a/content/html/content/src/HTMLTableSectionElement.h
+++ b/content/html/content/src/HTMLTableSectionElement.h
@@ -89,7 +89,7 @@ public:
 
   virtual nsIDOMNode* AsDOMNode() { return this; }
 protected:
-  JSObject* WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap);
+  JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
   nsRefPtr<nsContentList> mRows;
 };
diff --git a/content/html/content/src/HTMLTextAreaElement.cpp b/content/html/content/src/HTMLTextAreaElement.cpp
index 57ebd73cd68d..44a70ae91272 100644
--- a/content/html/content/src/HTMLTextAreaElement.cpp
+++ b/content/html/content/src/HTMLTextAreaElement.cpp
@@ -1427,10 +1427,9 @@ HTMLTextAreaElement::FieldSetDisabledChanged(bool aNotify)
 }
 
 JSObject*
-HTMLTextAreaElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                              bool* aTriedToWrap)
+HTMLTextAreaElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return HTMLTextAreaElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return HTMLTextAreaElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLTextAreaElement.h b/content/html/content/src/HTMLTextAreaElement.h
index f053c7c39ff4..0beb784c548d 100644
--- a/content/html/content/src/HTMLTextAreaElement.h
+++ b/content/html/content/src/HTMLTextAreaElement.h
@@ -272,8 +272,7 @@ public:
 protected:
   using nsGenericHTMLFormElement::IsSingleLineTextControl; // get rid of the compiler warning
 
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
   nsCOMPtr<nsIControllers> mControllers;
   /** Whether or not the value has changed since its default value was given. */
diff --git a/content/html/content/src/HTMLTimeElement.cpp b/content/html/content/src/HTMLTimeElement.cpp
index 28a24186a808..292c29844d36 100644
--- a/content/html/content/src/HTMLTimeElement.cpp
+++ b/content/html/content/src/HTMLTimeElement.cpp
@@ -37,9 +37,9 @@ NS_HTML_CONTENT_INTERFACE_MAP_END
 NS_IMPL_ELEMENT_CLONE(HTMLTimeElement)
 
 JSObject*
-HTMLTimeElement::WrapNode(JSContext* cx, JSObject* scope, bool* triedToWrap)
+HTMLTimeElement::WrapNode(JSContext* cx, JSObject* scope)
 {
-  return HTMLTimeElementBinding::Wrap(cx, scope, this, triedToWrap);
+  return HTMLTimeElementBinding::Wrap(cx, scope, this);
 }
 
 void
diff --git a/content/html/content/src/HTMLTimeElement.h b/content/html/content/src/HTMLTimeElement.h
index f6ff70e3ca5f..61996d3a15fe 100644
--- a/content/html/content/src/HTMLTimeElement.h
+++ b/content/html/content/src/HTMLTimeElement.h
@@ -49,8 +49,7 @@ public:
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
 protected:
-  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope,
-                             bool* aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/html/content/src/HTMLTitleElement.cpp b/content/html/content/src/HTMLTitleElement.cpp
index 930b5b6a5f77..e85645d990e6 100644
--- a/content/html/content/src/HTMLTitleElement.cpp
+++ b/content/html/content/src/HTMLTitleElement.cpp
@@ -51,9 +51,9 @@ NS_HTML_CONTENT_INTERFACE_MAP_END
 NS_IMPL_ELEMENT_CLONE(HTMLTitleElement)
 
 JSObject*
-HTMLTitleElement::WrapNode(JSContext* cx, JSObject* scope, bool* triedToWrap)
+HTMLTitleElement::WrapNode(JSContext* cx, JSObject* scope)
 {
-  return HTMLTitleElementBinding::Wrap(cx, scope, this, triedToWrap);
+  return HTMLTitleElementBinding::Wrap(cx, scope, this);
 }
 
 
diff --git a/content/html/content/src/HTMLTitleElement.h b/content/html/content/src/HTMLTitleElement.h
index 9d2e7206d927..f26aea59da90 100644
--- a/content/html/content/src/HTMLTitleElement.h
+++ b/content/html/content/src/HTMLTitleElement.h
@@ -70,7 +70,7 @@ public:
 
 protected:
 
-  virtual JSObject* WrapNode(JSContext* cx, JSObject* scope, bool* triedToWrap)
+  virtual JSObject* WrapNode(JSContext* cx, JSObject* scope)
     MOZ_OVERRIDE MOZ_FINAL;
 
 private:
diff --git a/content/html/content/src/HTMLUnknownElement.cpp b/content/html/content/src/HTMLUnknownElement.cpp
index 8e2fbae261be..9c90ba1d92df 100644
--- a/content/html/content/src/HTMLUnknownElement.cpp
+++ b/content/html/content/src/HTMLUnknownElement.cpp
@@ -16,11 +16,10 @@ NS_IMPL_ADDREF_INHERITED(HTMLUnknownElement, Element)
 NS_IMPL_RELEASE_INHERITED(HTMLUnknownElement, Element)
 
 JSObject*
-HTMLUnknownElement::WrapNode(JSContext *aCx, JSObject *aScope,
-                               bool *aTriedToWrap)
+HTMLUnknownElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
   JSObject* obj =
-    HTMLUnknownElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+    HTMLUnknownElementBinding::Wrap(aCx, aScope, this);
   if (obj && Substring(NodeName(), 0, 2).LowerCaseEqualsLiteral("x-")) {
     // If we have a registered x-tag then we fix the prototype.
     JSAutoCompartment ac(aCx, obj);
diff --git a/content/html/content/src/HTMLUnknownElement.h b/content/html/content/src/HTMLUnknownElement.h
index 61ba7cc014b3..3732868b370f 100644
--- a/content/html/content/src/HTMLUnknownElement.h
+++ b/content/html/content/src/HTMLUnknownElement.h
@@ -41,8 +41,7 @@ public:
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/html/content/src/MediaError.cpp b/content/html/content/src/MediaError.cpp
index 2bdeafce5171..076a06cc6885 100644
--- a/content/html/content/src/MediaError.cpp
+++ b/content/html/content/src/MediaError.cpp
@@ -37,10 +37,9 @@ NS_IMETHODIMP MediaError::GetCode(uint16_t* aCode)
 }
 
 JSObject*
-MediaError::WrapObject(JSContext* aCx, JSObject* aScope,
-                       bool* aTriedToWrap)
+MediaError::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return MediaErrorBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return MediaErrorBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/MediaError.h b/content/html/content/src/MediaError.h
index 6dd29e308e2c..7ee64eb66a24 100644
--- a/content/html/content/src/MediaError.h
+++ b/content/html/content/src/MediaError.h
@@ -34,7 +34,7 @@ public:
     return mParent;
   }
 
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   uint16_t Code() const
   {
diff --git a/content/html/content/src/UndoManager.h b/content/html/content/src/UndoManager.h
index bb41df3110fc..73906da565e2 100644
--- a/content/html/content/src/UndoManager.h
+++ b/content/html/content/src/UndoManager.h
@@ -54,11 +54,9 @@ public:
     return mHostNode;
   }
 
-  JSObject* WrapObject(JSContext* aCx, JSObject* aScope,
-                       bool* aTriedToWrap)
+  JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE
   {
-    return mozilla::dom::UndoManagerBinding::Wrap(aCx, aScope, this,
-                                                  aTriedToWrap);
+    return mozilla::dom::UndoManagerBinding::Wrap(aCx, aScope, this);
   }
 
   nsITransactionManager* GetTransactionManager();
diff --git a/content/html/content/src/ValidityState.cpp b/content/html/content/src/ValidityState.cpp
index 09b94457eb0e..d69e6852ba08 100644
--- a/content/html/content/src/ValidityState.cpp
+++ b/content/html/content/src/ValidityState.cpp
@@ -96,10 +96,9 @@ ValidityState::GetValid(bool* aValid)
 }
 
 JSObject*
-ValidityState::WrapObject(JSContext* aCx, JSObject* aScope,
-                          bool* aTriedToWrap)
+ValidityState::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return ValidityStateBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return ValidityStateBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/html/content/src/ValidityState.h b/content/html/content/src/ValidityState.h
index c1edebe19fb6..2d206ffa7663 100644
--- a/content/html/content/src/ValidityState.h
+++ b/content/html/content/src/ValidityState.h
@@ -30,8 +30,7 @@ public:
     return mConstraintValidation;
   }
 
-  virtual JSObject* WrapObject(JSContext *aCx, JSObject *aScope,
-                               bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapObject(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
   // Web IDL methods
   bool ValueMissing() const
diff --git a/content/html/content/src/nsClientRect.cpp b/content/html/content/src/nsClientRect.cpp
index bf53d231c6d1..1ca4df9cd124 100644
--- a/content/html/content/src/nsClientRect.cpp
+++ b/content/html/content/src/nsClientRect.cpp
@@ -95,10 +95,9 @@ nsClientRectList::Item(uint32_t aIndex, nsIDOMClientRect** aReturn)
 }
 
 JSObject*
-nsClientRectList::WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap)
+nsClientRectList::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return mozilla::dom::ClientRectListBinding::Wrap(cx, scope, this,
-                                                   triedToWrap);
+  return mozilla::dom::ClientRectListBinding::Wrap(cx, scope, this);
 }
 
 static double
diff --git a/content/html/content/src/nsClientRect.h b/content/html/content/src/nsClientRect.h
index f70a821c1752..b71f36e6a103 100644
--- a/content/html/content/src/nsClientRect.h
+++ b/content/html/content/src/nsClientRect.h
@@ -47,8 +47,7 @@ public:
 
   NS_DECL_NSIDOMCLIENTRECTLIST
   
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap);
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
   nsISupports* GetParentObject()
   {
diff --git a/content/html/content/src/nsDOMStringMap.cpp b/content/html/content/src/nsDOMStringMap.cpp
index 577ef6af2c52..5184e70c0a0e 100644
--- a/content/html/content/src/nsDOMStringMap.cpp
+++ b/content/html/content/src/nsDOMStringMap.cpp
@@ -58,10 +58,9 @@ nsDOMStringMap::~nsDOMStringMap()
 
 /* virtual */
 JSObject*
-nsDOMStringMap::WrapObject(JSContext *cx, JSObject *scope,
-                           bool *triedToWrap)
+nsDOMStringMap::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return DOMStringMapBinding::Wrap(cx, scope, this, triedToWrap);
+  return DOMStringMapBinding::Wrap(cx, scope, this);
 }
 
 void
diff --git a/content/html/content/src/nsDOMStringMap.h b/content/html/content/src/nsDOMStringMap.h
index 9b1d252ebb2e..610fc82f5caa 100644
--- a/content/html/content/src/nsDOMStringMap.h
+++ b/content/html/content/src/nsDOMStringMap.h
@@ -33,8 +33,7 @@ public:
   nsDOMStringMap(nsGenericHTMLElement* aElement);
 
   // WebIDL API
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap);
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
   void NamedGetter(const nsAString& aProp, bool& found, nsString& aResult) const;
   void NamedSetter(const nsAString& aProp, const nsAString& aValue,
                    mozilla::ErrorResult& rv);
diff --git a/content/html/content/src/nsHTMLFormElement.cpp b/content/html/content/src/nsHTMLFormElement.cpp
index 79e9ba81cf3f..7f0944a34058 100644
--- a/content/html/content/src/nsHTMLFormElement.cpp
+++ b/content/html/content/src/nsHTMLFormElement.cpp
@@ -124,10 +124,9 @@ public:
   nsresult GetSortedControls(nsTArray<nsGenericHTMLFormElement*>& aControls) const;
 
   // nsWrapperCache
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap)
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope)
   {
-    return HTMLCollectionBinding::Wrap(cx, scope, this, triedToWrap);
+    return HTMLCollectionBinding::Wrap(cx, scope, this);
   }
 
   nsHTMLFormElement* mForm;  // WEAK - the form owns me
diff --git a/content/html/content/src/nsHTMLInputElement.cpp b/content/html/content/src/nsHTMLInputElement.cpp
index 1809ef6491c2..e8254cf96646 100644
--- a/content/html/content/src/nsHTMLInputElement.cpp
+++ b/content/html/content/src/nsHTMLInputElement.cpp
@@ -3112,9 +3112,6 @@ nsHTMLInputElement::PostHandleEventForRangeThumb(nsEventChainPostVisitor& aVisit
         }
       }
       aVisitor.mEvent->mFlags.mMultipleActionsPrevented = true;
-      // Also set this to tell the native code on Android that it should not
-      // scroll:
-      aVisitor.mEventStatus = nsEventStatus_eConsumeNoDefault;
     } break;
 
     case NS_MOUSE_MOVE:
@@ -3130,9 +3127,6 @@ nsHTMLInputElement::PostHandleEventForRangeThumb(nsEventChainPostVisitor& aVisit
       SetValueOfRangeForUserEvent(rangeFrame->GetValueAtEventPoint(
                                     static_cast<nsInputEvent*>(aVisitor.mEvent)));
       aVisitor.mEvent->mFlags.mMultipleActionsPrevented = true;
-      // Also set this to tell the native code on Android that it should not
-      // scroll:
-      aVisitor.mEventStatus = nsEventStatus_eConsumeNoDefault;
       break;
 
     case NS_MOUSE_BUTTON_UP:
diff --git a/content/html/content/src/nsHTMLMediaElement.cpp b/content/html/content/src/nsHTMLMediaElement.cpp
index 949ccc996843..604e6e27a9b2 100644
--- a/content/html/content/src/nsHTMLMediaElement.cpp
+++ b/content/html/content/src/nsHTMLMediaElement.cpp
@@ -3161,7 +3161,7 @@ nsIContent* nsHTMLMediaElement::GetNextSource()
   nsresult rv = NS_OK;
   if (!mSourcePointer) {
     // First time this has been run, create a selection to cover children.
-    mSourcePointer = new nsRange();
+    mSourcePointer = new nsRange(this);
 
     rv = mSourcePointer->SelectNodeContents(thisDomNode);
     if (NS_FAILED(rv)) return nullptr;
diff --git a/content/html/content/src/nsHTMLSelectElement.cpp b/content/html/content/src/nsHTMLSelectElement.cpp
index 60fbdee3b167..c819d6bdbddf 100644
--- a/content/html/content/src/nsHTMLSelectElement.cpp
+++ b/content/html/content/src/nsHTMLSelectElement.cpp
@@ -2018,10 +2018,9 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE(nsHTMLOptionCollection)
 
 
 JSObject*
-nsHTMLOptionCollection::WrapObject(JSContext* cx, JSObject* scope,
-                                   bool* triedToWrap)
+nsHTMLOptionCollection::WrapObject(JSContext* cx, JSObject* scope)
 {
-  return HTMLOptionsCollectionBinding::Wrap(cx, scope, this, triedToWrap);
+  return HTMLOptionsCollectionBinding::Wrap(cx, scope, this);
 }
 
 NS_IMETHODIMP
diff --git a/content/html/content/src/nsHTMLSelectElement.h b/content/html/content/src/nsHTMLSelectElement.h
index a23da7dd7375..0e7c9151d884 100644
--- a/content/html/content/src/nsHTMLSelectElement.h
+++ b/content/html/content/src/nsHTMLSelectElement.h
@@ -47,8 +47,7 @@ public:
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
 
-  virtual JSObject* WrapObject(JSContext* cx, JSObject* scope,
-                               bool* triedToWrap);
+  virtual JSObject* WrapObject(JSContext* cx, JSObject* scope) MOZ_OVERRIDE;
 
   // nsIDOMHTMLOptionsCollection interface
   NS_DECL_NSIDOMHTMLOPTIONSCOLLECTION
diff --git a/content/html/document/src/nsHTMLDocument.cpp b/content/html/document/src/nsHTMLDocument.cpp
index 098e76b5db1e..3af8491baa0c 100644
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -2605,7 +2605,7 @@ nsHTMLDocument::DeferredContentEditableCountChange(nsIContent *aElement)
       nsCOMPtr<nsIEditor> editor;
       docshell->GetEditor(getter_AddRefs(editor));
       if (editor) {
-        nsRefPtr<nsRange> range = new nsRange();
+        nsRefPtr<nsRange> range = new nsRange(aElement);
         rv = range->SelectNode(node);
         if (NS_FAILED(rv)) {
           // The node might be detached from the document at this point,
diff --git a/content/mathml/content/src/nsMathMLElement.cpp b/content/mathml/content/src/nsMathMLElement.cpp
index e813ee744853..3a5ba85d3cd9 100644
--- a/content/mathml/content/src/nsMathMLElement.cpp
+++ b/content/mathml/content/src/nsMathMLElement.cpp
@@ -941,7 +941,7 @@ nsMathMLElement::UnsetAttr(int32_t aNameSpaceID, nsIAtom* aAttr,
 }
 
 JSObject*
-nsMathMLElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+nsMathMLElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return ElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return ElementBinding::Wrap(aCx, aScope, this);
 }
diff --git a/content/mathml/content/src/nsMathMLElement.h b/content/mathml/content/src/nsMathMLElement.h
index 1f5377fc0c03..6a09018be44b 100644
--- a/content/mathml/content/src/nsMathMLElement.h
+++ b/content/mathml/content/src/nsMathMLElement.h
@@ -106,8 +106,7 @@ public:
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
 private:
   bool mIncrementScriptLevel;
diff --git a/content/media/AudioStream.cpp b/content/media/AudioStream.cpp
index 66b8fb7cb5c2..7f64ae4be153 100644
--- a/content/media/AudioStream.cpp
+++ b/content/media/AudioStream.cpp
@@ -178,6 +178,31 @@ static sa_stream_type_t ConvertChannelToSAType(dom::AudioChannelType aType)
   }
 }
 
+#if defined(MOZ_CUBEB) && (__ANDROID__)
+static cubeb_stream_type ConvertChannelToCubebType(dom::AudioChannelType aType)
+{
+  switch(aType) {
+    case dom::AUDIO_CHANNEL_NORMAL:
+      return CUBEB_STREAM_TYPE_SYSTEM;
+    case dom::AUDIO_CHANNEL_CONTENT:
+      return CUBEB_STREAM_TYPE_MUSIC;
+    case dom::AUDIO_CHANNEL_NOTIFICATION:
+      return CUBEB_STREAM_TYPE_NOTIFICATION;
+    case dom::AUDIO_CHANNEL_ALARM:
+      return CUBEB_STREAM_TYPE_ALARM;
+    case dom::AUDIO_CHANNEL_TELEPHONY:
+      return CUBEB_STREAM_TYPE_VOICE_CALL;
+    case dom::AUDIO_CHANNEL_RINGER:
+      return CUBEB_STREAM_TYPE_RING;
+    // Currently Android openSLES library doesn't support FORCE_AUDIBLE yet.
+    case dom::AUDIO_CHANNEL_PUBLICNOTIFICATION:
+    default:
+      NS_ERROR("The value of AudioChannelType is invalid");
+      return CUBEB_STREAM_TYPE_MAX;
+  }
+}
+#endif
+
 AudioStream::AudioStream()
 : mInRate(0),
   mOutRate(0),
@@ -760,6 +785,13 @@ BufferedAudioStream::Init(int32_t aNumChannels, int32_t aRate,
   cubeb_stream_params params;
   params.rate = aRate;
   params.channels = aNumChannels;
+#if defined(__ANDROID__)
+  params.stream_type = ConvertChannelToCubebType(aAudioChannelType);
+
+  if (params.stream_type == CUBEB_STREAM_TYPE_MAX) {
+    return NS_ERROR_INVALID_ARG;
+  }
+#endif
   if (AUDIO_OUTPUT_FORMAT == AUDIO_FORMAT_S16) {
     params.format = CUBEB_SAMPLE_S16NE;
   } else {
diff --git a/content/media/DOMMediaStream.cpp b/content/media/DOMMediaStream.cpp
index 6d8115f7b52f..fe5bb77c0415 100644
--- a/content/media/DOMMediaStream.cpp
+++ b/content/media/DOMMediaStream.cpp
@@ -33,9 +33,9 @@ DOMMediaStream::~DOMMediaStream()
 }
 
 JSObject*
-DOMMediaStream::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+DOMMediaStream::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return dom::MediaStreamBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return dom::MediaStreamBinding::Wrap(aCx, aScope, this);
 }
 
 double
@@ -99,9 +99,9 @@ DOMLocalMediaStream::~DOMLocalMediaStream()
 }
 
 JSObject*
-DOMLocalMediaStream::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+DOMLocalMediaStream::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return dom::LocalMediaStreamBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return dom::LocalMediaStreamBinding::Wrap(aCx, aScope, this);
 }
 
 void
diff --git a/content/media/DOMMediaStream.h b/content/media/DOMMediaStream.h
index 300ded072f21..2b15570e29b2 100644
--- a/content/media/DOMMediaStream.h
+++ b/content/media/DOMMediaStream.h
@@ -51,7 +51,7 @@ public:
   {
     return mWindow;
   }
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   double CurrentTime();
   MediaStream* GetStream() { return mStream; }
@@ -119,7 +119,7 @@ public:
 
   NS_DECL_ISUPPORTS_INHERITED
 
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   virtual void Stop();
 
diff --git a/content/media/webaudio/AudioBuffer.cpp b/content/media/webaudio/AudioBuffer.cpp
index c48f3d384573..155ca21ae58c 100644
--- a/content/media/webaudio/AudioBuffer.cpp
+++ b/content/media/webaudio/AudioBuffer.cpp
@@ -84,10 +84,9 @@ AudioBuffer::InitializeBuffers(uint32_t aNumberOfChannels, JSContext* aJSContext
 }
 
 JSObject*
-AudioBuffer::WrapObject(JSContext* aCx, JSObject* aScope,
-                        bool* aTriedToWrap)
+AudioBuffer::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return AudioBufferBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return AudioBufferBinding::Wrap(aCx, aScope, this);
 }
 
 void
diff --git a/content/media/webaudio/AudioBuffer.h b/content/media/webaudio/AudioBuffer.h
index 3a7293947e93..2d3be3c26acd 100644
--- a/content/media/webaudio/AudioBuffer.h
+++ b/content/media/webaudio/AudioBuffer.h
@@ -53,8 +53,7 @@ public:
     return mContext;
   }
 
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope,
-                               bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   float SampleRate() const
   {
diff --git a/content/media/webaudio/AudioContext.cpp b/content/media/webaudio/AudioContext.cpp
index 7798666ef860..a1e827c19aa1 100644
--- a/content/media/webaudio/AudioContext.cpp
+++ b/content/media/webaudio/AudioContext.cpp
@@ -45,10 +45,9 @@ AudioContext::~AudioContext()
 }
 
 JSObject*
-AudioContext::WrapObject(JSContext* aCx, JSObject* aScope,
-                         bool* aTriedToWrap)
+AudioContext::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return AudioContextBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return AudioContextBinding::Wrap(aCx, aScope, this);
 }
 
 /* static */ already_AddRefed<AudioContext>
diff --git a/content/media/webaudio/AudioContext.h b/content/media/webaudio/AudioContext.h
index 0668423a611b..9d97ebc90138 100644
--- a/content/media/webaudio/AudioContext.h
+++ b/content/media/webaudio/AudioContext.h
@@ -63,8 +63,7 @@ public:
     mDecoder.Shutdown();
   }
 
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope,
-                               bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   static already_AddRefed<AudioContext>
   Constructor(const GlobalObject& aGlobal, ErrorResult& aRv);
diff --git a/content/media/webaudio/AudioDestinationNode.cpp b/content/media/webaudio/AudioDestinationNode.cpp
index b62c34a37163..07467d955ba8 100644
--- a/content/media/webaudio/AudioDestinationNode.cpp
+++ b/content/media/webaudio/AudioDestinationNode.cpp
@@ -36,10 +36,9 @@ AudioDestinationNode::AudioDestinationNode(AudioContext* aContext, MediaStreamGr
 }
 
 JSObject*
-AudioDestinationNode::WrapObject(JSContext* aCx, JSObject* aScope,
-                                 bool* aTriedToWrap)
+AudioDestinationNode::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return AudioDestinationNodeBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return AudioDestinationNodeBinding::Wrap(aCx, aScope, this);
 }
 
 }
diff --git a/content/media/webaudio/AudioDestinationNode.h b/content/media/webaudio/AudioDestinationNode.h
index 94bf2d8a79ab..34d7b705e096 100644
--- a/content/media/webaudio/AudioDestinationNode.h
+++ b/content/media/webaudio/AudioDestinationNode.h
@@ -28,8 +28,7 @@ public:
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_INHERITED(AudioDestinationNode,
                                                          AudioNode)
 
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope,
-                               bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   virtual uint32_t NumberOfOutputs() const MOZ_FINAL MOZ_OVERRIDE
   {
diff --git a/content/media/webaudio/AudioListener.cpp b/content/media/webaudio/AudioListener.cpp
index 56cfd040a446..8b8cbc59355c 100644
--- a/content/media/webaudio/AudioListener.cpp
+++ b/content/media/webaudio/AudioListener.cpp
@@ -21,21 +21,20 @@ NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(AudioListener, Release)
 AudioListener::AudioListener(AudioContext* aContext)
   : mContext(aContext)
   , mPosition()
-  , mOrientation(0.f, 0.f, -1.f)
-  , mUpVector(0.f, 1.f, 0.f)
+  , mOrientation(0., 0., -1.)
+  , mUpVector(0., 1., 0.)
   , mVelocity()
-  , mDopplerFactor(1.f)
-  , mSpeedOfSound(343.3f) // meters/second
+  , mDopplerFactor(1.)
+  , mSpeedOfSound(343.3) // meters/second
 {
   MOZ_ASSERT(aContext);
   SetIsDOMBinding();
 }
 
 JSObject*
-AudioListener::WrapObject(JSContext* aCx, JSObject* aScope,
-                          bool* aTriedToWrap)
+AudioListener::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return AudioListenerBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return AudioListenerBinding::Wrap(aCx, aScope, this);
 }
 
 }
diff --git a/content/media/webaudio/AudioListener.h b/content/media/webaudio/AudioListener.h
index ecf6e38a65cd..5f43a932f2c2 100644
--- a/content/media/webaudio/AudioListener.h
+++ b/content/media/webaudio/AudioListener.h
@@ -37,36 +37,35 @@ public:
     return mContext;
   }
 
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope,
-                               bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
-  float DopplerFactor() const
+  double DopplerFactor() const
   {
     return mDopplerFactor;
   }
-  void SetDopplerFactor(float aDopplerFactor)
+  void SetDopplerFactor(double aDopplerFactor)
   {
     mDopplerFactor = aDopplerFactor;
   }
 
-  float SpeedOfSound() const
+  double SpeedOfSound() const
   {
     return mSpeedOfSound;
   }
-  void SetSpeedOfSound(float aSpeedOfSound)
+  void SetSpeedOfSound(double aSpeedOfSound)
   {
     mSpeedOfSound = aSpeedOfSound;
   }
 
-  void SetPosition(float aX, float aY, float aZ)
+  void SetPosition(double aX, double aY, double aZ)
   {
     mPosition.x = aX;
     mPosition.y = aY;
     mPosition.z = aZ;
   }
 
-  void SetOrientation(float aX, float aY, float aZ,
-                      float aXUp, float aYUp, float aZUp)
+  void SetOrientation(double aX, double aY, double aZ,
+                      double aXUp, double aYUp, double aZUp)
   {
     mOrientation.x = aX;
     mOrientation.y = aY;
@@ -76,7 +75,7 @@ public:
     mUpVector.z = aZUp;
   }
 
-  void SetVelocity(float aX, float aY, float aZ)
+  void SetVelocity(double aX, double aY, double aZ)
   {
     mVelocity.x = aX;
     mVelocity.y = aY;
@@ -89,8 +88,8 @@ private:
   ThreeDPoint mOrientation;
   ThreeDPoint mUpVector;
   ThreeDPoint mVelocity;
-  float mDopplerFactor;
-  float mSpeedOfSound;
+  double mDopplerFactor;
+  double mSpeedOfSound;
 };
 
 }
diff --git a/content/media/webaudio/AudioParam.cpp b/content/media/webaudio/AudioParam.cpp
index 38e506b12414..397a0f4c9b19 100644
--- a/content/media/webaudio/AudioParam.cpp
+++ b/content/media/webaudio/AudioParam.cpp
@@ -41,10 +41,9 @@ AudioParam::~AudioParam()
 }
 
 JSObject*
-AudioParam::WrapObject(JSContext* aCx, JSObject* aScope,
-                       bool* aTriedToWrap)
+AudioParam::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return AudioParamBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return AudioParamBinding::Wrap(aCx, aScope, this);
 }
 
 }
diff --git a/content/media/webaudio/AudioParam.h b/content/media/webaudio/AudioParam.h
index 919c7d5f434d..a9918d9073ec 100644
--- a/content/media/webaudio/AudioParam.h
+++ b/content/media/webaudio/AudioParam.h
@@ -49,8 +49,7 @@ public:
     return mNode->Context();
   }
 
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope,
-                               bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   // We override SetValueCurveAtTime to convert the Float32Array to the wrapper
   // object.
diff --git a/content/media/webaudio/PannerNode.cpp b/content/media/webaudio/PannerNode.cpp
index f10e720030ed..f120934dcbf4 100644
--- a/content/media/webaudio/PannerNode.cpp
+++ b/content/media/webaudio/PannerNode.cpp
@@ -5,24 +5,23 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "PannerNode.h"
-#include "mozilla/dom/PannerNodeBinding.h"
 
 namespace mozilla {
 namespace dom {
 
 PannerNode::PannerNode(AudioContext* aContext)
   : AudioNode(aContext)
-  , mPanningModel(PanningModelEnum::HRTF)
-  , mDistanceModel(DistanceModelEnum::INVERSE_DISTANCE)
+  , mPanningModel(PanningModelTypeValues::HRTF)
+  , mDistanceModel(DistanceModelTypeValues::Inverse)
   , mPosition()
-  , mOrientation(1.f, 0.f, 0.f)
+  , mOrientation(1., 0., 0.)
   , mVelocity()
-  , mRefDistance(1.f)
-  , mMaxDistance(10000.f)
-  , mRolloffFactor(1.f)
-  , mConeInnerAngle(360.f)
-  , mConeOuterAngle(360.f)
-  , mConeOuterGain(0.f)
+  , mRefDistance(1.)
+  , mMaxDistance(10000.)
+  , mRolloffFactor(1.)
+  , mConeInnerAngle(360.)
+  , mConeOuterAngle(360.)
+  , mConeOuterGain(0.)
 {
 }
 
diff --git a/content/media/webaudio/PannerNode.h b/content/media/webaudio/PannerNode.h
index 8dc27eb7fc7b..a2376dbac903 100644
--- a/content/media/webaudio/PannerNode.h
+++ b/content/media/webaudio/PannerNode.h
@@ -11,6 +11,7 @@
 #include "AudioParam.h"
 #include "mozilla/ErrorResult.h"
 #include "mozilla/TypedEnum.h"
+#include "mozilla/dom/PannerNodeBinding.h"
 #include "ThreeDPoint.h"
 
 namespace mozilla {
@@ -18,19 +19,6 @@ namespace dom {
 
 class AudioContext;
 
-MOZ_BEGIN_ENUM_CLASS(PanningModelEnum, uint16_t)
-  EQUALPOWER = 0,
-  HRTF = 1,
-  SOUNDFIELD = 2,
-  Max = 2
-MOZ_END_ENUM_CLASS(PanningModelEnum)
-MOZ_BEGIN_ENUM_CLASS(DistanceModelEnum, uint16_t)
-  LINEAR_DISTANCE = 0,
-  INVERSE_DISTANCE = 1,
-  EXPONENTIAL_DISTANCE = 2,
-  Max = 2
-MOZ_END_ENUM_CLASS(DistanceModelEnum)
-
 class PannerNode : public AudioNode
 {
 public:
@@ -38,123 +26,111 @@ public:
 
   virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope);
 
-  uint16_t PanningModel() const
+  PanningModelType PanningModel() const
   {
-    return static_cast<uint16_t> (mPanningModel);
+    return mPanningModel;
   }
-  void SetPanningModel(uint16_t aPanningModel, ErrorResult& aRv)
+  void SetPanningModel(PanningModelType aPanningModel)
   {
-    PanningModelEnum panningModel =
-      static_cast<PanningModelEnum> (aPanningModel);
-    if (panningModel > PanningModelEnum::Max) {
-      aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
-    } else {
-      mPanningModel = panningModel;
-    }
+    mPanningModel = aPanningModel;
   }
 
-  uint16_t DistanceModel() const
+  DistanceModelType DistanceModel() const
   {
-    return static_cast<uint16_t> (mDistanceModel);
+    return mDistanceModel;
   }
-  void SetDistanceModel(uint16_t aDistanceModel, ErrorResult& aRv)
+  void SetDistanceModel(DistanceModelType aDistanceModel)
   {
-    DistanceModelEnum distanceModel =
-      static_cast<DistanceModelEnum> (aDistanceModel);
-    if (distanceModel > DistanceModelEnum::Max) {
-      aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
-    } else {
-      mDistanceModel = distanceModel;
-    }
+    mDistanceModel = aDistanceModel;
   }
 
-  void SetPosition(float aX, float aY, float aZ)
+  void SetPosition(double aX, double aY, double aZ)
   {
     mPosition.x = aX;
     mPosition.y = aY;
     mPosition.z = aZ;
   }
 
-  void SetOrientation(float aX, float aY, float aZ)
+  void SetOrientation(double aX, double aY, double aZ)
   {
     mOrientation.x = aX;
     mOrientation.y = aY;
     mOrientation.z = aZ;
   }
 
-  void SetVelocity(float aX, float aY, float aZ)
+  void SetVelocity(double aX, double aY, double aZ)
   {
     mVelocity.x = aX;
     mVelocity.y = aY;
     mVelocity.z = aZ;
   }
 
-  float RefDistance() const
+  double RefDistance() const
   {
     return mRefDistance;
   }
-  void SetRefDistance(float aRefDistance)
+  void SetRefDistance(double aRefDistance)
   {
     mRefDistance = aRefDistance;
   }
 
-  float MaxDistance() const
+  double MaxDistance() const
   {
     return mMaxDistance;
   }
-  void SetMaxDistance(float aMaxDistance)
+  void SetMaxDistance(double aMaxDistance)
   {
     mMaxDistance = aMaxDistance;
   }
 
-  float RolloffFactor() const
+  double RolloffFactor() const
   {
     return mRolloffFactor;
   }
-  void SetRolloffFactor(float aRolloffFactor)
+  void SetRolloffFactor(double aRolloffFactor)
   {
     mRolloffFactor = aRolloffFactor;
   }
 
-  float ConeInnerAngle() const
+  double ConeInnerAngle() const
   {
     return mConeInnerAngle;
   }
-  void SetConeInnerAngle(float aConeInnerAngle)
+  void SetConeInnerAngle(double aConeInnerAngle)
   {
     mConeInnerAngle = aConeInnerAngle;
   }
 
-  float ConeOuterAngle() const
+  double ConeOuterAngle() const
   {
     return mConeOuterAngle;
   }
-  void SetConeOuterAngle(float aConeOuterAngle)
+  void SetConeOuterAngle(double aConeOuterAngle)
   {
     mConeOuterAngle = aConeOuterAngle;
   }
 
-  float ConeOuterGain() const
+  double ConeOuterGain() const
   {
     return mConeOuterGain;
   }
-  void SetConeOuterGain(float aConeOuterGain)
+  void SetConeOuterGain(double aConeOuterGain)
   {
     mConeOuterGain = aConeOuterGain;
   }
 
 private:
-  PanningModelEnum mPanningModel;
-  DistanceModelEnum mDistanceModel;
+  PanningModelType mPanningModel;
+  DistanceModelType mDistanceModel;
   ThreeDPoint mPosition;
   ThreeDPoint mOrientation;
   ThreeDPoint mVelocity;
-  float mRefDistance;
-  float mMaxDistance;
-  float mRolloffFactor;
-  float mConeInnerAngle;
-  float mConeOuterAngle;
-  float mConeOuterGain;
+  double mRefDistance;
+  double mMaxDistance;
+  double mRolloffFactor;
+  double mConeInnerAngle;
+  double mConeOuterAngle;
+  double mConeOuterGain;
 };
 
 }
diff --git a/content/media/webaudio/ThreeDPoint.h b/content/media/webaudio/ThreeDPoint.h
index 20e91d67129d..8a3e460a01da 100644
--- a/content/media/webaudio/ThreeDPoint.h
+++ b/content/media/webaudio/ThreeDPoint.h
@@ -13,19 +13,19 @@ namespace dom {
 
 struct ThreeDPoint {
   ThreeDPoint()
-    : x(0.f)
-    , y(0.f)
-    , z(0.f)
+    : x(0.)
+    , y(0.)
+    , z(0.)
   {
   }
-  ThreeDPoint(float aX, float aY, float aZ)
+  ThreeDPoint(double aX, double aY, double aZ)
     : x(aX)
     , y(aY)
     , z(aZ)
   {
   }
 
-  float x, y, z;
+  double x, y, z;
 };
 
 }
diff --git a/content/media/webaudio/test/test_pannerNode.html b/content/media/webaudio/test/test_pannerNode.html
index b531ebe7a8fc..66f9f4cb29d3 100644
--- a/content/media/webaudio/test/test_pannerNode.html
+++ b/content/media/webaudio/test/test_pannerNode.html
@@ -35,8 +35,8 @@ addLoadEvent(function() {
   panner.connect(destination);
 
   // Verify default values
-  is(panner.panningModel, 1, "Correct default value for panning model");
-  is(panner.distanceModel, 1, "Correct default value for distance model");
+  is(panner.panningModel, "HRTF", "Correct default value for panning model");
+  is(panner.distanceModel, "inverse", "Correct default value for distance model");
   near(panner.refDistance, 1, "Correct default value for ref distance");
   near(panner.maxDistance, 10000, "Correct default value for max distance");
   near(panner.rolloffFactor, 1, "Correct default value for rolloff factor");
diff --git a/content/media/wmf/WMFSourceReaderCallback.cpp b/content/media/wmf/WMFSourceReaderCallback.cpp
index 66ce5d7d1b6b..9aee5f56c62c 100644
--- a/content/media/wmf/WMFSourceReaderCallback.cpp
+++ b/content/media/wmf/WMFSourceReaderCallback.cpp
@@ -10,8 +10,8 @@
 namespace mozilla {
 
 #ifdef PR_LOGGING
-extern PRLogModuleInfo* gMediaDecoderLog;
-#define LOG(...) PR_LOG(gMediaDecoderLog, PR_LOG_DEBUG, (__VA_ARGS__))
+static PRLogModuleInfo* gWMFSourceReaderCallbackLog = nullptr;
+#define LOG(...) PR_LOG(gWMFSourceReaderCallbackLog, PR_LOG_DEBUG, (__VA_ARGS__))
 #else
 #define LOG(...)
 #endif
@@ -44,6 +44,11 @@ WMFSourceReaderCallback::WMFSourceReaderCallback()
   , mReadFinished(false)
   , mMonitor("WMFSourceReaderCallback")
 {
+#ifdef PR_LOGGING
+  if (!gWMFSourceReaderCallbackLog) {
+    gWMFSourceReaderCallbackLog = PR_NewLogModule("WMFSourceReaderCallback");
+  }
+#endif
 }
 
 HRESULT
diff --git a/content/svg/content/src/DOMSVGAnimatedLengthList.cpp b/content/svg/content/src/DOMSVGAnimatedLengthList.cpp
index 775076f6f2d7..6247cc84a949 100644
--- a/content/svg/content/src/DOMSVGAnimatedLengthList.cpp
+++ b/content/svg/content/src/DOMSVGAnimatedLengthList.cpp
@@ -30,9 +30,9 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(DOMSVGAnimatedLengthList)
 NS_INTERFACE_MAP_END
 
 JSObject*
-DOMSVGAnimatedLengthList::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+DOMSVGAnimatedLengthList::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return dom::SVGAnimatedLengthListBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return dom::SVGAnimatedLengthListBinding::Wrap(aCx, aScope, this);
 }
 
 already_AddRefed<DOMSVGLengthList>
diff --git a/content/svg/content/src/DOMSVGAnimatedLengthList.h b/content/svg/content/src/DOMSVGAnimatedLengthList.h
index 2bea710b22cc..32223c67ceeb 100644
--- a/content/svg/content/src/DOMSVGAnimatedLengthList.h
+++ b/content/svg/content/src/DOMSVGAnimatedLengthList.h
@@ -160,7 +160,7 @@ public:
 
   // WebIDL
   nsSVGElement* GetParentObject() const { return mElement; }
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
   // These aren't weak refs because mBaseVal and mAnimVal are weak
   already_AddRefed<DOMSVGLengthList> BaseVal();
   already_AddRefed<DOMSVGLengthList> AnimVal();
diff --git a/content/svg/content/src/DOMSVGAnimatedNumberList.cpp b/content/svg/content/src/DOMSVGAnimatedNumberList.cpp
index a4008e07a09e..fac2469ed1a2 100644
--- a/content/svg/content/src/DOMSVGAnimatedNumberList.cpp
+++ b/content/svg/content/src/DOMSVGAnimatedNumberList.cpp
@@ -30,9 +30,9 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(DOMSVGAnimatedNumberList)
 NS_INTERFACE_MAP_END
 
 JSObject*
-DOMSVGAnimatedNumberList::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+DOMSVGAnimatedNumberList::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return mozilla::dom::SVGAnimatedNumberListBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return mozilla::dom::SVGAnimatedNumberListBinding::Wrap(aCx, aScope, this);
 }
 
 already_AddRefed<DOMSVGNumberList>
diff --git a/content/svg/content/src/DOMSVGAnimatedNumberList.h b/content/svg/content/src/DOMSVGAnimatedNumberList.h
index 0b6fcc74df8d..a30f9b39c7bd 100644
--- a/content/svg/content/src/DOMSVGAnimatedNumberList.h
+++ b/content/svg/content/src/DOMSVGAnimatedNumberList.h
@@ -90,7 +90,7 @@ public:
 
   // WebIDL
   nsSVGElement* GetParentObject() const { return mElement; }
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
   // These aren't weak refs because mBaseVal and mAnimVal are weak
   already_AddRefed<DOMSVGNumberList> BaseVal();
   already_AddRefed<DOMSVGNumberList> AnimVal();
diff --git a/content/svg/content/src/DOMSVGAnimatedTransformList.cpp b/content/svg/content/src/DOMSVGAnimatedTransformList.cpp
index 9189125c0b07..8bac16a01a1e 100644
--- a/content/svg/content/src/DOMSVGAnimatedTransformList.cpp
+++ b/content/svg/content/src/DOMSVGAnimatedTransformList.cpp
@@ -27,9 +27,9 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(DOMSVGAnimatedTransformList)
 NS_INTERFACE_MAP_END
 
 JSObject*
-DOMSVGAnimatedTransformList::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+DOMSVGAnimatedTransformList::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return mozilla::dom::SVGAnimatedTransformListBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return mozilla::dom::SVGAnimatedTransformListBinding::Wrap(aCx, aScope, this);
 }
 
 //----------------------------------------------------------------------
diff --git a/content/svg/content/src/DOMSVGAnimatedTransformList.h b/content/svg/content/src/DOMSVGAnimatedTransformList.h
index d2393355cf95..36b7b399b220 100644
--- a/content/svg/content/src/DOMSVGAnimatedTransformList.h
+++ b/content/svg/content/src/DOMSVGAnimatedTransformList.h
@@ -89,7 +89,7 @@ public:
 
   // WebIDL
   nsSVGElement* GetParentObject() const { return mElement; }
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
   // These aren't weak refs because mBaseVal and mAnimVal are weak
   already_AddRefed<DOMSVGTransformList> BaseVal();
   already_AddRefed<DOMSVGTransformList> AnimVal();
diff --git a/content/svg/content/src/DOMSVGLengthList.cpp b/content/svg/content/src/DOMSVGLengthList.cpp
index ac6139ea2b40..3f060b289f0f 100644
--- a/content/svg/content/src/DOMSVGLengthList.cpp
+++ b/content/svg/content/src/DOMSVGLengthList.cpp
@@ -68,9 +68,9 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(DOMSVGLengthList)
 NS_INTERFACE_MAP_END
 
 JSObject*
-DOMSVGLengthList::WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap)
+DOMSVGLengthList::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return mozilla::dom::SVGLengthListBinding::Wrap(cx, scope, this, triedToWrap);
+  return mozilla::dom::SVGLengthListBinding::Wrap(cx, scope, this);
 }
 
 void
diff --git a/content/svg/content/src/DOMSVGLengthList.h b/content/svg/content/src/DOMSVGLengthList.h
index 93081811a923..487b4c447c44 100644
--- a/content/svg/content/src/DOMSVGLengthList.h
+++ b/content/svg/content/src/DOMSVGLengthList.h
@@ -71,8 +71,7 @@ public:
     }
   }
 
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap);
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
   nsISupports* GetParentObject()
   {
diff --git a/content/svg/content/src/DOMSVGNumberList.cpp b/content/svg/content/src/DOMSVGNumberList.cpp
index 4bb401e54f44..7f0399cb7040 100644
--- a/content/svg/content/src/DOMSVGNumberList.cpp
+++ b/content/svg/content/src/DOMSVGNumberList.cpp
@@ -69,9 +69,9 @@ NS_INTERFACE_MAP_END
 
 
 JSObject*
-DOMSVGNumberList::WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap)
+DOMSVGNumberList::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return mozilla::dom::SVGNumberListBinding::Wrap(cx, scope, this, triedToWrap);
+  return mozilla::dom::SVGNumberListBinding::Wrap(cx, scope, this);
 }
 
 void
diff --git a/content/svg/content/src/DOMSVGNumberList.h b/content/svg/content/src/DOMSVGNumberList.h
index eaa27b7ec1a9..e16dfb2cdf2d 100644
--- a/content/svg/content/src/DOMSVGNumberList.h
+++ b/content/svg/content/src/DOMSVGNumberList.h
@@ -71,8 +71,7 @@ public:
     }
   }
 
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap);
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
   nsISupports* GetParentObject()
   {
diff --git a/content/svg/content/src/DOMSVGPathSeg.h b/content/svg/content/src/DOMSVGPathSeg.h
index 8007febaf4df..7d428dae96b2 100644
--- a/content/svg/content/src/DOMSVGPathSeg.h
+++ b/content/svg/content/src/DOMSVGPathSeg.h
@@ -68,9 +68,9 @@ namespace mozilla {
   }                                                                           \
                                                                               \
   virtual JSObject*                                                           \
-  WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)            \
+  WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE                   \
   {                                                                           \
-    return dom::SVGPathSeg##segName##Binding::Wrap(aCx, aScope, this, aTriedToWrap); \
+    return dom::SVGPathSeg##segName##Binding::Wrap(aCx, aScope, this);        \
   }
 
 
@@ -175,7 +175,7 @@ public:
   uint16_t PathSegType() const { return Type(); }
   void GetPathSegTypeAsLetter(nsAString &aPathSegTypeAsLetter)
     { aPathSegTypeAsLetter = SVGPathSegUtils::GetPathSegTypeAsLetter(Type()); }
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) = 0;
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE = 0;
 
 protected:
 
diff --git a/content/svg/content/src/DOMSVGPathSegList.cpp b/content/svg/content/src/DOMSVGPathSegList.cpp
index 89af915eb496..d07542c08595 100644
--- a/content/svg/content/src/DOMSVGPathSegList.cpp
+++ b/content/svg/content/src/DOMSVGPathSegList.cpp
@@ -74,10 +74,9 @@ DOMSVGPathSegList::~DOMSVGPathSegList()
 }
 
 JSObject*
-DOMSVGPathSegList::WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap)
+DOMSVGPathSegList::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return mozilla::dom::SVGPathSegListBinding::Wrap(cx, scope, this,
-                                                   triedToWrap);
+  return mozilla::dom::SVGPathSegListBinding::Wrap(cx, scope, this);
 }
 
 void
diff --git a/content/svg/content/src/DOMSVGPathSegList.h b/content/svg/content/src/DOMSVGPathSegList.h
index 834cd9ff1aaf..0fcecc64dd16 100644
--- a/content/svg/content/src/DOMSVGPathSegList.h
+++ b/content/svg/content/src/DOMSVGPathSegList.h
@@ -55,8 +55,7 @@ public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(DOMSVGPathSegList)
 
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap);
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
   nsISupports* GetParentObject()
   {
diff --git a/content/svg/content/src/DOMSVGPoint.cpp b/content/svg/content/src/DOMSVGPoint.cpp
index 328cccae7dc0..634142684359 100644
--- a/content/svg/content/src/DOMSVGPoint.cpp
+++ b/content/svg/content/src/DOMSVGPoint.cpp
@@ -6,12 +6,10 @@
 #include "DOMSVGPoint.h"
 #include "DOMSVGPointList.h"
 #include "SVGPoint.h"
-#include "SVGAnimatedPointList.h"
 #include "nsSVGElement.h"
 #include "nsError.h"
 #include "nsContentUtils.h" // NS_ENSURE_FINITE
 #include "mozilla/dom/SVGMatrix.h"
-#include "mozilla/dom/SVGPointBinding.h"
 
 // See the architecture comment in DOMSVGPointList.h.
 
diff --git a/content/svg/content/src/DOMSVGPoint.h b/content/svg/content/src/DOMSVGPoint.h
index a5ebcc14cd3e..96a70525b9ae 100644
--- a/content/svg/content/src/DOMSVGPoint.h
+++ b/content/svg/content/src/DOMSVGPoint.h
@@ -9,12 +9,9 @@
 #include "DOMSVGPointList.h"
 #include "gfxPoint.h"
 #include "nsAutoPtr.h"
-#include "nsCycleCollectionParticipant.h"
 #include "nsDebug.h"
 #include "nsISVGPoint.h"
-#include "nsTArray.h"
 #include "SVGPoint.h"
-#include "nsWrapperCache.h"
 #include "mozilla/Attributes.h"
 
 class nsSVGElement;
diff --git a/content/svg/content/src/DOMSVGPointList.cpp b/content/svg/content/src/DOMSVGPointList.cpp
index 658835630ddd..0156aa327524 100644
--- a/content/svg/content/src/DOMSVGPointList.cpp
+++ b/content/svg/content/src/DOMSVGPointList.cpp
@@ -92,9 +92,9 @@ DOMSVGPointList::~DOMSVGPointList()
 }
 
 JSObject*
-DOMSVGPointList::WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap)
+DOMSVGPointList::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return mozilla::dom::SVGPointListBinding::Wrap(cx, scope, this, triedToWrap);
+  return mozilla::dom::SVGPointListBinding::Wrap(cx, scope, this);
 }
 
 void
diff --git a/content/svg/content/src/DOMSVGPointList.h b/content/svg/content/src/DOMSVGPointList.h
index 96b9b1d1096a..eba6ee1255a7 100644
--- a/content/svg/content/src/DOMSVGPointList.h
+++ b/content/svg/content/src/DOMSVGPointList.h
@@ -57,8 +57,7 @@ public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(DOMSVGPointList)
 
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap);
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
   nsISupports* GetParentObject()
   {
diff --git a/content/svg/content/src/DOMSVGTransform.cpp b/content/svg/content/src/DOMSVGTransform.cpp
index 227d619c6002..b7a8dbe700f6 100644
--- a/content/svg/content/src/DOMSVGTransform.cpp
+++ b/content/svg/content/src/DOMSVGTransform.cpp
@@ -8,7 +8,6 @@
 #include "mozilla/dom/SVGMatrix.h"
 #include "SVGAnimatedTransformList.h"
 #include "nsError.h"
-#include <math.h>
 #include "nsContentUtils.h"
 #include "nsAttrValueInlines.h"
 #include "nsSVGAttrTearoffTable.h"
@@ -59,9 +58,9 @@ NS_INTERFACE_MAP_END
 
 
 JSObject*
-DOMSVGTransform::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+DOMSVGTransform::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return mozilla::dom::SVGTransformBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return mozilla::dom::SVGTransformBinding::Wrap(aCx, aScope, this);
 }
 
 //----------------------------------------------------------------------
diff --git a/content/svg/content/src/DOMSVGTransform.h b/content/svg/content/src/DOMSVGTransform.h
index 1d025090b9dd..a77394fe54c3 100644
--- a/content/svg/content/src/DOMSVGTransform.h
+++ b/content/svg/content/src/DOMSVGTransform.h
@@ -12,7 +12,6 @@
 #include "nsCycleCollectionParticipant.h"
 #include "nsDebug.h"
 #include "nsID.h"
-#include "nsTArray.h"
 #include "SVGTransform.h"
 #include "nsWrapperCache.h"
 #include "mozilla/Attributes.h"
@@ -131,7 +130,7 @@ public:
 
   // WebIDL
   DOMSVGTransformList* GetParentObject() const { return mList; }
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
   uint16_t Type() const;
   dom::SVGMatrix* Matrix();
   float Angle() const;
diff --git a/content/svg/content/src/DOMSVGTransformList.cpp b/content/svg/content/src/DOMSVGTransformList.cpp
index 688205e670e8..63ebe509b296 100644
--- a/content/svg/content/src/DOMSVGTransformList.cpp
+++ b/content/svg/content/src/DOMSVGTransformList.cpp
@@ -68,11 +68,9 @@ NS_INTERFACE_MAP_END
 // DOMSVGTransformList methods:
 
 JSObject*
-DOMSVGTransformList::WrapObject(JSContext *cx, JSObject *scope,
-                                bool *triedToWrap)
+DOMSVGTransformList::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return mozilla::dom::SVGTransformListBinding::Wrap(cx, scope, this,
-                                                     triedToWrap);
+  return mozilla::dom::SVGTransformListBinding::Wrap(cx, scope, this);
 }
 
 void
diff --git a/content/svg/content/src/DOMSVGTransformList.h b/content/svg/content/src/DOMSVGTransformList.h
index 510b84bfe5ba..5f0ee51f9b35 100644
--- a/content/svg/content/src/DOMSVGTransformList.h
+++ b/content/svg/content/src/DOMSVGTransformList.h
@@ -67,8 +67,7 @@ public:
     }
   }
 
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap);
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
   nsISupports* GetParentObject()
   {
diff --git a/content/svg/content/src/Makefile.in b/content/svg/content/src/Makefile.in
index b8b805b23540..b3f69bd4e38d 100644
--- a/content/svg/content/src/Makefile.in
+++ b/content/svg/content/src/Makefile.in
@@ -33,7 +33,6 @@ CPPSRCS		= \
 		DOMSVGTransform.cpp \
 		DOMSVGTransformList.cpp \
 		nsDOMSVGZoomEvent.cpp \
-		nsDOMSVGEvent.cpp \
 		nsISVGPoint.cpp \
 		nsSVGAngle.cpp \
 		nsSVGBoolean.cpp \
diff --git a/content/svg/content/src/SVGAElement.cpp b/content/svg/content/src/SVGAElement.cpp
index 0d60df8ecb74..96da97b6b5c6 100644
--- a/content/svg/content/src/SVGAElement.cpp
+++ b/content/svg/content/src/SVGAElement.cpp
@@ -7,7 +7,6 @@
 
 #include "mozilla/dom/SVGAElement.h"
 #include "mozilla/dom/SVGAElementBinding.h"
-#include "nsIDOMSVGURIReference.h"
 #include "nsILink.h"
 #include "nsSVGString.h"
 #include "nsCOMPtr.h"
@@ -20,9 +19,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGAElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGAElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGAElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGAElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::StringInfo SVGAElement::sStringInfo[2] =
@@ -35,11 +34,10 @@ nsSVGElement::StringInfo SVGAElement::sStringInfo[2] =
 //----------------------------------------------------------------------
 // nsISupports methods
 
-NS_IMPL_ISUPPORTS_INHERITED6(SVGAElement, SVGAElementBase,
+NS_IMPL_ISUPPORTS_INHERITED5(SVGAElement, SVGAElementBase,
                              nsIDOMNode,
                              nsIDOMElement,
                              nsIDOMSVGElement,
-                             nsIDOMSVGURIReference,
                              nsILink,
                              Link)
 
@@ -54,17 +52,6 @@ SVGAElement::SVGAElement(already_AddRefed<nsINodeInfo> aNodeInfo)
   SetIsDOMBinding();
 }
 
-//----------------------------------------------------------------------
-// nsIDOMSVGURIReference methods
-
-/* readonly attribute nsIDOMSVGAnimatedString href; */
-NS_IMETHODIMP
-SVGAElement::GetHref(nsIDOMSVGAnimatedString * *aHref)
-{
-  *aHref = Href().get();
-  return NS_OK;
-}
-
 already_AddRefed<nsIDOMSVGAnimatedString>
 SVGAElement::Href()
 {
diff --git a/content/svg/content/src/SVGAElement.h b/content/svg/content/src/SVGAElement.h
index 8ec894bc8d6b..383671b66ffa 100644
--- a/content/svg/content/src/SVGAElement.h
+++ b/content/svg/content/src/SVGAElement.h
@@ -7,7 +7,6 @@
 #define mozilla_dom_SVGAElement_h
 
 #include "Link.h"
-#include "nsIDOMSVGURIReference.h"
 #include "nsILink.h"
 #include "nsSVGString.h"
 #include "mozilla/dom/SVGGraphicsElement.h"
@@ -22,7 +21,6 @@ typedef SVGGraphicsElement SVGAElementBase;
 
 class SVGAElement MOZ_FINAL : public SVGAElementBase,
                               public nsIDOMSVGElement,
-                              public nsIDOMSVGURIReference,
                               public nsILink,
                               public Link
 {
@@ -30,13 +28,12 @@ protected:
   SVGAElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   friend nsresult (::NS_NewSVGAElement(nsIContent **aResult,
                                        already_AddRefed<nsINodeInfo> aNodeInfo));
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
 
   NS_DECL_ISUPPORTS_INHERITED
-  NS_DECL_NSIDOMSVGURIREFERENCE
 
   // XXX: I wish we could use virtual inheritance
   NS_FORWARD_NSIDOMNODE_TO_NSINODE
diff --git a/content/svg/content/src/SVGAltGlyphElement.cpp b/content/svg/content/src/SVGAltGlyphElement.cpp
index 752a45340525..0daa10158d5e 100644
--- a/content/svg/content/src/SVGAltGlyphElement.cpp
+++ b/content/svg/content/src/SVGAltGlyphElement.cpp
@@ -13,9 +13,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGAltGlyphElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGAltGlyphElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGAltGlyphElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGAltGlyphElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::StringInfo SVGAltGlyphElement::sStringInfo[1] =
@@ -27,10 +27,9 @@ nsSVGElement::StringInfo SVGAltGlyphElement::sStringInfo[1] =
 //----------------------------------------------------------------------
 // nsISupports methods
 
-NS_IMPL_ISUPPORTS_INHERITED4(SVGAltGlyphElement, SVGAltGlyphElementBase,
+NS_IMPL_ISUPPORTS_INHERITED3(SVGAltGlyphElement, SVGAltGlyphElementBase,
                              nsIDOMNode, nsIDOMElement,
-                             nsIDOMSVGElement,
-                             nsIDOMSVGURIReference)
+                             nsIDOMSVGElement)
 
 //----------------------------------------------------------------------
 // Implementation
@@ -46,16 +45,6 @@ SVGAltGlyphElement::SVGAltGlyphElement(already_AddRefed<nsINodeInfo> aNodeInfo)
 
 NS_IMPL_ELEMENT_CLONE_WITH_INIT(SVGAltGlyphElement)
 
-//----------------------------------------------------------------------
-// nsIDOMSVGURIReference methods
-
-/* readonly attribute nsIDOMSVGAnimatedString href; */
-NS_IMETHODIMP SVGAltGlyphElement::GetHref(nsIDOMSVGAnimatedString * *aHref)
-{
-  *aHref = Href().get();
-  return NS_OK;
-}
-
 already_AddRefed<nsIDOMSVGAnimatedString>
 SVGAltGlyphElement::Href()
 {
diff --git a/content/svg/content/src/SVGAltGlyphElement.h b/content/svg/content/src/SVGAltGlyphElement.h
index 0a1549467d25..32a2e9f0e8bc 100644
--- a/content/svg/content/src/SVGAltGlyphElement.h
+++ b/content/svg/content/src/SVGAltGlyphElement.h
@@ -6,7 +6,6 @@
 #ifndef mozilla_dom_SVGAltGlyphElement_h
 #define mozilla_dom_SVGAltGlyphElement_h
 
-#include "nsIDOMSVGURIReference.h"
 #include "mozilla/dom/SVGTextPositioningElement.h"
 #include "nsSVGString.h"
 
@@ -19,20 +18,18 @@ namespace dom {
 typedef SVGTextPositioningElement SVGAltGlyphElementBase;
 
 class SVGAltGlyphElement MOZ_FINAL : public SVGAltGlyphElementBase,
-                                     public nsIDOMSVGElement,
-                                     public nsIDOMSVGURIReference
+                                     public nsIDOMSVGElement
 {
 protected:
   friend nsresult (::NS_NewSVGAltGlyphElement(nsIContent **aResult,
                                               already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGAltGlyphElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
 
   NS_DECL_ISUPPORTS_INHERITED
-  NS_DECL_NSIDOMSVGURIREFERENCE
 
   // xxx If xpcom allowed virtual inheritance we wouldn't need to
   // forward here :-(
diff --git a/content/svg/content/src/SVGAngle.cpp b/content/svg/content/src/SVGAngle.cpp
index ebdc6d09ec99..8de4aa0df07b 100644
--- a/content/svg/content/src/SVGAngle.cpp
+++ b/content/svg/content/src/SVGAngle.cpp
@@ -23,9 +23,9 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(SVGAngle)
 NS_INTERFACE_MAP_END
 
 JSObject*
-SVGAngle::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+SVGAngle::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return SVGAngleBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGAngleBinding::Wrap(aCx, aScope, this);
 }
 
 uint16_t
diff --git a/content/svg/content/src/SVGAngle.h b/content/svg/content/src/SVGAngle.h
index ced63ffc24be..550f33287481 100644
--- a/content/svg/content/src/SVGAngle.h
+++ b/content/svg/content/src/SVGAngle.h
@@ -48,7 +48,7 @@ public:
 
   // WebIDL
   nsSVGElement* GetParentObject() { return mSVGElement; }
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
   uint16_t UnitType() const;
   float Value() const;
   void GetValueAsString(nsAString& aValue);
diff --git a/content/svg/content/src/SVGAnimateElement.cpp b/content/svg/content/src/SVGAnimateElement.cpp
index c418b7b089db..652ea342a19b 100644
--- a/content/svg/content/src/SVGAnimateElement.cpp
+++ b/content/svg/content/src/SVGAnimateElement.cpp
@@ -12,9 +12,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGAnimateElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGAnimateElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGAnimateElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGAnimateElementBinding::Wrap(aCx, aScope, this);
 }
 
 //----------------------------------------------------------------------
diff --git a/content/svg/content/src/SVGAnimateElement.h b/content/svg/content/src/SVGAnimateElement.h
index 2c007ebc5d47..6adbd4e5b061 100644
--- a/content/svg/content/src/SVGAnimateElement.h
+++ b/content/svg/content/src/SVGAnimateElement.h
@@ -26,7 +26,7 @@ protected:
     (::NS_NewSVGAnimateElement(nsIContent **aResult,
                                already_AddRefed<nsINodeInfo> aNodeInfo));
 
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
diff --git a/content/svg/content/src/SVGAnimateMotionElement.cpp b/content/svg/content/src/SVGAnimateMotionElement.cpp
index 1de2a3ae82fc..559fb8e968dc 100644
--- a/content/svg/content/src/SVGAnimateMotionElement.cpp
+++ b/content/svg/content/src/SVGAnimateMotionElement.cpp
@@ -12,9 +12,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGAnimateMotionElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGAnimateMotionElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGAnimateMotionElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGAnimateMotionElementBinding::Wrap(aCx, aScope, this);
 }
 
 //----------------------------------------------------------------------
diff --git a/content/svg/content/src/SVGAnimateMotionElement.h b/content/svg/content/src/SVGAnimateMotionElement.h
index 827c51a01c89..5894b0c1e6e4 100644
--- a/content/svg/content/src/SVGAnimateMotionElement.h
+++ b/content/svg/content/src/SVGAnimateMotionElement.h
@@ -26,7 +26,7 @@ protected:
     (::NS_NewSVGAnimateMotionElement(nsIContent **aResult,
                                      already_AddRefed<nsINodeInfo> aNodeInfo));
 
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
diff --git a/content/svg/content/src/SVGAnimateTransformElement.cpp b/content/svg/content/src/SVGAnimateTransformElement.cpp
index a63b0becf11b..d0ac1414dc3e 100644
--- a/content/svg/content/src/SVGAnimateTransformElement.cpp
+++ b/content/svg/content/src/SVGAnimateTransformElement.cpp
@@ -12,9 +12,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGAnimateTransformElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGAnimateTransformElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGAnimateTransformElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGAnimateTransformElementBinding::Wrap(aCx, aScope, this);
 }
 
 //----------------------------------------------------------------------
diff --git a/content/svg/content/src/SVGAnimateTransformElement.h b/content/svg/content/src/SVGAnimateTransformElement.h
index 84a38a98b588..a4e1dcae446a 100644
--- a/content/svg/content/src/SVGAnimateTransformElement.h
+++ b/content/svg/content/src/SVGAnimateTransformElement.h
@@ -26,7 +26,7 @@ protected:
     (::NS_NewSVGAnimateTransformElement(nsIContent **aResult,
                                         already_AddRefed<nsINodeInfo> aNodeInfo));
 
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
diff --git a/content/svg/content/src/SVGAnimatedAngle.cpp b/content/svg/content/src/SVGAnimatedAngle.cpp
index 2f62c57c036a..b9dc2eedfb58 100644
--- a/content/svg/content/src/SVGAnimatedAngle.cpp
+++ b/content/svg/content/src/SVGAnimatedAngle.cpp
@@ -4,7 +4,6 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "SVGAnimatedAngle.h"
-#include "SVGAngle.h"
 #include "nsSVGAngle.h"
 #include "mozilla/dom/SVGAnimatedAngleBinding.h"
 #include "nsContentUtils.h"
@@ -23,9 +22,9 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(SVGAnimatedAngle)
 NS_INTERFACE_MAP_END
 
 JSObject*
-SVGAnimatedAngle::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+SVGAnimatedAngle::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return SVGAnimatedAngleBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGAnimatedAngleBinding::Wrap(aCx, aScope, this);
 }
 
 already_AddRefed<SVGAngle>
diff --git a/content/svg/content/src/SVGAnimatedAngle.h b/content/svg/content/src/SVGAnimatedAngle.h
index 63324d07f28a..f371f3def64c 100644
--- a/content/svg/content/src/SVGAnimatedAngle.h
+++ b/content/svg/content/src/SVGAnimatedAngle.h
@@ -3,11 +3,11 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#pragma once
+#ifndef mozilla_dom_SVGAnimatedAngle_h
+#define mozilla_dom_SVGAnimatedAngle_h
 
 #include "nsWrapperCache.h"
 #include "nsSVGElement.h"
-#include "SVGAngle.h"
 #include "mozilla/Attributes.h"
 
 class nsSVGAngle;
@@ -15,6 +15,8 @@ class nsSVGAngle;
 namespace mozilla {
 namespace dom {
 
+class SVGAngle;
+
 class SVGAnimatedAngle MOZ_FINAL : public nsISupports,
                                    public nsWrapperCache
 {
@@ -31,7 +33,7 @@ public:
 
   // WebIDL
   nsSVGElement* GetParentObject() { return mSVGElement; }
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
   already_AddRefed<SVGAngle> BaseVal();
   already_AddRefed<SVGAngle> AnimVal();
 
@@ -43,3 +45,4 @@ protected:
 } //namespace dom
 } //namespace mozilla
 
+#endif // mozilla_dom_SVGAnimatedAngle_h
diff --git a/content/svg/content/src/SVGAnimatedBoolean.cpp b/content/svg/content/src/SVGAnimatedBoolean.cpp
index 685ba758c418..bae9d8470a09 100644
--- a/content/svg/content/src/SVGAnimatedBoolean.cpp
+++ b/content/svg/content/src/SVGAnimatedBoolean.cpp
@@ -4,7 +4,6 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "SVGAnimatedBoolean.h"
-#include "nsSVGBoolean.h"
 #include "mozilla/dom/SVGAnimatedBooleanBinding.h"
 #include "nsContentUtils.h"
 
@@ -22,8 +21,8 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(SVGAnimatedBoolean)
 NS_INTERFACE_MAP_END
 
 JSObject*
-SVGAnimatedBoolean::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+SVGAnimatedBoolean::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return SVGAnimatedBooleanBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGAnimatedBooleanBinding::Wrap(aCx, aScope, this);
 }
 
diff --git a/content/svg/content/src/SVGAnimatedBoolean.h b/content/svg/content/src/SVGAnimatedBoolean.h
index 1a4f192f8d1a..b3172f7e4b9e 100644
--- a/content/svg/content/src/SVGAnimatedBoolean.h
+++ b/content/svg/content/src/SVGAnimatedBoolean.h
@@ -28,7 +28,7 @@ class SVGAnimatedBoolean MOZ_FINAL : public nsISupports,
 
  // WebIDL
   nsSVGElement* GetParentObject() const { return mSVGElement; }
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
   bool BaseVal() const { return mVal->GetBaseValue(); }
   void SetBaseVal(bool aValue) { mVal->SetBaseValue(aValue, mSVGElement); }
   bool AnimVal() const { mSVGElement->FlushAnimations(); return mVal->GetAnimValue(); }
diff --git a/content/svg/content/src/SVGAnimatedLength.cpp b/content/svg/content/src/SVGAnimatedLength.cpp
index 485fb15ab28e..6554a69a1a1e 100644
--- a/content/svg/content/src/SVGAnimatedLength.cpp
+++ b/content/svg/content/src/SVGAnimatedLength.cpp
@@ -6,6 +6,7 @@
 #include "mozilla/dom/SVGAnimatedLength.h"
 #include "mozilla/dom/SVGAnimatedLengthBinding.h"
 #include "nsContentUtils.h"
+#include "nsSVGLength2.h"
 
 namespace mozilla {
 namespace dom {
@@ -22,9 +23,9 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(SVGAnimatedLength)
 NS_INTERFACE_MAP_END
 
 JSObject*
-SVGAnimatedLength::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+SVGAnimatedLength::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return SVGAnimatedLengthBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGAnimatedLengthBinding::Wrap(aCx, aScope, this);
 }
 
 already_AddRefed<nsIDOMSVGLength>
diff --git a/content/svg/content/src/SVGAnimatedLength.h b/content/svg/content/src/SVGAnimatedLength.h
index d5f9a1199cec..4dcf735b7240 100644
--- a/content/svg/content/src/SVGAnimatedLength.h
+++ b/content/svg/content/src/SVGAnimatedLength.h
@@ -7,7 +7,10 @@
 #define mozilla_dom_SVGAnimatedLength_h
 
 #include "nsSVGElement.h"
-#include "nsSVGLength2.h"
+#include "nsIDOMSVGAnimatedLength.h"
+
+class nsSVGLength2;
+class nsIDOMSVGLength;
 
 namespace mozilla {
 namespace dom {
@@ -33,7 +36,7 @@ public:
 
   // WebIDL
   nsSVGElement* GetParentObject() { return mSVGElement; }
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
   already_AddRefed<nsIDOMSVGLength> BaseVal();
   already_AddRefed<nsIDOMSVGLength> AnimVal();
 
diff --git a/content/svg/content/src/SVGAnimatedPreserveAspectRatio.cpp b/content/svg/content/src/SVGAnimatedPreserveAspectRatio.cpp
index 40f063033706..29e07d100b05 100644
--- a/content/svg/content/src/SVGAnimatedPreserveAspectRatio.cpp
+++ b/content/svg/content/src/SVGAnimatedPreserveAspectRatio.cpp
@@ -30,9 +30,9 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(DOMSVGAnimatedPreserveAspectRatio)
 NS_INTERFACE_MAP_END
 
 JSObject*
-DOMSVGAnimatedPreserveAspectRatio::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+DOMSVGAnimatedPreserveAspectRatio::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return SVGAnimatedPreserveAspectRatioBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGAnimatedPreserveAspectRatioBinding::Wrap(aCx, aScope, this);
 }
 
 /* Implementation */
diff --git a/content/svg/content/src/SVGAnimatedPreserveAspectRatio.h b/content/svg/content/src/SVGAnimatedPreserveAspectRatio.h
index b08fb60a4e43..1084bab53040 100644
--- a/content/svg/content/src/SVGAnimatedPreserveAspectRatio.h
+++ b/content/svg/content/src/SVGAnimatedPreserveAspectRatio.h
@@ -128,7 +128,7 @@ class DOMSVGAnimatedPreserveAspectRatio MOZ_FINAL : public nsISupports,
 
   // WebIDL
   nsSVGElement* GetParentObject() const { return mSVGElement; }
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   // These aren't weak refs because new objects are returned each time
   already_AddRefed<DOMSVGPreserveAspectRatio> BaseVal();
diff --git a/content/svg/content/src/SVGAnimationElement.cpp b/content/svg/content/src/SVGAnimationElement.cpp
index 0ccacb1647b0..aba190e7a75e 100644
--- a/content/svg/content/src/SVGAnimationElement.cpp
+++ b/content/svg/content/src/SVGAnimationElement.cpp
@@ -8,7 +8,6 @@
 #include "nsSMILTimeContainer.h"
 #include "nsSMILAnimationController.h"
 #include "nsSMILAnimationFunction.h"
-#include "nsISMILAttr.h"
 #include "nsContentUtils.h"
 
 namespace mozilla {
diff --git a/content/svg/content/src/SVGCircleElement.cpp b/content/svg/content/src/SVGCircleElement.cpp
index 5ad7c990a00e..72d535f42464 100644
--- a/content/svg/content/src/SVGCircleElement.cpp
+++ b/content/svg/content/src/SVGCircleElement.cpp
@@ -6,7 +6,6 @@
 #include "mozilla/dom/SVGCircleElement.h"
 #include "nsGkAtoms.h"
 #include "gfxContext.h"
-#include "mozilla/dom/SVGAnimatedLength.h"
 #include "mozilla/dom/SVGCircleElementBinding.h"
 
 NS_IMPL_NS_NEW_NAMESPACED_SVG_ELEMENT(Circle)
@@ -15,9 +14,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGCircleElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGCircleElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGCircleElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGCircleElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::LengthInfo SVGCircleElement::sLengthInfo[3] =
diff --git a/content/svg/content/src/SVGCircleElement.h b/content/svg/content/src/SVGCircleElement.h
index 3a5b5a511bed..a5c3609ac413 100644
--- a/content/svg/content/src/SVGCircleElement.h
+++ b/content/svg/content/src/SVGCircleElement.h
@@ -22,7 +22,7 @@ class SVGCircleElement MOZ_FINAL : public SVGCircleElementBase,
 {
 protected:
   SVGCircleElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
   friend nsresult (::NS_NewSVGCircleElement(nsIContent **aResult,
                                             already_AddRefed<nsINodeInfo> aNodeInfo));
 
diff --git a/content/svg/content/src/SVGClipPathElement.cpp b/content/svg/content/src/SVGClipPathElement.cpp
index d81bb3ab21db..f0abb9873b16 100644
--- a/content/svg/content/src/SVGClipPathElement.cpp
+++ b/content/svg/content/src/SVGClipPathElement.cpp
@@ -15,9 +15,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGClipPathElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGClipPathElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGClipPathElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGClipPathElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::EnumInfo SVGClipPathElement::sEnumInfo[1] =
diff --git a/content/svg/content/src/SVGClipPathElement.h b/content/svg/content/src/SVGClipPathElement.h
index 8c98e42668b4..bf47387856d0 100644
--- a/content/svg/content/src/SVGClipPathElement.h
+++ b/content/svg/content/src/SVGClipPathElement.h
@@ -28,7 +28,7 @@ protected:
   friend nsresult (::NS_NewSVGClipPathElement(nsIContent **aResult,
                                               already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGClipPathElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
diff --git a/content/svg/content/src/SVGComponentTransferFunctionElement.h b/content/svg/content/src/SVGComponentTransferFunctionElement.h
index 38009598cc11..a63048f83fe2 100644
--- a/content/svg/content/src/SVGComponentTransferFunctionElement.h
+++ b/content/svg/content/src/SVGComponentTransferFunctionElement.h
@@ -48,7 +48,7 @@ public:
 
   // WebIDL
   virtual JSObject*
-  WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE = 0;
+  WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE = 0;
   already_AddRefed<nsIDOMSVGAnimatedEnumeration> Type();
   already_AddRefed<DOMSVGAnimatedNumberList> TableValues();
   already_AddRefed<nsIDOMSVGAnimatedNumber> Slope();
@@ -114,7 +114,7 @@ public:
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
   virtual JSObject*
-  WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE;
+  WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
@@ -154,7 +154,7 @@ public:
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
   virtual JSObject*
-  WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE;
+  WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
@@ -194,7 +194,7 @@ public:
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
   virtual JSObject*
-  WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE;
+  WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
@@ -234,7 +234,7 @@ public:
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
   virtual JSObject*
-  WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE;
+  WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/svg/content/src/SVGContentUtils.cpp b/content/svg/content/src/SVGContentUtils.cpp
index d94eddf27ffa..106635138b52 100644
--- a/content/svg/content/src/SVGContentUtils.cpp
+++ b/content/svg/content/src/SVGContentUtils.cpp
@@ -9,7 +9,6 @@
 
 // Keep others in (case-insensitive) order:
 #include "gfxMatrix.h"
-#include "mozilla/Preferences.h"
 #include "nsComputedDOMStyle.h"
 #include "nsFontMetrics.h"
 #include "nsIFrame.h"
diff --git a/content/svg/content/src/SVGContentUtils.h b/content/svg/content/src/SVGContentUtils.h
index ec7cd2191332..b269e89d9612 100644
--- a/content/svg/content/src/SVGContentUtils.h
+++ b/content/svg/content/src/SVGContentUtils.h
@@ -11,14 +11,12 @@
 #include <math.h>
 
 #include "gfxMatrix.h"
-#include "nsCOMPtr.h"
 
 class nsIContent;
 class nsIDocument;
 class nsIFrame;
 class nsStyleContext;
 class nsSVGElement;
-class nsSVGLength2;
 
 namespace mozilla {
 class SVGAnimatedPreserveAspectRatio;
diff --git a/content/svg/content/src/SVGDefsElement.cpp b/content/svg/content/src/SVGDefsElement.cpp
index 42d39ea55fbe..45863fefb8a4 100644
--- a/content/svg/content/src/SVGDefsElement.cpp
+++ b/content/svg/content/src/SVGDefsElement.cpp
@@ -12,9 +12,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGDefsElement::WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+SVGDefsElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return SVGDefsElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGDefsElementBinding::Wrap(aCx, aScope, this);
 }
 
 //----------------------------------------------------------------------
diff --git a/content/svg/content/src/SVGDefsElement.h b/content/svg/content/src/SVGDefsElement.h
index 34e646b71a4d..d877785ec88c 100644
--- a/content/svg/content/src/SVGDefsElement.h
+++ b/content/svg/content/src/SVGDefsElement.h
@@ -6,7 +6,6 @@
 #ifndef mozilla_dom_SVGDefsElement_h
 #define mozilla_dom_SVGDefsElement_h
 
-#include "mozilla/Util.h"
 #include "SVGGraphicsElement.h"
 
 nsresult NS_NewSVGDefsElement(nsIContent **aResult,
@@ -22,7 +21,7 @@ protected:
   friend nsresult (::NS_NewSVGDefsElement(nsIContent **aResult,
                                           already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGDefsElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
diff --git a/content/svg/content/src/SVGDescElement.cpp b/content/svg/content/src/SVGDescElement.cpp
index 4703521fec75..642b79d85ab0 100644
--- a/content/svg/content/src/SVGDescElement.cpp
+++ b/content/svg/content/src/SVGDescElement.cpp
@@ -12,9 +12,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGDescElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGDescElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGDescElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGDescElementBinding::Wrap(aCx, aScope, this);
 }
 
 //----------------------------------------------------------------------
diff --git a/content/svg/content/src/SVGDescElement.h b/content/svg/content/src/SVGDescElement.h
index dc5ea0386991..99c0a77f13a5 100644
--- a/content/svg/content/src/SVGDescElement.h
+++ b/content/svg/content/src/SVGDescElement.h
@@ -24,7 +24,7 @@ protected:
                                           already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGDescElement(already_AddRefed<nsINodeInfo> aNodeInfo);
 
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
diff --git a/content/svg/content/src/SVGElementFactory.cpp b/content/svg/content/src/SVGElementFactory.cpp
index 6f2d4566edcc..ac1f3eb909dc 100644
--- a/content/svg/content/src/SVGElementFactory.cpp
+++ b/content/svg/content/src/SVGElementFactory.cpp
@@ -4,10 +4,10 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "SVGElementFactory.h"
-#include "mozilla/Util.h"
-#include "nsContentCreatorFunctions.h"
 #include "nsGkAtoms.h"
+#include "nsIContent.h"
 #include "nsINodeInfo.h"
+#include "mozilla/dom/FromParser.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
diff --git a/content/svg/content/src/SVGEllipseElement.cpp b/content/svg/content/src/SVGEllipseElement.cpp
index 755d268c5acc..55d2da281f4e 100644
--- a/content/svg/content/src/SVGEllipseElement.cpp
+++ b/content/svg/content/src/SVGEllipseElement.cpp
@@ -3,7 +3,6 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "mozilla/dom/SVGAnimatedLength.h"
 #include "mozilla/dom/SVGEllipseElement.h"
 #include "mozilla/dom/SVGEllipseElementBinding.h"
 #include "gfxContext.h"
@@ -14,9 +13,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGEllipseElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGEllipseElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGEllipseElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGEllipseElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::LengthInfo SVGEllipseElement::sLengthInfo[4] =
diff --git a/content/svg/content/src/SVGEllipseElement.h b/content/svg/content/src/SVGEllipseElement.h
index 2207412bce93..ca05964afbbd 100644
--- a/content/svg/content/src/SVGEllipseElement.h
+++ b/content/svg/content/src/SVGEllipseElement.h
@@ -22,7 +22,7 @@ class SVGEllipseElement MOZ_FINAL : public SVGEllipseElementBase,
 {
 protected:
   SVGEllipseElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
   friend nsresult (::NS_NewSVGEllipseElement(nsIContent **aResult,
                                              already_AddRefed<nsINodeInfo> aNodeInfo));
 
diff --git a/content/svg/content/src/SVGFEBlendElement.cpp b/content/svg/content/src/SVGFEBlendElement.cpp
index 24ea58fdb609..4a6363d57d4f 100644
--- a/content/svg/content/src/SVGFEBlendElement.cpp
+++ b/content/svg/content/src/SVGFEBlendElement.cpp
@@ -13,9 +13,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGFEBlendElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGFEBlendElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGFEBlendElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGFEBlendElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGEnumMapping SVGFEBlendElement::sModeMap[] = {
diff --git a/content/svg/content/src/SVGFEBlendElement.h b/content/svg/content/src/SVGFEBlendElement.h
index 8b2351e92f46..5da09147f0af 100644
--- a/content/svg/content/src/SVGFEBlendElement.h
+++ b/content/svg/content/src/SVGFEBlendElement.h
@@ -34,7 +34,7 @@ protected:
   {
     SetIsDOMBinding();
   }
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
diff --git a/content/svg/content/src/SVGFEFloodElement.cpp b/content/svg/content/src/SVGFEFloodElement.cpp
index 58f3747bb447..53973e5d9f68 100644
--- a/content/svg/content/src/SVGFEFloodElement.cpp
+++ b/content/svg/content/src/SVGFEFloodElement.cpp
@@ -12,9 +12,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGFEFloodElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGFEFloodElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGFEFloodElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGFEFloodElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::StringInfo SVGFEFloodElement::sStringInfo[1] =
diff --git a/content/svg/content/src/SVGFEFloodElement.h b/content/svg/content/src/SVGFEFloodElement.h
index 24997663d7b4..1ddb555d01a3 100644
--- a/content/svg/content/src/SVGFEFloodElement.h
+++ b/content/svg/content/src/SVGFEFloodElement.h
@@ -27,7 +27,7 @@ protected:
   {
     SetIsDOMBinding();
   }
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 public:
   virtual bool SubregionIsUnionOfRegions() { return false; }
diff --git a/content/svg/content/src/SVGFEImageElement.cpp b/content/svg/content/src/SVGFEImageElement.cpp
index 63d047df93eb..0b344b3141c6 100644
--- a/content/svg/content/src/SVGFEImageElement.cpp
+++ b/content/svg/content/src/SVGFEImageElement.cpp
@@ -16,9 +16,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGFEImageElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGFEImageElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGFEImageElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGFEImageElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::StringInfo SVGFEImageElement::sStringInfo[2] =
@@ -34,9 +34,8 @@ NS_IMPL_ADDREF_INHERITED(SVGFEImageElement,SVGFEImageElementBase)
 NS_IMPL_RELEASE_INHERITED(SVGFEImageElement,SVGFEImageElementBase)
 
 NS_INTERFACE_TABLE_HEAD(SVGFEImageElement)
-  NS_NODE_INTERFACE_TABLE7(SVGFEImageElement, nsIDOMNode, nsIDOMElement,
+  NS_NODE_INTERFACE_TABLE6(SVGFEImageElement, nsIDOMNode, nsIDOMElement,
                            nsIDOMSVGElement,
-                           nsIDOMSVGURIReference,
                            imgINotificationObserver, nsIImageLoadingContent,
                            imgIOnloadBlocker)
 NS_INTERFACE_MAP_END_INHERITING(SVGFEImageElementBase)
@@ -182,17 +181,6 @@ SVGFEImageElement::IntrinsicState() const
 
 NS_IMPL_ELEMENT_CLONE_WITH_INIT(SVGFEImageElement)
 
-//----------------------------------------------------------------------
-// nsIDOMSVGURIReference methods:
-
-/* readonly attribute nsIDOMSVGAnimatedString href; */
-NS_IMETHODIMP
-SVGFEImageElement::GetHref(nsIDOMSVGAnimatedString * *aHref)
-{
-  *aHref = Href().get();
-  return NS_OK;
-}
-
 already_AddRefed<nsIDOMSVGAnimatedString>
 SVGFEImageElement::Href()
 {
diff --git a/content/svg/content/src/SVGFEImageElement.h b/content/svg/content/src/SVGFEImageElement.h
index a4dafb0d6698..a9c9f007a9d7 100644
--- a/content/svg/content/src/SVGFEImageElement.h
+++ b/content/svg/content/src/SVGFEImageElement.h
@@ -20,7 +20,6 @@ typedef nsSVGFE SVGFEImageElementBase;
 
 class SVGFEImageElement : public SVGFEImageElementBase,
                           public nsIDOMSVGElement,
-                          public nsIDOMSVGURIReference,
                           public nsImageLoadingContent
 {
   friend class ::SVGFEImageFrame;
@@ -30,7 +29,7 @@ protected:
                                              already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGFEImageElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   virtual ~SVGFEImageElement();
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
 public:
   virtual bool SubregionIsUnionOfRegions() { return false; }
@@ -48,8 +47,6 @@ public:
   virtual nsIntRect ComputeTargetBBox(const nsTArray<nsIntRect>& aSourceBBoxes,
           const nsSVGFilterInstance& aInstance);
 
-  NS_DECL_NSIDOMSVGURIREFERENCE
-
   NS_FORWARD_NSIDOMSVGELEMENT(SVGFEImageElementBase::)
 
   NS_FORWARD_NSIDOMNODE_TO_NSINODE
diff --git a/content/svg/content/src/SVGFEMergeElement.cpp b/content/svg/content/src/SVGFEMergeElement.cpp
index 499ac8357544..8c95b0525bce 100644
--- a/content/svg/content/src/SVGFEMergeElement.cpp
+++ b/content/svg/content/src/SVGFEMergeElement.cpp
@@ -13,9 +13,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGFEMergeElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGFEMergeElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGFEMergeElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGFEMergeElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::StringInfo SVGFEMergeElement::sStringInfo[1] =
diff --git a/content/svg/content/src/SVGFEMergeElement.h b/content/svg/content/src/SVGFEMergeElement.h
index 19376a22635e..3854e62af8cc 100644
--- a/content/svg/content/src/SVGFEMergeElement.h
+++ b/content/svg/content/src/SVGFEMergeElement.h
@@ -27,7 +27,7 @@ protected:
   {
     SetIsDOMBinding();
   }
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
diff --git a/content/svg/content/src/SVGFEMergeNodeElement.cpp b/content/svg/content/src/SVGFEMergeNodeElement.cpp
index c52f939272eb..aa7286f8b6c2 100644
--- a/content/svg/content/src/SVGFEMergeNodeElement.cpp
+++ b/content/svg/content/src/SVGFEMergeNodeElement.cpp
@@ -12,9 +12,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGFEMergeNodeElement::WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+SVGFEMergeNodeElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return SVGFEMergeNodeElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGFEMergeNodeElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::StringInfo SVGFEMergeNodeElement::sStringInfo[1] =
diff --git a/content/svg/content/src/SVGFEMergeNodeElement.h b/content/svg/content/src/SVGFEMergeNodeElement.h
index c8a6f94688eb..644e787ca7fd 100644
--- a/content/svg/content/src/SVGFEMergeNodeElement.h
+++ b/content/svg/content/src/SVGFEMergeNodeElement.h
@@ -27,7 +27,7 @@ protected:
   {
     SetIsDOMBinding();
   }
-  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
diff --git a/content/svg/content/src/SVGFETileElement.cpp b/content/svg/content/src/SVGFETileElement.cpp
index 47cd2ad63c90..b57a8a39d291 100644
--- a/content/svg/content/src/SVGFETileElement.cpp
+++ b/content/svg/content/src/SVGFETileElement.cpp
@@ -14,9 +14,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGFETileElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGFETileElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGFETileElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGFETileElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::StringInfo SVGFETileElement::sStringInfo[2] =
diff --git a/content/svg/content/src/SVGFETileElement.h b/content/svg/content/src/SVGFETileElement.h
index 4779111deee5..ee71eb62e18c 100644
--- a/content/svg/content/src/SVGFETileElement.h
+++ b/content/svg/content/src/SVGFETileElement.h
@@ -27,7 +27,7 @@ protected:
   {
     SetIsDOMBinding();
   }
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 public:
   virtual bool SubregionIsUnionOfRegions() { return false; }
diff --git a/content/svg/content/src/SVGFilterElement.cpp b/content/svg/content/src/SVGFilterElement.cpp
index cc0fba5c6708..e2fa2d82e5a7 100644
--- a/content/svg/content/src/SVGFilterElement.cpp
+++ b/content/svg/content/src/SVGFilterElement.cpp
@@ -9,7 +9,7 @@
 #include "nsCOMPtr.h"
 #include "mozilla/dom/SVGFilterElement.h"
 #include "mozilla/dom/SVGFilterElementBinding.h"
-#include "nsSVGEffects.h"
+#include "nsSVGUtils.h"
 
 NS_IMPL_NS_NEW_NAMESPACED_SVG_ELEMENT(Filter)
 
@@ -17,9 +17,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGFilterElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGFilterElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGFilterElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGFilterElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::LengthInfo SVGFilterElement::sLengthInfo[4] =
@@ -55,9 +55,9 @@ nsSVGElement::StringInfo SVGFilterElement::sStringInfo[1] =
 //----------------------------------------------------------------------
 // nsISupports methods
 
-NS_IMPL_ISUPPORTS_INHERITED4(SVGFilterElement, SVGFilterElementBase,
+NS_IMPL_ISUPPORTS_INHERITED3(SVGFilterElement, SVGFilterElementBase,
                              nsIDOMNode, nsIDOMElement,
-                             nsIDOMSVGElement, nsIDOMSVGURIReference)
+                             nsIDOMSVGElement)
 
 //----------------------------------------------------------------------
 // Implementation
@@ -133,16 +133,6 @@ SVGFilterElement::SetFilterRes(uint32_t filterResX, uint32_t filterResY)
   mIntegerPairAttributes[FILTERRES].SetBaseValues(filterResX, filterResY, this);
 }
 
-//----------------------------------------------------------------------
-// nsIDOMSVGURIReference methods
-
-NS_IMETHODIMP
-SVGFilterElement::GetHref(nsIDOMSVGAnimatedString** aHref)
-{
-  *aHref = Href().get();
-  return NS_OK;
-}
-
 already_AddRefed<nsIDOMSVGAnimatedString>
 SVGFilterElement::Href()
 {
diff --git a/content/svg/content/src/SVGFilterElement.h b/content/svg/content/src/SVGFilterElement.h
index a0ea7c651be0..cb4f6ce07265 100644
--- a/content/svg/content/src/SVGFilterElement.h
+++ b/content/svg/content/src/SVGFilterElement.h
@@ -6,7 +6,6 @@
 #ifndef mozilla_dom_SVGFilterElement_h
 #define mozilla_dom_SVGFilterElement_h
 
-#include "nsIDOMSVGURIReference.h"
 #include "nsSVGEnum.h"
 #include "nsSVGElement.h"
 #include "nsSVGIntegerPair.h"
@@ -26,8 +25,7 @@ namespace dom {
 class SVGAnimatedLength;
 
 class SVGFilterElement : public SVGFilterElementBase,
-                         public nsIDOMSVGElement,
-                         public nsIDOMSVGURIReference
+                         public nsIDOMSVGElement
 {
   friend class ::nsSVGFilterFrame;
   friend class ::nsAutoFilterInstance;
@@ -36,13 +34,12 @@ protected:
   friend nsresult (::NS_NewSVGFilterElement(nsIContent **aResult,
                                             already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGFilterElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
 
   NS_DECL_ISUPPORTS_INHERITED
-  NS_DECL_NSIDOMSVGURIREFERENCE
 
   // xxx I wish we could use virtual inheritance
   NS_FORWARD_NSIDOMNODE_TO_NSINODE
diff --git a/content/svg/content/src/SVGForeignObjectElement.cpp b/content/svg/content/src/SVGForeignObjectElement.cpp
index 14eff89be6ac..9ca4eab5ae52 100644
--- a/content/svg/content/src/SVGForeignObjectElement.cpp
+++ b/content/svg/content/src/SVGForeignObjectElement.cpp
@@ -6,7 +6,6 @@
 #include "mozilla/Util.h"
 
 #include "nsCOMPtr.h"
-#include "mozilla/dom/SVGAnimatedLength.h"
 #include "mozilla/dom/SVGForeignObjectElement.h"
 #include "mozilla/dom/SVGForeignObjectElementBinding.h"
 
@@ -16,9 +15,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGForeignObjectElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGForeignObjectElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGForeignObjectElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGForeignObjectElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::LengthInfo SVGForeignObjectElement::sLengthInfo[4] =
diff --git a/content/svg/content/src/SVGForeignObjectElement.h b/content/svg/content/src/SVGForeignObjectElement.h
index 8c6ed3d45f04..bd6b9112a71d 100644
--- a/content/svg/content/src/SVGForeignObjectElement.h
+++ b/content/svg/content/src/SVGForeignObjectElement.h
@@ -26,7 +26,7 @@ protected:
   friend nsresult (::NS_NewSVGForeignObjectElement(nsIContent **aResult,
                                                    already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGForeignObjectElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
diff --git a/content/svg/content/src/SVGFragmentIdentifier.cpp b/content/svg/content/src/SVGFragmentIdentifier.cpp
index 61408ec4cca8..54620386611b 100644
--- a/content/svg/content/src/SVGFragmentIdentifier.cpp
+++ b/content/svg/content/src/SVGFragmentIdentifier.cpp
@@ -4,11 +4,9 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "SVGFragmentIdentifier.h"
-#include "nsIDOMSVGDocument.h"
 #include "mozilla/dom/SVGSVGElement.h"
 #include "mozilla/dom/SVGViewElement.h"
 #include "SVGAnimatedTransformList.h"
-#include "nsContentUtils.h"
 
 using namespace mozilla;
 
diff --git a/content/svg/content/src/SVGGElement.cpp b/content/svg/content/src/SVGGElement.cpp
index 0a8e8953f981..171f6c346944 100644
--- a/content/svg/content/src/SVGGElement.cpp
+++ b/content/svg/content/src/SVGGElement.cpp
@@ -12,9 +12,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGGElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGGElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGGElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGGElementBinding::Wrap(aCx, aScope, this);
 }
 
 //----------------------------------------------------------------------
diff --git a/content/svg/content/src/SVGGElement.h b/content/svg/content/src/SVGGElement.h
index 82256403027d..8bdd5a3e5a2a 100644
--- a/content/svg/content/src/SVGGElement.h
+++ b/content/svg/content/src/SVGGElement.h
@@ -6,7 +6,6 @@
 #ifndef mozilla_dom_SVGGElement_h
 #define mozilla_dom_SVGGElement_h
 
-#include "mozilla/Util.h"
 #include "mozilla/dom/SVGGraphicsElement.h"
 
 nsresult NS_NewSVGGElement(nsIContent **aResult,
@@ -20,7 +19,7 @@ class SVGGElement MOZ_FINAL : public SVGGraphicsElement,
 {
 protected:
   SVGGElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
   friend nsresult (::NS_NewSVGGElement(nsIContent **aResult,
                                        already_AddRefed<nsINodeInfo> aNodeInfo));
 
diff --git a/content/svg/content/src/SVGGradientElement.cpp b/content/svg/content/src/SVGGradientElement.cpp
index df973d3e9a82..33a24de8dc51 100644
--- a/content/svg/content/src/SVGGradientElement.cpp
+++ b/content/svg/content/src/SVGGradientElement.cpp
@@ -6,15 +6,12 @@
 #include "mozilla/dom/SVGGradientElement.h"
 
 #include "DOMSVGAnimatedTransformList.h"
-#include "mozilla/dom/SVGAnimatedLength.h"
 #include "mozilla/dom/SVGRadialGradientElementBinding.h"
 #include "mozilla/dom/SVGLinearGradientElementBinding.h"
 #include "mozilla/Util.h"
 #include "nsCOMPtr.h"
 #include "nsGkAtoms.h"
-#include "nsIDOMMutationEvent.h"
 #include "nsIDOMSVGAnimatedEnum.h"
-#include "nsIDOMSVGURIReference.h"
 #include "nsSVGElement.h"
 
 NS_IMPL_NS_NEW_NAMESPACED_SVG_ELEMENT(LinearGradient)
@@ -56,7 +53,6 @@ NS_IMPL_ADDREF_INHERITED(SVGGradientElement, SVGGradientElementBase)
 NS_IMPL_RELEASE_INHERITED(SVGGradientElement, SVGGradientElementBase)
 
 NS_INTERFACE_MAP_BEGIN(SVGGradientElement)
-  NS_INTERFACE_MAP_ENTRY(nsIDOMSVGURIReference)
 NS_INTERFACE_MAP_END_INHERITING(SVGGradientElementBase)
 
 //----------------------------------------------------------------------
@@ -107,23 +103,12 @@ SVGGradientElement::SpreadMethod()
   return mEnumAttributes[SPREADMETHOD].ToDOMAnimatedEnum(this);
 }
 
-//----------------------------------------------------------------------
-// nsIDOMSVGURIReference methods:
-
-/* readonly attribute nsIDOMSVGAnimatedString href; */
 already_AddRefed<nsIDOMSVGAnimatedString>
 SVGGradientElement::Href()
 {
   return mStringAttributes[HREF].ToDOMAnimatedString(this);
 }
 
-NS_IMETHODIMP
-SVGGradientElement::GetHref(nsIDOMSVGAnimatedString * *aHref)
-{
-  *aHref = Href().get();
-  return NS_OK;
-}
-
 //----------------------------------------------------------------------
 // nsIContent methods
 
@@ -134,7 +119,7 @@ SVGGradientElement::IsAttributeMapped(const nsIAtom* name) const
     sColorMap,
     sGradientStopMap
   };
-  
+
   return FindAttributeDependence(name, map) ||
     SVGGradientElementBase::IsAttributeMapped(name);
 }
@@ -142,10 +127,9 @@ SVGGradientElement::IsAttributeMapped(const nsIAtom* name) const
 //---------------------Linear Gradients------------------------
 
 JSObject*
-SVGLinearGradientElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                                   bool* aTriedToWrap)
+SVGLinearGradientElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return SVGLinearGradientElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGLinearGradientElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::LengthInfo SVGLinearGradientElement::sLengthInfo[4] =
@@ -224,10 +208,9 @@ SVGLinearGradientElement::GetLengthInfo()
 //-------------------------- Radial Gradients ----------------------------
 
 JSObject*
-SVGRadialGradientElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                                   bool* aTriedToWrap)
+SVGRadialGradientElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return SVGRadialGradientElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGRadialGradientElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::LengthInfo SVGRadialGradientElement::sLengthInfo[5] =
diff --git a/content/svg/content/src/SVGGradientElement.h b/content/svg/content/src/SVGGradientElement.h
index 0c0bf1a2e074..c2d0dc83b35b 100644
--- a/content/svg/content/src/SVGGradientElement.h
+++ b/content/svg/content/src/SVGGradientElement.h
@@ -6,7 +6,6 @@
 #ifndef __NS_SVGGRADIENTELEMENT_H__
 #define __NS_SVGGRADIENTELEMENT_H__
 
-#include "nsIDOMSVGURIReference.h"
 #include "nsSVGElement.h"
 #include "nsSVGLength2.h"
 #include "nsSVGEnum.h"
@@ -40,22 +39,18 @@ namespace dom {
 typedef nsSVGElement SVGGradientElementBase;
 
 class SVGGradientElement : public SVGGradientElementBase
-                         , public nsIDOMSVGURIReference
 {
   friend class ::nsSVGGradientFrame;
 
 protected:
   SVGGradientElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   virtual JSObject*
-  WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE = 0;
+  WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE = 0;
 
 public:
   // interfaces:
   NS_DECL_ISUPPORTS_INHERITED
 
-  // URI Reference
-  NS_DECL_NSIDOMSVGURIREFERENCE
-
   // nsIContent
   NS_IMETHOD_(bool) IsAttributeMapped(const nsIAtom* aAttribute) const;
 
@@ -103,7 +98,7 @@ class SVGLinearGradientElement : public SVGLinearGradientElementBase
 protected:
   SVGLinearGradientElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   virtual JSObject*
-  WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE;
+  WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
@@ -149,7 +144,7 @@ class SVGRadialGradientElement : public SVGRadialGradientElementBase
 protected:
   SVGRadialGradientElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   virtual JSObject*
-  WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE;
+  WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
diff --git a/content/svg/content/src/SVGImageElement.cpp b/content/svg/content/src/SVGImageElement.cpp
index a96cc5fe6350..47bb4f5a4e12 100644
--- a/content/svg/content/src/SVGImageElement.cpp
+++ b/content/svg/content/src/SVGImageElement.cpp
@@ -6,11 +6,9 @@
 #include "mozilla/Util.h"
 
 #include "mozilla/dom/SVGImageElement.h"
-#include "mozilla/dom/SVGAnimatedLength.h"
 #include "nsCOMPtr.h"
 #include "nsIURI.h"
 #include "nsNetUtil.h"
-#include "imgIContainer.h"
 #include "imgINotificationObserver.h"
 #include "gfxContext.h"
 #include "mozilla/dom/SVGImageElementBinding.h"
@@ -22,9 +20,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGImageElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGImageElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGImageElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGImageElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::LengthInfo SVGImageElement::sLengthInfo[4] =
@@ -43,10 +41,10 @@ nsSVGElement::StringInfo SVGImageElement::sStringInfo[1] =
 //----------------------------------------------------------------------
 // nsISupports methods
 
-NS_IMPL_ISUPPORTS_INHERITED7(SVGImageElement, SVGImageElementBase,
+NS_IMPL_ISUPPORTS_INHERITED6(SVGImageElement, SVGImageElementBase,
                              nsIDOMNode, nsIDOMElement,
                              nsIDOMSVGElement,
-                             nsIDOMSVGURIReference, imgINotificationObserver,
+                             imgINotificationObserver,
                              nsIImageLoadingContent, imgIOnloadBlocker)
 
 //----------------------------------------------------------------------
@@ -106,17 +104,6 @@ SVGImageElement::PreserveAspectRatio()
   return ratio.forget();
 }
 
-//----------------------------------------------------------------------
-// nsIDOMSVGURIReference methods:
-
-/* readonly attribute nsIDOMSVGAnimatedString href; */
-NS_IMETHODIMP
-SVGImageElement::GetHref(nsIDOMSVGAnimatedString * *aHref)
-{
-  *aHref = Href().get();
-  return NS_OK;
-}
-
 already_AddRefed<nsIDOMSVGAnimatedString>
 SVGImageElement::Href()
 {
diff --git a/content/svg/content/src/SVGImageElement.h b/content/svg/content/src/SVGImageElement.h
index 9347bd9806f9..93792916f7d1 100644
--- a/content/svg/content/src/SVGImageElement.h
+++ b/content/svg/content/src/SVGImageElement.h
@@ -6,7 +6,6 @@
 #ifndef mozilla_dom_SVGImageElement_h
 #define mozilla_dom_SVGImageElement_h
 
-#include "nsIDOMSVGURIReference.h"
 #include "nsImageLoadingContent.h"
 #include "nsSVGLength2.h"
 #include "nsSVGPathGeometryElement.h"
@@ -26,7 +25,6 @@ class DOMSVGAnimatedPreserveAspectRatio;
 
 class SVGImageElement : public SVGImageElementBase,
                         public nsIDOMSVGElement,
-                        public nsIDOMSVGURIReference,
                         public nsImageLoadingContent
 {
   friend class ::nsSVGImageFrame;
@@ -34,7 +32,7 @@ class SVGImageElement : public SVGImageElementBase,
 protected:
   SVGImageElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   virtual ~SVGImageElement();
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
   friend nsresult (::NS_NewSVGImageElement(nsIContent **aResult,
                                            already_AddRefed<nsINodeInfo> aNodeInfo));
 
@@ -42,7 +40,6 @@ public:
   // interfaces:
 
   NS_DECL_ISUPPORTS_INHERITED
-  NS_DECL_NSIDOMSVGURIREFERENCE
 
   // xxx I wish we could use virtual inheritance
   NS_FORWARD_NSIDOMNODE_TO_NSINODE
diff --git a/content/svg/content/src/SVGIntegerPairSMILType.cpp b/content/svg/content/src/SVGIntegerPairSMILType.cpp
index 70ad2cb34a37..e91e5f872e27 100644
--- a/content/svg/content/src/SVGIntegerPairSMILType.cpp
+++ b/content/svg/content/src/SVGIntegerPairSMILType.cpp
@@ -7,10 +7,9 @@
 #include "nsSMILValue.h"
 #include "nsMathUtils.h"
 #include "nsDebug.h"
-#include <math.h>
 
 namespace mozilla {
-  
+
 /*static*/ SVGIntegerPairSMILType SVGIntegerPairSMILType::sSingleton;
 
 void
diff --git a/content/svg/content/src/SVGLineElement.cpp b/content/svg/content/src/SVGLineElement.cpp
index 38503059a0e4..3dc4e000b0d2 100644
--- a/content/svg/content/src/SVGLineElement.cpp
+++ b/content/svg/content/src/SVGLineElement.cpp
@@ -3,7 +3,6 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "mozilla/dom/SVGAnimatedLength.h"
 #include "mozilla/dom/SVGLineElement.h"
 #include "mozilla/dom/SVGLineElementBinding.h"
 #include "gfxContext.h"
@@ -14,9 +13,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGLineElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGLineElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGLineElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGLineElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::LengthInfo SVGLineElement::sLengthInfo[4] =
diff --git a/content/svg/content/src/SVGLineElement.h b/content/svg/content/src/SVGLineElement.h
index e9defca0ace3..3725b972917f 100644
--- a/content/svg/content/src/SVGLineElement.h
+++ b/content/svg/content/src/SVGLineElement.h
@@ -22,7 +22,7 @@ class SVGLineElement MOZ_FINAL : public SVGLineElementBase,
 {
 protected:
   SVGLineElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
   friend nsresult (::NS_NewSVGLineElement(nsIContent **aResult,
                                           already_AddRefed<nsINodeInfo> aNodeInfo));
 
diff --git a/content/svg/content/src/SVGMPathElement.cpp b/content/svg/content/src/SVGMPathElement.cpp
index 29af5b191819..bf8ee0e32527 100644
--- a/content/svg/content/src/SVGMPathElement.cpp
+++ b/content/svg/content/src/SVGMPathElement.cpp
@@ -6,7 +6,6 @@
 #include "mozilla/Util.h"
 
 #include "mozilla/dom/SVGMPathElement.h"
-#include "nsAutoPtr.h"
 #include "nsDebug.h"
 #include "mozilla/dom/SVGAnimateMotionElement.h"
 #include "mozilla/dom/SVGPathElement.h"
@@ -19,9 +18,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGMPathElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGMPathElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGMPathElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGMPathElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::StringInfo SVGMPathElement::sStringInfo[1] =
@@ -47,8 +46,8 @@ NS_IMPL_ADDREF_INHERITED(SVGMPathElement,SVGMPathElementBase)
 NS_IMPL_RELEASE_INHERITED(SVGMPathElement,SVGMPathElementBase)
 
 NS_INTERFACE_TABLE_HEAD_CYCLE_COLLECTION_INHERITED(SVGMPathElement)
-  NS_NODE_INTERFACE_TABLE5(SVGMPathElement, nsIDOMNode, nsIDOMElement,
-                           nsIDOMSVGElement,  nsIDOMSVGURIReference,
+  NS_NODE_INTERFACE_TABLE4(SVGMPathElement, nsIDOMNode, nsIDOMElement,
+                           nsIDOMSVGElement,
                            nsIMutationObserver)
 NS_INTERFACE_MAP_END_INHERITING(SVGMPathElementBase)
 
@@ -80,23 +79,12 @@ SVGMPathElement::~SVGMPathElement()
 
 NS_IMPL_ELEMENT_CLONE_WITH_INIT(SVGMPathElement)
 
-//----------------------------------------------------------------------
-// nsIDOMSVGURIReference methods
-
-/* readonly attribute nsIDOMSVGAnimatedString href; */
 already_AddRefed<nsIDOMSVGAnimatedString>
 SVGMPathElement::Href()
 {
   return mStringAttributes[HREF].ToDOMAnimatedString(this);
 }
 
-NS_IMETHODIMP
-SVGMPathElement::GetHref(nsIDOMSVGAnimatedString** aHref)
-{
-  *aHref = Href().get();
-  return NS_OK;
-}
-
 //----------------------------------------------------------------------
 // nsIContent methods
 
diff --git a/content/svg/content/src/SVGMPathElement.h b/content/svg/content/src/SVGMPathElement.h
index 4e2cad033db4..ea856f5237da 100644
--- a/content/svg/content/src/SVGMPathElement.h
+++ b/content/svg/content/src/SVGMPathElement.h
@@ -6,7 +6,6 @@
 #ifndef mozilla_dom_SVGMPathElement_h
 #define mozilla_dom_SVGMPathElement_h
 
-#include "nsIDOMSVGURIReference.h"
 #include "nsSVGElement.h"
 #include "nsStubMutationObserver.h"
 #include "nsSVGString.h"
@@ -23,7 +22,6 @@ class SVGPathElement;
 
 class SVGMPathElement MOZ_FINAL : public SVGMPathElementBase,
                                   public nsIDOMSVGElement,
-                                  public nsIDOMSVGURIReference,
                                   public nsStubMutationObserver
 {
 protected:
@@ -32,12 +30,11 @@ protected:
   SVGMPathElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   ~SVGMPathElement();
 
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
   NS_DECL_ISUPPORTS_INHERITED
-  NS_DECL_NSIDOMSVGURIREFERENCE
 
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(SVGMPathElement,
                                            SVGMPathElementBase)
diff --git a/content/svg/content/src/SVGMarkerElement.cpp b/content/svg/content/src/SVGMarkerElement.cpp
index 5606fd428426..9193adecd6e8 100644
--- a/content/svg/content/src/SVGMarkerElement.cpp
+++ b/content/svg/content/src/SVGMarkerElement.cpp
@@ -10,8 +10,6 @@
 #include "SVGAnimatedPreserveAspectRatio.h"
 #include "nsError.h"
 #include "mozilla/dom/SVGAngle.h"
-#include "mozilla/dom/SVGAnimatedAngle.h"
-#include "mozilla/dom/SVGAnimatedLength.h"
 #include "mozilla/dom/SVGMarkerElement.h"
 #include "mozilla/dom/SVGMarkerElementBinding.h"
 #include "gfxMatrix.h"
@@ -23,9 +21,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGMarkerElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGMarkerElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGMarkerElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGMarkerElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::LengthInfo SVGMarkerElement::sLengthInfo[4] =
diff --git a/content/svg/content/src/SVGMarkerElement.h b/content/svg/content/src/SVGMarkerElement.h
index 6c25bb87e264..ab3c320f4c54 100644
--- a/content/svg/content/src/SVGMarkerElement.h
+++ b/content/svg/content/src/SVGMarkerElement.h
@@ -95,7 +95,7 @@ protected:
   friend nsresult (::NS_NewSVGMarkerElement(nsIContent **aResult,
                                             already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGMarkerElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
diff --git a/content/svg/content/src/SVGMaskElement.cpp b/content/svg/content/src/SVGMaskElement.cpp
index 048f7e2add02..46aca00fbb89 100644
--- a/content/svg/content/src/SVGMaskElement.cpp
+++ b/content/svg/content/src/SVGMaskElement.cpp
@@ -9,7 +9,6 @@
 #include "nsGkAtoms.h"
 #include "mozilla/dom/SVGMaskElement.h"
 #include "mozilla/dom/SVGMaskElementBinding.h"
-#include "mozilla/dom/SVGAnimatedLength.h"
 
 NS_IMPL_NS_NEW_NAMESPACED_SVG_ELEMENT(Mask)
 
@@ -17,9 +16,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGMaskElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGMaskElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGMaskElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGMaskElementBinding::Wrap(aCx, aScope, this);
 }
 
 //--------------------- Masks ------------------------
diff --git a/content/svg/content/src/SVGMaskElement.h b/content/svg/content/src/SVGMaskElement.h
index d80ebbbbd20c..54f480cbf19a 100644
--- a/content/svg/content/src/SVGMaskElement.h
+++ b/content/svg/content/src/SVGMaskElement.h
@@ -31,7 +31,7 @@ protected:
   friend nsresult (::NS_NewSVGMaskElement(nsIContent **aResult,
                                           already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGMaskElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
diff --git a/content/svg/content/src/SVGMatrix.cpp b/content/svg/content/src/SVGMatrix.cpp
index bcb887e5624f..c12aeb017f2b 100644
--- a/content/svg/content/src/SVGMatrix.cpp
+++ b/content/svg/content/src/SVGMatrix.cpp
@@ -27,9 +27,9 @@ SVGMatrix::GetParentObject() const
 }
 
 JSObject*
-SVGMatrix::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+SVGMatrix::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return SVGMatrixBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGMatrixBinding::Wrap(aCx, aScope, this);
 }
 
 void
diff --git a/content/svg/content/src/SVGMatrix.h b/content/svg/content/src/SVGMatrix.h
index 374fbd955108..e48d34996392 100644
--- a/content/svg/content/src/SVGMatrix.h
+++ b/content/svg/content/src/SVGMatrix.h
@@ -81,7 +81,7 @@ public:
 
   // WebIDL
   DOMSVGTransform* GetParentObject() const;
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   float A() const { return static_cast<float>(Matrix().xx); }
   void SetA(float aA, ErrorResult& rv);
diff --git a/content/svg/content/src/SVGMetadataElement.cpp b/content/svg/content/src/SVGMetadataElement.cpp
index c77118b78898..ce1ee35354e7 100644
--- a/content/svg/content/src/SVGMetadataElement.cpp
+++ b/content/svg/content/src/SVGMetadataElement.cpp
@@ -12,9 +12,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGMetadataElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGMetadataElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGMetadataElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGMetadataElementBinding::Wrap(aCx, aScope, this);
 }
 
 //----------------------------------------------------------------------
diff --git a/content/svg/content/src/SVGMetadataElement.h b/content/svg/content/src/SVGMetadataElement.h
index a5de5ed89ef9..646a26247dd8 100644
--- a/content/svg/content/src/SVGMetadataElement.h
+++ b/content/svg/content/src/SVGMetadataElement.h
@@ -24,7 +24,7 @@ protected:
                                               already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGMetadataElement(already_AddRefed<nsINodeInfo> aNodeInfo);
 
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
   nsresult Init();
 
 public:
diff --git a/content/svg/content/src/SVGMotionSMILAttr.cpp b/content/svg/content/src/SVGMotionSMILAttr.cpp
index 8adeb089c923..45b873e0ff31 100644
--- a/content/svg/content/src/SVGMotionSMILAttr.cpp
+++ b/content/svg/content/src/SVGMotionSMILAttr.cpp
@@ -9,12 +9,8 @@
 #include "SVGMotionSMILType.h"
 #include "nsISMILAnimationElement.h"
 #include "nsSMILValue.h"
-#include "nsAttrValue.h"
-#include "nsGkAtoms.h"
 #include "nsDebug.h"
-#include "nsCRT.h"
-#include "nsSVGLength2.h"
-#include "nsSMILParserUtils.h"
+#include "nsSVGElement.h"
 
 namespace mozilla {
 
diff --git a/content/svg/content/src/SVGMotionSMILPathUtils.cpp b/content/svg/content/src/SVGMotionSMILPathUtils.cpp
index e2a131c19300..e707d947c056 100644
--- a/content/svg/content/src/SVGMotionSMILPathUtils.cpp
+++ b/content/svg/content/src/SVGMotionSMILPathUtils.cpp
@@ -6,7 +6,6 @@
 #include "SVGMotionSMILPathUtils.h"
 #include "nsCharSeparatedTokenizer.h"
 #include "nsContentUtils.h"
-#include "nsSVGElement.h"
 #include "SVGContentUtils.h"
 #include "SVGLength.h"
 
diff --git a/content/svg/content/src/SVGNumberList.cpp b/content/svg/content/src/SVGNumberList.cpp
index 893858aeaa52..640594cb1fb5 100644
--- a/content/svg/content/src/SVGNumberList.cpp
+++ b/content/svg/content/src/SVGNumberList.cpp
@@ -10,10 +10,8 @@
 #include "nsError.h"
 #include "nsMathUtils.h"
 #include "nsString.h"
-#include "nsSVGElement.h"
 #include "nsTextFormatter.h"
 #include "prdtoa.h"
-#include "SVGAnimatedNumberList.h"
 #include "SVGContentUtils.h"
 
 namespace mozilla {
diff --git a/content/svg/content/src/SVGNumberPairSMILType.cpp b/content/svg/content/src/SVGNumberPairSMILType.cpp
index 37dedea4964a..0aea3465d4ce 100644
--- a/content/svg/content/src/SVGNumberPairSMILType.cpp
+++ b/content/svg/content/src/SVGNumberPairSMILType.cpp
@@ -7,10 +7,9 @@
 #include "nsSMILValue.h"
 #include "nsMathUtils.h"
 #include "nsDebug.h"
-#include <math.h>
 
 namespace mozilla {
-  
+
 /*static*/ SVGNumberPairSMILType SVGNumberPairSMILType::sSingleton;
 
 void
diff --git a/content/svg/content/src/SVGOrientSMILType.cpp b/content/svg/content/src/SVGOrientSMILType.cpp
index 95d4528fc2ee..631e92004afc 100644
--- a/content/svg/content/src/SVGOrientSMILType.cpp
+++ b/content/svg/content/src/SVGOrientSMILType.cpp
@@ -5,7 +5,6 @@
 
 #include "SVGOrientSMILType.h"
 #include "nsSMILValue.h"
-#include "nsSVGViewBox.h"
 #include "nsSVGAngle.h"
 #include "nsDebug.h"
 #include "mozilla/dom/SVGMarkerElement.h"
diff --git a/content/svg/content/src/SVGPathData.cpp b/content/svg/content/src/SVGPathData.cpp
index 69b38aac25a2..6d8795fd0763 100644
--- a/content/svg/content/src/SVGPathData.cpp
+++ b/content/svg/content/src/SVGPathData.cpp
@@ -7,7 +7,6 @@
 #include "gfxPlatform.h"
 #include "nsError.h"
 #include "nsString.h"
-#include "nsSVGElement.h"
 #include "nsSVGPathDataParser.h"
 #include "nsSVGPathGeometryElement.h" // for nsSVGMark
 #include <stdarg.h>
diff --git a/content/svg/content/src/SVGPathElement.cpp b/content/svg/content/src/SVGPathElement.cpp
index 5efa7e09da1f..159176d4efa7 100644
--- a/content/svg/content/src/SVGPathElement.cpp
+++ b/content/svg/content/src/SVGPathElement.cpp
@@ -3,8 +3,6 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "mozilla/Util.h"
-
 #include "nsGkAtoms.h"
 #include "DOMSVGPathSeg.h"
 #include "DOMSVGPathSegList.h"
@@ -12,19 +10,20 @@
 #include "nsContentUtils.h"
 #include "mozilla/dom/SVGPathElement.h"
 #include "DOMSVGPoint.h"
-#include "gfxContext.h"
 #include <algorithm>
 #include "mozilla/dom/SVGPathElementBinding.h"
 
+class gfxContext;
+
 NS_IMPL_NS_NEW_NAMESPACED_SVG_ELEMENT(Path)
 
 namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGPathElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGPathElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGPathElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGPathElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::NumberInfo SVGPathElement::sNumberInfo = 
diff --git a/content/svg/content/src/SVGPathElement.h b/content/svg/content/src/SVGPathElement.h
index acd70afe572f..28416484d85c 100644
--- a/content/svg/content/src/SVGPathElement.h
+++ b/content/svg/content/src/SVGPathElement.h
@@ -32,7 +32,7 @@ friend class nsSVGPathFrame;
 protected:
   friend nsresult (::NS_NewSVGPathElement(nsIContent **aResult,
                                           already_AddRefed<nsINodeInfo> aNodeInfo));
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
   SVGPathElement(already_AddRefed<nsINodeInfo> aNodeInfo);
 
 public:
diff --git a/content/svg/content/src/SVGPathSegListSMILType.cpp b/content/svg/content/src/SVGPathSegListSMILType.cpp
index 70df072c74cd..225638d7cc3c 100644
--- a/content/svg/content/src/SVGPathSegListSMILType.cpp
+++ b/content/svg/content/src/SVGPathSegListSMILType.cpp
@@ -3,10 +3,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include <math.h>
-
 #include "mozilla/DebugOnly.h"
-#include "mozilla/Util.h"
 
 #include "SVGPathSegListSMILType.h"
 #include "nsSMILValue.h"
diff --git a/content/svg/content/src/SVGPatternElement.cpp b/content/svg/content/src/SVGPatternElement.cpp
index d40173940e17..0378dab6aea4 100644
--- a/content/svg/content/src/SVGPatternElement.cpp
+++ b/content/svg/content/src/SVGPatternElement.cpp
@@ -6,10 +6,8 @@
 #include "mozilla/Util.h"
 
 #include "DOMSVGAnimatedTransformList.h"
-#include "nsIDOMMutationEvent.h"
 #include "nsCOMPtr.h"
 #include "nsGkAtoms.h"
-#include "mozilla/dom/SVGAnimatedLength.h"
 #include "mozilla/dom/SVGPatternElement.h"
 #include "mozilla/dom/SVGPatternElementBinding.h"
 
@@ -19,9 +17,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGPatternElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGPatternElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGPatternElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGPatternElementBinding::Wrap(aCx, aScope, this);
 }
 
 //--------------------- Patterns ------------------------
@@ -54,10 +52,9 @@ nsSVGElement::StringInfo SVGPatternElement::sStringInfo[1] =
 //----------------------------------------------------------------------
 // nsISupports methods
 
-NS_IMPL_ISUPPORTS_INHERITED4(SVGPatternElement, SVGPatternElementBase,
+NS_IMPL_ISUPPORTS_INHERITED3(SVGPatternElement, SVGPatternElementBase,
                              nsIDOMNode, nsIDOMElement,
-                             nsIDOMSVGElement,
-                             nsIDOMSVGURIReference)
+                             nsIDOMSVGElement)
 
 //----------------------------------------------------------------------
 // Implementation
@@ -138,17 +135,6 @@ SVGPatternElement::Height()
   return mLengthAttributes[ATTR_HEIGHT].ToDOMAnimatedLength(this);
 }
 
-//----------------------------------------------------------------------
-// nsIDOMSVGURIReference methods:
-
-/* readonly attribute nsIDOMSVGAnimatedString href; */
-NS_IMETHODIMP
-SVGPatternElement::GetHref(nsIDOMSVGAnimatedString * *aHref)
-{
-  *aHref = Href().get();
-  return NS_OK;
-}
-
 already_AddRefed<nsIDOMSVGAnimatedString>
 SVGPatternElement::Href()
 {
diff --git a/content/svg/content/src/SVGPatternElement.h b/content/svg/content/src/SVGPatternElement.h
index d161649c20a1..6782f1a6f824 100644
--- a/content/svg/content/src/SVGPatternElement.h
+++ b/content/svg/content/src/SVGPatternElement.h
@@ -6,7 +6,6 @@
 #ifndef mozilla_dom_SVGPatternElement_h
 #define mozilla_dom_SVGPatternElement_h
 
-#include "nsIDOMSVGURIReference.h"
 #include "nsSVGEnum.h"
 #include "nsSVGLength2.h"
 #include "nsSVGString.h"
@@ -28,8 +27,7 @@ namespace dom {
 typedef nsSVGElement SVGPatternElementBase;
 
 class SVGPatternElement MOZ_FINAL : public SVGPatternElementBase,
-                                    public nsIDOMSVGElement,
-                                    public nsIDOMSVGURIReference
+                                    public nsIDOMSVGElement
 {
   friend class ::nsSVGPatternFrame;
 
@@ -37,7 +35,7 @@ protected:
   friend nsresult (::NS_NewSVGPatternElement(nsIContent **aResult,
                                              already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGPatternElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 public:
   typedef mozilla::SVGAnimatedPreserveAspectRatio SVGAnimatedPreserveAspectRatio;
@@ -45,9 +43,6 @@ public:
   // interfaces:
   NS_DECL_ISUPPORTS_INHERITED
 
-  // URI Reference
-  NS_DECL_NSIDOMSVGURIREFERENCE
-
   NS_FORWARD_NSIDOMNODE_TO_NSINODE
   NS_FORWARD_NSIDOMELEMENT_TO_GENERIC
   NS_FORWARD_NSIDOMSVGELEMENT(nsSVGElement::)
@@ -98,7 +93,6 @@ protected:
 
   nsAutoPtr<mozilla::SVGAnimatedTransformList> mPatternTransform;
 
-  // nsIDOMSVGURIReference properties
   enum { HREF };
   nsSVGString mStringAttributes[1];
   static StringInfo sStringInfo[1];
diff --git a/content/svg/content/src/SVGPointList.cpp b/content/svg/content/src/SVGPointList.cpp
index 1ee2d7ef651f..bf1df764b82b 100644
--- a/content/svg/content/src/SVGPointList.cpp
+++ b/content/svg/content/src/SVGPointList.cpp
@@ -10,10 +10,8 @@
 #include "nsCharSeparatedTokenizer.h"
 #include "nsMathUtils.h"
 #include "nsString.h"
-#include "nsSVGElement.h"
 #include "nsTextFormatter.h"
 #include "prdtoa.h"
-#include "SVGAnimatedPointList.h"
 #include "SVGContentUtils.h"
 
 namespace mozilla {
diff --git a/content/svg/content/src/SVGPolygonElement.cpp b/content/svg/content/src/SVGPolygonElement.cpp
index 868304f4773e..253d1bbc8718 100644
--- a/content/svg/content/src/SVGPolygonElement.cpp
+++ b/content/svg/content/src/SVGPolygonElement.cpp
@@ -14,9 +14,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGPolygonElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGPolygonElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGPolygonElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGPolygonElementBinding::Wrap(aCx, aScope, this);
 }
 
 //----------------------------------------------------------------------
diff --git a/content/svg/content/src/SVGPolygonElement.h b/content/svg/content/src/SVGPolygonElement.h
index ce54e737cda2..ffe69a54ffac 100644
--- a/content/svg/content/src/SVGPolygonElement.h
+++ b/content/svg/content/src/SVGPolygonElement.h
@@ -21,7 +21,7 @@ class SVGPolygonElement MOZ_FINAL : public SVGPolygonElementBase,
 {
 protected:
   SVGPolygonElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
   friend nsresult (::NS_NewSVGPolygonElement(nsIContent **aResult,
                                              already_AddRefed<nsINodeInfo> aNodeInfo));
 
diff --git a/content/svg/content/src/SVGPolylineElement.cpp b/content/svg/content/src/SVGPolylineElement.cpp
index d715613b0175..3eeb083fb773 100644
--- a/content/svg/content/src/SVGPolylineElement.cpp
+++ b/content/svg/content/src/SVGPolylineElement.cpp
@@ -12,9 +12,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGPolylineElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGPolylineElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGPolylineElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGPolylineElementBinding::Wrap(aCx, aScope, this);
 }
 
 //----------------------------------------------------------------------
diff --git a/content/svg/content/src/SVGPolylineElement.h b/content/svg/content/src/SVGPolylineElement.h
index 669d52e1d32b..b8d67627e674 100644
--- a/content/svg/content/src/SVGPolylineElement.h
+++ b/content/svg/content/src/SVGPolylineElement.h
@@ -21,7 +21,7 @@ class SVGPolylineElement MOZ_FINAL : public SVGPolylineElementBase,
 {
 protected:
   SVGPolylineElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
   friend nsresult (::NS_NewSVGPolylineElement(nsIContent **aResult,
                                               already_AddRefed<nsINodeInfo> aNodeInfo));
 
diff --git a/content/svg/content/src/SVGPreserveAspectRatio.cpp b/content/svg/content/src/SVGPreserveAspectRatio.cpp
index 3f4ec3baba7a..44cf2906565e 100644
--- a/content/svg/content/src/SVGPreserveAspectRatio.cpp
+++ b/content/svg/content/src/SVGPreserveAspectRatio.cpp
@@ -30,9 +30,9 @@ SVGPreserveAspectRatio::operator==(const SVGPreserveAspectRatio& aOther) const
 }
 
 JSObject*
-DOMSVGPreserveAspectRatio::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+DOMSVGPreserveAspectRatio::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return mozilla::dom::SVGPreserveAspectRatioBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return mozilla::dom::SVGPreserveAspectRatioBinding::Wrap(aCx, aScope, this);
 }
 
 uint16_t
diff --git a/content/svg/content/src/SVGPreserveAspectRatio.h b/content/svg/content/src/SVGPreserveAspectRatio.h
index b8bbb2ba26d2..d24ab9c3de09 100644
--- a/content/svg/content/src/SVGPreserveAspectRatio.h
+++ b/content/svg/content/src/SVGPreserveAspectRatio.h
@@ -126,7 +126,7 @@ public:
 
   // WebIDL
   nsSVGElement* GetParentObject() const { return mSVGElement; }
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   uint16_t Align();
   void SetAlign(uint16_t aAlign, ErrorResult& rv);
diff --git a/content/svg/content/src/SVGRectElement.cpp b/content/svg/content/src/SVGRectElement.cpp
index 01853ea3da44..2e684091e72e 100644
--- a/content/svg/content/src/SVGRectElement.cpp
+++ b/content/svg/content/src/SVGRectElement.cpp
@@ -7,7 +7,6 @@
 #include "nsGkAtoms.h"
 #include "gfxContext.h"
 #include "mozilla/dom/SVGRectElementBinding.h"
-#include "mozilla/dom/SVGAnimatedLength.h"
 #include <algorithm>
 
 NS_IMPL_NS_NEW_NAMESPACED_SVG_ELEMENT(Rect)
@@ -15,10 +14,12 @@ NS_IMPL_NS_NEW_NAMESPACED_SVG_ELEMENT(Rect)
 namespace mozilla {
 namespace dom {
 
+class SVGAnimatedLength;
+
 JSObject*
-SVGRectElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGRectElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGRectElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGRectElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::LengthInfo SVGRectElement::sLengthInfo[6] =
diff --git a/content/svg/content/src/SVGRectElement.h b/content/svg/content/src/SVGRectElement.h
index 4091782f54ab..4a03aa666285 100644
--- a/content/svg/content/src/SVGRectElement.h
+++ b/content/svg/content/src/SVGRectElement.h
@@ -22,7 +22,7 @@ class SVGRectElement MOZ_FINAL : public SVGRectElementBase,
 {
 protected:
   SVGRectElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
   friend nsresult (::NS_NewSVGRectElement(nsIContent **aResult,
                                           already_AddRefed<nsINodeInfo> aNodeInfo));
 
diff --git a/content/svg/content/src/SVGSVGElement.cpp b/content/svg/content/src/SVGSVGElement.cpp
index fd89ede346ca..fb71db8ef714 100644
--- a/content/svg/content/src/SVGSVGElement.cpp
+++ b/content/svg/content/src/SVGSVGElement.cpp
@@ -16,10 +16,8 @@
 #include "nsIPresShell.h"
 #include "nsContentUtils.h"
 #include "nsIDocument.h"
-#include "nsPresContext.h"
 #include "mozilla/dom/SVGMatrix.h"
 #include "DOMSVGPoint.h"
-#include "nsIDOMEventTarget.h"
 #include "nsIFrame.h"
 #include "nsISVGSVGFrame.h" //XXX
 #include "nsSVGRect.h"
@@ -37,9 +35,7 @@
 #include "nsSMILTimeContainer.h"
 #include "nsSMILAnimationController.h"
 #include "nsSMILTypes.h"
-#include "nsIContentIterator.h"
 #include "SVGAngle.h"
-#include "mozilla/dom/SVGAnimatedLength.h"
 #include <algorithm>
 
 NS_IMPL_NS_NEW_NAMESPACED_SVG_ELEMENT_CHECK_PARSER(SVG)
@@ -47,10 +43,12 @@ NS_IMPL_NS_NEW_NAMESPACED_SVG_ELEMENT_CHECK_PARSER(SVG)
 namespace mozilla {
 namespace dom {
 
+class SVGAnimatedLength;
+
 JSObject*
-SVGSVGElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGSVGElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGSVGElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGSVGElementBinding::Wrap(aCx, aScope, this);
 }
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(DOMSVGTranslatePoint,
@@ -526,7 +524,7 @@ SVGSVGElement::SetCurrentScaleTranslate(float s, float x, float y)
       bool scaling = (mPreviousScale != mCurrentScale);
       nsEventStatus status = nsEventStatus_eIgnore;
       nsGUIEvent event(true, scaling ? NS_SVG_ZOOM : NS_SVG_SCROLL, 0);
-      event.eventStructType = scaling ? NS_SVGZOOM_EVENT : NS_SVG_EVENT;
+      event.eventStructType = scaling ? NS_SVGZOOM_EVENT : NS_EVENT;
       presShell->HandleDOMEventWithTarget(this, &event, &status);
       InvalidateTransformNotifyFrame();
     }
diff --git a/content/svg/content/src/SVGSVGElement.h b/content/svg/content/src/SVGSVGElement.h
index cfc07f0c0440..9c81bf60e7fa 100644
--- a/content/svg/content/src/SVGSVGElement.h
+++ b/content/svg/content/src/SVGSVGElement.h
@@ -90,7 +90,7 @@ class SVGSVGElement MOZ_FINAL : public SVGSVGElementBase,
 
   SVGSVGElement(already_AddRefed<nsINodeInfo> aNodeInfo,
                 FromParser aFromParser);
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
   friend nsresult (::NS_NewSVGSVGElement(nsIContent **aResult,
                                          already_AddRefed<nsINodeInfo> aNodeInfo,
diff --git a/content/svg/content/src/SVGScriptElement.cpp b/content/svg/content/src/SVGScriptElement.cpp
index 035fde9ffd4e..e5d084782d5d 100644
--- a/content/svg/content/src/SVGScriptElement.cpp
+++ b/content/svg/content/src/SVGScriptElement.cpp
@@ -16,9 +16,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGScriptElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGScriptElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGScriptElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGScriptElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::StringInfo SVGScriptElement::sStringInfo[1] =
@@ -29,10 +29,10 @@ nsSVGElement::StringInfo SVGScriptElement::sStringInfo[1] =
 //----------------------------------------------------------------------
 // nsISupports methods
 
-NS_IMPL_ISUPPORTS_INHERITED7(SVGScriptElement, SVGScriptElementBase,
+NS_IMPL_ISUPPORTS_INHERITED6(SVGScriptElement, SVGScriptElementBase,
                              nsIDOMNode, nsIDOMElement,
                              nsIDOMSVGElement,
-                             nsIDOMSVGURIReference, nsIScriptLoaderObserver,
+                             nsIScriptLoaderObserver,
                              nsIScriptElement, nsIMutationObserver)
 
 //----------------------------------------------------------------------
@@ -99,17 +99,6 @@ SVGScriptElement::SetCrossOrigin(const nsAString & aOrigin, ErrorResult& rv)
   rv = SetAttr(kNameSpaceID_None, nsGkAtoms::crossorigin, aOrigin, true);
 }
 
-//----------------------------------------------------------------------
-// nsIDOMSVGURIReference methods
-
-/* readonly attribute nsIDOMSVGAnimatedString href; */
-NS_IMETHODIMP
-SVGScriptElement::GetHref(nsIDOMSVGAnimatedString * *aHref)
-{
-  *aHref = Href().get();
-  return NS_OK;
-}
-
 already_AddRefed<nsIDOMSVGAnimatedString>
 SVGScriptElement::Href()
 {
diff --git a/content/svg/content/src/SVGScriptElement.h b/content/svg/content/src/SVGScriptElement.h
index 7086f2e042ee..d19c5d42efcb 100644
--- a/content/svg/content/src/SVGScriptElement.h
+++ b/content/svg/content/src/SVGScriptElement.h
@@ -8,7 +8,6 @@
 #define mozilla_dom_SVGScriptElement_h
 
 #include "nsSVGElement.h"
-#include "nsIDOMSVGURIReference.h"
 #include "nsCOMPtr.h"
 #include "nsSVGString.h"
 #include "nsIDocument.h"
@@ -25,7 +24,6 @@ typedef nsSVGElement SVGScriptElementBase;
 
 class SVGScriptElement MOZ_FINAL : public SVGScriptElementBase,
                                    public nsIDOMSVGElement,
-                                   public nsIDOMSVGURIReference,
                                    public nsScriptElement
 {
 protected:
@@ -35,13 +33,12 @@ protected:
   SVGScriptElement(already_AddRefed<nsINodeInfo> aNodeInfo,
                    FromParser aFromParser);
 
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
 
   NS_DECL_ISUPPORTS_INHERITED
-  NS_DECL_NSIDOMSVGURIREFERENCE
 
   // xxx If xpcom allowed virtual inheritance we wouldn't need to
   // forward here :-(
diff --git a/content/svg/content/src/SVGSetElement.cpp b/content/svg/content/src/SVGSetElement.cpp
index 3473a44fd276..af91dbff6ed0 100644
--- a/content/svg/content/src/SVGSetElement.cpp
+++ b/content/svg/content/src/SVGSetElement.cpp
@@ -12,9 +12,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGSetElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGSetElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGSetElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGSetElementBinding::Wrap(aCx, aScope, this);
 }
 
 //----------------------------------------------------------------------
diff --git a/content/svg/content/src/SVGSetElement.h b/content/svg/content/src/SVGSetElement.h
index e86164dc1560..a68ae7e888f6 100644
--- a/content/svg/content/src/SVGSetElement.h
+++ b/content/svg/content/src/SVGSetElement.h
@@ -26,7 +26,7 @@ protected:
   friend nsresult (::NS_NewSVGSetElement(nsIContent **aResult,
                                          already_AddRefed<nsINodeInfo> aNodeInfo));
 
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
diff --git a/content/svg/content/src/SVGStopElement.cpp b/content/svg/content/src/SVGStopElement.cpp
index 294eb81b550a..7208aa00d792 100644
--- a/content/svg/content/src/SVGStopElement.cpp
+++ b/content/svg/content/src/SVGStopElement.cpp
@@ -12,9 +12,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGStopElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGStopElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGStopElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGStopElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::NumberInfo SVGStopElement::sNumberInfo =
diff --git a/content/svg/content/src/SVGStopElement.h b/content/svg/content/src/SVGStopElement.h
index ee2ef2bf92e1..b75e3732ba84 100644
--- a/content/svg/content/src/SVGStopElement.h
+++ b/content/svg/content/src/SVGStopElement.h
@@ -24,7 +24,7 @@ protected:
   friend nsresult (::NS_NewSVGStopElement(nsIContent **aResult,
                                           already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGStopElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
diff --git a/content/svg/content/src/SVGStringList.cpp b/content/svg/content/src/SVGStringList.cpp
index 6dd136788aaf..af49b0fd7d2b 100644
--- a/content/svg/content/src/SVGStringList.cpp
+++ b/content/svg/content/src/SVGStringList.cpp
@@ -3,15 +3,10 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "mozilla/Util.h"
-
 #include "SVGStringList.h"
 #include "nsError.h"
 #include "nsCharSeparatedTokenizer.h"
-#include "nsMathUtils.h"
 #include "nsString.h"
-#include "nsSVGElement.h"
-#include "nsTextFormatter.h"
 #include "nsWhitespaceTokenizer.h"
 #include "SVGContentUtils.h"
 
diff --git a/content/svg/content/src/SVGStyleElement.cpp b/content/svg/content/src/SVGStyleElement.cpp
index f023406c0bf5..72ed079e0c6d 100644
--- a/content/svg/content/src/SVGStyleElement.cpp
+++ b/content/svg/content/src/SVGStyleElement.cpp
@@ -6,7 +6,6 @@
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/SVGStyleElement.h"
 #include "nsContentUtils.h"
-#include "nsStubMutationObserver.h"
 #include "mozilla/dom/SVGStyleElementBinding.h"
 
 NS_IMPL_NS_NEW_NAMESPACED_SVG_ELEMENT(Style)
@@ -15,9 +14,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGStyleElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGStyleElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGStyleElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGStyleElementBinding::Wrap(aCx, aScope, this);
 }
 
 //----------------------------------------------------------------------
diff --git a/content/svg/content/src/SVGStyleElement.h b/content/svg/content/src/SVGStyleElement.h
index 40914a92ed9d..f524d8c013e9 100644
--- a/content/svg/content/src/SVGStyleElement.h
+++ b/content/svg/content/src/SVGStyleElement.h
@@ -28,7 +28,7 @@ protected:
                                            already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGStyleElement(already_AddRefed<nsINodeInfo> aNodeInfo);
 
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
 public:
   NS_DECL_ISUPPORTS_INHERITED
diff --git a/content/svg/content/src/SVGSwitchElement.cpp b/content/svg/content/src/SVGSwitchElement.cpp
index 7111d830068d..2cf5fb395af9 100644
--- a/content/svg/content/src/SVGSwitchElement.cpp
+++ b/content/svg/content/src/SVGSwitchElement.cpp
@@ -3,23 +3,22 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "mozilla/Util.h"
-
 #include "mozilla/dom/SVGSwitchElement.h"
-#include "nsIFrame.h"
 #include "nsSVGUtils.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/dom/SVGSwitchElementBinding.h"
 
+class nsIFrame;
+
 NS_IMPL_NS_NEW_NAMESPACED_SVG_ELEMENT(Switch)
 
 namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGSwitchElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGSwitchElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGSwitchElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGSwitchElementBinding::Wrap(aCx, aScope, this);
 }
 
 //----------------------------------------------------------------------
diff --git a/content/svg/content/src/SVGSwitchElement.h b/content/svg/content/src/SVGSwitchElement.h
index d1d55102391e..1fb0e2cb56b5 100644
--- a/content/svg/content/src/SVGSwitchElement.h
+++ b/content/svg/content/src/SVGSwitchElement.h
@@ -24,7 +24,7 @@ protected:
   friend nsresult (::NS_NewSVGSwitchElement(nsIContent **aResult,
                                             already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGSwitchElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
 public:
   nsIContent * GetActiveChild() const
diff --git a/content/svg/content/src/SVGSymbolElement.cpp b/content/svg/content/src/SVGSymbolElement.cpp
index b46ad4a3fc0b..2155031fb34f 100644
--- a/content/svg/content/src/SVGSymbolElement.cpp
+++ b/content/svg/content/src/SVGSymbolElement.cpp
@@ -12,9 +12,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGSymbolElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGSymbolElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGSymbolElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGSymbolElementBinding::Wrap(aCx, aScope, this);
 }
 
 //----------------------------------------------------------------------
diff --git a/content/svg/content/src/SVGSymbolElement.h b/content/svg/content/src/SVGSymbolElement.h
index 558d04cf44ff..a817907a9696 100644
--- a/content/svg/content/src/SVGSymbolElement.h
+++ b/content/svg/content/src/SVGSymbolElement.h
@@ -10,7 +10,6 @@
 #include "nsSVGElement.h"
 #include "nsSVGViewBox.h"
 #include "SVGAnimatedPreserveAspectRatio.h"
-#include "nsGkAtoms.h"
 
 nsresult NS_NewSVGSymbolElement(nsIContent **aResult,
                                 already_AddRefed<nsINodeInfo> aNodeInfo);
@@ -28,7 +27,7 @@ protected:
   friend nsresult (::NS_NewSVGSymbolElement(nsIContent **aResult,
                                             already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGSymbolElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
diff --git a/content/svg/content/src/SVGTSpanElement.cpp b/content/svg/content/src/SVGTSpanElement.cpp
index 40299bde5338..5f87731655c1 100644
--- a/content/svg/content/src/SVGTSpanElement.cpp
+++ b/content/svg/content/src/SVGTSpanElement.cpp
@@ -13,9 +13,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGTSpanElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGTSpanElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGTSpanElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGTSpanElementBinding::Wrap(aCx, aScope, this);
 }
 
 
diff --git a/content/svg/content/src/SVGTSpanElement.h b/content/svg/content/src/SVGTSpanElement.h
index 9ee09e263a22..573ddd36c16d 100644
--- a/content/svg/content/src/SVGTSpanElement.h
+++ b/content/svg/content/src/SVGTSpanElement.h
@@ -23,7 +23,7 @@ protected:
   friend nsresult (::NS_NewSVGTSpanElement(nsIContent **aResult,
                                            already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGTSpanElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
diff --git a/content/svg/content/src/SVGTextElement.cpp b/content/svg/content/src/SVGTextElement.cpp
index 27849a608f75..c7200cb56762 100644
--- a/content/svg/content/src/SVGTextElement.cpp
+++ b/content/svg/content/src/SVGTextElement.cpp
@@ -12,9 +12,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGTextElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGTextElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGTextElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGTextElementBinding::Wrap(aCx, aScope, this);
 }
 
 //----------------------------------------------------------------------
diff --git a/content/svg/content/src/SVGTextElement.h b/content/svg/content/src/SVGTextElement.h
index f796bc47333c..315033ca17dc 100644
--- a/content/svg/content/src/SVGTextElement.h
+++ b/content/svg/content/src/SVGTextElement.h
@@ -21,7 +21,7 @@ class SVGTextElement MOZ_FINAL : public SVGTextElementBase,
 {
 protected:
   SVGTextElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
   friend nsresult (::NS_NewSVGTextElement(nsIContent **aResult,
                                           already_AddRefed<nsINodeInfo> aNodeInfo));
diff --git a/content/svg/content/src/SVGTextPathElement.cpp b/content/svg/content/src/SVGTextPathElement.cpp
index f213a9cf72db..6c624299911e 100644
--- a/content/svg/content/src/SVGTextPathElement.cpp
+++ b/content/svg/content/src/SVGTextPathElement.cpp
@@ -7,21 +7,21 @@
 #include "mozilla/dom/SVGTextPathElementBinding.h"
 #include "nsSVGElement.h"
 #include "nsGkAtoms.h"
-#include "nsIDOMSVGURIReference.h"
 #include "nsIFrame.h"
 #include "nsError.h"
 #include "nsContentUtils.h"
-#include "mozilla/dom/SVGAnimatedLength.h"
 
 NS_IMPL_NS_NEW_NAMESPACED_SVG_ELEMENT(TextPath)
 
 namespace mozilla {
 namespace dom {
 
+class SVGAnimatedLength;
+
 JSObject*
-SVGTextPathElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGTextPathElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGTextPathElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGTextPathElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::LengthInfo SVGTextPathElement::sLengthInfo[1] =
@@ -79,16 +79,6 @@ SVGTextPathElement::SVGTextPathElement(already_AddRefed<nsINodeInfo> aNodeInfo)
 
 NS_IMPL_ELEMENT_CLONE_WITH_INIT(SVGTextPathElement)
 
-//----------------------------------------------------------------------
-// nsIDOMSVGURIReference methods
-
-/* readonly attribute nsIDOMSVGAnimatedString href; */
-NS_IMETHODIMP SVGTextPathElement::GetHref(nsIDOMSVGAnimatedString * *aHref)
-{
-  *aHref = Href().get();
-  return NS_OK;
-}
-
 already_AddRefed<nsIDOMSVGAnimatedString>
 SVGTextPathElement::Href()
 {
diff --git a/content/svg/content/src/SVGTextPathElement.h b/content/svg/content/src/SVGTextPathElement.h
index 2590f47ae9de..def4101b848a 100644
--- a/content/svg/content/src/SVGTextPathElement.h
+++ b/content/svg/content/src/SVGTextPathElement.h
@@ -6,10 +6,7 @@
 #ifndef mozilla_dom_SVGTextPathElement_h
 #define mozilla_dom_SVGTextPathElement_h
 
-#include "nsIDOMElement.h"
-#include "nsIDOMNode.h"
 #include "nsIDOMSVGElement.h"
-#include "nsIDOMSVGURIReference.h"
 #include "nsSVGEnum.h"
 #include "nsSVGLength2.h"
 #include "nsSVGString.h"
@@ -17,9 +14,7 @@
 
 class nsIAtom;
 class nsIContent;
-class nsINode;
 class nsINodeInfo;
-class nsXPCClassInfo;
 class nsSVGTextPathFrame;
 
 nsresult NS_NewSVGTextPathElement(nsIContent **aResult,
@@ -40,8 +35,7 @@ static const unsigned short TEXTPATH_SPACINGTYPE_EXACT   = 2;
 typedef SVGTextContentElement SVGTextPathElementBase;
 
 class SVGTextPathElement MOZ_FINAL : public SVGTextPathElementBase,
-                                     public nsIDOMSVGElement,
-                                     public nsIDOMSVGURIReference
+                                     public nsIDOMSVGElement
 {
 friend class ::nsSVGTextPathFrame;
 friend class ::nsSVGTextFrame2;
@@ -50,13 +44,12 @@ protected:
   friend nsresult (::NS_NewSVGTextPathElement(nsIContent **aResult,
                                               already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGTextPathElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
 
   NS_DECL_ISUPPORTS_INHERITED
-  NS_DECL_NSIDOMSVGURIREFERENCE
 
   // xxx If xpcom allowed virtual inheritance we wouldn't need to
   // forward here :-(
diff --git a/content/svg/content/src/SVGTextPositioningElement.cpp b/content/svg/content/src/SVGTextPositioningElement.cpp
index cdb8196c9482..1762ab503afd 100644
--- a/content/svg/content/src/SVGTextPositioningElement.cpp
+++ b/content/svg/content/src/SVGTextPositioningElement.cpp
@@ -10,7 +10,6 @@
 #include "DOMSVGAnimatedLengthList.h"
 #include "DOMSVGAnimatedNumberList.h"
 #include "SVGContentUtils.h"
-#include "SVGLengthList.h"
 
 namespace mozilla {
 namespace dom {
diff --git a/content/svg/content/src/SVGTitleElement.cpp b/content/svg/content/src/SVGTitleElement.cpp
index 1aaaa13d01e4..e68c405c1b76 100644
--- a/content/svg/content/src/SVGTitleElement.cpp
+++ b/content/svg/content/src/SVGTitleElement.cpp
@@ -12,9 +12,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGTitleElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGTitleElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGTitleElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGTitleElementBinding::Wrap(aCx, aScope, this);
 }
 
 //----------------------------------------------------------------------
diff --git a/content/svg/content/src/SVGTitleElement.h b/content/svg/content/src/SVGTitleElement.h
index feb83cc63036..83408efd6efa 100644
--- a/content/svg/content/src/SVGTitleElement.h
+++ b/content/svg/content/src/SVGTitleElement.h
@@ -25,7 +25,7 @@ protected:
                                            already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGTitleElement(already_AddRefed<nsINodeInfo> aNodeInfo);
 
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
diff --git a/content/svg/content/src/SVGTransformListParser.cpp b/content/svg/content/src/SVGTransformListParser.cpp
index fcf239e49907..aeceefe69525 100644
--- a/content/svg/content/src/SVGTransformListParser.cpp
+++ b/content/svg/content/src/SVGTransformListParser.cpp
@@ -8,12 +8,10 @@
 
 #include "SVGTransformListParser.h"
 #include "SVGTransform.h"
-#include "prdtoa.h"
 #include "nsError.h"
 #include "nsGkAtoms.h"
-#include "nsCRT.h"
-#include "nsDOMClassInfoID.h"
 #include "nsIAtom.h"
+#include "plstr.h"
 
 using namespace mozilla;
 
diff --git a/content/svg/content/src/SVGUseElement.cpp b/content/svg/content/src/SVGUseElement.cpp
index ea6358c5991d..8f51fdb1fed2 100644
--- a/content/svg/content/src/SVGUseElement.cpp
+++ b/content/svg/content/src/SVGUseElement.cpp
@@ -5,7 +5,6 @@
 
 #include "mozilla/Util.h"
 
-#include "mozilla/dom/SVGAnimatedLength.h"
 #include "mozilla/dom/SVGUseElement.h"
 #include "mozilla/dom/SVGUseElementBinding.h"
 #include "nsGkAtoms.h"
@@ -21,9 +20,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGUseElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGUseElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGUseElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGUseElementBinding::Wrap(aCx, aScope, this);
 }
 
 ////////////////////////////////////////////////////////////////////////
@@ -63,9 +62,8 @@ NS_IMPL_ADDREF_INHERITED(SVGUseElement,SVGUseElementBase)
 NS_IMPL_RELEASE_INHERITED(SVGUseElement,SVGUseElementBase)
 
 NS_INTERFACE_TABLE_HEAD_CYCLE_COLLECTION_INHERITED(SVGUseElement)
-  NS_NODE_INTERFACE_TABLE5(SVGUseElement, nsIDOMNode, nsIDOMElement,
+  NS_NODE_INTERFACE_TABLE4(SVGUseElement, nsIDOMNode, nsIDOMElement,
                            nsIDOMSVGElement,
-                           nsIDOMSVGURIReference,
                            nsIMutationObserver)
 NS_INTERFACE_MAP_END_INHERITING(SVGUseElementBase)
 
@@ -120,16 +118,6 @@ SVGUseElement::Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const
   return NS_FAILED(rv1) ? rv1 : rv2;
 }
 
-//----------------------------------------------------------------------
-// nsIDOMSVGURIReference methods
-
-/* readonly attribute nsIDOMSVGAnimatedString href; */
-  NS_IMETHODIMP SVGUseElement::GetHref(nsIDOMSVGAnimatedString * *aHref)
-{
-  *aHref = Href().get();
-  return NS_OK;
-}
-
 already_AddRefed<nsIDOMSVGAnimatedString>
 SVGUseElement::Href()
 {
diff --git a/content/svg/content/src/SVGUseElement.h b/content/svg/content/src/SVGUseElement.h
index 39c8484a1e26..b79d254435a4 100644
--- a/content/svg/content/src/SVGUseElement.h
+++ b/content/svg/content/src/SVGUseElement.h
@@ -7,7 +7,6 @@
 #define mozilla_dom_SVGUseElement_h
 
 #include "mozilla/dom/FromParser.h"
-#include "nsIDOMSVGURIReference.h"
 #include "nsReferencedElement.h"
 #include "nsStubMutationObserver.h"
 #include "mozilla/dom/SVGGraphicsElement.h"
@@ -33,7 +32,6 @@ typedef SVGGraphicsElement SVGUseElementBase;
 
 class SVGUseElement MOZ_FINAL : public SVGUseElementBase,
                                 public nsIDOMSVGElement,
-                                public nsIDOMSVGURIReference,
                                 public nsStubMutationObserver
 {
   friend class ::nsSVGUseFrame;
@@ -42,14 +40,13 @@ protected:
                                          already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGUseElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   virtual ~SVGUseElement();
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(SVGUseElement, SVGUseElementBase)
-  NS_DECL_NSIDOMSVGURIREFERENCE
 
   NS_DECL_NSIMUTATIONOBSERVER_CHARACTERDATACHANGED
   NS_DECL_NSIMUTATIONOBSERVER_ATTRIBUTECHANGED
diff --git a/content/svg/content/src/SVGViewElement.cpp b/content/svg/content/src/SVGViewElement.cpp
index 8674d9d7bcf6..343b6df334c7 100644
--- a/content/svg/content/src/SVGViewElement.cpp
+++ b/content/svg/content/src/SVGViewElement.cpp
@@ -13,9 +13,9 @@ namespace mozilla {
 namespace dom {
 
 JSObject*
-SVGViewElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+SVGViewElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGViewElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGViewElementBinding::Wrap(aCx, aScope, this);
 }
 
 nsSVGElement::StringListInfo SVGViewElement::sStringListInfo[1] =
diff --git a/content/svg/content/src/SVGViewElement.h b/content/svg/content/src/SVGViewElement.h
index 8c669c408049..c02054b4a0dc 100644
--- a/content/svg/content/src/SVGViewElement.h
+++ b/content/svg/content/src/SVGViewElement.h
@@ -40,7 +40,7 @@ protected:
   SVGViewElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   friend nsresult (::NS_NewSVGViewElement(nsIContent **aResult,
                                           already_AddRefed<nsINodeInfo> aNodeInfo));
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 public:
   // interfaces:
diff --git a/content/svg/content/src/nsDOMSVGEvent.cpp b/content/svg/content/src/nsDOMSVGEvent.cpp
deleted file mode 100644
index f18f7cdf6d79..000000000000
--- a/content/svg/content/src/nsDOMSVGEvent.cpp
+++ /dev/null
@@ -1,57 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsDOMClassInfoID.h"
-#include "nsDOMSVGEvent.h"
-
-//----------------------------------------------------------------------
-// Implementation
-
-nsDOMSVGEvent::nsDOMSVGEvent(mozilla::dom::EventTarget* aOwner,
-                             nsPresContext* aPresContext,
-                             nsEvent* aEvent)
-  : nsDOMEvent(aOwner, aPresContext,
-               aEvent ? aEvent : new nsEvent(false, 0))
-{
-  if (aEvent) {
-    mEventIsInternal = false;
-  }
-  else {
-    mEventIsInternal = true;
-    mEvent->eventStructType = NS_SVG_EVENT;
-    mEvent->time = PR_Now();
-  }
-
-  mEvent->mFlags.mCancelable = false;
-  mEvent->mFlags.mBubbles =
-    (mEvent->message != NS_SVG_LOAD && mEvent->message != NS_SVG_UNLOAD);
-}
-
-//----------------------------------------------------------------------
-// nsISupports methods:
-
-NS_IMPL_ADDREF_INHERITED(nsDOMSVGEvent, nsDOMEvent)
-NS_IMPL_RELEASE_INHERITED(nsDOMSVGEvent, nsDOMEvent)
-
-DOMCI_DATA(SVGEvent, nsDOMSVGEvent)
-
-NS_INTERFACE_MAP_BEGIN(nsDOMSVGEvent)
-  NS_INTERFACE_MAP_ENTRY(nsIDOMSVGEvent)
-  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(SVGEvent)
-NS_INTERFACE_MAP_END_INHERITING(nsDOMEvent)
-
-
-////////////////////////////////////////////////////////////////////////
-// Exported creation functions:
-
-nsresult
-NS_NewDOMSVGEvent(nsIDOMEvent** aInstancePtrResult,
-                  mozilla::dom::EventTarget* aOwner,
-                  nsPresContext* aPresContext,
-                  nsEvent *aEvent)
-{
-  nsDOMSVGEvent* it = new nsDOMSVGEvent(aOwner, aPresContext, aEvent);
-  return CallQueryInterface(it, aInstancePtrResult);
-}
diff --git a/content/svg/content/src/nsDOMSVGEvent.h b/content/svg/content/src/nsDOMSVGEvent.h
deleted file mode 100644
index 772568d513cb..000000000000
--- a/content/svg/content/src/nsDOMSVGEvent.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef __NS_SVGEVENT_H__
-#define __NS_SVGEVENT_H__
-
-#include "nsDOMEvent.h"
-#include "nsIDOMSVGEvent.h"
-
-class nsEvent;
-class nsPresContext;
-
-class nsDOMSVGEvent : public nsDOMEvent,
-                      public nsIDOMSVGEvent
-{
-public:
-  nsDOMSVGEvent(mozilla::dom::EventTarget* aOwner,
-                nsPresContext* aPresContext, nsEvent* aEvent);
-
-  // nsISupports interface:
-  NS_DECL_ISUPPORTS_INHERITED
-
-  // nsIDOMSVGEvent interface:
-  NS_DECL_NSIDOMSVGEVENT
-
-  // Forward to base class
-  NS_FORWARD_TO_NSDOMEVENT
-};
-
-#endif // __NS_SVGEVENT_H__
diff --git a/content/svg/content/src/nsDOMSVGZoomEvent.cpp b/content/svg/content/src/nsDOMSVGZoomEvent.cpp
index 8a23bd37d4ab..e73f763ecf59 100644
--- a/content/svg/content/src/nsDOMSVGZoomEvent.cpp
+++ b/content/svg/content/src/nsDOMSVGZoomEvent.cpp
@@ -4,7 +4,6 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsDOMSVGZoomEvent.h"
-#include "nsSVGRect.h"
 #include "DOMSVGPoint.h"
 #include "mozilla/dom/SVGSVGElement.h"
 #include "nsIPresShell.h"
diff --git a/content/svg/content/src/nsISVGPoint.cpp b/content/svg/content/src/nsISVGPoint.cpp
index 6e7146369415..3cdc00b11e5f 100644
--- a/content/svg/content/src/nsISVGPoint.cpp
+++ b/content/svg/content/src/nsISVGPoint.cpp
@@ -3,14 +3,12 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "DOMSVGPoint.h"
+#include "nsISVGPoint.h"
 #include "DOMSVGPointList.h"
 #include "SVGPoint.h"
-#include "SVGAnimatedPointList.h"
 #include "nsSVGElement.h"
 #include "nsError.h"
 #include "nsContentUtils.h" // NS_ENSURE_FINITE
-#include "mozilla/dom/SVGMatrix.h"
 #include "mozilla/dom/SVGPointBinding.h"
 
 // See the architecture comment in DOMSVGPointList.h.
diff --git a/content/svg/content/src/nsISVGPoint.h b/content/svg/content/src/nsISVGPoint.h
index cad8d8a6064e..b30a78375ee7 100644
--- a/content/svg/content/src/nsISVGPoint.h
+++ b/content/svg/content/src/nsISVGPoint.h
@@ -140,9 +140,8 @@ public:
   virtual float Y() = 0;
   virtual void SetY(float aY, ErrorResult& rv) = 0;
   virtual already_AddRefed<nsISVGPoint> MatrixTransform(dom::SVGMatrix& matrix) = 0;
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap)
-    { return dom::SVGPointBinding::Wrap(cx, scope, this, triedToWrap); }
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE
+    { return dom::SVGPointBinding::Wrap(cx, scope, this); }
 
   virtual nsISupports* GetParentObject() = 0;
 
diff --git a/content/svg/content/src/nsSVGAngle.cpp b/content/svg/content/src/nsSVGAngle.cpp
index 98e6a7306294..a8d197fcc3c9 100644
--- a/content/svg/content/src/nsSVGAngle.cpp
+++ b/content/svg/content/src/nsSVGAngle.cpp
@@ -17,7 +17,6 @@
 #include "nsAttrValueInlines.h"
 #include "SVGAngle.h"
 #include "SVGAnimatedAngle.h"
-#include "mozilla/Attributes.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
diff --git a/content/svg/content/src/nsSVGAngle.h b/content/svg/content/src/nsSVGAngle.h
index 9a9dc3fc9ac0..c47c881e9ecd 100644
--- a/content/svg/content/src/nsSVGAngle.h
+++ b/content/svg/content/src/nsSVGAngle.h
@@ -6,16 +6,15 @@
 #ifndef __NS_SVGANGLE_H__
 #define __NS_SVGANGLE_H__
 
-#include "nsAutoPtr.h"
-#include "nsCycleCollectionParticipant.h"
+#include "nsCOMPtr.h"
 #include "nsError.h"
 #include "nsISMILAttr.h"
-#include "nsSVGElement.h"
-#include "nsWrapperCache.h"
 #include "mozilla/Attributes.h"
 
+class nsISupports;
 class nsISMILAnimationElement;
 class nsSMILValue;
+class nsSVGElement;
 
 namespace mozilla {
 
diff --git a/content/svg/content/src/nsSVGBoolean.h b/content/svg/content/src/nsSVGBoolean.h
index 2a0aac7849e3..2fa1775ce288 100644
--- a/content/svg/content/src/nsSVGBoolean.h
+++ b/content/svg/content/src/nsSVGBoolean.h
@@ -6,16 +6,15 @@
 #ifndef __NS_SVGBOOLEAN_H__
 #define __NS_SVGBOOLEAN_H__
 
-#include "nsAutoPtr.h"
-#include "nsCycleCollectionParticipant.h"
 #include "nsError.h"
 #include "nsISMILAttr.h"
-#include "nsISupportsImpl.h"
-#include "nsSVGElement.h"
 #include "mozilla/Attributes.h"
 
+class nsIAtom;
 class nsISMILAnimationElement;
+class nsISupports;
 class nsSMILValue;
+class nsSVGElement;
 
 class nsSVGBoolean
 {
diff --git a/content/svg/content/src/nsSVGElement.cpp b/content/svg/content/src/nsSVGElement.cpp
index 58ebe88f11cb..a3bc1c212546 100644
--- a/content/svg/content/src/nsSVGElement.cpp
+++ b/content/svg/content/src/nsSVGElement.cpp
@@ -10,28 +10,19 @@
 
 #include "mozilla/dom/SVGSVGElement.h"
 #include "mozilla/dom/SVGTests.h"
+#include "nsICSSDeclaration.h"
 #include "nsIDocument.h"
-#include "nsRange.h"
-#include "nsIDOMAttr.h"
 #include "nsIDOMEventTarget.h"
 #include "nsIDOMMutationEvent.h"
 #include "nsMutationEvent.h"
-#include "nsXBLPrototypeBinding.h"
-#include "nsBindingManager.h"
-#include "nsXBLBinding.h"
-#include "nsStyleConsts.h"
 #include "nsError.h"
 #include "nsIPresShell.h"
-#include "nsIServiceManager.h"
 #include "nsGkAtoms.h"
 #include "mozilla/css/StyleRule.h"
 #include "nsRuleWalker.h"
 #include "mozilla/css/Declaration.h"
 #include "nsCSSProps.h"
 #include "nsCSSParser.h"
-#include "nsGenericHTMLElement.h"
-#include "nsNodeInfoManager.h"
-#include "nsIScriptGlobalObject.h"
 #include "nsEventListenerManager.h"
 #include "nsSVGLength2.h"
 #include "nsSVGNumber2.h"
@@ -49,15 +40,12 @@
 #include "SVGAnimatedPathSegList.h"
 #include "SVGAnimatedTransformList.h"
 #include "SVGContentUtils.h"
-#include "nsSVGRect.h"
 #include "nsIFrame.h"
-#include "prdtoa.h"
 #include <stdarg.h>
 #include "nsSMILMappedAttribute.h"
 #include "SVGMotionSMILAttr.h"
 #include "nsAttrValueOrString.h"
 #include "nsSMILAnimationController.h"
-#include "nsDOMCSSDeclaration.h"
 #include "mozilla/dom/SVGElementBinding.h"
 
 using namespace mozilla;
@@ -82,9 +70,9 @@ nsSVGElement::nsSVGElement(already_AddRefed<nsINodeInfo> aNodeInfo)
 }
 
 JSObject*
-nsSVGElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+nsSVGElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return SVGElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGElementBinding::Wrap(aCx, aScope, this);
 }
 
 //----------------------------------------------------------------------
diff --git a/content/svg/content/src/nsSVGElement.h b/content/svg/content/src/nsSVGElement.h
index 80f899a830a2..0189b65446ef 100644
--- a/content/svg/content/src/nsSVGElement.h
+++ b/content/svg/content/src/nsSVGElement.h
@@ -307,7 +307,7 @@ public:
   already_AddRefed<nsIDOMSVGAnimatedString> ClassName();
   already_AddRefed<mozilla::dom::CSSValue> GetPresentationAttribute(const nsAString& aName, mozilla::ErrorResult& rv);
 protected:
-  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap);
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 #ifdef DEBUG
   // We define BeforeSetAttr here and mark it MOZ_FINAL to ensure it is NOT used
diff --git a/content/svg/content/src/nsSVGFilters.cpp b/content/svg/content/src/nsSVGFilters.cpp
index b7480543cd70..2df8810b5967 100644
--- a/content/svg/content/src/nsSVGFilters.cpp
+++ b/content/svg/content/src/nsSVGFilters.cpp
@@ -23,16 +23,13 @@
 #include "nsLayoutUtils.h"
 #include "nsSVGUtils.h"
 #include "nsStyleContext.h"
-#include "nsIDocument.h"
 #include "nsIFrame.h"
 #include "gfxContext.h"
 #include "gfxMatrix.h"
 #include "imgIContainer.h"
 #include "nsNetUtil.h"
-#include "nsIInterfaceRequestorUtils.h"
 #include "mozilla/dom/SVGFilterElement.h"
 #include "nsSVGString.h"
-#include "nsSVGEffects.h"
 #include "gfxUtils.h"
 #include "SVGContentUtils.h"
 #include <algorithm>
@@ -1897,10 +1894,9 @@ NS_IMPL_ISUPPORTS_INHERITED5(SVGFEFuncRElement,
                              nsIDOMSVGFEFuncRElement)
 
 /* virtual */ JSObject*
-SVGFEFuncRElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                            bool* aTriedToWrap)
+SVGFEFuncRElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return SVGFEFuncRElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGFEFuncRElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
@@ -1921,10 +1917,9 @@ NS_IMPL_ISUPPORTS_INHERITED5(SVGFEFuncGElement,
                              nsIDOMSVGFEFuncGElement)
 
 /* virtual */ JSObject*
-SVGFEFuncGElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                            bool* aTriedToWrap)
+SVGFEFuncGElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return SVGFEFuncGElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGFEFuncGElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
@@ -1945,10 +1940,9 @@ NS_IMPL_ISUPPORTS_INHERITED5(SVGFEFuncBElement,
                              nsIDOMSVGFEFuncBElement)
 
 /* virtual */ JSObject*
-SVGFEFuncBElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                            bool* aTriedToWrap)
+SVGFEFuncBElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return SVGFEFuncBElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGFEFuncBElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
@@ -1969,10 +1963,9 @@ NS_IMPL_ISUPPORTS_INHERITED5(SVGFEFuncAElement,
                              nsIDOMSVGFEFuncAElement)
 
 /* virtual */ JSObject*
-SVGFEFuncAElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                            bool* aTriedToWrap)
+SVGFEFuncAElement::WrapNode(JSContext* aCx, JSObject* aScope)
 {
-  return SVGFEFuncAElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return SVGFEFuncAElementBinding::Wrap(aCx, aScope, this);
 }
 
 } // namespace dom
diff --git a/content/svg/content/src/nsSVGFilters.h b/content/svg/content/src/nsSVGFilters.h
index cd7206fe60a4..b47bae6ae9e3 100644
--- a/content/svg/content/src/nsSVGFilters.h
+++ b/content/svg/content/src/nsSVGFilters.h
@@ -9,7 +9,6 @@
 #include "gfxImageSurface.h"
 #include "gfxRect.h"
 #include "nsIDOMSVGFilters.h"
-#include "nsIDOMSVGURIReference.h"
 #include "nsIFrame.h"
 #include "nsImageLoadingContent.h"
 #include "nsSVGLength2.h"
diff --git a/content/svg/content/src/nsSVGNumber2.cpp b/content/svg/content/src/nsSVGNumber2.cpp
index 67635e147aa7..edaafdd58b22 100644
--- a/content/svg/content/src/nsSVGNumber2.cpp
+++ b/content/svg/content/src/nsSVGNumber2.cpp
@@ -6,7 +6,6 @@
 #include "nsError.h"
 #include "nsSVGAttrTearoffTable.h"
 #include "nsSVGNumber2.h"
-#include "nsTextFormatter.h"
 #include "prdtoa.h"
 #include "nsMathUtils.h"
 #include "nsContentUtils.h" // NS_ENSURE_FINITE
diff --git a/content/svg/content/src/nsSVGPathDataParser.cpp b/content/svg/content/src/nsSVGPathDataParser.cpp
index 2b9882ef217b..e611d257a007 100644
--- a/content/svg/content/src/nsSVGPathDataParser.cpp
+++ b/content/svg/content/src/nsSVGPathDataParser.cpp
@@ -5,8 +5,8 @@
 
 #include "nsSVGPathDataParser.h"
 #include "nsSVGDataParser.h"
-#include "prdtoa.h"
-#include "DOMSVGPathSeg.h"
+#include "SVGPathData.h"
+#include "SVGPathSegUtils.h"
 #include <stdlib.h>
 #include <math.h>
 
diff --git a/content/svg/content/src/nsSVGPathGeometryElement.h b/content/svg/content/src/nsSVGPathGeometryElement.h
index e14c887125cc..97780341b708 100644
--- a/content/svg/content/src/nsSVGPathGeometryElement.h
+++ b/content/svg/content/src/nsSVGPathGeometryElement.h
@@ -6,9 +6,10 @@
 #ifndef __NS_SVGPATHGEOMETRYELEMENT_H__
 #define __NS_SVGPATHGEOMETRYELEMENT_H__
 
-#include "gfxMatrix.h"
 #include "SVGGraphicsElement.h"
-#include "nsTArray.h"
+
+struct gfxMatrix;
+template <class E> class nsTArray;
 
 struct nsSVGMark {
   float x, y, angle;
diff --git a/content/svg/content/src/nsSVGPolyElement.cpp b/content/svg/content/src/nsSVGPolyElement.cpp
index 543bb5352044..cf8fdb5ed9db 100644
--- a/content/svg/content/src/nsSVGPolyElement.cpp
+++ b/content/svg/content/src/nsSVGPolyElement.cpp
@@ -3,8 +3,6 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "mozilla/Util.h"
-
 #include "nsSVGPolyElement.h"
 #include "DOMSVGPointList.h"
 #include "gfxContext.h"
diff --git a/content/svg/content/src/nsSVGRect.cpp b/content/svg/content/src/nsSVGRect.cpp
index 88de78846a72..f2913682f727 100644
--- a/content/svg/content/src/nsSVGRect.cpp
+++ b/content/svg/content/src/nsSVGRect.cpp
@@ -4,7 +4,6 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsSVGRect.h"
-#include "nsTextFormatter.h"
 #include "nsContentUtils.h"
 #include "nsDOMClassInfoID.h"
 
diff --git a/content/test/unit/test_range.js b/content/test/unit/test_range.js
index 9cfa647151a0..f5c5a669e9f4 100644
--- a/content/test/unit/test_range.js
+++ b/content/test/unit/test_range.js
@@ -363,7 +363,7 @@ function run_miscellaneous_tests() {
       baseRange.setStart(null, 0);
       do_throw("Should have thrown NOT_OBJECT_ERR!");
     } catch (e) {
-      do_check_eq(e.name, "NS_ERROR_DOM_NOT_OBJECT_ERR");
+      do_check_eq(e instanceof TypeError, true);
     }
 
     // Invalid start node
@@ -371,7 +371,7 @@ function run_miscellaneous_tests() {
       baseRange.setStart({}, 0);
       do_throw("Should have thrown SecurityError!");
     } catch (e) {
-      do_check_eq(e.name, "SecurityError");
+      do_check_true(e instanceof TypeError);
     }
 
     // Invalid index
diff --git a/content/xbl/src/nsBindingManager.cpp b/content/xbl/src/nsBindingManager.cpp
index d48de12edce1..d960f372cb56 100644
--- a/content/xbl/src/nsBindingManager.cpp
+++ b/content/xbl/src/nsBindingManager.cpp
@@ -79,10 +79,9 @@ public:
   nsXBLInsertionPoint* GetInsertionPointAt(int32_t i) { return static_cast<nsXBLInsertionPoint*>(mElements->ElementAt(i)); }
   void RemoveInsertionPointAt(int32_t i) { mElements->RemoveElementAt(i); }
 
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap)
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE
   {
-    return mozilla::dom::NodeListBinding::Wrap(cx, scope, this, triedToWrap);
+    return mozilla::dom::NodeListBinding::Wrap(cx, scope, this);
   }
 
   NS_DECLARE_STATIC_IID_ACCESSOR(NS_ANONYMOUS_CONTENT_LIST_IID)
diff --git a/content/xbl/src/nsXBLService.cpp b/content/xbl/src/nsXBLService.cpp
index ceb44158d209..46d056de51b0 100644
--- a/content/xbl/src/nsXBLService.cpp
+++ b/content/xbl/src/nsXBLService.cpp
@@ -107,18 +107,6 @@ public:
   nsCOMPtr<nsIURI> mBindingURI;
   nsCOMPtr<nsIContent> mBoundElement;
 
-  static nsXBLBindingRequest*
-  Create(nsFixedSizeAllocator& aPool, nsIURI* aURI, nsIContent* aBoundElement) {
-    void* place = aPool.Alloc(sizeof(nsXBLBindingRequest));
-    return place ? ::new (place) nsXBLBindingRequest(aURI, aBoundElement) : nullptr;
-  }
-
-  static void
-  Destroy(nsFixedSizeAllocator& aPool, nsXBLBindingRequest* aRequest) {
-    aRequest->~nsXBLBindingRequest();
-    aPool.Free(aRequest, sizeof(*aRequest));
-  }
-
   void DocumentLoaded(nsIDocument* aBindingDoc)
   {
     // We only need the document here to cause frame construction, so
@@ -157,28 +145,13 @@ public:
     }
   }
 
-protected:
   nsXBLBindingRequest(nsIURI* aURI, nsIContent* aBoundElement)
     : mBindingURI(aURI),
       mBoundElement(aBoundElement)
   {
   }
-
-private:
-  // Hide so that only Create() and Destroy() can be used to
-  // allocate and deallocate from the heap
-  static void* operator new(size_t) CPP_THROW_NEW { return 0; }
-  static void operator delete(void*, size_t) {}
 };
 
-static const size_t kBucketSizes[] = {
-  sizeof(nsXBLBindingRequest)
-};
-
-static const int32_t kNumBuckets = sizeof(kBucketSizes)/sizeof(size_t);
-static const int32_t kNumElements = 64;
-static const int32_t kInitialSize = sizeof(nsXBLBindingRequest) * kNumElements;
-
 // nsXBLStreamListener, a helper class used for 
 // asynchronous parsing of URLs
 /* Header file */
@@ -227,13 +200,13 @@ nsXBLStreamListener::~nsXBLStreamListener()
 {
   for (uint32_t i = 0; i < mBindingRequests.Length(); i++) {
     nsXBLBindingRequest* req = mBindingRequests.ElementAt(i);
-    nsXBLBindingRequest::Destroy(nsXBLService::GetInstance()->mPool, req);
+    delete req;
   }
 }
 
 NS_IMETHODIMP
 nsXBLStreamListener::OnDataAvailable(nsIRequest *request, nsISupports* aCtxt,
-                                     nsIInputStream* aInStr, 
+                                     nsIInputStream* aInStr,
                                      uint64_t aSourceOffset, uint32_t aCount)
 {
   if (mInner)
@@ -419,8 +392,6 @@ nsXBLService::Init()
 // Constructors/Destructors
 nsXBLService::nsXBLService(void)
 {
-  mPool.Init("XBL Binding Requests", kBucketSizes, kNumBuckets, kInitialSize);
-
   gClassTable = new nsHashtable();
 
   Preferences::AddBoolVarCache(&gAllowDataURIs, "layout.debug.enable_data_xbl");
@@ -970,7 +941,7 @@ nsXBLService::LoadBindingDocumentInfo(nsIContent* aBoundElement,
           static_cast<nsXBLStreamListener*>(listener.get());
         // Create a new load observer.
         if (!xblListener->HasRequest(aBindingURI, aBoundElement)) {
-          nsXBLBindingRequest* req = nsXBLBindingRequest::Create(mPool, aBindingURI, aBoundElement);
+          nsXBLBindingRequest* req = new nsXBLBindingRequest(aBindingURI, aBoundElement);
           xblListener->AddRequest(req);
         }
         return NS_OK;
@@ -1094,9 +1065,8 @@ nsXBLService::FetchBindingDocument(nsIContent* aBoundElement, nsIDocument* aBoun
       bindingManager->PutLoadingDocListener(aDocumentURI, xblListener);
 
     // Add our request.
-    nsXBLBindingRequest* req = nsXBLBindingRequest::Create(mPool,
-                                                           aBindingURI,
-                                                           aBoundElement);
+    nsXBLBindingRequest* req = new nsXBLBindingRequest(aBindingURI,
+                                                       aBoundElement);
     xblListener->AddRequest(req);
 
     // Now kick off the async read.
diff --git a/content/xbl/src/nsXBLService.h b/content/xbl/src/nsXBLService.h
index a4f035e1cbd6..f93c25d1e64e 100644
--- a/content/xbl/src/nsXBLService.h
+++ b/content/xbl/src/nsXBLService.h
@@ -13,7 +13,6 @@
 #include "nsWeakReference.h"
 #include "jsapi.h"              // nsXBLJSClass derives from JSClass
 #include "jsclist.h"            // nsXBLJSClass derives from JSCList
-#include "nsFixedSizeAllocator.h"
 #include "nsTArray.h"
 
 class nsXBLBinding;
@@ -126,8 +125,6 @@ public:
   static bool     gAllowDataURIs;            // Whether we should allow data
                                              // urls in -moz-binding. Needed for
                                              // testing.
-
-  nsFixedSizeAllocator mPool;
 };
 
 class nsXBLJSClass : public JSCList, public JSClass
diff --git a/content/xml/content/src/CDATASection.cpp b/content/xml/content/src/CDATASection.cpp
index 2815a0c8da20..e7254416b5eb 100644
--- a/content/xml/content/src/CDATASection.cpp
+++ b/content/xml/content/src/CDATASection.cpp
@@ -44,9 +44,9 @@ NS_IMPL_ISUPPORTS_INHERITED4(CDATASection, nsGenericDOMDataNode, nsIDOMNode,
                              nsIDOMCDATASection)
 
 JSObject*
-CDATASection::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+CDATASection::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return CDATASectionBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return CDATASectionBinding::Wrap(aCx, aScope, this);
 }
 
 bool
diff --git a/content/xml/content/src/CDATASection.h b/content/xml/content/src/CDATASection.h
index a4b2085a206c..cb22bade50f9 100644
--- a/content/xml/content/src/CDATASection.h
+++ b/content/xml/content/src/CDATASection.h
@@ -53,8 +53,7 @@ public:
 #endif
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/xml/content/src/ProcessingInstruction.cpp b/content/xml/content/src/ProcessingInstruction.cpp
index d8c117722361..e877873564e7 100644
--- a/content/xml/content/src/ProcessingInstruction.cpp
+++ b/content/xml/content/src/ProcessingInstruction.cpp
@@ -75,9 +75,9 @@ NS_IMPL_ISUPPORTS_INHERITED3(ProcessingInstruction, nsGenericDOMDataNode,
                              nsIDOMProcessingInstruction)
 
 JSObject*
-ProcessingInstruction::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+ProcessingInstruction::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return ProcessingInstructionBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return ProcessingInstructionBinding::Wrap(aCx, aScope, this);
 }
 
 NS_IMETHODIMP
diff --git a/content/xml/content/src/ProcessingInstruction.h b/content/xml/content/src/ProcessingInstruction.h
index 70d42ed3f143..e91471d056c9 100644
--- a/content/xml/content/src/ProcessingInstruction.h
+++ b/content/xml/content/src/ProcessingInstruction.h
@@ -64,8 +64,7 @@ protected:
    */
   bool GetAttrValue(nsIAtom *aName, nsAString& aValue);
 
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 };
 
 } // namespace dom
diff --git a/content/xml/content/src/XMLStylesheetProcessingInstruction.cpp b/content/xml/content/src/XMLStylesheetProcessingInstruction.cpp
index 4e6c50e477d6..fdec58779977 100644
--- a/content/xml/content/src/XMLStylesheetProcessingInstruction.cpp
+++ b/content/xml/content/src/XMLStylesheetProcessingInstruction.cpp
@@ -38,11 +38,9 @@ XMLStylesheetProcessingInstruction::~XMLStylesheetProcessingInstruction()
 }
 
 JSObject*
-XMLStylesheetProcessingInstruction::WrapNode(JSContext *aCx, JSObject *aScope,
-                                             bool *aTriedToWrap)
+XMLStylesheetProcessingInstruction::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return XMLStylesheetProcessingInstructionBinding::Wrap(aCx, aScope, this,
-                                                         aTriedToWrap);
+  return XMLStylesheetProcessingInstructionBinding::Wrap(aCx, aScope, this);
 }
 
 // nsIContent
diff --git a/content/xml/content/src/XMLStylesheetProcessingInstruction.h b/content/xml/content/src/XMLStylesheetProcessingInstruction.h
index 34c2101b0266..46185c97e9dc 100644
--- a/content/xml/content/src/XMLStylesheetProcessingInstruction.h
+++ b/content/xml/content/src/XMLStylesheetProcessingInstruction.h
@@ -23,8 +23,7 @@ public:
   }
   virtual ~XMLStylesheetProcessingInstruction();
 
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap);
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
diff --git a/content/xml/content/src/nsXMLElement.cpp b/content/xml/content/src/nsXMLElement.cpp
index 59f69b2d1f1e..05f06787d727 100644
--- a/content/xml/content/src/nsXMLElement.cpp
+++ b/content/xml/content/src/nsXMLElement.cpp
@@ -33,9 +33,9 @@ NS_IMPL_ADDREF_INHERITED(nsXMLElement, Element)
 NS_IMPL_RELEASE_INHERITED(nsXMLElement, Element)
 
 JSObject*
-nsXMLElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+nsXMLElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-  return ElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return ElementBinding::Wrap(aCx, aScope, this);
 }
 
 NS_IMPL_ELEMENT_CLONE(nsXMLElement)
diff --git a/content/xml/content/src/nsXMLElement.h b/content/xml/content/src/nsXMLElement.h
index 59e5c316ca7e..5fc4a1dcabf6 100644
--- a/content/xml/content/src/nsXMLElement.h
+++ b/content/xml/content/src/nsXMLElement.h
@@ -53,8 +53,7 @@ public:
   virtual void NodeInfoChanged(nsINodeInfo* aOldNodeInfo);
 
 protected:
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 };
 
 #endif // nsXMLElement_h___
diff --git a/content/xul/content/src/nsXULElement.cpp b/content/xul/content/src/nsXULElement.cpp
index 775837d7235f..2b3d53ef3334 100644
--- a/content/xul/content/src/nsXULElement.cpp
+++ b/content/xul/content/src/nsXULElement.cpp
@@ -1935,9 +1935,9 @@ nsXULElement::IsEventAttributeName(nsIAtom *aName)
 }
 
 JSObject*
-nsXULElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+nsXULElement::WrapNode(JSContext *aCx, JSObject *aScope)
 {
-    return dom::XULElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+    return dom::XULElementBinding::Wrap(aCx, aScope, this);
 }
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXULPrototypeNode)
diff --git a/content/xul/content/src/nsXULElement.h b/content/xul/content/src/nsXULElement.h
index 34effd3c981e..3b4d32cee427 100644
--- a/content/xul/content/src/nsXULElement.h
+++ b/content/xul/content/src/nsXULElement.h
@@ -692,8 +692,7 @@ protected:
             !HasAttr(kNameSpaceID_None, nsGkAtoms::readonly);
     }
 
-    virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                               bool *aTriedToWrap) MOZ_OVERRIDE;
+    virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope) MOZ_OVERRIDE;
 
     void MaybeUpdatePrivateLifetime();
 };
diff --git a/content/xul/templates/src/nsRDFConInstanceTestNode.cpp b/content/xul/templates/src/nsRDFConInstanceTestNode.cpp
index bf243a42c539..492017b4b041 100644
--- a/content/xul/templates/src/nsRDFConInstanceTestNode.cpp
+++ b/content/xul/templates/src/nsRDFConInstanceTestNode.cpp
@@ -211,7 +211,7 @@ nsRDFConInstanceTestNode::FilterInstantiations(InstantiationSet& aInstantiations
                 ((mContainer == eDontCare) && (mEmpty == empty)))
             {
                 Element* element =
-                    nsRDFConInstanceTestNode::Element::Create(valueres, container, empty);
+                    new nsRDFConInstanceTestNode::Element(valueres, container, empty);
 
                 if (! element)
                     return NS_ERROR_OUT_OF_MEMORY;
diff --git a/content/xul/templates/src/nsRDFConInstanceTestNode.h b/content/xul/templates/src/nsRDFConInstanceTestNode.h
index 426982a15607..5be69498151c 100644
--- a/content/xul/templates/src/nsRDFConInstanceTestNode.h
+++ b/content/xul/templates/src/nsRDFConInstanceTestNode.h
@@ -43,12 +43,6 @@ public:
 
 
     class Element : public MemoryElement {
-    protected:
-        // Hide so that only Create() and Destroy() can be used to
-        // allocate and deallocate from the heap
-        static void* operator new(size_t) CPP_THROW_NEW { return 0; }
-        static void operator delete(void*, size_t) {}
-
     public:
         Element(nsIRDFResource* aContainer,
                 Test aContainerTest,
@@ -60,17 +54,6 @@ public:
 
         virtual ~Element() { MOZ_COUNT_DTOR(nsRDFConInstanceTestNode::Element); }
 
-        static Element*
-        Create(nsIRDFResource* aContainer,
-               Test aContainerTest, Test aEmptyTest) {
-            void* place = MemoryElement::gPool.Alloc(sizeof(Element));
-            return place ? ::new (place) Element(aContainer, aContainerTest, aEmptyTest) : nullptr; }
-
-        void Destroy() {
-            this->~Element();
-            MemoryElement::gPool.Free(this, sizeof(Element));
-        }
-
         virtual const char* Type() const {
             return "nsRDFConInstanceTestNode::Element"; }
 
diff --git a/content/xul/templates/src/nsRDFConMemberTestNode.cpp b/content/xul/templates/src/nsRDFConMemberTestNode.cpp
index 281ef5410f9c..5a2c64e35356 100644
--- a/content/xul/templates/src/nsRDFConMemberTestNode.cpp
+++ b/content/xul/templates/src/nsRDFConMemberTestNode.cpp
@@ -180,8 +180,8 @@ nsRDFConMemberTestNode::FilterInstantiations(InstantiationSet& aInstantiations,
             if (isconsistent) {
                 // Add a memory element to our set-of-support.
                 Element* element =
-                    nsRDFConMemberTestNode::Element::Create(containerRes,
-                                                            memberValue);
+                    new nsRDFConMemberTestNode::Element(containerRes,
+                                                        memberValue);
 
                 if (! element)
                     return NS_ERROR_OUT_OF_MEMORY;
@@ -235,7 +235,7 @@ nsRDFConMemberTestNode::FilterInstantiations(InstantiationSet& aInstantiations,
                 newinst.AddAssignment(mMemberVariable, node);
 
                 Element* element =
-                    nsRDFConMemberTestNode::Element::Create(containerRes, node);
+                    new nsRDFConMemberTestNode::Element(containerRes, node);
 
                 if (! element)
                     return NS_ERROR_OUT_OF_MEMORY;
@@ -325,8 +325,8 @@ nsRDFConMemberTestNode::FilterInstantiations(InstantiationSet& aInstantiations,
                         newinst.AddAssignment(mContainerVariable, source);
 
                         Element* element =
-                            nsRDFConMemberTestNode::Element::Create(source,
-                                                                    memberValue);
+                            new nsRDFConMemberTestNode::Element(source,
+                                                                memberValue);
 
                         if (! element)
                             return NS_ERROR_OUT_OF_MEMORY;
@@ -421,11 +421,11 @@ nsRDFConMemberTestNode::FilterInstantiations(InstantiationSet& aInstantiations,
                     Element* element;
                     if (hasContainerBinding) {
                         element =
-                            nsRDFConMemberTestNode::Element::Create(containerRes, value);
+                            new nsRDFConMemberTestNode::Element(containerRes, value);
                     }
                     else {
                         element =
-                            nsRDFConMemberTestNode::Element::Create(valueRes, memberValue);
+                            new nsRDFConMemberTestNode::Element(valueRes, memberValue);
                     }
 
                     if (! element)
diff --git a/content/xul/templates/src/nsRDFConMemberTestNode.h b/content/xul/templates/src/nsRDFConMemberTestNode.h
index 6ae0cfc3dc8b..5e7c95a56de6 100644
--- a/content/xul/templates/src/nsRDFConMemberTestNode.h
+++ b/content/xul/templates/src/nsRDFConMemberTestNode.h
@@ -39,12 +39,6 @@ public:
             nsIRDFNode* aTarget) const;
 
     class Element : public MemoryElement {
-    protected:
-        // Hide so that only Create() and Destroy() can be used to
-        // allocate and deallocate from the heap
-        static void* operator new(size_t) CPP_THROW_NEW { return 0; }
-        static void operator delete(void*, size_t) {}
-
     public:
         Element(nsIRDFResource* aContainer,
                 nsIRDFNode* aMember)
@@ -54,16 +48,6 @@ public:
 
         virtual ~Element() { MOZ_COUNT_DTOR(nsRDFConMemberTestNode::Element); }
 
-        static Element*
-        Create(nsIRDFResource* aContainer, nsIRDFNode* aMember) {
-            void* place = MemoryElement::gPool.Alloc(sizeof(Element));
-            return place ? ::new (place) Element(aContainer, aMember) : nullptr; }
-
-        void Destroy() {
-            this->~Element();
-            MemoryElement::gPool.Free(this, sizeof(Element));
-        }
-
         virtual const char* Type() const {
             return "nsRDFConMemberTestNode::Element"; }
 
diff --git a/content/xul/templates/src/nsRDFPropertyTestNode.cpp b/content/xul/templates/src/nsRDFPropertyTestNode.cpp
index f66d90bfdb94..9278918e2ef1 100644
--- a/content/xul/templates/src/nsRDFPropertyTestNode.cpp
+++ b/content/xul/templates/src/nsRDFPropertyTestNode.cpp
@@ -187,9 +187,8 @@ nsRDFPropertyTestNode::FilterInstantiations(InstantiationSet& aInstantiations,
             if (hasAssertion) {
                 // it's consistent.
                 Element* element =
-                    nsRDFPropertyTestNode::Element::Create(sourceRes,
-                                                           mProperty,
-                                                           targetValue);
+                    new nsRDFPropertyTestNode::Element(sourceRes, mProperty,
+                                                       targetValue);
 
                 if (! element)
                     return NS_ERROR_OUT_OF_MEMORY;
@@ -286,9 +285,8 @@ nsRDFPropertyTestNode::FilterInstantiations(InstantiationSet& aInstantiations,
                 newinst.AddAssignment(variable, value);
 
                 Element* element =
-                    nsRDFPropertyTestNode::Element::Create(sourceRes,
-                                                           mProperty,
-                                                           targetValue);
+                    new nsRDFPropertyTestNode::Element(sourceRes, mProperty,
+                                                       targetValue);
 
                 if (! element)
                     return NS_ERROR_OUT_OF_MEMORY;
diff --git a/content/xul/templates/src/nsRDFPropertyTestNode.h b/content/xul/templates/src/nsRDFPropertyTestNode.h
index 48a50c962a3f..bfacdc932136 100644
--- a/content/xul/templates/src/nsRDFPropertyTestNode.h
+++ b/content/xul/templates/src/nsRDFPropertyTestNode.h
@@ -58,12 +58,6 @@ public:
 
 
     class Element : public MemoryElement {
-    protected:
-        // Hide so that only Create() and Destroy() can be used to
-        // allocate and deallocate from the heap
-        static void* operator new(size_t) CPP_THROW_NEW { return 0; }
-        static void operator delete(void*, size_t) {}
-
     public:
         Element(nsIRDFResource* aSource,
                 nsIRDFResource* aProperty,
@@ -75,18 +69,6 @@ public:
 
         virtual ~Element() { MOZ_COUNT_DTOR(nsRDFPropertyTestNode::Element); }
 
-        static Element*
-        Create(nsIRDFResource* aSource,
-               nsIRDFResource* aProperty,
-               nsIRDFNode* aTarget) {
-            void* place = MemoryElement::gPool.Alloc(sizeof(Element));
-            return place ? ::new (place) Element(aSource, aProperty, aTarget) : nullptr; }
-
-        void Destroy() {
-            this->~Element();
-            MemoryElement::gPool.Free(this, sizeof(Element));
-        }
-
         virtual const char* Type() const {
             return "nsRDFPropertyTestNode::Element"; }
 
diff --git a/content/xul/templates/src/nsRuleNetwork.cpp b/content/xul/templates/src/nsRuleNetwork.cpp
index c979b9e65d3e..526df5643164 100644
--- a/content/xul/templates/src/nsRuleNetwork.cpp
+++ b/content/xul/templates/src/nsRuleNetwork.cpp
@@ -39,29 +39,6 @@ extern PRLogModuleInfo* gXULTemplateLog;
 
 using namespace mozilla;
 
-bool MemoryElement::gPoolInited;
-nsFixedSizeAllocator MemoryElement::gPool;
-
-// static
-bool
-MemoryElement::Init()
-{
-    if (!gPoolInited) {
-        const size_t bucketsizes[] = {
-            sizeof (nsRDFConMemberTestNode::Element),
-            sizeof (nsRDFPropertyTestNode::Element)
-        };
-
-        if (NS_FAILED(gPool.Init("MemoryElement", bucketsizes,
-                                 ArrayLength(bucketsizes), 256)))
-            return false;
-
-        gPoolInited = true;
-    }
-
-    return true;
-}
-
 //----------------------------------------------------------------------
 //
 // nsRuleNetwork
@@ -75,7 +52,7 @@ MemoryElementSet::Add(MemoryElement* aElement)
             // We've already got this element covered. Since Add()
             // assumes ownership, and we aren't going to need this,
             // just nuke it.
-            aElement->Destroy();
+            delete aElement;
             return NS_OK;
         }
     }
diff --git a/content/xul/templates/src/nsRuleNetwork.h b/content/xul/templates/src/nsRuleNetwork.h
index 608c26258868..619fc2d0d96b 100644
--- a/content/xul/templates/src/nsRuleNetwork.h
+++ b/content/xul/templates/src/nsRuleNetwork.h
@@ -30,7 +30,6 @@
 
 #include "nsCOMPtr.h"
 #include "nsCOMArray.h"
-#include "nsFixedSizeAllocator.h"
 #include "nsIAtom.h"
 #include "nsIDOMNode.h"
 #include "plhash.h"
@@ -54,15 +53,10 @@ class nsXULTemplateQueryProcessorRDF;
 class MemoryElement {
 protected:
     MemoryElement() { MOZ_COUNT_CTOR(MemoryElement); }
-    virtual ~MemoryElement() { MOZ_COUNT_DTOR(MemoryElement); }
+
 public:
+    virtual ~MemoryElement() { MOZ_COUNT_DTOR(MemoryElement); }
 
-    static bool Init();
-
-    static bool gPoolInited;
-    static nsFixedSizeAllocator gPool;
-
-    virtual void Destroy() = 0;
     virtual const char* Type() const = 0;
     virtual PLHashNumber Hash() const = 0;
     virtual bool Equals(const MemoryElement& aElement) const = 0;
@@ -93,7 +87,7 @@ protected:
 
         ~List() {
             MOZ_COUNT_DTOR(MemoryElementSet::List);
-            mElement->Destroy();
+            delete mElement;
             NS_IF_RELEASE(mNext); }
 
         int32_t AddRef() { return ++mRefCnt; }
diff --git a/content/xul/templates/src/nsTemplateMatch.cpp b/content/xul/templates/src/nsTemplateMatch.cpp
index 65c3a9273219..736a3bc2a41c 100644
--- a/content/xul/templates/src/nsTemplateMatch.cpp
+++ b/content/xul/templates/src/nsTemplateMatch.cpp
@@ -13,13 +13,11 @@ void nsTemplateMatch::operator=(const nsTemplateMatch& aMatch) {}
 
 // static
 void
-nsTemplateMatch::Destroy(nsFixedSizeAllocator& aPool,
-                         nsTemplateMatch*& aMatch,
-                         bool aRemoveResult) {
+nsTemplateMatch::Destroy(nsTemplateMatch*& aMatch, bool aRemoveResult)
+{
     if (aRemoveResult && aMatch->mResult)
         aMatch->mResult->HasBeenRemoved();
-    aMatch->~nsTemplateMatch();
-    aPool.Free(aMatch, sizeof(*aMatch));
+    ::delete aMatch;
     aMatch = nullptr;
 }
 
diff --git a/content/xul/templates/src/nsTemplateMatch.h b/content/xul/templates/src/nsTemplateMatch.h
index 07562a0b17f4..7e79f1df1c60 100644
--- a/content/xul/templates/src/nsTemplateMatch.h
+++ b/content/xul/templates/src/nsTemplateMatch.h
@@ -6,12 +6,10 @@
 #ifndef nsTemplateMatch_h__
 #define nsTemplateMatch_h__
 
-#include "nsFixedSizeAllocator.h"
 #include "nsIContent.h"
 #include "nsIXULTemplateQueryProcessor.h"
 #include "nsIXULTemplateResult.h"
 #include "nsRuleNetwork.h"
-#include NEW_H
 
 /**
  * A match object, where each match object is associated with one result.
@@ -37,8 +35,8 @@ class nsTemplateMatch {
 private:
     // Hide so that only Create() and Destroy() can be used to
     // allocate and deallocate from the heap
-    void* operator new(size_t) CPP_THROW_NEW { return 0; }
-    void operator delete(void*, size_t) {}
+    void* operator new(size_t) CPP_THROW_NEW { MOZ_ASSERT(0); return nullptr; }
+    void operator delete(void*, size_t) { MOZ_ASSERT(0); }
 
 public:
     nsTemplateMatch(uint16_t aQuerySetPriority,
@@ -59,18 +57,13 @@ public:
     }
 
     static nsTemplateMatch*
-    Create(nsFixedSizeAllocator& aPool,
-           uint16_t aQuerySetPriority,
+    Create(uint16_t aQuerySetPriority,
            nsIXULTemplateResult* aResult,
            nsIContent* aContainer) {
-        void* place = aPool.Alloc(sizeof(nsTemplateMatch));
-        return place ? ::new (place) nsTemplateMatch(aQuerySetPriority,
-                                                     aResult, aContainer)
-                     : nullptr; }
+        return ::new nsTemplateMatch(aQuerySetPriority, aResult, aContainer);
+    }
 
-    static void Destroy(nsFixedSizeAllocator& aPool,
-                        nsTemplateMatch*& aMatch,
-                        bool aRemoveResult);
+    static void Destroy(nsTemplateMatch*& aMatch, bool aRemoveResult);
 
     // return true if the the match is active, and has generated output
     bool IsActive() {
diff --git a/content/xul/templates/src/nsXULContentBuilder.cpp b/content/xul/templates/src/nsXULContentBuilder.cpp
index 59154ecf8fe6..8e5f4ef72e00 100644
--- a/content/xul/templates/src/nsXULContentBuilder.cpp
+++ b/content/xul/templates/src/nsXULContentBuilder.cpp
@@ -1116,7 +1116,7 @@ nsXULContentBuilder::CreateContainerContentsForQuerySet(nsIContent* aElement,
             continue;
 
         nsTemplateMatch *newmatch =
-            nsTemplateMatch::Create(mPool, aQuerySet->Priority(),
+            nsTemplateMatch::Create(aQuerySet->Priority(),
                                     nextresult, aElement);
         if (!newmatch)
             return NS_ERROR_OUT_OF_MEMORY;
@@ -1177,7 +1177,7 @@ nsXULContentBuilder::CreateContainerContentsForQuerySet(nsIContent* aElement,
             rv = DetermineMatchedRule(aElement, nextresult, aQuerySet,
                                       &matchedrule, &ruleindex);
             if (NS_FAILED(rv)) {
-                nsTemplateMatch::Destroy(mPool, newmatch, false);
+                nsTemplateMatch::Destroy(newmatch, false);
                 return rv;
             }
 
@@ -1185,7 +1185,7 @@ nsXULContentBuilder::CreateContainerContentsForQuerySet(nsIContent* aElement,
                 rv = newmatch->RuleMatched(aQuerySet, matchedrule,
                                            ruleindex, nextresult);
                 if (NS_FAILED(rv)) {
-                    nsTemplateMatch::Destroy(mPool, newmatch, false);
+                    nsTemplateMatch::Destroy(newmatch, false);
                     return rv;
                 }
 
@@ -1210,7 +1210,7 @@ nsXULContentBuilder::CreateContainerContentsForQuerySet(nsIContent* aElement,
 
         if (removematch) {
             newmatch->mNext = removematch->mNext;
-            nsTemplateMatch::Destroy(mPool, removematch, true);
+            nsTemplateMatch::Destroy(removematch, true);
         }
         else {
             newmatch->mNext = existingmatch;
diff --git a/content/xul/templates/src/nsXULTemplateBuilder.cpp b/content/xul/templates/src/nsXULTemplateBuilder.cpp
index 078ddbfe5138..42d1499bb764 100644
--- a/content/xul/templates/src/nsXULTemplateBuilder.cpp
+++ b/content/xul/templates/src/nsXULTemplateBuilder.cpp
@@ -19,7 +19,6 @@
 
 #include "nsCOMPtr.h"
 #include "nsCRT.h"
-#include "nsFixedSizeAllocator.h"
 #include "nsIContent.h"
 #include "nsIDOMElement.h"
 #include "nsIDOMNode.h"
@@ -112,12 +111,10 @@ nsXULTemplateBuilder::nsXULTemplateBuilder(void)
 static PLDHashOperator
 DestroyMatchList(nsISupports* aKey, nsTemplateMatch*& aMatch, void* aContext)
 {
-    nsFixedSizeAllocator* pool = static_cast<nsFixedSizeAllocator *>(aContext);
-
     // delete all the matches in the list
     while (aMatch) {
         nsTemplateMatch* next = aMatch->mNext;
-        nsTemplateMatch::Destroy(*pool, aMatch, true);
+        nsTemplateMatch::Destroy(aMatch, true);
         aMatch = next;
     }
 
@@ -176,8 +173,7 @@ nsXULTemplateBuilder::InitGlobals()
     if (!mMatchMap.IsInitialized())
         mMatchMap.Init();
 
-    const size_t bucketsizes[] = { sizeof(nsTemplateMatch) };
-    return mPool.Init("nsXULTemplateBuilder", bucketsizes, 1, 256);
+    return NS_OK;
 }
 
 void
@@ -190,7 +186,7 @@ nsXULTemplateBuilder::CleanUp(bool aIsFinal)
 
     mQuerySets.Clear();
 
-    mMatchMap.Enumerate(DestroyMatchList, &mPool);
+    mMatchMap.Enumerate(DestroyMatchList, nullptr);
 
     // Setting mQueryProcessor to null will close connections. This would be
     // handled by the cycle collector, but we want to close them earlier.
@@ -246,7 +242,7 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXULTemplateBuilder)
     NS_IMPL_CYCLE_COLLECTION_UNLINK(mListeners)
     NS_IMPL_CYCLE_COLLECTION_UNLINK(mQueryProcessor)
     if (tmp->mMatchMap.IsInitialized()) {
-      tmp->mMatchMap.Enumerate(DestroyMatchList, &(tmp->mPool));
+      tmp->mMatchMap.Enumerate(DestroyMatchList, nullptr);
     }
     for (uint32_t i = 0; i < tmp->mQuerySets.Length(); ++i) {
         nsTemplateQuerySet* qs = tmp->mQuerySets[i];
@@ -778,7 +774,7 @@ nsXULTemplateBuilder::UpdateResultInContainer(nsIXULTemplateResult* aOldResult,
 
         int32_t findpriority = aQuerySet->Priority();
 
-        newmatch = nsTemplateMatch::Create(mPool, findpriority,
+        newmatch = nsTemplateMatch::Create(findpriority,
                                            aNewResult, aInsertionPoint);
         if (!newmatch)
             return NS_ERROR_OUT_OF_MEMORY;
@@ -850,7 +846,7 @@ nsXULTemplateBuilder::UpdateResultInContainer(nsIXULTemplateResult* aOldResult,
                 rv = DetermineMatchedRule(aInsertionPoint, newmatch->mResult,
                                           aQuerySet, &matchedrule, &ruleindex);
                 if (NS_FAILED(rv)) {
-                    nsTemplateMatch::Destroy(mPool, newmatch, false);
+                    nsTemplateMatch::Destroy(newmatch, false);
                     return rv;
                 }
 
@@ -859,7 +855,7 @@ nsXULTemplateBuilder::UpdateResultInContainer(nsIXULTemplateResult* aOldResult,
                                                matchedrule, ruleindex,
                                                newmatch->mResult);
                     if (NS_FAILED(rv)) {
-                        nsTemplateMatch::Destroy(mPool, newmatch, false);
+                        nsTemplateMatch::Destroy(newmatch, false);
                         return rv;
                     }
 
@@ -899,8 +895,7 @@ nsXULTemplateBuilder::UpdateResultInContainer(nsIXULTemplateResult* aOldResult,
                             rv = DetermineMatchedRule(aInsertionPoint, newmatch->mResult,
                                                       aQuerySet, &matchedrule, &ruleindex);
                             if (NS_FAILED(rv)) {
-                                nsTemplateMatch::Destroy(mPool, newmatch,
-                                                         false);
+                                nsTemplateMatch::Destroy(newmatch, false);
                                 return rv;
                             }
 
@@ -909,8 +904,7 @@ nsXULTemplateBuilder::UpdateResultInContainer(nsIXULTemplateResult* aOldResult,
                                                            matchedrule, ruleindex,
                                                            newmatch->mResult);
                                 if (NS_FAILED(rv)) {
-                                    nsTemplateMatch::Destroy(mPool, newmatch,
-                                                             false);
+                                    nsTemplateMatch::Destroy(newmatch, false);
                                     return rv;
                                 }
 
@@ -939,7 +933,7 @@ nsXULTemplateBuilder::UpdateResultInContainer(nsIXULTemplateResult* aOldResult,
             rv = DetermineMatchedRule(aInsertionPoint, aNewResult,
                                       aQuerySet, &matchedrule, &ruleindex);
             if (NS_FAILED(rv)) {
-                nsTemplateMatch::Destroy(mPool, newmatch, false);
+                nsTemplateMatch::Destroy(newmatch, false);
                 return rv;
             }
 
@@ -947,7 +941,7 @@ nsXULTemplateBuilder::UpdateResultInContainer(nsIXULTemplateResult* aOldResult,
                 rv = newmatch->RuleMatched(aQuerySet, matchedrule,
                                            ruleindex, aNewResult);
                 if (NS_FAILED(rv)) {
-                    nsTemplateMatch::Destroy(mPool, newmatch, false);
+                    nsTemplateMatch::Destroy(newmatch, false);
                     return rv;
                 }
 
@@ -969,10 +963,10 @@ nsXULTemplateBuilder::UpdateResultInContainer(nsIXULTemplateResult* aOldResult,
         if (mFlags & eLoggingEnabled)
             OutputMatchToLog(aNewId, replacedmatch, false);
     }
- 
+
     // remove a match that needs to be deleted.
     if (replacedmatchtodelete)
-        nsTemplateMatch::Destroy(mPool, replacedmatchtodelete, true);
+        nsTemplateMatch::Destroy(replacedmatchtodelete, true);
 
     // If the old match was active, the content for it needs to be removed.
     // If the old match was not active, it shouldn't have had any content,
@@ -984,7 +978,7 @@ nsXULTemplateBuilder::UpdateResultInContainer(nsIXULTemplateResult* aOldResult,
 
     // delete the old match that was replaced
     if (removedmatch)
-        nsTemplateMatch::Destroy(mPool, removedmatch, true);
+        nsTemplateMatch::Destroy(removedmatch, true);
 
     if (mFlags & eLoggingEnabled && newmatch)
         OutputMatchToLog(aNewId, newmatch, true);
diff --git a/content/xul/templates/src/nsXULTemplateBuilder.h b/content/xul/templates/src/nsXULTemplateBuilder.h
index ffda59c75ff4..223986c9c64d 100644
--- a/content/xul/templates/src/nsXULTemplateBuilder.h
+++ b/content/xul/templates/src/nsXULTemplateBuilder.h
@@ -18,7 +18,6 @@
 #include "nsIRDFService.h"
 #include "nsIXULTemplateBuilder.h"
 
-#include "nsFixedSizeAllocator.h"
 #include "nsCOMArray.h"
 #include "nsTArray.h"
 #include "nsDataHashtable.h"
@@ -382,16 +381,6 @@ protected:
      */
     nsDataHashtable<nsISupportsHashKey, nsTemplateMatch*> mMatchMap;
 
-    /**
-     * Fixed size allocator used to allocate matches
-     */
-    nsFixedSizeAllocator mPool;
-
-public:
-
-    nsFixedSizeAllocator& GetPool() { return mPool; }
-
-protected:
     // pseudo-constants
     static nsrefcnt gRefCnt;
     static nsIRDFService*            gRDFService;
diff --git a/content/xul/templates/src/nsXULTemplateQueryProcessorRDF.cpp b/content/xul/templates/src/nsXULTemplateQueryProcessorRDF.cpp
index 3062aeb10c24..ccaa6035f97d 100644
--- a/content/xul/templates/src/nsXULTemplateQueryProcessorRDF.cpp
+++ b/content/xul/templates/src/nsXULTemplateQueryProcessorRDF.cpp
@@ -169,7 +169,7 @@ nsXULTemplateQueryProcessorRDF::InitGlobals()
                              &kRDF_type);
     }
 
-    return MemoryElement::Init() ? NS_OK : NS_ERROR_FAILURE;
+    return NS_OK;
 }
 
 //----------------------------------------------------------------------
diff --git a/content/xul/templates/src/nsXULTreeBuilder.cpp b/content/xul/templates/src/nsXULTreeBuilder.cpp
index b9b91aa10273..376fe63ce72c 100644
--- a/content/xul/templates/src/nsXULTreeBuilder.cpp
+++ b/content/xul/templates/src/nsXULTreeBuilder.cpp
@@ -1587,8 +1587,7 @@ nsXULTreeBuilder::OpenSubtreeForQuerySet(nsTreeRows::Subtree* aSubtree,
         }
 
         nsTemplateMatch *newmatch =
-            nsTemplateMatch::Create(mPool, aQuerySet->Priority(),
-                                    nextresult, nullptr);
+            nsTemplateMatch::Create(aQuerySet->Priority(), nextresult, nullptr);
         if (!newmatch)
             return NS_ERROR_OUT_OF_MEMORY;
 
@@ -1601,7 +1600,7 @@ nsXULTreeBuilder::OpenSubtreeForQuerySet(nsTreeRows::Subtree* aSubtree,
                     nsCOMPtr<nsIRDFResource> parentid;
                     rv = GetResultResource(iter->mMatch->mResult, getter_AddRefs(parentid));
                     if (NS_FAILED(rv)) {
-                        nsTemplateMatch::Destroy(mPool, newmatch, false);
+                        nsTemplateMatch::Destroy(newmatch, false);
                         return rv;
                     }
 
@@ -1614,7 +1613,7 @@ nsXULTreeBuilder::OpenSubtreeForQuerySet(nsTreeRows::Subtree* aSubtree,
 
             if (cyclic) {
                 NS_WARNING("tree cannot handle cyclic graphs");
-                nsTemplateMatch::Destroy(mPool, newmatch, false);
+                nsTemplateMatch::Destroy(newmatch, false);
                 continue;
             }
 
@@ -1623,7 +1622,7 @@ nsXULTreeBuilder::OpenSubtreeForQuerySet(nsTreeRows::Subtree* aSubtree,
             rv = DetermineMatchedRule(nullptr, nextresult, aQuerySet,
                                       &matchedrule, &ruleindex);
             if (NS_FAILED(rv)) {
-                nsTemplateMatch::Destroy(mPool, newmatch, false);
+                nsTemplateMatch::Destroy(newmatch, false);
                 return rv;
             }
 
@@ -1631,7 +1630,7 @@ nsXULTreeBuilder::OpenSubtreeForQuerySet(nsTreeRows::Subtree* aSubtree,
                 rv = newmatch->RuleMatched(aQuerySet, matchedrule, ruleindex,
                                            nextresult);
                 if (NS_FAILED(rv)) {
-                    nsTemplateMatch::Destroy(mPool, newmatch, false);
+                    nsTemplateMatch::Destroy(newmatch, false);
                     return rv;
                 }
 
@@ -1712,7 +1711,7 @@ nsXULTreeBuilder::RemoveMatchesFor(nsTreeRows::Subtree& subtree)
         if (mMatchMap.Get(id, &existingmatch)) {
             while (existingmatch) {
                 nsTemplateMatch* nextmatch = existingmatch->mNext;
-                nsTemplateMatch::Destroy(mPool, existingmatch, true);
+                nsTemplateMatch::Destroy(existingmatch, true);
                 existingmatch = nextmatch;
             }
 
diff --git a/dom/base/nsDOMClassInfo.cpp b/dom/base/nsDOMClassInfo.cpp
index a85a24dd8307..13b73892181e 100644
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -253,12 +253,10 @@
 #include "nsIDOMTimeEvent.h"
 #include "nsIDOMSVGDocument.h"
 #include "nsIDOMSVGElement.h"
-#include "nsIDOMSVGEvent.h"
 #include "nsIDOMSVGFilters.h"
 #include "nsIDOMSVGLength.h"
 #include "nsIDOMSVGNumber.h"
 #include "nsIDOMSVGRect.h"
-#include "nsIDOMSVGURIReference.h"
 #include "nsIDOMSVGZoomEvent.h"
 
 #include "nsIImageDocument.h"
@@ -861,8 +859,6 @@ static nsDOMClassInfoData sClassInfoData[] = {
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGAnimatedString, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
-  NS_DEFINE_CLASSINFO_DATA(SVGEvent, nsEventSH,
-                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGLength, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGNumber, nsDOMGenericSH,
@@ -2373,11 +2369,6 @@ nsDOMClassInfo::Init()
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGAnimatedString)
   DOM_CLASSINFO_MAP_END
 
-  DOM_CLASSINFO_MAP_BEGIN(SVGEvent, nsIDOMSVGEvent)
-    DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGEvent)
-    DOM_CLASSINFO_EVENT_MAP_ENTRIES
-  DOM_CLASSINFO_MAP_END
-
   DOM_CLASSINFO_MAP_BEGIN(SVGLength, nsIDOMSVGLength)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGLength)
   DOM_CLASSINFO_MAP_END
diff --git a/dom/base/nsDOMClassInfoClasses.h b/dom/base/nsDOMClassInfoClasses.h
index fb994cf10b57..3f8022cc0f2e 100644
--- a/dom/base/nsDOMClassInfoClasses.h
+++ b/dom/base/nsDOMClassInfoClasses.h
@@ -144,7 +144,6 @@ DOMCI_CLASS(SVGAnimatedInteger)
 DOMCI_CLASS(SVGAnimatedNumber)
 DOMCI_CLASS(SVGAnimatedRect)
 DOMCI_CLASS(SVGAnimatedString)
-DOMCI_CLASS(SVGEvent)
 DOMCI_CLASS(SVGLength)
 DOMCI_CLASS(SVGNumber)
 DOMCI_CLASS(SVGRect)
diff --git a/dom/base/nsGlobalWindow.h b/dom/base/nsGlobalWindow.h
index 7f331e475a8d..4e7b6c8f215e 100644
--- a/dom/base/nsGlobalWindow.h
+++ b/dom/base/nsGlobalWindow.h
@@ -280,11 +280,10 @@ public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
 
   // nsWrapperCache
-  JSObject *WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap)
+  JSObject *WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE
   {
     NS_ASSERTION(IsOuterWindow(),
                  "Inner window supports nsWrapperCache, fix WrapObject!");
-    *triedToWrap = true;
     return EnsureInnerWindow() ? GetWrapper() : nullptr;
   }
 
diff --git a/dom/base/nsPerformance.cpp b/dom/base/nsPerformance.cpp
index 1dcf6ef613a1..bbb61c4c1d5b 100644
--- a/dom/base/nsPerformance.cpp
+++ b/dom/base/nsPerformance.cpp
@@ -124,11 +124,9 @@ nsPerformanceTiming::ResponseEnd() const
 }
 
 JSObject*
-nsPerformanceTiming::WrapObject(JSContext *cx, JSObject *scope,
-                                bool *triedToWrap)
+nsPerformanceTiming::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return dom::PerformanceTimingBinding::Wrap(cx, scope, this,
-                                             triedToWrap);
+  return dom::PerformanceTimingBinding::Wrap(cx, scope, this);
 }
 
 
@@ -149,11 +147,9 @@ nsPerformanceNavigation::~nsPerformanceNavigation()
 }
 
 JSObject*
-nsPerformanceNavigation::WrapObject(JSContext *cx, JSObject *scope,
-                                    bool *triedToWrap)
+nsPerformanceNavigation::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return dom::PerformanceNavigationBinding::Wrap(cx, scope, this,
-                                                 triedToWrap);
+  return dom::PerformanceNavigationBinding::Wrap(cx, scope, this);
 }
 
 
@@ -210,10 +206,8 @@ nsPerformance::Now()
 }
 
 JSObject*
-nsPerformance::WrapObject(JSContext *cx, JSObject *scope,
-                          bool *triedToWrap)
+nsPerformance::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return dom::PerformanceBinding::Wrap(cx, scope, this,
-                                       triedToWrap);
+  return dom::PerformanceBinding::Wrap(cx, scope, this);
 }
 
diff --git a/dom/base/nsPerformance.h b/dom/base/nsPerformance.h
index 6298f9f5df8d..318104f87745 100644
--- a/dom/base/nsPerformance.h
+++ b/dom/base/nsPerformance.h
@@ -35,7 +35,7 @@ public:
     return mPerformance;
   }
 
-  JSObject* WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap);
+  JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
   // PerformanceNavigation WebIDL methods
   DOMTimeMilliSec NavigationStart() const {
@@ -106,7 +106,7 @@ public:
     return mPerformance;
   }
 
-  JSObject* WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap);
+  JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
   // PerformanceNavigation WebIDL methods
   uint16_t Type() const {
@@ -148,7 +148,7 @@ public:
     return mWindow.get();
   }
 
-  JSObject* WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap);
+  JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
   // Performance WebIDL methods
   DOMHighResTimeStamp Now();
diff --git a/dom/base/nsScreen.cpp b/dom/base/nsScreen.cpp
index fc00e65c772d..fd79a51f1fb5 100644
--- a/dom/base/nsScreen.cpp
+++ b/dom/base/nsScreen.cpp
@@ -409,9 +409,9 @@ nsScreen::SlowMozUnlockOrientation()
 
 /* virtual */
 JSObject*
-nsScreen::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+nsScreen::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return ScreenBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return ScreenBinding::Wrap(aCx, aScope, this);
 }
 
 NS_IMPL_ISUPPORTS1(nsScreen::FullScreenEventListener, nsIDOMEventListener)
diff --git a/dom/base/nsScreen.h b/dom/base/nsScreen.h
index 47605262cd06..4b716db6569f 100644
--- a/dom/base/nsScreen.h
+++ b/dom/base/nsScreen.h
@@ -114,8 +114,7 @@ public:
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsScreen,
                                            nsDOMEventTargetHelper)
 
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope,
-                               bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   void Notify(const mozilla::hal::ScreenConfiguration& aConfiguration);
 
diff --git a/dom/base/nsWrapperCache.h b/dom/base/nsWrapperCache.h
index 91722271a602..6a0b97b87cd3 100644
--- a/dom/base/nsWrapperCache.h
+++ b/dom/base/nsWrapperCache.h
@@ -147,17 +147,11 @@ public:
 
   /**
    * Wrap the object corresponding to this wrapper cache. If non-null is
-   * returned, the object has already been stored in the wrapper cache and the
-   * value set in triedToWrap is meaningless. If null is returned then
-   * triedToWrap indicates whether an error occurred, if it's false then the
-   * object doesn't actually support creating a wrapper through its WrapObject
-   * hook.
+   * returned, the object has already been stored in the wrapper cache.
    */
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap)
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope)
   {
     MOZ_ASSERT(!IsDOMBinding(), "Someone forgot to override WrapObject");
-    *triedToWrap = false;
     return nullptr;
   }
 
diff --git a/dom/battery/BatteryManager.cpp b/dom/battery/BatteryManager.cpp
index 823795269617..e6f83182f2ad 100644
--- a/dom/battery/BatteryManager.cpp
+++ b/dom/battery/BatteryManager.cpp
@@ -54,9 +54,9 @@ BatteryManager::Shutdown()
 }
 
 JSObject*
-BatteryManager::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+BatteryManager::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return BatteryManagerBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return BatteryManagerBinding::Wrap(aCx, aScope, this);
 }
 
 double
diff --git a/dom/battery/BatteryManager.h b/dom/battery/BatteryManager.h
index 93d2a7afa477..ad33d26ad3a5 100644
--- a/dom/battery/BatteryManager.h
+++ b/dom/battery/BatteryManager.h
@@ -51,8 +51,7 @@ public:
      return GetOwner();
   }
 
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope,
-                               bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   bool Charging() const
   {
diff --git a/dom/bindings/BindingUtils.h b/dom/bindings/BindingUtils.h
index fb93456e8473..003ecc0cf249 100644
--- a/dom/bindings/BindingUtils.h
+++ b/dom/bindings/BindingUtils.h
@@ -425,7 +425,7 @@ struct HasWrapObject
 private:
   typedef char yes[1];
   typedef char no[2];
-  typedef JSObject* (nsWrapperCache::*WrapObject)(JSContext*, JSObject*, bool*);
+  typedef JSObject* (nsWrapperCache::*WrapObject)(JSContext*, JSObject*);
   template<typename U, U> struct SFINAE;
   template <typename V> static no& Check(SFINAE<WrapObject, &V::WrapObject>*);
   template <typename V> static yes& Check(...);
@@ -586,13 +586,11 @@ WrapNewBindingObject(JSContext* cx, JSObject* scope, T* value, JS::Value* vp)
       return false;
     }
 
-    bool triedToWrap;
-    obj = value->WrapObject(cx, scope, &triedToWrap);
+    obj = value->WrapObject(cx, scope);
     if (!obj) {
-      // At this point, obj is null, so just return false.  We could
-      // try to communicate triedToWrap to the caller, but in practice
-      // callers seem to be testing JS_IsExceptionPending(cx) to
-      // figure out whether WrapObject() threw instead.
+      // At this point, obj is null, so just return false.
+      // Callers seem to be testing JS_IsExceptionPending(cx) to
+      // figure out whether WrapObject() threw.
       return false;
     }
   }
@@ -1036,8 +1034,6 @@ struct WrapNativeParentFallback
   static inline JSObject* Wrap(JSContext* cx, JSObject* scope, T* parent,
                                nsWrapperCache* cache)
   {
-    MOZ_NOT_REACHED("Don't know how to deal with triedToWrap == false for "
-                    "non-nsISupports classes");
     return nullptr;
   }
 };
@@ -1069,17 +1065,13 @@ struct WrapNativeParentHelper
       return obj;
     }
 
-    bool triedToWrap;
     // Inline this here while we have non-dom objects in wrapper caches.
     if (!CouldBeDOMBinding(parent)) {
-      triedToWrap = false;
+      obj = WrapNativeParentFallback<T>::Wrap(cx, scope, parent, cache);
     } else {
-      obj = parent->WrapObject(cx, scope, &triedToWrap);
+      obj = parent->WrapObject(cx, scope);
     }
 
-    if (!triedToWrap) {
-      obj = WrapNativeParentFallback<T>::Wrap(cx, scope, parent, cache);
-    }
     return obj;
   }
 };
diff --git a/dom/bindings/Bindings.conf b/dom/bindings/Bindings.conf
index b9d9a29cd8dd..3b2bfa44404b 100644
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@@ -572,6 +572,14 @@ DOMInterfaces = {
     'resultNotAddRefed': [ 'item' ]
 },
 
+'Range': {
+    'nativeType': 'nsRange',
+    'resultNotAddRefed': [ 'startContainer', 'endContainer', 'commonAncestorContainer' ],
+    'binaryNames': {
+        '__stringifier': 'ToString'
+    }
+},
+
 'Rect': {
     'nativeType': 'nsDOMCSSRect',
     'resultNotAddRefed': [ 'top', 'right', 'bottom', 'left' ]
@@ -1226,7 +1234,6 @@ addExternalIface('OutputStream', nativeType='nsIOutputStream',
                  notflattened=True)
 addExternalIface('Principal', nativeType='nsIPrincipal',
                  headerFile='nsIPrincipal.h', notflattened=True)
-addExternalIface('Range', nativeType='nsRange')
 addExternalIface('Selection', nativeType='nsISelection')
 addExternalIface('StyleSheet', nativeType='nsIStyleSheet')
 addExternalIface('StyleSheetList')
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index 6b2873497d36..41540fa7f6a8 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -1853,18 +1853,15 @@ class CGWrapWithCacheMethod(CGAbstractMethod):
         assert descriptor.interface.hasInterfacePrototypeObject()
         args = [Argument('JSContext*', 'aCx'), Argument('JSObject*', 'aScope'),
                 Argument(descriptor.nativeType + '*', 'aObject'),
-                Argument('nsWrapperCache*', 'aCache'),
-                Argument('bool*', 'aTriedToWrap')]
+                Argument('nsWrapperCache*', 'aCache')]
         CGAbstractMethod.__init__(self, descriptor, 'Wrap', 'JSObject*', args)
         self.properties = properties
 
     def definition_body(self):
         if self.descriptor.workers:
-            return """  *aTriedToWrap = true;
-  return aObject->GetJSObject();"""
+            return """  return aObject->GetJSObject();"""
 
         return """%s
-  *aTriedToWrap = true;
 
   JSObject* parent = WrapNativeParent(aCx, aScope, aObject->GetParentObject());
   if (!parent) {
@@ -1901,11 +1898,11 @@ class CGWrapMethod(CGAbstractMethod):
         # XXX can we wrap if we don't have an interface prototype object?
         assert descriptor.interface.hasInterfacePrototypeObject()
         args = [Argument('JSContext*', 'aCx'), Argument('JSObject*', 'aScope'),
-                Argument('T*', 'aObject'), Argument('bool*', 'aTriedToWrap')]
+                Argument('T*', 'aObject')]
         CGAbstractMethod.__init__(self, descriptor, 'Wrap', 'JSObject*', args, inline=True, templateArgs=["class T"])
 
     def definition_body(self):
-        return "  return Wrap(aCx, aScope, aObject, aObject, aTriedToWrap);"
+        return "  return Wrap(aCx, aScope, aObject, aObject);"
 
 class CGWrapNonWrapperCacheMethod(CGAbstractMethod):
     """
@@ -7735,8 +7732,6 @@ class CGExampleClass(CGClass):
 
         wrapArgs = [Argument('JSContext*', 'aCx'),
                     Argument('JSObject*', 'aScope')]
-        if descriptor.wrapperCache:
-            wrapArgs.append(Argument('bool*', 'aTriedToWrap'))
         methodDecls.insert(0,
                            ClassMethod("WrapObject", "JSObject*",
                                        wrapArgs, virtual=descriptor.wrapperCache,
@@ -7788,9 +7783,9 @@ ${ifaceName}::~${ifaceName}()
         if self.descriptor.wrapperCache:
             classImpl += """
 JSObject*
-${ifaceName}::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+${ifaceName}::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return ${ifaceName}Binding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return ${ifaceName}Binding::Wrap(aCx, aScope, this);
 }
 
 """
diff --git a/dom/bluetooth/BluetoothHfpManager.cpp b/dom/bluetooth/BluetoothHfpManager.cpp
index b91d39118b1c..efd2669f6f49 100644
--- a/dom/bluetooth/BluetoothHfpManager.cpp
+++ b/dom/bluetooth/BluetoothHfpManager.cpp
@@ -857,15 +857,6 @@ BluetoothHfpManager::ReceiveSocketData(nsAutoPtr<UnixSocketRawData>& aMessage)
     // Currently, we don't support memory dialing in Dialer app
     SendLine("ERROR");
     return;
-  } else if ((msg.Find("AT+XAPL=") != -1) ||
-             (msg.Find("AT+XEVENT=") != -1)) {
-    // FIXME: Bug 838089
-    // These are vendor commands used on some special headsets. Eventually we
-    // should reply with ERROR to all unknown incoming commands. However,
-    // in order not to cause interoperability issues for b2g18 branch, only
-    // filtering these two commands should be fine for now.
-    SendLine("ERROR");
-    return;
   } else if (msg.Find("AT+CLCC") != -1) {
     SendCommand("+CLCC: ");
   } else if (msg.Find("ATD") != -1) {
@@ -925,9 +916,13 @@ BluetoothHfpManager::ReceiveSocketData(nsAutoPtr<UnixSocketRawData>& aMessage)
     }
   } else {
     nsCString warningMsg;
-    warningMsg.AssignLiteral("Not handling HFP message, reply ok: ");
+    warningMsg.Append(NS_LITERAL_CSTRING("Unsupported AT command: "));
     warningMsg.Append(msg);
+    warningMsg.Append(NS_LITERAL_CSTRING(", reply with ERROR"));
     NS_WARNING(warningMsg.get());
+
+    SendLine("ERROR");
+    return;
   }
 
 respond_with_ok:
diff --git a/dom/encoding/TextDecoder.h b/dom/encoding/TextDecoder.h
index 0b1211e454fd..937e7bb8a7b7 100644
--- a/dom/encoding/TextDecoder.h
+++ b/dom/encoding/TextDecoder.h
@@ -45,9 +45,9 @@ public:
   {}
 
   virtual JSObject*
-  WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE
+  WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE
   {
-    return TextDecoderBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+    return TextDecoderBinding::Wrap(aCx, aScope, this);
   }
 
   nsISupports*
diff --git a/dom/encoding/TextEncoder.h b/dom/encoding/TextEncoder.h
index d3cab6f9041d..c39604a3556b 100644
--- a/dom/encoding/TextEncoder.h
+++ b/dom/encoding/TextEncoder.h
@@ -44,9 +44,9 @@ public:
   {}
 
   virtual JSObject*
-  WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE
+  WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE
   {
-    return TextEncoderBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+    return TextEncoderBinding::Wrap(aCx, aScope, this);
   }
 
   nsISupports*
diff --git a/dom/file/ArchiveReader.cpp b/dom/file/ArchiveReader.cpp
index ca031e14287f..64fbc05afc13 100644
--- a/dom/file/ArchiveReader.cpp
+++ b/dom/file/ArchiveReader.cpp
@@ -62,9 +62,9 @@ ArchiveReader::~ArchiveReader()
 }
 
 /* virtual */ JSObject*
-ArchiveReader::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+ArchiveReader::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return ArchiveReaderBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return ArchiveReaderBinding::Wrap(aCx, aScope, this);
 }
 
 /* static */ bool
diff --git a/dom/file/ArchiveReader.h b/dom/file/ArchiveReader.h
index 118dc8b7a6a3..56c26066e404 100644
--- a/dom/file/ArchiveReader.h
+++ b/dom/file/ArchiveReader.h
@@ -51,7 +51,7 @@ public:
     return mWindow;
   }
   virtual JSObject*
-  WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE;
+  WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   already_AddRefed<nsIDOMArchiveRequest> GetFilenames();
   already_AddRefed<nsIDOMArchiveRequest> GetFile(const nsAString& filename);
diff --git a/dom/file/FileHandle.cpp b/dom/file/FileHandle.cpp
index c673c97fbef7..1443ce6611ad 100644
--- a/dom/file/FileHandle.cpp
+++ b/dom/file/FileHandle.cpp
@@ -202,7 +202,7 @@ GetFileHelper::GetSuccessResult(JSContext* aCx, jsval* aVal)
 
 /* virtual */
 JSObject*
-FileHandle::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+FileHandle::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return FileHandleBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return FileHandleBinding::Wrap(aCx, aScope, this);
 }
diff --git a/dom/file/FileHandle.h b/dom/file/FileHandle.h
index 6e7e75fa05bc..92323eeb1edc 100644
--- a/dom/file/FileHandle.h
+++ b/dom/file/FileHandle.h
@@ -50,8 +50,7 @@ public:
   {
     return GetOwner();
   }
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope,
-                               bool* aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   void GetName(nsString& aName) const
   {
diff --git a/dom/imptests/failures/webapps/DOMCore/tests/approved/test_interfaces.html.json b/dom/imptests/failures/webapps/DOMCore/tests/approved/test_interfaces.html.json
index 4f28e8f59247..f43193681a12 100644
--- a/dom/imptests/failures/webapps/DOMCore/tests/approved/test_interfaces.html.json
+++ b/dom/imptests/failures/webapps/DOMCore/tests/approved/test_interfaces.html.json
@@ -75,45 +75,6 @@
   "CharacterData interface: document.createTextNode(\"abc\") must inherit property \"remove\" with the proper type (7)": true,
   "CharacterData interface: xmlDoc.createProcessingInstruction(\"abc\", \"def\") must inherit property \"remove\" with the proper type (7)": true,
   "CharacterData interface: document.createComment(\"abc\") must inherit property \"remove\" with the proper type (7)": true,
-  "Range interface: existence and properties of interface object": true,
-  "Range interface: existence and properties of interface prototype object": true,
-  "Range interface: existence and properties of interface prototype object's \"constructor\" property": true,
-  "Range interface: attribute startContainer": true,
-  "Range interface: attribute startOffset": true,
-  "Range interface: attribute endContainer": true,
-  "Range interface: attribute endOffset": true,
-  "Range interface: attribute collapsed": true,
-  "Range interface: attribute commonAncestorContainer": true,
-  "Range interface: calling setStart(Node,unsigned long) on document.createRange() with too few arguments must throw TypeError": true,
-  "Range interface: calling setEnd(Node,unsigned long) on document.createRange() with too few arguments must throw TypeError": true,
-  "Range interface: calling setStartBefore(Node) on document.createRange() with too few arguments must throw TypeError": true,
-  "Range interface: calling setStartAfter(Node) on document.createRange() with too few arguments must throw TypeError": true,
-  "Range interface: calling setEndBefore(Node) on document.createRange() with too few arguments must throw TypeError": true,
-  "Range interface: calling setEndAfter(Node) on document.createRange() with too few arguments must throw TypeError": true,
-  "Range interface: calling collapse(boolean) on document.createRange() with too few arguments must throw TypeError": true,
-  "Range interface: calling selectNode(Node) on document.createRange() with too few arguments must throw TypeError": true,
-  "Range interface: calling selectNodeContents(Node) on document.createRange() with too few arguments must throw TypeError": true,
-  "Range interface: calling compareBoundaryPoints(unsigned short,Range) on document.createRange() with too few arguments must throw TypeError": true,
-  "Range interface: calling insertNode(Node) on document.createRange() with too few arguments must throw TypeError": true,
-  "Range interface: calling surroundContents(Node) on document.createRange() with too few arguments must throw TypeError": true,
-  "Range interface: calling isPointInRange(Node,unsigned long) on document.createRange() with too few arguments must throw TypeError": true,
-  "Range interface: calling comparePoint(Node,unsigned long) on document.createRange() with too few arguments must throw TypeError": true,
-  "Range interface: calling intersectsNode(Node) on document.createRange() with too few arguments must throw TypeError": true,
-  "Range interface: calling setStart(Node,unsigned long) on detachedRange with too few arguments must throw TypeError": true,
-  "Range interface: calling setEnd(Node,unsigned long) on detachedRange with too few arguments must throw TypeError": true,
-  "Range interface: calling setStartBefore(Node) on detachedRange with too few arguments must throw TypeError": true,
-  "Range interface: calling setStartAfter(Node) on detachedRange with too few arguments must throw TypeError": true,
-  "Range interface: calling setEndBefore(Node) on detachedRange with too few arguments must throw TypeError": true,
-  "Range interface: calling setEndAfter(Node) on detachedRange with too few arguments must throw TypeError": true,
-  "Range interface: calling collapse(boolean) on detachedRange with too few arguments must throw TypeError": true,
-  "Range interface: calling selectNode(Node) on detachedRange with too few arguments must throw TypeError": true,
-  "Range interface: calling selectNodeContents(Node) on detachedRange with too few arguments must throw TypeError": true,
-  "Range interface: calling compareBoundaryPoints(unsigned short,Range) on detachedRange with too few arguments must throw TypeError": true,
-  "Range interface: calling insertNode(Node) on detachedRange with too few arguments must throw TypeError": true,
-  "Range interface: calling surroundContents(Node) on detachedRange with too few arguments must throw TypeError": true,
-  "Range interface: calling isPointInRange(Node,unsigned long) on detachedRange with too few arguments must throw TypeError": true,
-  "Range interface: calling comparePoint(Node,unsigned long) on detachedRange with too few arguments must throw TypeError": true,
-  "Range interface: calling intersectsNode(Node) on detachedRange with too few arguments must throw TypeError": true,
   "NodeFilter interface: existence and properties of interface object": true,
   "NodeFilter interface: existence and properties of interface prototype object": true,
   "NodeFilter interface: existence and properties of interface prototype object's \"constructor\" property": true,
diff --git a/dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/Makefile.in b/dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/Makefile.in
index 6ca2154239a3..60b16d7cff46 100644
--- a/dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/Makefile.in
+++ b/dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/Makefile.in
@@ -25,7 +25,6 @@ MOCHITEST_FILES := \
   test_Range-commonAncestorContainer.html.json \
   test_Range-comparePoint.html.json \
   test_Range-detach.html.json \
-  test_Range-intersectsNode-binding.html.json \
   test_attributes.html.json \
   test_case.html.json \
   test_historical.html.json \
diff --git a/dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/test_Range-comparePoint.html.json b/dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/test_Range-comparePoint.html.json
index 456283f7ac70..d7d8b443a70e 100644
--- a/dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/test_Range-comparePoint.html.json
+++ b/dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/test_Range-comparePoint.html.json
@@ -1,4 +1,3 @@
 {
-  "Range.comparePoint": true,
-  "Range.comparePoint 1": true
+  "Range.comparePoint": true
 }
diff --git a/dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/test_Range-intersectsNode-binding.html.json b/dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/test_Range-intersectsNode-binding.html.json
deleted file mode 100644
index fdfba98df306..000000000000
--- a/dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/test_Range-intersectsNode-binding.html.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "Calling intersectsNode without an argument or with an invalid argument should throw a TypeError.": true
-}
diff --git a/dom/interfaces/core/nsIDOMDocumentFragment.idl b/dom/interfaces/core/nsIDOMDocumentFragment.idl
index 39d229cffbc5..98aab1a89e49 100644
--- a/dom/interfaces/core/nsIDOMDocumentFragment.idl
+++ b/dom/interfaces/core/nsIDOMDocumentFragment.idl
@@ -14,7 +14,7 @@
  * http://www.w3.org/TR/DOM-Level-2-Core/
  */
 
-[scriptable, uuid(b098fc8f-9ef4-4de8-bbd0-4a0fc712dd6e)]
+[scriptable, builtinclass, uuid(b098fc8f-9ef4-4de8-bbd0-4a0fc712dd6e)]
 interface nsIDOMDocumentFragment : nsIDOMNode
 {
 };
diff --git a/dom/interfaces/svg/Makefile.in b/dom/interfaces/svg/Makefile.in
index 09bbb4309789..d77145107dd8 100644
--- a/dom/interfaces/svg/Makefile.in
+++ b/dom/interfaces/svg/Makefile.in
@@ -13,5 +13,6 @@ VPATH		= @srcdir@
 include $(DEPTH)/config/autoconf.mk
 
 MODULE		= dom
+
 include $(topsrcdir)/config/rules.mk
 
diff --git a/dom/interfaces/svg/moz.build b/dom/interfaces/svg/moz.build
index 34e65b139721..d53b4c0d12a5 100644
--- a/dom/interfaces/svg/moz.build
+++ b/dom/interfaces/svg/moz.build
@@ -13,13 +13,11 @@ XPIDL_SOURCES += [
     'nsIDOMSVGAnimatedString.idl',
     'nsIDOMSVGDocument.idl',
     'nsIDOMSVGElement.idl',
-    'nsIDOMSVGEvent.idl',
     'nsIDOMSVGFilters.idl',
     'nsIDOMSVGLength.idl',
     'nsIDOMSVGNumber.idl',
     'nsIDOMSVGRect.idl',
     'nsIDOMSVGStringList.idl',
-    'nsIDOMSVGURIReference.idl',
     'nsIDOMSVGUnitTypes.idl',
     'nsIDOMSVGZoomEvent.idl',
 ]
diff --git a/dom/interfaces/svg/nsIDOMSVGEvent.idl b/dom/interfaces/svg/nsIDOMSVGEvent.idl
deleted file mode 100644
index 8bebd64c8d82..000000000000
--- a/dom/interfaces/svg/nsIDOMSVGEvent.idl
+++ /dev/null
@@ -1,16 +0,0 @@
-/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsIDOMEvent.idl"
-
-/**
- * For more information on this interface please see
- * http://www.w3.org/TR/SVG11/script.html#InterfaceSVGEvent
- */
-
-[scriptable, builtinclass, uuid(d6a2c07c-8a67-4a6e-adde-f668edb4a852)]
-interface nsIDOMSVGEvent : nsIDOMEvent
-{
-};
diff --git a/dom/interfaces/svg/nsIDOMSVGURIReference.idl b/dom/interfaces/svg/nsIDOMSVGURIReference.idl
deleted file mode 100644
index e421eae4be52..000000000000
--- a/dom/interfaces/svg/nsIDOMSVGURIReference.idl
+++ /dev/null
@@ -1,15 +0,0 @@
-/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsISupports.idl"
-
-interface nsIDOMSVGAnimatedString;
-
-[scriptable, uuid(8092b5f3-dc8a-459c-94f1-92f8011f2438)]
-interface nsIDOMSVGURIReference
-  : nsISupports
-{
-  readonly attribute nsIDOMSVGAnimatedString href;
-};
diff --git a/dom/media/Makefile.in b/dom/media/Makefile.in
index 339f9f460ef4..4d6f60fa9ff5 100644
--- a/dom/media/Makefile.in
+++ b/dom/media/Makefile.in
@@ -25,7 +25,7 @@ EXTRA_COMPONENTS = \
   PeerConnection.manifest \
   $(NULL)
 
-EXPORTS_NAMESPACE = mozilla
+EXPORTS_NAMESPACES = mozilla
 
 EXPORTS_mozilla = \
   MediaManager.h \
diff --git a/dom/mms/src/ril/MmsService.js b/dom/mms/src/ril/MmsService.js
index 9046c80e26a5..8c1efd4d3188 100644
--- a/dom/mms/src/ril/MmsService.js
+++ b/dom/mms/src/ril/MmsService.js
@@ -39,6 +39,14 @@ const RETRIEVAL_MODE_MANUAL = "manual";
 const RETRIEVAL_MODE_AUTOMATIC = "automatic";
 const RETRIEVAL_MODE_NEVER = "never";
 
+
+//Internal const values.
+const DELIVERY_RECEIVED = "received";
+const DELIVERY_NOT_DOWNLOADED = "not-downloaded";
+const DELIVERY_SENDING = "sending";
+const DELIVERY_SENT = "sent";
+const DELIVERY_ERROR = "error";
+
 const MAX_RETRY_COUNT = Services.prefs.getIntPref("dom.mms.retrievalRetryCount");
 const DELAY_TIME_TO_RETRY = Services.prefs.getIntPref("dom.mms.retrievalRetryInterval");
 
@@ -54,6 +62,10 @@ XPCOMUtils.defineLazyServiceGetter(this, "gRIL",
                                    "@mozilla.org/ril;1",
                                    "nsIRadioInterfaceLayer");
 
+XPCOMUtils.defineLazyServiceGetter(this, "gMobileMessageDatabaseService",
+                                   "@mozilla.org/mobilemessage/rilmobilemessagedatabaseservice;1",
+                                   "nsIRilMobileMessageDatabaseService");
+
 XPCOMUtils.defineLazyGetter(this, "MMS", function () {
   let MMS = {};
   Cu.import("resource://gre/modules/MmsPduHelper.jsm", MMS);
@@ -419,6 +431,83 @@ XPCOMUtils.defineLazyGetter(this, "gMmsTransactionHelper", function () {
           releaseMmsConnectionAndCallback(0, null);
         }
       }).bind(this, method, url, istream, callback));
+    },
+
+    /**
+     * Count number of recipients(to, cc, bcc fields).
+     *
+     * @param recipients
+     *        The recipients in MMS message object.
+     * @return the number of recipients
+     * @see OMA-TS-MMS_CONF-V1_3-20110511-C section 10.2.5
+     */
+    countRecipients: function countRecipients(recipients) {
+      if (recipients && recipients.address) {
+        return 1;
+      }
+      let totalRecipients = 0;
+      if (!Array.isArray(recipients)) {
+        return 0;
+      }
+      totalRecipients += recipients.length;
+      for (let ix = 0; ix < recipients.length; ++ix) {
+        if (recipients[ix].address.length > MMS.MMS_MAX_LENGTH_RECIPIENT) {
+          throw new Error("MMS_MAX_LENGTH_RECIPIENT error");
+        }
+        if (recipients[ix].type === "email") {
+          let found = recipients[ix].address.indexOf("<");
+          let lenMailbox = recipients[ix].address.length - found;
+          if(lenMailbox > MMS.MMS_MAX_LENGTH_MAILBOX_PORTION) {
+            throw new Error("MMS_MAX_LENGTH_MAILBOX_PORTION error");
+          }
+        }
+      }
+      return totalRecipients;
+    },
+
+    /**
+     * Check maximum values of MMS parameters.
+     *
+     * @param msg
+     *        The MMS message object.
+     * @return true if the lengths are less than the maximum values of MMS
+     *         parameters.
+     * @see OMA-TS-MMS_CONF-V1_3-20110511-C section 10.2.5
+     */
+    checkMaxValuesParameters: function checkMaxValuesParameters(msg) {
+      let subject = msg.headers["subject"];
+      if (subject && subject.length > MMS.MMS_MAX_LENGTH_SUBJECT) {
+        return false;
+      }
+
+      let totalRecipients = 0;
+      try {
+        totalRecipients += this.countRecipients(msg.headers["to"]);
+        totalRecipients += this.countRecipients(msg.headers["cc"]);
+        totalRecipients += this.countRecipients(msg.headers["bcc"]);
+      } catch (ex) {
+        debug("Exception caught : " + ex);
+        return false;
+      }
+
+      if (totalRecipients < 1 ||
+          totalRecipients > MMS.MMS_MAX_TOTAL_RECIPIENTS) {
+        return false;
+      }
+
+      if (!Array.isArray(msg.parts)) {
+        return true;
+      }
+      for (let i = 0; i < msg.parts.length; i++) {
+        if (msg.parts[i].headers["content-type"] &&
+          msg.parts[i].headers["content-type"].params) {
+          let name = msg.parts[i].headers["content-type"].params["name"];
+          if (name && name.length > MMS.MMS_MAX_LENGTH_NAME_CONTENT_TYPE) {
+            return false;
+          }
+        }
+      }
+      return true;
     }
   };
 });
@@ -544,6 +633,7 @@ RetrieveTransaction.prototype = {
 /**
  * SendTransaction.
  *   Class for sending M-Send.req to MMSC
+ *   @throws Error("Check max values parameters fail.")
  */
 function SendTransaction(msg) {
   msg.headers["x-mms-message-type"] = MMS.MMS_PDU_TYPE_SEND_REQ;
@@ -564,9 +654,11 @@ function SendTransaction(msg) {
   msg.headers["x-mms-read-report"] = true;
   msg.headers["x-mms-delivery-report"] = true;
 
-  // TODO: bug 792321 - MMSCONF-GEN-C-003: Support for maximum values for MMS
-  //                                        parameters
-
+  if (!gMmsTransactionHelper.checkMaxValuesParameters(msg)) {
+    //We should notify end user that the header format is wrong.
+    debug("Check max values parameters fail.");
+    throw new Error("Check max values parameters fail.");
+  }
   let messageSize = 0;
 
   if (msg.content) {
@@ -813,6 +905,70 @@ MmsService.prototype = {
     return config >= CONFIG_SEND_REPORT_DEFAULT_YES;
   },
 
+  /**
+   * Convert intermediate message to indexedDB savable object.
+   *
+   * @param intermediate
+   *        Intermediate MMS message parsed from PDU.
+   */
+  convertFromIntermediateToSavable: function convertFromIntermediateToSavable(intermediate) {
+    intermediate.type = "mms";
+    intermediate.delivery = DELIVERY_NOT_DOWNLOADED;
+    intermediate.timestamp = Date.now();
+    intermediate.sender = null;
+    if (intermediate.headers.from) {
+      intermediate.sender = intermediate.headers.from.address;
+    } else {
+      record.sender = "anonymous";
+    }
+    intermediate.receivers = [];
+    return intermediate;
+  },
+
+  /**
+   * Convert intermediate message to indexedDB savable object.
+   *
+   * @param intermediate
+   *        Intermediate MMS message parsed from PDU.
+   * @param record
+   *        Record stored in the database.
+   */
+  mergeRetrievalConfirmationIntoRecord: function mergeRetrievalConfirmationIntoRecord(intermediate, record) {
+    if (intermediate.headers["Date"]) {
+      record.timestamp = Date.parse(intermediate.headers["Date"]);
+    }
+    if (intermediate.headers.from) {
+      record.sender = intermediate.headers.from.address;
+    } else {
+      record.sender = "anonymous";
+    }
+    record.receivers = [];
+    // We don't have Bcc in recevied MMS message.
+    for each (let type in ["cc", "to"]) {
+      if (intermediate.headers[type]) {
+        if (intermediate.headers[type] instanceof Array) {
+          for (let index in intermediate.headers[type]) {
+            record.receivers.push(intermediate.headers[type][index].address)
+          }
+        } else {
+          record.receivers.push(intermediate.headers[type].address);
+        }
+      }
+    }
+
+    record.delivery = DELIVERY_RECEIVED;
+    for (let field in intermediate.headers) {
+      record.headers[field] = intermediate.headers[field];
+    }
+    if (intermediate.parts) {
+      record.parts = intermediate.parts;
+    }
+    if (intermediate.content) {
+      record.content = intermediate.content;
+    }
+    return record;
+  },
+
   /**
    * @param contentLocation
    *        X-Mms-Content-Location of the message.
@@ -843,45 +999,92 @@ MmsService.prototype = {
     // TODO: bug 810091 - don't download message twice on receiving duplicated
     //                     notification
 
-    let retrievalMode = RETRIEVAL_MODE_MANUAL;
-    try {
-      retrievalMode = Services.prefs.getCharPref(PREF_RETRIEVAL_MODE);
-    } catch (e) {}
-
-    if (RETRIEVAL_MODE_AUTOMATIC === retrievalMode) {
-      this.retrieveMessage(url, (function responseNotify(mmsStatus, retrievedMsg) {
-        debug("retrievedMsg = " + JSON.stringify(retrievedMsg));
-        // TODO: Bug 845643 - B2G MMS: Save retrieved MM into database.
-
-        let transactionId = notification.headers["x-mms-transaction-id"];
-
-        // For X-Mms-Report-Allowed
-        let wish = notification.headers["x-mms-delivery-report"];
-        // `The absence of the field does not indicate any default value.`
-        // So we go checking the same field in retrieved message instead.
-        if ((wish == null) && retrievedMsg) {
-          wish = retrievedMsg.headers["x-mms-delivery-report"];
-        }
-        let reportAllowed = this.getReportAllowed(this.confSendDeliveryReport, wish);
-
-        let transaction =
-          new NotifyResponseTransaction(transactionId, mmsStatus, reportAllowed);
-        transaction.run();
-      }).bind(this));
-      return;
-    }
-
     let transactionId = notification.headers["x-mms-transaction-id"];
-    let mmsStatus = RETRIEVAL_MODE_NEVER === retrievalMode ?
-        MMS.MMS_PDU_STATUS_REJECTED : MMS.MMS_PDU_STATUS_DEFERRED;
     // For X-Mms-Report-Allowed
     let wish = notification.headers["x-mms-delivery-report"];
-    let reportAllowed = this.getReportAllowed(this.confSendDeliveryReport, wish);
 
-    let transaction = new NotifyResponseTransaction(transactionId,
-                                                    mmsStatus,
-                                                    reportAllowed);
-    transaction.run();
+    notification = this.convertFromIntermediateToSavable(notification);
+
+    gMobileMessageDatabaseService.saveReceivedMessage(notification,
+      (function (rv, messageRecord) {
+        // TODO: Bug 760065 - B2G MMS: Implement MMS DOM API
+        // Connect to DOM API for notifing new comming MMS to Gaia.
+        let success = Components.isSuccessCode(rv);
+        if (!success) {
+          // At this point we could send a message to content to notify the
+          // user that storing an incoming MMS notify indication failed,
+          // ost likely due to a full disk.
+          debug("Could not store MMS " + JSON.stringify(notification) +
+                ", error code " + rv);
+          // Because MMSC will resend the notification indication once we don't
+          // response the notification. Hope the end user will clean some space
+          // for the resended notification indication.
+          return;
+        }
+
+        let retrievalMode = RETRIEVAL_MODE_MANUAL;
+        try {
+          retrievalMode = Services.prefs.getCharPref(PREF_RETRIEVAL_MODE);
+        } catch (e) {}
+
+        if (RETRIEVAL_MODE_AUTOMATIC !== retrievalMode) {
+          let mmsStatus = RETRIEVAL_MODE_NEVER === retrievalMode ?
+              MMS.MMS_PDU_STATUS_REJECTED : MMS.MMS_PDU_STATUS_DEFERRED;
+          // For X-Mms-Report-Allowed
+          let reportAllowed = this.getReportAllowed(this.confSendDeliveryReport, wish);
+
+          let transaction = new NotifyResponseTransaction(transactionId,
+                                                          mmsStatus,
+                                                          reportAllowed);
+          transaction.run();
+        }
+
+        this.retrieveMessage(url, (function responseNotify(mmsStatus,
+                                                           retrievedMsg) {
+          // `The absence of the field does not indicate any default
+          // value.` So we go checking the same field in retrieved
+          // message instead.
+          if ((wish == null) && retrievedMsg) {
+            wish = retrievedMsg.headers["x-mms-delivery-report"];
+          }
+          let reportAllowed = this.getReportAllowed(
+            this.confSendDeliveryReport, wish);
+
+          // Should update the retrievedStatus in databse.
+          debug("retrievedMsg = " + JSON.stringify(retrievedMsg));
+
+          // If the mmsStatus is still MMS_PDU_STATUS_DEFERRED after retry, we
+          // should not store into database.
+          if (MMS.MMS_PDU_STATUS_RETRIEVED !== mmsStatus) {
+            let transaction =
+              new NotifyResponseTransaction(transactionId, mmsStatus, reportAllowed);
+            transaction.run();
+          }
+
+          messageRecord = this.mergeRetrievalConfirmationIntoRecord(retrievedMsg, messageRecord);
+          gMobileMessageDatabaseService.saveReceivedMessage(messageRecord,
+            (function (rv, messageRecord) {
+              // TODO: Bug 760065 - B2G MMS: Implement MMS DOM API
+              // Connect to DOM API for notifing new comming MMS to Gaia.
+              let success = Components.isSuccessCode(rv);
+              if (!success) {
+                // At this point we could send a message to content to
+                // notify the user that storing an incoming MMS failed, most
+                // likely due to a full disk.
+                debug("Could not store MMS " + messageRecord.id +
+                      ", error code " + rv);
+
+                let transaction = new NotifyResponseTransaction(
+                  transactionId, MMS.MMS_PDU_STATUS_DEFERRED, reportAllowed);
+                transaction.run();
+                return;
+              }
+            }).bind(this)
+          );
+        }).bind(this));
+        return;
+      }).bind(this)
+    );
   },
 
   /**
diff --git a/dom/mms/src/ril/mms_consts.js b/dom/mms/src/ril/mms_consts.js
index 6f2d2937fb01..9db577a99011 100644
--- a/dom/mms/src/ril/mms_consts.js
+++ b/dom/mms/src/ril/mms_consts.js
@@ -94,6 +94,14 @@ this.MMS_PDU_STATUS_INDETERMINATE = 133;
 this.MMS_PDU_STATUS_FORWARDED     = 134;
 this.MMS_PDU_STATUS_UNREACHABLE   = 135;
 
+// Maximum Values of MMS Parameters
+// @see OMA-TS-MMS_CONF-V1_3-20110511-C 10.2.5
+this.MMS_MAX_LENGTH_SUBJECT                = 40;
+this.MMS_MAX_LENGTH_RECIPIENT              = 312;
+this.MMS_MAX_TOTAL_RECIPIENTS              = 20;
+this.MMS_MAX_LENGTH_NAME_CONTENT_TYPE      = 40;
+this.MMS_MAX_LENGTH_MAILBOX_PORTION        = 256;
+
 this.ALL_CONST_SYMBOLS = undefined; // We want ALL_CONST_SYMBOLS to be exported.
 this.ALL_CONST_SYMBOLS = Object.keys(this);
 
diff --git a/dom/mms/tests/test_mms_service.js b/dom/mms/tests/test_mms_service.js
new file mode 100644
index 000000000000..99aef7977db9
--- /dev/null
+++ b/dom/mms/tests/test_mms_service.js
@@ -0,0 +1,139 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+function newMmsTransactionHelper() {
+  let MMS_Service = {};
+  subscriptLoader.loadSubScript("resource://gre/components/MmsService.js", MMS_Service);
+  MMS_Service.debug = do_print;
+  return MMS_Service.gMmsTransactionHelper;
+}
+let CallFunc = newMmsTransactionHelper();
+function run_test() {
+  run_next_test();
+}
+
+//
+// Test target: checkMaxValuesParameters
+//
+
+//// Test Long Subject field ////
+//// @see OMA-ETS-MMS_CON-V1_3-20080128-C 5.1.1.1.10 MMS-1.3-con-171 ////
+
+add_test(function test_LongSubjectField() {
+  let msg = {};
+  msg.headers = {};
+  // Test for normal TextString
+  msg.headers["subject"] = "abcdefghijklmnopqrstuvwxyz0123456789/-+@?";
+  do_check_eq(CallFunc.checkMaxValuesParameters(msg), false);
+
+  run_next_test();
+});
+
+//// Test recipient field length
+
+add_test(function test_LongRecipientField() {
+  let msg = {};
+  msg.headers = {};
+  msg.headers["to"] = [
+    { address:
+      "abcdefghijklmnopqrstuvwxyz0123456789/-+@?" +
+      "abcdefghijklmnopqrstuvwxyz0123456789/-+@?" +
+      "abcdefghijklmnopqrstuvwxyz0123456789/-+@?" +
+      "abcdefghijklmnopqrstuvwxyz0123456789/-+@?" +
+      "abcdefghijklmnopqrstuvwxyz0123456789/-+@?" +
+      "abcdefghijklmnopqrstuvwxyz0123456789/-+@?" +
+      "abcdefghijklmnopqrstuvwxyz0123456789/-+@?" +
+      "abcdefghijklmnopqrstuvwxyz",
+      type: "PLMN" },
+  ];
+  do_check_eq(CallFunc.checkMaxValuesParameters(msg), false);
+
+  run_next_test();
+});
+
+
+add_test(function test_checkMaxValuesParameters() {
+  let msg = {};
+  msg.headers = {};
+  msg.headers["cc"] = [
+    { address: "+789", type: "PLMN" },
+    { address: "+119", type: "num" },
+    { address: "Joe2 User " +
+               "<abcdefghijklmnopqrstuvwxyz0123456789" +
+               "abcdefghijklmnopqrstuvwxyz0123456789@" +
+               "abcdefghijklmnopqrstuvwxyz0123456789" +
+               "abcdefghijklmnopqrstuvwxyz0123456789." +
+               "abcdefghijklmnopqrstuvwxyz0123456789" +
+               "abcdefghijklmnopqrstuvwxyz0123456789" +
+               "abcdefghijklmnopqrstuvwxyz0123456789->"
+      , type: "email" },
+  ];
+  do_check_eq(CallFunc.checkMaxValuesParameters(msg), false);
+
+  run_next_test();
+});
+
+//// Test total recipient count over 20
+
+add_test(function test_TotalRecipientCount() {
+  let msg = {};
+  msg.headers = {};
+  do_check_eq(CallFunc.checkMaxValuesParameters(msg), false);
+
+  msg.headers["to"] = [
+    { address: "+123", type: "PLMN" },
+    { address: "+456", type: "num" },
+    { address: "Joe User <joe@user.org>", type: "email" },
+    { address: "+123", type: "PLMN" },
+    { address: "+456", type: "num" },
+    { address: "Joe User <joe@user.org>", type: "email" },
+    { address: "+123", type: "PLMN" },
+  ];
+  msg.headers["cc"] = [
+    { address: "+789", type: "PLMN" },
+    { address: "+119", type: "num" },
+    { address: "Joe2 User <joe2@user.org>", type: "email" },
+    { address: "+789", type: "PLMN" },
+    { address: "+119", type: "num" },
+    { address: "Joe2 User <joe2@user.org>", type: "email" },
+    { address: "+789", type: "PLMN" },
+  ];
+  msg.headers["bcc"] = [
+    { address: "+110", type: "num" },
+    { address: "Joe3 User <joe2@user.org>", type: "email" },
+    { address: "Joe2 User <joe2@user.org>", type: "email" },
+    { address: "+789", type: "PLMN" },
+    { address: "+119", type: "num" },
+    { address: "Joe2 User <joe2@user.org>", type: "email" },
+    { address: "+789", type: "PLMN" },
+  ];
+  do_check_eq(CallFunc.checkMaxValuesParameters(msg), false);
+
+  run_next_test();
+});
+
+////Test name parameter in content-type field of multi-parts
+
+add_test(function test_NameParameterInContentType() {
+  let msg = {};
+  msg.headers = {};
+  msg.headers["to"] = [
+                       { address: "Joe User <joe@user.org>", type: "email" },
+                      ];
+  let params = {};
+  params["name"] = "abcdefghijklmnopqrstuvwxyz0123456789/-+@?";
+  let headers = {};
+  headers["content-type"] = {
+    media: null,
+    params: params,
+  };
+  msg.parts = new Array(1);
+  msg.parts[0] = {
+    index: 0,
+    headers: headers,
+    content: null,
+  };
+  do_check_eq(CallFunc.checkMaxValuesParameters(msg), false);
+
+  run_next_test();
+});
\ No newline at end of file
diff --git a/dom/mms/tests/xpcshell.ini b/dom/mms/tests/xpcshell.ini
index b689d9fd6498..ec9c95f5752e 100644
--- a/dom/mms/tests/xpcshell.ini
+++ b/dom/mms/tests/xpcshell.ini
@@ -4,3 +4,4 @@ tail =
 
 [test_wsp_pdu_helper.js]
 [test_mms_pdu_helper.js]
+[test_mms_service.js]
diff --git a/dom/mobilemessage/src/ril/MobileMessageDatabaseService.js b/dom/mobilemessage/src/ril/MobileMessageDatabaseService.js
index 04e7d73dcc81..f889187f6d87 100644
--- a/dom/mobilemessage/src/ril/MobileMessageDatabaseService.js
+++ b/dom/mobilemessage/src/ril/MobileMessageDatabaseService.js
@@ -964,8 +964,11 @@ MobileMessageDatabaseService.prototype = {
   },
 
   saveRecord: function saveRecord(aMessageRecord, aAddresses, aCallback) {
-    this.lastMessageId += 1;
-    aMessageRecord.id = this.lastMessageId;
+    if (aMessageRecord.id === undefined) {
+      // Assign a new id.
+      this.lastMessageId += 1;
+      aMessageRecord.id = this.lastMessageId;
+    }
     if (DEBUG) debug("Going to store " + JSON.stringify(aMessageRecord));
 
     let self = this;
@@ -1074,26 +1077,46 @@ MobileMessageDatabaseService.prototype = {
   saveReceivedMessage: function saveReceivedMessage(aMessage, aCallback) {
     if (aMessage.type === undefined ||
         aMessage.sender === undefined ||
-        aMessage.messageClass === undefined ||
+        (aMessage.type == "sms" && aMessage.messageClass === undefined) ||
+        (aMessage.type == "mms" && aMessage.delivery === undefined) ||
         aMessage.timestamp === undefined) {
       if (aCallback) {
         aCallback.notify(Cr.NS_ERROR_FAILURE, null);
       }
       return;
     }
+    let self = this.getRilIccInfoMsisdn();
+    let threadParticipants = [aMessage.sender];
+    if (aMessage.type == "sms") {
+      aMessage.receiver = self;
+    } else if (aMessage.type == "mms") {
+      if (!aMessage.receivers.length) {
+        if (self) {
+          aMessage.receivers.push(self);
+        }
+      } else {
+        let slicedReceivers = aMessage.receivers.slice();
+        let found = slicedReceivers.indexOf(self);
+        if (self && (found !== -1)) {
+          slicedReceivers.splice(found, 1);
+        }
+        threadParticipants = threadParticipants.concat(slicedReceivers);
+      }
+    }
 
-    aMessage.receiver = this.getRilIccInfoMsisdn();
     let timestamp = aMessage.timestamp;
 
     // Adding needed indexes and extra attributes for internal use.
     // threadIdIndex & participantIdsIndex are filled in saveRecord().
     aMessage.deliveryIndex = [DELIVERY_RECEIVED, timestamp];
     aMessage.readIndex = [FILTER_READ_UNREAD, timestamp];
-    aMessage.delivery = DELIVERY_RECEIVED;
+    if (aMessage.type == "sms") {
+      aMessage.delivery = DELIVERY_RECEIVED;
+    }
     aMessage.deliveryStatus = DELIVERY_STATUS_SUCCESS;
     aMessage.read = FILTER_READ_UNREAD;
 
-    return this.saveRecord(aMessage, [aMessage.sender], aCallback);
+    return this.saveRecord(aMessage, threadParticipants, aCallback);
   },
 
   saveSendingMessage: function saveSendingMessage(aMessage, aCallback) {
diff --git a/dom/network/interfaces/nsIDOMMobileConnection.idl b/dom/network/interfaces/nsIDOMMobileConnection.idl
index 6b516b28bd30..aa06abd5115d 100644
--- a/dom/network/interfaces/nsIDOMMobileConnection.idl
+++ b/dom/network/interfaces/nsIDOMMobileConnection.idl
@@ -323,7 +323,7 @@ interface nsIDOMMozMobileConnection : nsIDOMEventTarget
   [implicit_jscontext] attribute jsval oncfstatechange;
 };
 
-[scriptable, uuid(21a20166-a9b4-4386-b151-49e6cfb9401b)]
+[scriptable, uuid(c9d9ff61-a2f0-41cd-b478-9cefa7b31f31)]
 interface nsIDOMMozMobileConnectionInfo : nsISupports
 {
   /**
@@ -361,7 +361,7 @@ interface nsIDOMMozMobileConnectionInfo : nsISupports
   /**
    * Mobile Country Code (MCC) of last known network operator.
    */
-  readonly attribute unsigned short lastKnownMcc;
+  readonly attribute DOMString lastKnownMcc;
 
   /**
    * Type of connection.
@@ -389,7 +389,7 @@ interface nsIDOMMozMobileConnectionInfo : nsISupports
 
 };
 
-[scriptable, uuid(3bd866c7-98a5-4ef4-a464-c22d8cc6b992)]
+[scriptable, uuid(40018fc7-4c42-47b6-8de6-3591a9c622bc)]
 interface nsIDOMMozMobileNetworkInfo: nsISupports
 {
   /**
@@ -405,12 +405,12 @@ interface nsIDOMMozMobileNetworkInfo: nsISupports
   /**
    * Mobile Country Code (MCC) of the network operator
    */
-  readonly attribute unsigned short mcc;
+  readonly attribute DOMString mcc;
 
   /**
    * Mobile Network Code (MNC) of the network operator
    */
-  readonly attribute unsigned short mnc;
+  readonly attribute DOMString mnc;
 
   /**
    * State of this network operator.
@@ -434,7 +434,7 @@ interface nsIDOMMozMobileCellInfo: nsISupports
   readonly attribute unsigned long gsmCellId;
 };
 
-[scriptable, uuid(b794bfcd-4ba4-46f2-8bf3-b4ed1b8d2b40)]
+[scriptable, uuid(10d5c5a2-d43f-4f94-8657-cf7ccabbab6e)]
 interface nsIDOMMozMobileICCInfo : nsISupports
 {
    /**
@@ -445,12 +445,12 @@ interface nsIDOMMozMobileICCInfo : nsISupports
   /**
    * Mobile Country Code (MCC) of the subscriber's home network.
    */
-  readonly attribute unsigned short mcc;
+  readonly attribute DOMString mcc;
 
   /**
    * Mobile Network Code (MNC) of the subscriber's home network.
    */
-  readonly attribute unsigned short mnc;
+  readonly attribute DOMString mnc;
 
   /**
    * Service Provider Name (SPN) of the subscriber's home network.
diff --git a/dom/network/tests/marionette/test_mobile_networks.js b/dom/network/tests/marionette/test_mobile_networks.js
index 98effebc9900..40e0818f4c72 100644
--- a/dom/network/tests/marionette/test_mobile_networks.js
+++ b/dom/network/tests/marionette/test_mobile_networks.js
@@ -18,15 +18,15 @@ let telkilaNetwork = null;
 function isAndroidNetwork(network) {
   is(network.longName, "Android");
   is(network.shortName, "Android");
-  is(network.mcc, 310);
-  is(network.mnc, 260);
+  is(network.mcc, "310");
+  is(network.mnc, "260");
 }
 
 function isTelkilaNetwork(network) {
   is(network.longName, "TelKila");
   is(network.shortName, "TelKila");
-  is(network.mcc, 310);
-  is(network.mnc, 295);
+  is(network.mcc, "310");
+  is(network.mnc, "295");
 }
 
 function testConnectionInfo() {
@@ -36,7 +36,7 @@ function testConnectionInfo() {
   is(voice.emergencyCallsOnly, false);
   is(voice.roaming, false);
   isAndroidNetwork(voice.network);
-  is(voice.lastKnownMcc, 310);
+  is(voice.lastKnownMcc, "310");
 
   let data = connection.data;
   // data.connected = true means there's an active data call which we
@@ -45,7 +45,7 @@ function testConnectionInfo() {
   is(data.emergencyCallsOnly, false);
   is(data.roaming, false);
   isAndroidNetwork(data.network);
-  is(data.lastKnownMcc, 0);
+  is(data.lastKnownMcc, null);
 
   testGetNetworks();
 }
diff --git a/dom/network/tests/marionette/test_mobile_operator_names.js b/dom/network/tests/marionette/test_mobile_operator_names.js
index 62c4075188b0..4ea9e7530a3c 100644
--- a/dom/network/tests/marionette/test_mobile_operator_names.js
+++ b/dom/network/tests/marionette/test_mobile_operator_names.js
@@ -54,8 +54,8 @@ function setEmulatorRoaming(roaming, callback) {
 }
 
 function checkValidMccMnc() {
-  is(network.mcc, 310, "network.mcc");
-  is(network.mnc, 260, "network.mnc");
+  is(network.mcc, "310", "network.mcc");
+  is(network.mnc, "260", "network.mnc");
 }
 
 function waitForVoiceChange(callback) {
diff --git a/dom/phonenumberutils/PhoneNumber.jsm b/dom/phonenumberutils/PhoneNumber.jsm
index f89125df550e..98780913be2f 100644
--- a/dom/phonenumberutils/PhoneNumber.jsm
+++ b/dom/phonenumberutils/PhoneNumber.jsm
@@ -14,100 +14,15 @@ this.PhoneNumber = (function (dataBase) {
   // Use strict in our context only - users might not want it
   'use strict';
 
-  // The minimum length of the national significant number.
-  const MIN_LENGTH_FOR_NSN = 2;
-
-  const STAR_SIGN = "*";
+  const MAX_PHONE_NUMBER_LENGTH = 50;
   const UNICODE_DIGITS = /[\uFF10-\uFF19\u0660-\u0669\u06F0-\u06F9]/g;
   const NON_ALPHA_CHARS = /[^a-zA-Z]/g;
   const NON_DIALABLE_CHARS = /[^,#+\*\d]/g;
-  const PLUS_CHARS = "+\uFF0B";
+  const NON_DIALABLE_CHARS_ONCE = new RegExp(NON_DIALABLE_CHARS.source);
   const BACKSLASH = /\\/g;
   const SPLIT_FIRST_GROUP = /^(\d+)(.*)$/;
-
-  /**
-   * Regular expression of acceptable punctuation found in phone numbers. This
-   * excludes punctuation found as a leading character only. This consists of
-   * dash characters, white space characters, full stops, slashes, square
-   * brackets, parentheses and tildes. It also includes the letter 'x' as that
-   * is found as a placeholder for carrier information in some phone numbers.
-   * Full-width variants are also present.
-   */
-  const VALID_PUNCTUATION = "-x\u2010-\u2015\u2212\u30FC\uFF0D-\uFF0F \u00A0"
-                          + "\u200B\u2060\u3000()\uFF08\uFF09\uFF3B\uFF3D."
-                          + "\\[\\]/~\u2053\u223C\uFF5E";
-  const VALID_DIGITS = "0-9\uFF10-\uFF19\u0660-\u0669\u06F0-\u06F9";
-  const VALID_ALPHA = "a-zA-Z";
-
-  /**
-   * Regular expression of viable phone numbers. This is location independent.
-   * Checks we have at least three leading digits, and only valid punctuation,
-   * alpha characters and digits in the phone number. Does not include extension
-   * data. The symbol 'x' is allowed here as valid punctuation since it is often
-   * used as a placeholder for carrier codes, for example in Brazilian phone
-   * numbers. We also allow multiple '+' characters at the start.
-   * Corresponds to the following:
-   * [digits]{minLengthNsn}|
-   * plus_sign*
-   * (([punctuation]|[star])*[digits]){3,}([punctuation]|[star]|[digits]|[alpha])*
-   *
-   * The first reg-ex is to allow short numbers (two digits long) to be parsed
-   * if they are entered as "15" etc, but only if there is no punctuation in
-   * them. The second expression restricts the number of digits to three or
-   * more, but then allows them to be in international form, and to have
-   * alpha-characters and punctuation. We split up the two reg-exes here and
-   * combine them when creating the reg-ex VALID_PHONE_NUMBER_PATTERN itself so
-   * we can prefix it with ^ and append $ to each branch.
-   *
-   * Note VALID_PUNCTUATION starts with a -, so must be the first in the range.
-   */
-  const MIN_LENGTH_PHONE_NUMBER
-    = "[" + VALID_DIGITS + "]{" + MIN_LENGTH_FOR_NSN + "}";
-  const VALID_PHONE_NUMBER
-    = "[" + PLUS_CHARS + "]*"
-    + "(?:[" + VALID_PUNCTUATION + STAR_SIGN + "]*" + "[" + VALID_DIGITS + "]){3,}"
-    + "[" + VALID_PUNCTUATION + STAR_SIGN + VALID_ALPHA + VALID_DIGITS + "]*";
-
-  /**
-   * Pattern to capture digits used in an extension.
-   * Places a maximum length of '7' for an extension.
-   */
-  const CAPTURING_EXTN_DIGITS = "([" + VALID_DIGITS + "]{1,7})";
-
-  /**
-   * Regexp of all possible ways to write extensions, for use when parsing. This
-   * will be run as a case-insensitive regexp match. Wide character versions are
-   * also provided after each ASCII version. There are three regular expressions
-   * here. The first covers RFC 3966 format, where the extension is added using
-   * ';ext='. The second more generic one starts with optional white space and
-   * ends with an optional full stop (.), followed by zero or more spaces/tabs and
-   * then the numbers themselves. The other one covers the special case of
-   * American numbers where the extension is written with a hash at the end, such
-   * as '- 503#'. Note that the only capturing groups should be around the digits
-   * that you want to capture as part of the extension, or else parsing will fail!
-   * We allow two options for representing the accented o - the character itself,
-   * and one in the unicode decomposed form with the combining acute accent.
-   */
-  const EXTN_PATTERNS_FOR_PARSING
-    = ";ext=" + CAPTURING_EXTN_DIGITS + "|" + "[ \u00A0\\t,]*"
-    + "(?:e?xt(?:ensi(?:o\u0301?|\u00F3))?n?|\uFF45?\uFF58\uFF54\uFF4E?|"
-    + "[,x\uFF58#\uFF03~\uFF5E]|int|anexo|\uFF49\uFF4E\uFF54)"
-    + "[:\\.\uFF0E]?[ \u00A0\\t,-]*" + CAPTURING_EXTN_DIGITS + "#?|"
-    + "[- ]+([" + VALID_DIGITS + "]{1,5})#";
-
-  const VALID_ALPHA_PATTERN = new RegExp("[" + VALID_ALPHA + "]", "g");
-  const LEADING_PLUS_CHARS_PATTERN = new RegExp("^[" + PLUS_CHARS + "]+", "g");
-
-  // Bug 845539 - viable phone number in Venezuela.
-  const VENEZUELA_SHORT_NUMBER = "\\*[" + VALID_DIGITS + "]";
-
-  // We append optionally the extension pattern to the end here, as a valid
-  // phone number may have an extension prefix appended, followed by 1 or more
-  // digits.
-  const VALID_PHONE_NUMBER_PATTERN =
-    new RegExp("^" + MIN_LENGTH_PHONE_NUMBER + "$|"
-               + "^" + VENEZUELA_SHORT_NUMBER + "$|"
-               + "^" + VALID_PHONE_NUMBER + "(?:" + EXTN_PATTERNS_FOR_PARSING + ")?$", "i");
+  const VALID_ALPHA_PATTERN = /[a-zA-Z]/g;
+  const LEADING_PLUS_CHARS_PATTERN = /^[+\uFF0B]+/g;
 
   // Format of the string encoded meta data. If the name contains "^" or "$"
   // we will generate a regular expression from the value, with those special
@@ -317,6 +232,10 @@ this.PhoneNumber = (function (dataBase) {
   // Normalize a number by converting unicode numbers and symbols to their
   // ASCII equivalents and removing all non-dialable characters.
   function NormalizeNumber(number) {
+    if (typeof number !== 'string') {
+      return '';
+    }
+
     number = number.replace(UNICODE_DIGITS,
                             function (ch) {
                               return String.fromCharCode(48 + (ch.charCodeAt(0) & 0xf));
@@ -459,21 +378,19 @@ this.PhoneNumber = (function (dataBase) {
     return null;
   }
 
-  function IsViablePhoneNumber(number) {
-    if (number == null || number.length < MIN_LENGTH_FOR_NSN) {
+  function IsPlainPhoneNumber(number) {
+    if (typeof number !== 'string') {
       return false;
     }
 
-    let matchedGroups = number.match(VALID_PHONE_NUMBER_PATTERN);
-    if (matchedGroups && matchedGroups[0].length == number.length) {
-      return true;
-    }
-
-    return false;
+    var length = number.length;
+    var isTooLong = (length > MAX_PHONE_NUMBER_LENGTH);
+    var isEmpty = (length === 0);
+    return !(isTooLong || isEmpty || NON_DIALABLE_CHARS_ONCE.test(number));
   }
 
   return {
-    IsViable: IsViablePhoneNumber,
+    IsPlain: IsPlainPhoneNumber,
     Parse: ParseNumber,
     Normalize: NormalizeNumber
   };
diff --git a/dom/phonenumberutils/PhoneNumberUtils.jsm b/dom/phonenumberutils/PhoneNumberUtils.jsm
index aa3e241e3ed8..17fa18bf09b4 100644
--- a/dom/phonenumberutils/PhoneNumberUtils.jsm
+++ b/dom/phonenumberutils/PhoneNumberUtils.jsm
@@ -86,9 +86,15 @@ this.PhoneNumberUtils = {
     return PhoneNumber.Parse(aNumber, countryName);
   },
 
-  isViablePhoneNumber: function IsViablePhoneNumber(aNumber) {
-    let viable = PhoneNumber.IsViable(aNumber);
-    if (DEBUG) debug("IsViable(" + aNumber + "): " + viable);
-    return viable;
+  isPlainPhoneNumber: function isPlainPhoneNumber(aNumber) {
+    var isPlain = PhoneNumber.IsPlain(aNumber);
+    if (DEBUG) debug("isPlain(" + aNumber + ") " + isPlain);
+    return isPlain;
+  },
+
+  normalize: function Normalize(aNumber) {
+    var normalized = PhoneNumber.Normalize(aNumber);
+    if (DEBUG) debug("normalize(" + aNumber + "): " + normalized);
+    return normalized;
   }
 };
diff --git a/dom/phonenumberutils/tests/test_phonenumber.xul b/dom/phonenumberutils/tests/test_phonenumber.xul
index d9cb78f0ed4a..dc84ea5c4e09 100644
--- a/dom/phonenumberutils/tests/test_phonenumber.xul
+++ b/dom/phonenumberutils/tests/test_phonenumber.xul
@@ -22,12 +22,21 @@
 
 Components.utils.import("resource://gre/modules/PhoneNumber.jsm");
 
-function IsViable(dial, expected) {
-  var result = PhoneNumber.IsViable(dial);
+function IsPlain(dial, expected) {
+  var result = PhoneNumber.IsPlain(dial);
   if (result != expected) {
-    ok(false, dial + " is " + (result ? "" : "not ") + "viable, expects otherwise.");
+    ok(false, dial + " is " + (result ? "" : "not ") + "plain, expects otherwise.");
   } else {
-    ok(true, dial + " is " + (result ? "" : "not ") + "viable as expected.");
+    ok(true, dial + " is " + (result ? "" : "not ") + "plain as expected.");
+  }
+}
+
+function Normalize(dial, expected) {
+  var result = PhoneNumber.Normalize(dial);
+  if (result !== expected) {
+    ok(false, "normalized " + dial + " to " + result + ", expected " + expected + " instead.");
+  } else {
+    ok(true, "normalized " + dial + " to " + result + " as expected.");
   }
 }
 
@@ -89,42 +98,75 @@ function Format(dial, currentRegion, nationalNumber, region, nationalFormat, int
       result.internationalFormat != internationalFormat) {
     ok(false, "expected: " + nationalFormat + " " + internationalFormat + 
       "got: " + result.nationalFormat + " " + result.internationalFormat);
-    return result;
   }
 }
 
 // Test whether could a string be a phone number.
-IsViable(null, false);
-IsViable("", false);
-IsViable("1", false);
-IsViable("*2", true); // Real number used in Venezuela
-IsViable("*8", true); // Real number used in Venezuela
-IsViable("12", true); // MIN_LENGTH_PHONE_NUMBER
-IsViable("123", true); // MIN_LENGTH_PHONE_NUMBER
-IsViable("1a2", false);
-IsViable("12a", false);
-IsViable("1234", true); // MIN_LENGTH_PHONE_NUMBER
-IsViable("123a", true);
-IsViable("+", false);
-IsViable("+1", false);
-IsViable("+12", false);
-IsViable("+123", true);
-IsViable("()123", true);
-IsViable("(1)23", true);
-IsViable("(12)3", true);
-IsViable("(123)", true);
-IsViable("(123)4", true);
-IsViable("(123)4", true);
-IsViable("123;ext=", false);
-IsViable("123;ext=1", true);
-IsViable("123;ext=1234567", true);
-IsViable("123;ext=12345678", false);
-IsViable("123 ext:1", true);
-IsViable("123 ext:1#", true);
-IsViable("123-1#", true);
-IsViable("123 1#", true);
-IsViable("123 12345#", true);
-IsViable("123 +123456#", false);
+IsPlain(null, false);
+IsPlain("", false);
+IsPlain("1", true);
+IsPlain("*2", true); // Real number used in Venezuela
+IsPlain("*8", true); // Real number used in Venezuela
+IsPlain("12", true);
+IsPlain("123", true);
+IsPlain("1a2", false);
+IsPlain("12a", false);
+IsPlain("1234", true);
+IsPlain("123a", false);
+IsPlain("+", true);
+IsPlain("+1", true);
+IsPlain("+12", true);
+IsPlain("+123", true);
+IsPlain("()123", false);
+IsPlain("(1)23", false);
+IsPlain("(12)3", false);
+IsPlain("(123)", false);
+IsPlain("(123)4", false);
+IsPlain("123;ext=", false);
+IsPlain("123;ext=1", false);
+IsPlain("123;ext=1234567", false);
+IsPlain("123;ext=12345678", false);
+IsPlain("123 ext:1", false);
+IsPlain("123 ext:1#", false);
+IsPlain("123-1#", false);
+IsPlain("123 1#", false);
+IsPlain("123 12345#", false);
+IsPlain("123 +123456#", false);
+IsPlain("#123#", true);
+IsPlain("*#004#", true);
+IsPlain("*30#", true);
+IsPlain("*#06#", true);
+IsPlain("123456789012345678901234567890123456789012345678901", false); // more than 50 characters
+
+// test normalization
+Normalize(null, "");
+Normalize("", "");
+Normalize("1", "1");
+Normalize("*2", "*2"); // Real number used in Venezuela
+Normalize("*8", "*8"); // Real number used in Venezuela
+Normalize("12", "12");
+Normalize("123", "123");
+Normalize("1a2", "122");
+Normalize("12a", "122");
+Normalize("1234", "1234");
+Normalize("123a", "1232");
+Normalize("+", "+");
+Normalize("+1", "+1");
+Normalize("+12", "+12");
+Normalize("+123", "+123");
+Normalize("()123", "123");
+Normalize("(1)23", "123");
+Normalize("(12)3", "123");
+Normalize("(123)", "123");
+Normalize("(123)4", "1234");
+Normalize("123-1#", "1231#");
+Normalize("123 1#", "1231#");
+Normalize("123 12345#", "12312345#");
+Normalize("123 +123456#", "123+123456#");
+Normalize("#123#", "#123#");
+Normalize("*#004#", "*#004#");
+Normalize("*30#", "*30#");
+Normalize("*#06#", "*#06#");
 
 // Test parsing national numbers.
 Parse("033316005", "NZ");
diff --git a/dom/plugins/base/Makefile.in b/dom/plugins/base/Makefile.in
index 4db75ae1870d..1126d7a48399 100644
--- a/dom/plugins/base/Makefile.in
+++ b/dom/plugins/base/Makefile.in
@@ -30,7 +30,6 @@ EXPORTS = \
   nsPluginsCID.h \
   nsNPAPIPluginInstance.h \
   nsPluginsDir.h \
-  nsPluginSafety.h \
   nsPluginTags.h \
   nsPluginDirServiceProvider.h \
   nsPluginHost.h \
diff --git a/dom/plugins/base/PluginPRLibrary.cpp b/dom/plugins/base/PluginPRLibrary.cpp
index b7df877b7cdd..964082fe65a2 100644
--- a/dom/plugins/base/PluginPRLibrary.cpp
+++ b/dom/plugins/base/PluginPRLibrary.cpp
@@ -5,7 +5,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/PluginPRLibrary.h"
-#include "nsPluginSafety.h"
+
 // Some plugins on Windows, notably Quake Live, implement NP_Initialize using
 // cdecl instead of the documented stdcall. In order to work around this,
 // we force the caller to use a frame pointer.
diff --git a/dom/plugins/base/nsNPAPIPlugin.cpp b/dom/plugins/base/nsNPAPIPlugin.cpp
index 7ee01f0195a1..f2ec77f61170 100644
--- a/dom/plugins/base/nsNPAPIPlugin.cpp
+++ b/dom/plugins/base/nsNPAPIPlugin.cpp
@@ -25,7 +25,6 @@
 #include "nsPluginInstanceOwner.h"
 
 #include "nsPluginsDir.h"
-#include "nsPluginSafety.h"
 #include "nsPluginLogging.h"
 
 #include "nsIJSContextStack.h"
diff --git a/dom/plugins/base/nsNPAPIPluginInstance.cpp b/dom/plugins/base/nsNPAPIPluginInstance.cpp
index d25c89ea5bd4..3c63abfb3dd6 100644
--- a/dom/plugins/base/nsNPAPIPluginInstance.cpp
+++ b/dom/plugins/base/nsNPAPIPluginInstance.cpp
@@ -19,7 +19,6 @@
 #include "nsNPAPIPlugin.h"
 #include "nsNPAPIPluginStreamListener.h"
 #include "nsPluginHost.h"
-#include "nsPluginSafety.h"
 #include "nsPluginLogging.h"
 #include "nsContentUtils.h"
 #include "nsPluginInstanceOwner.h"
diff --git a/dom/plugins/base/nsNPAPIPluginInstance.h b/dom/plugins/base/nsNPAPIPluginInstance.h
index 5586dd4f8afd..e15af31b5732 100644
--- a/dom/plugins/base/nsNPAPIPluginInstance.h
+++ b/dom/plugins/base/nsNPAPIPluginInstance.h
@@ -15,11 +15,13 @@
 #include "nsIChannel.h"
 #include "nsInterfaceHashtable.h"
 #include "nsHashKeys.h"
+#include <prinrval.h>
 #ifdef MOZ_WIDGET_ANDROID
 #include "nsAutoPtr.h"
 #include "nsIRunnable.h"
 #include "GLContext.h"
 #include "nsSurfaceTexture.h"
+#include "AndroidBridge.h"
 #include <map>
 class PluginEventRunnable;
 class SharedPluginTexture;
@@ -401,4 +403,31 @@ private:
   static uint32_t gInUnsafePluginCalls;
 };
 
+// On Android, we need to guard against plugin code leaking entries in the local
+// JNI ref table. See https://bugzilla.mozilla.org/show_bug.cgi?id=780831#c21
+#ifdef MOZ_WIDGET_ANDROID
+  #define MAIN_THREAD_JNI_REF_GUARD mozilla::AutoLocalJNIFrame jniFrame
+#else
+  #define MAIN_THREAD_JNI_REF_GUARD
+#endif
+
+PRIntervalTime NS_NotifyBeginPluginCall(NSPluginCallReentry aReentryState);
+void NS_NotifyPluginCall(PRIntervalTime aTime, NSPluginCallReentry aReentryState);
+
+#define NS_TRY_SAFE_CALL_RETURN(ret, fun, pluginInst, pluginCallReentry) \
+PR_BEGIN_MACRO                                     \
+  MAIN_THREAD_JNI_REF_GUARD;                       \
+  PRIntervalTime startTime = NS_NotifyBeginPluginCall(pluginCallReentry); \
+  ret = fun;                                       \
+  NS_NotifyPluginCall(startTime, pluginCallReentry); \
+PR_END_MACRO
+
+#define NS_TRY_SAFE_CALL_VOID(fun, pluginInst, pluginCallReentry) \
+PR_BEGIN_MACRO                                     \
+  MAIN_THREAD_JNI_REF_GUARD;                       \
+  PRIntervalTime startTime = NS_NotifyBeginPluginCall(pluginCallReentry); \
+  fun;                                             \
+  NS_NotifyPluginCall(startTime, pluginCallReentry); \
+PR_END_MACRO
+
 #endif // nsNPAPIPluginInstance_h_
diff --git a/dom/plugins/base/nsNPAPIPluginStreamListener.cpp b/dom/plugins/base/nsNPAPIPluginStreamListener.cpp
index cd06aaeadea5..c87d8b4a40e6 100644
--- a/dom/plugins/base/nsNPAPIPluginStreamListener.cpp
+++ b/dom/plugins/base/nsNPAPIPluginStreamListener.cpp
@@ -12,7 +12,6 @@
 #include "nsNetUtil.h"
 #include "nsPluginHost.h"
 #include "nsNPAPIPlugin.h"
-#include "nsPluginSafety.h"
 #include "nsPluginLogging.h"
 #include "nsPluginStreamListenerPeer.h"
 
diff --git a/dom/plugins/base/nsPluginHost.cpp b/dom/plugins/base/nsPluginHost.cpp
index 2d5bb600fe09..44bf2c8ecb76 100644
--- a/dom/plugins/base/nsPluginHost.cpp
+++ b/dom/plugins/base/nsPluginHost.cpp
@@ -89,8 +89,6 @@
 #include "nsCExternalHandlerService.h"
 #include "nsIFileChannel.h"
 
-#include "nsPluginSafety.h"
-
 #include "nsICharsetConverterManager.h"
 #include "nsIPlatformCharset.h"
 
diff --git a/dom/plugins/base/nsPluginNativeWindowOS2.cpp b/dom/plugins/base/nsPluginNativeWindowOS2.cpp
index 404f3c9f2b7e..de6c9bfef33a 100644
--- a/dom/plugins/base/nsPluginNativeWindowOS2.cpp
+++ b/dom/plugins/base/nsPluginNativeWindowOS2.cpp
@@ -10,7 +10,6 @@
 
 #include "nsDebug.h"
 #include "nsGUIEvent.h"
-#include "nsPluginSafety.h"
 #include "nsPluginNativeWindow.h"
 #include "nsThreadUtils.h"
 #include "nsAutoPtr.h"
diff --git a/dom/plugins/base/nsPluginNativeWindowWin.cpp b/dom/plugins/base/nsPluginNativeWindowWin.cpp
index e5d67c3a2bb5..ec83e54c1004 100644
--- a/dom/plugins/base/nsPluginNativeWindowWin.cpp
+++ b/dom/plugins/base/nsPluginNativeWindowWin.cpp
@@ -19,7 +19,6 @@
 
 #include "nsGUIEvent.h"
 #include "nsWindowsDllInterceptor.h"
-#include "nsPluginSafety.h"
 #include "nsPluginNativeWindow.h"
 #include "nsThreadUtils.h"
 #include "nsAutoPtr.h"
diff --git a/dom/plugins/base/nsPluginSafety.h b/dom/plugins/base/nsPluginSafety.h
deleted file mode 100644
index c0d11d074092..000000000000
--- a/dom/plugins/base/nsPluginSafety.h
+++ /dev/null
@@ -1,42 +0,0 @@
-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef nsPluginSafety_h_
-#define nsPluginSafety_h_
-
-#include <prinrval.h>
-
-enum NSPluginCallReentry;
-
-// On Android, we need to guard against plugin code leaking entries in the local
-// JNI ref table. See https://bugzilla.mozilla.org/show_bug.cgi?id=780831#c21
-#ifdef MOZ_WIDGET_ANDROID
-  #include "AndroidBridge.h"
-
-  #define MAIN_THREAD_JNI_REF_GUARD mozilla::AutoLocalJNIFrame jniFrame
-#else
-  #define MAIN_THREAD_JNI_REF_GUARD
-#endif
-
-PRIntervalTime NS_NotifyBeginPluginCall(NSPluginCallReentry aReentryState);
-void NS_NotifyPluginCall(PRIntervalTime aTime, NSPluginCallReentry aReentryState);
-
-#define NS_TRY_SAFE_CALL_RETURN(ret, fun, pluginInst, pluginCallReentry) \
-PR_BEGIN_MACRO                                     \
-  MAIN_THREAD_JNI_REF_GUARD;                       \
-  PRIntervalTime startTime = NS_NotifyBeginPluginCall(pluginCallReentry); \
-  ret = fun;                                       \
-  NS_NotifyPluginCall(startTime, pluginCallReentry); \
-PR_END_MACRO
-
-#define NS_TRY_SAFE_CALL_VOID(fun, pluginInst, pluginCallReentry) \
-PR_BEGIN_MACRO                                     \
-  MAIN_THREAD_JNI_REF_GUARD;                       \
-  PRIntervalTime startTime = NS_NotifyBeginPluginCall(pluginCallReentry); \
-  fun;                                             \
-  NS_NotifyPluginCall(startTime, pluginCallReentry); \
-PR_END_MACRO
-
-#endif //nsPluginSafety_h_
diff --git a/dom/system/gonk/AudioChannelManager.cpp b/dom/system/gonk/AudioChannelManager.cpp
index eb5a97ee2778..fe8b749e2116 100644
--- a/dom/system/gonk/AudioChannelManager.cpp
+++ b/dom/system/gonk/AudioChannelManager.cpp
@@ -33,9 +33,9 @@ AudioChannelManager::Init(nsPIDOMWindow* aWindow)
 }
 
 JSObject*
-AudioChannelManager::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
+AudioChannelManager::WrapObject(JSContext* aCx, JSObject* aScope)
 {
-  return AudioChannelManagerBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  return AudioChannelManagerBinding::Wrap(aCx, aScope, this);
 }
 
 void
diff --git a/dom/system/gonk/AudioChannelManager.h b/dom/system/gonk/AudioChannelManager.h
index 6616b7de6626..015ea3be8112 100644
--- a/dom/system/gonk/AudioChannelManager.h
+++ b/dom/system/gonk/AudioChannelManager.h
@@ -38,8 +38,7 @@ public:
      return GetOwner();
   }
 
-  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope,
-                               bool* aTriedToWrap);
+  virtual JSObject* WrapObject(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
 
   bool Headphones() const
   {
diff --git a/dom/system/gonk/GonkGPSGeolocationProvider.cpp b/dom/system/gonk/GonkGPSGeolocationProvider.cpp
index f8a96e543dad..c3b99a63cd98 100644
--- a/dom/system/gonk/GonkGPSGeolocationProvider.cpp
+++ b/dom/system/gonk/GonkGPSGeolocationProvider.cpp
@@ -449,8 +449,23 @@ GonkGPSGeolocationProvider::SetReferenceLocation()
     nsCOMPtr<nsIDOMMozMobileICCInfo> iccInfo;
     rilCtx->GetIccInfo(getter_AddRefs(iccInfo));
     if (iccInfo) {
-      iccInfo->GetMcc(&location.u.cellID.mcc);
-      iccInfo->GetMnc(&location.u.cellID.mnc);
+      nsresult result;
+      nsAutoString mcc, mnc;
+
+      iccInfo->GetMcc(mcc);
+      iccInfo->GetMnc(mnc);
+
+      location.u.cellID.mcc = mcc.ToInteger(&result, 10);
+      if (result != NS_OK) {
+        NS_WARNING("Cannot parse mcc to integer");
+        location.u.cellID.mcc = 0;
+      }
+
+      location.u.cellID.mnc = mnc.ToInteger(&result, 10);
+      if (result != NS_OK) {
+        NS_WARNING("Cannot parse mnc to integer");
+        location.u.cellID.mnc = 0;
+      }
     }
     nsCOMPtr<nsIDOMMozMobileConnectionInfo> voice;
     rilCtx->GetVoice(getter_AddRefs(voice));
diff --git a/dom/system/gonk/NetworkManager.js b/dom/system/gonk/NetworkManager.js
index 600b0f4af7eb..350af4c125a9 100644
--- a/dom/system/gonk/NetworkManager.js
+++ b/dom/system/gonk/NetworkManager.js
@@ -70,6 +70,8 @@ const SETTINGS_WIFI_IP                 = "tethering.wifi.ip";
 const SETTINGS_WIFI_PREFIX             = "tethering.wifi.prefix";
 const SETTINGS_WIFI_DHCPSERVER_STARTIP = "tethering.wifi.dhcpserver.startip";
 const SETTINGS_WIFI_DHCPSERVER_ENDIP   = "tethering.wifi.dhcpserver.endip";
+const SETTINGS_WIFI_DNS1               = "tethering.wifi.dns1";
+const SETTINGS_WIFI_DNS2               = "tethering.wifi.dns2";
 
 // Settings DB path for USB tethering.
 const SETTINGS_USB_ENABLED             = "tethering.usb.enabled";
@@ -77,6 +79,26 @@ const SETTINGS_USB_IP                  = "tethering.usb.ip";
 const SETTINGS_USB_PREFIX              = "tethering.usb.prefix";
 const SETTINGS_USB_DHCPSERVER_STARTIP  = "tethering.usb.dhcpserver.startip";
 const SETTINGS_USB_DHCPSERVER_ENDIP    = "tethering.usb.dhcpserver.endip";
+const SETTINGS_USB_DNS1                = "tethering.usb.dns1";
+const SETTINGS_USB_DNS2                = "tethering.usb.dns2";
+
+// Default value for WIFI tethering.
+const DEFAULT_WIFI_IP                  = "192.168.1.1";
+const DEFAULT_WIFI_PREFIX              = "24";
+const DEFAULT_WIFI_DHCPSERVER_STARTIP  = "192.168.1.10";
+const DEFAULT_WIFI_DHCPSERVER_ENDIP    = "192.168.1.30";
+const DEFAULT_WIFI_SSID                = "FirefoxHotspot";
+const DEFAULT_WIFI_SECURITY_TYPE       = "open";
+const DEFAULT_WIFI_SECURITY_PASSWORD   = "1234567890";
+
+// Default value for USB tethering.
+const DEFAULT_USB_IP                   = "192.168.0.1";
+const DEFAULT_USB_PREFIX               = "24";
+const DEFAULT_USB_DHCPSERVER_STARTIP   = "192.168.0.10";
+const DEFAULT_USB_DHCPSERVER_ENDIP     = "192.168.0.30";
+
+const DEFAULT_DNS1                     = "8.8.8.8";
+const DEFAULT_DNS2                     = "8.8.4.4";
 
 const MANUAL_PROXY_CONFIGURATION = 1;
 
@@ -134,8 +156,7 @@ function NetworkManager() {
   this._tetheringInterface[TETHERING_TYPE_WIFI] = {externalInterface: DEFAULT_3G_INTERFACE_NAME,
                                                    internalInterface: DEFAULT_WIFI_INTERFACE_NAME};
 
-  this.tetheringSettings[SETTINGS_WIFI_ENABLED] = false;
-  this.tetheringSettings[SETTINGS_USB_ENABLED] = false;
+  this.initTetheringSettings();
 
   let settingsLock = gSettingsService.createLock();
   // Read wifi tethering data from settings DB.
@@ -146,11 +167,15 @@ function NetworkManager() {
   settingsLock.get(SETTINGS_WIFI_PREFIX, this);
   settingsLock.get(SETTINGS_WIFI_DHCPSERVER_STARTIP, this);
   settingsLock.get(SETTINGS_WIFI_DHCPSERVER_ENDIP, this);
+  settingsLock.get(SETTINGS_WIFI_DNS1, this);
+  settingsLock.get(SETTINGS_WIFI_DNS2, this);
   // Read usb tethering data from settings DB.
   settingsLock.get(SETTINGS_USB_IP, this);
   settingsLock.get(SETTINGS_USB_PREFIX, this);
   settingsLock.get(SETTINGS_USB_DHCPSERVER_STARTIP, this);
   settingsLock.get(SETTINGS_USB_DHCPSERVER_ENDIP, this);
+  settingsLock.get(SETTINGS_USB_DNS1, this);
+  settingsLock.get(SETTINGS_USB_DNS2, this);
 
   this.setAndConfigureActive();
 
@@ -526,6 +551,26 @@ NetworkManager.prototype = {
 
   tetheringSettings: {},
 
+  initTetheringSettings: function initTetheringSettings() {
+    this.tetheringSettings[SETTINGS_WIFI_ENABLED] = false;
+    this.tetheringSettings[SETTINGS_USB_ENABLED] = false;
+    this.tetheringSettings[SETTINGS_WIFI_SSID] = DEFAULT_WIFI_SSID;
+    this.tetheringSettings[SETTINGS_WIFI_SECURITY_TYPE] = DEFAULT_WIFI_SECURITY_TYPE;
+    this.tetheringSettings[SETTINGS_WIFI_SECURITY_PASSWORD] = DEFAULT_WIFI_SECURITY_PASSWORD;
+    this.tetheringSettings[SETTINGS_WIFI_IP] = DEFAULT_WIFI_IP;
+    this.tetheringSettings[SETTINGS_WIFI_PREFIX] = DEFAULT_WIFI_PREFIX;
+    this.tetheringSettings[SETTINGS_WIFI_DHCPSERVER_STARTIP] = DEFAULT_WIFI_DHCPSERVER_STARTIP;
+    this.tetheringSettings[SETTINGS_WIFI_DHCPSERVER_ENDIP] = DEFAULT_WIFI_DHCPSERVER_ENDIP;
+    this.tetheringSettings[SETTINGS_WIFI_DNS1] = DEFAULT_DNS1;
+    this.tetheringSettings[SETTINGS_WIFI_DNS2] = DEFAULT_DNS2;
+    this.tetheringSettings[SETTINGS_USB_IP] = DEFAULT_USB_IP;
+    this.tetheringSettings[SETTINGS_USB_PREFIX] = DEFAULT_USB_PREFIX;
+    this.tetheringSettings[SETTINGS_USB_DHCPSERVER_STARTIP] = DEFAULT_USB_DHCPSERVER_STARTIP;
+    this.tetheringSettings[SETTINGS_USB_DHCPSERVER_ENDIP] = DEFAULT_USB_DHCPSERVER_ENDIP;
+    this.tetheringSettings[SETTINGS_USB_DNS1] = DEFAULT_DNS1;
+    this.tetheringSettings[SETTINGS_USB_DNS2] = DEFAULT_DNS2;
+  },
+
   handle: function handle(aName, aResult) {
     switch(aName) {
       case SETTINGS_USB_ENABLED:
@@ -542,11 +587,17 @@ NetworkManager.prototype = {
       case SETTINGS_WIFI_PREFIX:
       case SETTINGS_WIFI_DHCPSERVER_STARTIP:
       case SETTINGS_WIFI_DHCPSERVER_ENDIP:
+      case SETTINGS_WIFI_DNS1:
+      case SETTINGS_WIFI_DNS2:
       case SETTINGS_USB_IP:
       case SETTINGS_USB_PREFIX:
       case SETTINGS_USB_DHCPSERVER_STARTIP:
       case SETTINGS_USB_DHCPSERVER_ENDIP:
-        this.tetheringSettings[aName] = aResult;
+      case SETTINGS_USB_DNS1:
+      case SETTINGS_USB_DNS2:
+        if (aResult) {
+          this.tetheringSettings[aName] = aResult;
+        }
         debug("'" + aName + "'" + " is now " + this.tetheringSettings[aName]);
         break;
     };
@@ -586,17 +637,9 @@ NetworkManager.prototype = {
       this._tetheringInterface[TETHERING_TYPE_USB].externalInterface = this.active.name
     } else {
       let mobile = this.getNetworkInterface(Ci.nsINetworkInterface.NETWORK_TYPE_MOBILE);
-      if (!mobile) {
-        let params = {
-          enable: enable,
-          resultCode: NETD_COMMAND_ERROR,
-          resultReason: "Mobile interface is not registered"
-        };
-        this.usbTetheringResultReport(params);
-        debug("Can't enable usb tethering - no active network interface.");
-        return;
+      if (mobile) {
+        this._tetheringInterface[TETHERING_TYPE_USB].externalInterface = mobile.name;
       }
-      this._tetheringInterface[TETHERING_TYPE_USB].externalInterface = mobile.name;
     }
     this.tetheringSettings[SETTINGS_USB_ENABLED] = true;
     this.enableUsbRndis(true, this.enableUsbRndisResult);
@@ -610,6 +653,8 @@ NetworkManager.prototype = {
     let prefix;
     let dhcpStartIp;
     let dhcpEndIp;
+    let dns1;
+    let dns2;
     let internalInterface = tetheringinterface.internalInterface;
     let externalInterface = tetheringinterface.externalInterface;
 
@@ -620,6 +665,8 @@ NetworkManager.prototype = {
     prefix = this.tetheringSettings[SETTINGS_WIFI_PREFIX];
     dhcpStartIp = this.tetheringSettings[SETTINGS_WIFI_DHCPSERVER_STARTIP];
     dhcpEndIp = this.tetheringSettings[SETTINGS_WIFI_DHCPSERVER_ENDIP];
+    dns1 = this.tetheringSettings[SETTINGS_WIFI_DNS1];
+    dns2 = this.tetheringSettings[SETTINGS_WIFI_DNS2];
 
     // Check the format to prevent netd from crash.
     if (!ssid || ssid == "") {
@@ -654,8 +701,8 @@ NetworkManager.prototype = {
       prefix: prefix,
       startIp: dhcpStartIp,
       endIp: dhcpEndIp,
-      dns1: "",
-      dns2: "",
+      dns1: dns1,
+      dns2: dns2,
       internalIfname: internalInterface,
       externalIfname: externalInterface,
       enable: enable,
@@ -669,6 +716,8 @@ NetworkManager.prototype = {
     let prefix;
     let dhcpStartIp;
     let dhcpEndIp;
+    let dns1;
+    let dns2;
     let internalInterface = tetheringinterface.internalInterface;
     let externalInterface = tetheringinterface.externalInterface;
 
@@ -676,6 +725,8 @@ NetworkManager.prototype = {
     prefix = this.tetheringSettings[SETTINGS_USB_PREFIX];
     dhcpStartIp = this.tetheringSettings[SETTINGS_USB_DHCPSERVER_STARTIP];
     dhcpEndIp = this.tetheringSettings[SETTINGS_USB_DHCPSERVER_ENDIP];
+    dns1 = this.tetheringSettings[SETTINGS_USB_DNS1];
+    dns2 = this.tetheringSettings[SETTINGS_USB_DNS2];
 
     // Using the default values here until application support these settings.
     if (interfaceIp == "" || prefix == "" ||
@@ -690,8 +741,8 @@ NetworkManager.prototype = {
       prefix: prefix,
       startIp: dhcpStartIp,
       endIp: dhcpEndIp,
-      dns1: "",
-      dns2: "",
+      dns1: dns1,
+      dns2: dns2,
       internalIfname: internalInterface,
       externalIfname: externalInterface,
       enable: enable,
@@ -732,15 +783,13 @@ NetworkManager.prototype = {
     this._tetheringInterface[TETHERING_TYPE_WIFI].internalInterface = network.name;
 
     let mobile = this.getNetworkInterface(Ci.nsINetworkInterface.NETWORK_TYPE_MOBILE);
-    if (!mobile) {
-      this.notifyError(true, callback, "mobile interface is not registered");
-      return;
+    // Update the real interface name
+    if (mobile) {
+      this._tetheringInterface[TETHERING_TYPE_WIFI].externalInterface = mobile.name;
     }
     // Clear this flag to prevent unexpected action.
     this.waitForConnectionReadyCallback = null;
 
-    this._tetheringInterface[TETHERING_TYPE_WIFI].externalInterface = mobile.name;
-
     let params = this.getWifiTetheringParameters(enable, this._tetheringInterface[TETHERING_TYPE_WIFI]);
     if (!params) {
       this.notifyError(true, callback, "invalid parameters");
diff --git a/dom/system/gonk/RILContentHelper.js b/dom/system/gonk/RILContentHelper.js
index 2943b12f5159..231946ae59b9 100644
--- a/dom/system/gonk/RILContentHelper.js
+++ b/dom/system/gonk/RILContentHelper.js
@@ -120,8 +120,8 @@ MobileICCInfo.prototype = {
   // nsIDOMMozMobileICCInfo
 
   iccid: null,
-  mcc: 0,
-  mnc: 0,
+  mcc: null,
+  mnc: null,
   spn: null,
   msisdn: null
 };
@@ -150,7 +150,7 @@ MobileConnectionInfo.prototype = {
   emergencyCallsOnly: false,
   roaming: false,
   network: null,
-  lastKnownMcc: 0,
+  lastKnownMcc: null,
   cell: null,
   type: null,
   signalStrength: null,
@@ -178,8 +178,8 @@ MobileNetworkInfo.prototype = {
 
   shortName: null,
   longName: null,
-  mcc: 0,
-  mnc: 0,
+  mcc: null,
+  mnc: null,
   state: null
 };
 
@@ -455,14 +455,12 @@ RILContentHelper.prototype = {
       throw new Error("Invalid network provided: " + network);
     }
 
-    let mnc = network.mnc;
-    if (!mnc) {
-      throw new Error("Invalid network MNC: " + mnc);
+    if (isNaN(parseInt(network.mnc, 10))) {
+      throw new Error("Invalid network MNC: " + network.mnc);
     }
 
-    let mcc = network.mcc;
-    if (!mcc) {
-      throw new Error("Invalid network MCC: " + mcc);
+    if (isNaN(parseInt(network.mcc, 10))) {
+      throw new Error("Invalid network MCC: " + network.mcc);
     }
 
     let request = Services.DOMRequest.createRequest(window);
@@ -481,8 +479,8 @@ RILContentHelper.prototype = {
 
     cpmm.sendAsyncMessage("RIL:SelectNetwork", {
       requestId: requestId,
-      mnc: mnc,
-      mcc: mcc
+      mnc: network.mnc,
+      mcc: network.mcc
     });
 
     return request;
diff --git a/dom/system/gonk/RadioInterfaceLayer.js b/dom/system/gonk/RadioInterfaceLayer.js
index 458d4e5b22b3..78e365322424 100644
--- a/dom/system/gonk/RadioInterfaceLayer.js
+++ b/dom/system/gonk/RadioInterfaceLayer.js
@@ -236,7 +236,7 @@ function RadioInterfaceLayer() {
                      emergencyCallsOnly: false,
                      roaming: false,
                      network: null,
-                     lastKnownMcc: 0,
+                     lastKnownMcc: null,
                      cell: null,
                      type: null,
                      signalStrength: null,
@@ -245,7 +245,7 @@ function RadioInterfaceLayer() {
                      emergencyCallsOnly: false,
                      roaming: false,
                      network: null,
-                     lastKnownMcc: 0,
+                     lastKnownMcc: null,
                      cell: null,
                      type: null,
                      signalStrength: null,
@@ -253,7 +253,7 @@ function RadioInterfaceLayer() {
   };
 
   try {
-    this.rilContext.voice.lastKnownMcc = Services.prefs.getIntPref("ril.lastKnownMcc");
+    this.rilContext.voice.lastKnownMcc = Services.prefs.getCharPref("ril.lastKnownMcc");
   } catch (e) {}
 
   this.voicemailInfo = {
@@ -1066,7 +1066,7 @@ RadioInterfaceLayer.prototype = {
         // !voice.network is in case voice.network is still null.
         if (!voice.network || voice.network.mcc != message.mcc) {
           try {
-            Services.prefs.setIntPref("ril.lastKnownMcc", message.mcc);
+            Services.prefs.setCharPref("ril.lastKnownMcc", message.mcc);
           } catch (e) {}
         }
       }
@@ -2058,26 +2058,40 @@ RadioInterfaceLayer.prototype = {
     this.worker.postMessage(message);
   },
 
+  _validateNumber: function _validateNumber(number) {
+    // note: isPlainPhoneNumber also accepts USSD and SS numbers
+    if (PhoneNumberUtils.isPlainPhoneNumber(number)) {
+      return true;
+    }
+
+    this.handleCallError({
+      callIndex: -1,
+      error: RIL.RIL_CALL_FAILCAUSE_TO_GECKO_CALL_ERROR[RIL.CALL_FAIL_UNOBTAINABLE_NUMBER]
+    });
+    debug("Number '" + number + "' doesn't seem to be a viable number. Drop.");
+
+    return false;
+  },
+
   dial: function dial(number) {
     debug("Dialing " + number);
-    if (!PhoneNumberUtils.isViablePhoneNumber(number)) {
-      this.handleCallError({
-        callIndex: -1,
-        errorMsg: RIL.RIL_CALL_FAILCAUSE_TO_GECKO_CALL_ERROR[RIL.CALL_FAIL_UNOBTAINABLE_NUMBER]
-      });
-      debug("Number '" + number + "' doesn't seem to be a viable number. Drop.");
-      return;
+    number = PhoneNumberUtils.normalize(number);
+    if (this._validateNumber(number)) {
+      this.worker.postMessage({rilMessageType: "dial",
+                              number: number,
+                              isDialEmergency: false});
     }
-    this.worker.postMessage({rilMessageType: "dial",
-                             number: number,
-                             isDialEmergency: false});
   },
 
   dialEmergency: function dialEmergency(number) {
     debug("Dialing emergency " + number);
-    this.worker.postMessage({rilMessageType: "dial",
-                             number: number,
-                             isDialEmergency: true});
+    // we don't try to be too clever here, as the phone is probably in the
+    // locked state. Let's just check if it's a number without normalizing
+    if (this._validateNumber(number)) {
+      this.worker.postMessage({rilMessageType: "dial",
+                              number: number,
+                              isDialEmergency: true});
+    }
   },
 
   hangUp: function hangUp(callIndex) {
diff --git a/dom/system/gonk/net_worker.js b/dom/system/gonk/net_worker.js
index 0a8cdd8ce0fd..71cadd46340a 100644
--- a/dom/system/gonk/net_worker.js
+++ b/dom/system/gonk/net_worker.js
@@ -550,8 +550,12 @@ function setWifiTethering(params) {
   let enable = params.enable;
   let interfaceProperties = getIFProperties(params.externalIfname);
 
-  params.dns1 = interfaceProperties.dns1_str;
-  params.dns2 = interfaceProperties.dns2_str;
+  if (interfaceProperties.dns1_str) {
+    params.dns1 = interfaceProperties.dns1_str;
+  }
+  if (interfaceProperties.dns2_str) {
+    params.dns2 = interfaceProperties.dns2_str;
+  }
   dumpParams(params, "WIFI");
 
   if (enable) {
@@ -589,8 +593,13 @@ function setUSBTethering(params) {
   let enable = params.enable;
   let interfaceProperties = getIFProperties(params.externalIfname);
 
-  params.dns1 = interfaceProperties.dns1_str;
-  params.dns2 = interfaceProperties.dns2_str;
+  if (interfaceProperties.dns1_str) {
+    params.dns1 = interfaceProperties.dns1_str;
+  }
+  if (interfaceProperties.dns2_str) {
+    params.dns2 = interfaceProperties.dns2_str;
+  }
+
   dumpParams(params, "USB");
 
   if (enable) {
diff --git a/dom/system/gonk/ril_worker.js b/dom/system/gonk/ril_worker.js
index 5954d83379f3..ea296bec7149 100644
--- a/dom/system/gonk/ril_worker.js
+++ b/dom/system/gonk/ril_worker.js
@@ -1555,14 +1555,10 @@ let RIL = {
    */
   selectNetwork: function selectNetwork(options) {
     if (DEBUG) {
-      debug("Setting manual network selection: " + options.mcc + options.mnc);
+      debug("Setting manual network selection: " + options.mcc + ", " + options.mnc);
     }
 
-    // TODO: Bug 828307 - B2G RIL: Change to store MNC/MCC values from integer to string
-    let mnc = options.mnc.toString();
-    if (mnc.length == 1)
-      mnc = "0" + mnc;
-    let numeric = options.mcc.toString() + mnc;
+    let numeric = (options.mcc && options.mnc) ? options.mcc + options.mnc : null;
     Buf.newParcel(REQUEST_SET_NETWORK_SELECTION_MANUAL, options);
     Buf.writeString(numeric);
     Buf.sendParcel();
@@ -3094,14 +3090,14 @@ let RIL = {
     }
 
     let [longName, shortName, networkTuple] = operatorData;
-    let thisTuple = "" + this.operator.mcc + this.operator.mnc;
+    let thisTuple = this.operator.mcc + this.operator.mnc;
 
     if (this.operator.longName !== longName ||
         this.operator.shortName !== shortName ||
         thisTuple !== networkTuple) {
 
-      this.operator.mcc = 0;
-      this.operator.mnc = 0;
+      this.operator.mcc = null;
+      this.operator.mnc = null;
 
       if (networkTuple) {
         try {
@@ -3329,7 +3325,8 @@ let RIL = {
       let network = {
         longName: strings[i],
         shortName: strings[i + 1],
-        mcc: 0, mnc: 0,
+        mcc: null,
+        mnc: null,
         state: null
       };
 
@@ -3361,24 +3358,16 @@ let RIL = {
    */
   _processNetworkTuple: function _processNetworkTuple(networkTuple, network) {
     let tupleLen = networkTuple.length;
-    let mcc = 0, mnc = 0;
 
     if (tupleLen == 5 || tupleLen == 6) {
-      mcc = parseInt(networkTuple.substr(0, 3), 10);
-      if (isNaN(mcc)) {
-        throw new Error("MCC could not be parsed from network tuple: " + networkTuple );
-      }
-
-      mnc = parseInt(networkTuple.substr(3), 10);
-      if (isNaN(mnc)) {
-        throw new Error("MNC could not be parsed from network tuple: " + networkTuple);
-      }
+      network.mcc = networkTuple.substr(0, 3);
+      network.mnc = networkTuple.substr(3);
     } else {
+      network.mcc = null;
+      network.mnc = null;
+
       throw new Error("Invalid network tuple (should be 5 or 6 digits): " + networkTuple);
     }
-
-    network.mcc = mcc;
-    network.mnc = mnc;
   },
 
   /**
@@ -9375,14 +9364,11 @@ let ComprehensionTlvHelper = {
     // shall be coded as '1111'".
 
     // MCC & MNC, 3 octets
-    let mcc = loc.mcc.toString();
-    let mnc = loc.mnc.toString();
-    if (mnc.length == 1) {
-      mnc = "F0" + mnc;
-    } else if (mnc.length == 2) {
-      mnc = "F" + mnc;
+    let mcc = loc.mcc, mnc;
+    if (loc.mnc.length == 2) {
+      mnc = "F" + loc.mnc;
     } else {
-      mnc = mnc[2] + mnc[0] + mnc[1];
+      mnc = loc.mnc[2] + loc.mnc[0] + loc.mnc[1];
     }
     GsmPDUHelper.writeSwappedNibbleBCD(mcc + mnc);
 
@@ -10033,9 +10019,9 @@ let ICCRecordHelper = {
       let imsi = RIL.iccInfoPrivate.imsi;
       if (imsi) {
         // MCC is the first 3 digits of IMSI.
-        RIL.iccInfo.mcc = parseInt(imsi.substr(0,3));
+        RIL.iccInfo.mcc = imsi.substr(0,3);
         // The 4th byte of the response is the length of MNC.
-        RIL.iccInfo.mnc = parseInt(imsi.substr(3, ad[3]));
+        RIL.iccInfo.mnc = imsi.substr(3, ad[3]);
         if (DEBUG) debug("MCC: " + RIL.iccInfo.mcc + " MNC: " + RIL.iccInfo.mnc);
         ICCUtilsHelper.handleICCInfoChange();
       }
@@ -10633,11 +10619,11 @@ let ICCRecordHelper = {
           }
           if (i === 2) {
             // 0-2: MCC
-            oplElement.mcc = parseInt(buf);
+            oplElement.mcc = buf;
             buf = "";
           } else if (i === 5) {
             // 3-5: MNC
-            oplElement.mnc = parseInt(buf);
+            oplElement.mnc = buf;
           }
         }
         // LAC/TAC
@@ -10829,11 +10815,11 @@ let ICCRecordHelper = {
             }
             if (i === 2) {
               // 0-2: MCC
-              plmnEntry.mcc = parseInt(buf);
+              plmnEntry.mcc = buf;
               buf = "";
             } else if (i === 5) {
               // 3-5: MNC
-              plmnEntry.mnc = parseInt(buf);
+              plmnEntry.mnc = buf;
             }
           }
           if (DEBUG) debug("readPLMNEntries: PLMN = " + plmnEntry.mcc + ", " + plmnEntry.mnc);
diff --git a/dom/system/gonk/tests/test_ril_worker_icc.js b/dom/system/gonk/tests/test_ril_worker_icc.js
index 49c95f4738a2..bbf58c630c67 100644
--- a/dom/system/gonk/tests/test_ril_worker_icc.js
+++ b/dom/system/gonk/tests/test_ril_worker_icc.js
@@ -554,8 +554,8 @@ add_test(function test_write_location_info_tlv() {
 
   // Test with 2-digit mnc, and gsmCellId obtained from UMTS network.
   let loc = {
-    mcc: 466,
-    mnc: 92,
+    mcc: "466",
+    mnc: "92",
     gsmLocationAreaCode : 10291,
     gsmCellId: 19072823
   };
@@ -582,8 +582,8 @@ add_test(function test_write_location_info_tlv() {
 
   // Test with 1-digit mnc, and gsmCellId obtained from GSM network.
   loc = {
-    mcc: 466,
-    mnc: 2,
+    mcc: "466",
+    mnc: "02",
     gsmLocationAreaCode : 10291,
     gsmCellId: 65534
   };
@@ -607,8 +607,8 @@ add_test(function test_write_location_info_tlv() {
 
   // Test with 3-digit mnc, and gsmCellId obtained from GSM network.
   loc = {
-    mcc: 466,
-    mnc: 222,
+    mcc: "466",
+    mnc: "222",
     gsmLocationAreaCode : 10291,
     gsmCellId: 65534
   };
@@ -1538,8 +1538,8 @@ add_test(function test_stk_event_download_location_status() {
     eventType: STK_EVENT_TYPE_LOCATION_STATUS,
     locationStatus: STK_SERVICE_STATE_NORMAL,
     locationInfo: {
-      mcc: 123,
-      mnc: 456,
+      mcc: "123",
+      mnc: "456",
       gsmLocationAreaCode: 0,
       gsmCellId: 0
     }
diff --git a/dom/webidl/AudioListener.webidl b/dom/webidl/AudioListener.webidl
index 6222b14c2bac..45fe4b23d52e 100644
--- a/dom/webidl/AudioListener.webidl
+++ b/dom/webidl/AudioListener.webidl
@@ -14,15 +14,15 @@
 interface AudioListener {
 
     // same as OpenAL (default 1) 
-    attribute float dopplerFactor;
+    attribute double dopplerFactor;
 
     // in meters / second (default 343.3) 
-    attribute float speedOfSound;
+    attribute double speedOfSound;
 
     // Uses a 3D cartesian coordinate system 
-    void setPosition(float x, float y, float z);
-    void setOrientation(float x, float y, float z, float xUp, float yUp, float zUp);
-    void setVelocity(float x, float y, float z);
+    void setPosition(double x, double y, double z);
+    void setOrientation(double x, double y, double z, double xUp, double yUp, double zUp);
+    void setVelocity(double x, double y, double z);
 
 };
 
diff --git a/dom/webidl/Document.webidl b/dom/webidl/Document.webidl
index 796db0018434..77659f5bd097 100644
--- a/dom/webidl/Document.webidl
+++ b/dom/webidl/Document.webidl
@@ -17,7 +17,6 @@
 
 interface Attr;
 interface Comment;
-interface Range;
 interface StyleSheetList;
 interface Touch;
 interface TouchList;
diff --git a/dom/webidl/Event.webidl b/dom/webidl/Event.webidl
index 654b3525e9b5..928bf19fb140 100644
--- a/dom/webidl/Event.webidl
+++ b/dom/webidl/Event.webidl
@@ -78,6 +78,7 @@ partial interface Event {
 
   readonly attribute EventTarget? originalTarget;
   readonly attribute EventTarget? explicitOriginalTarget;
+  [ChromeOnly] readonly attribute boolean multipleActionsPrevented;
 
   void preventBubble();
   void preventCapture();
diff --git a/dom/webidl/HTMLObjectElement.webidl b/dom/webidl/HTMLObjectElement.webidl
index a6103112be1c..5f080eeb9f69 100644
--- a/dom/webidl/HTMLObjectElement.webidl
+++ b/dom/webidl/HTMLObjectElement.webidl
@@ -179,6 +179,13 @@ interface MozObjectLoadingContent {
   [ChromeOnly]
   readonly attribute unsigned long pluginFallbackType;
 
+  /**
+   * If this object currently owns a running plugin, regardless of whether or
+   * not one is pending spawn/despawn.
+   */
+  [ChromeOnly]
+  readonly attribute boolean hasRunningPlugin;
+
   /**
    * This method will disable the play-preview plugin state.
    */
diff --git a/dom/webidl/PannerNode.webidl b/dom/webidl/PannerNode.webidl
index 848a848331b7..992076de8432 100644
--- a/dom/webidl/PannerNode.webidl
+++ b/dom/webidl/PannerNode.webidl
@@ -10,39 +10,39 @@
  * liability, trademark and document use rules apply.
  */
 
+enum PanningModelType {
+  "equalpower",
+  "HRTF",
+  "soundfield"
+};
+
+enum DistanceModelType {
+  "linear",
+  "inverse",
+  "exponential"
+};
+
 [PrefControlled]
 interface PannerNode : AudioNode {
 
-    // Panning model 
-    const unsigned short EQUALPOWER = 0;
-    const unsigned short HRTF = 1;
-    const unsigned short SOUNDFIELD = 2;
-
-    // Distance model 
-    const unsigned short LINEAR_DISTANCE = 0;
-    const unsigned short INVERSE_DISTANCE = 1;
-    const unsigned short EXPONENTIAL_DISTANCE = 2;
-
     // Default for stereo is HRTF 
-    [SetterThrows]
-    attribute unsigned short panningModel;
+    attribute PanningModelType panningModel;
 
     // Uses a 3D cartesian coordinate system 
-    void setPosition(float x, float y, float z);
-    void setOrientation(float x, float y, float z);
-    void setVelocity(float x, float y, float z);
+    void setPosition(double x, double y, double z);
+    void setOrientation(double x, double y, double z);
+    void setVelocity(double x, double y, double z);
 
     // Distance model and attributes 
-    [SetterThrows]
-    attribute unsigned short distanceModel;
-    attribute float refDistance;
-    attribute float maxDistance;
-    attribute float rolloffFactor;
+    attribute DistanceModelType distanceModel;
+    attribute double refDistance;
+    attribute double maxDistance;
+    attribute double rolloffFactor;
 
     // Directional sound cone 
-    attribute float coneInnerAngle;
-    attribute float coneOuterAngle;
-    attribute float coneOuterGain;
+    attribute double coneInnerAngle;
+    attribute double coneOuterAngle;
+    attribute double coneOuterGain;
 
 };
 
diff --git a/dom/webidl/Range.webidl b/dom/webidl/Range.webidl
index 9df9468117ad..6db93d70aca0 100644
--- a/dom/webidl/Range.webidl
+++ b/dom/webidl/Range.webidl
@@ -4,49 +4,87 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/.
  *
  * The origin of this IDL file is
- * http://www.w3.org/TR/2012/WD-dom-20120105/
+ * http://dom.spec.whatwg.org/#range
+ * http://domparsing.spec.whatwg.org/#dom-range-createcontextualfragment
+ * http://dvcs.w3.org/hg/csswg/raw-file/tip/cssom-view/Overview.html#extensions-to-the-range-interface
  *
  * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
  * liability, trademark and document use rules apply.
  */
 
+interface ClientRect;
+
 interface Range {
+  [Throws]
   readonly attribute Node startContainer;
+  [Throws]
   readonly attribute unsigned long startOffset;
+  [Throws]
   readonly attribute Node endContainer;
+  [Throws]
   readonly attribute unsigned long endOffset;
   readonly attribute boolean collapsed;
+  [Throws]
   readonly attribute Node commonAncestorContainer;
 
+  [Throws]
   void setStart(Node refNode, unsigned long offset);
+  [Throws]
   void setEnd(Node refNode, unsigned long offset);
+  [Throws]
   void setStartBefore(Node refNode);
+  [Throws]
   void setStartAfter(Node refNode);
+  [Throws]
   void setEndBefore(Node refNode);
+  [Throws]
   void setEndAfter(Node refNode);
   void collapse(boolean toStart);
+  [Throws]
   void selectNode(Node refNode);
+  [Throws]
   void selectNodeContents(Node refNode);
 
   const unsigned short START_TO_START = 0;
   const unsigned short START_TO_END = 1;
   const unsigned short END_TO_END = 2;
   const unsigned short END_TO_START = 3;
+  [Throws]
   short compareBoundaryPoints(unsigned short how, Range sourceRange);
-
+  [Throws]
   void deleteContents();
+  [Throws]
   DocumentFragment extractContents();
+  [Throws]
   DocumentFragment cloneContents();
+  [Throws]
   void insertNode(Node node);
+  [Throws]
   void surroundContents(Node newParent);
 
   Range cloneRange();
   void detach();
 
+  [Throws]
   boolean isPointInRange(Node node, unsigned long offset);
+  [Throws]
   short comparePoint(Node node, unsigned long offset);
 
+  [Throws]
   boolean intersectsNode(Node node);
 
   stringifier;
 };
+
+// http://domparsing.spec.whatwg.org/#dom-range-createcontextualfragment
+partial interface Range {
+  [Throws]
+  DocumentFragment createContextualFragment(DOMString fragment);
+};
+
+// http://dvcs.w3.org/hg/csswg/raw-file/tip/cssom-view/Overview.html#extensions-to-the-range-interface
+partial interface Range {
+  [Throws]
+  ClientRectList getClientRects();
+  ClientRect getBoundingClientRect();
+};
diff --git a/dom/webidl/WebIDL.mk b/dom/webidl/WebIDL.mk
index 5a92ae3eb51f..1ee2ddad7712 100644
--- a/dom/webidl/WebIDL.mk
+++ b/dom/webidl/WebIDL.mk
@@ -133,6 +133,7 @@ webidl_files = \
   PerformanceNavigation.webidl \
   PerformanceTiming.webidl \
   ProcessingInstruction.webidl \
+  Range.webidl \
   Rect.webidl \
   RGBColor.webidl \
   RTCConfiguration.webidl \
diff --git a/editor/libeditor/base/IMETextTxn.cpp b/editor/libeditor/base/IMETextTxn.cpp
index d229c0d45192..b8398233c920 100644
--- a/editor/libeditor/base/IMETextTxn.cpp
+++ b/editor/libeditor/base/IMETextTxn.cpp
@@ -314,8 +314,13 @@ NS_IMETHODIMP IMETextTxn::CollapseTextSelection(void)
              if(NS_FAILED(result))
                 break;
 
-             nsRefPtr<nsRange> newRange = new nsRange();
-             result = newRange->SetStart(mElement,mOffset+selectionStart);
+             nsCOMPtr<nsIContent> content = do_QueryInterface(mElement);
+             if (!content) {
+               break;
+          }
+
+             nsRefPtr<nsRange> newRange = new nsRange(content);
+             result = newRange->SetStart(content, mOffset+selectionStart);
              NS_ASSERTION(NS_SUCCEEDED(result), "Cannot SetStart");
              if(NS_FAILED(result))
                 break;
diff --git a/editor/libeditor/html/nsHTMLEditRules.cpp b/editor/libeditor/html/nsHTMLEditRules.cpp
index 34916260fca2..295d1061a4fd 100644
--- a/editor/libeditor/html/nsHTMLEditRules.cpp
+++ b/editor/libeditor/html/nsHTMLEditRules.cpp
@@ -247,20 +247,26 @@ nsHTMLEditRules::Init(nsPlaintextEditor *aEditor)
   mReturnInEmptyLIKillsList = !returnInEmptyLIKillsList.EqualsLiteral("false");
 
   // make a utility range for use by the listenter
-  mUtilRange = new nsRange();
+  nsCOMPtr<nsINode> node = mHTMLEditor->GetRoot();
+  if (!node) {
+    node = mHTMLEditor->GetDocument();
+  }
+
+  NS_ENSURE_STATE(node);
+
+  mUtilRange = new nsRange(node);
    
   // set up mDocChangeRange to be whole doc
-  nsCOMPtr<nsIDOMElement> rootElem = do_QueryInterface(mHTMLEditor->GetRoot());
-  if (rootElem)
-  {
-    // temporarily turn off rules sniffing
-    nsAutoLockRulesSniffing lockIt((nsTextEditRules*)this);
-    if (!mDocChangeRange)
-    {
-      mDocChangeRange = new nsRange();
-    }
-    mDocChangeRange->SelectNode(rootElem);
-    res = AdjustSpecialBreaks();
+  // temporarily turn off rules sniffing
+  nsAutoLockRulesSniffing lockIt((nsTextEditRules*)this);
+  if (!mDocChangeRange) {
+    mDocChangeRange = new nsRange(node);
+  }
+
+  if (node->IsElement()) {
+    ErrorResult rv;
+    mDocChangeRange->SelectNode(*node, rv);
+    res = AdjustSpecialBreaks(node);
     NS_ENSURE_SUCCESS(res, res);
   }
 
@@ -1440,7 +1446,9 @@ nsHTMLEditRules::WillInsertText(EditAction aAction,
     // the correct portion of the document.
     if (!mDocChangeRange)
     {
-      mDocChangeRange = new nsRange();
+      nsCOMPtr<nsINode> node = do_QueryInterface(selNode);
+      NS_ENSURE_STATE(node);
+      mDocChangeRange = new nsRange(node);
     }
     res = mDocChangeRange->SetStart(selNode, selOffset);
     NS_ENSURE_SUCCESS(res, res);
@@ -5069,7 +5077,9 @@ nsHTMLEditRules::ExpandSelectionForDeletion(nsISelection *aSelection)
     bool nodeBefore=false, nodeAfter=false;
     
     // create a range that represents expanded selection
-    nsRefPtr<nsRange> range = new nsRange();
+    nsCOMPtr<nsINode> node = do_QueryInterface(selStartNode);
+    NS_ENSURE_STATE(node);
+    nsRefPtr<nsRange> range = new nsRange(node);
     res = range->SetStart(selStartNode, selStartOffset);
     NS_ENSURE_SUCCESS(res, res);
     res = range->SetEnd(selEndNode, selEndOffset);
@@ -6116,7 +6126,9 @@ nsHTMLEditRules::GetNodesFromPoint(DOMPoint point,
   point.GetPoint(node, offset);
   
   // use it to make a range
-  nsRefPtr<nsRange> range = new nsRange();
+  nsCOMPtr<nsINode> nativeNode = do_QueryInterface(node);
+  NS_ENSURE_STATE(nativeNode);
+  nsRefPtr<nsRange> range = new nsRange(nativeNode);
   res = range->SetStart(node, offset);
   NS_ENSURE_SUCCESS(res, res);
   /* SetStart() will also set the end for this new range
@@ -7296,7 +7308,9 @@ nsHTMLEditRules::PinSelectionToNewBlock(nsISelection *aSelection)
   temp = selNode;
   
   // use ranges and sRangeHelper to compare sel point to new block
-  nsRefPtr<nsRange> range = new nsRange();
+  nsCOMPtr<nsINode> node = do_QueryInterface(selNode);
+  NS_ENSURE_STATE(node);
+  nsRefPtr<nsRange> range = new nsRange(node);
   res = range->SetStart(selNode, selOffset);
   NS_ENSURE_SUCCESS(res, res);
   res = range->SetEnd(selNode, selOffset);
diff --git a/editor/libeditor/html/nsHTMLEditor.cpp b/editor/libeditor/html/nsHTMLEditor.cpp
index 9818737529b5..8da399d96800 100644
--- a/editor/libeditor/html/nsHTMLEditor.cpp
+++ b/editor/libeditor/html/nsHTMLEditor.cpp
@@ -3253,7 +3253,7 @@ nsHTMLEditor::ContentInserted(nsIDocument *aDocument, nsIContent* aContainer,
 
     // Update spellcheck for only the newly-inserted node (bug 743819)
     if (mInlineSpellChecker) {
-      nsRefPtr<nsRange> range = new nsRange();
+      nsRefPtr<nsRange> range = new nsRange(aChild);
       nsresult res = range->Set(aContainer, aIndexInContainer,
                                 aContainer, aIndexInContainer + 1);
       if (NS_SUCCEEDED(res)) {
diff --git a/editor/libeditor/html/nsWSRunObject.cpp b/editor/libeditor/html/nsWSRunObject.cpp
index f42c469bcc67..2e5265c0bf41 100644
--- a/editor/libeditor/html/nsWSRunObject.cpp
+++ b/editor/libeditor/html/nsWSRunObject.cpp
@@ -1484,8 +1484,10 @@ nsWSRunObject::DeleteChars(nsIDOMNode *aStartNode, int32_t aStartOffset,
     {
       if (!range)
       {
-        range = new nsRange();
-        res = range->SetStart(aStartNode, aStartOffset);
+        nsCOMPtr<nsINode> startNode = do_QueryInterface(aStartNode);
+        NS_ENSURE_STATE(startNode);
+        range = new nsRange(startNode);
+        res = range->SetStart(startNode, aStartOffset);
         NS_ENSURE_SUCCESS(res, res);
         res = range->SetEnd(aEndNode, aEndOffset);
         NS_ENSURE_SUCCESS(res, res);
diff --git a/editor/libeditor/html/tests/test_bug629845.html b/editor/libeditor/html/tests/test_bug629845.html
index 49c902b88be9..9eb24f904a60 100644
--- a/editor/libeditor/html/tests/test_bug629845.html
+++ b/editor/libeditor/html/tests/test_bug629845.html
@@ -26,10 +26,12 @@ function command(aName)
 {
   var frame = document.getElementsByTagName('iframe')[0];
 
+  is(frame.contentDocument.designMode, "on", "design mode should be on!");
   var caught = false;
   try {
     frame.contentDocument.execCommand(aName, false, null);
   } catch (e) {
+    ok(false, "exception " + e + " was thrown");
     caught = true;
   }
 
diff --git a/editor/txtsvc/src/nsFilteredContentIterator.cpp b/editor/txtsvc/src/nsFilteredContentIterator.cpp
index 95c9218f5cdb..ed8ab35e955e 100644
--- a/editor/txtsvc/src/nsFilteredContentIterator.cpp
+++ b/editor/txtsvc/src/nsFilteredContentIterator.cpp
@@ -57,13 +57,14 @@ NS_IMPL_CYCLE_COLLECTION_5(nsFilteredContentIterator,
 nsresult
 nsFilteredContentIterator::Init(nsINode* aRoot)
 {
+  NS_ENSURE_ARG_POINTER(aRoot);
   NS_ENSURE_TRUE(mPreIterator, NS_ERROR_FAILURE);
   NS_ENSURE_TRUE(mIterator, NS_ERROR_FAILURE);
   mIsOutOfRange    = false;
   mDirection       = eForward;
   mCurrentIterator = mPreIterator;
 
-  mRange = new nsRange();
+  mRange = new nsRange(aRoot);
   nsCOMPtr<nsIDOMNode> domNode(do_QueryInterface(aRoot));
   if (domNode) {
     mRange->SelectNode(domNode);
diff --git a/editor/txtsvc/src/nsTextServicesDocument.cpp b/editor/txtsvc/src/nsTextServicesDocument.cpp
index a7a636e648f0..343c57e75060 100644
--- a/editor/txtsvc/src/nsTextServicesDocument.cpp
+++ b/editor/txtsvc/src/nsTextServicesDocument.cpp
@@ -2070,7 +2070,10 @@ nsTextServicesDocument::CreateDocumentContentRange(nsIDOMRange **aRange)
   NS_ENSURE_SUCCESS(rv, rv);
   NS_ENSURE_TRUE(node, NS_ERROR_NULL_POINTER);
 
-  nsRefPtr<nsRange> range = new nsRange();
+  nsCOMPtr<nsINode> nativeNode = do_QueryInterface(node);
+  NS_ENSURE_STATE(nativeNode);
+
+  nsRefPtr<nsRange> range = new nsRange(nativeNode);
 
   rv = range->SelectNodeContents(node);
   NS_ENSURE_SUCCESS(rv, rv);
diff --git a/embedding/components/find/src/nsFind.cpp b/embedding/components/find/src/nsFind.cpp
index 47152786c761..0c550ed6bea3 100644
--- a/embedding/components/find/src/nsFind.cpp
+++ b/embedding/components/find/src/nsFind.cpp
@@ -147,6 +147,8 @@ nsresult
 nsFindContentIterator::Init(nsIDOMNode* aStartNode, int32_t aStartOffset,
                             nsIDOMNode* aEndNode, int32_t aEndOffset)
 {
+  NS_ENSURE_ARG_POINTER(aStartNode);
+  NS_ENSURE_ARG_POINTER(aEndNode);
   if (!mOuterIterator) {
     if (mFindBackward) {
       // Use post-order in the reverse case, so we get parents
@@ -274,7 +276,10 @@ nsFindContentIterator::Reset()
   // Note: OK to just set up the outer iterator here; if our range has a native
   // anonymous endpoint we'll end up setting up an inner iterator, and
   // reset the outer one in the process.
-  nsCOMPtr<nsIDOMRange> range = nsFind::CreateRange();
+  nsCOMPtr<nsINode> node = do_QueryInterface(mStartNode);
+  NS_ENSURE_TRUE_VOID(node);
+
+  nsCOMPtr<nsIDOMRange> range = nsFind::CreateRange(node);
   range->SetStart(mStartNode, mStartOffset);
   range->SetEnd(mEndNode, mEndOffset);
   mOuterIterator->Init(range);
@@ -366,10 +371,9 @@ nsFindContentIterator::SetupInnerIterator(nsIContent* aContent)
 
   nsCOMPtr<nsIDOMElement> rootElement;
   editor->GetRootElement(getter_AddRefs(rootElement));
-  nsCOMPtr<nsIContent> rootContent(do_QueryInterface(rootElement));
 
-  nsCOMPtr<nsIDOMRange> innerRange = nsFind::CreateRange();
-  nsCOMPtr<nsIDOMRange> outerRange = nsFind::CreateRange();
+  nsCOMPtr<nsIDOMRange> innerRange = nsFind::CreateRange(aContent);
+  nsCOMPtr<nsIDOMRange> outerRange = nsFind::CreateRange(aContent);
   if (!innerRange || !outerRange) {
     return;
   }
@@ -1141,7 +1145,7 @@ nsFind::Find(const PRUnichar *aPatText, nsIDOMRange* aSearchRange,
         // Make the range:
         nsCOMPtr<nsIDOMNode> startParent;
         nsCOMPtr<nsIDOMNode> endParent;
-        nsCOMPtr<nsIDOMRange> range = CreateRange();
+        nsCOMPtr<nsIDOMRange> range = CreateRange(tc);
         if (range)
         {
           int32_t matchStartOffset, matchEndOffset;
@@ -1255,9 +1259,9 @@ nsFind::Find(const PRUnichar *aPatText, nsIDOMRange* aSearchRange,
 
 /* static */
 already_AddRefed<nsIDOMRange>
-nsFind::CreateRange()
+nsFind::CreateRange(nsINode* aNode)
 {
-  nsRefPtr<nsRange> range = new nsRange();
+  nsRefPtr<nsRange> range = new nsRange(aNode);
   range->SetMaySpanAnonymousSubtrees(true);
   return range.forget();
 }
diff --git a/embedding/components/find/src/nsFind.h b/embedding/components/find/src/nsFind.h
index 3626cc8f2079..8f3f43de73f6 100644
--- a/embedding/components/find/src/nsFind.h
+++ b/embedding/components/find/src/nsFind.h
@@ -35,7 +35,7 @@ public:
   nsFind();
   virtual ~nsFind();
 
-  static already_AddRefed<nsIDOMRange> CreateRange();
+  static already_AddRefed<nsIDOMRange> CreateRange(nsINode* aNode);
 
 protected:
   // Parameters set from the interface:
diff --git a/embedding/components/find/src/nsWebBrowserFind.cpp b/embedding/components/find/src/nsWebBrowserFind.cpp
index 98570050f1b4..d5b6f175d6d6 100644
--- a/embedding/components/find/src/nsWebBrowserFind.cpp
+++ b/embedding/components/find/src/nsWebBrowserFind.cpp
@@ -727,11 +727,11 @@ nsresult nsWebBrowserFind::SearchInFrame(nsIDOMWindow* aWindow,
     GetFrameSelection(aWindow, getter_AddRefs(sel));
     NS_ENSURE_ARG_POINTER(sel);
 
-    nsCOMPtr<nsIDOMRange> searchRange = nsFind::CreateRange();
+    nsCOMPtr<nsIDOMRange> searchRange = nsFind::CreateRange(theDoc);
     NS_ENSURE_ARG_POINTER(searchRange);
-    nsCOMPtr<nsIDOMRange> startPt  = nsFind::CreateRange();
+    nsCOMPtr<nsIDOMRange> startPt  = nsFind::CreateRange(theDoc);
     NS_ENSURE_ARG_POINTER(startPt);
-    nsCOMPtr<nsIDOMRange> endPt  = nsFind::CreateRange();
+    nsCOMPtr<nsIDOMRange> endPt  = nsFind::CreateRange(theDoc);
     NS_ENSURE_ARG_POINTER(endPt);
 
     nsCOMPtr<nsIDOMRange> foundRange;
diff --git a/extensions/spellcheck/src/mozInlineSpellChecker.cpp b/extensions/spellcheck/src/mozInlineSpellChecker.cpp
index 885be2b516c9..c7c88344202a 100644
--- a/extensions/spellcheck/src/mozInlineSpellChecker.cpp
+++ b/extensions/spellcheck/src/mozInlineSpellChecker.cpp
@@ -132,7 +132,10 @@ mozInlineSpellStatus::InitForEditorChange(
   mOp = eOpChange;
 
   // range to check
-  mRange = new nsRange();
+  nsCOMPtr<nsINode> prevNode = do_QueryInterface(aPreviousNode);
+  NS_ENSURE_STATE(prevNode);
+
+  mRange = new nsRange(prevNode);
 
   // ...we need to put the start and end in the correct order
   int16_t cmpResult;
diff --git a/extensions/spellcheck/src/mozInlineSpellWordUtil.cpp b/extensions/spellcheck/src/mozInlineSpellWordUtil.cpp
index cc90e6aea697..a7e73f333e33 100644
--- a/extensions/spellcheck/src/mozInlineSpellWordUtil.cpp
+++ b/extensions/spellcheck/src/mozInlineSpellWordUtil.cpp
@@ -317,10 +317,11 @@ nsresult
 mozInlineSpellWordUtil::MakeRange(NodeOffset aBegin, NodeOffset aEnd,
                                   nsRange** aRange)
 {
+  NS_ENSURE_ARG_POINTER(aBegin.mNode);
   if (!mDOMDocument)
     return NS_ERROR_NOT_INITIALIZED;
 
-  nsRefPtr<nsRange> range = new nsRange();
+  nsRefPtr<nsRange> range = new nsRange(aBegin.mNode);
   nsresult rv = range->Set(aBegin.mNode, aBegin.mOffset,
                            aEnd.mNode, aEnd.mOffset);
   NS_ENSURE_SUCCESS(rv, rv);
diff --git a/gfx/2d/Makefile.in b/gfx/2d/Makefile.in
index d45909a6265a..704bbb2fc839 100644
--- a/gfx/2d/Makefile.in
+++ b/gfx/2d/Makefile.in
@@ -138,6 +138,7 @@ ifdef MOZ_ENABLE_SKIA
 CPPSRCS += \
         ScaledFontWin.cpp \
         $(NULL)
+DEFINES += -DSKIA_IMPLEMENTATION=1 -DGR_IMPLEMENTATION=1
 endif
 endif
 
diff --git a/gfx/gl/GLContextSkia.cpp b/gfx/gl/GLContextSkia.cpp
index 36dfe04505bf..4e357781748b 100644
--- a/gfx/gl/GLContextSkia.cpp
+++ b/gfx/gl/GLContextSkia.cpp
@@ -4,7 +4,6 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "skia/GrGLInterface.h"
-#include "skia/SkString.h"
 
 /* SkPostConfig.h includes windows.h, which includes windef.h
  * which redefines min/max. We don't want that. */
@@ -300,25 +299,25 @@ const GLubyte* glGetString_mozilla(GrGLenum name)
         // Only expose the bare minimum extensions we want to support to ensure a functional Ganesh
         // as GLContext only exposes certain extensions
         static bool extensionsStringBuilt = false;
-        static SkString extensionsString;
+        static char extensionsString[120];
 
         if (!extensionsStringBuilt) {
             if (sGLContext->IsExtensionSupported(GLContext::EXT_texture_format_BGRA8888)) {
-                extensionsString.append("GL_EXT_texture_format_BGRA8888 ");
+                strcpy(extensionsString, "GL_EXT_texture_format_BGRA8888 ");
             }
 
             if (sGLContext->IsExtensionSupported(GLContext::OES_packed_depth_stencil)) {
-                extensionsString.append("GL_OES_packed_depth_stencil ");
+                strcat(extensionsString, "GL_OES_packed_depth_stencil ");
             }
 
             if (sGLContext->IsExtensionSupported(GLContext::EXT_packed_depth_stencil)) {
-                extensionsString.append("GL_EXT_packed_depth_stencil ");
+                strcat(extensionsString, "GL_EXT_packed_depth_stencil ");
             }
 
             extensionsStringBuilt = true;
         }
 
-        return reinterpret_cast<const GLubyte*>(extensionsString.c_str());
+        return reinterpret_cast<const GLubyte*>(extensionsString);
 
     } else if (name == LOCAL_GL_SHADING_LANGUAGE_VERSION) {
         if (sGLContext->IsGLES2()) {
diff --git a/gfx/layers/GonkIOSurfaceImage.cpp b/gfx/layers/GonkIOSurfaceImage.cpp
index c7ea4e369848..a88d2d3817bc 100644
--- a/gfx/layers/GonkIOSurfaceImage.cpp
+++ b/gfx/layers/GonkIOSurfaceImage.cpp
@@ -20,6 +20,7 @@ uint32_t GonkIOSurfaceImage::sColorIdMap[] = {
     HAL_PIXEL_FORMAT_YCbCr_420_P, OMX_COLOR_FormatYUV420Planar,
     HAL_PIXEL_FORMAT_YCbCr_422_P, OMX_COLOR_FormatYUV422Planar,
     HAL_PIXEL_FORMAT_YCbCr_420_SP, OMX_COLOR_FormatYUV420SemiPlanar,
+    HAL_PIXEL_FORMAT_YCrCb_420_SP, -1,
     HAL_PIXEL_FORMAT_YCrCb_420_SP_ADRENO, -1,
     HAL_PIXEL_FORMAT_YV12, OMX_COLOR_FormatYUV420Planar,
     0, 0
@@ -127,6 +128,15 @@ GonkIOSurfaceImage::GetAsSurface()
 
     return imageSurface.forget();
   }
+  else if (format == HAL_PIXEL_FORMAT_YCrCb_420_SP) {
+    uint32_t uvOffset = height * width;
+    ConvertYVU420SPToRGB565(buffer, width,
+                            buffer + uvOffset, width,
+                            imageSurface->Data(),
+                            width, height);
+
+    return imageSurface.forget();
+  }
 
   android::ColorConverter colorConverter((OMX_COLOR_FORMATTYPE)omxFormat,
                                          OMX_COLOR_Format16bitRGB565);
diff --git a/gfx/skia/Makefile.in b/gfx/skia/Makefile.in
index d2af192b540e..fdc19ae7b39c 100644
--- a/gfx/skia/Makefile.in
+++ b/gfx/skia/Makefile.in
@@ -507,6 +507,7 @@ CPPSRCS += \
 	SkFontHost_sandbox_none.cpp \
 	SkTime_win.cpp \
 	$(NULL)
+DEFINES += -DSKIA_IMPLEMENTATION=1 -DGR_IMPLEMENTATION=1
 endif
 
 ifneq (,$(INTEL_ARCHITECTURE))
diff --git a/gfx/skia/patches/0018-Bug-817356-PPC-defines.patch b/gfx/skia/patches/0018-Bug-817356-PPC-defines.patch
new file mode 100644
index 000000000000..d16ec4b3b4bd
--- /dev/null
+++ b/gfx/skia/patches/0018-Bug-817356-PPC-defines.patch
@@ -0,0 +1,14 @@
+Index: gfx/skia/include/core/SkPreConfig.h
+===================================================================
+--- gfx/skia/include/core/SkPreConfig.h	(revision 6724)
++++ gfx/skia/include/core/SkPreConfig.h	(working copy)
+@@ -94,7 +94,8 @@
+ //////////////////////////////////////////////////////////////////////
+ 
+ #if !defined(SK_CPU_BENDIAN) && !defined(SK_CPU_LENDIAN)
+-    #if defined (__ppc__) || defined(__ppc64__)
++    #if defined (__ppc__) || defined(__PPC__) || defined(__ppc64__) \
++        || defined(__PPC64__)
+         #define SK_CPU_BENDIAN
+     #else
+         #define SK_CPU_LENDIAN
diff --git a/gfx/skia/patches/README b/gfx/skia/patches/README
index 81135df9ece0..4515997c8aa3 100644
--- a/gfx/skia/patches/README
+++ b/gfx/skia/patches/README
@@ -7,6 +7,7 @@ See the relevant bugs in bugzilla for information on these patches:
 0004-Bug-777614-Re-apply-bug-719872-Fix-crash-on-Android-.patch
 0005-Bug-777614-Re-apply-bug-687188-Expand-the-gradient-c.patch
 0009-Bug-777614-Re-apply-759683-Handle-compilers-that-don.patch
+0018-Bug-817356-PPC-defines.patch
 0010-Bug-836892-Add-new-blending-modes-to-SkXfermode.patch
 0011-Bug-839347-no-anon-namespace-around-SkNO_RETURN_HINT.patch
 0012-Bug-751418-Add-our-own-GrUserConfig-r-mattwoodrow.patch
diff --git a/image/test/reftest/icon/win/reftest.list b/image/test/reftest/icon/win/reftest.list
index a8467c287ad9..9b1726e6cd53 100644
--- a/image/test/reftest/icon/win/reftest.list
+++ b/image/test/reftest/icon/win/reftest.list
@@ -1,2 +1,2 @@
-skip-if(!winWidget) HTTP == bug415761.sjs bug415761.ico
-skip-if(!winWidget) HTTP == bug415761cleanup.sjs about:blank
+skip-if(!winWidget) skip-if(/^Windows\x20NT\x206\.2/.test(http.oscpu)) HTTP == bug415761.sjs bug415761.ico
+skip-if(!winWidget) skip-if(/^Windows\x20NT\x206\.2/.test(http.oscpu)) HTTP == bug415761cleanup.sjs about:blank
diff --git a/intl/uconv/tests/Makefile.in b/intl/uconv/tests/Makefile.in
index e2933fdec250..b767e438ab80 100644
--- a/intl/uconv/tests/Makefile.in
+++ b/intl/uconv/tests/Makefile.in
@@ -34,6 +34,7 @@ relativesrcdir	= @relativesrcdir@
 
 MOCHITEST_FILES =	\
 		test_bug335816.html \
+		test_bug843434.html \
 		test_long_doc.html \
 		test_singlebyte_overconsumption.html \
 		test_unicode_noncharacterescapes.html \
diff --git a/intl/uconv/tests/test_bug843434.html b/intl/uconv/tests/test_bug843434.html
new file mode 100644
index 000000000000..21d6cef484e9
--- /dev/null
+++ b/intl/uconv/tests/test_bug843434.html
@@ -0,0 +1,27 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=843434
+-->
+<head>
+  <meta http-equiv="Content-type" content="text/html; charset=UTF-8">
+  <title>Test for Bug 843434</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+  <!-- This next 'link' is part of the test, it may cause an assertion. -->
+  <link rel=stylesheet href="data:text/css;charset=ISO-2022-JP,%cc">
+</head>
+<body onload="test()">
+<pre id="test">
+<script class="testbody" type="text/javascript">
+function test()
+{
+  ok(true, "Test for no prior assertion.");
+  SimpleTest.finish();
+}
+SimpleTest.waitForExplicitFinish();
+</script>
+</pre>
+</body>
+</html>
+
diff --git a/intl/uconv/ucvja/nsJapaneseToUnicode.cpp b/intl/uconv/ucvja/nsJapaneseToUnicode.cpp
index f819e905bc88..08eee8b9f294 100644
--- a/intl/uconv/ucvja/nsJapaneseToUnicode.cpp
+++ b/intl/uconv/ucvja/nsJapaneseToUnicode.cpp
@@ -482,7 +482,11 @@ NS_IMETHODIMP nsISO2022JPToUnicodeV2::Convert(
               mLastLegalState = mState;
               mState = mState_ESC;
             } else if(*src & 0x80) {
-              goto error2;
+              if (mErrBehavior == kOnError_Signal)
+                goto error3;
+              if (CHECK_OVERRUN(dest, destEnd, 1))
+                goto error1;
+              *dest++ = UNICODE_REPLACEMENT_CHARACTER;
             } else {
               if (CHECK_OVERRUN(dest, destEnd, 1))
                 goto error1;
@@ -905,7 +909,11 @@ error1:
    *aSrcLen = src - (const unsigned char*)aSrc;
    return NS_OK_UDEC_MOREOUTPUT;
 error2:
-   *aSrcLen = src - (const unsigned char*)aSrc;
    *aDestLen = dest - aDest;
+   *aSrcLen = src - (const unsigned char*)aSrc;
    return NS_ERROR_UNEXPECTED;
+error3:
+   *aDestLen = dest - aDest;
+   *aSrcLen = src - (const unsigned char*)aSrc;
+   return NS_ERROR_ILLEGAL_INPUT;
 }
diff --git a/js/src/frontend/FullParseHandler.h b/js/src/frontend/FullParseHandler.h
index a38be83634ac..807b6337fcb1 100644
--- a/js/src/frontend/FullParseHandler.h
+++ b/js/src/frontend/FullParseHandler.h
@@ -166,6 +166,7 @@ class FullParseHandler
     void setFunctionBox(ParseNode *pn, FunctionBox *funbox) {
         pn->pn_funbox = funbox;
     }
+    inline ParseNode *newLexicalScope(ObjectBox *blockbox);
     bool isOperationWithoutParens(ParseNode *pn, ParseNodeKind kind) {
         return pn->isKind(kind) && !pn->isInParens();
     }
@@ -304,6 +305,20 @@ FullParseHandler::newFunctionDefinition()
     return pn;
 }
 
+inline ParseNode *
+FullParseHandler::newLexicalScope(ObjectBox *blockbox)
+{
+    ParseNode *pn = LexicalScopeNode::create(PNK_LEXICALSCOPE, this);
+    if (!pn)
+        return NULL;
+
+    pn->setOp(JSOP_LEAVEBLOCK);
+    pn->pn_objbox = blockbox;
+    pn->pn_cookie.makeFree();
+    pn->pn_dflags = 0;
+    return pn;
+}
+
 inline void
 FullParseHandler::noteLValue(ParseNode *pn)
 {
diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index bcc89584cc45..e0f4121926bf 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -2340,8 +2340,7 @@ static inline bool
 ForEachLetDef(JSContext *cx, ParseContext<ParseHandler> *pc,
               HandleStaticBlockObject blockObj, Op op)
 {
-    for (Shape::Range r = blockObj->lastProperty()->all(); !r.empty(); r.popFront()) {
-        Shape::Range::AutoRooter rooter(cx, &r);
+    for (Shape::Range<CanGC> r(cx, blockObj->lastProperty()); !r.empty(); r.popFront()) {
         Shape &shape = r.front();
 
         /* Beware the destructuring dummy slots. */
@@ -2873,14 +2872,11 @@ Parser<ParseHandler>::returnOrYield(bool useAssignExpr)
     return pn;
 }
 
-template <>
-ParseNode *
-Parser<FullParseHandler>::pushLexicalScope(HandleStaticBlockObject blockObj, StmtInfoPC *stmt)
+template <typename ParseHandler>
+typename ParseHandler::Node
+Parser<ParseHandler>::pushLexicalScope(HandleStaticBlockObject blockObj, StmtInfoPC *stmt)
 {
     JS_ASSERT(blockObj);
-    ParseNode *pn = LexicalScopeNode::create(PNK_LEXICALSCOPE, &handler);
-    if (!pn)
-        return null();
 
     ObjectBox *blockbox = newObjectBox(blockObj);
     if (!blockbox)
@@ -2890,24 +2886,16 @@ Parser<FullParseHandler>::pushLexicalScope(HandleStaticBlockObject blockObj, Stm
     blockObj->initPrevBlockChainFromParser(pc->blockChain);
     FinishPushBlockScope(pc, stmt, *blockObj.get());
 
-    pn->setOp(JSOP_LEAVEBLOCK);
-    pn->pn_objbox = blockbox;
-    pn->pn_cookie.makeFree();
-    pn->pn_dflags = 0;
+    Node pn = handler.newLexicalScope(blockbox);
+    if (!pn)
+        return null();
+
     if (!GenerateBlockId(pc, stmt->blockid))
         return null();
-    pn->pn_blockid = stmt->blockid;
+    handler.setBlockId(pn, stmt->blockid);
     return pn;
 }
 
-template <>
-SyntaxParseHandler::Node
-Parser<SyntaxParseHandler>::pushLexicalScope(HandleStaticBlockObject blockObj, StmtInfoPC *stmt)
-{
-    setUnknownResult();
-    return SyntaxParseHandler::NodeFailure;
-}
-
 template <typename ParseHandler>
 typename ParseHandler::Node
 Parser<ParseHandler>::pushLexicalScope(StmtInfoPC *stmt)
@@ -2983,7 +2971,7 @@ Parser<ParseHandler>::letBlock(LetContext letContext)
 
     MUST_MATCH_TOKEN(TOK_LP, JSMSG_PAREN_BEFORE_LET);
 
-    Node vars = variables(PNK_LET, blockObj, DontHoistVars);
+    Node vars = variables(PNK_LET, NULL, blockObj, DontHoistVars);
     if (!vars)
         return null();
 
@@ -3095,8 +3083,7 @@ template <>
 SyntaxParseHandler::Node
 Parser<SyntaxParseHandler>::newBindingNode(PropertyName *name, VarContext varContext)
 {
-    setUnknownResult();
-    return SyntaxParseHandler::NodeFailure;
+    return SyntaxParseHandler::NodeGeneric;
 }
 
 template <typename ParseHandler>
@@ -3352,7 +3339,7 @@ Parser<FullParseHandler>::forStatement()
                     blockObj = StaticBlockObject::create(context);
                     if (!blockObj)
                         return null();
-                    pn1 = variables(PNK_LET, blockObj, DontHoistVars);
+                    pn1 = variables(PNK_LET, NULL, blockObj, DontHoistVars);
                 }
             }
 #endif
@@ -3627,9 +3614,107 @@ template <>
 SyntaxParseHandler::Node
 Parser<SyntaxParseHandler>::forStatement()
 {
-    // XXX bug 835587 for statement needs a rewrite for syntax parsing.
-    setUnknownResult();
-    return SyntaxParseHandler::NodeFailure;
+    /*
+     * 'for' statement parsing is fantastically complicated and requires being
+     * able to inspect the parse tree for previous parts of the 'for'. Syntax
+     * parsing of 'for' statements is thus done separately, and only handles
+     * the types of 'for' statements likely to be seen in web content.
+     */
+    JS_ASSERT(tokenStream.isCurrentTokenType(TOK_FOR));
+
+    StmtInfoPC forStmt(context);
+    PushStatementPC(pc, &forStmt, STMT_FOR_LOOP);
+
+    MUST_MATCH_TOKEN(TOK_LP, JSMSG_PAREN_AFTER_FOR);
+
+    /* True if we have 'for (var ...)'. */
+    bool forDecl = false;
+    bool simpleForDecl = true;
+
+    /* Set to 'x' in 'for (x ;... ;...)' or 'for (x in ...)'. */
+    Node lhsNode;
+
+    {
+        TokenKind tt = tokenStream.peekToken(TSF_OPERAND);
+        if (tt == TOK_SEMI) {
+            lhsNode = null();
+        } else {
+            /* Set lhsNode to a var list or an initializing expression. */
+            pc->parsingForInit = true;
+            if (tt == TOK_VAR) {
+                forDecl = true;
+                tokenStream.consumeKnownToken(tt);
+                lhsNode = variables(tt == TOK_VAR ? PNK_VAR : PNK_CONST, &simpleForDecl);
+            }
+#if JS_HAS_BLOCK_SCOPE
+            else if (tt == TOK_CONST || tt == TOK_LET) {
+                setUnknownResult();
+                return null();
+            }
+#endif
+            else {
+                lhsNode = expr();
+            }
+            if (!lhsNode)
+                return null();
+            pc->parsingForInit = false;
+        }
+    }
+
+    /*
+     * We can be sure that it's a for/in loop if there's still an 'in'
+     * keyword here, even if JavaScript recognizes 'in' as an operator,
+     * as we've excluded 'in' from being parsed in RelExpr by setting
+     * pc->parsingForInit.
+     */
+    bool forOf;
+    if (lhsNode && matchInOrOf(&forOf)) {
+        /* Parse the rest of the for/in or for/of head. */
+        forStmt.type = STMT_FOR_IN_LOOP;
+
+        /* Check that the left side of the 'in' or 'of' is valid. */
+        if (!forDecl &&
+            lhsNode != SyntaxParseHandler::NodeName &&
+            lhsNode != SyntaxParseHandler::NodeLValue)
+        {
+            setUnknownResult();
+            return null();
+        }
+
+        if (!simpleForDecl) {
+            setUnknownResult();
+            return null();
+        }
+
+        if (!forDecl && !setAssignmentLhsOps(lhsNode, JSOP_NOP))
+            return null();
+
+        if (!expr())
+            return null();
+    } else {
+        /* Parse the loop condition or null. */
+        MUST_MATCH_TOKEN(TOK_SEMI, JSMSG_SEMI_AFTER_FOR_INIT);
+        if (tokenStream.peekToken(TSF_OPERAND) != TOK_SEMI) {
+            if (!expr())
+                return null();
+        }
+
+        /* Parse the update expression or null. */
+        MUST_MATCH_TOKEN(TOK_SEMI, JSMSG_SEMI_AFTER_FOR_COND);
+        if (tokenStream.peekToken(TSF_OPERAND) != TOK_RP) {
+            if (!expr())
+                return null();
+        }
+    }
+
+    MUST_MATCH_TOKEN(TOK_RP, JSMSG_PAREN_AFTER_FOR_CTRL);
+
+    /* Parse the loop body. */
+    if (!statement())
+        return null();
+
+    PopStatementPC(context, pc);
+    return SyntaxParseHandler::NodeGeneric;
 }
 
 template <typename ParseHandler>
@@ -3964,7 +4049,7 @@ Parser<FullParseHandler>::letStatement()
             pc->blockNode = pn1;
         }
 
-        pn = variables(PNK_LET, pc->blockChain, HoistVars);
+        pn = variables(PNK_LET, NULL, pc->blockChain, HoistVars);
         if (!pn)
             return null();
         pn->pn_xflags = PNX_POPVAR;
@@ -4331,7 +4416,8 @@ Parser<ParseHandler>::statement()
  */
 template <typename ParseHandler>
 typename ParseHandler::Node
-Parser<ParseHandler>::variables(ParseNodeKind kind, StaticBlockObject *blockObj, VarContext varContext)
+Parser<ParseHandler>::variables(ParseNodeKind kind, bool *psimple,
+                                StaticBlockObject *blockObj, VarContext varContext)
 {
     /*
      * The four options here are:
@@ -4342,6 +4428,12 @@ Parser<ParseHandler>::variables(ParseNodeKind kind, StaticBlockObject *blockObj,
      */
     JS_ASSERT(kind == PNK_VAR || kind == PNK_CONST || kind == PNK_LET || kind == PNK_CALL);
 
+    /*
+     * The simple flag is set if the declaration has the form 'var x', with
+     * only one variable declared and no initializer expression.
+     */
+    JS_ASSERT_IF(psimple, *psimple);
+
     JSOp op = blockObj ? JSOP_NOP : kind == PNK_VAR ? JSOP_DEFVAR : JSOP_DEFCONST;
 
     Node pn = handler.newList(kind, null(), op);
@@ -4359,11 +4451,19 @@ Parser<ParseHandler>::variables(ParseNodeKind kind, StaticBlockObject *blockObj,
     else
         data.initVarOrConst(op);
 
+    bool first = true;
     Node pn2;
     do {
+        if (psimple && !first)
+            *psimple = false;
+        first = false;
+
         TokenKind tt = tokenStream.getToken();
 #if JS_HAS_DESTRUCTURING
         if (tt == TOK_LB || tt == TOK_LC) {
+            if (psimple)
+                *psimple = false;
+
             pc->inDeclDestructuring = true;
             pn2 = primaryExpr(tt);
             pc->inDeclDestructuring = false;
@@ -4414,6 +4514,9 @@ Parser<ParseHandler>::variables(ParseNodeKind kind, StaticBlockObject *blockObj,
         if (tokenStream.matchToken(TOK_ASSIGN)) {
             JS_ASSERT(tokenStream.currentToken().t_op == JSOP_NOP);
 
+            if (psimple)
+                *psimple = false;
+
             Node init = assignExpr();
             if (!init)
                 return null();
diff --git a/js/src/frontend/Parser.h b/js/src/frontend/Parser.h
index 89b1b51a19e6..431cccff28b3 100644
--- a/js/src/frontend/Parser.h
+++ b/js/src/frontend/Parser.h
@@ -402,7 +402,8 @@ struct Parser : private AutoGCRooter, public StrictModeGetter
     Node letStatement();
 #endif
     Node expressionStatement();
-    Node variables(ParseNodeKind kind, StaticBlockObject *blockObj = NULL,
+    Node variables(ParseNodeKind kind, bool *psimple = NULL,
+                   StaticBlockObject *blockObj = NULL,
                    VarContext varContext = HoistVars);
     Node expr();
     Node assignExpr();
@@ -527,14 +528,24 @@ struct Parser : private AutoGCRooter, public StrictModeGetter
     friend struct BindData<ParseHandler>;
 };
 
+/* Declare some required template specializations. */
+
 template <>
 ParseNode *
 Parser<FullParseHandler>::expr();
 
+template <>
+SyntaxParseHandler::Node
+Parser<SyntaxParseHandler>::expr();
+
 template <>
 bool
 Parser<FullParseHandler>::setAssignmentLhsOps(ParseNode *pn, JSOp op);
 
+template <>
+bool
+Parser<SyntaxParseHandler>::setAssignmentLhsOps(Node pn, JSOp op);
+
 } /* namespace frontend */
 } /* namespace js */
 
diff --git a/js/src/frontend/SyntaxParseHandler.h b/js/src/frontend/SyntaxParseHandler.h
index ab70bba7ecdd..22453632a14f 100644
--- a/js/src/frontend/SyntaxParseHandler.h
+++ b/js/src/frontend/SyntaxParseHandler.h
@@ -101,6 +101,7 @@ class SyntaxParseHandler
     Node newFunctionDefinition() { return NodeGeneric; }
     void setFunctionBody(Node pn, Node kid) {}
     void setFunctionBox(Node pn, FunctionBox *funbox) {}
+    Node newLexicalScope(ObjectBox *blockbox) { return NodeGeneric; }
     bool isOperationWithoutParens(Node pn, ParseNodeKind kind) {
         // It is OK to return false here, callers should only use this method
         // for reporting strict option warnings and parsing code which the
diff --git a/js/src/frontend/TokenStream.cpp b/js/src/frontend/TokenStream.cpp
index 12453f31e706..f772e8b082e5 100644
--- a/js/src/frontend/TokenStream.cpp
+++ b/js/src/frontend/TokenStream.cpp
@@ -207,8 +207,6 @@ TokenStream::TokenStream(JSContext *cx, const CompileOptions &options,
 
 TokenStream::~TokenStream()
 {
-    if (flags & TSF_OWNFILENAME)
-        js_free((void *) filename);
     if (sourceMap)
         js_free(sourceMap);
     if (originPrincipals)
@@ -696,69 +694,6 @@ CharsMatch(const jschar *p, const char *q) {
     return true;
 }
 
-bool
-TokenStream::getAtLine()
-{
-    int c;
-    jschar cp[5];
-    unsigned i, line, temp;
-    char filenameBuf[1024];
-
-    /*
-     * Hack for source filters such as the Mozilla XUL preprocessor:
-     * "//@line 123\n" sets the number of the *next* line after the
-     * comment to 123.  If we reach here, we've already seen "//".
-     */
-    if (peekChars(5, cp) && CharsMatch(cp, "@line")) {
-        skipChars(5);
-        while ((c = getChar()) != '\n' && c != EOF && IsSpaceOrBOM2(c))
-            continue;
-        if (JS7_ISDEC(c)) {
-            line = JS7_UNDEC(c);
-            while ((c = getChar()) != EOF && JS7_ISDEC(c)) {
-                temp = 10 * line + JS7_UNDEC(c);
-                if (temp < line) {
-                    /* Ignore overlarge line numbers. */
-                    return true;
-                }
-                line = temp;
-            }
-            while (c != '\n' && c != EOF && IsSpaceOrBOM2(c))
-                c = getChar();
-            i = 0;
-            if (c == '"') {
-                while ((c = getChar()) != EOF && c != '"') {
-                    if (c == '\n') {
-                        ungetChar(c);
-                        return true;
-                    }
-                    if ((c >> 8) != 0 || i >= sizeof filenameBuf - 1)
-                        return true;
-                    filenameBuf[i++] = (char) c;
-                }
-                if (c == '"') {
-                    while ((c = getChar()) != '\n' && c != EOF && IsSpaceOrBOM2(c))
-                        continue;
-                }
-            }
-            filenameBuf[i] = '\0';
-            if (c == EOF || c == '\n') {
-                if (i > 0) {
-                    if (flags & TSF_OWNFILENAME)
-                        js_free((void *) filename);
-                    filename = JS_strdup(cx, filenameBuf);
-                    if (!filename)
-                        return false;
-                    flags |= TSF_OWNFILENAME;
-                }
-                lineno = line;
-            }
-        }
-        ungetChar(c);
-    }
-    return true;
-}
-
 bool
 TokenStream::getAtSourceMappingURL()
 {
@@ -1489,9 +1424,6 @@ TokenStream::getTokenInternal()
          * Look for a single-line comment.
          */
         if (matchChar('/')) {
-            if (cx->hasAtLineOption() && !getAtLine())
-                goto error;
-
             if (!getAtSourceMappingURL())
                 goto error;
 
diff --git a/js/src/frontend/TokenStream.h b/js/src/frontend/TokenStream.h
index 70e68aec6ad7..ef0142ff6e4f 100644
--- a/js/src/frontend/TokenStream.h
+++ b/js/src/frontend/TokenStream.h
@@ -353,9 +353,8 @@ enum TokenStreamFlags
     TSF_UNEXPECTED_EOF = 0x10,  /* unexpected end of input, i.e. TOK_EOF not at top-level. */
     TSF_KEYWORD_IS_NAME = 0x20, /* Ignore keywords and return TOK_NAME instead to the parser. */
     TSF_DIRTYLINE = 0x40,       /* non-whitespace since start of line */
-    TSF_OWNFILENAME = 0x80,     /* ts->filename is malloc'd */
-    TSF_OCTAL_CHAR = 0x100,     /* observed a octal character escape */
-    TSF_HAD_ERROR = 0x200,      /* returned TOK_ERROR from getToken */
+    TSF_OCTAL_CHAR = 0x80,      /* observed a octal character escape */
+    TSF_HAD_ERROR = 0x100,      /* returned TOK_ERROR from getToken */
 
     /*
      * To handle the hard case of contiguous HTML comments, we want to clear the
@@ -376,7 +375,7 @@ enum TokenStreamFlags
      * It does not cope with malformed comment hiding hacks where --> is hidden
      * by C-style comments, or on a dirty line.  Such cases are already broken.
      */
-    TSF_IN_HTML_COMMENT = 0x2000
+    TSF_IN_HTML_COMMENT = 0x200
 };
 
 struct CompileError {
@@ -768,7 +767,6 @@ class TokenStream
     bool matchUnicodeEscapeIdStart(int32_t *c);
     bool matchUnicodeEscapeIdent(int32_t *c);
     bool peekChars(int n, jschar *cp);
-    bool getAtLine();
     bool getAtSourceMappingURL();
 
     bool matchChar(int32_t expect) {
diff --git a/js/src/gc/Barrier-inl.h b/js/src/gc/Barrier-inl.h
index 6467abe1b048..c64823f19ae0 100644
--- a/js/src/gc/Barrier-inl.h
+++ b/js/src/gc/Barrier-inl.h
@@ -10,6 +10,7 @@
 
 #include "gc/Barrier.h"
 #include "gc/Marking.h"
+#include "gc/StoreBuffer.h"
 
 #include "vm/ObjectImpl-inl.h"
 #include "vm/String-inl.h"
@@ -418,6 +419,19 @@ DenseRangeWriteBarrierPost(JSRuntime *rt, JSObject *obj, uint32_t start, uint32_
 #endif
 }
 
+/*
+ * This is a post barrier for HashTables whose key can be moved during a GC.
+ */
+template <class Map, class Key>
+inline void
+HashTableWriteBarrierPost(JSRuntime *rt, Map *map, const Key &key)
+{
+#ifdef JSGC_GENERATIONAL
+    if (key && IsInsideNursery(rt, key))
+        rt->gcStoreBuffer.putGeneric(gc::HashKeyRef<Map, Key>(map, key));
+#endif
+}
+
 inline
 EncapsulatedId::~EncapsulatedId()
 {
diff --git a/js/src/gc/Barrier.h b/js/src/gc/Barrier.h
index 2427fba886ee..3904333244c6 100644
--- a/js/src/gc/Barrier.h
+++ b/js/src/gc/Barrier.h
@@ -507,19 +507,6 @@ class HeapSlot : public EncapsulatedValue
 inline void
 DenseRangeWriteBarrierPost(JSRuntime *rt, JSObject *obj, uint32_t start, uint32_t count);
 
-/*
- * This is a post barrier for HashTables whose key can be moved during a GC.
- */
-template <class Map, class Key>
-inline void
-HashTableWriteBarrierPost(JSRuntime *rt, const Map *map, const Key &key)
-{
-#ifdef JS_GCGENERATIONAL
-    if (key && comp->gcNursery.isInside(key))
-        comp->gcStoreBuffer.putGeneric(HashKeyRef(map, key));
-#endif
-}
-
 static inline const Value *
 Valueify(const EncapsulatedValue *array)
 {
diff --git a/js/src/gc/RootMarking.cpp b/js/src/gc/RootMarking.cpp
index d4a1a72e581f..1bdd95e7c796 100644
--- a/js/src/gc/RootMarking.cpp
+++ b/js/src/gc/RootMarking.cpp
@@ -538,12 +538,6 @@ AutoGCRooter::trace(JSTracer *trc)
         return;
       }
 
-      case SHAPERANGE: {
-        Shape::Range::AutoRooter *rooter = static_cast<Shape::Range::AutoRooter *>(this);
-        rooter->trace(trc);
-        return;
-      }
-
       case STACKSHAPE: {
         StackShape::AutoRooter *rooter = static_cast<StackShape::AutoRooter *>(this);
         if (rooter->shape->base)
@@ -649,13 +643,6 @@ AutoGCRooter::traceAllWrappers(JSTracer *trc)
     }
 }
 
-void
-Shape::Range::AutoRooter::trace(JSTracer *trc)
-{
-    if (r->cursor)
-        MarkShapeRoot(trc, const_cast<Shape**>(&r->cursor), "Shape::Range::AutoRooter");
-}
-
 void
 RegExpStatics::AutoRooter::trace(JSTracer *trc)
 {
diff --git a/js/src/gc/StoreBuffer.cpp b/js/src/gc/StoreBuffer.cpp
index 63951066a012..e2f305e4db64 100644
--- a/js/src/gc/StoreBuffer.cpp
+++ b/js/src/gc/StoreBuffer.cpp
@@ -13,8 +13,49 @@
 #include "gc/StoreBuffer.h"
 #include "vm/ObjectImpl-inl.h"
 
+using namespace js;
 using namespace js::gc;
 
+/*** SlotEdge ***/
+
+JS_ALWAYS_INLINE HeapSlot *
+StoreBuffer::SlotEdge::slotLocation() const
+{
+    if (kind == HeapSlot::Element) {
+        if (offset >= object->getDenseInitializedLength())
+            return NULL;
+        return (HeapSlot *)&object->getDenseElement(offset);
+    }
+    if (offset >= object->slotSpan())
+        return NULL;
+    return &object->getSlotRef(offset);
+}
+
+JS_ALWAYS_INLINE void *
+StoreBuffer::SlotEdge::deref() const
+{
+    HeapSlot *loc = slotLocation();
+    return (loc && loc->isGCThing()) ? loc->toGCThing() : NULL;
+}
+
+JS_ALWAYS_INLINE void *
+StoreBuffer::SlotEdge::location() const
+{
+    return (void *)slotLocation();
+}
+
+JS_ALWAYS_INLINE bool
+StoreBuffer::SlotEdge::inRememberedSet(Nursery *n) const
+{
+    return !n->isInside(object) && n->isInside(deref());
+}
+
+JS_ALWAYS_INLINE bool
+StoreBuffer::SlotEdge::isNullEdge() const
+{
+    return !deref();
+}
+
 /*** MonoTypeBuffer ***/
 
 template <typename T>
diff --git a/js/src/gc/StoreBuffer.h b/js/src/gc/StoreBuffer.h
index 1e6e157acb45..89ec0b64ef25 100644
--- a/js/src/gc/StoreBuffer.h
+++ b/js/src/gc/StoreBuffer.h
@@ -302,33 +302,15 @@ class StoreBuffer
             return object != other.object || offset != other.offset || kind != other.kind;
         }
 
-        HeapSlot *slotLocation() const {
-            if (kind == HeapSlot::Element) {
-                if (offset >= object->getDenseInitializedLength())
-                    return NULL;
-                return (HeapSlot *)&object->getDenseElement(offset);
-            }
-            if (offset >= object->slotSpan())
-                return NULL;
-            return &object->getSlotRef(offset);
-        }
+        JS_ALWAYS_INLINE HeapSlot *slotLocation() const;
 
-        void *deref() const {
-            HeapSlot *loc = slotLocation();
-            return (loc && loc->isGCThing()) ? loc->toGCThing() : NULL;
-        }
+        JS_ALWAYS_INLINE void *deref() const;
 
-        void *location() const {
-            return (void *)slotLocation();
-        }
+        JS_ALWAYS_INLINE void *location() const;
 
-        bool inRememberedSet(Nursery *n) {
-            return !n->isInside(object) && n->isInside(deref());
-        }
+        JS_ALWAYS_INLINE bool inRememberedSet(Nursery *n) const;
 
-        bool isNullEdge() const {
-            return !deref();
-        }
+        JS_ALWAYS_INLINE bool isNullEdge() const;
     };
 
     MonoTypeBuffer<ValueEdge> bufferVal;
diff --git a/js/src/ion/shared/Assembler-shared.h b/js/src/ion/shared/Assembler-shared.h
index f5b8aa326007..d2630cf8cfef 100644
--- a/js/src/ion/shared/Assembler-shared.h
+++ b/js/src/ion/shared/Assembler-shared.h
@@ -238,9 +238,12 @@ class Label : public LabelBase
     { }
     ~Label()
     {
-        // Note: the condition is a hack to avoid this assert when OOM testing,
+#ifdef DEBUG
+        // Note: the condition is a hack to silence this assert when OOM testing,
         // see bug 756614.
-        JS_ASSERT_IF(OOM_counter < OOM_maxAllocations, !used());
+        if (!js_IonOptions.parallelCompilation)
+            JS_ASSERT_IF(!GetIonContext()->cx->runtime->hadOutOfMemory, !used());
+#endif
     }
 };
 
diff --git a/js/src/jsapi-tests/testXDR.cpp b/js/src/jsapi-tests/testXDR.cpp
index 442c3af6ba6e..40cef1bca958 100644
--- a/js/src/jsapi-tests/testXDR.cpp
+++ b/js/src/jsapi-tests/testXDR.cpp
@@ -152,36 +152,6 @@ JSScript *createScriptViaXDR(JSPrincipals *prin, JSPrincipals *orig, int testCas
 
 END_TEST(testXDR_principals)
 
-BEGIN_TEST(testXDR_atline)
-{
-    JS_ToggleOptions(cx, JSOPTION_ATLINE);
-    CHECK(JS_GetOptions(cx) & JSOPTION_ATLINE);
-
-    const char src[] =
-"//@line 100 \"foo\"\n"
-"function nested() { }\n"
-"//@line 200 \"bar\"\n"
-"nested;\n";
-
-    JSScript *script = JS_CompileScript(cx, global, src, strlen(src), "internal", 1);
-    CHECK(script);
-    CHECK(script = FreezeThaw(cx, script));
-    CHECK(!strcmp("bar", JS_GetScriptFilename(cx, script)));
-
-    JS::RootedValue v(cx);
-    JSBool ok = JS_ExecuteScript(cx, global, script, v.address());
-    CHECK(ok);
-    CHECK(v.isObject());
-
-    JS::RootedObject funobj(cx, &v.toObject());
-    script = JS_GetFunctionScript(cx, JS_GetObjectFunction(funobj));
-    CHECK(!strcmp("foo", JS_GetScriptFilename(cx, script)));
-
-    return true;
-}
-
-END_TEST(testXDR_atline)
-
 BEGIN_TEST(testXDR_bug506491)
 {
     const char *s =
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 3a434821a69c..9aebde593a2b 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -4396,8 +4396,8 @@ JS_DeleteProperty(JSContext *cx, JSObject *objArg, const char *name)
 static RawShape
 LastConfigurableShape(JSObject *obj)
 {
-    for (Shape::Range r(obj->lastProperty()->all()); !r.empty(); r.popFront()) {
-        RawShape shape = &r.front();
+    for (Shape::Range<NoGC> r(obj->lastProperty()); !r.empty(); r.popFront()) {
+        Shape *shape = &r.front();
         if (shape->configurable())
             return shape;
     }
@@ -4425,8 +4425,8 @@ JS_ClearNonGlobalObject(JSContext *cx, JSObject *objArg)
     }
 
     /* Set all remaining writable plain data properties to undefined. */
-    for (Shape::Range r(obj->lastProperty()->all()); !r.empty(); r.popFront()) {
-        RawShape shape = &r.front();
+    for (Shape::Range<NoGC> r(obj->lastProperty()); !r.empty(); r.popFront()) {
+        Shape *shape = &r.front();
         if (shape->isDataDescriptor() &&
             shape->writable() &&
             shape->hasDefaultSetter() &&
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index a1685ee7d5e9..18971434c5ef 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -129,7 +129,6 @@ class JS_PUBLIC_API(AutoGCRooter) {
         STRINGVECTOR =-17, /* js::AutoStringVector */
         SCRIPTVECTOR =-18, /* js::AutoScriptVector */
         PROPDESC =    -19, /* js::PropDesc::AutoRooter */
-        SHAPERANGE =  -20, /* js::Shape::Range::AutoRooter */
         STACKSHAPE =  -21, /* js::StackShape::AutoRooter */
         STACKBASESHAPE=-22,/* js::StackBaseShape::AutoRooter */
         GETTERSETTER =-24, /* js::AutoRooterGetterSetter */
@@ -2093,10 +2092,8 @@ JS_StringToVersion(const char *string);
                                                    script once only; enables
                                                    compile-time scope chain
                                                    resolution of consts. */
-#define JSOPTION_ATLINE         JS_BIT(5)       /* //@line number ["filename"]
-                                                   option supported for the
-                                                   XUL preprocessor and kindred
-                                                   beasts. */
+
+/* JS_BIT(5) is currently unused. */
 
 /* JS_BIT(6) is currently unused. */
 
diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index 0e295300b17f..f9f05cdfed92 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -1581,7 +1581,6 @@ struct JSContext : js::ContextFriendFields,
 
     bool hasStrictOption() const { return hasOption(JSOPTION_STRICT); }
     bool hasWErrorOption() const { return hasOption(JSOPTION_WERROR); }
-    bool hasAtLineOption() const { return hasOption(JSOPTION_ATLINE); }
 
     js::LifoAlloc &tempLifoAlloc() { return runtime->tempLifoAlloc; }
     inline js::LifoAlloc &analysisLifoAlloc();
diff --git a/js/src/jsdbgapi.cpp b/js/src/jsdbgapi.cpp
index 786b4ab27210..946d7781d0ca 100644
--- a/js/src/jsdbgapi.cpp
+++ b/js/src/jsdbgapi.cpp
@@ -728,8 +728,7 @@ JS_GetPropertyDescArray(JSContext *cx, JSObject *obj_, JSPropertyDescArray *pda)
         return false;
 
     {
-        Shape::Range r(obj->lastProperty()->all());
-        Shape::Range::AutoRooter rooter(cx, &r);
+        Shape::Range<CanGC> r(cx, obj->lastProperty());
         RootedShape shape(cx);
         for (; !r.empty(); r.popFront()) {
             pd[i].id = JSVAL_NULL;
diff --git a/js/src/jsgcinlines.h b/js/src/jsgcinlines.h
index 5b0404f85c72..1800e0112655 100644
--- a/js/src/jsgcinlines.h
+++ b/js/src/jsgcinlines.h
@@ -181,6 +181,18 @@ GetGCKindSlots(AllocKind thingKind, Class *clasp)
     return nslots;
 }
 
+inline bool
+IsInsideNursery(JSRuntime *rt, void *thing)
+{
+#ifdef JSGC_GENERATIONAL
+#if JS_GC_ZEAL
+    if (rt->gcVerifyPostData)
+        return rt->gcNursery.isInside(thing);
+#endif
+#endif
+    return false;
+}
+
 static inline void
 GCPoke(JSRuntime *rt)
 {
diff --git a/js/src/jsiter.cpp b/js/src/jsiter.cpp
index cd1bbe0c2118..59a0a08d1e96 100644
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -142,8 +142,7 @@ EnumerateNativeProperties(JSContext *cx, HandleObject pobj, unsigned flags, IdSe
     size_t initialLength = props->length();
 
     /* Collect all unique properties from this object's scope. */
-    Shape::Range r = pobj->lastProperty()->all();
-    Shape::Range::AutoRooter root(cx, &r);
+    Shape::Range<NoGC> r(pobj->lastProperty());
     for (; !r.empty(); r.popFront()) {
         Shape &shape = r.front();
 
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 53989e54f78b..2bf41409a4dc 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -1080,7 +1080,7 @@ JSObject::sealOrFreeze(JSContext *cx, HandleObject obj, ImmutabilityType it)
 
         /* Get an in order list of the shapes in this object. */
         AutoShapeVector shapes(cx);
-        for (Shape::Range r = obj->lastProperty()->all(); !r.empty(); r.popFront()) {
+        for (Shape::Range<NoGC> r(obj->lastProperty()); !r.empty(); r.popFront()) {
             if (!shapes.append(&r.front()))
                 return false;
         }
@@ -1632,7 +1632,7 @@ JS_CopyPropertiesFrom(JSContext *cx, JSObject *targetArg, JSObject *objArg)
         return true;
 
     AutoShapeVector shapes(cx);
-    for (Shape::Range r(obj->lastProperty()); !r.empty(); r.popFront()) {
+    for (Shape::Range<NoGC> r(obj->lastProperty()); !r.empty(); r.popFront()) {
         if (!shapes.append(&r.front()))
             return false;
     }
@@ -4943,7 +4943,7 @@ JSObject::dump()
     if (obj->isNative()) {
         fprintf(stderr, "properties:\n");
         Vector<RawShape, 8, SystemAllocPolicy> props;
-        for (Shape::Range r = obj->lastProperty()->all(); !r.empty(); r.popFront())
+        for (Shape::Range<NoGC> r(obj->lastProperty()); !r.empty(); r.popFront())
             props.append(&r.front());
         for (size_t i = props.length(); i-- != 0;)
             DumpProperty(obj, *props[i]);
diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index ee9d8e4a0391..01084abe64ee 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -475,8 +475,7 @@ ToDisassemblySource(JSContext *cx, jsval v, JSAutoByteString *bytes)
             if (!source)
                 return false;
 
-            Shape::Range r = obj->lastProperty()->all();
-            Shape::Range::AutoRooter root(cx, &r);
+            Shape::Range<CanGC> r(cx, obj->lastProperty());
 
             while (!r.empty()) {
                 Rooted<Shape*> shape(cx, &r.front());
@@ -1429,7 +1428,7 @@ ExpressionDecompiler::findLetVar(jsbytecode *pc, unsigned depth)
             uint32_t blockDepth = block.stackDepth();
             uint32_t blockCount = block.slotCount();
             if (uint32_t(depth - blockDepth) < uint32_t(blockCount)) {
-                for (Shape::Range r(block.lastProperty()); !r.empty(); r.popFront()) {
+                for (Shape::Range<NoGC> r(block.lastProperty()); !r.empty(); r.popFront()) {
                     const Shape &shape = r.front();
                     if (shape.shortid() == int(depth - blockDepth))
                         return JSID_TO_ATOM(shape.propid());
diff --git a/js/src/jsproxy.h b/js/src/jsproxy.h
index 70f9c4157b00..f213f417d5f7 100644
--- a/js/src/jsproxy.h
+++ b/js/src/jsproxy.h
@@ -328,13 +328,6 @@ SetProxyHandler(RawObject obj, BaseProxyHandler *handler)
     SetReservedSlot(obj, JSSLOT_PROXY_HANDLER, PrivateValue(handler));
 }
 
-inline void
-SetProxyPrivate(RawObject obj, const Value &value)
-{
-    JS_ASSERT(IsProxy(obj));
-    SetReservedSlot(obj, JSSLOT_PROXY_PRIVATE, value);
-}
-
 inline void
 SetProxyExtra(RawObject obj, size_t n, const Value &extra)
 {
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 3ebf416d164b..1c8f2c05d04f 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -600,7 +600,6 @@ static const struct JSOption {
     const char  *name;
     uint32_t    flag;
 } js_options[] = {
-    {"atline",          JSOPTION_ATLINE},
     {"methodjit",       JSOPTION_METHODJIT},
     {"methodjit_always",JSOPTION_METHODJIT_ALWAYS},
     {"strict",          JSOPTION_STRICT},
diff --git a/js/src/tests/browser.js b/js/src/tests/browser.js
index db75636c0b42..e0f4d5620f30 100644
--- a/js/src/tests/browser.js
+++ b/js/src/tests/browser.js
@@ -189,7 +189,6 @@ function optionsInit() {
   options.currvalues = {
     strict:     true,
     werror:     true,
-    atline:     true,
     methodjit:  true,
     methodjit_always: true,
     strict_mode: true
diff --git a/js/src/tests/js1_8_5/regress/regress-618652.js b/js/src/tests/js1_8_5/regress/regress-618652.js
deleted file mode 100644
index 87619df27103..000000000000
--- a/js/src/tests/js1_8_5/regress/regress-618652.js
+++ /dev/null
@@ -1,10 +0,0 @@
-options('atline')
-
-var F, L;
-
-eval('//@line 42 "foo"\n' +
-     'try { nosuchname; } catch (e) { F = e.fileName; L = e.lineNumber; }');
-assertEq(F, "foo");
-assertEq(L, 42);
-
-reportCompare(0, 0, "ok");
diff --git a/js/src/vm/DateTime.cpp b/js/src/vm/DateTime.cpp
index 2003f44706a7..4bf194cf7add 100644
--- a/js/src/vm/DateTime.cpp
+++ b/js/src/vm/DateTime.cpp
@@ -127,7 +127,13 @@ UTCToLocalStandardOffsetSeconds()
 void
 js::DateTimeInfo::updateTimeZoneAdjustment()
 {
-    double newTZA = UTCToLocalStandardOffsetSeconds() * msPerSecond;
+    /*
+     * The difference between local standard time and UTC will never change for
+     * a given time zone.
+     */
+    utcToLocalStandardOffsetSeconds = UTCToLocalStandardOffsetSeconds();
+
+    double newTZA = utcToLocalStandardOffsetSeconds * msPerSecond;
     if (newTZA == localTZA_)
         return;
 
@@ -177,7 +183,7 @@ js::DateTimeInfo::computeDSTOffsetMilliseconds(int64_t utcSeconds)
     if (!ComputeLocalTime(static_cast<time_t>(utcSeconds), &tm))
         return 0;
 
-    int32_t dayoff = int32_t((utcSeconds + UTCToLocalStandardOffsetSeconds()) % SecondsPerDay);
+    int32_t dayoff = int32_t((utcSeconds + utcToLocalStandardOffsetSeconds) % SecondsPerDay);
     int32_t tmoff = tm.tm_sec + (tm.tm_min * SecondsPerMinute) + (tm.tm_hour * SecondsPerHour);
 
     int32_t diff = tmoff - dayoff;
diff --git a/js/src/vm/DateTime.h b/js/src/vm/DateTime.h
index caf44e1e10cb..1c19ab62d521 100644
--- a/js/src/vm/DateTime.h
+++ b/js/src/vm/DateTime.h
@@ -140,6 +140,12 @@ class DateTimeInfo
     int64_t oldOffsetMilliseconds;
     int64_t oldRangeStartSeconds, oldRangeEndSeconds; // UTC-based
 
+    /*
+     * Cached offset in seconds from the current UTC time to the current
+     * local standard time (i.e. not including any offset due to DST).
+     */
+    int32_t utcToLocalStandardOffsetSeconds;
+
     static const int64_t MaxUnixTimeT = 2145859200; /* time_t 12/31/2037 */
 
     static const int64_t RangeExpansionAmount = 30 * SecondsPerDay;
diff --git a/js/src/vm/ObjectImpl.cpp b/js/src/vm/ObjectImpl.cpp
index ea4aec93688a..b789ad89b6e0 100644
--- a/js/src/vm/ObjectImpl.cpp
+++ b/js/src/vm/ObjectImpl.cpp
@@ -232,7 +232,7 @@ js::ObjectImpl::checkShapeConsistency()
             if (shape->hasTable()) {
                 ShapeTable &table = shape->table();
                 MOZ_ASSERT(shape->parent);
-                for (Shape::Range r(shape); !r.empty(); r.popFront()) {
+                for (Shape::Range<NoGC> r(shape); !r.empty(); r.popFront()) {
                     Shape **spp = table.search(r.front().propid(), false);
                     MOZ_ASSERT(SHAPE_FETCH(spp) == &r.front());
                 }
diff --git a/js/src/vm/ScopeObject.cpp b/js/src/vm/ScopeObject.cpp
index 01f0087cc2ef..ae1db28e5212 100644
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -121,7 +121,7 @@ js::ScopeCoordinateToStaticScopeShape(JSContext *cx, JSScript *script, jsbytecod
 PropertyName *
 js::ScopeCoordinateName(JSContext *cx, JSScript *script, jsbytecode *pc)
 {
-    Shape::Range r = ScopeCoordinateToStaticScopeShape(cx, script, pc)->all();
+    Shape::Range<NoGC> r(ScopeCoordinateToStaticScopeShape(cx, script, pc));
     ScopeCoordinate sc(pc);
     while (r.front().slot() != sc.slot)
         r.popFront();
@@ -787,8 +787,8 @@ js::XDRStaticBlockObject(XDRState<mode> *xdr, HandleObject enclosingScope, Handl
         if (!shapes.growBy(count))
             return false;
 
-        for (Shape::Range r(obj->lastProperty()); !r.empty(); r.popFront()) {
-            RawShape shape = &r.front();
+        for (Shape::Range<NoGC> r(obj->lastProperty()); !r.empty(); r.popFront()) {
+            Shape *shape = &r.front();
             shapes[shape->shortid()] = shape;
         }
 
@@ -844,7 +844,7 @@ js::CloneStaticBlockObject(JSContext *cx, HandleObject enclosingScope, Handle<St
     AutoShapeVector shapes(cx);
     if (!shapes.growBy(srcBlock->slotCount()))
         return NULL;
-    for (Shape::Range r = srcBlock->lastProperty()->all(); !r.empty(); r.popFront())
+    for (Shape::Range<NoGC> r(srcBlock->lastProperty()); !r.empty(); r.popFront())
         shapes[r.front().shortid()] = &r.front();
 
     for (Shape **p = shapes.begin(); p != shapes.end(); ++p) {
diff --git a/js/src/vm/Shape.cpp b/js/src/vm/Shape.cpp
index 55e357edf908..19b905ddf68d 100644
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -62,7 +62,7 @@ ShapeTable::init(JSRuntime *rt, RawShape lastProp)
         return false;
 
     hashShift = HASH_BITS - sizeLog2;
-    for (Shape::Range r = lastProp->all(); !r.empty(); r.popFront()) {
+    for (Shape::Range<NoGC> r(lastProp); !r.empty(); r.popFront()) {
         Shape &shape = r.front();
         Shape **spp = search(shape.propid(), true);
 
diff --git a/js/src/vm/Shape.h b/js/src/vm/Shape.h
index a5e841049c1a..b750dc32ebc7 100644
--- a/js/src/vm/Shape.h
+++ b/js/src/vm/Shape.h
@@ -545,15 +545,21 @@ class Shape : public js::gc::Cell
         return parent;
     }
 
+    template <AllowGC allowGC>
     class Range {
       protected:
         friend class Shape;
 
-        /* |cursor| is rooted manually when necessary using Range::AutoRooter. */
-        RawShape cursor;
+        typename MaybeRooted<Shape*, allowGC>::RootType cursor;
 
       public:
-        Range(RawShape shape) : cursor(shape) { }
+        Range(JSContext *cx, Shape *shape) : cursor(cx, shape) {
+            JS_STATIC_ASSERT(allowGC == CanGC);
+        }
+
+        Range(Shape *shape) : cursor(NULL, shape) {
+            JS_STATIC_ASSERT(allowGC == NoGC);
+        }
 
         bool empty() const {
             return !cursor || cursor->isEmptyShape();
@@ -568,31 +574,8 @@ class Shape : public js::gc::Cell
             JS_ASSERT(!empty());
             cursor = cursor->parent;
         }
-
-        class AutoRooter : private AutoGCRooter
-        {
-          public:
-            explicit AutoRooter(JSContext *cx, Range *r_
-                                MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-              : AutoGCRooter(cx, SHAPERANGE), r(r_), skip(cx, r_)
-            {
-                MOZ_GUARD_OBJECT_NOTIFIER_INIT;
-            }
-
-            friend void AutoGCRooter::trace(JSTracer *trc);
-            void trace(JSTracer *trc);
-
-          private:
-            Range *r;
-            SkipRoot skip;
-            MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
-        };
     };
 
-    Range all() {
-        return Range(this);
-    }
-
     Class *getObjectClass() const { return base()->clasp; }
     JSObject *getObjectParent() const { return base()->parent; }
 
@@ -798,7 +781,7 @@ class Shape : public js::gc::Cell
 
         RawShape shape = this;
         uint32_t count = 0;
-        for (Shape::Range r = shape->all(); !r.empty(); r.popFront())
+        for (Shape::Range<NoGC> r(shape); !r.empty(); r.popFront())
             ++count;
         return count;
     }
@@ -807,7 +790,7 @@ class Shape : public js::gc::Cell
         JS_ASSERT(!hasTable());
         RawShape shape = this;
         uint32_t count = 0;
-        for (Shape::Range r = shape->all(); !r.empty(); r.popFront()) {
+        for (Shape::Range<NoGC> r(shape); !r.empty(); r.popFront()) {
             ++count;
             if (count >= ShapeTable::MIN_ENTRIES)
                 return true;
diff --git a/js/xpconnect/crashtests/786142-iframe.html b/js/xpconnect/crashtests/786142-iframe.html
new file mode 100644
index 000000000000..8910efbf6e98
--- /dev/null
+++ b/js/xpconnect/crashtests/786142-iframe.html
@@ -0,0 +1,81 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+// Morph a slim wrapper into an XPCWN by generating a cross-compartment wrapper
+// for it (we Morph in WrapperFactory::PrepareForWrapping).
+function makeNonSlim(elem) {
+  window.parent.someCCW = elem;
+  delete window.parent.someCCW;
+}
+
+function doTest() {
+
+  // Get a slim wrapper for |form|. This lives in scope 1.
+  var form = document.getElementById('myform');
+
+  // The gist here is that we want to create an input element that isn't part
+  // of a form, so that its PreCreate hook will cause it to be parented to the
+  // document. However, there are several considerations that make this more
+  // complicted.
+  //
+  // First, the crashtest becomes non-deterministics if we morph |form| before
+  // getting to scope 3 (as explained below). This means that we can't trigger
+  // the PreCreate hook for |input|, because that will call WrapNativeParent
+  // on the form, which will end up making a cross-compartment wrapper, which
+  // will morph form. But this puts us in a pickle, because appendChild returns
+  // the apppended child, which will trigger the PreCreate hook in
+  // NativeInterface2JSObject. So we do this little hack where we append a buch
+  // of dummy <div> children to the form, and use replaceChild (which returns
+  // the replacer, not the replacee) to stick the input elements as children of
+  // the form.
+  //
+  // Second, the crashtest can also be non-deterministics if the final call to
+  // MoveWrappers iterates over the hashtable in such a way that it fixes up
+  // the Document before it fixes up the Input. If so, the Input will become
+  // orphaned, and we'll detect it and fix things up at the top of MoveWrapper.
+  // Since we can't control the hashtable ordering here, we just make 100 input
+  // elements, to make it a near-certainty (statistically) that we'll encounter
+  // one of them during iteration before encountering the Document.
+  //
+  // With all this, this testcase deterministically crashes on my machine. Whew!
+
+  // Create an input element. This isn't part of a form right now, so it gets
+  // parented to the document.
+  var inputs = [];
+  var placeHolders = [];
+  for (var i = 0; i < 100; ++i) {
+    var dummyDiv = form.appendChild(document.createElement('div'));
+    var input = document.createElement('input');
+    makeNonSlim(input);
+    inputs.push(input);
+    placeHolders.push(dummyDiv);
+  }
+
+  // Blow away the document, forcing a transplan of all the XPCWNs in scope. This
+  // will transplant |input|, but |form| stays in the old scope (since it's slim).
+  document.open();
+  document.close();
+
+  // Now we're in scope 2. Associate |input| with |form| so that the next call to
+  // PreCreate will parent |input| to |form| rather than the document. But make
+  // sure to do it with replaceChild, rather than appendChild, so that we don't
+  // end up triggering the PreCreate hook for |form| in scope 2, which would make
+  // make it non-slim. If we didn't, the ensuing call to MoveWrappers might find
+  // |form| before |input| while iterating over the hashtable. If so, |form|
+  // would be rescued as an orphan and everything would be fixed before getting to  // |input|.
+  for (var i = 0; i < inputs.length; ++i)
+    form.replaceChild(inputs[i], placeHolders[i]);
+
+  // Blow away the document a second time. This should cause the crash in
+  // unpatched builds.
+  document.open();
+  document.close();
+}
+</script>
+</head>
+<body>
+<form id="myform"></form>
+</body>
+</html>
diff --git a/js/xpconnect/crashtests/786142.html b/js/xpconnect/crashtests/786142.html
new file mode 100644
index 000000000000..d98d39dd3fd0
--- /dev/null
+++ b/js/xpconnect/crashtests/786142.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+function go() {
+  // document.open() doesn't play well with reftest-wait, so we use an iframe.
+  var ifr = document.getElementById('ifr');
+  ifr.contentWindow.doTest();
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body>
+  <iframe id="ifr" onload="go()" src="786142-iframe.html"></iframe>
+</body>
+</html>
diff --git a/js/xpconnect/crashtests/806751.html b/js/xpconnect/crashtests/806751.html
new file mode 100644
index 000000000000..4e44b9b829a7
--- /dev/null
+++ b/js/xpconnect/crashtests/806751.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+  var frame = document.getElementById("frame");
+  var frameWin = frame.contentWindow;
+  var frameWinner = Object.create(frameWin);
+  var v = frameWinner.captureEvents.bind(frameWinner);
+  frame.src = "local-file-not-found";
+  setTimeout(function() { setTimeout(finish); v(0); });
+}
+
+function finish() {
+  document.documentElement.removeAttribute('class');
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<iframe id="frame" src="data:text/html,1"></iframe>
+</body>
+</html>
diff --git a/js/xpconnect/crashtests/crashtests.list b/js/xpconnect/crashtests/crashtests.list
index 96427d3f428e..96ded50251cc 100644
--- a/js/xpconnect/crashtests/crashtests.list
+++ b/js/xpconnect/crashtests/crashtests.list
@@ -45,6 +45,8 @@ asserts(1) load 753162.html # We hit bug 675518 or bug 680086 here.
 load 754311.html
 load 776328.html
 load 776333.html
+asserts(0-1) load 786142.html # We may hit bug 645229 here.
 load 791845.html
 load 797583.html
+load 806751.html
 load 833856.html
diff --git a/js/xpconnect/idl/xpccomponents.idl b/js/xpconnect/idl/xpccomponents.idl
index 9143648861b1..e73f861cefc7 100644
--- a/js/xpconnect/idl/xpccomponents.idl
+++ b/js/xpconnect/idl/xpccomponents.idl
@@ -119,7 +119,7 @@ interface ScheduledGCCallback : nsISupports
 /**
 * interface of Components.utils
 */
-[scriptable, uuid(5b62c98f-5ff8-41f9-bcb8-a24d1b4255d4)]
+[scriptable, uuid(ab50492f-a9de-4a68-9a75-9406f1542a6c)]
 interface nsIXPCComponents_Utils : nsISupports
 {
 
@@ -382,9 +382,6 @@ interface nsIXPCComponents_Utils : nsISupports
     [implicit_jscontext]
     attribute boolean werror;
 
-    [implicit_jscontext]
-    attribute boolean atline;
-
     [implicit_jscontext]
     attribute boolean methodjit;
 
diff --git a/js/xpconnect/shell/xpcshell.cpp b/js/xpconnect/shell/xpcshell.cpp
index edd282c5b69c..a878e6da9930 100644
--- a/js/xpconnect/shell/xpcshell.cpp
+++ b/js/xpconnect/shell/xpcshell.cpp
@@ -699,7 +699,6 @@ static const struct JSOption {
     const char  *name;
     uint32_t    flag;
 } js_options[] = {
-    {"atline",          JSOPTION_ATLINE},
     {"strict",          JSOPTION_STRICT},
     {"werror",          JSOPTION_WERROR},
     {"strict_mode",     JSOPTION_STRICT_MODE},
diff --git a/js/xpconnect/src/XPCComponents.cpp b/js/xpconnect/src/XPCComponents.cpp
index c91fd2cb8025..a19ab78733c7 100644
--- a/js/xpconnect/src/XPCComponents.cpp
+++ b/js/xpconnect/src/XPCComponents.cpp
@@ -4455,7 +4455,6 @@ SetBoolOption(JSContext* cx, uint32_t aOption, bool aValue)
 
 GENERATE_JSOPTION_GETTER_SETTER(Strict, JSOPTION_STRICT)
 GENERATE_JSOPTION_GETTER_SETTER(Werror, JSOPTION_WERROR)
-GENERATE_JSOPTION_GETTER_SETTER(Atline, JSOPTION_ATLINE)
 GENERATE_JSOPTION_GETTER_SETTER(Methodjit, JSOPTION_METHODJIT)
 GENERATE_JSOPTION_GETTER_SETTER(Methodjit_always, JSOPTION_METHODJIT_ALWAYS)
 GENERATE_JSOPTION_GETTER_SETTER(Strict_mode, JSOPTION_STRICT_MODE)
diff --git a/js/xpconnect/src/XPCConvert.cpp b/js/xpconnect/src/XPCConvert.cpp
index 05760ef82772..bb7d13e63e0b 100644
--- a/js/xpconnect/src/XPCConvert.cpp
+++ b/js/xpconnect/src/XPCConvert.cpp
@@ -838,12 +838,11 @@ XPCConvert::NativeInterface2JSObject(XPCLazyCallContext& lccx,
                 return false;
 
             if (!flat) {
-                bool triedToWrap;
                 flat = cache->WrapObject(lccx.GetJSContext(),
-                                         xpcscope->GetGlobalJSObject(),
-                                         &triedToWrap);
-                if (!flat && triedToWrap)
+                                         xpcscope->GetGlobalJSObject());
+                if (!flat && JS_IsExceptionPending(lccx.GetJSContext())) {
                     return false;
+                }
             }
 
             if (flat) {
diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
index de021f9a5c05..d733ddaeb283 100644
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -1354,7 +1354,7 @@ XPCJSRuntime::~XPCJSRuntime()
     }
 #ifdef MOZ_ENABLE_PROFILER_SPS
     // Tell the profiler that the runtime is gone
-    if (PseudoStack *stack = mozilla_get_pseudo_stack())
+    if (ProfileStack *stack = mozilla_profile_stack())
         stack->sampleRuntime(nullptr);
 #endif
 
@@ -2561,7 +2561,7 @@ XPCJSRuntime::XPCJSRuntime(nsXPConnect* aXPConnect)
     JS_EnumerateDiagnosticMemoryRegions(DiagnosticMemoryCallback);
 #endif
 #ifdef MOZ_ENABLE_PROFILER_SPS
-    if (PseudoStack *stack = mozilla_get_pseudo_stack())
+    if (ProfileStack *stack = mozilla_profile_stack())
         stack->sampleRuntime(mJSRuntime);
 #endif
     JS_SetAccumulateTelemetryCallback(mJSRuntime, AccumulateTelemetryCallback);
diff --git a/js/xpconnect/tests/chrome/test_bug760109.xul b/js/xpconnect/tests/chrome/test_bug760109.xul
index aa26158d5101..27429c7baf72 100644
--- a/js/xpconnect/tests/chrome/test_bug760109.xul
+++ b/js/xpconnect/tests/chrome/test_bug760109.xul
@@ -49,6 +49,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=760109
     is(chromeArray.indexOf('b'), 1, "indexOf works correctly");
     is(chromeArray.join(''), concat, "join works correctly");
     is(chromeArray.slice(1).join(''), 'bz', "slice works correctly");
+    is(chromeArray.length, 3, "Able to check array length");
 
     // Try some operations that modify the array.
     is(chromeArray.pop(), 'z', "Able to call pop");
diff --git a/js/xpconnect/tests/mochitest/Makefile.in b/js/xpconnect/tests/mochitest/Makefile.in
index 51018e4a5a2d..a8cf51896120 100644
--- a/js/xpconnect/tests/mochitest/Makefile.in
+++ b/js/xpconnect/tests/mochitest/Makefile.in
@@ -89,6 +89,7 @@ MOCHITEST_FILES =	chrome_wrappers_helper.html \
 		file_bug802557.html \
 		test_bug803730.html \
 		test_bug809547.html \
+		test_bug809674.html \
 		file_crosscompartment_weakmap.html \
 		test_crosscompartment_weakmap.html \
 		$(NULL)
diff --git a/js/xpconnect/tests/mochitest/test_bug809674.html b/js/xpconnect/tests/mochitest/test_bug809674.html
new file mode 100644
index 000000000000..0d385ce795e6
--- /dev/null
+++ b/js/xpconnect/tests/mochitest/test_bug809674.html
@@ -0,0 +1,35 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=809674
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 809674</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=809674">Mozilla Bug 809674</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 809674 **/
+
+var mse = document.createEvent('TimeEvents');
+mse.initTimeEvent('', {}, '');
+try {
+  mse.view.onunload;
+  ok(false, "Should have thrown");
+} catch(e) {
+  ok(!!/implicit_jscontext/.exec(e), "Should throw a helpful error");
+}
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/js/xpconnect/tests/unit/test_bug805807.js b/js/xpconnect/tests/unit/test_bug805807.js
new file mode 100644
index 000000000000..2533cff0b37d
--- /dev/null
+++ b/js/xpconnect/tests/unit/test_bug805807.js
@@ -0,0 +1,26 @@
+const Cu = Components.utils;
+function run_test() {
+  var sb = new Cu.Sandbox('http://www.example.com');
+
+  sb.obj = { priv: 42, __exposedProps__ : {} };
+  Object.defineProperty(sb.obj, 'readable', { get: function() { return this.priv; }, set: function(x) { this.priv = x; }} );
+  sb.obj.__exposedProps__.readable = 'r';
+  do_check_eq(Cu.evalInSandbox('Object.getOwnPropertyDescriptor(obj, "readable").get.call(obj)', sb), 42);
+  sb.obj.readable = 32;
+  do_check_eq(Cu.evalInSandbox('Object.getOwnPropertyDescriptor(obj, "readable").get.call(obj);', sb), 32);
+  do_check_eq(Cu.evalInSandbox('Object.__lookupGetter__.call(obj, "readable").call(obj);', sb), 32);
+  Object.getOwnPropertyDescriptor(sb.obj, "readable").set.call(sb.obj, 22);
+  do_check_eq(sb.obj.readable, 22);
+  Object.__lookupSetter__.call(sb.obj, "readable").call(sb.obj, 21);
+  do_check_eq(sb.obj.readable, 21);
+  checkThrows(sb, 'obj.readable = 11;');
+  do_check_eq(Cu.evalInSandbox('Object.getOwnPropertyDescriptor(obj, "readable").set', sb), null);
+  do_check_eq(Cu.evalInSandbox('Object.__lookupSetter__.call(obj, "readable")', sb), null);
+  do_check_eq(sb.obj.readable, 21);
+}
+
+function checkThrows(sb, expression) {
+  var result = Cu.evalInSandbox('(function() { try { ' + expression + ' return "success"; } catch (e) { return e.toString(); } })();', sb);
+  dump("Result: " + result);
+  do_check_true(!!/denied/.exec(result));
+}
diff --git a/js/xpconnect/tests/unit/test_bug809652.js b/js/xpconnect/tests/unit/test_bug809652.js
new file mode 100644
index 000000000000..7240f8fea5a5
--- /dev/null
+++ b/js/xpconnect/tests/unit/test_bug809652.js
@@ -0,0 +1,65 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* See https://bugzilla.mozilla.org/show_bug.cgi?id=813901 */
+
+const Cu = Components.utils;
+const TypedArrays = [ Int8Array, Uint8Array, Int16Array, Uint16Array,
+                      Int32Array, Uint32Array, Float32Array, Float64Array,
+                      Uint8ClampedArray ];
+
+// Make sure that the correct nativecall-y stuff is denied on security wrappers.
+
+function run_test() {
+
+  var sb = new Cu.Sandbox('http://www.example.org');
+  sb.obj = {foo: 2};
+
+  /* Set up some typed arrays. */
+  sb.ab = new ArrayBuffer(8);
+  for (var i = 0; i < 8; ++i)
+    new Uint8Array(sb.ab)[i] = i * 10;
+  sb.ta = [];
+  TypedArrays.forEach(function(f) sb.ta.push(new f(sb.ab)));
+  sb.dv = new DataView(sb.ab);
+
+  /* Things that should throw. */
+  checkThrows("Object.prototype.__lookupSetter__('__proto__').call(obj, {});", sb);
+  sb.re = /f/;
+  checkThrows("RegExp.prototype.exec.call(re, 'abcdefg').index", sb);
+  sb.d = new Date();
+  checkThrows("Date.prototype.setYear.call(d, 2011)", sb);
+  sb.m = new Map();
+  checkThrows("(new Map()).clear.call(m)", sb);
+  checkThrows("ArrayBuffer.prototype.__lookupGetter__('byteLength').call(ab);", sb);
+  checkThrows("ArrayBuffer.prototype.slice.call(ab, 0);", sb);
+  checkThrows("DataView.prototype.getInt8.call(dv, 0);", sb);
+
+  /* Things we explicitly allow in ExposedPropertiesOnly::allowNativeCall. */
+
+  /* Date */
+  do_check_eq(Cu.evalInSandbox("Date.prototype.getYear.call(d)", sb), sb.d.getYear());
+  do_check_eq(Cu.evalInSandbox("Date.prototype.valueOf.call(d)", sb), sb.d.valueOf());
+  do_check_eq(Cu.evalInSandbox("d.valueOf()", sb), sb.d.valueOf());
+  do_check_eq(Cu.evalInSandbox("Date.prototype.toString.call(d)", sb), sb.d.toString());
+  do_check_eq(Cu.evalInSandbox("d.toString()", sb), sb.d.toString());
+
+  /* Typed arrays. */
+  function testForTypedArray(t) {
+    sb.curr = t;
+    do_check_eq(Cu.evalInSandbox("this[curr.constructor.name].prototype.subarray.call(curr, 0)[0]", sb), t[0]);
+    do_check_eq(Cu.evalInSandbox("(new this[curr.constructor.name]).__lookupGetter__('length').call(curr)", sb), t.length);
+    do_check_eq(Cu.evalInSandbox("(new this[curr.constructor.name]).__lookupGetter__('buffer').call(curr)", sb), sb.ab);
+    do_check_eq(Cu.evalInSandbox("(new this[curr.constructor.name]).__lookupGetter__('byteOffset').call(curr)", sb), t.byteOffset);
+    do_check_eq(Cu.evalInSandbox("(new this[curr.constructor.name]).__lookupGetter__('byteLength').call(curr)", sb), t.byteLength);
+  }
+  sb.ta.forEach(testForTypedArray);
+}
+
+function checkThrows(expression, sb) {
+  var result = Cu.evalInSandbox('(function() { try { ' + expression + '; return "allowed"; } catch (e) { return e.toString(); }})();', sb);
+  dump('result: ' + result + '\n\n\n');
+  do_check_true(!!/denied/.exec(result));
+}
+
diff --git a/js/xpconnect/tests/unit/xpcshell.ini b/js/xpconnect/tests/unit/xpcshell.ini
index 7eb11fdc60c3..9be45117a9a9 100644
--- a/js/xpconnect/tests/unit/xpcshell.ini
+++ b/js/xpconnect/tests/unit/xpcshell.ini
@@ -13,6 +13,8 @@ tail =
 [test_bug711404.js]
 [test_bug778409.js]
 [test_bug780370.js]
+[test_bug805807.js]
+[test_bug809652.js]
 [test_bug845201.js]
 [test_bug_442086.js]
 [test_file.js]
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index b667a44eeec7..cd47e5d33676 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -2914,7 +2914,7 @@ PresShell::GoToAnchor(const nsAString& aAnchorName, bool aScroll)
     // Even if select anchor pref is false, we must still move the
     // caret there. That way tabbing will start from the new
     // location
-    nsRefPtr<nsIDOMRange> jumpToRange = new nsRange();
+    nsRefPtr<nsIDOMRange> jumpToRange = new nsRange(mDocument);
     while (content && content->GetFirstChild()) {
       content = content->GetFirstChild();
     }
@@ -4816,7 +4816,7 @@ PresShell::RenderNode(nsIDOMNode* aNode,
   if (!node->IsInDoc())
     return nullptr;
   
-  nsRefPtr<nsRange> range = new nsRange();
+  nsRefPtr<nsRange> range = new nsRange(node);
   if (NS_FAILED(range->SelectNode(aNode)))
     return nullptr;
 
@@ -6954,6 +6954,10 @@ PresShell::DispatchTouchEvent(nsEvent *aEvent,
       preventDefault = true;
     }
 
+    if (newEvent.mFlags.mMultipleActionsPrevented) {
+      touchEvent->mFlags.mMultipleActionsPrevented = true;
+    }
+
     if (contentPresShell) {
       contentPresShell->PopCurrentEventInfo();
     }
diff --git a/layout/forms/nsTextControlFrame.cpp b/layout/forms/nsTextControlFrame.cpp
index 6663ee92c814..611d9b671949 100644
--- a/layout/forms/nsTextControlFrame.cpp
+++ b/layout/forms/nsTextControlFrame.cpp
@@ -778,7 +778,7 @@ nsTextControlFrame::SetSelectionInternal(nsIDOMNode *aStartNode,
   // Note that we use a new range to avoid having to do
   // isIncreasing checks to avoid possible errors.
 
-  nsRefPtr<nsRange> range = new nsRange();
+  nsRefPtr<nsRange> range = new nsRange(mContent);
   nsresult rv = range->SetStart(aStartNode, aStartOffset);
   NS_ENSURE_SUCCESS(rv, rv);
 
diff --git a/layout/generic/nsSelection.cpp b/layout/generic/nsSelection.cpp
index 363dd534e014..8fa7541566d2 100644
--- a/layout/generic/nsSelection.cpp
+++ b/layout/generic/nsSelection.cpp
@@ -1466,7 +1466,7 @@ nsFrameSelection::TakeFocus(nsIContent *aNewFocus,
       // non-anchor/focus collapsed ranges.
       mDomSelections[index]->RemoveCollapsedRanges();
 
-      nsRefPtr<nsRange> newRange = new nsRange();
+      nsRefPtr<nsRange> newRange = new nsRange(aNewFocus);
 
       newRange->SetStart(aNewFocus, aContentOffset);
       newRange->SetEnd(aNewFocus, aContentOffset);
@@ -2866,7 +2866,7 @@ nsFrameSelection::CreateAndAddRange(nsINode *aParentNode, int32_t aOffset)
 {
   if (!aParentNode) return NS_ERROR_NULL_POINTER;
 
-  nsRefPtr<nsRange> range = new nsRange();
+  nsRefPtr<nsRange> range = new nsRange(aParentNode);
 
   // Set range around child at given offset
   nsresult result = range->SetStart(aParentNode, aOffset);
@@ -3276,7 +3276,7 @@ Selection::SubtractRange(RangeData* aRange, nsRange* aSubtract,
   if (cmp2 > 0) {
     // We need to add a new RangeData to the output, running from
     // the end of aSubtract to the end of range
-    nsRefPtr<nsRange> postOverlap = new nsRange();
+    nsRefPtr<nsRange> postOverlap = new nsRange(aSubtract->GetEndParent());
 
     rv =
       postOverlap->SetStart(aSubtract->GetEndParent(), aSubtract->EndOffset());
@@ -3294,7 +3294,7 @@ Selection::SubtractRange(RangeData* aRange, nsRange* aSubtract,
   if (cmp < 0) {
     // We need to add a new RangeData to the output, running from
     // the start of the range to the start of aSubtract
-    nsRefPtr<nsRange> preOverlap = new nsRange();
+    nsRefPtr<nsRange> preOverlap = new nsRange(range->GetStartParent());
 
     nsresult rv =
      preOverlap->SetStart(range->GetStartParent(), range->StartOffset());
@@ -4398,7 +4398,7 @@ Selection::Collapse(nsINode* aParentNode, int32_t aOffset)
   // Turn off signal for table selection
   mFrameSelection->ClearTableCellSelection();
 
-  nsRefPtr<nsRange> range = new nsRange();
+  nsRefPtr<nsRange> range = new nsRange(aParentNode);
   result = range->SetEnd(aParentNode, aOffset);
   if (NS_FAILED(result))
     return result;
@@ -4654,7 +4654,7 @@ Selection::Extend(nsINode* aParentNode, int32_t aOffset)
                                                   &disconnected);
 
   nsRefPtr<nsPresContext>  presContext = GetPresContext();
-  nsRefPtr<nsRange> difRange = new nsRange();
+  nsRefPtr<nsRange> difRange = new nsRange(aParentNode);
   if ((result1 == 0 && result3 < 0) || (result1 <= 0 && result2 < 0)){//a1,2  a,1,2
     //select from 1 to 2 unless they are collapsed
     res = range->SetEnd(aParentNode, aOffset);
diff --git a/layout/media/symbols.def.in b/layout/media/symbols.def.in
index f01480524e35..c032257bb5c5 100644
--- a/layout/media/symbols.def.in
+++ b/layout/media/symbols.def.in
@@ -567,18 +567,3 @@ hb_unicode_funcs_set_eastasian_width_func
 hb_unicode_funcs_set_general_category_func
 hb_unicode_funcs_set_mirroring_func
 hb_unicode_funcs_set_script_func
-#ifdef MOZ_ENABLE_SKIA
-#ifdef HAVE_64BIT_OS
-?insert@SkString@@QEAAX_KQEBD@Z
-??0SkString@@QEAA@XZ
-??1SkString@@QEAA@XZ
-?Create@GrContext@@SAPEAV1@W4GrEngine@@_J@Z
-??0GrGLInterface@@QEAA@XZ
-#else
-?insert@SkString@@QAEXIQBD@Z
-??0SkString@@QAE@XZ
-??1SkString@@QAE@XZ
-?Create@GrContext@@SAPAV1@W4GrEngine@@H@Z
-??0GrGLInterface@@QAE@XZ
-#endif
-#endif
diff --git a/layout/printing/nsPrintEngine.cpp b/layout/printing/nsPrintEngine.cpp
index c6b8b0a5a780..029bfce56c3b 100644
--- a/layout/printing/nsPrintEngine.cpp
+++ b/layout/printing/nsPrintEngine.cpp
@@ -2430,8 +2430,11 @@ CloneRangeToSelection(nsRange* aRange, nsIDocument* aDoc,
   nsCOMPtr<nsIDOMNode> newEnd = GetEqualNodeInCloneTree(endContainer, aDoc);
   NS_ENSURE_TRUE_VOID(newStart && newEnd);
 
-  nsRefPtr<nsRange> range = new nsRange();
-  nsresult rv = range->SetStart(newStart, startOffset);
+  nsCOMPtr<nsINode> newStartNode = do_QueryInterface(newStart);
+  NS_ENSURE_TRUE_VOID(newStartNode);
+
+  nsRefPtr<nsRange> range = new nsRange(newStartNode);
+  nsresult rv = range->SetStart(newStartNode, startOffset);
   NS_ENSURE_SUCCESS_VOID(rv);
   rv = range->SetEnd(newEnd, endOffset);
   NS_ENSURE_SUCCESS_VOID(rv);
diff --git a/layout/reftests/border-radius/reftest.list b/layout/reftests/border-radius/reftest.list
index 8c953ff245b8..079d8e4562b8 100644
--- a/layout/reftests/border-radius/reftest.list
+++ b/layout/reftests/border-radius/reftest.list
@@ -42,18 +42,18 @@ fuzzy-if(Android,9,73) == clipping-3.html clipping-3-ref.xhtml # edge of border-
 # Tests for clipping the contents of replaced elements and overflow!=visible
 != clipping-4-ref.html clipping-4-notref.html
 fuzzy-if(true,1,20) fuzzy-if(cocoaWidget,1,180) fuzzy-if(Android&&browserIsRemote,7,169) fuzzy-if(Android&&!browserIsRemote,140,237) == clipping-4-canvas.html clipping-4-ref.html # bug 732535
-fuzzy-if(Android,5,54) == clipping-4-image.html clipping-4-ref.html
-== clipping-4-overflow-hidden.html clipping-4-ref.html
+fuzzy-if(Android,5,54) fuzzy-if(/^Windows\x20NT\x206\.2/.test(http.oscpu),1,10) == clipping-4-image.html clipping-4-ref.html
+fuzzy-if(/^Windows\x20NT\x206\.2/.test(http.oscpu),1,10) == clipping-4-overflow-hidden.html clipping-4-ref.html
 == clipping-5-canvas.html clipping-5-refc.html
-== clipping-5-image.html clipping-5-refi.html
-== clipping-5-overflow-hidden.html clipping-5-ref.html
+fuzzy-if(/^Windows\x20NT\x206\.2/.test(http.oscpu),1,5) == clipping-5-image.html clipping-5-refi.html
+fuzzy-if(/^Windows\x20NT\x206\.2/.test(http.oscpu),1,5) == clipping-5-overflow-hidden.html clipping-5-ref.html
 fuzzy-if(Android,5,21) == clipping-5-refi.html clipping-5-ref.html
 fuzzy-if(true,1,7) fuzzy-if(cocoaWidget,1,99) fuzzy-if(Android&&browserIsRemote,7,89) fuzzy-if(Android&&!browserIsRemote,99,107) == clipping-5-refc.html clipping-5-ref.html # bug 732535
-== clipping-and-zindex-1.html clipping-and-zindex-1-ref.html
+fuzzy-if(/^Windows\x20NT\x206\.2/.test(http.oscpu),1,5) == clipping-and-zindex-1.html clipping-and-zindex-1-ref.html
 fuzzy-if(cocoaWidget,1,4) == intersecting-clipping-1-canvas.html intersecting-clipping-1-refc.html
 == intersecting-clipping-1-image.html intersecting-clipping-1-refi.html
 == intersecting-clipping-1-overflow-hidden.html intersecting-clipping-1-ref.html
-fuzzy-if(Android,5,105) == intersecting-clipping-1-refi.html intersecting-clipping-1-ref.html
+fuzzy-if(/^Windows\x20NT\x206\.2/.test(http.oscpu),1,20) fuzzy-if(Android,5,105) == intersecting-clipping-1-refi.html intersecting-clipping-1-ref.html
 fuzzy-if(true,1,33) fuzzy-if(cocoaWidget,1,332) fuzzy-if(Android&&browserIsRemote,7,310) fuzzy-if(Android&&!browserIsRemote,124,429) == intersecting-clipping-1-refc.html intersecting-clipping-1-ref.html # bug 732535
 
 # Inheritance
diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list
index a94cf0db2341..c1f6646d9cff 100644
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -681,7 +681,7 @@ skip-if(B2G) == 378937-1.html 378937-1-ref.html
 == 379178-html.html 379178-html-ref.html
 == 379178-svg.svg 379178-svg-ref.svg
 == 379316-1.html 379316-1-ref.html
-skip-if(B2G) fails-if(Android) random-if(cocoaWidget) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) fuzzy-if(gtk2Widget,1,191) == 379316-2.html 379316-2-ref.html # bug 379786
+skip-if(B2G) fails-if(Android) random-if(cocoaWidget) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) fuzzy-if(/^Windows\x20NT\x206\.2/.test(http.oscpu),1,170) fuzzy-if(gtk2Widget,1,191) == 379316-2.html 379316-2-ref.html # bug 379786
 == 379328-1.html 379328-1-ref.html
 == 379349-1a.xhtml 379349-1-ref.xhtml
 == 379349-1b.xhtml 379349-1-ref.xhtml
@@ -1724,8 +1724,8 @@ fuzzy-if(true,17,5859) == 759036-2.html 759036-2-ref.html
 == 776265-2d.html 776265-2-ref.html
 == 787947-1.html 787947-1-ref.html
 == 796847-1.svg 796847-1-ref.svg
-fuzzy(40,800) == 797797-1.html 797797-1-ref.html # 'opacity:N' and rgba(,,,N) text don't match precisely
-fuzzy(40,800) == 797797-2.html 797797-2-ref.html # 'opacity:N' and rgba(,,,N) text don't match precisely
+fuzzy(40,850) == 797797-1.html 797797-1-ref.html # 'opacity:N' and rgba(,,,N) text don't match precisely
+fuzzy(40,850) == 797797-2.html 797797-2-ref.html # 'opacity:N' and rgba(,,,N) text don't match precisely
 == 801681-1.html 801681-1-ref.html
 == 801681-2.html 801681-2-ref.html
 == 801994-1.html 801994-1-ref.html
diff --git a/layout/reftests/css-gradients/reftest.list b/layout/reftests/css-gradients/reftest.list
index 5f2b266b7728..79653914028f 100644
--- a/layout/reftests/css-gradients/reftest.list
+++ b/layout/reftests/css-gradients/reftest.list
@@ -64,9 +64,9 @@ fuzzy-if(!contentSameGfxBackendAsCanvas,3,7860) fails-if(Android) == radial-2f.h
 == radial-shape-closest-corner-1a.html radial-shape-closest-corner-1-ref.html
 == radial-shape-closest-corner-1b.html radial-shape-closest-corner-1-ref.html
 == radial-shape-closest-corner-1c.html radial-shape-closest-corner-1-ref.html
-fuzzy-if(Android,17,3880) == radial-shape-closest-side-1a.html radial-shape-closest-side-1-ref.html
-fuzzy-if(Android,17,3880) == radial-shape-closest-side-1b.html radial-shape-closest-side-1-ref.html
-fuzzy-if(Android,17,3880) == radial-shape-closest-side-1c.html radial-shape-closest-side-1-ref.html
+fuzzy-if(/^Windows\x20NT\x206\.2/.test(http.oscpu),1,5) fuzzy-if(Android,17,3880) == radial-shape-closest-side-1a.html radial-shape-closest-side-1-ref.html
+fuzzy-if(/^Windows\x20NT\x206\.2/.test(http.oscpu),1,5) fuzzy-if(Android,17,3880) == radial-shape-closest-side-1b.html radial-shape-closest-side-1-ref.html
+fuzzy-if(/^Windows\x20NT\x206\.2/.test(http.oscpu),1,5) fuzzy-if(Android,17,3880) == radial-shape-closest-side-1c.html radial-shape-closest-side-1-ref.html
 == radial-shape-farthest-corner-1a.html radial-shape-farthest-corner-1-ref.html
 fails-if(cocoaWidget&&/x86-/.test(xulRuntime.XPCOMABI)||gtk2Widget&&/x86_64-/.test(xulRuntime.XPCOMABI)) == radial-shape-farthest-corner-1b.html radial-shape-farthest-corner-1-ref.html
 == radial-shape-farthest-corner-1c.html radial-shape-farthest-corner-1-ref.html
diff --git a/layout/reftests/flexbox/reftest.list b/layout/reftests/flexbox/reftest.list
index 7adb5e647671..3d664f69d21d 100644
--- a/layout/reftests/flexbox/reftest.list
+++ b/layout/reftests/flexbox/reftest.list
@@ -80,11 +80,11 @@ fails == flexbox-basic-video-vert-2.xhtml flexbox-basic-video-vert-2-ref.xhtml #
 # (with existing [div | span | text] inside the flexbox, and new content
 # inserted adjacent to that existing content.)
 == flexbox-dyn-insertAroundDiv-1.xhtml flexbox-dyn-insertAroundDiv-1-ref.xhtml
-== flexbox-dyn-insertAroundDiv-2.xhtml flexbox-dyn-insertAroundDiv-2-ref.xhtml
+fuzzy-if(d2d&&layersGPUAccelerated,24,14) == flexbox-dyn-insertAroundDiv-2.xhtml flexbox-dyn-insertAroundDiv-2-ref.xhtml # bug 849692
 == flexbox-dyn-insertAroundDiv-3.xhtml flexbox-dyn-insertAroundDiv-3-ref.xhtml
 
 == flexbox-dyn-insertAroundSpan-1.xhtml flexbox-dyn-insertAroundDiv-1-ref.xhtml
-== flexbox-dyn-insertAroundSpan-2.xhtml flexbox-dyn-insertAroundDiv-2-ref.xhtml
+fuzzy-if(d2d&&layersGPUAccelerated,24,14) == flexbox-dyn-insertAroundSpan-2.xhtml flexbox-dyn-insertAroundDiv-2-ref.xhtml # bug 849692
 == flexbox-dyn-insertAroundSpan-3.xhtml flexbox-dyn-insertAroundDiv-3-ref.xhtml
 
 == flexbox-dyn-insertAroundText-1.xhtml flexbox-dyn-insertAroundText-1-ref.xhtml
diff --git a/layout/reftests/ogg-video/reftest.list b/layout/reftests/ogg-video/reftest.list
index 9963da8bb92e..4ced0d50a1f8 100644
--- a/layout/reftests/ogg-video/reftest.list
+++ b/layout/reftests/ogg-video/reftest.list
@@ -17,7 +17,7 @@ random skip-if(Android||B2G) HTTP(..) == object-aspect-ratio-1b.xhtml aspect-rat
 skip-if(Android||B2G) HTTP(..) == offset-1.xhtml offset-1-ref.html
 random skip-if(Android||B2G) HTTP(..) == object-aspect-ratio-2a.xhtml aspect-ratio-2-ref.html
 random skip-if(Android||B2G) HTTP(..) == object-aspect-ratio-2b.xhtml aspect-ratio-2-ref.html
-skip-if(Android||B2G) skip-if(gtk2Widget) fuzzy-if(/^Windows\x20NT\x205\.1/.test(http.oscpu),1,56000) fuzzy-if(cocoaWidget,1,56000) HTTP(..) == zoomed-1.xhtml zoomed-1-ref.html # bug 778995 for fuzzy
+skip-if(Android||B2G) skip-if(gtk2Widget) fuzzy-if(/^Windows\x20NT\x205\.1/.test(http.oscpu),1,56000) fuzzy-if(cocoaWidget,1,56000) fuzzy-if(d2d&&layersGPUAccelerated,1,56000) HTTP(..) == zoomed-1.xhtml zoomed-1-ref.html # bug 778995 for fuzzy
 skip-if(Android||B2G) == poster-1.html poster-ref-blue250x200.html
 skip-if(Android||B2G) == poster-2.html poster-ref-black140x100.html
 skip-if(Android||B2G) == poster-3.html poster-ref-black140x100.html
diff --git a/layout/reftests/position-dynamic-changes/relative/reftest.list b/layout/reftests/position-dynamic-changes/relative/reftest.list
index f1c5622a7d0b..cfa77279f46d 100644
--- a/layout/reftests/position-dynamic-changes/relative/reftest.list
+++ b/layout/reftests/position-dynamic-changes/relative/reftest.list
@@ -1,4 +1,4 @@
 random-if(cocoaWidget) fuzzy-if(d2d,85,20) == move-right-bottom.html move-right-bottom-ref.html # Bug 742176
 random-if(cocoaWidget) fuzzy-if(d2d,85,20) == move-top-left.html move-top-left-ref.html # Bug 688545, bug 742176
-random-if(cocoaWidget) fuzzy-if(d2d,85,20) == move-right-bottom-table.html move-right-bottom-table-ref.html # Bug 742176
-random-if(cocoaWidget) fuzzy-if(d2d,85,20) == move-top-left-table.html move-top-left-table-ref.html # Bug 688545, bug 742176
+random-if(cocoaWidget) fuzzy-if(d2d,85,80) == move-right-bottom-table.html move-right-bottom-table-ref.html # Bug 742176
+random-if(cocoaWidget) fuzzy-if(d2d,85,80) == move-top-left-table.html move-top-left-table-ref.html # Bug 688545, bug 742176
diff --git a/layout/reftests/text/reftest.list b/layout/reftests/text/reftest.list
index a430d80786cc..59a72884defb 100644
--- a/layout/reftests/text/reftest.list
+++ b/layout/reftests/text/reftest.list
@@ -174,7 +174,7 @@ skip-if(B2G) == 726392-3.html 726392-3-ref.html
 pref(gfx.font_rendering.graphite.enabled,true) HTTP(..) == graphite-01.html graphite-01-ref.html
 # Test 02 (using Pig Latin) is fuzzy on Win7 because glyph positioning is not guaranteed to match exactly
 # between a sequence of simple glyphs rendered individually, and the same sequence treated as a single cluster.
-fuzzy-if(winWidget,43,220) pref(gfx.font_rendering.graphite.enabled,true) HTTP(..) == graphite-02.html graphite-02-ref.html
+fuzzy-if(winWidget,49,220) pref(gfx.font_rendering.graphite.enabled,true) HTTP(..) == graphite-02.html graphite-02-ref.html
 pref(gfx.font_rendering.graphite.enabled,true) HTTP(..) != graphite-03a.html graphite-03-notref.html
 pref(gfx.font_rendering.graphite.enabled,true) HTTP(..) != graphite-03b.html graphite-03-notref.html
 pref(gfx.font_rendering.graphite.enabled,false) HTTP(..) != graphite-01.html graphite-01-ref.html
diff --git a/layout/reftests/transform-3d/reftest.list b/layout/reftests/transform-3d/reftest.list
index ad67bf57f05f..3d7948aa4b12 100644
--- a/layout/reftests/transform-3d/reftest.list
+++ b/layout/reftests/transform-3d/reftest.list
@@ -33,8 +33,8 @@ fails-if(Android) == rotatex-perspective-3a.html rotatex-perspective-3-ref.html
 skip-if(B2G) == preserve3d-4a.html green-rect.html
 == preserve3d-5a.html preserve3d-5-ref.html
 == scale3d-z.html scalez-1-ref.html
-fuzzy-if(d2d&&layersGPUAccelerated,52,680) fails-if(Android) fuzzy-if(OSX==10.8,145,752) == scale3d-all.html scale3d-1-ref.html # subpixel AA
-fuzzy-if(d2d&&layersGPUAccelerated,52,680) fails-if(Android) fuzzy-if(OSX==10.8,145,752) == scale3d-all-separate.html scale3d-1-ref.html # subpixel AA
+fuzzy-if(d2d&&layersGPUAccelerated,52,680) fuzzy-if(winWidget&&!layersGPUAccelerated,102,580) fails-if(Android) fuzzy-if(OSX==10.8,145,752) == scale3d-all.html scale3d-1-ref.html # subpixel AA
+fuzzy-if(d2d&&layersGPUAccelerated,52,680) fuzzy-if(winWidget&&!layersGPUAccelerated,102,580) fails-if(Android) fuzzy-if(OSX==10.8,145,752) == scale3d-all-separate.html scale3d-1-ref.html # subpixel AA
 == scale3d-xz.html scale3d-1-ref.html
 == translatez-1a.html translatez-1-ref.html
 != translatez-1b.html translatez-1-ref.html
diff --git a/layout/reftests/webm-video/reftest.list b/layout/reftests/webm-video/reftest.list
index 418ffd49135f..0ec247296574 100644
--- a/layout/reftests/webm-video/reftest.list
+++ b/layout/reftests/webm-video/reftest.list
@@ -17,7 +17,7 @@ random skip-if(Android||B2G) HTTP(..) == object-aspect-ratio-1b.xhtml aspect-rat
 skip-if(Android||B2G) HTTP(..) == offset-1.xhtml offset-1-ref.html
 random skip-if(Android||B2G) HTTP(..) == object-aspect-ratio-2a.xhtml aspect-ratio-2-ref.html
 random skip-if(Android||B2G) HTTP(..) == object-aspect-ratio-2b.xhtml aspect-ratio-2-ref.html
-skip-if(Android||B2G) skip-if(gtk2Widget) fuzzy-if(/^Windows\x20NT\x205\.1/.test(http.oscpu),1,56000) fuzzy-if(cocoaWidget,1,56000) HTTP(..) == zoomed-1.xhtml zoomed-1-ref.html # bug 778995 for fuzzy
+skip-if(Android||B2G) skip-if(gtk2Widget) fuzzy-if(/^Windows\x20NT\x205\.1/.test(http.oscpu),1,56000) fuzzy-if(cocoaWidget,1,56000) fuzzy-if(d2d&&layersGPUAccelerated,1,56000) HTTP(..) == zoomed-1.xhtml zoomed-1-ref.html # bug 778995 for fuzzy
 skip-if(Android||B2G) == poster-1.html poster-ref-blue250x200.html
 skip-if(Android||B2G) == poster-2.html poster-ref-black140x100.html
 skip-if(Android||B2G) == poster-3.html poster-ref-black140x100.html
diff --git a/layout/style/nsCSSRules.cpp b/layout/style/nsCSSRules.cpp
index 41e6534f0b51..aab64791e869 100644
--- a/layout/style/nsCSSRules.cpp
+++ b/layout/style/nsCSSRules.cpp
@@ -1742,11 +1742,9 @@ nsCSSFontFaceStyleDecl::GetParentObject()
 }
 
 JSObject*
-nsCSSFontFaceStyleDecl::WrapObject(JSContext *cx, JSObject *scope,
-                                   bool *triedToWrap)
+nsCSSFontFaceStyleDecl::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return mozilla::dom::CSSStyleDeclarationBinding::Wrap(cx, scope, this,
-                                                        triedToWrap);
+  return mozilla::dom::CSSStyleDeclarationBinding::Wrap(cx, scope, this);
 }
 
 // -------------------------------------------
diff --git a/layout/style/nsCSSRules.h b/layout/style/nsCSSRules.h
index 0aaba2acddd6..fcef951e69ff 100644
--- a/layout/style/nsCSSRules.h
+++ b/layout/style/nsCSSRules.h
@@ -203,8 +203,7 @@ public:
   nsresult GetPropertyValue(nsCSSFontDesc aFontDescID,
                             nsAString & aResult) const;
 
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap);
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 protected:
   friend class nsCSSFontFaceRule;
diff --git a/layout/style/nsDOMCSSDeclaration.h b/layout/style/nsDOMCSSDeclaration.h
index 9ab9c519bf53..6d4f92c1a321 100644
--- a/layout/style/nsDOMCSSDeclaration.h
+++ b/layout/style/nsDOMCSSDeclaration.h
@@ -92,11 +92,9 @@ public:
 
   virtual void IndexedGetter(uint32_t aIndex, bool& aFound, nsAString& aPropName);
 
-  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
-                               bool *triedToWrap)
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE
   {
-    return mozilla::dom::CSS2PropertiesBinding::Wrap(cx, scope, this,
-                                                     triedToWrap);
+    return mozilla::dom::CSS2PropertiesBinding::Wrap(cx, scope, this);
   }
 
 protected:
diff --git a/layout/style/nsDOMCSSRGBColor.cpp b/layout/style/nsDOMCSSRGBColor.cpp
index 19813ff61317..af4853891677 100644
--- a/layout/style/nsDOMCSSRGBColor.cpp
+++ b/layout/style/nsDOMCSSRGBColor.cpp
@@ -33,8 +33,8 @@ NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(nsDOMCSSRGBColor, AddRef)
 NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(nsDOMCSSRGBColor, Release)
 
 JSObject*
-nsDOMCSSRGBColor::WrapObject(JSContext *aCx, JSObject *aScope, bool *aTried)
+nsDOMCSSRGBColor::WrapObject(JSContext *aCx, JSObject *aScope)
 {
-  return dom::RGBColorBinding::Wrap(aCx, aScope, this, aTried);
+  return dom::RGBColorBinding::Wrap(aCx, aScope, this);
 }
 
diff --git a/layout/style/nsDOMCSSRGBColor.h b/layout/style/nsDOMCSSRGBColor.h
index d41417644837..a7ff490e3313 100644
--- a/layout/style/nsDOMCSSRGBColor.h
+++ b/layout/style/nsDOMCSSRGBColor.h
@@ -54,7 +54,7 @@ public:
     return nullptr;
   }
 
-  virtual JSObject *WrapObject(JSContext *cx, JSObject *aScope, bool *aTried)
+  virtual JSObject *WrapObject(JSContext *cx, JSObject *aScope)
     MOZ_OVERRIDE MOZ_FINAL;
 
 private:
diff --git a/layout/style/nsDOMCSSRect.cpp b/layout/style/nsDOMCSSRect.cpp
index 0d705195997e..958688ab77ec 100644
--- a/layout/style/nsDOMCSSRect.cpp
+++ b/layout/style/nsDOMCSSRect.cpp
@@ -42,9 +42,9 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE(nsDOMCSSRect)
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_4(nsDOMCSSRect, mTop, mBottom, mLeft, mRight)
  
 JSObject*
-nsDOMCSSRect::WrapObject(JSContext* cx, JSObject* scope, bool* tried)
+nsDOMCSSRect::WrapObject(JSContext* cx, JSObject* scope)
 {
- return dom::RectBinding::Wrap(cx, scope, this, tried);
+ return dom::RectBinding::Wrap(cx, scope, this);
 }
 
 NS_IMETHODIMP
diff --git a/layout/style/nsDOMCSSRect.h b/layout/style/nsDOMCSSRect.h
index ee4640894640..1f1416e39f06 100644
--- a/layout/style/nsDOMCSSRect.h
+++ b/layout/style/nsDOMCSSRect.h
@@ -39,7 +39,7 @@ public:
 
   nsISupports* GetParentObject() const { return nullptr; }
 
-  virtual JSObject* WrapObject(JSContext* cx, JSObject* scope, bool* tried)
+  virtual JSObject* WrapObject(JSContext* cx, JSObject* scope)
     MOZ_OVERRIDE MOZ_FINAL;
 
 private:
diff --git a/layout/style/nsDOMCSSValueList.cpp b/layout/style/nsDOMCSSValueList.cpp
index 0b3fbd2a5ca4..287a76d8ede1 100644
--- a/layout/style/nsDOMCSSValueList.cpp
+++ b/layout/style/nsDOMCSSValueList.cpp
@@ -34,9 +34,9 @@ NS_INTERFACE_MAP_END
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_1(nsDOMCSSValueList, mCSSValues)
 
 JSObject*
-nsDOMCSSValueList::WrapObject(JSContext *cx, JSObject *scope, bool *tried)
+nsDOMCSSValueList::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return dom::CSSValueListBinding::Wrap(cx, scope, this, tried);
+  return dom::CSSValueListBinding::Wrap(cx, scope, this);
 }
 
 void
diff --git a/layout/style/nsDOMCSSValueList.h b/layout/style/nsDOMCSSValueList.h
index d10ceead121b..d094163d5ef6 100644
--- a/layout/style/nsDOMCSSValueList.h
+++ b/layout/style/nsDOMCSSValueList.h
@@ -57,7 +57,7 @@ public:
     return nullptr;
   }
 
-  virtual JSObject *WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap);
+  virtual JSObject *WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 private:
   bool                        mCommaDelimited;  // some value lists use a comma
diff --git a/layout/style/nsROCSSPrimitiveValue.cpp b/layout/style/nsROCSSPrimitiveValue.cpp
index 7ddcfb7ecf41..a0f8206ce66e 100644
--- a/layout/style/nsROCSSPrimitiveValue.cpp
+++ b/layout/style/nsROCSSPrimitiveValue.cpp
@@ -62,10 +62,9 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsROCSSPrimitiveValue)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 JSObject*
-nsROCSSPrimitiveValue::WrapObject(JSContext *cx, JSObject *scope,
-                                  bool *triedToWrap)
+nsROCSSPrimitiveValue::WrapObject(JSContext *cx, JSObject *scope)
 {
-  return dom::CSSPrimitiveValueBinding::Wrap(cx, scope, this, triedToWrap);
+  return dom::CSSPrimitiveValueBinding::Wrap(cx, scope, this);
 }
 
 // nsIDOMCSSValue
diff --git a/layout/style/nsROCSSPrimitiveValue.h b/layout/style/nsROCSSPrimitiveValue.h
index 0f9999329cfb..ce44c85caac5 100644
--- a/layout/style/nsROCSSPrimitiveValue.h
+++ b/layout/style/nsROCSSPrimitiveValue.h
@@ -82,7 +82,7 @@ public:
     return nullptr;
   }
 
-  virtual JSObject *WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap);
+  virtual JSObject *WrapObject(JSContext *cx, JSObject *scope) MOZ_OVERRIDE;
 
 private:
   uint16_t mType;
diff --git a/layout/xul/tree/nsTreeContentView.cpp b/layout/xul/tree/nsTreeContentView.cpp
index 1187dab87c4b..ec9bdfa23051 100644
--- a/layout/xul/tree/nsTreeContentView.cpp
+++ b/layout/xul/tree/nsTreeContentView.cpp
@@ -37,19 +37,6 @@ namespace dom = mozilla::dom;
 class Row
 {
   public:
-    static Row*
-    Create(nsFixedSizeAllocator& aAllocator,
-           nsIContent* aContent, int32_t aParentIndex) {
-      void* place = aAllocator.Alloc(sizeof(Row));
-      return place ? ::new(place) Row(aContent, aParentIndex) : nullptr;
-    }
-
-    static void
-    Destroy(nsFixedSizeAllocator& aAllocator, Row* aRow) {
-      aRow->~Row();
-      aAllocator.Free(aRow, sizeof(*aRow));
-    }
-
     Row(nsIContent* aContent, int32_t aParentIndex)
       : mContent(aContent), mParentIndex(aParentIndex),
         mSubtreeSize(0), mFlags(0) {
@@ -88,11 +75,6 @@ class Row
     int32_t             mSubtreeSize;
 
   private:
-    // Hide so that only Create() and Destroy() can be used to
-    // allocate and deallocate from the heap
-    static void* operator new(size_t) CPP_THROW_NEW { return 0; } 
-    static void operator delete(void*, size_t) {}
-
     // State flags
     int8_t		mFlags;
 };
@@ -110,13 +92,6 @@ nsTreeContentView::nsTreeContentView(void) :
   mRoot(nullptr),
   mDocument(nullptr)
 {
-  static const size_t kBucketSizes[] = {
-    sizeof(Row)
-  };
-  static const int32_t kNumBuckets = sizeof(kBucketSizes) / sizeof(size_t);
-  static const int32_t kInitialSize = 16;
-
-  mAllocator.Init("nsTreeContentView", kBucketSizes, kNumBuckets, kInitialSize);
 }
 
 nsTreeContentView::~nsTreeContentView(void)
@@ -1089,7 +1064,7 @@ nsTreeContentView::SerializeItem(nsIContent* aContent, int32_t aParentIndex,
                             nsGkAtoms::_true, eCaseMatters))
     return;
 
-  Row* row = Row::Create(mAllocator, aContent, aParentIndex);
+  Row* row = new Row(aContent, aParentIndex);
   aRows.AppendElement(row);
 
   if (aContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::container,
@@ -1125,7 +1100,7 @@ nsTreeContentView::SerializeSeparator(nsIContent* aContent,
                             nsGkAtoms::_true, eCaseMatters))
     return;
 
-  Row* row = Row::Create(mAllocator, aContent, aParentIndex);
+  Row* row = new Row(aContent, aParentIndex);
   row->SetSeparator(true);
   aRows.AppendElement(row);
 }
@@ -1205,9 +1180,8 @@ nsTreeContentView::RemoveSubtree(int32_t aIndex)
   Row* row = mRows[aIndex];
   int32_t count = row->mSubtreeSize;
 
-  for(int32_t i = 0; i < count; i++) {
-    Row* nextRow = mRows[aIndex + i + 1];
-    Row::Destroy(mAllocator, nextRow);
+  for (int32_t i = 0; i < count; i++) {
+    delete mRows[aIndex + i + 1];
   }
   mRows.RemoveElementsAt(aIndex + 1, count);
 
@@ -1286,15 +1260,14 @@ nsTreeContentView::RemoveRow(int32_t aIndex)
   int32_t count = row->mSubtreeSize + 1;
   int32_t parentIndex = row->mParentIndex;
 
-  Row::Destroy(mAllocator, row);
+  delete row;
   for(int32_t i = 1; i < count; i++) {
-    Row* nextRow = mRows[aIndex + i];
-    Row::Destroy(mAllocator, nextRow);
+    delete mRows[aIndex + i];
   }
   mRows.RemoveElementsAt(aIndex, count);
 
   UpdateSubtreeSizes(parentIndex, -count);
-  
+
   UpdateParentIndexes(aIndex, 0, -count);
 
   return count;
@@ -1303,8 +1276,9 @@ nsTreeContentView::RemoveRow(int32_t aIndex)
 void
 nsTreeContentView::ClearRows()
 {
-  for (uint32_t i = 0; i < mRows.Length(); i++)
-    Row::Destroy(mAllocator, mRows[i]);
+  for (uint32_t i = 0; i < mRows.Length(); i++) {
+    delete mRows[i];
+  }
   mRows.Clear();
   mRoot = nullptr;
   mBody = nullptr;
@@ -1313,7 +1287,7 @@ nsTreeContentView::ClearRows()
     mDocument->RemoveObserver(this);
     mDocument = nullptr;
   }
-} 
+}
 
 void
 nsTreeContentView::OpenContainer(int32_t aIndex)
diff --git a/layout/xul/tree/nsTreeContentView.h b/layout/xul/tree/nsTreeContentView.h
index 450c1723e4d0..83806ae8c729 100644
--- a/layout/xul/tree/nsTreeContentView.h
+++ b/layout/xul/tree/nsTreeContentView.h
@@ -6,7 +6,6 @@
 #ifndef nsTreeContentView_h__
 #define nsTreeContentView_h__
 
-#include "nsFixedSizeAllocator.h"
 #include "nsTArray.h"
 #include "nsIDocument.h"
 #include "nsStubDocumentObserver.h"
@@ -94,7 +93,6 @@ class nsTreeContentView MOZ_FINAL : public nsINativeTreeView,
     nsCOMPtr<nsIContent>                mRoot;
     nsCOMPtr<nsIContent>                mBody;
     nsIDocument*                        mDocument;      // WEAK
-    nsFixedSizeAllocator                mAllocator;
     nsTArray<Row*>                      mRows;
 };
 
diff --git a/media/libcubeb/README_MOZILLA b/media/libcubeb/README_MOZILLA
index 9a7db32d51b7..7232df158623 100644
--- a/media/libcubeb/README_MOZILLA
+++ b/media/libcubeb/README_MOZILLA
@@ -5,4 +5,4 @@ Makefile.in build files for the Mozilla build system.
 
 The cubeb git repository is: git://github.com/kinetiknz/cubeb.git
 
-The git commit ID used was b56cf57ceb0bf4c9f675fe977b457b54d1a8e08b.
+The git commit ID used was f2d524c34b6f75d85053034c3075c2ff08383769.
diff --git a/media/libcubeb/include/cubeb.h b/media/libcubeb/include/cubeb.h
index f6c014766c0a..4494a6eb304b 100644
--- a/media/libcubeb/include/cubeb.h
+++ b/media/libcubeb/include/cubeb.h
@@ -101,12 +101,33 @@ typedef enum {
 #endif
 } cubeb_sample_format;
 
+#if defined(__ANDROID__)
+typedef enum {
+    CUBEB_STREAM_TYPE_VOICE_CALL = 0,
+    CUBEB_STREAM_TYPE_SYSTEM = 1,
+    CUBEB_STREAM_TYPE_RING = 2,
+    CUBEB_STREAM_TYPE_MUSIC = 3,
+    CUBEB_STREAM_TYPE_ALARM = 4,
+    CUBEB_STREAM_TYPE_NOTIFICATION = 5,
+    CUBEB_STREAM_TYPE_BLUETOOTH_SCO = 6,
+    CUBEB_STREAM_TYPE_ENFORCED_AUDIBLE = 7,
+    CUBEB_STREAM_TYPE_DTMF = 8,
+    CUBEB_STREAM_TYPE_TTS = 9,
+    CUBEB_STREAM_TYPE_FM = 10,
+
+    CUBEB_STREAM_TYPE_MAX
+} cubeb_stream_type;
+#endif
+
 /** Stream format initialization parameters. */
 typedef struct {
   cubeb_sample_format format; /**< Requested sample format.  One of
                                    #cubeb_sample_format. */
   unsigned int rate;          /**< Requested sample rate.  Valid range is [1, 192000]. */
   unsigned int channels;      /**< Requested channel count.  Valid range is [1, 32]. */
+#if defined(__ANDROID__)
+  cubeb_stream_type stream_type; /**< Used to map Android audio stream types */
+#endif
 } cubeb_stream_params;
 
 /** Stream states signaled via state_callback. */
diff --git a/media/libcubeb/src/cubeb_opensl.c b/media/libcubeb/src/cubeb_opensl.c
index 31c93d5b8e4c..ffeca02f3b66 100644
--- a/media/libcubeb/src/cubeb_opensl.c
+++ b/media/libcubeb/src/cubeb_opensl.c
@@ -9,6 +9,9 @@
 #include <dlfcn.h>
 #include <stdlib.h>
 #include <SLES/OpenSLES.h>
+#if defined(__ANDROID__)
+#include <SLES/OpenSLES_Android.h>
+#endif
 #include "cubeb/cubeb.h"
 #include "cubeb-internal.h"
 
@@ -19,11 +22,15 @@ struct cubeb {
   void * lib;
   SLInterfaceID SL_IID_BUFFERQUEUE;
   SLInterfaceID SL_IID_PLAY;
+#if defined(__ANDROID__)
+  SLInterfaceID SL_IID_ANDROIDCONFIGURATION;
+#endif
   SLObjectItf engObj;
   SLEngineItf eng;
   SLObjectItf outmixObj;
 };
 
+#define NELEMS(A) (sizeof(A) / sizeof A[0])
 #define NBUFS 4
 
 struct cubeb_stream {
@@ -80,6 +87,30 @@ bufferqueue_callback(SLBufferQueueItf caller, struct cubeb_stream *stm)
   }
 }
 
+#if defined(__ANDROID__)
+static SLuint32
+convert_stream_type_to_sl_stream(cubeb_stream_type stream_type)
+{
+  switch(stream_type) {
+    case CUBEB_STREAM_TYPE_SYSTEM:
+      return SL_ANDROID_STREAM_SYSTEM;
+    case CUBEB_STREAM_TYPE_MUSIC:
+      return SL_ANDROID_STREAM_MEDIA;
+    case CUBEB_STREAM_TYPE_NOTIFICATION:
+      return SL_ANDROID_STREAM_NOTIFICATION;
+    case CUBEB_STREAM_TYPE_ALARM:
+      return SL_ANDROID_STREAM_ALARM;
+    case CUBEB_STREAM_TYPE_VOICE_CALL:
+      return SL_ANDROID_STREAM_VOICE;
+    case CUBEB_STREAM_TYPE_RING:
+      return SL_ANDROID_STREAM_RING;
+    case CUBEB_STREAM_TYPE_ENFORCED_AUDIBLE:
+    default:
+      return 0xFFFFFFFF;
+  }
+}
+#endif
+
 static void opensl_destroy(cubeb * ctx);
 
 /*static*/ int
@@ -109,11 +140,17 @@ opensl_init(cubeb ** context, char const * context_name)
   SLInterfaceID SL_IID_ENGINE = *(SLInterfaceID *)dlsym(ctx->lib, "SL_IID_ENGINE");
   SLInterfaceID SL_IID_OUTPUTMIX = *(SLInterfaceID *)dlsym(ctx->lib, "SL_IID_OUTPUTMIX");
   ctx->SL_IID_BUFFERQUEUE = *(SLInterfaceID *)dlsym(ctx->lib, "SL_IID_BUFFERQUEUE");
+#if defined(__ANDROID__)
+  ctx->SL_IID_ANDROIDCONFIGURATION = *(SLInterfaceID *)dlsym(ctx->lib, "SL_IID_ANDROIDCONFIGURATION");
+#endif
   ctx->SL_IID_PLAY = *(SLInterfaceID *)dlsym(ctx->lib, "SL_IID_PLAY");
   if (!f_slCreateEngine ||
       !SL_IID_ENGINE ||
       !SL_IID_OUTPUTMIX ||
       !ctx->SL_IID_BUFFERQUEUE ||
+#if defined(__ANDROID__)
+      !ctx->SL_IID_ANDROIDCONFIGURATION ||
+#endif
       !ctx->SL_IID_PLAY) {
     opensl_destroy(ctx);
     return CUBEB_ERROR;
@@ -252,15 +289,36 @@ opensl_stream_init(cubeb * ctx, cubeb_stream ** stream, char const * stream_name
   sink.pLocator = &loc_outmix;
   sink.pFormat = NULL;
 
+#if defined(__ANDROID__)
+  const SLInterfaceID ids[] = {ctx->SL_IID_BUFFERQUEUE, ctx->SL_IID_ANDROIDCONFIGURATION};
+  const SLboolean req[] = {SL_BOOLEAN_TRUE, SL_BOOLEAN_TRUE};
+#else
   const SLInterfaceID ids[] = {ctx->SL_IID_BUFFERQUEUE};
   const SLboolean req[] = {SL_BOOLEAN_TRUE};
+#endif
+  assert(NELEMS(ids) == NELEMS(req));
   SLresult res = (*ctx->eng)->CreateAudioPlayer(ctx->eng, &stm->playerObj,
-                                                &source, &sink, 1, ids, req);
+                                                &source, &sink, NELEMS(ids), ids, req);
   if (res != SL_RESULT_SUCCESS) {
     opensl_stream_destroy(stm);
     return CUBEB_ERROR;
   }
 
+#if defined(__ANDROID__)
+  SLuint32 stream_type = convert_stream_type_to_sl_stream(stream_params.stream_type);
+  if (stream_type != 0xFFFFFFFF) {
+    SLAndroidConfigurationItf playerConfig;
+    res = (*stm->playerObj)->GetInterface(stm->playerObj,
+          ctx->SL_IID_ANDROIDCONFIGURATION, &playerConfig);
+    res = (*playerConfig)->SetConfiguration(playerConfig,
+          SL_ANDROID_KEY_STREAM_TYPE, &stream_type, sizeof(SLint32));
+    if (res != SL_RESULT_SUCCESS) {
+      opensl_stream_destroy(stm);
+      return CUBEB_ERROR;
+    }
+  }
+#endif
+
   res = (*stm->playerObj)->Realize(stm->playerObj, SL_BOOLEAN_FALSE);
   if (res != SL_RESULT_SUCCESS) {
     opensl_stream_destroy(stm);
diff --git a/mobile/android/app/mobile.js b/mobile/android/app/mobile.js
index a7cd099c423d..64c52fdc01a6 100644
--- a/mobile/android/app/mobile.js
+++ b/mobile/android/app/mobile.js
@@ -384,9 +384,6 @@ pref("privacy.item.geolocation", true);
 pref("privacy.item.siteSettings", true);
 pref("privacy.item.syncAccount", true);
 
-// URL to the Learn More link XXX this is the firefox one.  Bug 495578 fixes this.
-pref("browser.geolocation.warning.infoURL", "http://www.mozilla.com/%LOCALE%/firefox/geolocation/");
-
 // enable geo
 pref("geo.enabled", true);
 
diff --git a/mobile/android/base/AlertNotification.java b/mobile/android/base/AlertNotification.java
index bed77c650b94..7e92b3fb5c35 100644
--- a/mobile/android/base/AlertNotification.java
+++ b/mobile/android/base/AlertNotification.java
@@ -28,26 +28,50 @@ public class AlertNotification
     private final String mText;
     private final NotificationManager mNotificationManager;
 
-    private boolean mProgressStyle; // = false
+    private boolean mProgressStyle;
     private double mPrevPercent  = -1;
     private String mPrevAlertText = "";
 
     private static final double UPDATE_THRESHOLD = .01;
+    private Context mContext;
 
     public AlertNotification(Context aContext, int aNotificationId, int aIcon,
-                             String aTitle, String aText, long aWhen) {
+                             String aTitle, String aText, long aWhen, Uri aIconUri) {
         super(aIcon, (aText.length() > 0) ? aText : aTitle, aWhen);
 
         mIcon = aIcon;
         mTitle = aTitle;
         mText = aText;
         mId = aNotificationId;
+        mContext = aContext;
 
-        mNotificationManager = (NotificationManager)
-            aContext.getSystemService(Context.NOTIFICATION_SERVICE);
+        mNotificationManager = (NotificationManager) aContext.getSystemService(Context.NOTIFICATION_SERVICE);
+
+        if (aIconUri == null || aIconUri.getScheme() == null)
+            return;
+
+        // Custom view
+        int layout = R.layout.notification_icon_text;
+        RemoteViews view = new RemoteViews(mContext.getPackageName(), layout);
+        try {
+            URL url = new URL(aIconUri.toString());
+            Bitmap bm = BitmapFactory.decodeStream(url.openStream());
+            view.setImageViewBitmap(R.id.notification_image, bm);
+            view.setTextViewText(R.id.notification_title, mTitle);
+            if (mText.length() > 0) {
+                view.setTextViewText(R.id.notification_text, mText);
+            }
+            contentView = view;
+        } catch (Exception e) {
+            Log.e(LOGTAG, "failed to create bitmap", e);
+        }
     }
 
-    public boolean isProgressStyle() {
+    public int getId() {
+        return mId;
+    }
+
+    public synchronized boolean isProgressStyle() {
         return mProgressStyle;
     }
 
@@ -59,34 +83,12 @@ public class AlertNotification
         mNotificationManager.cancel(mId);
     }
 
-    public void setCustomIcon(Uri aIconUri) {
-        if (aIconUri == null || aIconUri.getScheme() == null)
-            return;
-
-        // Custom view
-        int layout = R.layout.notification_icon_text;
-        RemoteViews view = new RemoteViews(GeckoApp.mAppContext.getPackageName(), layout);
-        try {
-            URL url = new URL(aIconUri.toString());
-            Bitmap bm = BitmapFactory.decodeStream(url.openStream());
-            view.setImageViewBitmap(R.id.notification_image, bm);
-            view.setTextViewText(R.id.notification_title, mTitle);
-            if (mText.length() > 0) {
-                view.setTextViewText(R.id.notification_text, mText);
-            }
-            contentView = view;
-            mNotificationManager.notify(mId, this); 
-        } catch(Exception ex) {
-            Log.e(LOGTAG, "failed to create bitmap", ex);
-        }
-    }
-
-    public void updateProgress(String aAlertText, long aProgress, long aProgressMax) {
+    public synchronized void updateProgress(String aAlertText, long aProgress, long aProgressMax) {
         if (!mProgressStyle) {
             // Custom view
             int layout =  aAlertText.length() > 0 ? R.layout.notification_progress_text : R.layout.notification_progress;
 
-            RemoteViews view = new RemoteViews(GeckoApp.mAppContext.getPackageName(), layout);
+            RemoteViews view = new RemoteViews(mContext.getPackageName(), layout);
             view.setImageViewResource(R.id.notification_image, mIcon);
             view.setTextViewText(R.id.notification_title, mTitle);
             contentView = view;
diff --git a/mobile/android/base/AndroidManifest.xml.in b/mobile/android/base/AndroidManifest.xml.in
index 0ecad1bbcb4a..8515f69e55c8 100644
--- a/mobile/android/base/AndroidManifest.xml.in
+++ b/mobile/android/base/AndroidManifest.xml.in
@@ -273,6 +273,11 @@
             android:process="@MANGLED_ANDROID_PACKAGE_NAME@.UpdateService">
         </service>
 
+        <service
+            android:exported="false"
+            android:name="org.mozilla.gecko.NotificationService">
+        </service>
+
 
 #include ../services/manifests/AnnouncementsAndroidManifest_services.xml.in
 #include ../services/manifests/SyncAndroidManifest_services.xml.in
diff --git a/mobile/android/base/AwesomeBar.java b/mobile/android/base/AwesomeBar.java
index ff534b3a84d4..f8ed70df8dab 100644
--- a/mobile/android/base/AwesomeBar.java
+++ b/mobile/android/base/AwesomeBar.java
@@ -272,7 +272,7 @@ public class AwesomeBar extends GeckoActivity {
         if (showReadingList) {
             BookmarksTab bookmarksTab = mAwesomeTabs.getBookmarksTab();
             bookmarksTab.setShowReadingList(true);
-            mAwesomeTabs.setCurrentTabByTag(bookmarksTab.getTag());
+            mAwesomeTabs.setCurrentItemByTag(bookmarksTab.getTag());
         }
     }
 
diff --git a/mobile/android/base/AwesomeBarTabs.java b/mobile/android/base/AwesomeBarTabs.java
index 55f7bbabe9d4..b51ef5d3b806 100644
--- a/mobile/android/base/AwesomeBarTabs.java
+++ b/mobile/android/base/AwesomeBarTabs.java
@@ -173,7 +173,7 @@ public class AwesomeBarTabs extends TabHost
 
         styleSelectedTab();
 
-        // Initialize "App Pages" list with no filter
+        // Initialize "All Pages" list with no filter
         filter("");
     }
 
@@ -199,6 +199,15 @@ public class AwesomeBarTabs extends TabHost
         styleSelectedTab();
     }
 
+    public void setCurrentItemByTag(String tag) {
+        for (int i = 0; i < mTabs.length; i++) {
+            if (tag.equals(mTabs[i].getTag())) {
+                mViewPager.setCurrentItem(i);
+                break;
+            }
+        }
+    }
+
     private void styleSelectedTab() {
         int selIndex = mViewPager.getCurrentItem();
         TabWidget tabWidget = getTabWidget();
diff --git a/mobile/android/base/BrowserApp.java b/mobile/android/base/BrowserApp.java
index 771933badc66..0c9303273af3 100644
--- a/mobile/android/base/BrowserApp.java
+++ b/mobile/android/base/BrowserApp.java
@@ -35,6 +35,7 @@ import android.nfc.NfcEvent;
 import android.os.Build;
 import android.os.Bundle;
 import android.util.Log;
+import android.view.InputDevice;
 import android.view.KeyEvent;
 import android.view.LayoutInflater;
 import android.view.Menu;
@@ -56,7 +57,8 @@ import java.util.Vector;
 
 abstract public class BrowserApp extends GeckoApp
                                  implements TabsPanel.TabsLayoutChangeListener,
-                                            PropertyAnimator.PropertyAnimationListener {
+                                            PropertyAnimator.PropertyAnimationListener,
+                                            View.OnKeyListener {
     private static final String LOGTAG = "GeckoBrowserApp";
 
     private static final String PREF_CHROME_DYNAMICTOOLBAR = "browser.chrome.dynamictoolbar";
@@ -289,6 +291,48 @@ abstract public class BrowserApp extends GeckoApp
         return super.onInterceptTouchEvent(view, event);
     }
 
+    @Override
+    public boolean onKey(View v, int keyCode, KeyEvent event) {
+        // Global onKey handler. This is called if the focused UI doesn't
+        // handle the key event, and before Gecko swallows the events.
+        if (event.getAction() != KeyEvent.ACTION_DOWN) {
+            return false;
+        }
+
+        // Toggle/focus the address bar on gamepad-y button.
+        if (keyCode == KeyEvent.KEYCODE_BUTTON_Y &&
+            (event.getSource() & InputDevice.SOURCE_GAMEPAD) == InputDevice.SOURCE_GAMEPAD) {
+            mToolbarLocked = true;
+            if (mBrowserToolbar.isVisible()) {
+                if (mDynamicToolbarEnabled &&
+                    Boolean.FALSE.equals(mAboutHomeShowing)) {
+                    mBrowserToolbar.animateVisibility(false, 0);
+                    mLayerView.requestFocus();
+                } else {
+                    // Just focus the address bar when about:home is visible
+                    // or when the dynamic toolbar isn't enabled.
+                    mBrowserToolbar.requestFocusFromTouch();
+                }
+            } else {
+                mBrowserToolbar.animateVisibility(true, 0);
+                mBrowserToolbar.requestFocusFromTouch();
+            }
+
+            return true;
+        }
+
+        return false;
+    }
+
+    @Override
+    public boolean onKeyDown(int keyCode, KeyEvent event) {
+        if (onKey(null, keyCode, event)) {
+            return true;
+        }
+
+        return super.onKeyDown(keyCode, event);
+    }
+
     void handleReaderAdded(boolean success, final String title, final String url) {
         if (!success) {
             showToast(R.string.reading_list_failed, Toast.LENGTH_SHORT);
@@ -343,6 +387,9 @@ abstract public class BrowserApp extends GeckoApp
         mBrowserToolbar = new BrowserToolbar(this);
         mBrowserToolbar.from(actionBar);
 
+        // Intercept key events for gamepad shortcuts
+        actionBar.setOnKeyListener(this);
+
         if (mTabsPanel != null) {
             mTabsPanel.setTabsLayoutChangeListener(this);
             updateSideBarState();
@@ -474,6 +521,9 @@ abstract public class BrowserApp extends GeckoApp
                 Tabs.getInstance().loadUrl(uri, flags);
             }
         }
+
+        // Intercept key events for gamepad shortcuts
+        mLayerView.setOnKeyListener(this);
     }
 
     public void setToolbarHeight(int aHeight, int aVisibleHeight) {
@@ -798,7 +848,7 @@ abstract public class BrowserApp extends GeckoApp
     }
 
     private void showTabs(TabsPanel.Panel panel) {
-        if (Tabs.getInstance().getCount() == 0)
+        if (Tabs.getInstance().getDisplayCount() == 0)
             return;
 
         mTabsPanel.show(panel);
diff --git a/mobile/android/base/BrowserToolbar.java b/mobile/android/base/BrowserToolbar.java
index bcc2dbda6484..85df9990ff53 100644
--- a/mobile/android/base/BrowserToolbar.java
+++ b/mobile/android/base/BrowserToolbar.java
@@ -449,7 +449,7 @@ public class BrowserToolbar implements ViewSwitcher.ViewFactory,
                 }
                 break;
             case RESTORED:
-                updateTabCount(Tabs.getInstance().getCount());
+                updateTabCount(Tabs.getInstance().getDisplayCount());
                 break;
             case SELECTED:
                 mAnimateSiteSecurity = false;
@@ -463,7 +463,7 @@ public class BrowserToolbar implements ViewSwitcher.ViewFactory,
                 break;
             case CLOSED:
             case ADDED:
-                updateTabCountAndAnimate(Tabs.getInstance().getCount());
+                updateTabCountAndAnimate(Tabs.getInstance().getDisplayCount());
                 if (Tabs.getInstance().isSelectedTab(tab)) {
                     updateBackButton(tab.canDoBack());
                     updateForwardButton(tab.canDoForward());
@@ -1158,7 +1158,7 @@ public class BrowserToolbar implements ViewSwitcher.ViewFactory,
     }
 
     public void requestFocusFromTouch() {
-        mLayout.requestFocusFromTouch();
+        mAwesomeBar.requestFocusFromTouch();
     }
 
     public void updateBackButton(boolean enabled) {
@@ -1313,7 +1313,7 @@ public class BrowserToolbar implements ViewSwitcher.ViewFactory,
             setSecurityMode(tab.getSecurityMode());
             setReaderMode(tab.getReaderEnabled());
             setShadowVisibility(true);
-            updateTabCount(Tabs.getInstance().getCount());
+            updateTabCount(Tabs.getInstance().getDisplayCount());
             updateBackButton(tab.canDoBack());
             updateForwardButton(tab.canDoForward());
 
diff --git a/mobile/android/base/Divider.java b/mobile/android/base/Divider.java
new file mode 100644
index 000000000000..68c39efdac10
--- /dev/null
+++ b/mobile/android/base/Divider.java
@@ -0,0 +1,40 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko;
+
+import android.content.Context;
+import android.content.res.TypedArray;
+import android.util.AttributeSet;
+import android.view.View;
+import android.widget.LinearLayout.LayoutParams;
+
+public class Divider extends View {
+    public static enum Orientation { HORIZONTAL, VERTICAL };
+
+    // Orientation of the divider.
+    private Orientation mOrientation;
+
+    // Density of the device.
+    private int mDensity;
+
+    public Divider(Context context, AttributeSet attrs) {
+        super(context, attrs);
+
+        mDensity = (int) context.getResources().getDisplayMetrics().density;
+
+        setOrientation(Orientation.HORIZONTAL);
+    }
+
+    public void setOrientation(Orientation orientation) {
+        if (mOrientation != orientation) {
+            mOrientation = orientation;
+
+            if (mOrientation == Orientation.HORIZONTAL)
+                setLayoutParams(new LayoutParams(LayoutParams.FILL_PARENT, mDensity));
+            else
+                setLayoutParams(new LayoutParams(mDensity, LayoutParams.FILL_PARENT));
+        }
+    }
+}
diff --git a/mobile/android/base/DoorHanger.java b/mobile/android/base/DoorHanger.java
index 26192db85bd1..36f1669f7368 100644
--- a/mobile/android/base/DoorHanger.java
+++ b/mobile/android/base/DoorHanger.java
@@ -39,6 +39,9 @@ public class DoorHanger extends LinearLayout implements Button.OnClickListener {
     // Optional checkbox added underneath message text
     private CheckBox mCheckBox;
 
+    // Divider between doorhangers.
+    private View mDivider;
+
     private int mPersistence = 0;
     private boolean mPersistWhileVisible = false;
     private long mTimeout = 0;
@@ -60,10 +63,17 @@ public class DoorHanger extends LinearLayout implements Button.OnClickListener {
         return mValue;
     }
 
+    public void showDivider() {
+        mDivider.setVisibility(View.VISIBLE);
+    }
+
+    public void hideDivider() {
+        mDivider.setVisibility(View.GONE);
+    }
+
     // Postpone stuff that needs to be done on the main thread
     void init(String message, JSONArray buttons, JSONObject options) {
         setOrientation(VERTICAL);
-        setBackgroundResource(R.drawable.doorhanger_shadow_bg);
 
         LayoutInflater.from(mActivity).inflate(R.layout.doorhanger, this);
         setVisibility(View.GONE);
@@ -73,6 +83,8 @@ public class DoorHanger extends LinearLayout implements Button.OnClickListener {
 
         mChoicesLayout = (LinearLayout) findViewById(R.id.doorhanger_choices);
 
+        mDivider = findViewById(R.id.divider_doorhanger);
+
         // Set the doorhanger text and buttons
         for (int i = 0; i < buttons.length(); i++) {
             try {
@@ -87,7 +99,8 @@ public class DoorHanger extends LinearLayout implements Button.OnClickListener {
 
         // Enable the button layout if we have buttons.
         if (buttons.length() > 0) {
-            mChoicesLayout.setVisibility(LinearLayout.VISIBLE);
+            findViewById(R.id.divider_choices).setVisibility(View.VISIBLE);
+            mChoicesLayout.setVisibility(View.VISIBLE);
         }
 
         setOptions(options);
@@ -99,11 +112,19 @@ public class DoorHanger extends LinearLayout implements Button.OnClickListener {
                                              LayoutParams.FILL_PARENT,
                                              1.0f);
 
-        Button mButton = new Button(mActivity);
-        mButton.setText(aText);
-        mButton.setTag(Integer.toString(aCallback));
-        mButton.setOnClickListener(this);
-        mChoicesLayout.addView(mButton, mLayoutParams);
+        Button button = (Button) LayoutInflater.from(mActivity).inflate(R.layout.doorhanger_button, null);
+        button.setText(aText);
+        button.setTag(Integer.toString(aCallback));
+        button.setOnClickListener(this);
+
+        if (mChoicesLayout.getChildCount() > 0) {
+            Divider divider = new Divider(mActivity, null);
+            divider.setOrientation(Divider.Orientation.VERTICAL);
+            divider.setBackgroundColor(0xFFD1D5DA);
+            mChoicesLayout.addView(divider);
+        }
+
+        mChoicesLayout.addView(button, mLayoutParams);
     }
 
     @Override
diff --git a/mobile/android/base/DoorHangerPopup.java b/mobile/android/base/DoorHangerPopup.java
index a0e55ca78140..f71283afec2f 100644
--- a/mobile/android/base/DoorHangerPopup.java
+++ b/mobile/android/base/DoorHangerPopup.java
@@ -34,6 +34,7 @@ public class DoorHangerPopup extends PopupWindow
     private boolean mInflated; 
     private ImageView mArrow;
     private int mArrowWidth;
+    private int mYOffset;
 
     // Stores a set of all active DoorHanger notifications. A DoorHanger is
     // uniquely identified by its tabId and value.
@@ -45,7 +46,8 @@ public class DoorHangerPopup extends PopupWindow
         mAnchor = aAnchor;
 
         mInflated = false;
-        mArrowWidth = aActivity.getResources().getDimensionPixelSize(R.dimen.doorhanger_arrow_width);
+        mArrowWidth = aActivity.getResources().getDimensionPixelSize(R.dimen.menu_popup_arrow_width);
+        mYOffset = aActivity.getResources().getDimensionPixelSize(R.dimen.menu_popup_offset);
         mDoorHangers = new HashSet<DoorHanger>();
 
         registerEventListener("Doorhanger:Add");
@@ -257,7 +259,7 @@ public class DoorHangerPopup extends PopupWindow
             return;
         }
 
-        fixBackgroundForFirst();
+        showDividers();
         if (isShowing()) {
             update();
             return;
@@ -274,19 +276,20 @@ public class DoorHangerPopup extends PopupWindow
         // arrow position is determined by its left margin.
         int offset = mActivity.isTablet() ? mAnchor.getWidth()/2 - mArrowWidth/2 -
                      ((RelativeLayout.LayoutParams) mArrow.getLayoutParams()).leftMargin : 0;
-        showAsDropDown(mAnchor, offset, 0);
+        showAsDropDown(mAnchor, offset, -mYOffset);
         // Make the popup focusable for keyboard accessibility.
         setFocusable(true);
     }
 
-    private void fixBackgroundForFirst() {
-        for (int i = 0; i < mContent.getChildCount(); i++) {
+    private void showDividers() {
+        int count = mContent.getChildCount();
+
+        for (int i = 0; i < count; i++) {
             DoorHanger dh = (DoorHanger) mContent.getChildAt(i);
-            if (dh.getVisibility() == View.VISIBLE) {
-                dh.setBackgroundResource(R.drawable.doorhanger_bg);
-                break;
-            }
+            dh.showDivider();
         }
+
+        ((DoorHanger) mContent.getChildAt(count-1)).hideDivider();
     }
 
     private void registerEventListener(String event) {
diff --git a/mobile/android/base/GeckoApp.java b/mobile/android/base/GeckoApp.java
index 52e1c95b25db..ea1d36deba2c 100644
--- a/mobile/android/base/GeckoApp.java
+++ b/mobile/android/base/GeckoApp.java
@@ -1094,7 +1094,7 @@ abstract public class GeckoApp
         final String fileName = aSrc.substring(aSrc.lastIndexOf("/") + 1);
         final PendingIntent emptyIntent = PendingIntent.getActivity(mAppContext, 0, new Intent(), 0);
         final AlertNotification notification = new AlertNotification(mAppContext, fileName.hashCode(), 
-                                R.drawable.alert_download, fileName, progText, System.currentTimeMillis() );
+                                R.drawable.alert_download, fileName, progText, System.currentTimeMillis(), null);
         notification.setLatestEventInfo(mAppContext, fileName, progText, emptyIntent );
         notification.flags |= Notification.FLAG_ONGOING_EVENT;
         notification.show();
@@ -1324,8 +1324,8 @@ abstract public class GeckoApp
     public boolean isSmallTablet() {
         if (sIsSmallTablet == null) {
             int screenLayout = getResources().getConfiguration().screenLayout;
-            return (Build.VERSION.SDK_INT >= 11 &&
-                    ((screenLayout & Configuration.SCREENLAYOUT_SIZE_MASK) == Configuration.SCREENLAYOUT_SIZE_LARGE));
+            sIsSmallTablet = (Build.VERSION.SDK_INT >= 11 &&
+                              ((screenLayout & Configuration.SCREENLAYOUT_SIZE_MASK) == Configuration.SCREENLAYOUT_SIZE_LARGE));
         }
 
         return sIsSmallTablet;
@@ -1677,8 +1677,6 @@ abstract public class GeckoApp
             }
         });
 
-        final GeckoApp self = this;
-
         // End of the startup of our Java App
         mJavaUiStartupTimer.stop();
 
@@ -1731,8 +1729,9 @@ abstract public class GeckoApp
             } else {
                 onSearchRequested();
             }
+        } else if (ACTION_ALERT_CALLBACK.equals(action)) {
+            processAlertCallback(intent);
         }
-
     }
 
     public GeckoProfile getProfile() {
@@ -1820,6 +1819,21 @@ abstract public class GeckoApp
         }
     }
 
+    private void processAlertCallback(Intent intent) {
+        String alertName = "";
+        String alertCookie = "";
+        Uri data = intent.getData();
+        if (data != null) {
+            alertName = data.getQueryParameter("name");
+            if (alertName == null)
+                alertName = "";
+            alertCookie = data.getQueryParameter("cookie");
+            if (alertCookie == null)
+                alertCookie = "";
+        }
+        handleNotification(ACTION_ALERT_CALLBACK, alertName, alertCookie);
+    }
+
     @Override
     protected void onNewIntent(Intent intent) {
         if (GeckoThread.checkLaunchState(GeckoThread.LaunchState.GeckoExiting)) {
@@ -1860,18 +1874,7 @@ abstract public class GeckoApp
             String uri = getURIFromIntent(intent);
             GeckoAppShell.sendEventToGecko(GeckoEvent.createURILoadEvent(uri));
         } else if (ACTION_ALERT_CALLBACK.equals(action)) {
-            String alertName = "";
-            String alertCookie = "";
-            Uri data = intent.getData();
-            if (data != null) {
-                alertName = data.getQueryParameter("name");
-                if (alertName == null)
-                    alertName = "";
-                alertCookie = data.getQueryParameter("cookie");
-                if (alertCookie == null)
-                    alertCookie = "";
-            }
-            handleNotification(ACTION_ALERT_CALLBACK, alertName, alertCookie);
+            processAlertCallback(intent);
         } else if (ACTION_WIDGET.equals(action)) {
             addTab();
         }
@@ -2012,11 +2015,6 @@ abstract public class GeckoApp
     @Override
     public void onDestroy()
     {
-        // Tell Gecko to shutting down; we'll end up calling System.exit()
-        // in onXreExit.
-        if (isFinishing())
-            GeckoAppShell.sendEventToGecko(GeckoEvent.createShutdownEvent());
-
         unregisterEventListener("log");
         unregisterEventListener("Reader:Added");
         unregisterEventListener("Reader:Removed");
@@ -2173,7 +2171,12 @@ abstract public class GeckoApp
     }
 
     public void handleNotification(String action, String alertName, String alertCookie) {
-        GeckoAppShell.handleNotification(action, alertName, alertCookie);
+        // If Gecko isn't running yet, we ignore the notification. Note that
+        // even if Gecko is running but it was restarted since the notification
+        // was created, the notification won't be handled (bug 849653).
+        if (GeckoThread.checkLaunchState(GeckoThread.LaunchState.GeckoRunning)) {
+            GeckoAppShell.handleNotification(action, alertName, alertCookie);
+        }
     }
 
     private void checkMigrateProfile() {
diff --git a/mobile/android/base/GeckoAppShell.java b/mobile/android/base/GeckoAppShell.java
index f3b6f35ac399..a426d4d98bc3 100644
--- a/mobile/android/base/GeckoAppShell.java
+++ b/mobile/android/base/GeckoAppShell.java
@@ -80,10 +80,8 @@ import java.io.InputStreamReader;
 import java.io.OutputStream;
 import java.io.PrintWriter;
 import java.io.StringWriter;
-import java.lang.reflect.Field;
 import java.net.URL;
 import java.nio.ByteBuffer;
-import java.util.HashMap;
 import java.util.Iterator;
 import java.util.LinkedList;
 import java.util.List;
@@ -111,9 +109,6 @@ public class GeckoAppShell
 
     static private GeckoEditableListener mEditableListener = null;
 
-    static private final HashMap<Integer, AlertNotification>
-        mAlertNotifications = new HashMap<Integer, AlertNotification>();
-
     /* Keep in sync with constants found here:
       http://mxr.mozilla.org/mozilla-central/source/uriloader/base/nsIWebProgressListener.idl
     */
@@ -157,6 +152,7 @@ public class GeckoAppShell
     private static Handler sGeckoHandler;
 
     static ActivityHandlerHelper sActivityHelper = new ActivityHandlerHelper();
+    static NotificationServiceClient sNotificationClient;
 
     /* The Android-side API: API methods that Android calls */
 
@@ -1185,6 +1181,14 @@ public class GeckoAppShell
             }});
     }
 
+    public static void setNotificationClient(NotificationServiceClient client) {
+        if (sNotificationClient == null) {
+            sNotificationClient = client;
+        } else {
+            Log.w(LOGTAG, "Notification client already set");
+        }
+    }
+
     public static void showAlertNotification(String aImageUrl, String aAlertTitle, String aAlertText,
                                              String aAlertCookie, String aAlertName) {
         Log.d(LOGTAG, "GeckoAppShell.showAlertNotification\n" +
@@ -1194,72 +1198,41 @@ public class GeckoAppShell
             "- cookie = '" + aAlertCookie +"'\n" +
             "- name = '" + aAlertName + "'");
 
-        int icon = R.drawable.ic_status_logo;
-
-        Uri imageUri = Uri.parse(aImageUrl);
-        String scheme = imageUri.getScheme();
-        if ("drawable".equals(scheme)) {
-            String resource = imageUri.getSchemeSpecificPart();
-            resource = resource.substring(resource.lastIndexOf('/') + 1);
-            try {
-                Class<R.drawable> drawableClass = R.drawable.class;
-                Field f = drawableClass.getField(resource);
-                icon = f.getInt(null);
-            } catch (Exception e) {} // just means the resource doesn't exist
-            imageUri = null;
-        }
-
-        int notificationID = aAlertName.hashCode();
-
-        // Remove the old notification with the same ID, if any
-        removeNotification(notificationID);
-
-        AlertNotification notification = 
-            new AlertNotification(GeckoApp.mAppContext,notificationID, icon, 
-                                  aAlertTitle, aAlertText, 
-                                  System.currentTimeMillis());
-
         // The intent to launch when the user clicks the expanded notification
         Intent notificationIntent = new Intent(GeckoApp.ACTION_ALERT_CLICK);
         notificationIntent.setClassName(GeckoApp.mAppContext,
             GeckoApp.mAppContext.getPackageName() + ".NotificationHandler");
 
+        int notificationID = aAlertName.hashCode();
+
         // Put the strings into the intent as an URI "alert:?name=<alertName>&app=<appName>&cookie=<cookie>"
         Uri.Builder b = new Uri.Builder();
         String app = GeckoApp.mAppContext.getClass().getName();
-        Uri dataUri = b.scheme("alert")
-                                 .path(Integer.toString(notificationID))
-                                 .appendQueryParameter("name", aAlertName)
-                                 .appendQueryParameter("app", app)
-                                 .appendQueryParameter("cookie", aAlertCookie)
-                                 .build();
+        Uri dataUri = b.scheme("alert").path(Integer.toString(notificationID))
+                                       .appendQueryParameter("name", aAlertName)
+                                       .appendQueryParameter("app", app)
+                                       .appendQueryParameter("cookie", aAlertCookie)
+                                       .build();
         notificationIntent.setData(dataUri);
-
         PendingIntent contentIntent = PendingIntent.getBroadcast(GeckoApp.mAppContext, 0, notificationIntent, 0);
-        notification.setLatestEventInfo(GeckoApp.mAppContext, aAlertTitle, aAlertText, contentIntent);
-        notification.setCustomIcon(imageUri);
+
         // The intent to execute when the status entry is deleted by the user with the "Clear All Notifications" button
         Intent clearNotificationIntent = new Intent(GeckoApp.ACTION_ALERT_CLEAR);
         clearNotificationIntent.setClassName(GeckoApp.mAppContext,
             GeckoApp.mAppContext.getPackageName() + ".NotificationHandler");
         clearNotificationIntent.setData(dataUri);
-        notification.deleteIntent = PendingIntent.getBroadcast(GeckoApp.mAppContext, 0, clearNotificationIntent, 0);
+        PendingIntent clearIntent = PendingIntent.getBroadcast(GeckoApp.mAppContext, 0, clearNotificationIntent, 0);
 
-        mAlertNotifications.put(notificationID, notification);
-
-        notification.show();
+        sNotificationClient.add(notificationID, aImageUrl, aAlertTitle, aAlertText, contentIntent, clearIntent);
     }
 
     public static void alertsProgressListener_OnProgress(String aAlertName, long aProgress, long aProgressMax, String aAlertText) {
-        final int notificationID = aAlertName.hashCode();
-        AlertNotification notification = mAlertNotifications.get(notificationID);
-        if (notification != null)
-            notification.updateProgress(aAlertText, aProgress, aProgressMax);
+        int notificationID = aAlertName.hashCode();
+        sNotificationClient.update(notificationID, aProgress, aProgressMax, aAlertText);
 
         if (aProgress == aProgressMax) {
             // Hide the notification at 100%
             removeObserver(aAlertName);
-            removeNotification(notificationID);
         }
     }
 
@@ -1276,9 +1249,8 @@ public class GeckoAppShell
         if (GeckoApp.ACTION_ALERT_CALLBACK.equals(aAction)) {
             callObserver(aAlertName, "alertclickcallback", aAlertCookie);
 
-            AlertNotification notification = mAlertNotifications.get(notificationID);
-            if (notification != null && notification.isProgressStyle()) {
-                // When clicked, keep the notification, if it displays a progress
+            if (sNotificationClient.isProgressStyle(notificationID)) {
+                // When clicked, keep the notification if it displays progress
                 return;
             }
         }
@@ -1295,11 +1267,7 @@ public class GeckoAppShell
     }
 
     private static void removeNotification(int notificationID) {
-        mAlertNotifications.remove(notificationID);
-
-        NotificationManager notificationManager = (NotificationManager)
-            GeckoApp.mAppContext.getSystemService(Context.NOTIFICATION_SERVICE);
-        notificationManager.cancel(notificationID);
+        sNotificationClient.remove(notificationID);
     }
 
     public static int getDpi() {
diff --git a/mobile/android/base/GeckoApplication.java b/mobile/android/base/GeckoApplication.java
index 0f8c030a731b..01a54e78e8af 100644
--- a/mobile/android/base/GeckoApplication.java
+++ b/mobile/android/base/GeckoApplication.java
@@ -31,6 +31,8 @@ public class GeckoApplication extends Application {
         GeckoBatteryManager.getInstance().start();
         GeckoNetworkManager.getInstance().init(getApplicationContext());
         MemoryMonitor.getInstance().init(getApplicationContext());
+        GeckoAppShell.setNotificationClient(new NotificationServiceClient(getApplicationContext()));
+
         mInited = true;
     }
 
diff --git a/mobile/android/base/GeckoMenu.java b/mobile/android/base/GeckoMenu.java
index 25ea3996c5f2..1a5ff04362ee 100644
--- a/mobile/android/base/GeckoMenu.java
+++ b/mobile/android/base/GeckoMenu.java
@@ -432,16 +432,6 @@ public class GeckoMenu extends ListView
         private Context mContext;
         private LinearLayout mContainer;
         private List<View> mItems;
-
-        private class Divider extends LinearLayout {
-            public Divider(Context context, AttributeSet attrs) {
-                super(context, attrs);
-
-                setLayoutParams(new LinearLayout.LayoutParams((int) context.getResources().getDisplayMetrics().density,
-                                                              LinearLayout.LayoutParams.FILL_PARENT));
-                setBackgroundColor(0xFFD1D5DA);
-            }
-        }
  
         public DefaultActionItemBarPresenter(Context context, LinearLayout container) {
             mContext = context;
@@ -457,6 +447,8 @@ public class GeckoMenu extends ListView
 
             if (mItems.size() > 0) {
                 Divider divider = new Divider(mContext, null);
+                divider.setOrientation(Divider.Orientation.VERTICAL);
+                divider.setBackgroundColor(0xFFD1D5DA);
                 mContainer.addView(divider);
             }
 
diff --git a/mobile/android/base/Makefile.in b/mobile/android/base/Makefile.in
index daec9b1f16fd..44d530e7b189 100644
--- a/mobile/android/base/Makefile.in
+++ b/mobile/android/base/Makefile.in
@@ -72,6 +72,7 @@ FENNEC_JAVA_FILES = \
   db/LocalBrowserDB.java \
   db/DBUtils.java \
   Distribution.java \
+  Divider.java \
   DoorHanger.java \
   DoorHangerPopup.java \
   Favicons.java \
@@ -117,6 +118,8 @@ FENNEC_JAVA_FILES = \
   MenuPanel.java \
   MenuPopup.java \
   MultiChoicePreference.java \
+  NotificationService.java \
+  NotificationServiceClient.java \
   NSSBridge.java \
   CustomEditText.java \
   OnInterceptTouchListener.java \
@@ -411,6 +414,7 @@ RES_LAYOUT = \
   res/layout/datetime_picker.xml \
   res/layout/doorhangerpopup.xml \
   res/layout/doorhanger.xml \
+  res/layout/doorhanger_button.xml \
   res/layout/find_in_page_content.xml \
   res/layout/font_size_preference.xml \
   res/layout/gecko_appwidget.xml \
@@ -595,9 +599,6 @@ RES_DRAWABLE_MDPI = \
   res/drawable-mdpi/address_bar_url_default_pb.9.png \
   res/drawable-mdpi/address_bar_url_pressed.9.png \
   res/drawable-mdpi/address_bar_url_pressed_pb.9.png \
-  res/drawable-mdpi/doorhanger_arrow.png \
-  res/drawable-mdpi/doorhanger_bg.9.png \
-  res/drawable-mdpi/doorhanger_shadow_bg.9.png \
   res/drawable-mdpi/doorhanger_popup_bg.9.png \
   res/drawable-mdpi/find_close.png \
   res/drawable-mdpi/find_next.png \
@@ -697,9 +698,6 @@ RES_DRAWABLE_HDPI = \
   res/drawable-hdpi/address_bar_url_default_pb.9.png \
   res/drawable-hdpi/address_bar_url_pressed.9.png \
   res/drawable-hdpi/address_bar_url_pressed_pb.9.png \
-  res/drawable-hdpi/doorhanger_arrow.png \
-  res/drawable-hdpi/doorhanger_bg.9.png \
-  res/drawable-hdpi/doorhanger_shadow_bg.9.png \
   res/drawable-hdpi/doorhanger_popup_bg.9.png \
   res/drawable-hdpi/find_close.png \
   res/drawable-hdpi/find_next.png \
@@ -784,9 +782,6 @@ RES_DRAWABLE_XHDPI = \
   res/drawable-xhdpi/tab_thumbnail_default.png \
   res/drawable-xhdpi/tab_thumbnail_shadow.png \
   res/drawable-xhdpi/tabs_carat.png \
-  res/drawable-xhdpi/doorhanger_arrow.png \
-  res/drawable-xhdpi/doorhanger_bg.9.png \
-  res/drawable-xhdpi/doorhanger_shadow_bg.9.png \
   res/drawable-xhdpi/doorhanger_popup_bg.9.png \
   res/drawable-xhdpi/find_close.png \
   res/drawable-xhdpi/find_next.png \
@@ -915,6 +910,7 @@ RES_DRAWABLE_LARGE_LAND_V11 = \
   $(NULL)
 
 RES_DRAWABLE_LARGE_MDPI_V11 = \
+  res/drawable-large-mdpi-v11/doorhanger_popup_bg.9.png \
   res/drawable-large-mdpi-v11/ic_menu_reload.png \
   res/drawable-large-mdpi-v11/ic_menu_forward.png \
   res/drawable-large-mdpi-v11/menu.png \
@@ -924,6 +920,7 @@ RES_DRAWABLE_LARGE_MDPI_V11 = \
   $(NULL)
 
 RES_DRAWABLE_LARGE_HDPI_V11 = \
+  res/drawable-large-hdpi-v11/doorhanger_popup_bg.9.png \
   res/drawable-large-hdpi-v11/ic_menu_reload.png \
   res/drawable-large-hdpi-v11/ic_menu_forward.png \
   res/drawable-large-hdpi-v11/menu.png \
@@ -933,6 +930,7 @@ RES_DRAWABLE_LARGE_HDPI_V11 = \
   $(NULL)
 
 RES_DRAWABLE_LARGE_XHDPI_V11 = \
+  res/drawable-large-xhdpi-v11/doorhanger_popup_bg.9.png \
   res/drawable-large-xhdpi-v11/ic_menu_reload.png \
   res/drawable-large-xhdpi-v11/ic_menu_forward.png \
   res/drawable-large-xhdpi-v11/menu.png \
diff --git a/mobile/android/base/MenuPopup.java b/mobile/android/base/MenuPopup.java
index b71f6f16aabc..535c31756e57 100644
--- a/mobile/android/base/MenuPopup.java
+++ b/mobile/android/base/MenuPopup.java
@@ -93,7 +93,6 @@ public class MenuPopup extends PopupWindow {
         anchor.getLocationOnScreen(anchorLocation);
 
         int screenWidth = mResources.getDisplayMetrics().widthPixels;
-        int screenHeight = mResources.getDisplayMetrics().heightPixels;
         int arrowWidth = mResources.getDimensionPixelSize(R.dimen.menu_popup_arrow_width);
         int arrowOffset = (anchor.getWidth() - arrowWidth)/2;
        
@@ -107,16 +106,9 @@ public class MenuPopup extends PopupWindow {
             ((LayoutParams) mArrowBottom.getLayoutParams()).rightMargin = mArrowMargin;
         }
 
-        if (anchorLocation[1] + anchor.getHeight() + mPanel.getMeasuredHeight() >= screenHeight) {
-            // shown above anchor
-            mArrowTop.setVisibility(View.GONE);
-            mArrowBottom.setVisibility(View.VISIBLE);
-            showAsDropDown(anchor, 0, -(mYOffset + mPanel.getMeasuredHeight() + anchor.getHeight()));
-        } else {
-            // shown below anchor
-            mArrowTop.setVisibility(View.VISIBLE);
-            mArrowBottom.setVisibility(View.GONE);
-            showAsDropDown(anchor, 0, -mYOffset);
-        }
+        // shown below anchor
+        mArrowTop.setVisibility(View.VISIBLE);
+        mArrowBottom.setVisibility(View.GONE);
+        showAsDropDown(anchor, 0, -mYOffset);
     }
 }
diff --git a/mobile/android/base/NotificationService.java b/mobile/android/base/NotificationService.java
new file mode 100644
index 000000000000..5ebbacc8a25a
--- /dev/null
+++ b/mobile/android/base/NotificationService.java
@@ -0,0 +1,175 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 4; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko;
+
+import java.lang.reflect.Field;
+import java.util.concurrent.ConcurrentHashMap;
+
+import android.app.PendingIntent;
+import android.app.Service;
+import android.content.Intent;
+import android.net.Uri;
+import android.os.Binder;
+import android.os.IBinder;
+
+public class NotificationService extends Service {
+    private final IBinder mBinder = new NotificationBinder();
+
+    private final ConcurrentHashMap<Integer, AlertNotification>
+            mAlertNotifications = new ConcurrentHashMap<Integer, AlertNotification>();
+
+    /**
+     * Notification associated with this service's foreground state.
+     *
+     * {@link android.app.Service#startForeground(int, android.app.Notification)}
+     * associates the foreground with exactly one notification from the service.
+     * To keep Fennec alive during downloads (and to make sure it can be killed
+     * once downloads are complete), we make sure that the foreground is always
+     * associated with an active progress notification if and only if at least
+     * one download is in progress.
+     */
+    private AlertNotification mForegroundNotification;
+
+    public class NotificationBinder extends Binder {
+        NotificationService getService() {
+            // Return this instance of NotificationService so clients can call public methods
+            return NotificationService.this;
+        }
+    }
+
+    @Override
+    public IBinder onBind(Intent intent) {
+        return mBinder;
+    }
+
+    /**
+     * Adds a notification.
+     *
+     * @param notificationID the unique ID of the notification
+     * @param aImageUrl      URL of the image to use
+     * @param aAlertTitle    title of the notification
+     * @param aAlertText     text of the notification
+     * @param contentIntent  Intent used when the notification is clicked
+     * @param clearIntent    Intent used when the notification is removed
+     */
+    public void add(int notificationID, String aImageUrl, String aAlertTitle,
+                    String aAlertText, PendingIntent contentIntent, PendingIntent clearIntent) {
+        // Remove the old notification with the same ID, if any
+        remove(notificationID);
+
+        int icon = R.drawable.ic_status_logo;
+
+        Uri imageUri = Uri.parse(aImageUrl);
+        final String scheme = imageUri.getScheme();
+        if ("drawable".equals(scheme)) {
+            String resource = imageUri.getSchemeSpecificPart();
+            resource = resource.substring(resource.lastIndexOf('/') + 1);
+            try {
+                final Class<R.drawable> drawableClass = R.drawable.class;
+                final Field f = drawableClass.getField(resource);
+                icon = f.getInt(null);
+            } catch (final Exception e) {} // just means the resource doesn't exist
+            imageUri = null;
+        }
+
+        final AlertNotification notification = new AlertNotification(this, notificationID,
+                icon, aAlertTitle, aAlertText, System.currentTimeMillis(), imageUri);
+
+        notification.setLatestEventInfo(this, aAlertTitle, aAlertText, contentIntent);
+        notification.deleteIntent = clearIntent;
+
+        notification.show();
+        mAlertNotifications.put(notification.getId(), notification);
+    }
+
+    /**
+     * Updates a notification.
+     *
+     * @param notificationID ID of existing notification
+     * @param aProgress      progress of item being updated
+     * @param aProgressMax   max progress of item being updated
+     * @param aAlertText     text of the notification
+     */
+    public void update(int notificationID, long aProgress, long aProgressMax, String aAlertText) {
+        final AlertNotification notification = mAlertNotifications.get(notificationID);
+        if (notification == null) {
+            return;
+        }
+
+        notification.updateProgress(aAlertText, aProgress, aProgressMax);
+
+        if (mForegroundNotification == null && notification.isProgressStyle()) {
+            setForegroundNotification(notification);
+        }
+
+        // Hide the notification at 100%
+        if (aProgress == aProgressMax) {
+            remove(notificationID);
+        }
+    }
+
+    /**
+     * Removes a notification.
+     *
+     * @param notificationID ID of existing notification
+     */
+    public void remove(int notificationID) {
+        final AlertNotification notification = mAlertNotifications.remove(notificationID);
+        if (notification != null) {
+            updateForegroundNotification(notification);
+            notification.cancel();
+        }
+    }
+
+    /**
+     * Determines whether the service is done.
+     *
+     * The service is considered finished when all notifications have been
+     * removed.
+     *
+     * @return whether all notifications have been removed
+     */
+    public boolean isDone() {
+        return mAlertNotifications.isEmpty();
+    }
+
+    /**
+     * Determines whether a notification is showing progress.
+     *
+     * @param notificationID the notification to check
+     * @return               whether the notification is progress style
+     */
+    public boolean isProgressStyle(int notificationID) {
+        final AlertNotification notification = mAlertNotifications.get(notificationID);
+        return notification != null && notification.isProgressStyle();
+    }
+
+    private void setForegroundNotification(AlertNotification notification) {
+        mForegroundNotification = notification;
+        if (notification == null) {
+            stopForeground(true);
+        } else {
+            startForeground(notification.getId(), notification);
+        }
+    }
+
+    private void updateForegroundNotification(AlertNotification oldNotification) {
+        if (mForegroundNotification == oldNotification) {
+            // If we're removing the notification associated with the
+            // foreground, we need to pick another active notification to act
+            // as the foreground notification.
+            AlertNotification foregroundNotification = null;
+            for (final AlertNotification notification : mAlertNotifications.values()) {
+                if (notification.isProgressStyle()) {
+                    foregroundNotification = notification;
+                    break;
+                }
+            }
+
+            setForegroundNotification(foregroundNotification);
+        }
+    }
+}
diff --git a/mobile/android/base/NotificationServiceClient.java b/mobile/android/base/NotificationServiceClient.java
new file mode 100644
index 000000000000..e21298081e1c
--- /dev/null
+++ b/mobile/android/base/NotificationServiceClient.java
@@ -0,0 +1,227 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 4; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko;
+
+import java.util.LinkedList;
+import java.util.concurrent.ConcurrentHashMap;
+
+import android.app.PendingIntent;
+import android.content.ComponentName;
+import android.content.Context;
+import android.content.Intent;
+import android.content.ServiceConnection;
+import android.os.IBinder;
+import android.text.TextUtils;
+import android.util.Log;
+
+/**
+ * Client for posting notifications through the NotificationService.
+ */
+public class NotificationServiceClient {
+    private static final String LOGTAG = "GeckoNotificationServiceClient";
+
+    private volatile NotificationService mService;
+    private final ServiceConnection mConnection = new NotificationServiceConnection();
+    private boolean mBound;
+    private final Context mContext;
+    private final LinkedList<Runnable> mTaskQueue = new LinkedList<Runnable>();
+    private final ConcurrentHashMap<Integer, UpdateRunnable> mUpdatesMap =
+            new ConcurrentHashMap<Integer, UpdateRunnable>();
+
+    public NotificationServiceClient(Context context) {
+        mContext = context;
+    }
+
+    /**
+     * Runnable that is reused between update notifications.
+     *
+     * Updates happen frequently, so reusing Runnables prevents frequent dynamic allocation.
+     */
+    private class UpdateRunnable implements Runnable {
+        private long mProgress;
+        private long mProgressMax;
+        private String mAlertText;
+        final private int mNotificationID;
+
+        public UpdateRunnable(int notificationID) {
+            mNotificationID = notificationID;
+        }
+
+        public synchronized boolean updateProgress(long progress, long progressMax, String alertText) {
+            if (progress == mProgress
+                    && mProgressMax == progressMax
+                    && TextUtils.equals(mAlertText, alertText)) {
+                return false;
+            }
+
+            mProgress = progress;
+            mProgressMax = progressMax;
+            mAlertText = alertText;
+            return true;
+        }
+
+        @Override
+        public void run() {
+            long progress;
+            long progressMax;
+            String alertText;
+
+            synchronized (this) {
+                progress = mProgress;
+                progressMax = mProgressMax;
+                alertText = mAlertText;
+            }
+
+            mService.update(mNotificationID, progress, progressMax, alertText);
+        }
+    };
+
+    /**
+     * Adds a notification.
+     *
+     * @see NotificationService#add(int, String, String, String, PendingIntent, PendingIntent)
+     */
+    public synchronized void add(final int notificationID, final String aImageUrl,
+            final String aAlertTitle, final String aAlertText, final PendingIntent contentIntent,
+            final PendingIntent clearIntent) {
+        mTaskQueue.add(new Runnable() {
+            @Override
+            public void run() {
+                mService.add(notificationID, aImageUrl, aAlertTitle, aAlertText,
+                        contentIntent, clearIntent);
+            }
+        });
+        notify();
+
+        if (!mBound) {
+            bind();
+        }
+    }
+
+    /**
+     * Updates a notification.
+     *
+     * @see NotificationService#update(int, long, long, String)
+     */
+    public void update(final int notificationID, final long aProgress, final long aProgressMax,
+            final String aAlertText) {
+        UpdateRunnable runnable = mUpdatesMap.get(notificationID);
+
+        if (runnable == null) {
+            runnable = new UpdateRunnable(notificationID);
+            mUpdatesMap.put(notificationID, runnable);
+        }
+
+        // If we've already posted an update with these values, there's no
+        // need to do it again.
+        if (!runnable.updateProgress(aProgress, aProgressMax, aAlertText)) {
+            return;
+        }
+
+        synchronized (this) {
+            if (mBound) {
+                mTaskQueue.add(runnable);
+                notify();
+            }
+        }
+    }
+
+    /**
+     * Removes a notification.
+     *
+     * @see NotificationService#remove(int)
+     */
+    public synchronized void remove(final int notificationID) {
+        if (!mBound) {
+            return;
+        }
+
+        mTaskQueue.add(new Runnable() {
+            @Override
+            public void run() {
+                mService.remove(notificationID);
+                mUpdatesMap.remove(notificationID);
+            }
+        });
+        notify();
+    }
+
+    /**
+     * Determines whether a notification is showing progress.
+     *
+     * @see NotificationService#isProgressStyle(int)
+     */
+    public boolean isProgressStyle(int notificationID) {
+        final NotificationService service = mService;
+        return service != null && service.isProgressStyle(notificationID);
+    }
+
+    private void bind() {
+        mBound = true;
+        final Intent intent = new Intent(mContext, NotificationService.class);
+        mContext.bindService(intent, mConnection, Context.BIND_AUTO_CREATE);
+    }
+
+    private void unbind() {
+        if (mBound) {
+            mBound = false;
+            mContext.unbindService(mConnection);
+            mUpdatesMap.clear();
+        }
+    }
+
+    class NotificationServiceConnection implements ServiceConnection, Runnable {
+        @Override
+        public void onServiceConnected(ComponentName className, IBinder service) {
+            final NotificationService.NotificationBinder binder =
+                    (NotificationService.NotificationBinder) service;
+            mService = binder.getService();
+
+            new Thread(this).start();
+        }
+
+        @Override
+        public void onServiceDisconnected(ComponentName componentName) {
+            // This is called when the connection with the service has been
+            // unexpectedly disconnected -- that is, its process crashed.
+            // Because it is running in our same process, we should never
+            // see this happen, and the correctness of this class relies on
+            // this never happening.
+            Log.e(LOGTAG, "Notification service disconnected", new Exception());
+        }
+
+        @Override
+        public void run() {
+            Runnable r;
+            try {
+                while (true) {
+                    // Synchronize polls to prevent tasks from being added to the queue
+                    // during the isDone check.
+                    synchronized (NotificationServiceClient.this) {
+                        r = mTaskQueue.poll();
+                        while (r == null) {
+                            if (mService.isDone()) {
+                                // If there are no more tasks and no notifications being
+                                // displayed, the service is disconnected. Unfortunately,
+                                // since completed download notifications are shown by
+                                // removing the progress notification and creating a new
+                                // static one, this will cause the service to be unbound
+                                // and immediately rebound when a download completes.
+                                unbind();
+                                return;
+                            }
+                            NotificationServiceClient.this.wait();
+                            r = mTaskQueue.poll();
+                        }
+                    }
+                    r.run();
+                }
+            } catch (InterruptedException e) {
+                Log.e(LOGTAG, "Notification task queue processing interrupted", e);
+            }
+        }
+    }
+}
diff --git a/mobile/android/base/SiteIdentityPopup.java b/mobile/android/base/SiteIdentityPopup.java
index 33f1f256a93d..2492d9b0f5f5 100644
--- a/mobile/android/base/SiteIdentityPopup.java
+++ b/mobile/android/base/SiteIdentityPopup.java
@@ -43,10 +43,13 @@ public class SiteIdentityPopup extends PopupWindow {
     private ImageView mLarry;
     private ImageView mArrow;
 
+    private int mYOffset;
+
     private SiteIdentityPopup() {
         super(GeckoApp.mAppContext);
 
         mResources = GeckoApp.mAppContext.getResources();
+        mYOffset = mResources.getDimensionPixelSize(R.dimen.menu_popup_offset);
         mInflated = false;
     }
 
@@ -73,9 +76,7 @@ public class SiteIdentityPopup extends PopupWindow {
 
         mHost = (TextView) layout.findViewById(R.id.host);
         mOwner = (TextView) layout.findViewById(R.id.owner);
-        mSupplemental = (TextView) layout.findViewById(R.id.supplemental);
         mVerifier = (TextView) layout.findViewById(R.id.verifier);
-        mEncrypted = (TextView) layout.findViewById(R.id.encrypted);
 
         mLarry = (ImageView) layout.findViewById(R.id.larry);
         mArrow = (ImageView) layout.findViewById(R.id.arrow);
@@ -117,44 +118,38 @@ public class SiteIdentityPopup extends PopupWindow {
             mHost.setText(host);
 
             String owner = identityData.getString("owner");
+
+            try {
+                String supplemental = identityData.getString("supplemental");
+                owner += "\n" + supplemental;
+            } catch (JSONException e) { }
+
             mOwner.setText(owner);
 
             String verifier = identityData.getString("verifier");
-            mVerifier.setText(verifier);
-
             String encrypted = identityData.getString("encrypted");
-            mEncrypted.setText(encrypted);
+            mVerifier.setText(verifier + "\n" + encrypted);
         } catch (JSONException e) {
             Log.e(LOGTAG, "Exception trying to get identity data", e);
             return;
         }
 
-        try {
-            String supplemental = identityData.getString("supplemental");
-            mSupplemental.setText(supplemental);
-            mSupplemental.setVisibility(View.VISIBLE);
-        } catch (JSONException e) {
-            mSupplemental.setVisibility(View.INVISIBLE);
-        }
-
         if (mode.equals(VERIFIED)) {
             // Use a blue theme for SSL
             mLarry.setImageResource(R.drawable.larry_blue);
             mHost.setTextColor(mResources.getColor(R.color.identity_verified));
             mOwner.setTextColor(mResources.getColor(R.color.identity_verified));
-            mSupplemental.setTextColor(mResources.getColor(R.color.identity_verified));
         } else {
             // Use a green theme for EV
             mLarry.setImageResource(R.drawable.larry_green);
             mHost.setTextColor(mResources.getColor(R.color.identity_identified));
             mOwner.setTextColor(mResources.getColor(R.color.identity_identified));
-            mSupplemental.setTextColor(mResources.getColor(R.color.identity_identified));
         }
 
         int[] anchorLocation = new int[2];
         v.getLocationOnScreen(anchorLocation);
 
-        int arrowWidth = mResources.getDimensionPixelSize(R.dimen.doorhanger_arrow_width);
+        int arrowWidth = mResources.getDimensionPixelSize(R.dimen.menu_popup_arrow_width);
         int leftMargin = anchorLocation[0] + (v.getWidth() - arrowWidth) / 2;
 
         int offset = 0;
@@ -164,10 +159,8 @@ public class SiteIdentityPopup extends PopupWindow {
         }
 
         LayoutParams layoutParams = (LayoutParams) mArrow.getLayoutParams();
-        LayoutParams newLayoutParams = new LayoutParams(LayoutParams.WRAP_CONTENT, LayoutParams.WRAP_CONTENT);
-        newLayoutParams.setMargins(leftMargin, layoutParams.topMargin, 0, 0);
-        mArrow.setLayoutParams(newLayoutParams);
+        layoutParams.setMargins(leftMargin, 0, 0, 0);
 
-        showAsDropDown(v, offset, 0);
+        showAsDropDown(v, offset, -mYOffset);
     }
 }
diff --git a/mobile/android/base/Tabs.java b/mobile/android/base/Tabs.java
index 30e8625bcef3..1001ef364348 100644
--- a/mobile/android/base/Tabs.java
+++ b/mobile/android/base/Tabs.java
@@ -104,8 +104,15 @@ public class Tabs implements GeckoEventListener {
         }
     }
 
-    public int getCount() {
-        return mTabs.size();
+    public int getDisplayCount() {
+        boolean getPrivate = mSelectedTab != null && mSelectedTab.isPrivate();
+        int count = 0;
+        for (Tab tab : mTabs.values()) {
+            if (tab.isPrivate() == getPrivate) {
+                count++;
+            }
+        }
+        return count;
     }
 
     private void lazyRegisterBookmarkObserver() {
@@ -206,7 +213,7 @@ public class Tabs implements GeckoEventListener {
     }
 
     public Tab getTab(int id) {
-        if (getCount() == 0)
+        if (mTabs.size() == 0)
             return null;
 
         if (!mTabs.containsKey(id))
diff --git a/mobile/android/base/awesomebar/AllPagesTab.java b/mobile/android/base/awesomebar/AllPagesTab.java
index d72f33e11b46..ca44a7bebe4d 100644
--- a/mobile/android/base/awesomebar/AllPagesTab.java
+++ b/mobile/android/base/awesomebar/AllPagesTab.java
@@ -55,7 +55,7 @@ import java.util.ArrayList;
 import java.util.List;
 
 public class AllPagesTab extends AwesomeBarTab implements GeckoEventListener {
-    public static final String LOGTAG = "ALL_PAGES";
+    public static final String LOGTAG = "GeckoAllPagesTab";
     private static final String TAG = "allPages";
 
     private static final int SUGGESTION_TIMEOUT = 3000;
@@ -222,10 +222,8 @@ public class AllPagesTab extends AwesomeBarTab implements GeckoEventListener {
                     postLoadFavicons();
 
                     long end = SystemClock.uptimeMillis();
-                    int time = (int)(end - start);
-                    Log.i(LOGTAG, "Got cursor in " + time + "ms");
-
                     if (!mTelemetrySent && TextUtils.isEmpty(constraint)) {
+                        int time = (int)(end - start);
                         Telemetry.HistogramAdd("FENNEC_AWESOMEBAR_ALLPAGES_EMPTY_TIME", time);
                         mTelemetrySent = true;
                     }
diff --git a/mobile/android/base/gfx/DisplayPortCalculator.java b/mobile/android/base/gfx/DisplayPortCalculator.java
index 05289a62f131..debc6e48e669 100644
--- a/mobile/android/base/gfx/DisplayPortCalculator.java
+++ b/mobile/android/base/gfx/DisplayPortCalculator.java
@@ -20,7 +20,7 @@ import java.util.HashMap;
 import java.util.Map;
 
 final class DisplayPortCalculator {
-    private static final String LOGTAG = "GeckoDisplayPortCalculator";
+    private static final String LOGTAG = "GeckoDisplayPort";
     private static final PointF ZERO_VELOCITY = new PointF(0, 0);
 
     // Keep this in sync with the TILEDLAYERBUFFER_TILE_SIZE defined in gfx/layers/TiledLayerBuffer.h
diff --git a/mobile/android/base/resources/drawable-hdpi/doorhanger_arrow.png b/mobile/android/base/resources/drawable-hdpi/doorhanger_arrow.png
deleted file mode 100644
index af56f10b7bf1..000000000000
Binary files a/mobile/android/base/resources/drawable-hdpi/doorhanger_arrow.png and /dev/null differ
diff --git a/mobile/android/base/resources/drawable-hdpi/doorhanger_bg.9.png b/mobile/android/base/resources/drawable-hdpi/doorhanger_bg.9.png
deleted file mode 100644
index 67053b12b0c7..000000000000
Binary files a/mobile/android/base/resources/drawable-hdpi/doorhanger_bg.9.png and /dev/null differ
diff --git a/mobile/android/base/resources/drawable-hdpi/doorhanger_popup_bg.9.png b/mobile/android/base/resources/drawable-hdpi/doorhanger_popup_bg.9.png
index 19ec3f130f80..ce25586552a2 100644
Binary files a/mobile/android/base/resources/drawable-hdpi/doorhanger_popup_bg.9.png and b/mobile/android/base/resources/drawable-hdpi/doorhanger_popup_bg.9.png differ
diff --git a/mobile/android/base/resources/drawable-hdpi/doorhanger_shadow_bg.9.png b/mobile/android/base/resources/drawable-hdpi/doorhanger_shadow_bg.9.png
deleted file mode 100644
index 2743419e2823..000000000000
Binary files a/mobile/android/base/resources/drawable-hdpi/doorhanger_shadow_bg.9.png and /dev/null differ
diff --git a/mobile/android/base/resources/drawable-hdpi/larry_blue.png b/mobile/android/base/resources/drawable-hdpi/larry_blue.png
index 4007364d4257..f76760a3a4cf 100644
Binary files a/mobile/android/base/resources/drawable-hdpi/larry_blue.png and b/mobile/android/base/resources/drawable-hdpi/larry_blue.png differ
diff --git a/mobile/android/base/resources/drawable-hdpi/larry_green.png b/mobile/android/base/resources/drawable-hdpi/larry_green.png
index 886aebd5f740..2c8eb3e942b1 100644
Binary files a/mobile/android/base/resources/drawable-hdpi/larry_green.png and b/mobile/android/base/resources/drawable-hdpi/larry_green.png differ
diff --git a/mobile/android/base/resources/drawable-large-hdpi-v11/doorhanger_popup_bg.9.png b/mobile/android/base/resources/drawable-large-hdpi-v11/doorhanger_popup_bg.9.png
new file mode 100644
index 000000000000..fcfa2e4b4adb
Binary files /dev/null and b/mobile/android/base/resources/drawable-large-hdpi-v11/doorhanger_popup_bg.9.png differ
diff --git a/mobile/android/base/resources/drawable-large-mdpi-v11/doorhanger_popup_bg.9.png b/mobile/android/base/resources/drawable-large-mdpi-v11/doorhanger_popup_bg.9.png
new file mode 100644
index 000000000000..c194335f5953
Binary files /dev/null and b/mobile/android/base/resources/drawable-large-mdpi-v11/doorhanger_popup_bg.9.png differ
diff --git a/mobile/android/base/resources/drawable-large-xhdpi-v11/doorhanger_popup_bg.9.png b/mobile/android/base/resources/drawable-large-xhdpi-v11/doorhanger_popup_bg.9.png
new file mode 100644
index 000000000000..04f44fe669a1
Binary files /dev/null and b/mobile/android/base/resources/drawable-large-xhdpi-v11/doorhanger_popup_bg.9.png differ
diff --git a/mobile/android/base/resources/drawable-mdpi/doorhanger_arrow.png b/mobile/android/base/resources/drawable-mdpi/doorhanger_arrow.png
deleted file mode 100644
index ab403b052c3e..000000000000
Binary files a/mobile/android/base/resources/drawable-mdpi/doorhanger_arrow.png and /dev/null differ
diff --git a/mobile/android/base/resources/drawable-mdpi/doorhanger_bg.9.png b/mobile/android/base/resources/drawable-mdpi/doorhanger_bg.9.png
deleted file mode 100644
index 67053b12b0c7..000000000000
Binary files a/mobile/android/base/resources/drawable-mdpi/doorhanger_bg.9.png and /dev/null differ
diff --git a/mobile/android/base/resources/drawable-mdpi/doorhanger_popup_bg.9.png b/mobile/android/base/resources/drawable-mdpi/doorhanger_popup_bg.9.png
index 78e27038d830..1d94ae53b508 100644
Binary files a/mobile/android/base/resources/drawable-mdpi/doorhanger_popup_bg.9.png and b/mobile/android/base/resources/drawable-mdpi/doorhanger_popup_bg.9.png differ
diff --git a/mobile/android/base/resources/drawable-mdpi/doorhanger_shadow_bg.9.png b/mobile/android/base/resources/drawable-mdpi/doorhanger_shadow_bg.9.png
deleted file mode 100644
index e8ad9ee0541c..000000000000
Binary files a/mobile/android/base/resources/drawable-mdpi/doorhanger_shadow_bg.9.png and /dev/null differ
diff --git a/mobile/android/base/resources/drawable-mdpi/larry_blue.png b/mobile/android/base/resources/drawable-mdpi/larry_blue.png
index d31b1ef93849..cb4fe8d9ec7b 100644
Binary files a/mobile/android/base/resources/drawable-mdpi/larry_blue.png and b/mobile/android/base/resources/drawable-mdpi/larry_blue.png differ
diff --git a/mobile/android/base/resources/drawable-mdpi/larry_green.png b/mobile/android/base/resources/drawable-mdpi/larry_green.png
index ad6f84c26ab9..5147a920ca9e 100644
Binary files a/mobile/android/base/resources/drawable-mdpi/larry_green.png and b/mobile/android/base/resources/drawable-mdpi/larry_green.png differ
diff --git a/mobile/android/base/resources/drawable-xhdpi/doorhanger_arrow.png b/mobile/android/base/resources/drawable-xhdpi/doorhanger_arrow.png
deleted file mode 100644
index 5d11789584ae..000000000000
Binary files a/mobile/android/base/resources/drawable-xhdpi/doorhanger_arrow.png and /dev/null differ
diff --git a/mobile/android/base/resources/drawable-xhdpi/doorhanger_bg.9.png b/mobile/android/base/resources/drawable-xhdpi/doorhanger_bg.9.png
deleted file mode 100644
index 67053b12b0c7..000000000000
Binary files a/mobile/android/base/resources/drawable-xhdpi/doorhanger_bg.9.png and /dev/null differ
diff --git a/mobile/android/base/resources/drawable-xhdpi/doorhanger_popup_bg.9.png b/mobile/android/base/resources/drawable-xhdpi/doorhanger_popup_bg.9.png
index f9bb18efb879..746c50580842 100644
Binary files a/mobile/android/base/resources/drawable-xhdpi/doorhanger_popup_bg.9.png and b/mobile/android/base/resources/drawable-xhdpi/doorhanger_popup_bg.9.png differ
diff --git a/mobile/android/base/resources/drawable-xhdpi/doorhanger_shadow_bg.9.png b/mobile/android/base/resources/drawable-xhdpi/doorhanger_shadow_bg.9.png
deleted file mode 100644
index 38cc05290d3f..000000000000
Binary files a/mobile/android/base/resources/drawable-xhdpi/doorhanger_shadow_bg.9.png and /dev/null differ
diff --git a/mobile/android/base/resources/drawable-xhdpi/larry_blue.png b/mobile/android/base/resources/drawable-xhdpi/larry_blue.png
index 3fa00fe743d7..c460f767f3f3 100644
Binary files a/mobile/android/base/resources/drawable-xhdpi/larry_blue.png and b/mobile/android/base/resources/drawable-xhdpi/larry_blue.png differ
diff --git a/mobile/android/base/resources/drawable-xhdpi/larry_green.png b/mobile/android/base/resources/drawable-xhdpi/larry_green.png
index fc037ba19757..371aa3c427b3 100644
Binary files a/mobile/android/base/resources/drawable-xhdpi/larry_green.png and b/mobile/android/base/resources/drawable-xhdpi/larry_green.png differ
diff --git a/mobile/android/base/resources/layout-large-v11/browser_toolbar_menu.xml.in b/mobile/android/base/resources/layout-large-v11/browser_toolbar_menu.xml.in
index 5979fa8e54f6..9eadc602664b 100644
--- a/mobile/android/base/resources/layout-large-v11/browser_toolbar_menu.xml.in
+++ b/mobile/android/base/resources/layout-large-v11/browser_toolbar_menu.xml.in
@@ -55,7 +55,8 @@
                       android:layout_width="wrap_content"
                       android:layout_height="fill_parent"
                       android:orientation="horizontal"
-                      android:layout_toLeftOf="@id/menu"/>
+                      android:layout_toLeftOf="@id/menu"
+                      android:layout_alignWithParentIfMissing="true"/>
 
         <RelativeLayout style="@style/AddressBar.Button"
                         android:layout_toRightOf="@id/tabs"
diff --git a/mobile/android/base/resources/layout-large-v11/doorhangerpopup.xml b/mobile/android/base/resources/layout-large-v11/doorhangerpopup.xml
index baaa52b6e6bf..ec4aa17468ac 100644
--- a/mobile/android/base/resources/layout-large-v11/doorhangerpopup.xml
+++ b/mobile/android/base/resources/layout-large-v11/doorhangerpopup.xml
@@ -9,7 +9,6 @@
 
     <ScrollView android:layout_width="@dimen/popup_width"
                 android:layout_height="wrap_content"
-                android:layout_marginTop="24dip"
                 android:layout_alignParentTop="true"
                 android:background="@drawable/doorhanger_popup_bg">
 
@@ -21,12 +20,11 @@
     </ScrollView>
 
     <ImageView android:id="@+id/doorhanger_arrow"
-               android:layout_width="@dimen/doorhanger_arrow_width"
-               android:layout_height="16dip"
+               android:layout_width="@dimen/menu_popup_arrow_width"
+               android:layout_height="12dip"
                android:layout_marginLeft="4dip"
-               android:layout_marginTop="9dip"
                android:layout_alignParentTop="true"
-               android:src="@drawable/doorhanger_arrow"
+               android:src="@drawable/menu_popup_arrow_top"
                android:scaleType="fitXY"/>
 
 </RelativeLayout>
diff --git a/mobile/android/base/resources/layout-large-v11/site_identity_popup.xml b/mobile/android/base/resources/layout-large-v11/site_identity_popup.xml
index e5a335344a42..6418815ae4d3 100644
--- a/mobile/android/base/resources/layout-large-v11/site_identity_popup.xml
+++ b/mobile/android/base/resources/layout-large-v11/site_identity_popup.xml
@@ -4,81 +4,65 @@
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
 <RelativeLayout xmlns:android="http://schemas.android.com/apk/res/android"
-                android:layout_width="fill_parent"
+                android:layout_width="@dimen/popup_width"
                 android:layout_height="wrap_content">
 
-    <RelativeLayout android:layout_width="@dimen/popup_width"
-                    android:layout_height="wrap_content"
-                    android:layout_marginTop="15dip"
-                    android:layout_alignParentTop="true"
-                    android:background="@drawable/doorhanger_popup_bg">
+    <LinearLayout android:layout_width="fill_parent"
+                  android:layout_height="wrap_content"
+                  android:orientation="horizontal"
+                  android:layout_alignParentTop="true"
+                  android:background="@drawable/doorhanger_popup_bg">
 
-      <LinearLayout android:id="@+id/identity_info"
-                    android:layout_width="fill_parent"
-                    android:layout_height="wrap_content"
-                    android:padding="12dip"
-                    android:background="@drawable/doorhanger_bg"
-                    android:orientation="vertical">
+        <LinearLayout android:layout_width="0dip"
+                      android:layout_height="wrap_content"
+                      android:layout_weight="1.0"
+                      android:orientation="vertical"
+                      android:padding="12dip">
 
-          <TextView android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:textAppearance="?android:attr/textAppearanceSmall"
-                    android:textColor="@color/doorhanger_text"
-                    android:text="@string/identity_connected_to"/>
+            <TextView android:layout_width="wrap_content"
+                      android:layout_height="wrap_content"
+                      android:textSize="12sp"
+                      android:textColor="@color/doorhanger_text"
+                      android:text="@string/identity_connected_to"/>
 
-          <TextView android:id="@+id/host"
-                    android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:textAppearance="?android:attr/textAppearanceMedium"
-                    android:textStyle="bold"/>
+            <TextView android:id="@+id/host"
+                      android:layout_width="wrap_content"
+                      android:layout_height="wrap_content"
+                      android:textSize="18sp"/>
 
-          <TextView android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:textAppearance="?android:attr/textAppearanceSmall"
-                    android:textColor="@color/doorhanger_text"
-                    android:text="@string/identity_run_by"/>
+            <TextView android:layout_width="wrap_content"
+                      android:layout_height="wrap_content"
+                      android:textSize="12sp"
+                      android:textColor="@color/doorhanger_text"
+                      android:text="@string/identity_run_by"
+                      android:paddingTop="12dip"/>
 
-          <TextView android:id="@+id/owner"
-                    android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:textAppearance="?android:attr/textAppearanceMedium"
-                    android:textStyle="bold"/>
+            <TextView android:id="@+id/owner"
+                      android:layout_width="wrap_content"
+                      android:layout_height="wrap_content"
+                      android:textSize="18sp"/>
 
-          <TextView android:id="@+id/supplemental"
-                    android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:textAppearance="?android:attr/textAppearanceSmall"/>
+            <TextView android:id="@+id/verifier"
+                      android:layout_width="wrap_content"
+                      android:layout_height="wrap_content"
+                      android:textSize="12sp"
+                      android:textColor="@color/doorhanger_text"
+                      android:paddingTop="12dip"/>
 
-          <TextView android:id="@+id/verifier"
-                    android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:textAppearance="?android:attr/textAppearanceSmall"
-                    android:textColor="@color/doorhanger_text"/>
+        </LinearLayout>
 
-      </LinearLayout>
+        <ImageView android:id="@+id/larry"
+                   android:layout_width="wrap_content"
+                   android:layout_height="wrap_content"
+                   android:padding="15dip"/>
 
-      <ImageView android:id="@+id/larry"
-                 android:layout_width="wrap_content"
-                 android:layout_height="wrap_content"
-                 android:padding="12dip"
-                 android:layout_alignParentRight="true"/>
-
-      <TextView android:id="@+id/encrypted"
-                android:layout_width="fill_parent"
-                android:layout_height="wrap_content"
-                android:layout_alignBottom="@id/identity_info"
-                android:padding="12dip"
-                android:gravity="right"
-                android:textAppearance="?android:attr/textAppearanceSmall"
-                android:textColor="@color/doorhanger_text"/>
-
-    </RelativeLayout>
+    </LinearLayout>
 
     <ImageView android:id="@+id/arrow"
-               android:layout_width="@dimen/doorhanger_arrow_width"
-               android:layout_height="16dip"
+               android:layout_width="@dimen/menu_popup_arrow_width"
+               android:layout_height="12dip"
                android:layout_alignParentTop="true"
-               android:src="@drawable/doorhanger_arrow"
+               android:src="@drawable/menu_popup_arrow_top"
                android:scaleType="fitXY"/>
 
 </RelativeLayout>
diff --git a/mobile/android/base/resources/layout/doorhanger.xml b/mobile/android/base/resources/layout/doorhanger.xml
index ea1b136b8a25..591575ca71f5 100644
--- a/mobile/android/base/resources/layout/doorhanger.xml
+++ b/mobile/android/base/resources/layout/doorhanger.xml
@@ -21,11 +21,21 @@
               android:textColor="@color/doorhanger_text"
               android:visibility="gone"/>
 
+    <View android:id="@+id/divider_choices"
+          android:layout_width="fill_parent"
+          android:layout_height="1dp"
+          android:background="#FFD1D5DA"
+          android:visibility="gone"/>
+
     <LinearLayout android:id="@+id/doorhanger_choices"
-                  style="@android:style/ButtonBar"
                   android:layout_width="fill_parent"
                   android:layout_height="wrap_content"
                   android:orientation="horizontal"
                   android:visibility="gone"/>
 
+    <View android:id="@+id/divider_doorhanger"
+          android:layout_width="fill_parent"
+          android:layout_height="1dp"
+          android:background="#FFFF9500"/>
+
 </merge>
diff --git a/mobile/android/base/resources/layout/doorhanger_button.xml b/mobile/android/base/resources/layout/doorhanger_button.xml
new file mode 100644
index 000000000000..54bcb501ef42
--- /dev/null
+++ b/mobile/android/base/resources/layout/doorhanger_button.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<Button xmlns:android="http://schemas.android.com/apk/res/android"
+        android:layout_width="wrap_content"
+        android:layout_height="wrap_content"
+        android:minHeight="48dip"
+        android:textColor="#FF222222"
+        android:textSize="14sp"
+        android:background="@drawable/action_bar_button"/>
diff --git a/mobile/android/base/resources/layout/doorhangerpopup.xml b/mobile/android/base/resources/layout/doorhangerpopup.xml
index 638d97757b6f..3e9ae5757de6 100644
--- a/mobile/android/base/resources/layout/doorhangerpopup.xml
+++ b/mobile/android/base/resources/layout/doorhangerpopup.xml
@@ -9,7 +9,6 @@
 
     <ScrollView android:layout_width="fill_parent"
                 android:layout_height="wrap_content"
-                android:layout_marginTop="24dip"
                 android:layout_alignParentTop="true"
                 android:background="@drawable/doorhanger_popup_bg">
 
@@ -21,12 +20,11 @@
     </ScrollView>
 
     <ImageView android:id="@+id/doorhanger_arrow"
-               android:layout_width="@dimen/doorhanger_arrow_width"
-               android:layout_height="16dip"
+               android:layout_width="@dimen/menu_popup_arrow_width"
+               android:layout_height="12dip"
                android:layout_marginLeft="4dip"
-               android:layout_marginTop="9dip"
                android:layout_alignParentTop="true"
-               android:src="@drawable/doorhanger_arrow"
+               android:src="@drawable/menu_popup_arrow_top"
                android:scaleType="fitXY"/>
 
 </RelativeLayout>
diff --git a/mobile/android/base/resources/layout/site_identity_popup.xml b/mobile/android/base/resources/layout/site_identity_popup.xml
index 5e306522e864..f8d8a43b33ce 100644
--- a/mobile/android/base/resources/layout/site_identity_popup.xml
+++ b/mobile/android/base/resources/layout/site_identity_popup.xml
@@ -7,78 +7,62 @@
                 android:layout_width="fill_parent"
                 android:layout_height="wrap_content">
 
-    <RelativeLayout android:layout_width="fill_parent"
-                    android:layout_height="wrap_content"
-                    android:layout_marginTop="15dip"
-                    android:layout_alignParentTop="true"
-                    android:background="@drawable/doorhanger_popup_bg">
+    <LinearLayout android:layout_width="fill_parent"
+                  android:layout_height="wrap_content"
+                  android:orientation="horizontal"
+                  android:layout_alignParentTop="true"
+                  android:background="@drawable/doorhanger_popup_bg">
 
-      <LinearLayout android:id="@+id/identity_info"
-                    android:layout_width="fill_parent"
-                    android:layout_height="wrap_content"
-                    android:padding="12dip"
-                    android:background="@drawable/doorhanger_bg"
-                    android:orientation="vertical">
+        <LinearLayout android:layout_width="0dip"
+                      android:layout_height="wrap_content"
+                      android:layout_weight="1.0"
+                      android:orientation="vertical"
+                      android:padding="12dip">
 
-          <TextView android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:textAppearance="?android:attr/textAppearanceSmall"
-                    android:textColor="@color/doorhanger_text"
-                    android:text="@string/identity_connected_to"/>
+            <TextView android:layout_width="wrap_content"
+                      android:layout_height="wrap_content"
+                      android:textSize="12sp"
+                      android:textColor="@color/doorhanger_text"
+                      android:text="@string/identity_connected_to"/>
 
-          <TextView android:id="@+id/host"
-                    android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:textAppearance="?android:attr/textAppearanceMedium"
-                    android:textStyle="bold"/>
+            <TextView android:id="@+id/host"
+                      android:layout_width="wrap_content"
+                      android:layout_height="wrap_content"
+                      android:textSize="18sp"/>
 
-          <TextView android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:textAppearance="?android:attr/textAppearanceSmall"
-                    android:textColor="@color/doorhanger_text"
-                    android:text="@string/identity_run_by"/>
+            <TextView android:layout_width="wrap_content"
+                      android:layout_height="wrap_content"
+                      android:textSize="12sp"
+                      android:textColor="@color/doorhanger_text"
+                      android:text="@string/identity_run_by"
+                      android:paddingTop="12dip"/>
 
-          <TextView android:id="@+id/owner"
-                    android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:textAppearance="?android:attr/textAppearanceMedium"
-                    android:textStyle="bold"/>
+            <TextView android:id="@+id/owner"
+                      android:layout_width="wrap_content"
+                      android:layout_height="wrap_content"
+                      android:textSize="18sp"/>
 
-          <TextView android:id="@+id/supplemental"
-                    android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:textAppearance="?android:attr/textAppearanceSmall"/>
+            <TextView android:id="@+id/verifier"
+                      android:layout_width="wrap_content"
+                      android:layout_height="wrap_content"
+                      android:textSize="12sp"
+                      android:textColor="@color/doorhanger_text"
+                      android:paddingTop="12dip"/>
 
-          <TextView android:id="@+id/verifier"
-                    android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:textAppearance="?android:attr/textAppearanceSmall"
-                    android:textColor="@color/doorhanger_text"/>
+        </LinearLayout>
 
-      </LinearLayout>
+        <ImageView android:id="@+id/larry"
+                   android:layout_width="wrap_content"
+                   android:layout_height="wrap_content"
+                   android:padding="15dip"/>
 
-      <ImageView android:id="@+id/larry"
-                 android:layout_width="wrap_content"
-                 android:layout_height="wrap_content"
-                 android:padding="12dip"
-                 android:layout_alignParentRight="true"/>
-
-      <TextView android:id="@+id/encrypted"
-                android:layout_width="fill_parent"
-                android:layout_height="wrap_content"
-                android:layout_alignBottom="@id/identity_info"
-                android:padding="12dip"
-                android:gravity="right"
-                android:textAppearance="?android:attr/textAppearanceSmall"
-                android:textColor="@color/doorhanger_text"/>
-
-    </RelativeLayout>
+    </LinearLayout>
 
     <ImageView android:id="@+id/arrow"
-               android:layout_width="@dimen/doorhanger_arrow_width"
-               android:layout_height="16dip"
+               android:layout_width="@dimen/menu_popup_arrow_width"
+               android:layout_height="12dip"
                android:layout_alignParentTop="true"
-               android:src="@drawable/doorhanger_arrow"
+               android:src="@drawable/menu_popup_arrow_top"
                android:scaleType="fitXY"/>
 
 </RelativeLayout>
diff --git a/mobile/android/base/resources/values/colors.xml b/mobile/android/base/resources/values/colors.xml
index e265a0115bab..d315124b9542 100644
--- a/mobile/android/base/resources/values/colors.xml
+++ b/mobile/android/base/resources/values/colors.xml
@@ -13,11 +13,11 @@
   <color name="splash_msgfont">#ffffff</color>
   <color name="splash_urlfont">#000000</color>
   <color name="splash_content">#ffffff</color>
-  <color name="doorhanger_text">#ffffff</color>
+  <color name="doorhanger_text">#FF222222</color>
   <color name="doorhanger_link">#ACC4D5</color>
   <color name="validation_message_text">#ffffff</color>
-  <color name="identity_verified">#77BAFF</color>
-  <color name="identity_identified">#B7D46A</color>
+  <color name="identity_verified">#FF3298FF</color>
+  <color name="identity_identified">#FF89C450</color>
   <color name="url_bar_text_highlight">#FFFF9500</color>
   <color name="url_bar_text_highlight_pb">#FFD06BFF</color>
   <color name="suggestion_primary">#dddddd</color>
diff --git a/mobile/android/base/resources/values/dimens.xml b/mobile/android/base/resources/values/dimens.xml
index d0bc7b88d4ad..2897718d52be 100644
--- a/mobile/android/base/resources/values/dimens.xml
+++ b/mobile/android/base/resources/values/dimens.xml
@@ -27,7 +27,6 @@
     <dimen name="browser_toolbar_icon_width">36dp</dimen>
     <dimen name="browser_toolbar_lock_width">20dp</dimen>
     <dimen name="browser_toolbar_favicon_size">29.33dip</dimen>
-    <dimen name="doorhanger_arrow_width">44dp</dimen>
     <dimen name="flow_layout_spacing">6dp</dimen>
     <dimen name="menu_item_icon">21dp</dimen>
     <dimen name="menu_item_state_icon">18dp</dimen>
diff --git a/mobile/android/base/tests/testAllPagesTab.java.in b/mobile/android/base/tests/testAllPagesTab.java.in
index b3a29aca5154..f55413dd152b 100644
--- a/mobile/android/base/tests/testAllPagesTab.java.in
+++ b/mobile/android/base/tests/testAllPagesTab.java.in
@@ -74,7 +74,12 @@ public class testAllPagesTab extends BaseTest {
         String loadUrl = "";
         for (int i = count - 1; i >= 0; i--) {
             View child = list.getChildAt(i);
-
+            if (child == null) {
+                // this may simply indicate that the item is not visible
+                Object item = list.getAdapter().getItem(i);
+                mAsserter.ok(item != null, "adapter item is set", item != null ? item.toString() : "null!");
+                continue;
+            }
             ArrayList<View> views = mSolo.getViews(child);
             ArrayList<ImageView> imageViews = new ArrayList<ImageView>();
 
@@ -114,6 +119,7 @@ public class testAllPagesTab extends BaseTest {
         ListView list = getAllPagesList(bookmarks[0]);
 
         View child = list.getChildAt(0);
+        mAsserter.ok(child != null, "first list item can be retrieved", child != null ? child.toString() : "null!");
         mSolo.clickLongOnView(child);
 
         // TODO: Test clicking these does the right thing
@@ -131,6 +137,7 @@ public class testAllPagesTab extends BaseTest {
 
         Actions.EventExpecter contentEventExpecter = mActions.expectGeckoEvent("DOMContentLoaded");
         View child = list.getChildAt(0);
+        mAsserter.ok(child != null, "first list item can be retrieved", child != null ? child.toString() : "null!");
         mSolo.clickOnView(child);
         contentEventExpecter.blockForEvent();
         verifyUrl(url);
diff --git a/mobile/android/base/tests/testBookmark.java.in b/mobile/android/base/tests/testBookmark.java.in
index 0063abda6b68..b2df3f7fd4c7 100644
--- a/mobile/android/base/tests/testBookmark.java.in
+++ b/mobile/android/base/tests/testBookmark.java.in
@@ -98,6 +98,7 @@ public class testBookmark extends PixelTest  {
         // Click on the bookmark we created and wait for the bookmarked page to load
         Actions.RepeatedEventExpecter paintExpecter = mActions.expectPaint();
         View child = bookmarksList.getChildAt(1);
+        mAsserter.ok(child != null, "list item can be retrieved", child != null ? child.toString() : "null!");
         mSolo.clickOnView(child);
         paintExpecter.blockUntilClear(PAINT_CLEAR_DELAY);
 
diff --git a/mobile/android/base/tests/testBookmarksTab.java.in b/mobile/android/base/tests/testBookmarksTab.java.in
index 334456a0349b..47975183f3d8 100644
--- a/mobile/android/base/tests/testBookmarksTab.java.in
+++ b/mobile/android/base/tests/testBookmarksTab.java.in
@@ -58,6 +58,7 @@ public class testBookmarksTab extends BaseTest {
         }
 
         child = list.getChildAt(0);
+        mAsserter.ok(child != null, "first list item can be retrieved", child != null ? child.toString() : "null!");
         mSolo.clickOnView(child);
         waitForText("Bookmarks Toolbar");
 
@@ -69,6 +70,7 @@ public class testBookmarksTab extends BaseTest {
         }
 
         child = list.getChildAt(1);
+        mAsserter.ok(child != null, "second list item can be retrieved", child != null ? child.toString() : "null!");
         mSolo.clickOnView(child);
         waitForText("BOOKMARK_TITLE");
 
@@ -137,6 +139,7 @@ public class testBookmarksTab extends BaseTest {
 
             // test long tap on a folder, this should fail but will still open the folder
             child = list.getChildAt(0);
+            mAsserter.ok(child != null, "first list item can be retrieved", child != null ? child.toString() : "null!");
             mSolo.clickLongOnView(child);
             mAsserter.is(mSolo.waitForText("Open in New Tab"), false, "Folders have no context menu");
         } else {
@@ -160,6 +163,7 @@ public class testBookmarksTab extends BaseTest {
         // Remove Bookmark from Context Menu
         waitForText("Bookmarks");
         child = list.getChildAt(1);
+        mAsserter.ok(child != null, "second list item can be retrieved", child != null ? child.toString() : "null!");
         mSolo.clickLongOnView(child);
         waitForText("Open in New Tab");
         mSolo.clickOnText("Remove");
@@ -169,6 +173,7 @@ public class testBookmarksTab extends BaseTest {
 
         // Verify Bookmark is removed
         child = list.getChildAt(1);
+        mAsserter.ok(child != null, "second list item can be retrieved", child != null ? child.toString() : "null!");
         mSolo.clickLongOnView(child);
         waitForText("Open in New Tab");
         mAsserter.is(mSolo.searchText("Bookmark Name"), false, "Removed bookmark has been deleted");
@@ -184,6 +189,7 @@ public class testBookmarksTab extends BaseTest {
         View child;
         mSolo.clickOnText("Bookmarks");
         child = list.getChildAt(bookmarkIndex);
+        mAsserter.ok(child != null, "edit item can be retrieved", child != null ? child.toString() : "null!");
         waitForText("about:home");
         mSolo.clickLongOnView(child);
         waitForText("Open in New Tab");
@@ -207,6 +213,7 @@ public class testBookmarksTab extends BaseTest {
         View child;
         mSolo.clickOnText("Bookmarks");
         child = list.getChildAt(bookmarkIndex);
+        mAsserter.ok(child != null, "check item can be retrieved", child != null ? child.toString() : "null!");
         waitForText("about:home");
         mSolo.clickLongOnView(child);
         waitForText("Open in New Tab");
@@ -233,6 +240,11 @@ public class testBookmarksTab extends BaseTest {
     }
 
     private void compareRow(View child, int numTextViews, int numImageViews) {
+        if (child == null) {
+            // this list item may be obscured or offscreen
+            mAsserter.dumpLog("ListView child not available for comparison - offscreen?");
+            return;
+        }
         ArrayList<View> views = mSolo.getViews(child);
         ArrayList<ImageView> imageViews = new ArrayList<ImageView>();
         ArrayList<TextView> textViews = new ArrayList<TextView>();
diff --git a/mobile/android/base/tests/testHistoryTab.java.in b/mobile/android/base/tests/testHistoryTab.java.in
index 6837f67e7144..b0f018ab4351 100644
--- a/mobile/android/base/tests/testHistoryTab.java.in
+++ b/mobile/android/base/tests/testHistoryTab.java.in
@@ -104,6 +104,12 @@ public class testHistoryTab extends PixelTest {
         String loadUrl = "";
         for (int i = count - 1; i >= 0; i--) {
             View child = listview.getChildAt(i);
+            if (child == null) {
+                // this may simply indicate that the item is not visible
+                Object item = listview.getAdapter().getItem(i);
+                mAsserter.ok(item != null, "adapter item is set", item != null ? item.toString() : "null!");
+                continue;
+            }
             ArrayList<View> views = mSolo.getViews(child);
             ArrayList<ImageView> imageViews = new ArrayList<ImageView>();
             int expectedImages = 1;
@@ -192,6 +198,7 @@ public class testHistoryTab extends PixelTest {
             mActions.sendSpecialKey(Actions.SpecialKey.BACK);
 
             View child = listview.getChildAt(0);
+            mAsserter.ok(child != null, "first list item can be retrieved", child != null ? child.toString() : "null!");
             mSolo.clickLongOnView(child);
             mAsserter.is(false, mSolo.waitForText("Open in New Tab"), "Header rows should not show a context menu");
 
@@ -206,6 +213,7 @@ public class testHistoryTab extends PixelTest {
         waitForText(url);
 
         View child = listview.getChildAt(0);
+        mAsserter.ok(child != null, "first list item can be retrieved", child != null ? child.toString() : "null!");
         mSolo.clickOnView(child);
         // nothing should happen
 
diff --git a/mobile/android/base/widget/TwoWayView.java b/mobile/android/base/widget/TwoWayView.java
index 0c8f78866bf9..deefeca03973 100644
--- a/mobile/android/base/widget/TwoWayView.java
+++ b/mobile/android/base/widget/TwoWayView.java
@@ -1453,6 +1453,10 @@ public class TwoWayView extends AdapterView<ListAdapter> implements
                 }
 
                 break;
+
+            case TOUCH_MODE_OVERSCROLL:
+                mTouchMode = TOUCH_MODE_REST;
+                reportScrollStateChange(OnScrollListener.SCROLL_STATE_IDLE);
             }
 
             cancelCheckForTap();
diff --git a/mobile/android/locales/en-US/chrome/browser.properties b/mobile/android/locales/en-US/chrome/browser.properties
index acfc7ab4e050..3c4738ab1004 100644
--- a/mobile/android/locales/en-US/chrome/browser.properties
+++ b/mobile/android/locales/en-US/chrome/browser.properties
@@ -133,18 +133,10 @@ offlineApps.storeOfflineData=Store Offline Data
 
 # New-style ContentPermissionPrompt values
 offlineApps.dontAllow=Don't Allow
-offlineApps.wantsTo=%S wants to store data on your device for offline use.
 
 # IndexedDB Quota increases
-indexedDBQuota.allow=Allow
-indexedDBQuota.dontAllow=Don't Allow
 indexedDBQuota.wantsTo=%S wants to store a lot of data on your device for offline use.
 
-# Open Web Apps management API
-openWebappsManage.allow=Allow
-openWebappsManage.dontAllow=Don't Allow
-openWebappsManage.wantsTo=%S wants to manage applications on your device.
-
 # LOCALIZATION NOTE (password.rememberPassword): Label that will be used in
 # site settings dialog.
 password.rememberPassword=Remember Password
diff --git a/mobile/android/themes/core/defines.inc b/mobile/android/themes/core/defines.inc
index 1dec2005099e..efcef97810b1 100644
--- a/mobile/android/themes/core/defines.inc
+++ b/mobile/android/themes/core/defines.inc
@@ -20,7 +20,7 @@
 %define color_text_as_link #febc2b
 
 %define color_background_highlight #febc2b
-%define color_background_highlight_overlay rgba(254, 188, 43, 0.8)
+%define color_background_highlight_overlay rgba(171, 171, 171, 0.5)
 %define color_text_highlight #000
 
 %define color_subtext_default lightgray
diff --git a/parser/html/nsHtml5SVGLoadDispatcher.cpp b/parser/html/nsHtml5SVGLoadDispatcher.cpp
index 7e30171863a2..8a87e0247add 100644
--- a/parser/html/nsHtml5SVGLoadDispatcher.cpp
+++ b/parser/html/nsHtml5SVGLoadDispatcher.cpp
@@ -19,7 +19,6 @@ NS_IMETHODIMP
 nsHtml5SVGLoadDispatcher::Run()
 {
   nsEvent event(true, NS_SVG_LOAD);
-  event.eventStructType = NS_SVG_EVENT;
   event.mFlags.mBubbles = false;
   // Do we care about forcing presshell creation if it hasn't happened yet?
   // That is, should this code flush or something?  Does it really matter?
diff --git a/python/mozbuild/mozbuild/base.py b/python/mozbuild/mozbuild/base.py
index 3d5a24fa849c..eaf3c79be56a 100644
--- a/python/mozbuild/mozbuild/base.py
+++ b/python/mozbuild/mozbuild/base.py
@@ -54,11 +54,9 @@ class MozbuildObject(ProcessExecutionMixin):
     @property
     def topobjdir(self):
         if self._topobjdir is None:
-            if self.mozconfig['topobjdir'] is None:
-                self._topobjdir = 'obj-%s' % self._config_guess
-            else:
-                self._topobjdir = self.mozconfig['topobjdir']
-
+            topobj = self.mozconfig['topobjdir'] or 'obj-@CONFIG_GUESS@'
+            self._topobjdir = topobj.replace("@CONFIG_GUESS@",
+                                             self._config_guess)
         return self._topobjdir
 
     @property
diff --git a/rdf/base/src/nsCompositeDataSource.cpp b/rdf/base/src/nsCompositeDataSource.cpp
index 096fe54eb0a2..b70aa3b368ba 100644
--- a/rdf/base/src/nsCompositeDataSource.cpp
+++ b/rdf/base/src/nsCompositeDataSource.cpp
@@ -27,7 +27,6 @@
 */
 
 #include "xpcom-config.h"
-#include NEW_H
 #include "nsCOMPtr.h"
 #include "nsIComponentManager.h"
 #include "nsIEnumerator.h"
@@ -35,7 +34,6 @@
 #include "nsIRDFNode.h"
 #include "nsIRDFObserver.h"
 #include "nsIRDFRemoteDataSource.h"
-#include "nsFixedSizeAllocator.h"
 #include "nsTArray.h"
 #include "nsCOMArray.h"
 #include "nsArrayEnumerator.h"
@@ -93,13 +91,11 @@ protected:
     nsCOMArray<nsIRDFObserver> mObservers;
     nsCOMArray<nsIRDFDataSource> mDataSources;
 
-	bool        mAllowNegativeAssertions;
-	bool        mCoalesceDuplicateArcs;
+    bool        mAllowNegativeAssertions;
+    bool        mCoalesceDuplicateArcs;
     int32_t     mUpdateBatchNest;
 
-    nsFixedSizeAllocator mAllocator;
-
-	virtual ~CompositeDataSourceImpl() {}
+    virtual ~CompositeDataSourceImpl() {}
 
     friend class CompositeEnumeratorImpl;
     friend class CompositeArcsInOutEnumeratorImpl;
@@ -126,15 +122,13 @@ class CompositeEnumeratorImpl : public nsISimpleEnumerator
     virtual nsresult
     HasNegation(nsIRDFDataSource* aDataSource, nsIRDFNode* aNode, bool* aResult) = 0;
 
-    virtual void Destroy() = 0;
-
 protected:
     CompositeEnumeratorImpl(CompositeDataSourceImpl* aCompositeDataSource,
                             bool aAllowNegativeAssertions,
                             bool aCoalesceDuplicateArcs);
 
     virtual ~CompositeEnumeratorImpl();
-    
+
     CompositeDataSourceImpl* mCompositeDataSource;
 
     nsISimpleEnumerator* mCurrent;
@@ -156,19 +150,19 @@ CompositeEnumeratorImpl::CompositeEnumeratorImpl(CompositeDataSourceImpl* aCompo
       mAllowNegativeAssertions(aAllowNegativeAssertions),
       mCoalesceDuplicateArcs(aCoalesceDuplicateArcs)
 {
-	NS_ADDREF(mCompositeDataSource);
+    NS_ADDREF(mCompositeDataSource);
 }
 
 
 CompositeEnumeratorImpl::~CompositeEnumeratorImpl(void)
 {
-	NS_IF_RELEASE(mCurrent);
-	NS_IF_RELEASE(mResult);
-	NS_RELEASE(mCompositeDataSource);
+    NS_IF_RELEASE(mCurrent);
+    NS_IF_RELEASE(mResult);
+    NS_RELEASE(mCompositeDataSource);
 }
 
 NS_IMPL_ADDREF(CompositeEnumeratorImpl)
-NS_IMPL_RELEASE_WITH_DESTROY(CompositeEnumeratorImpl, Destroy())
+NS_IMPL_RELEASE(CompositeEnumeratorImpl)
 NS_IMPL_QUERY_INTERFACE1(CompositeEnumeratorImpl, nsISimpleEnumerator)
 
 NS_IMETHODIMP
@@ -330,21 +324,6 @@ class CompositeArcsInOutEnumeratorImpl : public CompositeEnumeratorImpl
 public:
     enum Type { eArcsIn, eArcsOut };
 
-    static CompositeArcsInOutEnumeratorImpl*
-    Create(nsFixedSizeAllocator& aAllocator,
-           CompositeDataSourceImpl* aCompositeDataSource,
-           nsIRDFNode* aNode,
-           Type aType,
-           bool aAllowNegativeAssertions,
-           bool aCoalesceDuplicateArcs) {
-        void* place = aAllocator.Alloc(sizeof(CompositeArcsInOutEnumeratorImpl));
-        return place
-            ? ::new (place) CompositeArcsInOutEnumeratorImpl(aCompositeDataSource,
-                                                             aNode, aType,
-                                                             aAllowNegativeAssertions,
-                                                             aCoalesceDuplicateArcs)
-            : nullptr; }
-
     virtual ~CompositeArcsInOutEnumeratorImpl();
 
     virtual nsresult
@@ -353,9 +332,6 @@ public:
     virtual nsresult
     HasNegation(nsIRDFDataSource* aDataSource, nsIRDFNode* aNode, bool* aResult);
 
-    virtual void Destroy();
-
-protected:
     CompositeArcsInOutEnumeratorImpl(CompositeDataSourceImpl* aCompositeDataSource,
                                      nsIRDFNode* aNode,
                                      Type aType,
@@ -365,11 +341,6 @@ protected:
 private:
     nsIRDFNode* mNode;
     Type        mType;
-
-    // Hide so that only Create() and Destroy() can be used to
-    // allocate and deallocate from the heap
-    static void* operator new(size_t) CPP_THROW_NEW { return 0; }
-    static void operator delete(void*, size_t) {}
 };
 
 
@@ -416,18 +387,6 @@ CompositeArcsInOutEnumeratorImpl::HasNegation(
     return NS_OK;
 }
 
-void
-CompositeArcsInOutEnumeratorImpl::Destroy()
-{
-    // Keep the datasource alive for the duration of the stack
-    // frame so its allocator stays valid.
-    nsCOMPtr<nsIRDFCompositeDataSource> kungFuDeathGrip = mCompositeDataSource;
-
-    nsFixedSizeAllocator& pool = mCompositeDataSource->mAllocator;
-    this->~CompositeArcsInOutEnumeratorImpl();
-    pool.Free(this, sizeof(*this));
-}
-
 
 //----------------------------------------------------------------------
 //
@@ -437,33 +396,12 @@ CompositeArcsInOutEnumeratorImpl::Destroy()
 class CompositeAssertionEnumeratorImpl : public CompositeEnumeratorImpl
 {
 public:
-    static CompositeAssertionEnumeratorImpl*
-    Create(nsFixedSizeAllocator& aAllocator,
-           CompositeDataSourceImpl* aCompositeDataSource,
-           nsIRDFResource* aSource,
-           nsIRDFResource* aProperty,
-           nsIRDFNode* aTarget,
-           bool aTruthValue,
-           bool aAllowNegativeAssertions,
-           bool aCoalesceDuplicateArcs) {
-        void* place = aAllocator.Alloc(sizeof(CompositeAssertionEnumeratorImpl));
-        return place
-            ? ::new (place) CompositeAssertionEnumeratorImpl(aCompositeDataSource,
-                                                             aSource, aProperty, aTarget,
-                                                             aTruthValue,
-                                                             aAllowNegativeAssertions,
-                                                             aCoalesceDuplicateArcs)
-            : nullptr; }
-
     virtual nsresult
     GetEnumerator(nsIRDFDataSource* aDataSource, nsISimpleEnumerator** aResult);
 
     virtual nsresult
     HasNegation(nsIRDFDataSource* aDataSource, nsIRDFNode* aNode, bool* aResult);
 
-    virtual void Destroy();
-
-protected:
     CompositeAssertionEnumeratorImpl(CompositeDataSourceImpl* aCompositeDataSource,
                                      nsIRDFResource* aSource,
                                      nsIRDFResource* aProperty,
@@ -479,11 +417,6 @@ private:
     nsIRDFResource* mProperty;
     nsIRDFNode*     mTarget;
     bool            mTruthValue;
-
-    // Hide so that only Create() and Destroy() can be used to
-    // allocate and deallocate from the heap
-    static void* operator new(size_t) CPP_THROW_NEW { return 0; }
-    static void operator delete(void*, size_t) {}
 };
 
 
@@ -542,18 +475,6 @@ CompositeAssertionEnumeratorImpl::HasNegation(
     }
 }
 
-void
-CompositeAssertionEnumeratorImpl::Destroy()
-{
-    // Keep the datasource alive for the duration of the stack
-    // frame so its allocator stays valid.
-    nsCOMPtr<nsIRDFCompositeDataSource> kungFuDeathGrip = mCompositeDataSource;
-
-    nsFixedSizeAllocator& pool = mCompositeDataSource->mAllocator;
-    this->~CompositeAssertionEnumeratorImpl();
-    pool.Free(this, sizeof(*this));
-}
-
 ////////////////////////////////////////////////////////////////////////
 
 nsresult
@@ -574,17 +495,6 @@ CompositeDataSourceImpl::CompositeDataSourceImpl(void)
 	  mCoalesceDuplicateArcs(true),
       mUpdateBatchNest(0)
 {
-    static const size_t kBucketSizes[] = {
-        sizeof(CompositeAssertionEnumeratorImpl),
-        sizeof(CompositeArcsInOutEnumeratorImpl) };
-
-    static const int32_t kNumBuckets = sizeof(kBucketSizes) / sizeof(size_t);
-
-    // Per news://news.mozilla.org/39BEC105.5090206%40netscape.com
-    static const int32_t kInitialSize = 256;
-
-    mAllocator.Init("nsCompositeDataSource", kBucketSizes, kNumBuckets, kInitialSize);
-
 #ifdef PR_LOGGING
     if (nsRDFLog == nullptr) 
         nsRDFLog = PR_NewLogModule("RDF");
@@ -686,11 +596,10 @@ CompositeDataSourceImpl::GetSources(nsIRDFResource* aProperty,
     if (! mAllowNegativeAssertions && ! aTruthValue)
         return(NS_RDF_NO_VALUE);
 
-    *aResult = CompositeAssertionEnumeratorImpl::Create(mAllocator,
-                                                        this, nullptr, aProperty,
-                                                        aTarget, aTruthValue,
-                                                        mAllowNegativeAssertions,
-                                                        mCoalesceDuplicateArcs);
+    *aResult = new CompositeAssertionEnumeratorImpl(this, nullptr, aProperty,
+                                                    aTarget, aTruthValue,
+                                                    mAllowNegativeAssertions,
+                                                    mCoalesceDuplicateArcs);
 
     if (! *aResult)
         return NS_ERROR_OUT_OF_MEMORY;
@@ -793,11 +702,11 @@ CompositeDataSourceImpl::GetTargets(nsIRDFResource* aSource,
         return(NS_RDF_NO_VALUE);
 
     *aResult =
-        CompositeAssertionEnumeratorImpl::Create(mAllocator, this,
-                                                 aSource, aProperty, nullptr,
-                                                 aTruthValue,
-                                                 mAllowNegativeAssertions,
-                                                 mCoalesceDuplicateArcs);
+        new CompositeAssertionEnumeratorImpl(this,
+                                             aSource, aProperty, nullptr,
+                                             aTruthValue,
+                                             mAllowNegativeAssertions,
+                                             mCoalesceDuplicateArcs);
 
     if (! *aResult)
         return NS_ERROR_OUT_OF_MEMORY;
@@ -1124,11 +1033,11 @@ CompositeDataSourceImpl::ArcLabelsIn(nsIRDFNode* aTarget, nsISimpleEnumerator**
     if (! aResult)
         return NS_ERROR_NULL_POINTER;
 
-    nsISimpleEnumerator* result = 
-        CompositeArcsInOutEnumeratorImpl::Create(mAllocator, this, aTarget,
-                                                 CompositeArcsInOutEnumeratorImpl::eArcsIn,
-                                                 mAllowNegativeAssertions,
-                                                 mCoalesceDuplicateArcs);
+    nsISimpleEnumerator* result =
+        new CompositeArcsInOutEnumeratorImpl(this, aTarget,
+                                             CompositeArcsInOutEnumeratorImpl::eArcsIn,
+                                             mAllowNegativeAssertions,
+                                             mCoalesceDuplicateArcs);
 
     if (! result)
         return NS_ERROR_OUT_OF_MEMORY;
@@ -1151,10 +1060,10 @@ CompositeDataSourceImpl::ArcLabelsOut(nsIRDFResource* aSource,
         return NS_ERROR_NULL_POINTER;
 
     nsISimpleEnumerator* result =
-        CompositeArcsInOutEnumeratorImpl::Create(mAllocator, this, aSource,
-                                                 CompositeArcsInOutEnumeratorImpl::eArcsOut,
-                                                 mAllowNegativeAssertions,
-                                                 mCoalesceDuplicateArcs);
+        new CompositeArcsInOutEnumeratorImpl(this, aSource,
+                                             CompositeArcsInOutEnumeratorImpl::eArcsOut,
+                                             mAllowNegativeAssertions,
+                                             mCoalesceDuplicateArcs);
 
     if (! result)
         return NS_ERROR_OUT_OF_MEMORY;
diff --git a/rdf/base/src/nsInMemoryDataSource.cpp b/rdf/base/src/nsInMemoryDataSource.cpp
index 42189a38a3ed..5a6acbb375db 100644
--- a/rdf/base/src/nsInMemoryDataSource.cpp
+++ b/rdf/base/src/nsInMemoryDataSource.cpp
@@ -60,7 +60,6 @@
 #include "nsString.h"
 #include "nsReadableUtils.h"
 #include "nsXPIDLString.h"
-#include "nsFixedSizeAllocator.h"
 #include "rdfutil.h"
 #include "pldhash.h"
 #include "plstr.h"
@@ -82,37 +81,9 @@ static PRLogModuleInfo* gLog = nullptr;
 // ownership is shared between the datasource and any enumerators that
 // are currently iterating over the datasource.
 //
-class Assertion 
+class Assertion
 {
 public:
-    static Assertion*
-    Create(nsFixedSizeAllocator& aAllocator,
-           nsIRDFResource* aSource,
-           nsIRDFResource* aProperty,
-           nsIRDFNode* aTarget,
-           bool aTruthValue) {
-        void* place = aAllocator.Alloc(sizeof(Assertion));
-        return place
-            ? ::new (place) Assertion(aSource, aProperty, aTarget, aTruthValue)
-            : nullptr; }
-    static Assertion*
-    Create(nsFixedSizeAllocator& aAllocator, nsIRDFResource* aSource) {
-        void* place = aAllocator.Alloc(sizeof(Assertion));
-        return place
-            ? ::new (place) Assertion(aSource)
-            : nullptr; }
-
-    static void
-    Destroy(nsFixedSizeAllocator& aAllocator, Assertion* aAssertion) {
-        if (aAssertion->mHashEntry && aAssertion->u.hash.mPropertyHash) {
-            PL_DHashTableEnumerate(aAssertion->u.hash.mPropertyHash,
-                DeletePropertyHashEntry, &aAllocator);
-            PL_DHashTableDestroy(aAssertion->u.hash.mPropertyHash);
-            aAssertion->u.hash.mPropertyHash = nullptr;
-        }
-        aAssertion->~Assertion();
-        aAllocator.Free(aAssertion, sizeof(*aAssertion)); }
-
     static PLDHashOperator
     DeletePropertyHashEntry(PLDHashTable* aTable, PLDHashEntryHdr* aHdr,
                            uint32_t aNumber, void* aArg);
@@ -133,13 +104,13 @@ public:
         ++mRefCnt;
     }
 
-    void Release(nsFixedSizeAllocator& aAllocator) {
+    void Release() {
         if (mRefCnt == UINT16_MAX) {
             NS_WARNING("refcount overflow, leaking Assertion");
             return;
         }
         if (--mRefCnt == 0)
-            Destroy(aAllocator, this);
+            delete this;
     }
 
     // For nsIRDFPurgeableDataSource
@@ -175,12 +146,6 @@ public:
     // all 32-bit entries are long aligned
     uint16_t                    mRefCnt;
     bool                        mHashEntry;
-
-private:
-    // Hide so that only Create() and Destroy() can be used to
-    // allocate and deallocate from the heap
-    static void* operator new(size_t) CPP_THROW_NEW { return 0; }
-    static void operator delete(void*, size_t) {}
 };
 
 
@@ -230,6 +195,13 @@ Assertion::Assertion(nsIRDFResource* aSource,
 
 Assertion::~Assertion()
 {
+    if (mHashEntry && u.hash.mPropertyHash) {
+        PL_DHashTableEnumerate(u.hash.mPropertyHash, DeletePropertyHashEntry,
+                               NULL);
+        PL_DHashTableDestroy(u.hash.mPropertyHash);
+        u.hash.mPropertyHash = nullptr;
+    }
+
     MOZ_COUNT_DTOR(RDF_Assertion);
 #ifdef DEBUG_REFS
     --gInstanceCount;
@@ -249,7 +221,6 @@ Assertion::DeletePropertyHashEntry(PLDHashTable* aTable, PLDHashEntryHdr* aHdr,
                                            uint32_t aNumber, void* aArg)
 {
     Entry* entry = reinterpret_cast<Entry*>(aHdr);
-    nsFixedSizeAllocator* allocator = static_cast<nsFixedSizeAllocator*>(aArg);
 
     Assertion* as = entry->mAssertions;
     while (as) {
@@ -258,7 +229,7 @@ Assertion::DeletePropertyHashEntry(PLDHashTable* aTable, PLDHashEntryHdr* aHdr,
 
         // Unlink, and release the datasource's reference.
         doomed->mNext = doomed->u.as.mInvNext = nullptr;
-        doomed->Release(*allocator);
+        doomed->Release();
     }
     return PL_DHASH_NEXT;
 }
@@ -278,8 +249,6 @@ class InMemoryDataSource : public nsIRDFDataSource,
                            public rdfIDataSource
 {
 protected:
-    nsFixedSizeAllocator mAllocator;
-
     // These hash tables are keyed on pointers to nsIRDFResource
     // objects (the nsIRDFService ensures that there is only ever one
     // nsIRDFResource object per unique URI). The value of an entry is
@@ -418,11 +387,7 @@ private:
     Assertion*      mNextAssertion;
     nsCOMPtr<nsISupportsArray> mHashArcs;
 
-    // Hide so that only Create() and Destroy() can be used to
-    // allocate and deallocate from the heap
-    static void* operator new(size_t) CPP_THROW_NEW { return 0; }
-    static void operator delete(void*, size_t) {}
-
+public:
     InMemoryAssertionEnumeratorImpl(InMemoryDataSource* aDataSource,
                                     nsIRDFResource* aSource,
                                     nsIRDFResource* aProperty,
@@ -431,35 +396,9 @@ private:
 
     virtual ~InMemoryAssertionEnumeratorImpl();
 
-public:
-    static InMemoryAssertionEnumeratorImpl*
-    Create(InMemoryDataSource* aDataSource,
-           nsIRDFResource* aSource,
-           nsIRDFResource* aProperty,
-           nsIRDFNode* aTarget,
-           bool aTruthValue) {
-        void* place = aDataSource->mAllocator.Alloc(sizeof(InMemoryAssertionEnumeratorImpl));
-        return place
-            ? ::new (place) InMemoryAssertionEnumeratorImpl(aDataSource,
-                                                            aSource, aProperty, aTarget,
-                                                            aTruthValue)
-            : nullptr; }
-
-    static void
-    Destroy(InMemoryAssertionEnumeratorImpl* aEnumerator) {
-        // Keep the datasource alive for the duration of the stack
-        // frame so its allocator stays valid.
-        nsCOMPtr<nsIRDFDataSource> kungFuDeathGrip = aEnumerator->mDataSource;
-
-        // Grab the pool from the datasource; since we keep the
-        // datasource alive, this has to be safe.
-        nsFixedSizeAllocator& pool = aEnumerator->mDataSource->mAllocator;
-        aEnumerator->~InMemoryAssertionEnumeratorImpl();
-        pool.Free(aEnumerator, sizeof(*aEnumerator)); }
-
     // nsISupports interface
     NS_DECL_ISUPPORTS
-   
+
     // nsISimpleEnumerator interface
     NS_DECL_NSISIMPLEENUMERATOR
 };
@@ -515,7 +454,7 @@ InMemoryAssertionEnumeratorImpl::~InMemoryAssertionEnumeratorImpl()
 #endif
 
     if (mNextAssertion)
-        mNextAssertion->Release(mDataSource->mAllocator);
+        mNextAssertion->Release();
 
     NS_IF_RELEASE(mDataSource);
     NS_IF_RELEASE(mSource);
@@ -525,7 +464,7 @@ InMemoryAssertionEnumeratorImpl::~InMemoryAssertionEnumeratorImpl()
 }
 
 NS_IMPL_ADDREF(InMemoryAssertionEnumeratorImpl)
-NS_IMPL_RELEASE_WITH_DESTROY(InMemoryAssertionEnumeratorImpl, Destroy(this))
+NS_IMPL_RELEASE(InMemoryAssertionEnumeratorImpl)
 NS_IMPL_QUERY_INTERFACE1(InMemoryAssertionEnumeratorImpl, nsISimpleEnumerator)
 
 NS_IMETHODIMP
@@ -562,7 +501,7 @@ InMemoryAssertionEnumeratorImpl::HasMoreElements(bool* aResult)
             mNextAssertion->AddRef();
 
         // ...and release the reference from the enumerator to the old one.
-        as->Release(mDataSource->mAllocator);
+        as->Release();
 
         if (foundIt) {
             *aResult = true;
@@ -608,11 +547,6 @@ InMemoryAssertionEnumeratorImpl::GetNext(nsISupports** aResult)
 class InMemoryArcsEnumeratorImpl : public nsISimpleEnumerator
 {
 private:
-    // Hide so that only Create() and Destroy() can be used to
-    // allocate and deallocate from the heap
-    static void* operator new(size_t) CPP_THROW_NEW { return 0; }
-    static void operator delete(void*, size_t) {}
-
     InMemoryDataSource* mDataSource;
     nsIRDFResource*     mSource;
     nsIRDFNode*         mTarget;
@@ -621,43 +555,22 @@ private:
     Assertion*          mAssertion;
     nsCOMPtr<nsISupportsArray> mHashArcs;
 
+    static PLDHashOperator
+    ArcEnumerator(PLDHashTable* aTable, PLDHashEntryHdr* aHdr,
+                       uint32_t aNumber, void* aArg);
+
+public:
     InMemoryArcsEnumeratorImpl(InMemoryDataSource* aDataSource,
                                nsIRDFResource* aSource,
                                nsIRDFNode* aTarget);
 
     virtual ~InMemoryArcsEnumeratorImpl();
 
-    static PLDHashOperator
-    ArcEnumerator(PLDHashTable* aTable, PLDHashEntryHdr* aHdr,
-                       uint32_t aNumber, void* aArg);
-
-public:
     // nsISupports interface
     NS_DECL_ISUPPORTS
 
     // nsISimpleEnumerator interface
     NS_DECL_NSISIMPLEENUMERATOR
-
-    static InMemoryArcsEnumeratorImpl*
-    Create(InMemoryDataSource* aDataSource,
-           nsIRDFResource* aSource,
-           nsIRDFNode* aTarget) {
-        void* place = aDataSource->mAllocator.Alloc(sizeof(InMemoryArcsEnumeratorImpl));
-        return place
-            ? ::new (place) InMemoryArcsEnumeratorImpl(aDataSource, aSource, aTarget)
-            : nullptr; }
-
-    static void
-    Destroy(InMemoryArcsEnumeratorImpl* aEnumerator) {
-        // Keep the datasource alive for the duration of the stack
-        // frame so its allocator stays valid.
-        nsCOMPtr<nsIRDFDataSource> kungFuDeathGrip = aEnumerator->mDataSource;
-
-        // Grab the pool from the datasource; since we keep the
-        // datasource alive, this has to be safe.
-        nsFixedSizeAllocator& pool = aEnumerator->mDataSource->mAllocator;
-        aEnumerator->~InMemoryArcsEnumeratorImpl();
-        pool.Free(aEnumerator, sizeof(*aEnumerator)); }
 };
 
 
@@ -719,7 +632,7 @@ InMemoryArcsEnumeratorImpl::~InMemoryArcsEnumeratorImpl()
 }
 
 NS_IMPL_ADDREF(InMemoryArcsEnumeratorImpl)
-NS_IMPL_RELEASE_WITH_DESTROY(InMemoryArcsEnumeratorImpl, Destroy(this))
+NS_IMPL_RELEASE(InMemoryArcsEnumeratorImpl)
 NS_IMPL_QUERY_INTERFACE1(InMemoryArcsEnumeratorImpl, nsISimpleEnumerator)
 
 NS_IMETHODIMP
@@ -853,19 +766,6 @@ InMemoryDataSource::InMemoryDataSource(nsISupports* aOuter)
 {
     NS_INIT_AGGREGATED(aOuter);
 
-    static const size_t kBucketSizes[] = {
-        sizeof(Assertion),
-        sizeof(Entry),
-        sizeof(InMemoryArcsEnumeratorImpl),
-        sizeof(InMemoryAssertionEnumeratorImpl) };
-
-    static const int32_t kNumBuckets = sizeof(kBucketSizes) / sizeof(size_t);
-
-    // Per news://news.mozilla.org/39BEC105.5090206%40netscape.com
-    static const int32_t kInitialSize = 1024;
-
-    mAllocator.Init("nsInMemoryDataSource", kBucketSizes, kNumBuckets, kInitialSize);
-
     mForwardArcs.ops = nullptr;
     mReverseArcs.ops = nullptr;
     mPropagateChanges = true;
@@ -913,7 +813,7 @@ InMemoryDataSource::~InMemoryDataSource()
         // associated with this data source. We only need to do this
         // for the forward arcs, because the reverse arcs table
         // indexes the exact same set of resources.
-        PL_DHashTableEnumerate(&mForwardArcs, DeleteForwardArcsEntry, &mAllocator);
+        PL_DHashTableEnumerate(&mForwardArcs, DeleteForwardArcsEntry, NULL);
         PL_DHashTableFinish(&mForwardArcs);
     }
     if (mReverseArcs.ops)
@@ -929,7 +829,6 @@ InMemoryDataSource::DeleteForwardArcsEntry(PLDHashTable* aTable, PLDHashEntryHdr
                                            uint32_t aNumber, void* aArg)
 {
     Entry* entry = reinterpret_cast<Entry*>(aHdr);
-    nsFixedSizeAllocator* allocator = static_cast<nsFixedSizeAllocator*>(aArg);
 
     Assertion* as = entry->mAssertions;
     while (as) {
@@ -938,7 +837,7 @@ InMemoryDataSource::DeleteForwardArcsEntry(PLDHashTable* aTable, PLDHashEntryHdr
 
         // Unlink, and release the datasource's reference.
         doomed->mNext = doomed->u.as.mInvNext = nullptr;
-        doomed->Release(*allocator);
+        doomed->Release();
     }
     return PL_DHASH_NEXT;
 }
@@ -1177,8 +1076,8 @@ InMemoryDataSource::GetSources(nsIRDFResource* aProperty,
         return NS_ERROR_NULL_POINTER;
 
     InMemoryAssertionEnumeratorImpl* result =
-        InMemoryAssertionEnumeratorImpl::Create(this, nullptr, aProperty,
-                                                  aTarget, aTruthValue);
+        new InMemoryAssertionEnumeratorImpl(this, nullptr, aProperty,
+                                            aTarget, aTruthValue);
 
     if (! result)
         return NS_ERROR_OUT_OF_MEMORY;
@@ -1198,7 +1097,7 @@ InMemoryDataSource::GetTargets(nsIRDFResource* aSource,
     NS_PRECONDITION(aSource != nullptr, "null ptr");
     if (! aSource)
         return NS_ERROR_NULL_POINTER;
-    
+
     NS_PRECONDITION(aProperty != nullptr, "null ptr");
     if (! aProperty)
         return NS_ERROR_NULL_POINTER;
@@ -1208,8 +1107,8 @@ InMemoryDataSource::GetTargets(nsIRDFResource* aSource,
         return NS_ERROR_NULL_POINTER;
 
     InMemoryAssertionEnumeratorImpl* result =
-        InMemoryAssertionEnumeratorImpl::Create(this, aSource, aProperty,
-                                                nullptr, aTruthValue);
+        new InMemoryAssertionEnumeratorImpl(this, aSource, aProperty,
+                                            nullptr, aTruthValue);
 
     if (! result)
         return NS_ERROR_OUT_OF_MEMORY;
@@ -1269,7 +1168,7 @@ InMemoryDataSource::LockedAssert(nsIRDFResource* aSource,
         }
     }
 
-    as = Assertion::Create(mAllocator, aSource, aProperty, aTarget, aTruthValue);
+    as = new Assertion(aSource, aProperty, aTarget, aTruthValue);
     if (! as)
         return NS_ERROR_OUT_OF_MEMORY;
 
@@ -1415,7 +1314,7 @@ InMemoryDataSource::LockedUnassert(nsIRDFResource* aSource,
             else {
                 // If this second-level hash empties out, clean it up.
                 if (!root->u.hash.mPropertyHash->entryCount) {
-                    Assertion::Destroy(mAllocator, root);
+                    delete root;
                     SetForwardArcs(aSource, nullptr);
                 }
             }
@@ -1475,7 +1374,7 @@ InMemoryDataSource::LockedUnassert(nsIRDFResource* aSource,
 
     // Unlink, and release the datasource's reference
     as->mNext = as->u.as.mInvNext = nullptr;
-    as->Release(mAllocator);
+    as->Release();
 
     return NS_OK;
 }
@@ -1714,7 +1613,7 @@ InMemoryDataSource::ArcLabelsIn(nsIRDFNode* aTarget, nsISimpleEnumerator** aResu
         return NS_ERROR_NULL_POINTER;
 
     InMemoryArcsEnumeratorImpl* result =
-        InMemoryArcsEnumeratorImpl::Create(this, nullptr, aTarget);
+        new InMemoryArcsEnumeratorImpl(this, nullptr, aTarget);
 
     if (! result)
         return NS_ERROR_OUT_OF_MEMORY;
@@ -1733,7 +1632,7 @@ InMemoryDataSource::ArcLabelsOut(nsIRDFResource* aSource, nsISimpleEnumerator**
         return NS_ERROR_NULL_POINTER;
 
     InMemoryArcsEnumeratorImpl* result =
-        InMemoryArcsEnumeratorImpl::Create(this, aSource, nullptr);
+        new InMemoryArcsEnumeratorImpl(this, aSource, nullptr);
 
     if (! result)
         return NS_ERROR_OUT_OF_MEMORY;
@@ -1824,13 +1723,13 @@ InMemoryDataSource::EnsureFastContainment(nsIRDFResource* aSource)
 {
     Assertion *as = GetForwardArcs(aSource);
     bool    haveHash = (as) ? as->mHashEntry : false;
-    
+
     // if its already a hash, then nothing to do
     if (haveHash)   return(NS_OK);
 
     // convert aSource in forward hash into a hash
-    Assertion *hashAssertion = Assertion::Create(mAllocator, aSource);
-    NS_ASSERTION(hashAssertion, "unable to Assertion::Create");
+    Assertion *hashAssertion = new Assertion(aSource);
+    NS_ASSERTION(hashAssertion, "unable to create Assertion");
     if (!hashAssertion) return(NS_ERROR_OUT_OF_MEMORY);
 
     // Add the datasource's owning reference.
@@ -1965,13 +1864,12 @@ InMemoryDataSource::Mark(nsIRDFResource* aSource,
 struct SweepInfo {
     Assertion* mUnassertList;
     PLDHashTable* mReverseArcs;
-    nsFixedSizeAllocator* mAllocator;
 };
 
 NS_IMETHODIMP
 InMemoryDataSource::Sweep()
 {
-    SweepInfo info = { nullptr, &mReverseArcs, &mAllocator};
+    SweepInfo info = { nullptr, &mReverseArcs };
 
     // Remove all the assertions, but don't notify anyone.
     PL_DHashTableEnumerate(&mForwardArcs, SweepForwardArcsEntries, &info);
@@ -1997,7 +1895,7 @@ InMemoryDataSource::Sweep()
 
         // Unlink, and release the datasource's reference
         doomed->mNext = doomed->u.as.mInvNext = nullptr;
-        doomed->Release(mAllocator);
+        doomed->Release();
     }
 
     return NS_OK;
@@ -2017,12 +1915,12 @@ InMemoryDataSource::SweepForwardArcsEntries(PLDHashTable* aTable,
     if (as && (as->mHashEntry))
     {
         // Stuff in sub-hashes must be swept recursively (max depth: 1)
-        PL_DHashTableEnumerate(as->u.hash.mPropertyHash, 
+        PL_DHashTableEnumerate(as->u.hash.mPropertyHash,
                                SweepForwardArcsEntries, info);
 
         // If the sub-hash is now empty, clean it up.
         if (!as->u.hash.mPropertyHash->entryCount) {
-            Assertion::Destroy(*info->mAllocator, as);
+            delete as;
             result = PL_DHASH_REMOVE;
         }
 
diff --git a/services/healthreport/healthreporter.jsm b/services/healthreport/healthreporter.jsm
index 8e01f36cb732..9c1b9a76fa31 100644
--- a/services/healthreport/healthreporter.jsm
+++ b/services/healthreport/healthreporter.jsm
@@ -90,8 +90,6 @@ function AbstractHealthReporter(branch, policy, sessionRecorder) {
 
   this._errors = [];
 
-  this._pullOnlyProviders = {};
-  this._pullOnlyProvidersRegistered = false;
   this._lastDailyDate = null;
 
   // Yes, this will probably run concurrently with remaining constructor work.
@@ -177,12 +175,13 @@ AbstractHealthReporter.prototype = Object.freeze({
     this._log.info("Initializing provider manager.");
     this._providerManager = new Metrics.ProviderManager(this._storage);
     this._providerManager.onProviderError = this._recordError.bind(this);
+    this._providerManager.onProviderInit = this._initProvider.bind(this);
     this._providerManagerInProgress = true;
 
     let catString = this._prefs.get("service.providerCategories") || "";
     if (catString.length) {
       for (let category of catString.split(",")) {
-        yield this.registerProvidersFromCategoryManager(category);
+        yield this._providerManager.registerProvidersFromCategoryManager(category);
       }
     }
   },
@@ -400,173 +399,9 @@ AbstractHealthReporter.prototype = Object.freeze({
     return this._providerManager.getProvider(name);
   },
 
-  /**
-   * Register a `Metrics.Provider` with this instance.
-   *
-   * This needs to be called or no data will be collected. See also
-   * `registerProvidersFromCategoryManager`.
-   *
-   * @param provider
-   *        (Metrics.Provider) The provider to register for collection.
-   */
-  registerProvider: function (provider) {
-    return this._providerManager.registerProvider(provider);
-  },
-
-  /**
-   * Registers a provider from its constructor function.
-   *
-   * If the provider is pull-only, it will be stashed away and
-   * initialized later. Null will be returned.
-   *
-   * If it is not pull-only, it will be initialized immediately and a
-   * promise will be returned. The promise will be resolved when the
-   * provider has finished initializing.
-   */
-  registerProviderFromType: function (type) {
-    let proto = type.prototype;
-    if (proto.pullOnly) {
-      this._log.info("Provider is pull-only. Deferring initialization: " +
-                     proto.name);
-      this._pullOnlyProviders[proto.name] = type;
-
-      return null;
-    }
-
-    let provider = this.initProviderFromType(type);
-    return this.registerProvider(provider);
-  },
-
-  /**
-   * Registers providers from a category manager category.
-   *
-   * This examines the specified category entries and registers found
-   * providers.
-   *
-   * Category entries are essentially JS modules and the name of the symbol
-   * within that module that is a `Metrics.Provider` instance.
-   *
-   * The category entry name is the name of the JS type for the provider. The
-   * value is the resource:// URI to import which makes this type available.
-   *
-   * Example entry:
-   *
-   *   FooProvider resource://gre/modules/foo.jsm
-   *
-   * One can register entries in the application's .manifest file. e.g.
-   *
-   *   category healthreport-js-provider FooProvider resource://gre/modules/foo.jsm
-   *
-   * Then to load them:
-   *
-   *   let reporter = getHealthReporter("healthreport.");
-   *   reporter.registerProvidersFromCategoryManager("healthreport-js-provider");
-   *
-   * @param category
-   *        (string) Name of category to query and load from.
-   */
-  registerProvidersFromCategoryManager: function (category) {
-    this._log.info("Registering providers from category: " + category);
-    let cm = Cc["@mozilla.org/categorymanager;1"]
-               .getService(Ci.nsICategoryManager);
-
-    let promises = [];
-    let enumerator = cm.enumerateCategory(category);
-    while (enumerator.hasMoreElements()) {
-      let entry = enumerator.getNext()
-                            .QueryInterface(Ci.nsISupportsCString)
-                            .toString();
-
-      let uri = cm.getCategoryEntry(category, entry);
-      this._log.info("Attempting to load provider from category manager: " +
-                     entry + " from " + uri);
-
-      try {
-        let ns = {};
-        Cu.import(uri, ns);
-
-        let promise = this.registerProviderFromType(ns[entry]);
-        if (promise) {
-          promises.push(promise);
-        }
-      } catch (ex) {
-        this._recordError("Error registering provider from category manager : " +
-                          entry + ": ", ex);
-        continue;
-      }
-    }
-
-    return Task.spawn(function wait() {
-      for (let promise of promises) {
-        yield promise;
-      }
-    });
-  },
-
-  initProviderFromType: function (providerType) {
-    let provider = new providerType();
+  _initProvider: function (provider) {
     provider.initPreferences(this._branch + "provider.");
     provider.healthReporter = this;
-
-    return provider;
-  },
-
-  /**
-   * Ensure that pull-only providers are registered.
-   */
-  ensurePullOnlyProvidersRegistered: function () {
-    if (this._pullOnlyProvidersRegistered) {
-      return Promise.resolve();
-    }
-
-    let onFinished = function () {
-      this._pullOnlyProvidersRegistered = true;
-
-      return Promise.resolve();
-    }.bind(this);
-
-    return Task.spawn(function registerPullProviders() {
-      for each (let providerType in this._pullOnlyProviders) {
-        try {
-          let provider = this.initProviderFromType(providerType);
-          yield this.registerProvider(provider);
-        } catch (ex) {
-          this._recordError("Error registering pull-only provider", ex);
-        }
-      }
-    }.bind(this)).then(onFinished, onFinished);
-  },
-
-  ensurePullOnlyProvidersUnregistered: function () {
-    if (!this._pullOnlyProvidersRegistered) {
-      return Promise.resolve();
-    }
-
-    let onFinished = function () {
-      this._pullOnlyProvidersRegistered = false;
-
-      return Promise.resolve();
-    }.bind(this);
-
-    return Task.spawn(function unregisterPullProviders() {
-      for (let provider of this._providerManager.providers) {
-        if (!provider.pullOnly) {
-          continue;
-        }
-
-        this._log.info("Shutting down pull-only provider: " +
-                       provider.name);
-
-        try {
-          yield provider.shutdown();
-        } catch (ex) {
-          this._recordError("Error when shutting down provider: " +
-                            provider.name, ex);
-        } finally {
-          this._providerManager.unregisterProvider(provider.name);
-        }
-      }
-    }.bind(this)).then(onFinished, onFinished);
   },
 
   /**
@@ -682,7 +517,7 @@ AbstractHealthReporter.prototype = Object.freeze({
    */
   collectAndObtainJSONPayload: function (asObject=false) {
     return Task.spawn(function collectAndObtain() {
-      yield this.ensurePullOnlyProvidersRegistered();
+      yield this._providerManager.ensurePullOnlyProvidersRegistered();
 
       let payload;
       let error;
@@ -695,7 +530,7 @@ AbstractHealthReporter.prototype = Object.freeze({
         this._collectException("Error collecting and/or retrieving JSON payload",
                                ex);
       } finally {
-        yield this.ensurePullOnlyProvidersUnregistered();
+        yield this._providerManager.ensurePullOnlyProvidersUnregistered();
 
         if (error) {
           throw error;
@@ -1098,7 +933,7 @@ HealthReporter.prototype = Object.freeze({
    */
   requestDataUpload: function (request) {
     return Task.spawn(function doUpload() {
-      yield this.ensurePullOnlyProvidersRegistered();
+      yield this._providerManager.ensurePullOnlyProvidersRegistered();
       try {
         yield this.collectMeasurements();
         try {
@@ -1107,7 +942,7 @@ HealthReporter.prototype = Object.freeze({
           this._onSubmitDataRequestFailure(ex);
         }
       } finally {
-        yield this.ensurePullOnlyProvidersUnregistered();
+        yield this._providerManager.ensurePullOnlyProvidersUnregistered();
       }
     }.bind(this));
   },
diff --git a/services/healthreport/tests/xpcshell/test_healthreporter.js b/services/healthreport/tests/xpcshell/test_healthreporter.js
index 44a698cec205..919ee99590fa 100644
--- a/services/healthreport/tests/xpcshell/test_healthreporter.js
+++ b/services/healthreport/tests/xpcshell/test_healthreporter.js
@@ -173,25 +173,6 @@ add_task(function test_shutdown_when_provider_manager_errors() {
   do_check_eq(reporter.storageCloseCount, 1);
 });
 
-add_task(function test_register_providers_from_category_manager() {
-  const category = "healthreporter-js-modules";
-
-  let cm = Cc["@mozilla.org/categorymanager;1"]
-             .getService(Ci.nsICategoryManager);
-  cm.addCategoryEntry(category, "DummyProvider",
-                      "resource://testing-common/services/metrics/mocks.jsm",
-                      false, true);
-
-  let reporter = yield getReporter("category_manager");
-  try {
-    do_check_eq(reporter._providerManager._providers.size, 0);
-    yield reporter.registerProvidersFromCategoryManager(category);
-    do_check_eq(reporter._providerManager._providers.size, 1);
-  } finally {
-    reporter._shutdown();
-  }
-});
-
 // Pull-only providers are only initialized at collect time.
 add_task(function test_pull_only_providers() {
   const category = "healthreporter-constant-only";
@@ -208,16 +189,16 @@ add_task(function test_pull_only_providers() {
   let reporter = yield getReporter("constant_only_providers");
   try {
     do_check_eq(reporter._providerManager._providers.size, 0);
-    yield reporter.registerProvidersFromCategoryManager(category);
+    yield reporter._providerManager.registerProvidersFromCategoryManager(category);
     do_check_eq(reporter._providerManager._providers.size, 1);
     do_check_true(reporter._storage.hasProvider("DummyProvider"));
     do_check_false(reporter._storage.hasProvider("DummyConstantProvider"));
     do_check_neq(reporter.getProvider("DummyProvider"), null);
     do_check_null(reporter.getProvider("DummyConstantProvider"));
 
-    yield reporter.ensurePullOnlyProvidersRegistered();
+    yield reporter._providerManager.ensurePullOnlyProvidersRegistered();
     yield reporter.collectMeasurements();
-    yield reporter.ensurePullOnlyProvidersUnregistered();
+    yield reporter._providerManager.ensurePullOnlyProvidersUnregistered();
 
     do_check_eq(reporter._providerManager._providers.size, 1);
     do_check_true(reporter._storage.hasProvider("DummyConstantProvider"));
@@ -236,7 +217,7 @@ add_task(function test_collect_daily() {
   try {
     let now = new Date();
     let provider = new DummyProvider();
-    yield reporter.registerProvider(provider);
+    yield reporter._providerManager.registerProvider(provider);
     yield reporter.collectMeasurements();
 
     do_check_eq(provider.collectConstantCount, 1);
@@ -295,7 +276,7 @@ add_task(function test_json_payload_dummy_provider() {
   let reporter = yield getReporter("json_payload_dummy_provider");
 
   try {
-    yield reporter.registerProvider(new DummyProvider());
+    yield reporter._providerManager.registerProvider(new DummyProvider());
     yield reporter.collectMeasurements();
     let payload = yield reporter.getJSONPayload();
     print(payload);
@@ -314,7 +295,7 @@ add_task(function test_collect_and_obtain_json_payload() {
   let reporter = yield getReporter("collect_and_obtain_json_payload");
 
   try {
-    yield reporter.registerProvider(new DummyProvider());
+    yield reporter._providerManager.registerProvider(new DummyProvider());
     let payload = yield reporter.collectAndObtainJSONPayload();
     do_check_eq(typeof payload, "string");
 
@@ -343,7 +324,7 @@ add_task(function test_constant_only_providers_in_json_payload() {
 
   let reporter = yield getReporter("constant_only_providers_in_json_payload");
   try {
-    yield reporter.registerProvidersFromCategoryManager(category);
+    yield reporter._providerManager.registerProvidersFromCategoryManager(category);
 
     let payload = yield reporter.collectAndObtainJSONPayload();
     let o = JSON.parse(payload);
@@ -388,7 +369,7 @@ add_task(function test_json_payload_multiple_days() {
 
   try {
     let provider = new DummyProvider();
-    yield reporter.registerProvider(provider);
+    yield reporter._providerManager.registerProvider(provider);
 
     let now = new Date();
     let m = provider.getMeasurement("DummyMeasurement", 1);
@@ -418,7 +399,7 @@ add_task(function test_idle_daily() {
   let reporter = yield getReporter("idle_daily");
   try {
     let provider = new DummyProvider();
-    yield reporter.registerProvider(provider);
+    yield reporter._providerManager.registerProvider(provider);
 
     let now = new Date();
     let m = provider.getMeasurement("DummyMeasurement", 1);
@@ -459,8 +440,8 @@ add_task(function test_data_submission_transport_failure() {
 add_task(function test_data_submission_success() {
   let [reporter, server] = yield getReporterAndServer("data_submission_success");
   try {
-    yield reporter.registerProviderFromType(DummyProvider);
-    yield reporter.registerProviderFromType(DummyConstantProvider);
+    yield reporter._providerManager.registerProviderFromType(DummyProvider);
+    yield reporter._providerManager.registerProviderFromType(DummyConstantProvider);
 
     do_check_eq(reporter.lastPingDate.getTime(), 0);
     do_check_false(reporter.haveRemoteData());
@@ -488,7 +469,7 @@ add_task(function test_data_submission_success() {
 add_task(function test_recurring_daily_pings() {
   let [reporter, server] = yield getReporterAndServer("recurring_daily_pings");
   try {
-    reporter.registerProvider(new DummyProvider());
+    reporter._providerManager.registerProvider(new DummyProvider());
 
     let policy = reporter._policy;
 
diff --git a/services/metrics/Metrics.jsm b/services/metrics/Metrics.jsm
index 3daf750c5cda..0b247e53daac 100644
--- a/services/metrics/Metrics.jsm
+++ b/services/metrics/Metrics.jsm
@@ -8,7 +8,7 @@
 
 this.EXPORTED_SYMBOLS = ["Metrics"];
 
-const {utils: Cu} = Components;
+const {classes: Cc, interfaces: Ci, utils: Cu} = Components;
 
 const MILLISECONDS_PER_DAY = 24 * 60 * 60 * 1000;
 
diff --git a/services/metrics/modules-testing/mocks.jsm b/services/metrics/modules-testing/mocks.jsm
index 8df9c64e03c5..bb1441f4f432 100644
--- a/services/metrics/modules-testing/mocks.jsm
+++ b/services/metrics/modules-testing/mocks.jsm
@@ -40,7 +40,9 @@ DummyMeasurement.prototype = {
 
 
 this.DummyProvider = function DummyProvider(name="DummyProvider") {
-  this.name = name;
+  Object.defineProperty(this, "name", {
+    value: name,
+  });
 
   this.measurementTypes = [DummyMeasurement];
 
@@ -59,6 +61,8 @@ this.DummyProvider = function DummyProvider(name="DummyProvider") {
 DummyProvider.prototype = {
   __proto__: Metrics.Provider.prototype,
 
+  name: "DummyProvider",
+
   collectConstantData: function () {
     this.collectConstantCount++;
 
@@ -100,6 +104,8 @@ this.DummyConstantProvider = function () {
 DummyConstantProvider.prototype = {
   __proto__: DummyProvider.prototype,
 
+  name: "DummyConstantProvider",
+
   pullOnly: true,
 };
 
diff --git a/services/metrics/providermanager.jsm b/services/metrics/providermanager.jsm
index fa175e752839..dd118da3d57f 100644
--- a/services/metrics/providermanager.jsm
+++ b/services/metrics/providermanager.jsm
@@ -7,7 +7,7 @@
 #ifndef MERGED_COMPARTMENT
 this.EXPORTED_SYMBOLS = ["ProviderManager"];
 
-const {utils: Cu} = Components;
+const {classes: Cc, interfaces: Ci, utils: Cu} = Components;
 
 Cu.import("resource://gre/modules/services/metrics/dataprovider.jsm");
 #endif
@@ -32,6 +32,13 @@ this.ProviderManager = function (storage) {
 
   this._providerInitQueue = [];
   this._providerInitializing = false;
+
+  this._pullOnlyProviders = {};
+  this._pullOnlyProvidersRegistered = false;
+
+  // Callback to allow customization of providers after they are constructed
+  // but before they call out into their initialization code.
+  this.onProviderInit = null;
 }
 
 this.ProviderManager.prototype = Object.freeze({
@@ -57,6 +64,72 @@ this.ProviderManager.prototype = Object.freeze({
     return provider.provider;
   },
 
+  /**
+   * Registers providers from a category manager category.
+   *
+   * This examines the specified category entries and registers found
+   * providers.
+   *
+   * Category entries are essentially JS modules and the name of the symbol
+   * within that module that is a `Metrics.Provider` instance.
+   *
+   * The category entry name is the name of the JS type for the provider. The
+   * value is the resource:// URI to import which makes this type available.
+   *
+   * Example entry:
+   *
+   *   FooProvider resource://gre/modules/foo.jsm
+   *
+   * One can register entries in the application's .manifest file. e.g.
+   *
+   *   category healthreport-js-provider FooProvider resource://gre/modules/foo.jsm
+   *
+   * Then to load them:
+   *
+   *   let reporter = getHealthReporter("healthreport.");
+   *   reporter.registerProvidersFromCategoryManager("healthreport-js-provider");
+   *
+   * @param category
+   *        (string) Name of category to query and load from.
+   */
+  registerProvidersFromCategoryManager: function (category) {
+    this._log.info("Registering providers from category: " + category);
+    let cm = Cc["@mozilla.org/categorymanager;1"]
+               .getService(Ci.nsICategoryManager);
+
+    let promises = [];
+    let enumerator = cm.enumerateCategory(category);
+    while (enumerator.hasMoreElements()) {
+      let entry = enumerator.getNext()
+                            .QueryInterface(Ci.nsISupportsCString)
+                            .toString();
+
+      let uri = cm.getCategoryEntry(category, entry);
+      this._log.info("Attempting to load provider from category manager: " +
+                     entry + " from " + uri);
+
+      try {
+        let ns = {};
+        Cu.import(uri, ns);
+
+        let promise = this.registerProviderFromType(ns[entry]);
+        if (promise) {
+          promises.push(promise);
+        }
+      } catch (ex) {
+        this._recordError("Error registering provider from category manager : " +
+                          entry + ": ", ex);
+        continue;
+      }
+    }
+
+    return Task.spawn(function wait() {
+      for (let promise of promises) {
+        yield promise;
+      }
+    });
+  },
+
   /**
    * Registers a `MetricsProvider` with this manager.
    *
@@ -93,6 +166,47 @@ this.ProviderManager.prototype = Object.freeze({
     return deferred.promise;
   },
 
+  /**
+   * Registers a provider from its constructor function.
+   *
+   * If the provider is pull-only, it will be stashed away and
+   * initialized later. Null will be returned.
+   *
+   * If it is not pull-only, it will be initialized immediately and a
+   * promise will be returned. The promise will be resolved when the
+   * provider has finished initializing.
+   */
+  registerProviderFromType: function (type) {
+    let proto = type.prototype;
+    if (proto.pullOnly) {
+      this._log.info("Provider is pull-only. Deferring initialization: " +
+                     proto.name);
+      this._pullOnlyProviders[proto.name] = type;
+
+      return null;
+    }
+
+    let provider = this._initProviderFromType(type);
+    return this.registerProvider(provider);
+  },
+
+  /**
+   * Initializes a provider from its type.
+   *
+   * This is how a constructor function should be turned into a provider
+   * instance.
+   *
+   * A side-effect is the provider is registered with the manager.
+   */
+  _initProviderFromType: function (type) {
+    let provider = new type();
+    if (this.onProviderInit) {
+      this.onProviderInit(provider);
+    }
+
+    return provider;
+  },
+
   /**
    * Remove a named provider from the manager.
    *
@@ -103,6 +217,64 @@ this.ProviderManager.prototype = Object.freeze({
     this._providers.delete(name);
   },
 
+  /**
+   * Ensure that pull-only providers are registered.
+   */
+  ensurePullOnlyProvidersRegistered: function () {
+    if (this._pullOnlyProvidersRegistered) {
+      return Promise.resolve();
+    }
+
+    let onFinished = function () {
+      this._pullOnlyProvidersRegistered = true;
+
+      return Promise.resolve();
+    }.bind(this);
+
+    return Task.spawn(function registerPullProviders() {
+      for each (let providerType in this._pullOnlyProviders) {
+        try {
+          let provider = this._initProviderFromType(providerType);
+          yield this.registerProvider(provider);
+        } catch (ex) {
+          this._recordError("Error registering pull-only provider", ex);
+        }
+      }
+    }.bind(this)).then(onFinished, onFinished);
+  },
+
+  ensurePullOnlyProvidersUnregistered: function () {
+    if (!this._pullOnlyProvidersRegistered) {
+      return Promise.resolve();
+    }
+
+    let onFinished = function () {
+      this._pullOnlyProvidersRegistered = false;
+
+      return Promise.resolve();
+    }.bind(this);
+
+    return Task.spawn(function unregisterPullProviders() {
+      for (let provider of this.providers) {
+        if (!provider.pullOnly) {
+          continue;
+        }
+
+        this._log.info("Shutting down pull-only provider: " +
+                       provider.name);
+
+        try {
+          yield provider.shutdown();
+        } catch (ex) {
+          this._recordError("Error when shutting down provider: " +
+                            provider.name, ex);
+        } finally {
+          this.unregisterProvider(provider.name);
+        }
+      }
+    }.bind(this)).then(onFinished, onFinished);
+  },
+
   _popAndInitProvider: function () {
     if (!this._providerInitQueue.length || this._providerInitializing) {
       return;
diff --git a/services/metrics/tests/xpcshell/test_metrics_provider_manager.js b/services/metrics/tests/xpcshell/test_metrics_provider_manager.js
index 0abc1b293d12..94ecdfcdff97 100644
--- a/services/metrics/tests/xpcshell/test_metrics_provider_manager.js
+++ b/services/metrics/tests/xpcshell/test_metrics_provider_manager.js
@@ -3,7 +3,7 @@
 
 "use strict";
 
-const {utils: Cu} = Components;
+const {classes: Cc, interfaces: Ci, utils: Cu} = Components;
 
 Cu.import("resource://gre/modules/Metrics.jsm");
 Cu.import("resource://testing-common/services/metrics/mocks.jsm");
@@ -49,6 +49,26 @@ add_task(function test_register_provider() {
   yield storage.close();
 });
 
+add_task(function test_register_providers_from_category_manager() {
+  const category = "metrics-providers-js-modules";
+
+  let cm = Cc["@mozilla.org/categorymanager;1"]
+             .getService(Ci.nsICategoryManager);
+  cm.addCategoryEntry(category, "DummyProvider",
+                      "resource://testing-common/services/metrics/mocks.jsm",
+                      false, true);
+
+  let storage = yield Metrics.Storage("register_providers_from_category_manager");
+  let manager = new Metrics.ProviderManager(storage);
+  try {
+    do_check_eq(manager._providers.size, 0);
+    yield manager.registerProvidersFromCategoryManager(category);
+    do_check_eq(manager._providers.size, 1);
+  } finally {
+    yield storage.close();
+  }
+});
+
 add_task(function test_collect_constant_data() {
   let storage = yield Metrics.Storage("collect_constant_data");
   let errorCount = 0;
diff --git a/testing/machine-configuration.json b/testing/machine-configuration.json
index 9582f10a1dee..29118c0fdde8 100644
--- a/testing/machine-configuration.json
+++ b/testing/machine-configuration.json
@@ -1,8 +1,8 @@
 {
     "win7": {
         "screen_resolution": {
-            "x": 1024,
-            "y": 768
+            "x": 1280,
+            "y": 1024 
         },
         "mouse_position": {
             "x": 1010,
diff --git a/testing/marionette/client/marionette/runtests.py b/testing/marionette/client/marionette/runtests.py
index 20431763d99c..2641c78ede09 100644
--- a/testing/marionette/client/marionette/runtests.py
+++ b/testing/marionette/client/marionette/runtests.py
@@ -66,7 +66,7 @@ class MarionetteTestResult(unittest._TextTestResult):
                     return
                 self.stream.writeln('START LOG:')
                 for line in testcase.loglines:
-                    self.stream.writeln(' '.join(line))
+                    self.stream.writeln(' '.join(line).encode('ascii', 'replace'))
                 self.stream.writeln('END LOG:')
 
     def getPerfData(self, test):
diff --git a/testing/mochitest/android.json b/testing/mochitest/android.json
index d2bd48356a29..db94be247f2c 100644
--- a/testing/mochitest/android.json
+++ b/testing/mochitest/android.json
@@ -23,6 +23,7 @@
  "content/base/test/test_mixed_content_blocker_bug803225.html": "TIMED_OUT, SSL_REQUIRED",
  "content/base/test/test_mutationobservers.html": "",
  "content/base/test/test_plugin_freezing.html": "CLICK_TO_PLAY",
+ "content/base/test/test_object.html": "",
  "content/base/test/test_range_bounds.html": "",
  "content/base/test/test_reentrant_flush.html": "RANDOM",
  "content/base/test/test_sync_xhr_timer.xhtml": "RANDOM",
diff --git a/testing/specialpowers/content/specialpowersAPI.js b/testing/specialpowers/content/specialpowersAPI.js
index 6db2ce8a1603..f3ce6e5ffabf 100644
--- a/testing/specialpowers/content/specialpowersAPI.js
+++ b/testing/specialpowers/content/specialpowersAPI.js
@@ -711,6 +711,17 @@ SpecialPowersAPI.prototype = {
      return obj1 instanceof obj2;
   },
 
+  // Returns a privileged getter from an object. GetOwnPropertyDescriptor does
+  // not work here because xray wrappers don't properly implement it.
+  //
+  // This terribleness is used by content/base/test/test_object.html because
+  // <object> and <embed> tags will spawn plugins if their prototype is touched,
+  // so we need to get and cache the getter of |hasRunningPlugin| if we want to
+  // call it without paradoxically spawning the plugin.
+  do_lookupGetter: function(obj, name) {
+    return Object.prototype.__lookupGetter__.call(obj, name);
+  },
+
   // Mimic the get*Pref API
   getBoolPref: function(aPrefName) {
     return (this._getPref(aPrefName, 'BOOL'));
diff --git a/testing/talos/talos.json b/testing/talos/talos.json
index d5bb69bafb0d..f15eb94ebb96 100644
--- a/testing/talos/talos.json
+++ b/testing/talos/talos.json
@@ -1,6 +1,6 @@
 {
     "talos.zip": {
-        "url": "http://build.mozilla.org/talos/zips/talos.880a267bfacc.zip",
+        "url": "http://build.mozilla.org/talos/zips/talos.1e4aec80d7b5.zip",
         "path": ""
     }
 }
diff --git a/toolkit/components/ctypes/tests/unit/head.js b/toolkit/components/ctypes/tests/unit/head.js
index 3aabd06a5c26..fd7043d45a6a 100644
--- a/toolkit/components/ctypes/tests/unit/head.js
+++ b/toolkit/components/ctypes/tests/unit/head.js
@@ -2,7 +2,6 @@ try {
   // We might be running without privileges, in which case it's up to the
   // harness to give us the 'ctypes' object.
   Components.utils.import("resource://gre/modules/ctypes.jsm");
-  Components.utils.atline = true;
 } catch(e) {
 }
 
diff --git a/toolkit/components/social/SocialService.jsm b/toolkit/components/social/SocialService.jsm
index 8307b39ce7bd..1318c5b2d0d1 100644
--- a/toolkit/components/social/SocialService.jsm
+++ b/toolkit/components/social/SocialService.jsm
@@ -375,7 +375,8 @@ this.SocialService = {
     let installOrigin = principal.origin;
 
     let id = getAddonIDFromOrigin(installOrigin);
-    if (bs.getAddonBlocklistState(id, data.version || "0") == Ci.nsIBlocklistService.STATE_BLOCKED)
+    let version = data && data.version ? data.version : "0";
+    if (bs.getAddonBlocklistState(id, version) == Ci.nsIBlocklistService.STATE_BLOCKED)
       throw new Error("installProvider: provider with origin [" +
                       installOrigin + "] is blocklisted");
 
diff --git a/toolkit/components/typeaheadfind/nsTypeAheadFind.cpp b/toolkit/components/typeaheadfind/nsTypeAheadFind.cpp
index 824aaf6227aa..ad31c4cbbb75 100644
--- a/toolkit/components/typeaheadfind/nsTypeAheadFind.cpp
+++ b/toolkit/components/typeaheadfind/nsTypeAheadFind.cpp
@@ -94,9 +94,10 @@ nsresult
 nsTypeAheadFind::Init(nsIDocShell* aDocShell)
 {
   nsCOMPtr<nsIPrefBranch> prefInternal(do_GetService(NS_PREFSERVICE_CONTRACTID));
-  mSearchRange = new nsRange();
-  mStartPointRange = new nsRange();
-  mEndPointRange = new nsRange();
+
+  mSearchRange = nullptr;
+  mStartPointRange = nullptr;
+  mEndPointRange = nullptr;
   if (!prefInternal || !EnsureFind())
     return NS_ERROR_FAILURE;
 
@@ -166,12 +167,12 @@ nsTypeAheadFind::SetDocShell(nsIDocShell* aDocShell)
 
   nsCOMPtr<nsIPresShell> presShell;
   presShell = aDocShell->GetPresShell();
-  mPresShell = do_GetWeakReference(presShell);      
+  mPresShell = do_GetWeakReference(presShell);
 
   mStartFindRange = nullptr;
-  mStartPointRange = new nsRange();
-  mSearchRange = new nsRange();
-  mEndPointRange = new nsRange();
+  mStartPointRange = nullptr;
+  mSearchRange = nullptr;
+  mEndPointRange = nullptr;
 
   mFoundLink = nullptr;
   mFoundEditable = nullptr;
@@ -361,6 +362,10 @@ nsTypeAheadFind::FindItNow(nsIPresShell *aPresShell, bool aIsLinksOnly,
   }
 
   int16_t rangeCompareResult = 0;
+  if (!mStartPointRange) {
+    mStartPointRange = new nsRange(presShell->GetDocument());
+  }
+
   mStartPointRange->CompareBoundaryPoints(nsIDOMRange::START_TO_START, mSearchRange, &rangeCompareResult);
   // No need to wrap find in doc if starting at beginning
   bool hasWrapped = (rangeCompareResult < 0);
@@ -621,6 +626,10 @@ nsTypeAheadFind::FindItNow(nsIPresShell *aPresShell, bool aIsLinksOnly,
         // at end of document and go to beginning
         nsCOMPtr<nsIDOMRange> tempRange;
         mStartPointRange->CloneRange(getter_AddRefs(tempRange));
+        if (!mEndPointRange) {
+          mEndPointRange = new nsRange(presShell->GetDocument());
+        }
+
         mStartPointRange = mEndPointRange;
         mEndPointRange = tempRange;
       }
@@ -719,6 +728,14 @@ nsTypeAheadFind::GetSearchContainers(nsISupports *aContainer,
 
   uint32_t childCount = rootContent->GetChildCount();
 
+  if (!mSearchRange) {
+    mSearchRange = new nsRange(rootContent);
+  }
+
+  if (!mEndPointRange) {
+    mEndPointRange = new nsRange(rootContent);
+  }
+
   mSearchRange->SelectNodeContents(rootNode);
 
   mEndPointRange->SetEnd(rootNode, childCount);
@@ -736,6 +753,10 @@ nsTypeAheadFind::GetSearchContainers(nsISupports *aContainer,
       selection->GetRangeAt(0, getter_AddRefs(currentSelectionRange));
   }
 
+  if (!mStartPointRange) {
+    mStartPointRange = new nsRange(doc);
+  }
+
   if (!currentSelectionRange) {
     // Ensure visible range, move forward if necessary
     // This uses ignores the return value, but usese the side effect of
diff --git a/toolkit/crashreporter/google-breakpad/src/common/linux/dump_symbols.cc b/toolkit/crashreporter/google-breakpad/src/common/linux/dump_symbols.cc
index dc27c050027e..e6a9f3d38c01 100644
--- a/toolkit/crashreporter/google-breakpad/src/common/linux/dump_symbols.cc
+++ b/toolkit/crashreporter/google-breakpad/src/common/linux/dump_symbols.cc
@@ -626,7 +626,7 @@ bool LoadSymbols(const string& obj_file,
     }
   }
 
-  if (!found_debug_info_section && symbol_data != ONLY_CFI) {
+  if (!found_debug_info_section) {
     fprintf(stderr, "%s: file contains no debugging information"
             " (no \".stab\" or \".debug_info\" sections)\n",
             obj_file.c_str());
diff --git a/tools/profiler/Makefile.in b/tools/profiler/Makefile.in
index 878c13c4a11c..52452b70784d 100644
--- a/tools/profiler/Makefile.in
+++ b/tools/profiler/Makefile.in
@@ -25,7 +25,6 @@ EXPORTS += \
 LOCAL_INCLUDES += \
   -I$(topsrcdir)/mozglue/linker \
   -I$(topsrcdir)/ipc/chromium/src \
-  -I$(topsrcdir)/toolkit/crashreporter/google-breakpad/src \
   $(NULL)
 
 ifneq (,$(filter armeabi,$(ANDROID_CPU_ARCH)))
@@ -46,10 +45,6 @@ CPPSRCS		= \
   nsProfilerFactory.cpp \
   nsProfiler.cpp \
   TableTicker.cpp \
-  TableTicker2.cpp \
-  UnwinderThread2.cpp \
-  ProfileEntry2.cpp \
-  local_debug_info_symbolizer.cc \
   JSObjectBuilder.cpp \
   JSCustomObjectBuilder.cpp \
   $(NULL)
@@ -70,8 +65,6 @@ CPPSRCS += \
   shared-libraries-macos.cc \
   platform-macos.cc \
   $(NULL)
-CMMSRCS += \
-  shim_mac_dump_syms.mm
 endif
 
 ifeq ($(OS_TARGET),WINNT)
diff --git a/tools/profiler/PlatformMacros.h b/tools/profiler/PlatformMacros.h
deleted file mode 100644
index 5f8f6d3dd39c..000000000000
--- a/tools/profiler/PlatformMacros.h
+++ /dev/null
@@ -1,70 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef SPS_PLATFORM_MACROS_H
-#define SPS_PLATFORM_MACROS_H
-
-/* Define platform selection macros in a consistent way.  Don't add
-   anything else to this file, so it can remain freestanding.  The
-   primary factorisation is on (ARCH,OS) pairs ("PLATforms") but ARCH_
-   and OS_ macros are defined too, since they are sometimes
-   convenient. */
-
-#undef SPS_PLAT_arm_android
-#undef SPS_PLAT_amd64_linux
-#undef SPS_PLAT_x86_linux
-#undef SPS_PLAT_amd64_darwin
-#undef SPS_PLAT_x86_darwin
-#undef SPS_PLAT_x86_windows
-
-#undef SPS_ARCH_arm
-#undef SPS_ARCH_x86
-#undef SPS_ARCH_amd64
-
-#undef SPS_OS_android
-#undef SPS_OS_linux
-#undef SPS_OS_darwin
-#undef SPS_OS_windows
-
-#if defined(__linux__) && defined(__x86_64__)
-#  define SPS_PLAT_amd64_linux 1
-#  define SPS_ARCH_amd64 1
-#  define SPS_OS_linux 1
-
-#elif defined(__linux__) && defined(__arm__) && defined(ANDROID)
-#  define SPS_PLAT_arm_android 1
-#  define SPS_ARCH_arm 1
-#  define SPS_OS_android 1
-
-#elif defined(__linux__) && defined(__i386__) && !defined(ANDROID)
-#  define SPS_PLAT_x86_linux 1
-#  define SPS_ARCH_x86 1
-#  define SPS_OS_linux 1
-
-#elif defined(__APPLE__) && defined(__x86_64__)
-#  define SPS_PLAT_amd64_darwin 1
-#  define SPS_ARCH_amd64 1
-#  define SPS_OS_darwin 1
-
-#elif defined(__APPLE__) && defined(__i386__)
-#  define SPS_PLAT_x86_darwin 1
-#  define SPS_ARCH_x86 1
-#  define SPS_OS_darwin 1
-
-#elif defined(_MSC_VER) && defined(_WIN32) && !defined(_WIN64)
-#  define SPS_PLAT_x86_windows 1
-#  define SPS_ARCH_x86 1
-#  define SPS_OS_windows 1
-
-#elif defined(__linux__) && defined(__i386__) && defined(ANDROID)
-#  define SPS_PLAT_x86_android 1
-#  define SPS_ARCH_x86 1
-#  define SPS_OS_android 1
-
-#else
-#  error "Unsupported platform"
-#endif
-
-#endif /* ndef SPS_PLATFORM_MACROS_H */
diff --git a/tools/profiler/ProfileEntry2.cpp b/tools/profiler/ProfileEntry2.cpp
deleted file mode 100644
index 5b591f0c2a87..000000000000
--- a/tools/profiler/ProfileEntry2.cpp
+++ /dev/null
@@ -1,338 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include <iostream>
-#include "sps_sampler.h"
-#include "platform.h"
-#include "nsThreadUtils.h"
-
-// JSON
-#include "JSObjectBuilder.h"
-
-// Self
-#include "ProfileEntry2.h"
-
-#if _MSC_VER
- #define snprintf _snprintf
-#endif
-
-////////////////////////////////////////////////////////////////////////
-// BEGIN ProfileEntry2
-
-ProfileEntry2::ProfileEntry2()
-  : mTagData(NULL)
-  , mTagName(0)
-{ }
-
-// aTagData must not need release (i.e. be a string from the text segment)
-ProfileEntry2::ProfileEntry2(char aTagName, const char *aTagData)
-  : mTagData(aTagData)
-  , mTagName(aTagName)
-{ }
-
-ProfileEntry2::ProfileEntry2(char aTagName, void *aTagPtr)
-  : mTagPtr(aTagPtr)
-  , mTagName(aTagName)
-{ }
-
-ProfileEntry2::ProfileEntry2(char aTagName, double aTagFloat)
-  : mTagFloat(aTagFloat)
-  , mTagName(aTagName)
-{ }
-
-ProfileEntry2::ProfileEntry2(char aTagName, uintptr_t aTagOffset)
-  : mTagOffset(aTagOffset)
-  , mTagName(aTagName)
-{ }
-
-ProfileEntry2::ProfileEntry2(char aTagName, Address aTagAddress)
-  : mTagAddress(aTagAddress)
-  , mTagName(aTagName)
-{ }
-
-ProfileEntry2::ProfileEntry2(char aTagName, int aTagLine)
-  : mTagLine(aTagLine)
-  , mTagName(aTagName)
-{ }
-
-ProfileEntry2::ProfileEntry2(char aTagName, char aTagChar)
-  : mTagChar(aTagChar)
-  , mTagName(aTagName)
-{ }
-
-bool ProfileEntry2::is_ent_hint(char hintChar) {
-  return mTagName == 'h' && mTagChar == hintChar;
-}
-
-bool ProfileEntry2::is_ent_hint() {
-  return mTagName == 'h';
-}
-
-bool ProfileEntry2::is_ent(char tagChar) {
-  return mTagName == tagChar;
-}
-
-void* ProfileEntry2::get_tagPtr() {
-  // No consistency checking.  Oh well.
-  return mTagPtr;
-}
-
-void ProfileEntry2::log()
-{
-  // There is no compiler enforced mapping between tag chars
-  // and union variant fields, so the following was derived
-  // by looking through all the use points of TableTicker.cpp.
-  //   mTagData   (const char*)  m,c,s
-  //   mTagPtr    (void*)        d,l,L, S(start-of-stack)
-  //   mTagLine   (int)          n,f
-  //   mTagChar   (char)         h
-  //   mTagFloat  (double)       r,t
-  switch (mTagName) {
-    case 'm': case 'c': case 's':
-      LOGF("%c \"%s\"", mTagName, mTagData); break;
-    case 'd': case 'l': case 'L': case 'S':
-      LOGF("%c %p", mTagName, mTagPtr); break;
-    case 'n': case 'f':
-      LOGF("%c %d", mTagName, mTagLine); break;
-    case 'h':
-      LOGF("%c \'%c\'", mTagName, mTagChar); break;
-    case 'r': case 't':
-      LOGF("%c %f", mTagName, mTagFloat); break;
-    default:
-      LOGF("'%c' unknown_tag", mTagName); break;
-  }
-}
-
-// END ProfileEntry2
-////////////////////////////////////////////////////////////////////////
-
-
-////////////////////////////////////////////////////////////////////////
-// BEGIN ThreadProfile2
-
-#define PROFILE_MAX_ENTRY  100000
-#define DYNAMIC_MAX_STRING 512
-
-ThreadProfile2::ThreadProfile2(int aEntrySize, PseudoStack *aStack)
-  : mWritePos(0)
-  , mLastFlushPos(0)
-  , mReadPos(0)
-  , mEntrySize(aEntrySize)
-  , mPseudoStack(aStack)
-  , mMutex("ThreadProfile2::mMutex")
-{
-  mEntries = new ProfileEntry2[mEntrySize];
-}
-
-ThreadProfile2::~ThreadProfile2()
-{
-  delete[] mEntries;
-}
-
-void ThreadProfile2::addTag(ProfileEntry2 aTag)
-{
-  // Called from signal, call only reentrant functions
-  mEntries[mWritePos] = aTag;
-  mWritePos = (mWritePos + 1) % mEntrySize;
-  if (mWritePos == mReadPos) {
-    // Keep one slot open
-    mEntries[mReadPos] = ProfileEntry2();
-    mReadPos = (mReadPos + 1) % mEntrySize;
-  }
-  // we also need to move the flush pos to ensure we
-  // do not pass it
-  if (mWritePos == mLastFlushPos) {
-    mLastFlushPos = (mLastFlushPos + 1) % mEntrySize;
-  }
-}
-
-// flush the new entries
-void ThreadProfile2::flush()
-{
-  mLastFlushPos = mWritePos;
-}
-
-// discards all of the entries since the last flush()
-// NOTE: that if mWritePos happens to wrap around past
-// mLastFlushPos we actually only discard mWritePos - mLastFlushPos entries
-//
-// r = mReadPos
-// w = mWritePos
-// f = mLastFlushPos
-//
-//     r          f    w
-// |-----------------------------|
-// |   abcdefghijklmnopq         | -> 'abcdefghijklmnopq'
-// |-----------------------------|
-//
-//
-// mWritePos and mReadPos have passed mLastFlushPos
-//                      f
-//                    w r
-// |-----------------------------|
-// |ABCDEFGHIJKLMNOPQRSqrstuvwxyz|
-// |-----------------------------|
-//                       w
-//                       r
-// |-----------------------------|
-// |ABCDEFGHIJKLMNOPQRSqrstuvwxyz| -> ''
-// |-----------------------------|
-//
-//
-// mWritePos will end up the same as mReadPos
-//                r
-//              w f
-// |-----------------------------|
-// |ABCDEFGHIJKLMklmnopqrstuvwxyz|
-// |-----------------------------|
-//                r
-//                w
-// |-----------------------------|
-// |ABCDEFGHIJKLMklmnopqrstuvwxyz| -> ''
-// |-----------------------------|
-//
-//
-// mWritePos has moved past mReadPos
-//      w r       f
-// |-----------------------------|
-// |ABCDEFdefghijklmnopqrstuvwxyz|
-// |-----------------------------|
-//        r       w
-// |-----------------------------|
-// |ABCDEFdefghijklmnopqrstuvwxyz| -> 'defghijkl'
-// |-----------------------------|
-
-void ThreadProfile2::erase()
-{
-  mWritePos = mLastFlushPos;
-}
-
-char* ThreadProfile2::processDynamicTag(int readPos,
-                                       int* tagsConsumed, char* tagBuff)
-{
-  int readAheadPos = (readPos + 1) % mEntrySize;
-  int tagBuffPos = 0;
-
-  // Read the string stored in mTagData until the null character is seen
-  bool seenNullByte = false;
-  while (readAheadPos != mLastFlushPos && !seenNullByte) {
-    (*tagsConsumed)++;
-    ProfileEntry2 readAheadEntry = mEntries[readAheadPos];
-    for (size_t pos = 0; pos < sizeof(void*); pos++) {
-      tagBuff[tagBuffPos] = readAheadEntry.mTagChars[pos];
-      if (tagBuff[tagBuffPos] == '\0' || tagBuffPos == DYNAMIC_MAX_STRING-2) {
-        seenNullByte = true;
-        break;
-      }
-      tagBuffPos++;
-    }
-    if (!seenNullByte)
-      readAheadPos = (readAheadPos + 1) % mEntrySize;
-  }
-  return tagBuff;
-}
-
-JSCustomObject* ThreadProfile2::ToJSObject(JSContext *aCx)
-{
-  JSObjectBuilder b(aCx);
-
-  JSCustomObject *profile = b.CreateObject();
-  JSCustomArray *samples = b.CreateArray();
-  b.DefineProperty(profile, "samples", samples);
-
-  JSCustomObject *sample = NULL;
-  JSCustomArray *frames = NULL;
-
-  int readPos = mReadPos;
-  while (readPos != mLastFlushPos) {
-    // Number of tag consumed
-    int incBy = 1;
-    ProfileEntry2 entry = mEntries[readPos];
-
-    // Read ahead to the next tag, if it's a 'd' tag process it now
-    const char* tagStringData = entry.mTagData;
-    int readAheadPos = (readPos + 1) % mEntrySize;
-    char tagBuff[DYNAMIC_MAX_STRING];
-    // Make sure the string is always null terminated if it fills up
-    // DYNAMIC_MAX_STRING-2
-    tagBuff[DYNAMIC_MAX_STRING-1] = '\0';
-
-    if (readAheadPos != mLastFlushPos && mEntries[readAheadPos].mTagName == 'd') {
-      tagStringData = processDynamicTag(readPos, &incBy, tagBuff);
-    }
-
-    switch (entry.mTagName) {
-      case 's':
-        sample = b.CreateObject();
-        b.DefineProperty(sample, "name", tagStringData);
-        frames = b.CreateArray();
-        b.DefineProperty(sample, "frames", frames);
-        b.ArrayPush(samples, sample);
-        break;
-      case 'r':
-        {
-          if (sample) {
-            b.DefineProperty(sample, "responsiveness", entry.mTagFloat);
-          }
-        }
-        break;
-      case 'f':
-        {
-          if (sample) {
-            b.DefineProperty(sample, "frameNumber", entry.mTagLine);
-          }
-        }
-        break;
-      case 't':
-        {
-          if (sample) {
-            b.DefineProperty(sample, "time", entry.mTagFloat);
-          }
-        }
-        break;
-      case 'c':
-      case 'l':
-        {
-          if (sample) {
-            JSCustomObject *frame = b.CreateObject();
-            if (entry.mTagName == 'l') {
-              // Bug 753041
-              // We need a double cast here to tell GCC that we don't want to sign
-              // extend 32-bit addresses starting with 0xFXXXXXX.
-              unsigned long long pc = (unsigned long long)(uintptr_t)entry.mTagPtr;
-              snprintf(tagBuff, DYNAMIC_MAX_STRING, "%#llx", pc);
-              b.DefineProperty(frame, "location", tagBuff);
-            } else {
-              b.DefineProperty(frame, "location", tagStringData);
-              readAheadPos = (readPos + incBy) % mEntrySize;
-              if (readAheadPos != mLastFlushPos &&
-                  mEntries[readAheadPos].mTagName == 'n') {
-                b.DefineProperty(frame, "line",
-                                 mEntries[readAheadPos].mTagLine);
-                incBy++;
-              }
-            }
-            b.ArrayPush(frames, frame);
-          }
-        }
-    }
-    readPos = (readPos + incBy) % mEntrySize;
-  }
-
-  return profile;
-}
-
-PseudoStack* ThreadProfile2::GetPseudoStack()
-{
-  return mPseudoStack;
-}
-
-mozilla::Mutex* ThreadProfile2::GetMutex()
-{
-  return &mMutex;
-}
-
-// END ThreadProfile2
-////////////////////////////////////////////////////////////////////////
diff --git a/tools/profiler/ProfileEntry2.h b/tools/profiler/ProfileEntry2.h
deleted file mode 100644
index bc5db6d56214..000000000000
--- a/tools/profiler/ProfileEntry2.h
+++ /dev/null
@@ -1,75 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef MOZ_PROFILE_ENTRY_H
-#define MOZ_PROFILE_ENTRY_H
-
-#include "mozilla/Mutex.h"
-
-class ThreadProfile2;
-
-class ProfileEntry2
-{
-public:
-  ProfileEntry2();
-
-  // aTagData must not need release (i.e. be a string from the text segment)
-  ProfileEntry2(char aTagName, const char *aTagData);
-  ProfileEntry2(char aTagName, void *aTagPtr);
-  ProfileEntry2(char aTagName, double aTagFloat);
-  ProfileEntry2(char aTagName, uintptr_t aTagOffset);
-  ProfileEntry2(char aTagName, Address aTagAddress);
-  ProfileEntry2(char aTagName, int aTagLine);
-  ProfileEntry2(char aTagName, char aTagChar);
-  friend std::ostream& operator<<(std::ostream& stream, const ProfileEntry2& entry);
-  bool is_ent_hint(char hintChar);
-  bool is_ent_hint();
-  bool is_ent(char tagName);
-  void* get_tagPtr();
-  void log();
-
-private:
-  friend class ThreadProfile2;
-  union {
-    const char* mTagData;
-    char        mTagChars[sizeof(void*)];
-    void*       mTagPtr;
-    double      mTagFloat;
-    Address     mTagAddress;
-    uintptr_t   mTagOffset;
-    int         mTagLine;
-    char        mTagChar;
-  };
-  char mTagName;
-};
-
-
-class ThreadProfile2
-{
-public:
-  ThreadProfile2(int aEntrySize, PseudoStack *aStack);
-  ~ThreadProfile2();
-  void addTag(ProfileEntry2 aTag);
-  void flush();
-  void erase();
-  char* processDynamicTag(int readPos, int* tagsConsumed, char* tagBuff);
-  friend std::ostream& operator<<(std::ostream& stream,
-                                  const ThreadProfile2& profile);
-  JSCustomObject *ToJSObject(JSContext *aCx);
-  PseudoStack* GetPseudoStack();
-  mozilla::Mutex* GetMutex();
-private:
-  // Circular buffer 'Keep One Slot Open' implementation
-  // for simplicity
-  ProfileEntry2* mEntries;
-  int            mWritePos; // points to the next entry we will write to
-  int            mLastFlushPos; // points to the next entry since the last flush()
-  int            mReadPos;  // points to the next entry we will read to
-  int            mEntrySize;
-  PseudoStack*   mPseudoStack;
-  mozilla::Mutex mMutex;
-};
-
-#endif /* ndef MOZ_PROFILE_ENTRY_H */
diff --git a/tools/profiler/TableTicker.cpp b/tools/profiler/TableTicker.cpp
index a8f1af4863cb..c39e04f6c48c 100644
--- a/tools/profiler/TableTicker.cpp
+++ b/tools/profiler/TableTicker.cpp
@@ -31,7 +31,6 @@
 #include "nsDirectoryServiceDefs.h"
 #include "nsIObserverService.h"
 #include "mozilla/Services.h"
-#include "PlatformMacros.h"
 
 // JS
 #include "jsdbgapi.h"
@@ -83,7 +82,13 @@ using namespace mozilla;
 
 static const int DYNAMIC_MAX_STRING = 512;
 
-static mozilla::ThreadLocal<TableTicker *> tlsTicker;
+mozilla::ThreadLocal<ProfileStack *> tlsStack;
+mozilla::ThreadLocal<TableTicker *> tlsTicker;
+// We need to track whether we've been initialized otherwise
+// we end up using tlsStack without initializing it.
+// Because tlsStack is totally opaque to us we can't reuse
+// it as the flag itself.
+bool stack_key_initialized;
 
 TimeStamp sLastTracerEvent;
 int sFrameNumber = 0;
@@ -150,7 +155,7 @@ typedef void (*IterateTagsCallback)(const ProfileEntry& entry, const char* tagSt
 class ThreadProfile
 {
 public:
-  ThreadProfile(int aEntrySize, PseudoStack *aStack)
+  ThreadProfile(int aEntrySize, ProfileStack *aStack)
     : mWritePos(0)
     , mLastFlushPos(0)
     , mReadPos(0)
@@ -411,7 +416,7 @@ public:
     }
   }
 
-  PseudoStack* GetStack()
+  ProfileStack* GetStack()
   {
     return mStack;
   }
@@ -423,7 +428,7 @@ private:
   int mLastFlushPos; // points to the next entry since the last flush()
   int mReadPos;  // points to the next entry we will read to
   int mEntrySize;
-  PseudoStack *mStack;
+  ProfileStack *mStack;
 };
 
 class SaveProfileTask;
@@ -439,7 +444,7 @@ hasFeature(const char** aFeatures, uint32_t aFeatureCount, const char* aFeature)
 
 class TableTicker: public Sampler {
  public:
-  TableTicker(int aInterval, int aEntrySize, PseudoStack *aStack,
+  TableTicker(int aInterval, int aEntrySize, ProfileStack *aStack,
               const char** aFeatures, uint32_t aFeatureCount)
     : Sampler(aInterval, true)
     , mPrimaryThreadProfile(aEntrySize, aStack)
@@ -581,7 +586,7 @@ public:
       // being thread safe. Bug 750989.
       if (stream.is_open()) {
         JSAutoCompartment autoComp(cx, obj);
-        JSObject* profileObj = mozilla_sampler_get_profile_data1(cx);
+        JSObject* profileObj = mozilla_sampler_get_profile_data(cx);
         jsval val = OBJECT_TO_JSVAL(profileObj);
         JS_Stringify(cx, &val, nullptr, JSVAL_NULL, WriteCallback, &stream);
         stream.close();
@@ -724,7 +729,7 @@ void addDynamicTag(ThreadProfile &aProfile, char aTagName, const char *aStr)
 
 static
 void addProfileEntry(volatile StackEntry &entry, ThreadProfile &aProfile,
-                     PseudoStack *stack, void *lastpc)
+                     ProfileStack *stack, void *lastpc)
 {
   int lineno = -1;
 
@@ -838,7 +843,7 @@ void TableTicker::doBacktrace(ThreadProfile &aProfile, TickSample* aSample)
   if (NS_SUCCEEDED(rv)) {
     aProfile.addTag(ProfileEntry('s', "(root)"));
 
-    PseudoStack* stack = aProfile.GetStack();
+    ProfileStack* stack = aProfile.GetStack();
     uint32_t pseudoStackPos = 0;
 
     /* We have two stacks, the native C stack we extracted from unwinding,
@@ -877,7 +882,7 @@ void TableTicker::doBacktrace(ThreadProfile &aProfile, TickSample* aSample)
 #endif
 
 static
-void doSampleStackTrace(PseudoStack *aStack, ThreadProfile &aProfile, TickSample *sample)
+void doSampleStackTrace(ProfileStack *aStack, ThreadProfile &aProfile, TickSample *sample)
 {
   // Sample
   // 's' tag denotes the start of a sample block
@@ -911,7 +916,7 @@ unsigned int sCurrentEventGeneration = 0;
 void TableTicker::Tick(TickSample* sample)
 {
   // Marker(s) come before the sample
-  PseudoStack* stack = mPrimaryThreadProfile.GetStack();
+  ProfileStack* stack = mPrimaryThreadProfile.GetStack();
   for (int i = 0; stack->getMarker(i) != NULL; i++) {
     addDynamicTag(mPrimaryThreadProfile, 'm', stack->getMarker(i));
   }
@@ -997,61 +1002,19 @@ std::ostream& operator<<(std::ostream& stream, const ProfileEntry& entry)
   return stream;
 }
 
-bool sps_version2()
-{
-  static int version = 0; // Raced on, potentially
-
-  if (version == 0) {
-    bool allow2 = false; // Is v2 allowable on this platform?
-#   if defined(SPS_PLAT_amd64_linux) || defined(SPS_PLAT_arm_android) \
-       || defined(SPS_PLAT_x86_linux)
-    allow2 = true;
-#   elif defined(SPS_PLAT_amd64_darwin) || defined(SPS_PLAT_x86_darwin) \
-         || defined(SPS_PLAT_x86_windows) || defined(SPS_PLAT_x86_android)
-    allow2 = false;
-#   else
-#     error "Unknown platform"
-#   endif
-
-    bool req2 = PR_GetEnv("MOZ_PROFILER_NEW") != NULL; // Has v2 been requested?
-
-    bool elfhackd = false;
-#   if defined(USE_ELF_HACK)
-    bool elfhackd = true;
-#   endif
-
-    if (req2 && allow2) {
-      version = 2;
-      LOG("------------------- MOZ_PROFILER_NEW set -------------------");
-    } else if (req2 && !allow2) {
-      version = 1;
-      LOG("--------------- MOZ_PROFILER_NEW requested, ----------------");
-      LOG("---------- but is not available on this platform -----------");
-    } else if (req2 && elfhackd) {
-      version = 1;
-      LOG("--------------- MOZ_PROFILER_NEW requested, ----------------");
-      LOG("--- but this build was not done with --disable-elf-hack ----");
-    } else {
-      version = 1;
-      LOG("----------------- MOZ_PROFILER_NEW not set -----------------");
-    }
-  }
-  return version == 2;
-}
-
-void mozilla_sampler_init1()
+void mozilla_sampler_init()
 {
   if (stack_key_initialized)
     return;
 
-  if (!tlsPseudoStack.init() || !tlsTicker.init()) {
+  if (!tlsStack.init() || !tlsTicker.init()) {
     LOG("Failed to init.");
     return;
   }
   stack_key_initialized = true;
 
-  PseudoStack *stack = new PseudoStack();
-  tlsPseudoStack.set(stack);
+  ProfileStack *stack = new ProfileStack();
+  tlsStack.set(stack);
 
   // Allow the profiler to be started using signals
   OS::RegisterStartHandler();
@@ -1069,11 +1032,11 @@ void mozilla_sampler_init1()
                          , "stackwalk"
 #endif
                          };
-  mozilla_sampler_start1(PROFILE_DEFAULT_ENTRY, PROFILE_DEFAULT_INTERVAL,
-                         features, sizeof(features)/sizeof(const char*));
+  mozilla_sampler_start(PROFILE_DEFAULT_ENTRY, PROFILE_DEFAULT_INTERVAL,
+                        features, sizeof(features)/sizeof(const char*));
 }
 
-void mozilla_sampler_shutdown1()
+void mozilla_sampler_shutdown()
 {
   TableTicker *t = tlsTicker.get();
   if (t) {
@@ -1088,13 +1051,13 @@ void mozilla_sampler_shutdown1()
     }
   }
 
-  mozilla_sampler_stop1();
+  mozilla_sampler_stop();
   // We can't delete the Stack because we can be between a
   // sampler call_enter/call_exit point.
   // TODO Need to find a safe time to delete Stack
 }
 
-void mozilla_sampler_save1()
+void mozilla_sampler_save()
 {
   TableTicker *t = tlsTicker.get();
   if (!t) {
@@ -1107,7 +1070,7 @@ void mozilla_sampler_save1()
   t->HandleSaveRequest();
 }
 
-char* mozilla_sampler_get_profile1()
+char* mozilla_sampler_get_profile()
 {
   TableTicker *t = tlsTicker.get();
   if (!t) {
@@ -1125,7 +1088,7 @@ char* mozilla_sampler_get_profile1()
   return rtn;
 }
 
-JSObject *mozilla_sampler_get_profile_data1(JSContext *aCx)
+JSObject *mozilla_sampler_get_profile_data(JSContext *aCx)
 {
   TableTicker *t = tlsTicker.get();
   if (!t) {
@@ -1136,7 +1099,7 @@ JSObject *mozilla_sampler_get_profile_data1(JSContext *aCx)
 }
 
 
-const char** mozilla_sampler_get_features1()
+const char** mozilla_sampler_get_features()
 {
   static const char* features[] = {
 #if defined(MOZ_PROFILING) && (defined(USE_BACKTRACE) || defined(USE_NS_STACKWALK))
@@ -1154,19 +1117,19 @@ const char** mozilla_sampler_get_features1()
 }
 
 // Values are only honored on the first start
-void mozilla_sampler_start1(int aProfileEntries, int aInterval,
-                            const char** aFeatures, uint32_t aFeatureCount)
+void mozilla_sampler_start(int aProfileEntries, int aInterval,
+                           const char** aFeatures, uint32_t aFeatureCount)
 {
   if (!stack_key_initialized)
-    mozilla_sampler_init1();
+    mozilla_sampler_init();
 
-  PseudoStack *stack = tlsPseudoStack.get();
+  ProfileStack *stack = tlsStack.get();
   if (!stack) {
     ASSERT(false);
     return;
   }
 
-  mozilla_sampler_stop1();
+  mozilla_sampler_stop();
 
   TableTicker *t = new TableTicker(aInterval ? aInterval : PROFILE_DEFAULT_INTERVAL,
                                    aProfileEntries ? aProfileEntries : PROFILE_DEFAULT_ENTRY,
@@ -1181,10 +1144,10 @@ void mozilla_sampler_start1(int aProfileEntries, int aInterval,
     os->NotifyObservers(nullptr, "profiler-started", nullptr);
 }
 
-void mozilla_sampler_stop1()
+void mozilla_sampler_stop()
 {
   if (!stack_key_initialized)
-    mozilla_sampler_init1();
+    mozilla_sampler_init();
 
   TableTicker *t = tlsTicker.get();
   if (!t) {
@@ -1196,7 +1159,7 @@ void mozilla_sampler_stop1()
   t->Stop();
   delete t;
   tlsTicker.set(NULL);
-  PseudoStack *stack = tlsPseudoStack.get();
+  ProfileStack *stack = tlsStack.get();
   ASSERT(stack != NULL);
 
   if (disableJS)
@@ -1207,10 +1170,10 @@ void mozilla_sampler_stop1()
     os->NotifyObservers(nullptr, "profiler-stopped", nullptr);
 }
 
-bool mozilla_sampler_is_active1()
+bool mozilla_sampler_is_active()
 {
   if (!stack_key_initialized)
-    mozilla_sampler_init1();
+    mozilla_sampler_init();
 
   TableTicker *t = tlsTicker.get();
   if (!t) {
@@ -1220,9 +1183,10 @@ bool mozilla_sampler_is_active1()
   return t->IsActive();
 }
 
-static double sResponsivenessTimes[100];
-static unsigned int sResponsivenessLoc = 0;
-void mozilla_sampler_responsiveness1(TimeStamp aTime)
+double sResponsivenessTimes[100];
+double sCurrResponsiveness = 0.f;
+unsigned int sResponsivenessLoc = 0;
+void mozilla_sampler_responsiveness(TimeStamp aTime)
 {
   if (!sLastTracerEvent.IsNull()) {
     if (sResponsivenessLoc == 100) {
@@ -1239,17 +1203,17 @@ void mozilla_sampler_responsiveness1(TimeStamp aTime)
   sLastTracerEvent = aTime;
 }
 
-const double* mozilla_sampler_get_responsiveness1()
+const double* mozilla_sampler_get_responsiveness()
 {
   return sResponsivenessTimes;
 }
 
-void mozilla_sampler_frame_number1(int frameNumber)
+void mozilla_sampler_frame_number(int frameNumber)
 {
   sFrameNumber = frameNumber;
 }
 
-static void print_callback(const ProfileEntry& entry, const char* tagStringData) {
+void print_callback(const ProfileEntry& entry, const char* tagStringData) {
   switch (entry.mTagName) {
     case 's':
     case 'c':
@@ -1257,12 +1221,12 @@ static void print_callback(const ProfileEntry& entry, const char* tagStringData)
   }
 }
 
-void mozilla_sampler_print_location1()
+void mozilla_sampler_print_location()
 {
   if (!stack_key_initialized)
-    mozilla_sampler_init1();
+    mozilla_sampler_init();
 
-  PseudoStack *stack = tlsPseudoStack.get();
+  ProfileStack *stack = tlsStack.get();
   if (!stack) {
     MOZ_ASSERT(false);
     return;
@@ -1277,15 +1241,15 @@ void mozilla_sampler_print_location1()
   threadProfile.IterateTags(print_callback);
 }
 
-void mozilla_sampler_lock1()
+void mozilla_sampler_lock()
 {
-  mozilla_sampler_stop1();
+  mozilla_sampler_stop();
   nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
   if (os)
     os->NotifyObservers(nullptr, "profiler-locked", nullptr);
 }
 
-void mozilla_sampler_unlock1()
+void mozilla_sampler_unlock()
 {
   nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
   if (os)
diff --git a/tools/profiler/TableTicker2.cpp b/tools/profiler/TableTicker2.cpp
deleted file mode 100644
index 9ca4dd98b61f..000000000000
--- a/tools/profiler/TableTicker2.cpp
+++ /dev/null
@@ -1,1007 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-// System
-#include <string>
-#include <stdio.h>
-#include <errno.h>
-#include <iostream>
-#include <fstream>
-#include <sstream>
-#if defined(ANDROID)
-# include "android-signal-defs.h"
-#endif
-
-// Profiler
-#include "PlatformMacros.h"
-#include "sps_sampler.h"
-#include "platform.h"
-#include "nsXULAppAPI.h"
-#include "nsThreadUtils.h"
-#include "prenv.h"
-#include "shared-libraries.h"
-#include "mozilla/StackWalk.h"
-#include "ProfileEntry2.h"
-#include "UnwinderThread2.h"
-
-// JSON
-#include "JSObjectBuilder.h"
-#include "nsIJSRuntimeService.h"
-
-// Meta
-#include "nsXPCOM.h"
-#include "nsXPCOMCID.h"
-#include "nsIHttpProtocolHandler.h"
-#include "nsServiceManagerUtils.h"
-#include "nsIXULRuntime.h"
-#include "nsIXULAppInfo.h"
-#include "nsDirectoryServiceUtils.h"
-#include "nsDirectoryServiceDefs.h"
-#include "nsIObserverService.h"
-#include "mozilla/Services.h"
-
-// JS
-#include "jsdbgapi.h"
-
-// This file's exports are listed in sps_sampler.h.
-
-// Pseudo backtraces are available on all platforms.  Native
-// backtraces are available only on selected platforms.  Breakpad is
-// the only supported native unwinder.  HAVE_NATIVE_UNWIND is set at
-// build time to indicate whether native unwinding is possible on this
-// platform.  The actual unwind mode currently in use is stored in
-// sUnwindMode.
-
-#undef HAVE_NATIVE_UNWIND
-#if defined(MOZ_PROFILING) \
-    && (defined(SPS_PLAT_amd64_linux) || defined(SPS_PLAT_arm_android) \
-        || defined(SPS_PLAT_x86_linux))
-# define HAVE_NATIVE_UNWIND
-#endif
-
-#if 0 && defined(MOZ_PROFILING) && !defined(SPS_PLAT_x86_windows)
-# warning MOZ_PROFILING
-#endif
-
-#if 0 && defined(HAVE_NATIVE_UNWIND)
-# warning HAVE_NATIVE_UNWIND
-#endif
-
-typedef  enum { UnwINVALID, UnwNATIVE, UnwPSEUDO, UnwCOMBINED }  UnwMode;
-
-/* These will be set to something sensible before we take the first
-   sample. */
-static UnwMode sUnwindMode     = UnwINVALID;
-static int     sUnwindInterval = 0;
-
-
-using std::string;
-using namespace mozilla;
-
-#ifdef XP_WIN
- #include <windows.h>
- #define getpid GetCurrentProcessId
-#else
- #include <unistd.h>
-#endif
-
-#ifndef MAXPATHLEN
- #ifdef PATH_MAX
-  #define MAXPATHLEN PATH_MAX
- #elif defined(MAX_PATH)
-  #define MAXPATHLEN MAX_PATH
- #elif defined(_MAX_PATH)
-  #define MAXPATHLEN _MAX_PATH
- #elif defined(CCHMAXPATH)
-  #define MAXPATHLEN CCHMAXPATH
- #else
-  #define MAXPATHLEN 1024
- #endif
-#endif
-
-#if _MSC_VER
- #define snprintf _snprintf
-#endif
-
-class TableTicker2;
-
-mozilla::ThreadLocal<PseudoStack *> tlsPseudoStack;
-static mozilla::ThreadLocal<TableTicker2 *> tlsTicker;
-// We need to track whether we've been initialized otherwise
-// we end up using tlsStack without initializing it.
-// Because tlsStack is totally opaque to us we can't reuse
-// it as the flag itself.
-bool stack_key_initialized;
-
-static TimeStamp sLastTracerEvent; // is raced on
-static int       sFrameNumber = 0;
-static int       sLastFrameNumber = 0;
-
-
-static bool
-hasFeature(const char** aFeatures, uint32_t aFeatureCount, const char* aFeature)
-{
-  for (size_t i = 0; i < aFeatureCount; i++) {
-    if (0) LOGF("hasFeature %s: %lu %s", aFeature, (unsigned long)i, aFeatures[i]);
-    if (strcmp(aFeatures[i], aFeature) == 0)
-      return true;
-  }
-  return false;
-}
-
-class TableTicker2: public Sampler {
- public:
-  TableTicker2(int aInterval, int aEntrySize, PseudoStack *aStack,
-              const char** aFeatures, uint32_t aFeatureCount)
-    : Sampler(aInterval, true)
-    , mPrimaryThreadProfile(aEntrySize, aStack)
-    , mStartTime(TimeStamp::Now())
-    , mSaveRequested(false)
-  {
-    mUseStackWalk = hasFeature(aFeatures, aFeatureCount, "stackwalk");
-
-    //XXX: It's probably worth splitting the jank profiler out from the regular profiler at some point
-    mJankOnly = hasFeature(aFeatures, aFeatureCount, "jank");
-    mProfileJS = hasFeature(aFeatures, aFeatureCount, "js");
-    mPrimaryThreadProfile.addTag(ProfileEntry2('m', "Start"));
-  }
-
-  ~TableTicker2() { if (IsActive()) Stop(); }
-
-  virtual void SampleStack(TickSample* sample) {}
-
-  // Called within a signal. This function must be reentrant
-  virtual void Tick(TickSample* sample);
-
-  // Called within a signal. This function must be reentrant
-  virtual void RequestSave()
-  {
-    mSaveRequested = true;
-  }
-
-  virtual void HandleSaveRequest();
-
-  ThreadProfile2* GetPrimaryThreadProfile()
-  {
-    return &mPrimaryThreadProfile;
-  }
-
-  JSObject *ToJSObject(JSContext *aCx);
-  JSCustomObject *GetMetaJSCustomObject(JSAObjectBuilder& b);
-
-  const bool ProfileJS() { return mProfileJS; }
-
-private:
-  // Unwind, using a "native" backtrace scheme (non-PseudoStack).
-  // Not implemented on platforms which do not support native backtraces
-  void doNativeBacktrace(ThreadProfile2 &aProfile, TickSample* aSample);
-
-private:
-  // This represent the application's main thread (SAMPLER_INIT)
-  ThreadProfile2 mPrimaryThreadProfile;
-  TimeStamp mStartTime;
-  bool mSaveRequested;
-  bool mUseStackWalk;
-  bool mJankOnly;
-  bool mProfileJS;
-};
-
-
-////////////////////////////////////////////////////////////////////////
-// BEGIN SaveProfileTask et al
-
-std::string GetSharedLibraryInfoString();
-
-static JSBool
-WriteCallback(const jschar *buf, uint32_t len, void *data)
-{
-  std::ofstream& stream = *static_cast<std::ofstream*>(data);
-  nsAutoCString profile = NS_ConvertUTF16toUTF8(buf, len);
-  stream << profile.Data();
-  return JS_TRUE;
-}
-
-/**
- * This is an event used to save the profile on the main thread
- * to be sure that it is not being modified while saving.
- */
-class SaveProfileTask : public nsRunnable {
-public:
-  SaveProfileTask() {}
-
-  NS_IMETHOD Run() {
-    TableTicker2 *t = tlsTicker.get();
-
-    // Pause the profiler during saving.
-    // This will prevent us from recording sampling
-    // regarding profile saving. This will also
-    // prevent bugs caused by the circular buffer not
-    // being thread safe. Bug 750989.
-    t->SetPaused(true);
-
-    // Get file path
-#   if defined(SPS_PLAT_arm_android)
-    nsCString tmpPath;
-    tmpPath.AppendPrintf("/sdcard/profile_%i_%i.txt", XRE_GetProcessType(), getpid());
-#   else
-    nsCOMPtr<nsIFile> tmpFile;
-    nsAutoCString tmpPath;
-    if (NS_FAILED(NS_GetSpecialDirectory(NS_OS_TEMP_DIR, getter_AddRefs(tmpFile)))) {
-      LOG("Failed to find temporary directory.");
-      return NS_ERROR_FAILURE;
-    }
-    tmpPath.AppendPrintf("profile_%i_%i.txt", XRE_GetProcessType(), getpid());
-
-    nsresult rv = tmpFile->AppendNative(tmpPath);
-    if (NS_FAILED(rv))
-      return rv;
-
-    rv = tmpFile->GetNativePath(tmpPath);
-    if (NS_FAILED(rv))
-      return rv;
-#   endif
-
-    // Create a JSContext to run a JSObjectBuilder :(
-    // Based on XPCShellEnvironment
-    JSRuntime *rt;
-    JSContext *cx;
-    nsCOMPtr<nsIJSRuntimeService> rtsvc 
-      = do_GetService("@mozilla.org/js/xpc/RuntimeService;1");
-    if (!rtsvc || NS_FAILED(rtsvc->GetRuntime(&rt)) || !rt) {
-      LOG("failed to get RuntimeService");
-      return NS_ERROR_FAILURE;;
-    }
-
-    cx = JS_NewContext(rt, 8192);
-    if (!cx) {
-      LOG("Failed to get context");
-      return NS_ERROR_FAILURE;
-    }
-
-    {
-      JSAutoRequest ar(cx);
-      static JSClass c = {
-          "global", JSCLASS_GLOBAL_FLAGS,
-          JS_PropertyStub, JS_PropertyStub, JS_PropertyStub, JS_StrictPropertyStub,
-          JS_EnumerateStub, JS_ResolveStub, JS_ConvertStub
-      };
-      JSObject *obj = JS_NewGlobalObject(cx, &c, NULL);
-
-      std::ofstream stream;
-      stream.open(tmpPath.get());
-      // Pause the profiler during saving.
-      // This will prevent us from recording sampling
-      // regarding profile saving. This will also
-      // prevent bugs caused by the circular buffer not
-      // being thread safe. Bug 750989.
-      t->SetPaused(true);
-      if (stream.is_open()) {
-        JSAutoCompartment autoComp(cx, obj);
-        JSObject* profileObj = mozilla_sampler_get_profile_data2(cx);
-        jsval val = OBJECT_TO_JSVAL(profileObj);
-        JS_Stringify(cx, &val, nullptr, JSVAL_NULL, WriteCallback, &stream);
-        stream.close();
-        LOGF("Saved to %s", tmpPath.get());
-      } else {
-        LOG("Fail to open profile log file.");
-      }
-    }
-    JS_EndRequest(cx);
-    JS_DestroyContext(cx);
-
-    t->SetPaused(false);
-
-    return NS_OK;
-  }
-};
-
-void TableTicker2::HandleSaveRequest()
-{
-  if (!mSaveRequested)
-    return;
-  mSaveRequested = false;
-
-  // TODO: Use use the ipc/chromium Tasks here to support processes
-  // without XPCOM.
-  nsCOMPtr<nsIRunnable> runnable = new SaveProfileTask();
-  NS_DispatchToMainThread(runnable);
-}
-
-JSCustomObject* TableTicker2::GetMetaJSCustomObject(JSAObjectBuilder& b)
-{
-  JSCustomObject *meta = b.CreateObject();
-
-  b.DefineProperty(meta, "version", 2);
-  b.DefineProperty(meta, "interval", interval());
-  b.DefineProperty(meta, "stackwalk", mUseStackWalk);
-  b.DefineProperty(meta, "jank", mJankOnly);
-  b.DefineProperty(meta, "processType", XRE_GetProcessType());
-
-  nsresult res;
-  nsCOMPtr<nsIHttpProtocolHandler> http
-    = do_GetService(NS_NETWORK_PROTOCOL_CONTRACTID_PREFIX "http", &res);
-  if (!NS_FAILED(res)) {
-    nsAutoCString string;
-
-    res = http->GetPlatform(string);
-    if (!NS_FAILED(res))
-      b.DefineProperty(meta, "platform", string.Data());
-
-    res = http->GetOscpu(string);
-    if (!NS_FAILED(res))
-      b.DefineProperty(meta, "oscpu", string.Data());
-
-    res = http->GetMisc(string);
-    if (!NS_FAILED(res))
-      b.DefineProperty(meta, "misc", string.Data());
-  }
-
-  nsCOMPtr<nsIXULRuntime> runtime = do_GetService("@mozilla.org/xre/runtime;1");
-  if (runtime) {
-    nsAutoCString string;
-
-    res = runtime->GetXPCOMABI(string);
-    if (!NS_FAILED(res))
-      b.DefineProperty(meta, "abi", string.Data());
-
-    res = runtime->GetWidgetToolkit(string);
-    if (!NS_FAILED(res))
-      b.DefineProperty(meta, "toolkit", string.Data());
-  }
-
-  nsCOMPtr<nsIXULAppInfo> appInfo = do_GetService("@mozilla.org/xre/app-info;1");
-  if (appInfo) {
-    nsAutoCString string;
-
-    res = appInfo->GetName(string);
-    if (!NS_FAILED(res))
-      b.DefineProperty(meta, "product", string.Data());
-  }
-
-  return meta;
-}
-
-JSObject* TableTicker2::ToJSObject(JSContext *aCx)
-{
-  JSObjectBuilder b(aCx);
-
-  JSCustomObject *profile = b.CreateObject();
-
-  // Put shared library info
-  b.DefineProperty(profile, "libs", GetSharedLibraryInfoString().c_str());
-
-  // Put meta data
-  JSCustomObject *meta = GetMetaJSCustomObject(b);
-  b.DefineProperty(profile, "meta", meta);
-
-  // Lists the samples for each ThreadProfile2
-  JSCustomArray *threads = b.CreateArray();
-  b.DefineProperty(profile, "threads", threads);
-
-  // For now we only have one thread
-  SetPaused(true);
-  ThreadProfile2* prof = GetPrimaryThreadProfile();
-  prof->GetMutex()->Lock();
-  JSCustomObject* threadSamples = prof->ToJSObject(aCx);
-  b.ArrayPush(threads, threadSamples);
-  prof->GetMutex()->Unlock();
-  SetPaused(false);
-
-  return b.GetJSObject(profile);
-}
-
-// END SaveProfileTask et al
-////////////////////////////////////////////////////////////////////////
-
-
-////////////////////////////////////////////////////////////////////////
-// BEGIN take samples.
-// Everything in this section RUNS IN SIGHANDLER CONTEXT
-
-// RUNS IN SIGHANDLER CONTEXT
-static
-void genProfileEntry2(/*MODIFIED*/UnwinderThreadBuffer* utb,
-                     volatile StackEntry &entry,
-                     PseudoStack *stack, void *lastpc)
-{
-  int lineno = -1;
-
-  // Add a pseudostack-entry start label
-  utb__addEntry( utb, ProfileEntry2('h', 'P') );
-  // And the SP value, if it is non-zero
-  if (entry.stackAddress() != 0) {
-    utb__addEntry( utb, ProfileEntry2('S', entry.stackAddress()) );
-  }
-
-  // First entry has tagName 's' (start)
-  // Check for magic pointer bit 1 to indicate copy
-  const char* sampleLabel = entry.label();
-  if (entry.isCopyLabel()) {
-    // Store the string using 1 or more 'd' (dynamic) tags
-    // that will happen to the preceding tag
-
-    utb__addEntry( utb, ProfileEntry2('c', "") );
-    // Add one to store the null termination
-    size_t strLen = strlen(sampleLabel) + 1;
-    for (size_t j = 0; j < strLen;) {
-      // Store as many characters in the void* as the platform allows
-      char text[sizeof(void*)];
-      for (size_t pos = 0; pos < sizeof(void*) && j+pos < strLen; pos++) {
-        text[pos] = sampleLabel[j+pos];
-      }
-      j += sizeof(void*)/sizeof(char);
-      // Cast to *((void**) to pass the text data to a void*
-      utb__addEntry( utb, ProfileEntry2('d', *((void**)(&text[0]))) );
-    }
-    if (entry.js()) {
-      if (!entry.pc()) {
-        // The JIT only allows the top-most entry to have a NULL pc
-        MOZ_ASSERT(&entry == &stack->mStack[stack->stackSize() - 1]);
-        // If stack-walking was disabled, then that's just unfortunate
-        if (lastpc) {
-          jsbytecode *jspc = js::ProfilingGetPC(stack->mRuntime, entry.script(),
-                                                lastpc);
-          if (jspc) {
-            lineno = JS_PCToLineNumber(NULL, entry.script(), jspc);
-          }
-        }
-      } else {
-        lineno = JS_PCToLineNumber(NULL, entry.script(), entry.pc());
-      }
-    } else {
-      lineno = entry.line();
-    }
-  } else {
-    utb__addEntry( utb, ProfileEntry2('c', sampleLabel) );
-    lineno = entry.line();
-  }
-  if (lineno != -1) {
-    utb__addEntry( utb, ProfileEntry2('n', lineno) );
-  }
-
-  // Add a pseudostack-entry end label
-  utb__addEntry( utb, ProfileEntry2('h', 'Q') );
-}
-
-// RUNS IN SIGHANDLER CONTEXT
-// Generate pseudo-backtrace entries and put them in |utb|, with
-// the order outermost frame first.
-void genPseudoBacktraceEntries(/*MODIFIED*/UnwinderThreadBuffer* utb,
-                               PseudoStack *aStack, TickSample *sample)
-{
-  // Call genProfileEntry2 to generate tags for each profile
-  // entry.  Each entry will be bounded by a 'h' 'P' tag to
-  // mark the start and a 'h' 'Q' tag to mark the end.
-  uint32_t nInStack = aStack->stackSize();
-  for (uint32_t i = 0; i < nInStack; i++) {
-    genProfileEntry2(utb, aStack->mStack[i], aStack, nullptr);
-  }
-# ifdef ENABLE_SPS_LEAF_DATA
-  if (sample) {
-    utb__addEntry( utb, ProfileEntry2('l', (void*)sample->pc) );
-#   ifdef ENABLE_ARM_LR_SAVING
-    utb__addEntry( utb, ProfileEntry2('L', (void*)sample->lr) );
-#   endif
-  }
-# endif
-}
-
-/* used to keep track of the last event that we sampled during */
-static unsigned int sLastSampledEventGeneration = 0;
-
-/* a counter that's incremented everytime we get responsiveness event
- * note: it might also be worth tracking everytime we go around
- * the event loop */
-static unsigned int sCurrentEventGeneration = 0;
-/* we don't need to worry about overflow because we only treat the
- * case of them being the same as special. i.e. we only run into
- * a problem if 2^32 events happen between samples that we need
- * to know are associated with different events */
-
-// RUNS IN SIGHANDLER CONTEXT
-void TableTicker2::Tick(TickSample* sample)
-{
-  /* Get hold of an empty inter-thread buffer into which to park
-     the ProfileEntries for this sample. */
-  UnwinderThreadBuffer* utb = uwt__acquire_empty_buffer();
-
-  /* This could fail, if no buffers are currently available, in which
-     case we must give up right away.  We cannot wait for a buffer to
-     become available, as that risks deadlock. */
-  if (!utb)
-    return;
-
-  /* Manufacture the ProfileEntries that we will give to the unwinder
-     thread, and park them in |utb|. */
-
-  // Marker(s) come before the sample
-  PseudoStack* stack = mPrimaryThreadProfile.GetPseudoStack();
-  for (int i = 0; stack->getMarker(i) != NULL; i++) {
-    utb__addEntry( utb, ProfileEntry2('m', stack->getMarker(i)) );
-  }
-  stack->mQueueClearMarker = true;
-
-  bool recordSample = true;
-  if (mJankOnly) {
-    // if we are on a different event we can discard any temporary samples
-    // we've kept around
-    if (sLastSampledEventGeneration != sCurrentEventGeneration) {
-      // XXX: we also probably want to add an entry to the profile to help
-      // distinguish which samples are part of the same event. That, or record
-      // the event generation in each sample
-      mPrimaryThreadProfile.erase();
-    }
-    sLastSampledEventGeneration = sCurrentEventGeneration;
-
-    recordSample = false;
-    // only record the events when we have a we haven't seen a tracer
-    // event for 100ms
-    if (!sLastTracerEvent.IsNull()) {
-      TimeDuration delta = sample->timestamp - sLastTracerEvent;
-      if (delta.ToMilliseconds() > 100.0) {
-          recordSample = true;
-      }
-    }
-  }
-
-  // JRS 2012-Sept-27: this logic used to involve mUseStackWalk.
-  // That should be reinstated, but for the moment, use the
-  // settings in sUnwindMode and sUnwindInterval.
-  // Add a native-backtrace request, or add pseudo backtrace entries,
-  // or both.
-  switch (sUnwindMode) {
-    case UnwNATIVE: /* Native only */
-      // add a "do native stack trace now" hint.  This will be actioned
-      // by the unwinder thread as it processes the entries in this
-      // sample.
-      utb__addEntry( utb, ProfileEntry2('h'/*hint*/, 'N'/*native-trace*/) );
-      break;
-    case UnwPSEUDO: /* Pseudo only */
-      /* Add into |utb|, the pseudo backtrace entries */
-      genPseudoBacktraceEntries(utb, stack, sample);
-      break;
-    case UnwCOMBINED: /* Both Native and Pseudo */
-      utb__addEntry( utb, ProfileEntry2('h'/*hint*/, 'N'/*native-trace*/) );
-      genPseudoBacktraceEntries(utb, stack, sample);
-      break;
-    case UnwINVALID:
-    default:
-      MOZ_CRASH();
-  }
-
-  if (recordSample) {    
-    // add a "flush now" hint
-    utb__addEntry( utb, ProfileEntry2('h'/*hint*/, 'F'/*flush*/) );
-  }
-
-  // Add any extras
-  if (!sLastTracerEvent.IsNull() && sample) {
-    TimeDuration delta = sample->timestamp - sLastTracerEvent;
-    utb__addEntry( utb, ProfileEntry2('r', delta.ToMilliseconds()) );
-  }
-
-  if (sample) {
-    TimeDuration delta = sample->timestamp - mStartTime;
-    utb__addEntry( utb, ProfileEntry2('t', delta.ToMilliseconds()) );
-  }
-
-  if (sLastFrameNumber != sFrameNumber) {
-    utb__addEntry( utb, ProfileEntry2('f', sFrameNumber) );
-    sLastFrameNumber = sFrameNumber;
-  }
-
-  /* So now we have, in |utb|, the complete set of entries we want to
-     push into the circular buffer.  This may also include a 'h' 'F'
-     entry, which is "flush now" hint, and/or a 'h' 'N' entry, which
-     is a "generate a native backtrace and add it to the buffer right
-     now" hint.  Hand them off to the helper thread, together with
-     stack and register context needed to do a native unwind, if that
-     is currently enabled. */
-
-  /* If a native unwind has been requested, we'll start it off using
-     the context obtained from the signal handler, to avoid the
-     problem of having to unwind through the signal frame itself. */
-
-  /* On Linux and Android, the initial register state is in the
-     supplied sample->context.  But on MacOS it's not, so we have to
-     fake it up here (sigh). */
-  if (sUnwindMode == UnwNATIVE || sUnwindMode == UnwCOMBINED) {
-#   if defined(SPS_PLAT_amd64_linux) || defined(SPS_PLAT_arm_android) \
-       || defined(SPS_PLAT_x86_linux) || defined(SPS_PLAT_x86_android)
-    void* ucV = (void*)sample->context;
-#   elif defined(SPS_PLAT_amd64_darwin)
-    struct __darwin_mcontext64 mc;
-    memset(&mc, 0, sizeof(mc));
-    ucontext_t uc;
-    memset(&uc, 0, sizeof(uc));
-    uc.uc_mcontext = &mc;
-    mc.__ss.__rip = (uint64_t)sample->pc;
-    mc.__ss.__rsp = (uint64_t)sample->sp;
-    mc.__ss.__rbp = (uint64_t)sample->fp;
-    void* ucV = (void*)&uc;
-#   elif defined(SPS_PLAT_x86_darwin)
-    struct __darwin_mcontext32 mc;
-    memset(&mc, 0, sizeof(mc));
-    ucontext_t uc;
-    memset(&uc, 0, sizeof(uc));
-    uc.uc_mcontext = &mc;
-    mc.__ss.__eip = (uint32_t)sample->pc;
-    mc.__ss.__esp = (uint32_t)sample->sp;
-    mc.__ss.__ebp = (uint32_t)sample->fp;
-    void* ucV = (void*)&uc;
-#   elif defined(SPS_PLAT_x86_windows)
-    /* Totally fake this up so it at least builds.  No idea if we can
-       even ever get here on Windows. */
-    void* ucV = NULL;
-#   else
-#     error "Unsupported platform"
-#   endif
-    uwt__release_full_buffer(&mPrimaryThreadProfile, utb, ucV);
-  } else {
-    uwt__release_full_buffer(&mPrimaryThreadProfile, utb, NULL);
-  }
-}
-
-// END take samples
-////////////////////////////////////////////////////////////////////////
-
-
-std::ostream& operator<<(std::ostream& stream, const ThreadProfile2& profile)
-{
-  int readPos = profile.mReadPos;
-  while (readPos != profile.mLastFlushPos) {
-    stream << profile.mEntries[readPos];
-    readPos = (readPos + 1) % profile.mEntrySize;
-  }
-  return stream;
-}
-
-std::ostream& operator<<(std::ostream& stream, const ProfileEntry2& entry)
-{
-  if (entry.mTagName == 'r' || entry.mTagName == 't') {
-    stream << entry.mTagName << "-" << std::fixed << entry.mTagFloat << "\n";
-  } else if (entry.mTagName == 'l' || entry.mTagName == 'L') {
-    // Bug 739800 - Force l-tag addresses to have a "0x" prefix on all platforms
-    // Additionally, stringstream seemed to be ignoring formatter flags.
-    char tagBuff[1024];
-    unsigned long long pc = (unsigned long long)(uintptr_t)entry.mTagPtr;
-    snprintf(tagBuff, 1024, "%c-%#llx\n", entry.mTagName, pc);
-    stream << tagBuff;
-  } else if (entry.mTagName == 'd') {
-    // TODO implement 'd' tag for text profile
-  } else {
-    stream << entry.mTagName << "-" << entry.mTagData << "\n";
-  }
-  return stream;
-}
-
-static const char* name_UnwMode(UnwMode m)
-{
-  switch (m) {
-    case UnwINVALID:  return "invalid";
-    case UnwNATIVE:   return "native";
-    case UnwPSEUDO:   return "pseudo";
-    case UnwCOMBINED: return "combined";
-    default:          return "??name_UnwMode??";
-  }
-}
-
-// Read env vars at startup, so as to set sUnwindMode and sInterval.
-static void read_env_vars()
-{
-  bool nativeAvail = false;
-# if defined(HAVE_NATIVE_UNWIND)
-  nativeAvail = true;
-# endif
-
-  MOZ_ASSERT(sUnwindMode     == UnwINVALID);
-  MOZ_ASSERT(sUnwindInterval == 0);
-
-  /* Set defaults */
-  sUnwindMode     = nativeAvail ? UnwCOMBINED : UnwPSEUDO;
-  sUnwindInterval = 0;  /* We'll have to look elsewhere */
-
-  const char* strM = PR_GetEnv("MOZ_PROFILER_MODE");
-  const char* strI = PR_GetEnv("MOZ_PROFILER_INTERVAL");
-
-  if (strM) {
-    if (0 == strcmp(strM, "pseudo"))
-      sUnwindMode = UnwPSEUDO;
-    else if (0 == strcmp(strM, "native") && nativeAvail)
-      sUnwindMode = UnwNATIVE;
-    else if (0 == strcmp(strM, "combined") && nativeAvail)
-      sUnwindMode = UnwCOMBINED;
-    else goto usage;
-  }
-
-  if (strI) {
-    errno = 0;
-    long int n = strtol(strI, (char**)NULL, 10);
-    if (errno == 0 && n >= 1 && n <= 1000) {
-      sUnwindInterval = n;
-    }
-    else goto usage;
-  }
-
-  goto out;
-
- usage:
-  LOG( "SPS: ");
-  LOG( "SPS: Environment variable usage:");
-  LOG( "SPS: ");
-  LOG( "SPS:   MOZ_PROFILER_MODE=native    for native unwind only");
-  LOG( "SPS:   MOZ_PROFILER_MODE=pseudo    for pseudo unwind only");
-  LOG( "SPS:   MOZ_PROFILER_MODE=combined  for combined native & pseudo unwind");
-  LOG( "SPS:   If unset, default is 'combined' on native-capable");
-  LOG( "SPS:     platforms, 'pseudo' on others.");
-  LOG( "SPS: ");
-  LOG( "SPS:   MOZ_PROFILER_INTERVAL=<number>   (milliseconds, 1 to 1000)");
-  LOG( "SPS:   If unset, platform default is used.");
-  LOG( "SPS: ");
-  LOGF("SPS:   This platform %s native unwinding.",
-       nativeAvail ? "supports" : "does not support");
-  LOG( "SPS: ");
-  /* Re-set defaults */
-  sUnwindMode       = nativeAvail ? UnwCOMBINED : UnwPSEUDO;
-  sUnwindInterval   = 0;  /* We'll have to look elsewhere */
-
- out:
-  LOG( "SPS:");
-  LOGF("SPS: Unwind mode       = %s", name_UnwMode(sUnwindMode));
-  LOGF("SPS: Sampling interval = %d ms (zero means \"platform default\")",
-       (int)sUnwindInterval);
-  LOG( "SPS: Use env var MOZ_PROFILER_MODE=help for further information.");
-  LOG( "SPS:");
-
-  return;
-}
-
-
-////////////////////////////////////////////////////////////////////////
-// BEGIN externally visible functions
-
-void mozilla_sampler_init2()
-{
-  if (stack_key_initialized)
-    return;
-
-  LOG("BEGIN mozilla_sampler_init2");
-  if (!tlsPseudoStack.init() || !tlsTicker.init()) {
-    LOG("Failed to init.");
-    return;
-  }
-  stack_key_initialized = true;
-
-  PseudoStack *stack = new PseudoStack();
-  tlsPseudoStack.set(stack);
-
-  // Read mode settings from MOZ_PROFILER_MODE and interval
-  // settings from MOZ_PROFILER_INTERVAL.
-  read_env_vars();
-
-  // Create the unwinder thread.  ATM there is only one.
-  uwt__init();
-
-# if defined(SPS_PLAT_amd64_linux) || defined(SPS_PLAT_arm_android) \
-     || defined(SPS_PLAT_x86_linux) || defined(SPS_PLAT_x86_android) \
-     || defined(SPS_PLAT_x86_windows) /* no idea if x86-win is correct */
-  // On Linuxes, register this thread (temporarily) for profiling
-  int aLocal;
-  uwt__register_thread_for_profiling( &aLocal );
-# elif defined(SPS_PLAT_amd64_darwin) || defined(SPS_PLAT_x86_darwin)
-  // Registration is done in platform-macos.cc
-# else
-#   error "Unknown plat"
-# endif
-
-  // Allow the profiler to be started using signals
-  OS::RegisterStartHandler();
-
-  // We can't open pref so we use an environment variable
-  // to know if we should trigger the profiler on startup
-  // NOTE: Default
-  const char *val = PR_GetEnv("MOZ_PROFILER_STARTUP");
-  if (!val || !*val) {
-    return;
-  }
-
-  const char* features[] = {"js"
-#if defined(XP_WIN) || defined(XP_MACOSX)
-                         , "stackwalk"
-#endif
-                         };
-  mozilla_sampler_start2(PROFILE_DEFAULT_ENTRY, PROFILE_DEFAULT_INTERVAL,
-                         features, sizeof(features)/sizeof(const char*));
-  LOG("END   mozilla_sampler_init2");
-}
-
-void mozilla_sampler_shutdown2()
-{
-  // Shut down and reap the unwinder thread.  We have to do this
-  // before stopping the sampler, so as to guarantee that the unwinder
-  // thread doesn't try to access memory that the subsequent call to
-  // mozilla_sampler_stop2 causes to be freed.
-  uwt__deinit();
-
-  mozilla_sampler_stop2();
-  // We can't delete the Stack because we can be between a
-  // sampler call_enter/call_exit point.
-  // TODO Need to find a safe time to delete Stack
-}
-
-void mozilla_sampler_save2()
-{
-  TableTicker2 *t = tlsTicker.get();
-  if (!t) {
-    return;
-  }
-
-  t->RequestSave();
-  // We're on the main thread already so we don't
-  // have to wait to handle the save request.
-  t->HandleSaveRequest();
-}
-
-char* mozilla_sampler_get_profile2()
-{
-  TableTicker2 *t = tlsTicker.get();
-  if (!t) {
-    return NULL;
-  }
-
-  std::stringstream profile;
-  t->SetPaused(true);
-  profile << *(t->GetPrimaryThreadProfile());
-  t->SetPaused(false);
-
-  std::string profileString = profile.str();
-  char *rtn = (char*)malloc( (profileString.length() + 1) * sizeof(char) );
-  strcpy(rtn, profileString.c_str());
-  return rtn;
-}
-
-JSObject *mozilla_sampler_get_profile_data2(JSContext *aCx)
-{
-  TableTicker2 *t = tlsTicker.get();
-  if (!t) {
-    return NULL;
-  }
-
-  return t->ToJSObject(aCx);
-}
-
-
-const char** mozilla_sampler_get_features2()
-{
-  static const char* features[] = {
-#if defined(MOZ_PROFILING) && defined(HAVE_NATIVE_UNWIND)
-    "stackwalk",
-#endif
-    "jank",
-    "js",
-    NULL
-  };
-
-  return features;
-}
-
-// Values are only honored on the first start
-void mozilla_sampler_start2(int aProfileEntries, int aInterval,
-                            const char** aFeatures, uint32_t aFeatureCount)
-{
-  if (!stack_key_initialized)
-    mozilla_sampler_init2();
-
-  /* If the sampling interval was set using env vars, use that
-     in preference to anything else. */
-  if (sUnwindInterval > 0)
-    aInterval = sUnwindInterval;
-
-  PseudoStack *stack = tlsPseudoStack.get();
-  if (!stack) {
-    ASSERT(false);
-    return;
-  }
-
-  mozilla_sampler_stop2();
-  TableTicker2 *t
-    = new TableTicker2(aInterval ? aInterval : PROFILE_DEFAULT_INTERVAL,
-                      aProfileEntries ? aProfileEntries : PROFILE_DEFAULT_ENTRY,
-                      stack, aFeatures, aFeatureCount);
-  tlsTicker.set(t);
-  t->Start();
-  if (t->ProfileJS())
-      stack->enableJSSampling();
-
-  nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
-  if (os)
-    os->NotifyObservers(nullptr, "profiler-started", nullptr);
-}
-
-void mozilla_sampler_stop2()
-{
-  if (!stack_key_initialized)
-    mozilla_sampler_init2();
-
-  TableTicker2 *t = tlsTicker.get();
-  if (!t) {
-    return;
-  }
-
-  bool disableJS = t->ProfileJS();
-
-  t->Stop();
-  delete t;
-  tlsTicker.set(NULL);
-  PseudoStack *stack = tlsPseudoStack.get();
-  ASSERT(stack != NULL);
-
-  if (disableJS)
-    stack->disableJSSampling();
-
-  nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
-  if (os)
-    os->NotifyObservers(nullptr, "profiler-stopped", nullptr);
-}
-
-bool mozilla_sampler_is_active2()
-{
-  if (!stack_key_initialized)
-    mozilla_sampler_init2();
-
-  TableTicker2 *t = tlsTicker.get();
-  if (!t) {
-    return false;
-  }
-
-  return t->IsActive();
-}
-
-static double sResponsivenessTimes[100];
-static unsigned int sResponsivenessLoc = 0;
-void mozilla_sampler_responsiveness2(TimeStamp aTime)
-{
-  if (!sLastTracerEvent.IsNull()) {
-    if (sResponsivenessLoc == 100) {
-      for(size_t i = 0; i < 100-1; i++) {
-        sResponsivenessTimes[i] = sResponsivenessTimes[i+1];
-      }
-      sResponsivenessLoc--;
-    }
-    TimeDuration delta = aTime - sLastTracerEvent;
-    sResponsivenessTimes[sResponsivenessLoc++] = delta.ToMilliseconds();
-  }
-  sCurrentEventGeneration++;
-
-  sLastTracerEvent = aTime;
-}
-
-const double* mozilla_sampler_get_responsiveness2()
-{
-  return sResponsivenessTimes;
-}
-
-void mozilla_sampler_frame_number2(int frameNumber)
-{
-  sFrameNumber = frameNumber;
-}
-
-void mozilla_sampler_print_location2()
-{
-  // FIXME
-}
-
-void mozilla_sampler_lock2()
-{
-  // FIXME!
-}
-
-void mozilla_sampler_unlock2()
-{
-  // FIXME!
-}
-
-// END externally visible functions
-////////////////////////////////////////////////////////////////////////
diff --git a/tools/profiler/UnwinderThread2.cpp b/tools/profiler/UnwinderThread2.cpp
deleted file mode 100644
index 302f574b7fa7..000000000000
--- a/tools/profiler/UnwinderThread2.cpp
+++ /dev/null
@@ -1,1766 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include <stdio.h>
-#include <signal.h>
-#include <string.h>
-#include <stdlib.h>
-#include <time.h>
-
-#ifdef MOZ_VALGRIND
-# include <valgrind/helgrind.h>
-# include <valgrind/memcheck.h>
-#else
-# define VALGRIND_HG_MUTEX_LOCK_PRE(_mx,_istry)  /* */
-# define VALGRIND_HG_MUTEX_LOCK_POST(_mx)        /* */
-# define VALGRIND_HG_MUTEX_UNLOCK_PRE(_mx)       /* */
-# define VALGRIND_HG_MUTEX_UNLOCK_POST(_mx)      /* */
-# define VALGRIND_MAKE_MEM_DEFINED(_addr,_len)   ((void)0)
-# define VALGRIND_MAKE_MEM_UNDEFINED(_addr,_len) ((void)0)
-#endif
-
-#include "mozilla/arm.h"
-#include "mozilla/StandardInteger.h"
-#include "PlatformMacros.h"
-
-#include "sps_sampler.h"
-#include "platform.h"
-#include <iostream>
-
-#include "ProfileEntry2.h"
-#include "UnwinderThread2.h"
-
-#if !defined(SPS_PLAT_x86_windows)
-# include <sys/time.h>
-# include <unistd.h>
-# include <pthread.h>
-  // mmap
-# include <sys/mman.h>
-#endif
-
-#if defined(SPS_OS_android)
-# include "android-signal-defs.h"
-#endif
-
-#if defined(SPS_OS_darwin)
-# include <mach-o/dyld.h>
-#endif
-
-
-/* Verbosity of this module, for debugging:
-     0  silent
-     1  adds info about debuginfo load success/failure
-     2  adds slow-summary stats for buffer fills/misses (RECOMMENDED)
-     3  adds per-sample summary lines
-     4  adds per-sample frame listing
-   Note that level 3 and above produces risk of deadlock, and 
-   are not recommended for extended use.
-*/
-#define LOGLEVEL 2
-
-
-// The 'else' of this covers the entire rest of the file
-#if defined(SPS_PLAT_x86_windows)
-
-//////////////////////////////////////////////////////////
-//// BEGIN externally visible functions (WINDOWS STUBS)
-
-// On Windows this will all need reworking.  sps_sampler.h
-// will ensure these functions are never actually called,
-// so just provide no-op stubs for now.
-
-void uwt__init()
-{
-}
-
-void uwt__deinit()
-{
-}
-
-void uwt__register_thread_for_profiling ( void* stackTop )
-{
-}
-
-// RUNS IN SIGHANDLER CONTEXT
-UnwinderThreadBuffer* uwt__acquire_empty_buffer()
-{
-  return NULL;
-}
-
-// RUNS IN SIGHANDLER CONTEXT
-void
-uwt__release_full_buffer(ThreadProfile2* aProfile,
-                         UnwinderThreadBuffer* utb,
-                         void* /* ucontext_t*, really */ ucV )
-{
-}
-
-// RUNS IN SIGHANDLER CONTEXT
-void
-utb__addEntry(/*MODIFIED*/UnwinderThreadBuffer* utb, ProfileEntry2 ent)
-{
-}
-
-//// END externally visible functions (WINDOWS STUBS)
-//////////////////////////////////////////////////////////
-
-#else // a supported target
-
-//////////////////////////////////////////////////////////
-//// BEGIN externally visible functions
-
-// Forward references
-// the unwinder thread ID, its fn, and a stop-now flag
-static void* unwind_thr_fn ( void* exit_nowV );
-static pthread_t unwind_thr;
-static int       unwind_thr_exit_now = 0; // RACED ON
-
-// Threads must be registered with this file before they can be
-// sampled.  So that we know the max safe stack address for each
-// registered thread.
-static void thread_register_for_profiling ( void* stackTop );
-
-// RUNS IN SIGHANDLER CONTEXT
-// Acquire an empty buffer and mark it as FILLING
-static UnwinderThreadBuffer* acquire_empty_buffer();
-
-// RUNS IN SIGHANDLER CONTEXT
-// Put this buffer in the queue of stuff going to the unwinder
-// thread, and mark it as FULL.  Before doing that, fill in stack
-// chunk and register fields if a native unwind is requested.
-// APROFILE is where the profile data should be added to.  UTB
-// is the partially-filled-in buffer, containing ProfileEntries.
-// UCV is the ucontext_t* from the signal handler.  If non-NULL, is
-// taken as a cue to request native unwind.
-static void release_full_buffer(ThreadProfile2* aProfile,
-                                UnwinderThreadBuffer* utb,
-                                void* /* ucontext_t*, really */ ucV );
-
-// RUNS IN SIGHANDLER CONTEXT
-static void utb_add_prof_ent(UnwinderThreadBuffer* utb, ProfileEntry2 ent);
-
-// Do a store memory barrier.
-static void do_MBAR();
-
-
-void uwt__init()
-{
-  // Create the unwinder thread.
-  MOZ_ASSERT(unwind_thr_exit_now == 0);
-  int r = pthread_create( &unwind_thr, NULL,
-                          unwind_thr_fn, (void*)&unwind_thr_exit_now );
-  MOZ_ALWAYS_TRUE(r==0);
-}
-
-void uwt__deinit()
-{
-  // Shut down the unwinder thread.
-  MOZ_ASSERT(unwind_thr_exit_now == 0);
-  unwind_thr_exit_now = 1;
-  do_MBAR();
-  int r = pthread_join(unwind_thr, NULL); MOZ_ALWAYS_TRUE(r==0);
-}
-
-void uwt__register_thread_for_profiling(void* stackTop)
-{
-  thread_register_for_profiling(stackTop);
-}
-
-// RUNS IN SIGHANDLER CONTEXT
-UnwinderThreadBuffer* uwt__acquire_empty_buffer()
-{
-  return acquire_empty_buffer();
-}
-
-// RUNS IN SIGHANDLER CONTEXT
-void
-uwt__release_full_buffer(ThreadProfile2* aProfile,
-                         UnwinderThreadBuffer* utb,
-                         void* /* ucontext_t*, really */ ucV )
-{
-  release_full_buffer( aProfile, utb, ucV );
-}
-
-// RUNS IN SIGHANDLER CONTEXT
-void
-utb__addEntry(/*MODIFIED*/UnwinderThreadBuffer* utb, ProfileEntry2 ent)
-{
-  utb_add_prof_ent(utb, ent);
-}
-
-//// END externally visible functions
-//////////////////////////////////////////////////////////
-
-
-//////////////////////////////////////////////////////////
-//// BEGIN type UnwindThreadBuffer
-
-MOZ_STATIC_ASSERT(sizeof(uint32_t) == 4, "uint32_t size incorrect");
-MOZ_STATIC_ASSERT(sizeof(uint64_t) == 8, "uint64_t size incorrect");
-MOZ_STATIC_ASSERT(sizeof(uintptr_t) == sizeof(void*),
-                  "uintptr_t size incorrect");
-
-typedef
-  struct { 
-    uint64_t rsp;
-    uint64_t rbp;
-    uint64_t rip; 
-  }
-  AMD64Regs;
-
-typedef
-  struct {
-    uint32_t r15;
-    uint32_t r14;
-    uint32_t r13;
-    uint32_t r12;
-    uint32_t r11;
-    uint32_t r7;
-  }
-  ARMRegs;
-
-typedef
-  struct {
-    uint32_t esp;
-    uint32_t ebp;
-    uint32_t eip;
-  }
-  X86Regs;
-
-#if defined(SPS_ARCH_amd64)
-typedef  AMD64Regs  ArchRegs;
-#elif defined(SPS_ARCH_arm)
-typedef  ARMRegs  ArchRegs;
-#elif defined(SPS_ARCH_x86)
-typedef  X86Regs  ArchRegs;
-#else
-# error "Unknown plat"
-#endif
-
-#if defined(SPS_ARCH_amd64) || defined(SPS_ARCH_arm) || defined(SPS_ARCH_x86)
-# define SPS_PAGE_SIZE 4096
-#else
-# error "Unknown plat"
-#endif
-
-typedef  enum { S_EMPTY, S_FILLING, S_EMPTYING, S_FULL }  State;
-
-typedef  struct { uintptr_t val; }  SpinLock;
-
-/* CONFIGURABLE */
-/* The maximum number of bytes in a stack snapshot */
-#define N_STACK_BYTES 32768
-
-/* CONFIGURABLE */
-/* The number of fixed ProfileEntry2 slots.  If more are required, they
-   are placed in mmap'd pages. */
-#define N_FIXED_PROF_ENTS 20
-
-/* CONFIGURABLE */
-/* The number of extra pages of ProfileEntries.  If (on arm) each
-   ProfileEntry2 is 8 bytes, then a page holds 512, and so 100 pages
-   is enough to hold 51200. */
-#define N_PROF_ENT_PAGES 100
-
-/* DERIVATIVE */
-#define N_PROF_ENTS_PER_PAGE (SPS_PAGE_SIZE / sizeof(ProfileEntry2))
-
-/* A page of ProfileEntry2s.  This might actually be slightly smaller
-   than a page if SPS_PAGE_SIZE is not an exact multiple of
-   sizeof(ProfileEntry2). */
-typedef
-  struct { ProfileEntry2 ents[N_PROF_ENTS_PER_PAGE]; }
-  ProfEntsPage;
-
-#define ProfEntsPage_INVALID ((ProfEntsPage*)1)
-
-
-/* Fields protected by the spinlock are marked SL */
-
-struct _UnwinderThreadBuffer {
-  /*SL*/ State  state;
-  /* The rest of these are protected, in some sense, by ::state.  If
-     ::state is S_FILLING, they are 'owned' by the sampler thread
-     that set the state to S_FILLING.  If ::state is S_EMPTYING,
-     they are 'owned' by the unwinder thread that set the state to
-     S_EMPTYING.  If ::state is S_EMPTY or S_FULL, the buffer isn't
-     owned by any thread, and so no thread may access these
-     fields. */
-  /* Sample number, needed to process samples in order */
-  uint64_t       seqNo;
-  /* The ThreadProfile2 into which the results are eventually to be
-     dumped. */
-  ThreadProfile2* aProfile;
-  /* Pseudostack and other info, always present */
-  ProfileEntry2   entsFixed[N_FIXED_PROF_ENTS];
-  ProfEntsPage*  entsPages[N_PROF_ENT_PAGES];
-  uintptr_t      entsUsed;
-  /* Do we also have data to do a native unwind? */
-  bool           haveNativeInfo;
-  /* If so, here is the register state and stack.  Unset if
-     .haveNativeInfo is false. */
-  ArchRegs       regs;
-  unsigned char  stackImg[N_STACK_BYTES];
-  unsigned int   stackImgUsed;
-  void*          stackImgAddr; /* VMA corresponding to stackImg[0] */
-  void*          stackMaxSafe; /* VMA for max safe stack reading */
-};
-/* Indexing scheme for ents:
-     0 <= i < N_FIXED_PROF_ENTS
-       is at entsFixed[i]
-
-     i >= N_FIXED_PROF_ENTS
-       is at let j = i - N_FIXED_PROF_ENTS
-             in  entsPages[j / N_PROFENTS_PER_PAGE]
-                  ->ents[j % N_PROFENTS_PER_PAGE]
-     
-   entsPages[] are allocated on demand.  Because zero can
-   theoretically be a valid page pointer, use 
-   ProfEntsPage_INVALID == (ProfEntsPage*)1 to mark invalid pages.
-
-   It follows that the max entsUsed value is N_FIXED_PROF_ENTS +
-   N_PROFENTS_PER_PAGE * N_PROFENTS_PAGES, and at that point no more
-   ProfileEntries can be storedd.
-*/
-
-
-typedef
-  struct {
-    pthread_t thrId;
-    void*     stackTop;
-    uint64_t  nSamples; 
-  }
-  StackLimit;
-
-/* Globals -- the buffer array */
-#define N_UNW_THR_BUFFERS 10
-/*SL*/ static UnwinderThreadBuffer** g_buffers     = NULL;
-/*SL*/ static uint64_t               g_seqNo       = 0;
-/*SL*/ static SpinLock               g_spinLock    = { 0 };
-
-/* Globals -- the thread array */
-#define N_SAMPLING_THREADS 10
-/*SL*/ static StackLimit g_stackLimits[N_SAMPLING_THREADS];
-/*SL*/ static int        g_stackLimitsUsed = 0;
-
-/* Stats -- atomically incremented, no lock needed */
-static uintptr_t g_stats_totalSamples = 0; // total # sample attempts
-static uintptr_t g_stats_noBuffAvail  = 0; // # failed due to no buffer avail
-
-/* We must be VERY CAREFUL what we do with the spinlock held.  The
-   only thing it is safe to do with it held is modify (viz, read or
-   write) g_buffers, g_buffers[], g_seqNo, g_buffers[]->state,
-   g_stackLimits[] and g_stackLimitsUsed.  No arbitrary computations,
-   no syscalls, no printfs, no file IO, and absolutely no dynamic
-   memory allocation (else we WILL eventually deadlock).
-
-   This applies both to the signal handler and to the unwinder thread.
-*/
-
-//// END type UnwindThreadBuffer
-//////////////////////////////////////////////////////////
-
-// fwds
-// the interface to breakpad
-typedef  struct { u_int64_t pc; u_int64_t sp; }  PCandSP;
-
-static
-void do_breakpad_unwind_Buffer(/*OUT*/PCandSP** pairs,
-                               /*OUT*/unsigned int* nPairs,
-                               UnwinderThreadBuffer* buff,
-                               int buffNo /* for debug printing only */);
-
-static bool is_page_aligned(void* v)
-{
-  uintptr_t w = (uintptr_t) v;
-  return (w & (SPS_PAGE_SIZE-1)) == 0  ? true  : false;
-}
-
-
-/* Implement machine-word sized atomic compare-and-swap.  Returns true
-   if success, false if failure. */
-static bool do_CASW(uintptr_t* addr, uintptr_t expected, uintptr_t nyu)
-{
-#if defined(__GNUC__)
-  return __sync_bool_compare_and_swap(addr, expected, nyu);
-#else
-# error "Unhandled compiler"
-#endif
-}
-
-/* Hint to the CPU core that we are in a spin-wait loop, and that
-   other processors/cores/threads-running-on-the-same-core should be
-   given priority on execute resources, if that is possible.  Not
-   critical if this is a no-op on some targets. */
-static void do_SPINLOOP_RELAX()
-{
-#if (defined(SPS_ARCH_amd64) || defined(SPS_ARCH_x86)) && defined(__GNUC__)
-  __asm__ __volatile__("rep; nop");
-#elif defined(SPS_PLAT_arm_android) && MOZILLA_ARM_ARCH >= 7
-  __asm__ __volatile__("wfe");
-#endif
-}
-
-/* Tell any cores snoozing in spin loops to wake up. */
-static void do_SPINLOOP_NUDGE()
-{
-#if (defined(SPS_ARCH_amd64) || defined(SPS_ARCH_x86)) && defined(__GNUC__)
-  /* this is a no-op */
-#elif defined(SPS_PLAT_arm_android) && MOZILLA_ARM_ARCH >= 7
-  __asm__ __volatile__("sev");
-#endif
-}
-
-/* Perform a full memory barrier. */
-static void do_MBAR()
-{
-#if defined(__GNUC__)
-  __sync_synchronize();
-#else
-# error "Unhandled compiler"
-#endif
-}
-
-static void spinLock_acquire(SpinLock* sl)
-{
-  uintptr_t* val = &sl->val;
-  VALGRIND_HG_MUTEX_LOCK_PRE(sl, 0/*!isTryLock*/);
-  while (1) {
-    bool ok = do_CASW( val, 0, 1 );
-    if (ok) break;
-    do_SPINLOOP_RELAX();
-  }
-  do_MBAR();
-  VALGRIND_HG_MUTEX_LOCK_POST(sl);
-}
-
-static void spinLock_release(SpinLock* sl)
-{
-  uintptr_t* val = &sl->val;
-  VALGRIND_HG_MUTEX_UNLOCK_PRE(sl);
-  do_MBAR();
-  bool ok = do_CASW( val, 1, 0 );
-  /* This must succeed at the first try.  To fail would imply that
-     the lock was unheld. */
-  MOZ_ALWAYS_TRUE(ok);
-  do_SPINLOOP_NUDGE();
-  VALGRIND_HG_MUTEX_UNLOCK_POST(sl);
-}
-
-static void sleep_ms(unsigned int ms)
-{
-  struct timespec req;
-  req.tv_sec = ((time_t)ms) / 1000;
-  req.tv_nsec = 1000 * 1000 * (((unsigned long)ms) % 1000);
-  nanosleep(&req, NULL);
-}
-
-/* Use CAS to implement standalone atomic increment. */
-static void atomic_INC(uintptr_t* loc)
-{
-  while (1) {
-    uintptr_t old = *loc;
-    uintptr_t nyu = old + 1;
-    bool ok = do_CASW( loc, old, nyu );
-    if (ok) break;
-  }
-}
-
-/* Register a thread for profiling.  It must not be allowed to receive
-   signals before this is done, else the signal handler will
-   MOZ_ASSERT. */
-static void thread_register_for_profiling(void* stackTop)
-{
-  int i;
-  /* Minimal sanity check on stackTop */
-  MOZ_ASSERT( (void*)&i < stackTop );
-
-  spinLock_acquire(&g_spinLock);
-
-  pthread_t me = pthread_self();
-  for (i = 0; i < g_stackLimitsUsed; i++) {
-    /* check for duplicate registration */
-    MOZ_ASSERT(g_stackLimits[i].thrId != me);
-  }
-  if (!(g_stackLimitsUsed < N_SAMPLING_THREADS))
-    MOZ_CRASH();  // Don't continue -- we'll get memory corruption.
-  g_stackLimits[g_stackLimitsUsed].thrId    = me;
-  g_stackLimits[g_stackLimitsUsed].stackTop = stackTop;
-  g_stackLimits[g_stackLimitsUsed].nSamples = 0;
-  g_stackLimitsUsed++;
-
-  spinLock_release(&g_spinLock);
-  LOGF("BPUnw: thread_register_for_profiling(stacktop %p, me %p)", 
-       stackTop, (void*)me);
-}
-
-
-__attribute__((unused))
-static void show_registered_threads()
-{
-  int i;
-  spinLock_acquire(&g_spinLock);
-  for (i = 0; i < g_stackLimitsUsed; i++) {
-    LOGF("[%d]  pthread_t=%p  nSamples=%lld",
-         i, (void*)g_stackLimits[i].thrId, 
-            (unsigned long long int)g_stackLimits[i].nSamples);
-  }
-  spinLock_release(&g_spinLock);
-}
-
-
-// RUNS IN SIGHANDLER CONTEXT
-static UnwinderThreadBuffer* acquire_empty_buffer()
-{
-  /* acq lock
-     if buffers == NULL { rel lock; exit }
-     scan to find a free buff; if none { rel lock; exit }
-     set buff state to S_FILLING
-     fillseqno++; and remember it
-     rel lock
-  */
-  int i;
-
-  atomic_INC( &g_stats_totalSamples );
-
-  /* This code is critical.  We are in a signal handler and possibly
-     with the malloc lock held.  So we can't allocate any heap, and
-     can't safely call any C library functions, not even the pthread_
-     functions.  And we certainly can't do any syscalls.  In short,
-     this function needs to be self contained, not do any allocation,
-     and not hold on to the spinlock for any significant length of
-     time. */
-
-  spinLock_acquire(&g_spinLock);
-
-  /* First of all, look for this thread's entry in g_stackLimits[].
-     We need to find it in order to figure out how much stack we can
-     safely copy into the sample.  This assumes that pthread_self()
-     is safe to call in a signal handler, which strikes me as highly
-     likely. */
-  pthread_t me = pthread_self();
-  MOZ_ASSERT(g_stackLimitsUsed >= 0 && g_stackLimitsUsed <= N_SAMPLING_THREADS);
-  for (i = 0; i < g_stackLimitsUsed; i++) {
-    if (g_stackLimits[i].thrId == me)
-      break;
-  }
-  /* "this thread is registered for profiling" */
-  MOZ_ASSERT(i < g_stackLimitsUsed);
-
-  /* The furthest point that we can safely scan back up the stack. */
-  void* myStackTop = g_stackLimits[i].stackTop;
-  g_stackLimits[i].nSamples++;
-
-  /* Try to find a free buffer to use. */
-  if (g_buffers == NULL) {
-    /* The unwinder thread hasn't allocated any buffers yet.
-       Nothing we can do. */
-    spinLock_release(&g_spinLock);
-    atomic_INC( &g_stats_noBuffAvail );
-    return NULL;
-  }
-
-  for (i = 0; i < N_UNW_THR_BUFFERS; i++) {
-    if (g_buffers[i]->state == S_EMPTY)
-      break;
-  }
-  MOZ_ASSERT(i >= 0 && i <= N_UNW_THR_BUFFERS);
-
-  if (i == N_UNW_THR_BUFFERS) {
-    /* Again, no free buffers .. give up. */
-    spinLock_release(&g_spinLock);
-    atomic_INC( &g_stats_noBuffAvail );
-    if (LOGLEVEL >= 3)
-      LOG("BPUnw: handler:  no free buffers");
-    return NULL;
-  }
-
-  /* So we can use this one safely.  Whilst still holding the lock,
-     mark the buffer as belonging to us, and increment the sequence
-     number. */
-  UnwinderThreadBuffer* buff = g_buffers[i];
-  MOZ_ASSERT(buff->state == S_EMPTY);
-  buff->state = S_FILLING;
-  buff->seqNo = g_seqNo;
-  g_seqNo++;
-
-  /* And drop the lock.  We own the buffer, so go on and fill it. */
-  spinLock_release(&g_spinLock);
-
-  /* Now we own the buffer, initialise it. */
-  buff->aProfile       = NULL;
-  buff->entsUsed       = 0;
-  buff->haveNativeInfo = false;
-  buff->stackImgUsed   = 0;
-  buff->stackImgAddr   = 0;
-  buff->stackMaxSafe   = myStackTop; /* We will need this in
-                                        release_full_buffer() */
-  for (i = 0; i < N_PROF_ENT_PAGES; i++)
-    buff->entsPages[i] = ProfEntsPage_INVALID;
-  return buff;
-}
-
-
-// RUNS IN SIGHANDLER CONTEXT
-/* The calling thread owns the buffer, as denoted by its state being
-   S_FILLING.  So we can mess with it without further locking. */
-static void release_full_buffer(ThreadProfile2* aProfile,
-                                UnwinderThreadBuffer* buff,
-                                void* /* ucontext_t*, really */ ucV )
-{
-  MOZ_ASSERT(buff->state == S_FILLING);
-
-  ////////////////////////////////////////////////////
-  // BEGIN fill
-
-  /* The buffer already will have some of its ProfileEntries filled
-     in, but everything else needs to be filled in at this point. */
-  //LOGF("Release full buffer: %lu ents", buff->entsUsed);
-  /* Where the resulting info is to be dumped */
-  buff->aProfile = aProfile;
-
-  /* And, if we have register state, that and the stack top */
-  buff->haveNativeInfo = ucV != NULL;
-  if (buff->haveNativeInfo) {
-#   if defined(SPS_PLAT_amd64_linux)
-    ucontext_t* uc = (ucontext_t*)ucV;
-    mcontext_t* mc = &(uc->uc_mcontext);
-    buff->regs.rip = mc->gregs[REG_RIP];
-    buff->regs.rsp = mc->gregs[REG_RSP];
-    buff->regs.rbp = mc->gregs[REG_RBP];
-#   elif defined(SPS_PLAT_amd64_darwin)
-    ucontext_t* uc = (ucontext_t*)ucV;
-    struct __darwin_mcontext64* mc = uc->uc_mcontext;
-    struct __darwin_x86_thread_state64* ss = &mc->__ss;
-    buff->regs.rip = ss->__rip;
-    buff->regs.rsp = ss->__rsp;
-    buff->regs.rbp = ss->__rbp;
-#   elif defined(SPS_PLAT_arm_android)
-    ucontext_t* uc = (ucontext_t*)ucV;
-    mcontext_t* mc = &(uc->uc_mcontext);
-    buff->regs.r15 = mc->arm_pc; //gregs[R15];
-    buff->regs.r14 = mc->arm_lr; //gregs[R14];
-    buff->regs.r13 = mc->arm_sp; //gregs[R13];
-    buff->regs.r12 = mc->arm_ip; //gregs[R12];
-    buff->regs.r11 = mc->arm_fp; //gregs[R11];
-    buff->regs.r7  = mc->arm_r7; //gregs[R7];
-#   elif defined(SPS_PLAT_x86_linux)
-    ucontext_t* uc = (ucontext_t*)ucV;
-    mcontext_t* mc = &(uc->uc_mcontext);
-    buff->regs.eip = mc->gregs[REG_EIP];
-    buff->regs.esp = mc->gregs[REG_ESP];
-    buff->regs.ebp = mc->gregs[REG_EBP];
-#   elif defined(SPS_PLAT_x86_darwin)
-    ucontext_t* uc = (ucontext_t*)ucV;
-    struct __darwin_mcontext32* mc = uc->uc_mcontext;
-    struct __darwin_i386_thread_state* ss = &mc->__ss;
-    buff->regs.eip = ss->__eip;
-    buff->regs.esp = ss->__esp;
-    buff->regs.ebp = ss->__ebp;
-#   elif defined(SPS_PLAT_x86_android)
-    ucontext_t* uc = (ucontext_t*)ucV;
-    mcontext_t* mc = &(uc->uc_mcontext);
-    buff->regs.eip = mc->eip;
-    buff->regs.esp = mc->esp;
-    buff->regs.ebp = mc->ebp;
-#   else
-#     error "Unknown plat"
-#   endif
-
-    /* Copy up to N_STACK_BYTES from rsp-REDZONE upwards, but not
-       going past the stack's registered top point.  Do some basic
-       sanity checks too. */
-    { 
-#     if defined(SPS_PLAT_amd64_linux) || defined(SPS_PLAT_amd64_darwin)
-      uintptr_t rEDZONE_SIZE = 128;
-      uintptr_t start = buff->regs.rsp - rEDZONE_SIZE;
-#     elif defined(SPS_PLAT_arm_android)
-      uintptr_t rEDZONE_SIZE = 0;
-      uintptr_t start = buff->regs.r13 - rEDZONE_SIZE;
-#     elif defined(SPS_PLAT_x86_linux) || defined(SPS_PLAT_x86_darwin) \
-           || defined(SPS_PLAT_x86_android)
-      uintptr_t rEDZONE_SIZE = 0;
-      uintptr_t start = buff->regs.esp - rEDZONE_SIZE;
-#     else
-#       error "Unknown plat"
-#     endif
-      uintptr_t end   = (uintptr_t)buff->stackMaxSafe;
-      uintptr_t ws    = sizeof(void*);
-      start &= ~(ws-1);
-      end   &= ~(ws-1);
-      uintptr_t nToCopy = 0;
-      if (start < end) {
-        nToCopy = end - start;
-        if (nToCopy > N_STACK_BYTES)
-          nToCopy = N_STACK_BYTES;
-      }
-      MOZ_ASSERT(nToCopy <= N_STACK_BYTES);
-      buff->stackImgUsed = nToCopy;
-      buff->stackImgAddr = (void*)start;
-      if (nToCopy > 0) {
-        memcpy(&buff->stackImg[0], (void*)start, nToCopy);
-        (void)VALGRIND_MAKE_MEM_DEFINED(&buff->stackImg[0], nToCopy);
-      }
-    }
-  } /* if (buff->haveNativeInfo) */
-  // END fill
-  ////////////////////////////////////////////////////
-
-  /* And now relinquish ownership of the buff, so that an unwinder
-     thread can pick it up. */
-  spinLock_acquire(&g_spinLock);
-  buff->state = S_FULL;
-  spinLock_release(&g_spinLock);
-}
-
-
-// RUNS IN SIGHANDLER CONTEXT
-// Allocate a ProfEntsPage, without using malloc, or return
-// ProfEntsPage_INVALID if we can't for some reason.
-static ProfEntsPage* mmap_anon_ProfEntsPage()
-{
-# if defined(SPS_OS_darwin)
-  void* v = ::mmap(NULL, sizeof(ProfEntsPage), PROT_READ|PROT_WRITE, 
-                   MAP_PRIVATE|MAP_ANON,      -1, 0);
-# else
-  void* v = ::mmap(NULL, sizeof(ProfEntsPage), PROT_READ|PROT_WRITE, 
-                   MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
-# endif
-  if (v == MAP_FAILED) {
-    return ProfEntsPage_INVALID;
-  } else {
-    return (ProfEntsPage*)v;
-  }
-}
-
-// Runs in the unwinder thread
-// Free a ProfEntsPage as allocated by mmap_anon_ProfEntsPage
-static void munmap_ProfEntsPage(ProfEntsPage* pep)
-{
-  MOZ_ALWAYS_TRUE(is_page_aligned(pep));
-  ::munmap(pep, sizeof(ProfEntsPage));
-}
-
-
-// RUNS IN SIGHANDLER CONTEXT
-void
-utb_add_prof_ent(/*MODIFIED*/UnwinderThreadBuffer* utb, ProfileEntry2 ent)
-{
-  uintptr_t limit
-    = N_FIXED_PROF_ENTS + (N_PROF_ENTS_PER_PAGE * N_PROF_ENT_PAGES);
-  if (utb->entsUsed == limit) {
-    /* We're full.  Now what? */
-    LOG("BPUnw: utb__addEntry: NO SPACE for ProfileEntry2; ignoring.");
-    return;
-  }
-  MOZ_ASSERT(utb->entsUsed < limit);
-
-  /* Will it fit in the fixed array? */
-  if (utb->entsUsed < N_FIXED_PROF_ENTS) {
-    utb->entsFixed[utb->entsUsed] = ent;
-    utb->entsUsed++;
-    return;
-  }
-
-  /* No.  Put it in the extras. */
-  uintptr_t i     = utb->entsUsed;
-  uintptr_t j     = i - N_FIXED_PROF_ENTS;
-  uintptr_t j_div = j / N_PROF_ENTS_PER_PAGE; /* page number */
-  uintptr_t j_mod = j % N_PROF_ENTS_PER_PAGE; /* page offset */
-  ProfEntsPage* pep = utb->entsPages[j_div];
-  if (pep == ProfEntsPage_INVALID) {
-    pep = mmap_anon_ProfEntsPage();
-    if (pep == ProfEntsPage_INVALID) {
-      /* Urr, we ran out of memory.  Now what? */
-      LOG("BPUnw: utb__addEntry: MMAP FAILED for ProfileEntry2; ignoring.");
-      return;
-    }
-    utb->entsPages[j_div] = pep;
-  }
-  pep->ents[j_mod] = ent;
-  utb->entsUsed++;
-}
-
-
-// misc helper
-static ProfileEntry2 utb_get_profent(UnwinderThreadBuffer* buff, uintptr_t i)
-{
-  MOZ_ASSERT(i < buff->entsUsed);
-  if (i < N_FIXED_PROF_ENTS) {
-    return buff->entsFixed[i];
-  } else {
-    uintptr_t j     = i - N_FIXED_PROF_ENTS;
-    uintptr_t j_div = j / N_PROF_ENTS_PER_PAGE; /* page number */
-    uintptr_t j_mod = j % N_PROF_ENTS_PER_PAGE; /* page offset */
-    MOZ_ASSERT(buff->entsPages[j_div] != ProfEntsPage_INVALID);
-    return buff->entsPages[j_div]->ents[j_mod];
-  }
-}
-
-
-// Runs in the unwinder thread -- well, this _is_ the unwinder thread.
-static void* unwind_thr_fn(void* exit_nowV)
-{
-  /* If we're the first thread in, we'll need to allocate the buffer
-     array g_buffers plus the Buffer structs that it points at. */
-  spinLock_acquire(&g_spinLock);
-  if (g_buffers == NULL) {
-    /* Drop the lock, make a complete copy in memory, reacquire the
-       lock, and try to install it -- which might fail, if someone
-       else beat us to it. */
-    spinLock_release(&g_spinLock);
-    UnwinderThreadBuffer** buffers
-      = (UnwinderThreadBuffer**)malloc(N_UNW_THR_BUFFERS
-                                        * sizeof(UnwinderThreadBuffer*));
-    MOZ_ASSERT(buffers);
-    int i;
-    for (i = 0; i < N_UNW_THR_BUFFERS; i++) {
-      buffers[i] = (UnwinderThreadBuffer*)
-                   calloc(sizeof(UnwinderThreadBuffer), 1);
-      MOZ_ASSERT(buffers[i]);
-      buffers[i]->state = S_EMPTY;
-    }
-    /* Try to install it */
-    spinLock_acquire(&g_spinLock);
-    if (g_buffers == NULL) {
-      g_buffers = buffers;
-      spinLock_release(&g_spinLock);
-    } else {
-      /* Someone else beat us to it.  Release what we just allocated
-         so as to avoid a leak. */
-      spinLock_release(&g_spinLock);
-      for (i = 0; i < N_UNW_THR_BUFFERS; i++) {
-        free(buffers[i]);
-      }
-      free(buffers);
-    }
-  } else {
-    /* They are already allocated, so just drop the lock and continue. */
-    spinLock_release(&g_spinLock);
-  }
-
-  /* 
-    while (1) {
-      acq lock
-      scan to find oldest full
-         if none { rel lock; sleep; continue }
-      set buff state to emptying
-      rel lock
-      acq MLock // implicitly
-      process buffer
-      rel MLock // implicitly
-      acq lock
-      set buff state to S_EMPTY
-      rel lock
-    }
-  */
-  int* exit_now = (int*)exit_nowV;
-  int ms_to_sleep_if_empty = 1;
-  while (1) {
-
-    if (*exit_now != 0) break;
-
-    spinLock_acquire(&g_spinLock);
-
-    /* Find the oldest filled buffer, if any. */
-    uint64_t oldest_seqNo = ~0ULL; /* infinity */
-    int      oldest_ix    = -1;
-    int      i;
-    for (i = 0; i < N_UNW_THR_BUFFERS; i++) {
-      UnwinderThreadBuffer* buff = g_buffers[i];
-      if (buff->state != S_FULL) continue;
-      if (buff->seqNo < oldest_seqNo) {
-        oldest_seqNo = buff->seqNo;
-        oldest_ix    = i;
-      }
-    }
-    if (oldest_ix == -1) {
-      /* We didn't find a full buffer.  Snooze and try again later. */
-      MOZ_ASSERT(oldest_seqNo == ~0ULL);
-      spinLock_release(&g_spinLock);
-      if (ms_to_sleep_if_empty > 100 && LOGLEVEL >= 2) {
-        LOGF("BPUnw: unwinder: sleep for %d ms", ms_to_sleep_if_empty);
-      }
-      sleep_ms(ms_to_sleep_if_empty);
-      if (ms_to_sleep_if_empty < 20) {
-        ms_to_sleep_if_empty += 2;
-      } else {
-        ms_to_sleep_if_empty = (15 * ms_to_sleep_if_empty) / 10;
-        if (ms_to_sleep_if_empty > 1000)
-          ms_to_sleep_if_empty = 1000;
-      }
-      continue;
-    }
-
-    /* We found a full a buffer.  Mark it as 'ours' and drop the
-       lock; then we can safely throw breakpad at it. */
-    UnwinderThreadBuffer* buff = g_buffers[oldest_ix];
-    MOZ_ASSERT(buff->state == S_FULL);
-    buff->state = S_EMPTYING;
-    spinLock_release(&g_spinLock);
-
-    /* unwind .. in which we can do anything we like, since any
-       resource stalls that we may encounter (eg malloc locks) in
-       competition with signal handler instances, will be short
-       lived since the signal handler is guaranteed nonblocking. */
-    if (0) LOGF("BPUnw: unwinder: seqNo %llu: emptying buf %d\n",
-                (unsigned long long int)oldest_seqNo, oldest_ix);
-
-    /* Copy ProfileEntries presented to us by the sampling thread.
-       Most of them are copied verbatim into |buff->aProfile|,
-       except for 'hint' tags, which direct us to do something
-       different. */
-
-    /* Need to lock |aProfile| so nobody tries to copy out entries
-       whilst we are putting them in. */
-    buff->aProfile->GetMutex()->Lock();
-
-    /* The buff is a sequence of ProfileEntries (ents).  It has
-       this grammar:
-
-       | --pre-tags-- | (h 'P' .. h 'Q')* | --post-tags-- |
-                        ^               ^
-                        ix_first_hP     ix_last_hQ
-
-       Each (h 'P' .. h 'Q') subsequence represents one pseudostack
-       entry.  These, if present, are in the order
-       outermost-frame-first, and that is the order that they should
-       be copied into aProfile.  The --pre-tags-- and --post-tags--
-       are to be copied into the aProfile verbatim, except that they
-       may contain the hints "h 'F'" for a flush and "h 'N'" to
-       indicate that a native unwind is also required, and must be
-       interleaved with the pseudostack entries.
-
-       The hint tags that bound each pseudostack entry, "h 'P'" and "h
-       'Q'", are not to be copied into the aProfile -- they are
-       present only to make parsing easy here.  Also, the pseudostack
-       entries may contain an "'S' (void*)" entry, which is the stack
-       pointer value for that entry, and these are also not to be
-       copied.
-    */
-    /* The first thing to do is therefore to find the pseudostack
-       entries, if any, and to find out also whether a native unwind
-       has been requested. */
-    const uintptr_t infUW = ~(uintptr_t)0; // infinity
-    bool  need_native_unw = false;
-    uintptr_t ix_first_hP = infUW; // "not found"
-    uintptr_t ix_last_hQ  = infUW; // "not found"
-
-    uintptr_t k;
-    for (k = 0; k < buff->entsUsed; k++) {
-      ProfileEntry2 ent = utb_get_profent(buff, k);
-      if (ent.is_ent_hint('N')) {
-        need_native_unw = true;
-      }
-      else if (ent.is_ent_hint('P') && ix_first_hP == ~(uintptr_t)0) {
-        ix_first_hP = k;
-      }
-      else if (ent.is_ent_hint('Q')) {
-        ix_last_hQ = k;
-      }
-    }
-
-    if (0) LOGF("BPUnw: ix_first_hP %llu  ix_last_hQ %llu  need_native_unw %llu",
-                (unsigned long long int)ix_first_hP,
-                (unsigned long long int)ix_last_hQ,
-                (unsigned long long int)need_native_unw);
-
-    /* There are four possibilities: native-only, pseudostack-only,
-       combined (both), and neither.  We handle all four cases. */
-
-    MOZ_ASSERT( (ix_first_hP == infUW && ix_last_hQ == infUW) ||
-                (ix_first_hP != infUW && ix_last_hQ != infUW) );
-    bool have_P = ix_first_hP != infUW;
-    if (have_P) {
-      MOZ_ASSERT(ix_first_hP < ix_last_hQ);
-      MOZ_ASSERT(ix_last_hQ <= buff->entsUsed);
-    }
-
-    /* Neither N nor P.  This is very unusual but has been observed to happen.
-       Just copy to the output. */
-    if (!need_native_unw && !have_P) {
-      for (k = 0; k < buff->entsUsed; k++) {
-        ProfileEntry2 ent = utb_get_profent(buff, k);
-        // action flush-hints
-        if (ent.is_ent_hint('F')) { buff->aProfile->flush(); continue; }
-        // skip ones we can't copy
-        if (ent.is_ent_hint() || ent.is_ent('S')) { continue; }
-        // and copy everything else
-        buff->aProfile->addTag( ent );
-      }
-    }
-    else /* Native only-case. */
-    if (need_native_unw && !have_P) {
-      for (k = 0; k < buff->entsUsed; k++) {
-        ProfileEntry2 ent = utb_get_profent(buff, k);
-        // action a native-unwind-now hint
-        if (ent.is_ent_hint('N')) {
-          MOZ_ASSERT(buff->haveNativeInfo);
-          PCandSP* pairs = NULL;
-          unsigned int nPairs = 0;
-          do_breakpad_unwind_Buffer(&pairs, &nPairs, buff, oldest_ix);
-          buff->aProfile->addTag( ProfileEntry2('s', "(root)") );
-          for (unsigned int i = 0; i < nPairs; i++) {
-            buff->aProfile
-                ->addTag( ProfileEntry2('l', reinterpret_cast<void*>(pairs[i].pc)) );
-          }
-          if (pairs)
-            free(pairs);
-          continue;
-        }
-        // action flush-hints
-        if (ent.is_ent_hint('F')) { buff->aProfile->flush(); continue; }
-        // skip ones we can't copy
-        if (ent.is_ent_hint() || ent.is_ent('S')) { continue; }
-        // and copy everything else
-        buff->aProfile->addTag( ent );
-      }
-    }
-    else /* Pseudostack-only case */
-    if (!need_native_unw && have_P) {
-      /* If there's no request for a native stack, it's easy: just
-         copy the tags verbatim into aProfile, skipping the ones that
-         can't be copied -- 'h' (hint) tags, and "'S' (void*)"
-         stack-pointer tags.  Except, insert a sample-start tag when
-         we see the start of the first pseudostack frame. */
-      for (k = 0; k < buff->entsUsed; k++) {
-        ProfileEntry2 ent = utb_get_profent(buff, k);
-        // We need to insert a sample-start tag before the first frame
-        if (k == ix_first_hP) {
-          buff->aProfile->addTag( ProfileEntry2('s', "(root)") );
-        }
-        // action flush-hints
-        if (ent.is_ent_hint('F')) { buff->aProfile->flush(); continue; }
-        // skip ones we can't copy
-        if (ent.is_ent_hint() || ent.is_ent('S')) { continue; }
-        // and copy everything else
-        buff->aProfile->addTag( ent );
-      }
-    }
-    else /* Combined case */
-    if (need_native_unw && have_P)
-    {
-      /* We need to get a native stacktrace and merge it with the
-         pseudostack entries.  This isn't too simple.  First, copy all
-         the tags up to the start of the pseudostack tags.  Then
-         generate a combined set of tags by native unwind and
-         pseudostack.  Then, copy all the stuff after the pseudostack
-         tags. */
-      MOZ_ASSERT(buff->haveNativeInfo);
-
-      // Get native unwind info
-      PCandSP* pairs = NULL;
-      unsigned int n_pairs = 0;
-      do_breakpad_unwind_Buffer(&pairs, &n_pairs, buff, oldest_ix);
-
-      // Entries before the pseudostack frames
-      for (k = 0; k < ix_first_hP; k++) {
-        ProfileEntry2 ent = utb_get_profent(buff, k);
-        // action flush-hints
-        if (ent.is_ent_hint('F')) { buff->aProfile->flush(); continue; }
-        // skip ones we can't copy
-        if (ent.is_ent_hint() || ent.is_ent('S')) { continue; }
-        // and copy everything else
-        buff->aProfile->addTag( ent );
-      }
-
-      // BEGIN merge
-      buff->aProfile->addTag( ProfileEntry2('s', "(root)") );
-      unsigned int next_N = 0; // index in pairs[]
-      unsigned int next_P = ix_first_hP; // index in buff profent array
-      bool last_was_P = false;
-      if (0) LOGF("at mergeloop: n_pairs %llu ix_last_hQ %llu",
-                  (unsigned long long int)n_pairs,
-                  (unsigned long long int)ix_last_hQ);
-      while (true) {
-        if (next_P <= ix_last_hQ) {
-          // Assert that next_P points at the start of an P entry
-          MOZ_ASSERT(utb_get_profent(buff, next_P).is_ent_hint('P'));
-        }
-        if (next_N >= n_pairs && next_P > ix_last_hQ) {
-          // both stacks empty
-          break;
-        }
-        /* Decide which entry to use next:
-           If N is empty, must use P, and vice versa
-           else
-           If the last was P and current P has zero SP, use P
-           else
-           we assume that both P and N have valid SP, in which case
-              use the one with the larger value
-        */
-        bool use_P = true;
-        if (next_N >= n_pairs) {
-          // N empty, use P
-          use_P = true;
-          if (0) LOG("  P  <=  no remaining N entries");
-        }
-        else if (next_P > ix_last_hQ) {
-          // P empty, use N
-          use_P = false;
-          if (0) LOG("  N  <=  no remaining P entries");
-        }
-        else {
-          // We have at least one N and one P entry available.
-          // Scan forwards to find the SP of the current P entry
-          u_int64_t sp_cur_P = 0;
-          unsigned int m = next_P + 1;
-          while (1) {
-            /* This assertion should hold because in a well formed
-               input, we must eventually find the hint-Q that marks
-               the end of this frame's entries. */
-            MOZ_ASSERT(m < buff->entsUsed);
-            ProfileEntry2 ent = utb_get_profent(buff, m);
-            if (ent.is_ent_hint('Q'))
-              break;
-            if (ent.is_ent('S')) {
-              sp_cur_P = reinterpret_cast<u_int64_t>(ent.get_tagPtr());
-              break;
-            }
-            m++;
-          }
-          if (last_was_P && sp_cur_P == 0) {
-            if (0) LOG("  P  <=  last_was_P && sp_cur_P == 0");
-            use_P = true;
-          } else {
-            u_int64_t sp_cur_N = pairs[next_N].sp;
-            use_P = (sp_cur_P > sp_cur_N);
-            if (0) LOGF("  %s  <=  sps P %p N %p",
-                        use_P ? "P" : "N", (void*)(intptr_t)sp_cur_P, 
-                                           (void*)(intptr_t)sp_cur_N);
-          }
-        }
-        /* So, we know which we are going to use. */
-        if (use_P) {
-          unsigned int m = next_P + 1;
-          while (true) {
-            MOZ_ASSERT(m < buff->entsUsed);
-            ProfileEntry2 ent = utb_get_profent(buff, m);
-            if (ent.is_ent_hint('Q')) {
-              next_P = m + 1;
-              break;
-            }
-            // we don't expect a flush-hint here
-            MOZ_ASSERT(!ent.is_ent_hint('F'));
-            // skip ones we can't copy
-            if (ent.is_ent_hint() || ent.is_ent('S')) { m++; continue; }
-            // and copy everything else
-            buff->aProfile->addTag( ent );
-            m++;
-          }
-        } else {
-          buff->aProfile
-              ->addTag( ProfileEntry2('l', reinterpret_cast<void*>(pairs[next_N].pc)) );
-          next_N++;
-        }
-        /* Remember what we chose, for next time. */
-        last_was_P = use_P;
-      }
-
-      MOZ_ASSERT(next_P == ix_last_hQ + 1);
-      MOZ_ASSERT(next_N == n_pairs);
-      // END merge
-
-      // Entries after the pseudostack frames
-      for (k = ix_last_hQ+1; k < buff->entsUsed; k++) {
-        ProfileEntry2 ent = utb_get_profent(buff, k);
-        // action flush-hints
-        if (ent.is_ent_hint('F')) { buff->aProfile->flush(); continue; }
-        // skip ones we can't copy
-        if (ent.is_ent_hint() || ent.is_ent('S')) { continue; }
-        // and copy everything else
-        buff->aProfile->addTag( ent );
-      }
-
-      // free native unwind info
-      if (pairs)
-        free(pairs);
-    }
-
-#if 0
-    bool show = true;
-    if (show) LOG("----------------");
-    for (k = 0; k < buff->entsUsed; k++) {
-      ProfileEntry2 ent = utb_get_profent(buff, k);
-      if (show) ent.log();
-      if (ent.is_ent_hint('F')) {
-        /* This is a flush-hint */
-        buff->aProfile->flush();
-      } 
-      else if (ent.is_ent_hint('N')) {
-        /* This is a do-a-native-unwind-right-now hint */
-        MOZ_ASSERT(buff->haveNativeInfo);
-        PCandSP* pairs = NULL;
-        unsigned int nPairs = 0;
-        do_breakpad_unwind_Buffer(&pairs, &nPairs, buff, oldest_ix);
-        buff->aProfile->addTag( ProfileEntry2('s', "(root)") );
-        for (unsigned int i = 0; i < nPairs; i++) {
-          buff->aProfile
-              ->addTag( ProfileEntry2('l', reinterpret_cast<void*>(pairs[i].pc)) );
-        }
-        if (pairs)
-          free(pairs);
-      } else {
-        /* Copy in verbatim */
-        buff->aProfile->addTag( ent );
-      }
-    }
-#endif
-
-    buff->aProfile->GetMutex()->Unlock();
-
-    /* And .. we're done.  Mark the buffer as empty so it can be
-       reused.  First though, unmap any of the entsPages that got
-       mapped during filling. */
-    for (i = 0; i < N_PROF_ENT_PAGES; i++) {
-      if (buff->entsPages[i] == ProfEntsPage_INVALID)
-        continue;
-      munmap_ProfEntsPage(buff->entsPages[i]);
-      buff->entsPages[i] = ProfEntsPage_INVALID;
-    }
-
-    (void)VALGRIND_MAKE_MEM_UNDEFINED(&buff->stackImg[0], N_STACK_BYTES);
-    spinLock_acquire(&g_spinLock);
-    MOZ_ASSERT(buff->state == S_EMPTYING);
-    buff->state = S_EMPTY;
-    spinLock_release(&g_spinLock);
-    ms_to_sleep_if_empty = 1;
-  }
-  return NULL;
-}
-
-
-////////////////////////////////////////////////////////////////
-////////////////////////////////////////////////////////////////
-////////////////////////////////////////////////////////////////
-////////////////////////////////////////////////////////////////
-////////////////////////////////////////////////////////////////
-////////////////////////////////////////////////////////////////
-
-/* After this point, we have some classes that interface with
-   breakpad, that allow us to pass in a Buffer and get an unwind of
-   it. */
-
-#include <stdio.h>
-#include <string.h>
-#include <stdlib.h>
-
-#include <string>
-#include <vector>
-#include <fstream>
-#include <sstream>
-
-#include "google_breakpad/common/minidump_format.h"
-#include "google_breakpad/processor/call_stack.h"
-#include "google_breakpad/processor/stack_frame_cpu.h"
-#include "local_debug_info_symbolizer.h"
-#include "processor/stackwalker_amd64.h"
-#include "processor/stackwalker_arm.h"
-#include "processor/stackwalker_x86.h"
-#include "processor/logging.h"
-#include "common/linux/dump_symbols.h"
-
-#include "google_breakpad/processor/memory_region.h"
-#include "google_breakpad/processor/code_modules.h"
-
-google_breakpad::MemoryRegion* foo = NULL;
-
-using std::string;
-
-///////////////////////////////////////////////////////////////////
-/* Implement MemoryRegion, so that it hauls stack image data out of
-   the stack top snapshots that the signal handler has so carefully
-   snarfed. */
-
-// BEGIN: DERIVED FROM src/processor/stackwalker_selftest.cc
-//
-class BufferMemoryRegion : public google_breakpad::MemoryRegion {
- public:
-  // We just keep hold of the Buffer* we're given, but make no attempt
-  // to take allocation-ownership of it.
-  BufferMemoryRegion(UnwinderThreadBuffer* buff) : buff_(buff) { }
-  ~BufferMemoryRegion() { }
-
-  u_int64_t GetBase() const { return (uintptr_t)buff_->stackImgAddr; }
-  u_int32_t GetSize() const { return (uintptr_t)buff_->stackImgUsed; }
-
-  bool GetMemoryAtAddress(u_int64_t address, u_int8_t*  value) const {
-      return GetMemoryAtAddressInternal(address, value); }
-  bool GetMemoryAtAddress(u_int64_t address, u_int16_t* value) const {
-      return GetMemoryAtAddressInternal(address, value); }
-  bool GetMemoryAtAddress(u_int64_t address, u_int32_t* value) const {
-      return GetMemoryAtAddressInternal(address, value); }
-  bool GetMemoryAtAddress(u_int64_t address, u_int64_t* value) const {
-      return GetMemoryAtAddressInternal(address, value); }
-
- private:
-  template<typename T> bool GetMemoryAtAddressInternal (
-                               u_int64_t address, T* value) const {
-    /* Range check .. */
-    if ( buff_->stackImgUsed >= sizeof(T)
-         && ((uintptr_t)address) >= ((uintptr_t)buff_->stackImgAddr)
-         && ((uintptr_t)address) <= ((uintptr_t)buff_->stackImgAddr)
-                                     + buff_->stackImgUsed
-                                     - sizeof(T) ) {
-      uintptr_t offset = (uintptr_t)address - (uintptr_t)buff_->stackImgAddr;
-      if (0) LOGF("GMAA %llx ok", (unsigned long long int)address);
-      *value = *reinterpret_cast<const T*>(&buff_->stackImg[offset]);
-      return true;
-    } else {
-      if (0) LOGF("GMAA %llx failed", (unsigned long long int)address);
-      return false;
-    }
-  }
-
-  // where this all comes from
-  UnwinderThreadBuffer* buff_;
-};
-//
-// END: DERIVED FROM src/processor/stackwalker_selftest.cc
-
-
-///////////////////////////////////////////////////////////////////
-/* Implement MyCodeModule and MyCodeModules, so they pull the relevant
-   information about which modules are loaded where out of
-   /proc/self/maps. */
-
-class MyCodeModule : public google_breakpad::CodeModule {
-public:
-  MyCodeModule(u_int64_t x_start, u_int64_t x_len, string filename)
-    : x_start_(x_start), x_len_(x_len), filename_(filename) {
-    MOZ_ASSERT(x_len > 0);
-  }
-
-  ~MyCodeModule() {}
-
-  // The base address of this code module as it was loaded by the process.
-  // (u_int64_t)-1 on error.
-  u_int64_t base_address() const { return x_start_; }
-
-  // The size of the code module.  0 on error.
-  u_int64_t size() const { return x_len_; }
-
-  // The path or file name that the code module was loaded from.  Empty on
-  // error.
-  string code_file() const { return filename_; }
-
-  // An identifying string used to discriminate between multiple versions and
-  // builds of the same code module.  This may contain a uuid, timestamp,
-  // version number, or any combination of this or other information, in an
-  // implementation-defined format.  Empty on error.
-  string code_identifier() const { MOZ_CRASH(); return ""; }
-
-  // The filename containing debugging information associated with the code
-  // module.  If debugging information is stored in a file separate from the
-  // code module itself (as is the case when .pdb or .dSYM files are used),
-  // this will be different from code_file.  If debugging information is
-  // stored in the code module itself (possibly prior to stripping), this
-  // will be the same as code_file.  Empty on error.
-  string debug_file() const { MOZ_CRASH(); return ""; }
-
-  // An identifying string similar to code_identifier, but identifies a
-  // specific version and build of the associated debug file.  This may be
-  // the same as code_identifier when the debug_file and code_file are
-  // identical or when the same identifier is used to identify distinct
-  // debug and code files.
-  string debug_identifier() const { MOZ_CRASH(); return ""; }
-
-  // A human-readable representation of the code module's version.  Empty on
-  // error.
-  string version() const { MOZ_CRASH(); return ""; }
-
-  // Creates a new copy of this CodeModule object, which the caller takes
-  // ownership of.  The new CodeModule may be of a different concrete class
-  // than the CodeModule being copied, but will behave identically to the
-  // copied CodeModule as far as the CodeModule interface is concerned.
-  const CodeModule* Copy() const { MOZ_CRASH(); return NULL; }
-
- private:
-  // record info for a file backed executable mapping
-  // snarfed from /proc/self/maps
-  u_int64_t x_start_;
-  u_int64_t x_len_;    // may not be zero
-  string    filename_; // of the mapped file
-};
-
-
-/* Find out, in a platform-dependent way, where the code modules got
-   mapped in the process' virtual address space, and add them to
-   |mods_|. */
-static void read_procmaps(std::vector<MyCodeModule*>& mods_)
-{
-  MOZ_ASSERT(mods_.size() == 0);
-
-#if defined(SPS_OS_linux) || defined(SPS_OS_android)
-  // read /proc/self/maps and create a vector of CodeModule*
-  FILE* f = fopen("/proc/self/maps", "r");
-  MOZ_ASSERT(f);
-  while (!feof(f)) {
-    unsigned long long int start = 0;
-    unsigned long long int end   = 0;
-    char rr = ' ', ww = ' ', xx = ' ', pp = ' ';
-    unsigned long long int offset = 0, inode = 0;
-    unsigned int devMaj = 0, devMin = 0;
-    int nItems = fscanf(f, "%llx-%llx %c%c%c%c %llx %x:%x %llu",
-                        &start, &end, &rr, &ww, &xx, &pp,
-                        &offset, &devMaj, &devMin, &inode);
-    if (nItems == EOF && feof(f)) break;
-    MOZ_ASSERT(nItems == 10);
-    MOZ_ASSERT(start < end);
-    // read the associated file name, if it is present
-    int ch;
-    // find '/' or EOL
-    while (1) {
-      ch = fgetc(f);
-      MOZ_ASSERT(ch != EOF);
-      if (ch == '\n' || ch == '/') break;
-    }
-    string fname("");
-    if (ch == '/') {
-      fname += (char)ch;
-      while (1) {
-        ch = fgetc(f);
-        MOZ_ASSERT(ch != EOF);
-        if (ch == '\n') break;
-        fname += (char)ch;
-      }
-    }
-    MOZ_ASSERT(ch == '\n');
-    if (0) LOGF("SEG %llx %llx %c %c %c %c %s",
-                start, end, rr, ww, xx, pp, fname.c_str() );
-    if (xx == 'x' && fname != "") {
-      MyCodeModule* cm = new MyCodeModule( start, end-start, fname );
-      mods_.push_back(cm);
-    }
-  }
-  fclose(f);
-
-#elif defined(SPS_OS_darwin)
-
-# if defined(SPS_PLAT_amd64_darwin)
-  typedef mach_header_64 breakpad_mach_header;
-  typedef segment_command_64 breakpad_mach_segment_command;
-  const int LC_SEGMENT_XX = LC_SEGMENT_64;
-# else // SPS_PLAT_x86_darwin
-  typedef mach_header breakpad_mach_header;
-  typedef segment_command breakpad_mach_segment_command;
-  const int LC_SEGMENT_XX = LC_SEGMENT;
-# endif
-
-  uint32_t n_images = _dyld_image_count();
-  for (uint32_t ix = 0; ix < n_images; ix++) {
-
-    MyCodeModule* cm = NULL;
-    unsigned long slide = _dyld_get_image_vmaddr_slide(ix);
-    const char* name = _dyld_get_image_name(ix);
-    const breakpad_mach_header* header
-      = (breakpad_mach_header*)_dyld_get_image_header(ix);
-    if (!header)
-      continue;
-
-    const struct load_command *cmd =
-      reinterpret_cast<const struct load_command *>(header + 1);
-
-    /* Look through the MachO headers to find out the module's stated
-       VMA, so we can add it to the slide to find its actual VMA.
-       Copied from MinidumpGenerator::WriteModuleStream
-       src/client/mac/handler/minidump_generator.cc. */
-    for (unsigned int i = 0; cmd && (i < header->ncmds); i++) {
-      if (cmd->cmd == LC_SEGMENT_XX) {
-
-        const breakpad_mach_segment_command *seg =
-          reinterpret_cast<const breakpad_mach_segment_command *>(cmd);
-
-        if (!strcmp(seg->segname, "__TEXT")) {
-          cm = new MyCodeModule( seg->vmaddr + slide,
-                                 seg->vmsize, string(name) );
-          break;
-        }
-      }
-      cmd = reinterpret_cast<struct load_command*>((char *)cmd + cmd->cmdsize);
-    }
-    if (cm) {
-      mods_.push_back(cm);
-      if (0) LOGF("SEG %llx %llx %s",
-                  cm->base_address(), cm->base_address() + cm->size(),
-                  cm->code_file().c_str());
-    }
-  }
-
-#else
-# error "Unknown platform"
-#endif
-
-  if (0) LOGF("got %d mappings\n", (int)mods_.size());
-}
-
-
-class MyCodeModules : public google_breakpad::CodeModules
-{
- public:
-  MyCodeModules() {
-    read_procmaps(mods_);
-  }
-
-  ~MyCodeModules() {
-    std::vector<MyCodeModule*>::const_iterator it;
-    for (it = mods_.begin(); it < mods_.end(); it++) {
-      MyCodeModule* cm = *it;
-      delete cm;
-    }
-  }
-
- private:
-  std::vector<MyCodeModule*> mods_;
-
-  unsigned int module_count() const { MOZ_CRASH(); return 1; }
-
-  const google_breakpad::CodeModule*
-                GetModuleForAddress(u_int64_t address) const
-  {
-    if (0) printf("GMFA %llx\n", (unsigned long long int)address);
-    std::vector<MyCodeModule*>::const_iterator it;
-    for (it = mods_.begin(); it < mods_.end(); it++) {
-       MyCodeModule* cm = *it;
-       if (0) printf("considering %p  %llx +%llx\n",
-                     (void*)cm, (unsigned long long int)cm->base_address(),
-                                (unsigned long long int)cm->size());
-       if (cm->base_address() <= address
-           && address < cm->base_address() + cm->size())
-          return cm;
-    }
-    return NULL;
-  }
-
-  const google_breakpad::CodeModule* GetMainModule() const {
-    MOZ_CRASH(); return NULL; return NULL;
-  }
-
-  const google_breakpad::CodeModule* GetModuleAtSequence(
-                unsigned int sequence) const {
-    MOZ_CRASH(); return NULL;
-  }
-
-  const google_breakpad::CodeModule* GetModuleAtIndex(unsigned int index) const {
-    MOZ_CRASH(); return NULL;
-  }
-
-  const CodeModules* Copy() const {
-    MOZ_CRASH(); return NULL;
-  }
-};
-
-///////////////////////////////////////////////////////////////////
-/* Top level interface to breakpad.  Given a Buffer* as carefully
-   acquired by the signal handler and later handed to this thread,
-   unwind it.
-
-   The first time in, read /proc/self/maps.  TODO: what about if it
-   changes as we go along?
-
-   Dump the result (PC, SP) pairs in a malloc-allocated array of
-   PCandSPs, and return that and its length to the caller.  Caller is
-   responsible for deallocating it.
-
-   The first pair is for the outermost frame, the last for the
-   innermost frame.
-*/
-
-MyCodeModules* sModules = NULL;
-google_breakpad::LocalDebugInfoSymbolizer* sSymbolizer = NULL;
-
-void do_breakpad_unwind_Buffer(/*OUT*/PCandSP** pairs,
-                               /*OUT*/unsigned int* nPairs,
-                               UnwinderThreadBuffer* buff,
-                               int buffNo /* for debug printing only */)
-{
-# if defined(SPS_ARCH_amd64)
-  MDRawContextAMD64* context = new MDRawContextAMD64();
-  memset(context, 0, sizeof(*context));
-
-  context->rip = buff->regs.rip;
-  context->rbp = buff->regs.rbp;
-  context->rsp = buff->regs.rsp;
-
-  if (0) {
-    LOGF("Initial RIP = 0x%llx", (unsigned long long int)context->rip);
-    LOGF("Initial RSP = 0x%llx", (unsigned long long int)context->rsp);
-    LOGF("Initial RBP = 0x%llx", (unsigned long long int)context->rbp);
-  }
-
-# elif defined(SPS_ARCH_arm)
-  MDRawContextARM* context = new MDRawContextARM();
-  memset(context, 0, sizeof(*context));
-
-  context->iregs[7]                     = buff->regs.r7;
-  context->iregs[12]                    = buff->regs.r12;
-  context->iregs[MD_CONTEXT_ARM_REG_PC] = buff->regs.r15;
-  context->iregs[MD_CONTEXT_ARM_REG_LR] = buff->regs.r14;
-  context->iregs[MD_CONTEXT_ARM_REG_SP] = buff->regs.r13;
-  context->iregs[MD_CONTEXT_ARM_REG_FP] = buff->regs.r11;
-
-  if (0) {
-    LOGF("Initial R15 = 0x%x",
-         context->iregs[MD_CONTEXT_ARM_REG_PC]);
-    LOGF("Initial R13 = 0x%x",
-         context->iregs[MD_CONTEXT_ARM_REG_SP]);
-  }
-
-# elif defined(SPS_ARCH_x86)
-  MDRawContextX86* context = new MDRawContextX86();
-  memset(context, 0, sizeof(*context));
-
-  context->eip = buff->regs.eip;
-  context->ebp = buff->regs.ebp;
-  context->esp = buff->regs.esp;
-
-  if (0) {
-    LOGF("Initial EIP = 0x%x", context->eip);
-    LOGF("Initial ESP = 0x%x", context->esp);
-    LOGF("Initial EBP = 0x%x", context->ebp);
-  }
-
-# else
-#   error "Unknown plat"
-# endif
-
-  BufferMemoryRegion* memory = new BufferMemoryRegion(buff);
-
-  if (!sModules) {
-     sModules = new MyCodeModules();
-  }
-
-  if (!sSymbolizer) {
-    /* Make up a list of places where the debug objects might be. */
-    std::vector<std::string> debug_dirs;
-#   if defined(SPS_OS_linux)
-    debug_dirs.push_back("/usr/lib/debug/lib");
-    debug_dirs.push_back("/usr/lib/debug/usr/lib");
-    debug_dirs.push_back("/usr/lib/debug/lib/x86_64-linux-gnu");
-    debug_dirs.push_back("/usr/lib/debug/usr/lib/x86_64-linux-gnu");
-#   elif defined(SPS_OS_android)
-    debug_dirs.push_back("/sdcard/symbols/system/lib");
-    debug_dirs.push_back("/sdcard/symbols/system/bin");
-#   elif defined(SPS_OS_darwin)
-    /* Nothing */
-#   else
-#     error "Unknown plat"
-#   endif
-    sSymbolizer = new google_breakpad::LocalDebugInfoSymbolizer(debug_dirs);
-  }
-
-# if defined(SPS_ARCH_amd64)
-  google_breakpad::StackwalkerAMD64* sw
-   = new google_breakpad::StackwalkerAMD64(NULL, context,
-                                           memory, sModules,
-                                           sSymbolizer);
-# elif defined(SPS_ARCH_arm)
-  google_breakpad::StackwalkerARM* sw
-   = new google_breakpad::StackwalkerARM(NULL, context,
-                                         -1/*FP reg*/,
-                                         memory, sModules,
-                                         sSymbolizer);
-# elif defined(SPS_ARCH_x86)
-  google_breakpad::StackwalkerX86* sw
-   = new google_breakpad::StackwalkerX86(NULL, context,
-                                         memory, sModules,
-                                         sSymbolizer);
-# else
-#   error "Unknown plat"
-# endif
-
-  google_breakpad::CallStack* stack = new google_breakpad::CallStack();
-
-  std::vector<const google_breakpad::CodeModule*>* modules_without_symbols
-    = new std::vector<const google_breakpad::CodeModule*>();
-  bool b = sw->Walk(stack, modules_without_symbols);
-  (void)b;
-  delete modules_without_symbols;
-
-  unsigned int n_frames = stack->frames()->size();
-  unsigned int n_frames_good = 0;
-
-  *pairs  = (PCandSP*)malloc(n_frames * sizeof(PCandSP));
-  *nPairs = n_frames;
-  if (*pairs == NULL) {
-    *nPairs = 0;
-    return;
-  }
-
-  if (n_frames > 0) {
-    for (unsigned int frame_index = 0; 
-         frame_index < n_frames; ++frame_index) {
-      google_breakpad::StackFrame *frame = stack->frames()->at(frame_index);
-
-      if (frame->trust == google_breakpad::StackFrame::FRAME_TRUST_CFI
-          || frame->trust == google_breakpad::StackFrame::FRAME_TRUST_CONTEXT) {
-        n_frames_good++;
-      }
-
-#     if defined(SPS_ARCH_amd64)
-      google_breakpad::StackFrameAMD64* frame_amd64
-        = reinterpret_cast<google_breakpad::StackFrameAMD64*>(frame);
-      if (LOGLEVEL >= 4) {
-        LOGF("frame %d   rip=0x%016llx rsp=0x%016llx    %s", 
-             frame_index,
-             (unsigned long long int)frame_amd64->context.rip, 
-             (unsigned long long int)frame_amd64->context.rsp, 
-             frame_amd64->trust_description().c_str());
-      }
-      (*pairs)[n_frames-1-frame_index].pc = frame_amd64->context.rip;
-      (*pairs)[n_frames-1-frame_index].sp = frame_amd64->context.rsp;
-
-#     elif defined(SPS_ARCH_arm)
-      google_breakpad::StackFrameARM* frame_arm
-        = reinterpret_cast<google_breakpad::StackFrameARM*>(frame);
-      if (LOGLEVEL >= 4) {
-        LOGF("frame %d   0x%08x   %s",
-             frame_index,
-             frame_arm->context.iregs[MD_CONTEXT_ARM_REG_PC],
-             frame_arm->trust_description().c_str());
-      }
-      (*pairs)[n_frames-1-frame_index].pc
-        = frame_arm->context.iregs[MD_CONTEXT_ARM_REG_PC];
-      (*pairs)[n_frames-1-frame_index].sp
-        = frame_arm->context.iregs[MD_CONTEXT_ARM_REG_SP];
-
-#     elif defined(SPS_ARCH_x86)
-      google_breakpad::StackFrameX86* frame_x86
-        = reinterpret_cast<google_breakpad::StackFrameX86*>(frame);
-      if (LOGLEVEL >= 4) {
-        LOGF("frame %d   eip=0x%08x rsp=0x%08x    %s", 
-             frame_index,
-             frame_x86->context.eip, frame_x86->context.esp, 
-             frame_x86->trust_description().c_str());
-      }
-      (*pairs)[n_frames-1-frame_index].pc = frame_x86->context.eip;
-      (*pairs)[n_frames-1-frame_index].sp = frame_x86->context.esp;
-
-#     else
-#       error "Unknown plat"
-#     endif
-    }
-  }
-
-  if (LOGLEVEL >= 3) {
-    LOGF("BPUnw: unwinder: seqNo %llu, buf %d: got %u frames "
-         "(%u trustworthy)", 
-         (unsigned long long int)buff->seqNo, buffNo, n_frames, n_frames_good);
-  }
-
-  if (LOGLEVEL >= 2) {
-    if (0 == (g_stats_totalSamples % 1000))
-      LOGF("BPUnw: %llu total samples, %llu failed due to buffer unavail",
-           (unsigned long long int)g_stats_totalSamples,
-           (unsigned long long int)g_stats_noBuffAvail);
-  }
-
-  delete stack;
-  delete sw;
-  delete memory;
-  delete context;
-}
-
-#endif /* defined(SPS_PLAT_x86_windows) */
diff --git a/tools/profiler/UnwinderThread2.h b/tools/profiler/UnwinderThread2.h
deleted file mode 100644
index 29111fbaa286..000000000000
--- a/tools/profiler/UnwinderThread2.h
+++ /dev/null
@@ -1,60 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef MOZ_UNWINDER_THREAD_2_H
-#define MOZ_UNWINDER_THREAD_2_H
-
-#include "sps_sampler.h"
-#include "ProfileEntry2.h"
-
-/* Top level exports of UnwinderThread.cpp. */
-
-// Abstract type.  A buffer which is used to transfer information between
-// the sampled thread(s) and the unwinder thread(s).
-typedef
-  struct _UnwinderThreadBuffer 
-  UnwinderThreadBuffer;
-
-// RUNS IN SIGHANDLER CONTEXT
-// Called in the sampled thread (signal) context.  Adds a ProfileEntry2
-// into an UnwinderThreadBuffer that the thread has previously obtained
-// by a call to utb__acquire_empty_buffer.
-void utb__addEntry(/*MOD*/UnwinderThreadBuffer* utb,
-                   ProfileEntry2 ent);
-
-// Create the unwinder thread.  At the moment there can be only one.
-void uwt__init();
-
-// Request the unwinder thread to exit, and wait until it has done so.
-void uwt__deinit();
-
-// Registers a sampler thread for profiling.  Threads must be registered
-// before they are allowed to call utb__acquire_empty_buffer or
-// utb__release_full_buffer.
-void uwt__register_thread_for_profiling(void* stackTop);
-
-// RUNS IN SIGHANDLER CONTEXT
-// Called in the sampled thread (signal) context.  Get an empty buffer
-// into which ProfileEntries can be put.  It may return NULL if no
-// empty buffers can be found, which will be the case if the unwinder
-// thread(s) have fallen behind for some reason.  In this case the
-// sampled thread must simply give up and return from the signal handler
-// immediately, else it risks deadlock.
-UnwinderThreadBuffer* uwt__acquire_empty_buffer();
-
-// RUNS IN SIGHANDLER CONTEXT
-// Called in the sampled thread (signal) context.  Release a buffer
-// that the sampled thread has acquired, handing the contents to
-// the unwinder thread, and, if necessary, passing sufficient
-// information (stack top chunk, + registers) to also do a native
-// unwind.  If 'ucV' is NULL, no native unwind is done.  If non-NULL,
-// it is assumed to point to a ucontext_t* that holds the initial 
-// register state for the unwind.  The results of all of this are
-// dumped into |aProfile| (by the unwinder thread, not the calling thread).
-void uwt__release_full_buffer(ThreadProfile2* aProfile,
-                              UnwinderThreadBuffer* utb,
-                              void* /* ucontext_t*, really */ ucV);
-
-#endif /* ndef MOZ_UNWINDER_THREAD_2_H */
diff --git a/tools/profiler/local_debug_info_symbolizer.cc b/tools/profiler/local_debug_info_symbolizer.cc
deleted file mode 100644
index 082861d3131d..000000000000
--- a/tools/profiler/local_debug_info_symbolizer.cc
+++ /dev/null
@@ -1,160 +0,0 @@
-
-#include "PlatformMacros.h"
-
-#if !defined(SPS_PLAT_x86_windows)
-# include "common/module.h"
-# include "processor/cfi_frame_info.h"
-#endif
-#include "google_breakpad/processor/code_module.h"
-#include "google_breakpad/processor/code_modules.h"
-#include "google_breakpad/processor/stack_frame.h"
-#include "processor/logging.h"
-#include "common/scoped_ptr.h"
-
-#if defined(SPS_PLAT_amd64_linux) || defined(SPS_PLAT_arm_android) \
-    || defined(SPS_PLAT_x86_linux) || defined(SPS_PLAT_x86_android)
-# include "common/linux/dump_symbols.h"
-#elif defined(SPS_PLAT_amd64_darwin) || defined(SPS_PLAT_x86_darwin)
-# include "shim_mac_dump_syms.h"
-#elif defined(SPS_PLAT_x86_windows)
-  /* This is all stubbed out anyway, so don't do anything. */
-#else
-# error "Unknown platform"
-#endif
-
-#include "platform.h"
-#include "local_debug_info_symbolizer.h"
-
-namespace google_breakpad {
-
-LocalDebugInfoSymbolizer::~LocalDebugInfoSymbolizer() {
-# if !defined(SPS_PLAT_x86_windows)
-  for (SymbolMap::iterator it = symbols_.begin();
-       it != symbols_.end();
-       ++it) {
-    delete it->second;
-  }
-# endif
-}
-
-StackFrameSymbolizer::SymbolizerResult
-LocalDebugInfoSymbolizer::FillSourceLineInfo(const CodeModules* modules,
-                                             const SystemInfo* system_info,
-                                             StackFrame* frame) {
-  if (!modules) {
-    return kError;
-  }
-  const CodeModule* module = modules->GetModuleForAddress(frame->instruction);
-  if (!module) {
-    return kError;
-  }
-  frame->module = module;
-
-# if !defined(SPS_PLAT_x86_windows)
-  Module* debug_info_module = NULL;
-  SymbolMap::const_iterator it = symbols_.find(module->code_file());
-  if (it == symbols_.end()) {
-    if (no_symbol_modules_.find(module->code_file()) !=
-        no_symbol_modules_.end()) {
-      return kNoError;
-    }
-    LOG("BPUnw:");
-    LOGF("BPUnw: ReadSymbolData: BEGIN   %s", module->code_file().c_str());
-    if (!ReadSymbolData(module->code_file(),
-                        debug_dirs_,
-                        ONLY_CFI,
-                        &debug_info_module)) {
-      BPLOG(ERROR) << "ReadSymbolData failed for " << module->code_file();
-      LOGF("BPUnw: ReadSymbolData: FAIL    %s", module->code_file().c_str());
-      if (debug_info_module)
-        delete debug_info_module;
-      no_symbol_modules_.insert(module->code_file());
-      return kNoError;
-    }
-
-    LOGF("BPUnw: ReadSymbolData: SUCCESS %s", module->code_file().c_str());
-    symbols_[module->code_file()] = debug_info_module;
-  } else {
-    debug_info_module = it->second;
-  }
-
-  u_int64_t address = frame->instruction - frame->module->base_address();
-  Module::Function* function =
-      debug_info_module->FindFunctionByAddress(address);
-  if (function) {
-    frame->function_name = function->name;
-    //TODO: line info: function->lines
-  } else {
-    Module::Extern* ex = debug_info_module->FindExternByAddress(address);
-    if (ex) {
-      frame->function_name = ex->name;
-    }
-  }
-# endif /* !defined(SPS_PLAT_x86_windows) */
-  return kNoError;
-}
-
-
-WindowsFrameInfo* LocalDebugInfoSymbolizer::FindWindowsFrameInfo(
-    const StackFrame* frame) {
-  // Not currently implemented, would require PDBSourceLineWriter to
-  // implement an API to return symbol data.
-  return NULL;
-}
-
-#if !defined(SPS_PLAT_x86_windows)
-// Taken wholesale from source_line_resolver_base.cc
-bool ParseCFIRuleSet(const string& rule_set, CFIFrameInfo* frame_info) {
-  CFIFrameInfoParseHandler handler(frame_info);
-  CFIRuleParser parser(&handler);
-  return parser.Parse(rule_set);
-}
-
-static void ConvertCFI(const UniqueString* name, const Module::Expr& rule,
-                       CFIFrameInfo* frame_info) {
-  if (name == ustr__ZDcfa()) frame_info->SetCFARule(rule);
-  else if (name == ustr__ZDra()) frame_info->SetRARule(rule);
-  else frame_info->SetRegisterRule(name, rule);
-}
-
-
-static void ConvertCFI(const Module::RuleMap& rule_map,
-                       CFIFrameInfo* frame_info) {
-  for (Module::RuleMap::const_iterator it = rule_map.begin();
-       it != rule_map.end(); ++it) {
-    ConvertCFI(it->first, it->second, frame_info);
-  }
-}
-#endif
-
-CFIFrameInfo* LocalDebugInfoSymbolizer::FindCFIFrameInfo(
-    const StackFrame* frame) {
-#if defined(SPS_PLAT_x86_windows)
-  return NULL;
-#else
-  if (!frame || !frame->module) return NULL;
-
-  SymbolMap::const_iterator it = symbols_.find(frame->module->code_file());
-  if (it == symbols_.end()) return NULL;
-
-  Module* module = it->second;
-  u_int64_t address = frame->instruction - frame->module->base_address();
-  Module::StackFrameEntry* entry =
-      module->FindStackFrameEntryByAddress(address);
-  if (!entry)
-    return NULL;
-
-  //TODO: can we cache this data per-address? does that make sense?
-  scoped_ptr<CFIFrameInfo> rules(new CFIFrameInfo());
-  ConvertCFI(entry->initial_rules, rules.get());
-  for (Module::RuleChangeMap::const_iterator delta_it =
-           entry->rule_changes.begin();
-       delta_it != entry->rule_changes.end() && delta_it->first < address;
-       ++delta_it) {
-    ConvertCFI(delta_it->second, rules.get());
-  }
-  return rules.release();
-#endif /* defined(SPS_PLAT_x86_windows) */
-}
-
-}  // namespace google_breakpad
diff --git a/tools/profiler/local_debug_info_symbolizer.h b/tools/profiler/local_debug_info_symbolizer.h
deleted file mode 100644
index 311cc49768ee..000000000000
--- a/tools/profiler/local_debug_info_symbolizer.h
+++ /dev/null
@@ -1,40 +0,0 @@
-#ifndef PROCESSOR_LOCAL_DEBUG_INFO_SYMBOLIZER_H_
-#define PROCESSOR_LOCAL_DEBUG_INFO_SYMBOLIZER_H_
-
-#include "google_breakpad/processor/stack_frame_symbolizer.h"
-
-#include <map>
-#include <vector>
-
-namespace google_breakpad {
-
-class Module;
-
-class LocalDebugInfoSymbolizer : public StackFrameSymbolizer {
- public:
-  using StackFrameSymbolizer::SymbolizerResult;
-  LocalDebugInfoSymbolizer(const std::vector<string>& debug_dirs) :
-      StackFrameSymbolizer(NULL, NULL),
-      debug_dirs_(debug_dirs) {}
-  virtual ~LocalDebugInfoSymbolizer();
-
-  virtual SymbolizerResult FillSourceLineInfo(const CodeModules* modules,
-                                              const SystemInfo* system_info,
-                                              StackFrame* stack_frame);
-
-  virtual WindowsFrameInfo* FindWindowsFrameInfo(const StackFrame* frame);
-
-  virtual CFIFrameInfo* FindCFIFrameInfo(const StackFrame* frame);
-
-  // Lie to the stackwalker to short-circuit stack-scanning heuristics.
-  virtual bool HasImplementation() { return false; }
-
- private:
-  typedef std::map<string, Module*> SymbolMap;
-  SymbolMap symbols_;
-  std::vector<string> debug_dirs_;
-};
-
-}  // namespace google_breakpad
-
-#endif  // PROCESSOR_LOCAL_DEBUG_INFO_SYMBOLIZER_H_
diff --git a/tools/profiler/nsProfiler.cpp b/tools/profiler/nsProfiler.cpp
index feb03c2c2394..c44f1b9c7f8b 100644
--- a/tools/profiler/nsProfiler.cpp
+++ b/tools/profiler/nsProfiler.cpp
@@ -60,11 +60,11 @@ nsProfiler::Observe(nsISupports *aSubject,
     nsCOMPtr<nsILoadContext> loadContext = do_QueryInterface(parentWebNav);
     if (loadContext && loadContext->UsePrivateBrowsing() && !mLockedForPrivateBrowsing) {
       mLockedForPrivateBrowsing = true;
-      SAMPLER_LOCK();
+      mozilla_sampler_lock();
     }
   } else if (strcmp(aTopic, "last-pb-context-exited") == 0) {
     mLockedForPrivateBrowsing = false;
-    SAMPLER_UNLOCK();
+    mozilla_sampler_unlock();
   }
   return NS_OK;
 }
diff --git a/tools/profiler/platform-linux.cc b/tools/profiler/platform-linux.cc
index 7685a9f19c32..9f54cf26488d 100644
--- a/tools/profiler/platform-linux.cc
+++ b/tools/profiler/platform-linux.cc
@@ -224,7 +224,7 @@ Sampler::~Sampler() {
 
 
 void Sampler::Start() {
-  LOG("Sampler started");
+  LOG("Sampler Started");
   if (sActiveSampler != NULL) return;
 
   // Request profiling signals.
@@ -291,8 +291,8 @@ static struct sigaction old_sigstart_signal_handler;
 const int SIGSTART = SIGUSR1;
 
 static void StartSignalHandler(int signal, siginfo_t* info, void* context) {
-  SAMPLER_START(PROFILE_DEFAULT_ENTRY, PROFILE_DEFAULT_INTERVAL,
-                PROFILE_DEFAULT_FEATURES, PROFILE_DEFAULT_FEATURE_COUNT);
+  mozilla_sampler_start(PROFILE_DEFAULT_ENTRY, PROFILE_DEFAULT_INTERVAL,
+                        PROFILE_DEFAULT_FEATURES, PROFILE_DEFAULT_FEATURE_COUNT);
 }
 
 void OS::RegisterStartHandler()
diff --git a/tools/profiler/platform-macos.cc b/tools/profiler/platform-macos.cc
index 99392cc7ed61..0d3b34239524 100644
--- a/tools/profiler/platform-macos.cc
+++ b/tools/profiler/platform-macos.cc
@@ -28,8 +28,8 @@
 #include <string.h>
 #include <errno.h>
 
+
 #include "platform.h"
-#include "UnwinderThread2.h"  /* uwt__register_thread_for_profiling */
 
 // this port is based off of v8 svn revision 9837
 
@@ -129,16 +129,6 @@ static void* ThreadEntry(void* arg) {
   // This is also initialized by the first argument to pthread_create() but we
   // don't know which thread will run first (the original thread or the new
   // one) so we initialize it here too.
-
-  // BEGIN temp hack for SPS v1-vs-v2
-  extern bool sps_version2();
-  if (sps_version2()) {
-    // Register this thread for profiling.
-    int aLocal;
-    uwt__register_thread_for_profiling( &aLocal );
-  }
-  // END temp hack for SPS v1-vs-v2
-
   thread->data()->thread_ = pthread_self();
   SetThreadName(thread->name());
   ASSERT(thread->data()->thread_ != kNoThread);
diff --git a/tools/profiler/platform.h b/tools/profiler/platform.h
index 021ddc32ebad..c67d3540d728 100644
--- a/tools/profiler/platform.h
+++ b/tools/profiler/platform.h
@@ -26,9 +26,6 @@
 // OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 // SUCH DAMAGE.
 
-#ifndef TOOLS_PLATFORM_H_
-#define TOOLS_PLATFORM_H_
-
 #ifdef ANDROID
 #include <android/log.h>
 #else
@@ -47,11 +44,11 @@
 #define ENABLE_SPS_LEAF_DATA
 #define ENABLE_ARM_LR_SAVING
 #endif
-#define LOG(text) __android_log_write(ANDROID_LOG_ERROR, "Profiler", text)
-#define LOGF(format, ...) __android_log_print(ANDROID_LOG_ERROR, "Profiler", format, __VA_ARGS__)
+#define LOG(text) __android_log_write(ANDROID_LOG_ERROR, "profiler", text)
+#define LOGF(format, ...) __android_log_print(ANDROID_LOG_ERROR, "profiler", format, __VA_ARGS__)
 #else
-#define LOG(text) fprintf(stderr, "Profiler: %s\n", text)
-#define LOGF(format, ...) fprintf(stderr, "Profiler: " format "\n", __VA_ARGS__)
+#define LOG(text) printf("Profiler: %s\n", text)
+#define LOGF(format, ...) printf("Profiler: " format "\n", __VA_ARGS__)
 #endif
 
 #if defined(XP_MACOSX) || defined(XP_WIN)
@@ -279,4 +276,3 @@ class Sampler {
   PlatformData* data_;  // Platform specific data.
 };
 
-#endif /* ndef TOOLS_PLATFORM_H_ */
diff --git a/tools/profiler/shim_mac_dump_syms.h b/tools/profiler/shim_mac_dump_syms.h
deleted file mode 100644
index 5820daf1c972..000000000000
--- a/tools/profiler/shim_mac_dump_syms.h
+++ /dev/null
@@ -1,8 +0,0 @@
-
-// Read debug info from |obj_file| and park it in a Module, returned
-// via |module|.  Caller owns the Module and is responsible for
-// deallocating it.  Note that |debug_dirs| is ignored.
-bool ReadSymbolData(const string& obj_file,
-                    const std::vector<string> &debug_dirs,
-                    SymbolData symbol_data,
-                    google_breakpad::Module** module);
diff --git a/tools/profiler/shim_mac_dump_syms.mm b/tools/profiler/shim_mac_dump_syms.mm
deleted file mode 100644
index 4eab6b9debf8..000000000000
--- a/tools/profiler/shim_mac_dump_syms.mm
+++ /dev/null
@@ -1,20 +0,0 @@
-// -*- mode: c++ -*-
-
-#include "common/mac/dump_syms.h"
-#include "shim_mac_dump_syms.h"
-
-bool ReadSymbolData(const string& obj_file,
-                    const std::vector<string> &debug_dirs,
-                    SymbolData symbol_data,
-                    google_breakpad::Module** module)
-{
-  google_breakpad::DumpSymbols ds(symbol_data);
-
-  NSString* obj_file_ns = [NSString stringWithUTF8String:obj_file.c_str()];
-  // TODO: remember to [obj_file_ns release] this at the exit points
-
-  if (!ds.Read(obj_file_ns))
-    return false;
-
-  return ds.ReadSymbolData(module);
-}
diff --git a/tools/profiler/sps_sampler.h b/tools/profiler/sps_sampler.h
index 9acaa1d25151..007b7391fa67 100644
--- a/tools/profiler/sps_sampler.h
+++ b/tools/profiler/sps_sampler.h
@@ -3,9 +3,6 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef TOOLS_SPS_SAMPLER_H_
-#define TOOLS_SPS_SAMPLER_H_
-
 #include <stdlib.h>
 #include <signal.h>
 #include <stdarg.h>
@@ -29,11 +26,12 @@
 using mozilla::TimeStamp;
 using mozilla::TimeDuration;
 
-struct PseudoStack;
+struct ProfileStack;
 class TableTicker;
 class JSCustomObject;
 
-extern mozilla::ThreadLocal<PseudoStack *> tlsPseudoStack;
+extern mozilla::ThreadLocal<ProfileStack *> tlsStack;
+extern mozilla::ThreadLocal<TableTicker *> tlsTicker;
 extern bool stack_key_initialized;
 
 #ifndef SAMPLE_FUNCTION_NAME
@@ -46,73 +44,18 @@ extern bool stack_key_initialized;
 # endif
 #endif
 
-/* Returns true if env var SPS_NEW is set to anything, else false. */
-extern bool sps_version2();
-
-#define SAMPLER_INIT() \
-  do { \
-    if (!sps_version2()) mozilla_sampler_init1(); \
-                    else mozilla_sampler_init2(); \
-  } while (0)
-
-#define SAMPLER_SHUTDOWN() \
-  do { \
-    if (!sps_version2()) mozilla_sampler_shutdown1(); \
-                    else mozilla_sampler_shutdown2(); \
-  } while (0)
-
-#define SAMPLER_START(entries, interval, features, featureCount) \
-  do { \
-    if (!sps_version2()) \
-      mozilla_sampler_start1(entries, interval, features, featureCount); \
-    else \
-      mozilla_sampler_start2(entries, interval, features, featureCount); \
-  } while (0)
-
-#define SAMPLER_STOP() \
-  do { \
-    if (!sps_version2()) mozilla_sampler_stop1(); \
-                    else mozilla_sampler_stop2(); \
-  } while (0)
-
-#define SAMPLER_IS_ACTIVE() \
-    (!sps_version2() ? mozilla_sampler_is_active1() \
-                     : mozilla_sampler_is_active2() )
-
-#define SAMPLER_RESPONSIVENESS(time) \
-  do { \
-    if (!sps_version2()) mozilla_sampler_responsiveness1(time); \
-                    else mozilla_sampler_responsiveness2(time); \
-  } while (0)
-
-#define SAMPLER_GET_RESPONSIVENESS() \
-    (!sps_version2() ? mozilla_sampler_get_responsiveness1() \
-                     : mozilla_sampler_get_responsiveness2() )
-
-#define SAMPLER_FRAME_NUMBER(frameNumber) \
-  do { \
-    if (!sps_version2()) mozilla_sampler_frame_number1(frameNumber); \
-                    else mozilla_sampler_frame_number2(frameNumber); \
-  } while (0)
-
-#define SAMPLER_SAVE() \
-  do { \
-    if (!sps_version2()) mozilla_sampler_save1(); \
-                    else mozilla_sampler_save2(); \
-  } while (0)
-
-#define SAMPLER_GET_PROFILE() \
-   (!sps_version2() ? mozilla_sampler_get_profile1() \
-                    : mozilla_sampler_get_profile2() )
-
-#define SAMPLER_GET_PROFILE_DATA(ctx) \
-   (!sps_version2() ? mozilla_sampler_get_profile_data1(ctx) \
-                    : mozilla_sampler_get_profile_data2(ctx) )
-
-#define SAMPLER_GET_FEATURES() \
-   (!sps_version2() ? mozilla_sampler_get_features1() \
-                    : mozilla_sampler_get_features2() )
-
+#define SAMPLER_INIT() mozilla_sampler_init()
+#define SAMPLER_SHUTDOWN() mozilla_sampler_shutdown()
+#define SAMPLER_START(entries, interval, features, featureCount) mozilla_sampler_start(entries, interval, features, featureCount)
+#define SAMPLER_STOP() mozilla_sampler_stop()
+#define SAMPLER_IS_ACTIVE() mozilla_sampler_is_active()
+#define SAMPLER_RESPONSIVENESS(time) mozilla_sampler_responsiveness(time)
+#define SAMPLER_GET_RESPONSIVENESS() mozilla_sampler_get_responsiveness()
+#define SAMPLER_FRAME_NUMBER(frameNumber) mozilla_sampler_frame_number(frameNumber)
+#define SAMPLER_SAVE() mozilla_sampler_save()
+#define SAMPLER_GET_PROFILE() mozilla_sampler_get_profile()
+#define SAMPLER_GET_PROFILE_DATA(ctx) mozilla_sampler_get_profile_data(ctx)
+#define SAMPLER_GET_FEATURES() mozilla_sampler_get_features()
 // we want the class and function name but can't easily get that using preprocessor macros
 // __func__ doesn't have the class name and __PRETTY_FUNCTION__ has the parameters
 
@@ -127,23 +70,7 @@ extern bool sps_version2();
 #define SAMPLE_MAIN_THREAD_LABEL_PRINTF(name_space, info, ...)  MOZ_ASSERT(NS_IsMainThread(), "This can only be called on the main thread"); mozilla::SamplerStackFramePrintfRAII SAMPLER_APPEND_LINE_NUMBER(sampler_raii)(name_space "::" info, __LINE__, __VA_ARGS__)
 #define SAMPLE_MAIN_THREAD_MARKER(info)  MOZ_ASSERT(NS_IsMainThread(), "This can only be called on the main thread"); mozilla_sampler_add_marker(info)
 
-#define SAMPLER_PRINT_LOCATION() \
-    do { \
-      if (!sps_version2()) mozilla_sampler_print_location1(); \
-                      else mozilla_sampler_print_location2(); \
-    } while (0)
-
-#define SAMPLER_LOCK() \
-    do { \
-      if (!sps_version2()) mozilla_sampler_lock1(); \
-                      else mozilla_sampler_lock2(); \
-    } while (0)
-
-#define SAMPLER_UNLOCK() \
-    do { \
-      if (!sps_version2()) mozilla_sampler_unlock1(); \
-                      else mozilla_sampler_unlock2(); \
-    } while (0)
+#define SAMPLER_PRINT_LOCATION() mozilla_sampler_print_location()
 
 /* we duplicate this code here to avoid header dependencies
  * which make it more difficult to include in other places */
@@ -238,63 +165,31 @@ LinuxKernelMemoryBarrierFunc pLinuxKernelMemoryBarrier __attribute__((weak)) =
 # error "Memory clobber not supported for your platform."
 #endif
 
-// Returns a handle to pass on exit. This can check that we are popping the
+// Returns a handdle to pass on exit. This can check that we are popping the
 // correct callstack.
-inline void* mozilla_sampler_call_enter(const char *aInfo, void *aFrameAddress = NULL,
-                                        bool aCopy = false, uint32_t line = 0);
+inline void* mozilla_sampler_call_enter(const char *aInfo, void *aFrameAddress = NULL, bool aCopy = false, uint32_t line = 0);
 inline void  mozilla_sampler_call_exit(void* handle);
 inline void  mozilla_sampler_add_marker(const char *aInfo);
 
-void mozilla_sampler_start1(int aEntries, int aInterval, const char** aFeatures,
-                            uint32_t aFeatureCount);
-void mozilla_sampler_start2(int aEntries, int aInterval, const char** aFeatures,
-                            uint32_t aFeatureCount);
-
-void mozilla_sampler_stop1();
-void mozilla_sampler_stop2();
-
-bool mozilla_sampler_is_active1();
-bool mozilla_sampler_is_active2();
-
-void mozilla_sampler_responsiveness1(TimeStamp time);
-void mozilla_sampler_responsiveness2(TimeStamp time);
-
-void mozilla_sampler_frame_number1(int frameNumber);
-void mozilla_sampler_frame_number2(int frameNumber);
-
-const double* mozilla_sampler_get_responsiveness1();
-const double* mozilla_sampler_get_responsiveness2();
-
-void mozilla_sampler_save1();
-void mozilla_sampler_save2();
-
-char* mozilla_sampler_get_profile1();
-char* mozilla_sampler_get_profile2();
-
-JSObject *mozilla_sampler_get_profile_data1(JSContext *aCx);
-JSObject *mozilla_sampler_get_profile_data2(JSContext *aCx);
-
-const char** mozilla_sampler_get_features1();
-const char** mozilla_sampler_get_features2();
-
-void mozilla_sampler_init1();
-void mozilla_sampler_init2();
-
-void mozilla_sampler_shutdown1();
-void mozilla_sampler_shutdown2();
-
-void mozilla_sampler_print_location1();
-void mozilla_sampler_print_location2();
-
+void mozilla_sampler_start(int aEntries, int aInterval, const char** aFeatures, uint32_t aFeatureCount);
+void mozilla_sampler_stop();
+bool mozilla_sampler_is_active();
+void mozilla_sampler_responsiveness(TimeStamp time);
+void mozilla_sampler_frame_number(int frameNumber);
+const double* mozilla_sampler_get_responsiveness();
+void mozilla_sampler_save();
+char* mozilla_sampler_get_profile();
+JSObject *mozilla_sampler_get_profile_data(JSContext *aCx);
+const char** mozilla_sampler_get_features();
+void mozilla_sampler_init();
+void mozilla_sampler_shutdown();
+void mozilla_sampler_print_location();
 // Lock the profiler. When locked the profiler is (1) stopped,
 // (2) profile data is cleared, (3) profiler-locked is fired.
 // This is used to lock down the profiler during private browsing
-void mozilla_sampler_lock1();
-void mozilla_sampler_lock2();
-
+void mozilla_sampler_lock();
 // Unlock the profiler, leaving it stopped and fires profiler-unlocked.
-void mozilla_sampler_unlock1();
-void mozilla_sampler_unlock2();
+void mozilla_sampler_unlock();
 
 namespace mozilla {
 
@@ -316,7 +211,7 @@ class NS_STACK_CLASS SamplerStackFramePrintfRAII {
 public:
   // we only copy the strings at save time, so to take multiple parameters we'd need to copy them then.
   SamplerStackFramePrintfRAII(const char *aDefault, uint32_t line, const char *aFormat, ...) {
-    if (SAMPLER_IS_ACTIVE()) {
+    if (mozilla_sampler_is_active()) {
       va_list args;
       va_start(args, aFormat);
       char buff[SAMPLER_MAX_STRING];
@@ -378,14 +273,13 @@ public:
   }
 };
 
-// the PseudoStack members are read by signal
+// the SamplerStack members are read by signal
 // handlers, so the mutation of them needs to be signal-safe.
-struct PseudoStack
+struct ProfileStack
 {
 public:
-  PseudoStack()
+  ProfileStack()
     : mStackPointer(0)
-    , mSignalLock(false)
     , mMarkerPointer(0)
     , mQueueClearMarker(false)
     , mRuntime(NULL)
@@ -526,11 +420,11 @@ public:
   bool mStartJSSampling;
 };
 
-inline PseudoStack* mozilla_get_pseudo_stack(void)
+inline ProfileStack* mozilla_profile_stack(void)
 {
   if (!stack_key_initialized)
     return NULL;
-  return tlsPseudoStack.get();
+  return tlsStack.get();
 }
 
 inline void* mozilla_sampler_call_enter(const char *aInfo, void *aFrameAddress,
@@ -541,7 +435,7 @@ inline void* mozilla_sampler_call_enter(const char *aInfo, void *aFrameAddress,
   if (!stack_key_initialized)
     return NULL;
 
-  PseudoStack *stack = tlsPseudoStack.get();
+  ProfileStack *stack = tlsStack.get();
   // we can't infer whether 'stack' has been initialized
   // based on the value of stack_key_intiailized because
   // 'stack' is only intialized when a thread is being
@@ -564,7 +458,7 @@ inline void mozilla_sampler_call_exit(void *aHandle)
   if (!aHandle)
     return;
 
-  PseudoStack *stack = (PseudoStack*)aHandle;
+  ProfileStack *stack = (ProfileStack*)aHandle;
   stack->pop();
 }
 
@@ -575,15 +469,14 @@ inline void mozilla_sampler_add_marker(const char *aMarker)
 
   // Don't insert a marker if we're not profiling to avoid
   // the heap copy (malloc).
-  if (!SAMPLER_IS_ACTIVE()) {
+  if (!mozilla_sampler_is_active()) {
     return;
   }
 
-  PseudoStack *stack = tlsPseudoStack.get();
+  ProfileStack *stack = tlsStack.get();
   if (!stack) {
     return;
   }
   stack->addMarker(aMarker);
 }
 
-#endif /* ndef TOOLS_SPS_SAMPLER_H_ */
diff --git a/widget/android/nsWindow.cpp b/widget/android/nsWindow.cpp
index a06f10250b32..7e9968a10772 100644
--- a/widget/android/nsWindow.cpp
+++ b/widget/android/nsWindow.cpp
@@ -1284,7 +1284,12 @@ nsWindow::DispatchMultitouchEvent(nsTouchEvent &event, AndroidGeckoEvent *ae)
 
     nsEventStatus status;
     DispatchEvent(&event, status);
-    return (status == nsEventStatus_eConsumeNoDefault);
+    // We check mMultipleActionsPrevented because that's what <input type=range>
+    // sets when someone starts dragging the thumb. It doesn't set the status
+    // because it doesn't want to prevent the code that gives the input focus
+    // from running.
+    return (status == nsEventStatus_eConsumeNoDefault ||
+            event.mFlags.mMultipleActionsPrevented);
 }
 
 void
diff --git a/widget/nsGUIEvent.h b/widget/nsGUIEvent.h
index efcea3a9f28b..3280f9d786b4 100644
--- a/widget/nsGUIEvent.h
+++ b/widget/nsGUIEvent.h
@@ -90,7 +90,6 @@ enum nsEventStructType {
   NS_CLIPBOARD_EVENT,                // nsClipboardEvent
 
   // SVG events
-  NS_SVG_EVENT,                      // nsEvent or nsGUIEvent
   NS_SVGZOOM_EVENT,                  // nsGUIEvent
   NS_SMIL_TIME_EVENT,                // nsUIEvent
 
diff --git a/widget/windows/winrt/MetroContracts.cpp b/widget/windows/winrt/MetroContracts.cpp
index 0a916f2ccd35..9c99af676fa7 100644
--- a/widget/windows/winrt/MetroContracts.cpp
+++ b/widget/windows/winrt/MetroContracts.cpp
@@ -18,6 +18,7 @@
 #include <printpreview.h>
 #include <D3D10.h>
 #include "MetroUIUtils.h"
+#include "nsIStringBundle.h"
 
 using namespace mozilla;
 using namespace ABI::Windows::Foundation;
@@ -316,7 +317,7 @@ FrameworkView::OnDataShareRequested(IDataTransferManager* aDTM,
     return E_FAIL;
   }
 
-  // Get the package to share and initialize it
+  // Get the package to share
   HRESULT hr;
   ComPtr<IDataRequest> request;
   AssertRetHRESULT(hr = aArg->get_Request(request.GetAddressOf()), hr);
@@ -324,9 +325,6 @@ FrameworkView::OnDataShareRequested(IDataTransferManager* aDTM,
   AssertRetHRESULT(hr = request->get_Data(dataPackage.GetAddressOf()), hr);
   ComPtr<IDataPackagePropertySet> props;
   AssertRetHRESULT(hr = dataPackage->get_Properties(props.GetAddressOf()), hr);
-  props->put_ApplicationName(HStringReference(L"Firefox").Get());
-  props->put_Title(HStringReference(title.BeginReading()).Get());
-  props->put_Description(HStringReference(url.BeginReading()).Get());
 
   // Only add a URI to the package when there is no selected content.
   // This is because most programs treat URIs as highest priority to generate
@@ -336,18 +334,30 @@ FrameworkView::OnDataShareRequested(IDataTransferManager* aDTM,
   if (!hasSelectedContent) {
     ComPtr<IUriRuntimeClass> uri;
     AssertRetHRESULT(hr = MetroUtils::CreateUri(HStringReference(url.BeginReading()).Get(), uri), hr);
+
+    // If there is no selection, then we don't support sharing for sites that
+    // are not HTTP, HTTPS, FTP, and FILE.
+    HString schemeHString;
+    uri->get_SchemeName(schemeHString.GetAddressOf());
+    unsigned int length;
+    LPCWSTR scheme = schemeHString.GetRawBuffer(&length);
+    if (!scheme || wcscmp(scheme, L"http") && wcscmp(scheme, L"https") &&
+        wcscmp(scheme, L"ftp") && wcscmp(scheme, L"file")) {
+      return S_OK;
+    }
+
     AssertRetHRESULT(hr = dataPackage->SetUri(uri.Get()), hr);
   }
 
   // Add whatever content metroUIUtils wants us to for the text sharing
   nsString shareText;
-  if (NS_SUCCEEDED(metroUIUtils->GetShareText(shareText))) {
+  if (NS_SUCCEEDED(metroUIUtils->GetShareText(shareText)) && shareText.Length()) {
     AssertRetHRESULT(hr = dataPackage->SetText(HStringReference(shareText.BeginReading()).Get()) ,hr);
   }
 
   // Add whatever content metroUIUtils wants us to for the HTML sharing
   nsString shareHTML;
-  if (NS_SUCCEEDED(metroUIUtils->GetShareHTML(shareHTML))) {
+  if (NS_SUCCEEDED(metroUIUtils->GetShareHTML(shareHTML)) && shareHTML.Length()) {
     // The sharing format needs some special headers, so pass it through Windows
     ComPtr<IHtmlFormatHelperStatics> htmlFormatHelper;
     hr = GetActivationFactory(HStringReference(RuntimeClass_Windows_ApplicationModel_DataTransfer_HtmlFormatHelper).Get(),
@@ -360,6 +370,31 @@ FrameworkView::OnDataShareRequested(IDataTransferManager* aDTM,
     AssertRetHRESULT(hr = dataPackage->SetHtmlFormat(fixedHTML), hr);
   }
 
+  // Obtain the brand name
+  nsCOMPtr<nsIStringBundleService> bundleService = 
+    do_GetService(NS_STRINGBUNDLE_CONTRACTID);
+  NS_ENSURE_TRUE(bundleService, E_FAIL);
+  nsCOMPtr<nsIStringBundle> brandBundle;
+  nsString brandName;
+  bundleService->CreateBundle("chrome://branding/locale/brand.properties",
+    getter_AddRefs(brandBundle));
+  NS_ENSURE_TRUE(brandBundle, E_FAIL);
+  if(brandBundle) {
+    brandBundle->GetStringFromName(NS_LITERAL_STRING("brandFullName").get(),
+                                   getter_Copies(brandName));
+  }
+
+  // Set these properties at the end.  Otherwise users can get a
+  // "There was a problem with the data package" error when there
+  // is simply nothing to share.
+  props->put_ApplicationName(HStringReference(brandName.BeginReading()).Get());
+  if (title.Length()) {
+    props->put_Title(HStringReference(title.BeginReading()).Get());
+  } else {
+    props->put_Title(HStringReference(brandName.BeginReading()).Get());
+  }
+  props->put_Description(HStringReference(url.BeginReading()).Get());
+
   return S_OK;
 }
 
diff --git a/widget/windows/winrt/MetroUIUtils.js b/widget/windows/winrt/MetroUIUtils.js
index 7145c6a37477..372e4bc14b18 100644
--- a/widget/windows/winrt/MetroUIUtils.js
+++ b/widget/windows/winrt/MetroUIUtils.js
@@ -97,11 +97,9 @@ MetroUIUtils.prototype = {
     let browserWin = Services.wm.getMostRecentWindow("navigator:browser");
     let tabBrowser = browserWin.getBrowser();
     if (browserWin && tabBrowser && tabBrowser.contentWindow) {
-      return tabBrowser.contentWindow.getSelection() || "";
-    }
-    else if (browserWin && browserWin.content && browserWin.document) {
-      return browserWin.content.document.URL ||
-             browserWin.content.document.title || "";
+      let sel = tabBrowser.contentWindow.getSelection();
+      if (sel && sel.rangeCount)
+        return sel;
     }
 
     throw Cr.NS_ERROR_FAILURE;
@@ -168,10 +166,6 @@ MetroUIUtils.prototype = {
       this._expandURLs(tabBrowser.contentWindow.document, div);
       return div.outerHTML;
     }
-    else if (browserWin && browserWin.content && browserWin.document) {
-      return browserWin.content.document.URL ||
-             browserWin.content.document.title || "";
-    }
 
     throw Cr.NS_ERROR_FAILURE;
   }