Merge mozilla-central to tracemonkey.

2009-07-23 16:49:14 -04:00 · 2009-07-23 16:49:14 -04:00 · e34c6309ce
--- a/.hgignore
+++ b/.hgignore
@ -5,7 +5,6 @@
 \.pyc$
 (^|/)TAGS$
 (^|/)\.DS_Store$
-\.class$

 # User files that may appear at the root
 ^\.mozconfig
@ -28,3 +27,6 @@ _OPT\.OBJ/
 # SpiderMonkey configury
 ^js/src/configure$
 ^js/src/autom4te.cache$
+
+# Java HTML5 parser classes
+^parser/html/java/.*\.class$
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@ -2495,16 +2495,18 @@ nsAccessible::GetRelationByType(PRUint32 aRelationType,
        return nsRelUtils::AddTarget(aRelationType, aRelation, accTarget);
      }

-      // If accessible is in its own Window then we should provide NODE_CHILD_OF relation
-      // so that MSAA clients can easily get to true parent instead of getting to oleacc's
-      // ROLE_WINDOW accessible which will prevent us from going up further (because it is
-      // system generated and has no idea about the hierarchy above it).
+      // If accessible is in its own Window, or is the root of a document,
+      // then we should provide NODE_CHILD_OF relation so that MSAA clients
+      // can easily get to true parent instead of getting to oleacc's
+      // ROLE_WINDOW accessible which will prevent us from going up further
+      // (because it is system generated and has no idea about the hierarchy
+      // above it).
      nsIFrame *frame = GetFrame();
      if (frame) {
        nsIView *view = frame->GetViewExternal();
        if (view) {
          nsIScrollableFrame *scrollFrame = do_QueryFrame(frame);
-          if (scrollFrame || view->GetWidget()) {
+          if (scrollFrame || view->GetWidget() || !frame->GetParent()) {
            nsCOMPtr<nsIAccessible> accTarget;
            GetParent(getter_AddRefs(accTarget));
            return nsRelUtils::AddTarget(aRelationType, aRelation, accTarget);
--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@ -106,7 +106,7 @@ nsDocAccessible::nsDocAccessible(nsIDOMNode *aDOMNode, nsIWeakReference* aShell)
    nsIViewManager* vm = shell->GetViewManager();
    if (vm) {
      nsCOMPtr<nsIWidget> widget;
-      vm->GetWidget(getter_AddRefs(widget));
+      vm->GetRootWidget(getter_AddRefs(widget));
      if (widget) {
        mWnd = widget->GetNativeData(NS_NATIVE_WINDOW);
      }
@ -617,7 +617,17 @@ nsDocAccessible::Init()
  nsCOMPtr<nsIAccessible> parentAccessible;  // Ensure outer doc mParent accessible
  GetParent(getter_AddRefs(parentAccessible));

-  return nsHyperTextAccessibleWrap::Init();
+  nsresult rv = nsHyperTextAccessibleWrap::Init();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Fire reorder event to notify new accessible document has been created and
+  // attached to the tree.
+  nsCOMPtr<nsIAccessibleEvent> reorderEvent =
+    new nsAccReorderEvent(mParent, PR_FALSE, PR_TRUE, mDOMNode);
+  NS_ENSURE_TRUE(reorderEvent, NS_ERROR_OUT_OF_MEMORY);
+
+  FireDelayedAccessibleEvent(reorderEvent);
+  return NS_OK;
 }

 nsresult
--- a/accessible/src/base/nsDocAccessible.h
+++ b/accessible/src/base/nsDocAccessible.h
@ -93,7 +93,8 @@ public:
  // nsIScrollPositionListener
  NS_IMETHOD ScrollPositionWillChange(nsIScrollableView *aView,
                                      nscoord aX, nscoord aY);
-  virtual void ViewPositionDidChange(nsIScrollableView* aScrollable) {}
+  virtual void ViewPositionDidChange(nsIScrollableView* aScrollable,
+                                     nsTArray<nsIWidget::Configuration>* aConfigurations) {}
  NS_IMETHOD ScrollPositionDidChange(nsIScrollableView *aView,
                                     nscoord aX, nscoord aY);

--- a/accessible/src/html/nsHTMLImageAccessible.cpp
+++ b/accessible/src/html/nsHTMLImageAccessible.cpp
@ -115,9 +115,9 @@ nsHTMLImageAccessible::GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState)
    imageRequest->GetImage(getter_AddRefs(imgContainer));

  if (imgContainer) {
-    PRUint32 numFrames;
-    imgContainer->GetNumFrames(&numFrames);
-    if (numFrames > 1)
+    PRBool animated;
+    imgContainer->GetAnimated(&animated);
+    if (animated)
      *aState |= nsIAccessibleStates::STATE_ANIMATED;
  }

--- a/accessible/src/msaa/nsAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsAccessibleWrap.cpp
@ -519,15 +519,21 @@ __try {
    nsAutoString roleString;
    if (msaaRole != ROLE_SYSTEM_CLIENT &&
        !content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::role, roleString)) {
+      nsIDocument * document = content->GetCurrentDoc();
+      if (!document)
+        return E_FAIL;
+
      nsINodeInfo *nodeInfo = content->NodeInfo();
      nodeInfo->GetName(roleString);
-      nsAutoString nameSpaceURI;
-      nodeInfo->GetNamespaceURI(nameSpaceURI);
-      if (!nameSpaceURI.IsEmpty()) {
-        // Only append name space if different from that of current document
+
+      // Only append name space if different from that of current document.
+      if (!nodeInfo->NamespaceEquals(document->GetDefaultNamespaceID())) {
+        nsAutoString nameSpaceURI;
+        nodeInfo->GetNamespaceURI(nameSpaceURI);
        roleString += NS_LITERAL_STRING(", ") + nameSpaceURI;
      }
    }
+
    if (!roleString.IsEmpty()) {
      pvarRole->vt = VT_BSTR;
      pvarRole->bstrVal = ::SysAllocString(roleString.get());
--- a/accessible/src/msaa/nsDocAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsDocAccessibleWrap.cpp
@ -93,66 +93,47 @@ STDMETHODIMP nsDocAccessibleWrap::QueryInterface(REFIID iid, void** ppv)
  return S_OK;
 }

-void nsDocAccessibleWrap::GetXPAccessibleFor(const VARIANT& aVarChild, nsIAccessible **aXPAccessible)
+void
+nsDocAccessibleWrap::GetXPAccessibleFor(const VARIANT& aVarChild,
+                                        nsIAccessible **aXPAccessible)
 {
  *aXPAccessible = nsnull;
-  if (!mWeakShell)
-    return; // This document has been shut down

-  if (aVarChild.lVal < 0) {
-    // Get from hash table
-    void *uniqueID = (void*)(-aVarChild.lVal);  // Convert child ID back to unique ID
-    nsCOMPtr<nsIAccessNode> accessNode;
-    GetCachedAccessNode(uniqueID, getter_AddRefs(accessNode));
-    nsCOMPtr<nsIAccessible> accessible(do_QueryInterface(accessNode));
-    NS_IF_ADDREF(*aXPAccessible = accessible);
+  if (IsDefunct())
    return;
-  }

-  nsDocAccessible::GetXPAccessibleFor(aVarChild, aXPAccessible);
+  // If lVal negative then it is treated as child ID and we should look for
+  // accessible through whole accessible subtree including subdocuments.
+  // Otherwise we treat lVal as index in parent.
+
+  if (aVarChild.lVal < 0)
+    GetXPAccessibleForChildID(aVarChild, aXPAccessible);
+  else
+    nsDocAccessible::GetXPAccessibleFor(aVarChild, aXPAccessible);
 }

-STDMETHODIMP nsDocAccessibleWrap::get_accChild( 
-      /* [in] */ VARIANT varChild,
-      /* [retval][out] */ IDispatch __RPC_FAR *__RPC_FAR *ppdispChild)
+STDMETHODIMP
+nsDocAccessibleWrap::get_accChild(VARIANT varChild,
+                                  IDispatch __RPC_FAR *__RPC_FAR *ppdispChild)
 {
 __try {
  *ppdispChild = NULL;

  if (varChild.vt == VT_I4 && varChild.lVal < 0) {
-    // AccessibleObjectFromEvent() being called
-    // that's why the lVal < 0
+    // IAccessible::accChild can be used to get an accessible by child ID.
+    // It is used by AccessibleObjectFromEvent() called by AT when AT handles
+    // our MSAA event.
+
    nsCOMPtr<nsIAccessible> xpAccessible;
-    GetXPAccessibleFor(varChild, getter_AddRefs(xpAccessible));
-    if (xpAccessible) {
-      IAccessible *msaaAccessible;
-      xpAccessible->GetNativeInterface((void**)&msaaAccessible);
-      *ppdispChild = static_cast<IDispatch*>(msaaAccessible);
-      return S_OK;
-    }
-    else if (mDocument) {
-      // If child ID from event can't be found in this window, ask parent.
-      // This is especially relevant for times when a xul menu item
-      // has focus, but the system thinks the content window has focus.
-      nsIDocument* parentDoc = mDocument->GetParentDocument();
-      if (parentDoc) {
-        nsIPresShell *parentShell = parentDoc->GetPrimaryShell();
-        nsCOMPtr<nsIWeakReference> weakParentShell(do_GetWeakReference(parentShell));
-        if (weakParentShell) {
-          nsCOMPtr<nsIAccessibleDocument> parentDocAccessible = 
-            nsAccessNode::GetDocAccessibleFor(weakParentShell);
-          nsCOMPtr<nsIAccessible> accessible(do_QueryInterface(parentDocAccessible));
-          IAccessible *msaaParentDoc;
-          if (accessible) {
-            accessible->GetNativeInterface((void**)&msaaParentDoc);
-            HRESULT rv = msaaParentDoc->get_accChild(varChild, ppdispChild);
-            msaaParentDoc->Release();
-            return rv;
-          }
-        }
-      }
-    }
-    return E_FAIL;
+    GetXPAccessibleForChildID(varChild, getter_AddRefs(xpAccessible));
+    if (!xpAccessible)
+      return E_FAIL;
+
+    IAccessible *msaaAccessible = NULL;
+    xpAccessible->GetNativeInterface((void**)&msaaAccessible);
+    *ppdispChild = static_cast<IDispatch*>(msaaAccessible);
+
+    return S_OK;
  }

  // Otherwise, the normal get_accChild() will do
@ -329,3 +310,53 @@ STDMETHODIMP nsDocAccessibleWrap::get_accValue(

  return get_URL(pszValue);
 }
+
+struct nsSearchAccessibleInCacheArg
+{
+  nsCOMPtr<nsIAccessNode> mAccessNode;
+  void *mUniqueID;
+};
+
+static PLDHashOperator
+SearchAccessibleInCache(const void* aKey, nsIAccessNode* aAccessNode,
+                        void* aUserArg)
+{
+  nsCOMPtr<nsIAccessibleDocument> docAccessible(do_QueryInterface(aAccessNode));
+  NS_ASSERTION(docAccessible,
+               "No doc accessible for the object in doc accessible cache!");
+
+  if (docAccessible) {
+    nsSearchAccessibleInCacheArg* arg =
+      static_cast<nsSearchAccessibleInCacheArg*>(aUserArg);
+    nsCOMPtr<nsIAccessNode> accessNode;
+    docAccessible->GetCachedAccessNode(arg->mUniqueID,
+                                       getter_AddRefs(accessNode));
+    if (accessNode) {
+      arg->mAccessNode = accessNode;
+      return PL_DHASH_STOP;
+    }
+  }
+
+  return PL_DHASH_NEXT;
+}
+
+void
+nsDocAccessibleWrap::GetXPAccessibleForChildID(const VARIANT& aVarChild,
+                                               nsIAccessible  **aAccessible)
+{
+  *aAccessible = nsnull;
+
+  NS_PRECONDITION(aVarChild.vt == VT_I4 && aVarChild.lVal < 0,
+                  "Variant doesn't point to child ID!");
+
+  // Convert child ID to unique ID.
+  void *uniqueID = reinterpret_cast<void*>(-aVarChild.lVal);
+
+  nsSearchAccessibleInCacheArg arg;
+  arg.mUniqueID = uniqueID;
+
+  gGlobalDocAccessibleCache.EnumerateRead(SearchAccessibleInCache,
+                                          static_cast<void*>(&arg));
+  if (arg.mAccessNode)
+    CallQueryInterface(arg.mAccessNode, aAccessible);
+}
--- a/accessible/src/msaa/nsDocAccessibleWrap.h
+++ b/accessible/src/msaa/nsDocAccessibleWrap.h
@ -93,6 +93,17 @@ public:
        /* [retval][out] */ BSTR __RPC_FAR *pszValue);

    virtual void FireAnchorJumpEvent();
+
+  // nsDocAccessibleWrap
+
+  /**
+   * Find an accessible by the given child ID in cached documents.
+   *
+   * @param  aVarChild    [in] variant pointing to the child ID
+   * @param  aAccessible  [out] the found accessible
+   */
+  static void GetXPAccessibleForChildID(const VARIANT& aVarChild,
+                                        nsIAccessible **aAccessible);
 };

 #endif
--- a/accessible/tests/mochitest/Makefile.in
+++ b/accessible/tests/mochitest/Makefile.in
@ -88,6 +88,7 @@ _TEST_FILES =\
 		test_elm_table.html \
 		test_elm_txtcntnr.html \
 		test_events_caretmove.html \
+		test_events_doc.html \
 		test_events_focus.xul \
 		test_events_mutation.html \
 		test_events_tree.xul \
--- a/accessible/tests/mochitest/common.js
+++ b/accessible/tests/mochitest/common.js
@ -397,6 +397,9 @@ function getNodePrettyName(aNode)
    if (aNode.nodeType == nsIDOMNode.ELEMENT_NODE && aNode.hasAttribute("id"))
      return " '" + aNode.getAttribute("id") + "' ";

+    if (aNode.nodeType == nsIDOMNode.DOCUMENT_NODE)
+      return " 'document node' ";
+
    return " '" + aNode.localName + " node' ";
  } catch (e) {
    return "no node info";
--- a/accessible/tests/mochitest/test_events_doc.html
+++ b/accessible/tests/mochitest/test_events_doc.html
@ -0,0 +1,78 @@
+<html>
+
+<head>
+  <title>Accessible events testing for document</title>
+
+  <link rel="stylesheet" type="text/css"
+        href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+
+  <script type="application/javascript"
+          src="chrome://mochikit/content/MochiKit/packed.js"></script>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+
+  <script type="application/javascript"
+          src="chrome://mochikit/content/a11y/accessible/common.js"></script>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/a11y/accessible/events.js"></script>
+
+  <script type="application/javascript">
+    ////////////////////////////////////////////////////////////////////////////
+    // Invokers
+
+    function changeIframeSrc(aIdentifier, aURL)
+    {
+      this.DOMNode = getNode(aIdentifier);
+
+      this.invoke = function changeIframeSrc_invoke()
+      {
+        this.DOMNode.src = aURL;
+      }
+
+      this.getID = function changeIframeSrc_getID()
+      {
+        return "change iframe src on " + aURL;
+      }
+    }
+
+    ////////////////////////////////////////////////////////////////////////////
+    // Do tests
+
+    var gQueue = null;
+
+    // var gA11yEventDumpID = "eventdump"; // debug stuff
+
+    function doTests()
+    {
+      gQueue = new eventQueue(EVENT_REORDER);
+
+      gQueue.push(new changeIframeSrc("iframe", "about:"));
+      gQueue.push(new changeIframeSrc("iframe", "about:buildconfig"));
+
+      gQueue.invoke(); // Will call SimpleTest.finish();
+    }
+
+    SimpleTest.waitForExplicitFinish();
+    addA11yLoadEvent(doTests);
+  </script>
+</head>
+
+<body>
+
+  <a target="_blank"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=420845"
+     title="Fire event_reorder on any embedded frames/iframes whos document has just loaded">
+    Mozilla Bug 420845
+  </a>
+
+  <p id="display"></p>
+  <div id="content" style="display: none"></div>
+  <pre id="test">
+  </pre>
+
+  <div id="testContainer">
+    <iframe id="iframe"></iframe>
+  </div>
+  <div id="eventdump"></div>
+</body>
+</html>
--- a/browser/app/Makefile.in
+++ b/browser/app/Makefile.in
@ -303,8 +303,6 @@ ifneq (,$(filter gtk2,$(MOZ_WIDGET_TOOLKIT)))

 ICON_FILES	= \
 		$(DIST)/branding/mozicon128.png \
-		$(DIST)/branding/mozicon50.xpm \
-		$(DIST)/branding/mozicon16.xpm \
 		$(DIST)/branding/document.png \
 		$(NULL)

@ -339,8 +337,6 @@ ifneq (,$(filter mac cocoa,$(MOZ_WIDGET_TOOLKIT)))
 endif
 ifneq (,$(filter gtk2,$(MOZ_WIDGET_TOOLKIT)))
 	cp $(srcdir)/mozicon128.png $(DIST)/branding/mozicon128.png
-	cp $(srcdir)/mozicon16.xpm $(DIST)/branding/mozicon16.xpm
-	cp $(srcdir)/mozicon50.xpm $(DIST)/branding/mozicon50.xpm
 	cp $(srcdir)/document.png $(DIST)/branding/document.png
 endif
 ifeq ($(MOZ_WIDGET_TOOLKIT),gtk2)
--- a/browser/app/mozicon16.xpm
+++ b/browser/app/mozicon16.xpm
@ -1,156 +0,0 @@
-/* XPM */
-static char * mozicon16_xpm[] = {
-"16 16 137 2",
-"  	c None",
-". 	c #388BBF",
-"+ 	c #59ADD6",
-"@ 	c #68CEEF",
-"# 	c #62CCEE",
-"$ 	c #45AAD7",
-"% 	c #3578AF",
-"& 	c #4A93C3",
-"* 	c #5EA9D2",
-"= 	c #72D1EF",
-"- 	c #6DCCEC",
-"; 	c #4B9FCE",
-"> 	c #3483BA",
-", 	c #1E67A5",
-"' 	c #1B6BA5",
-") 	c #2F7AB0",
-"! 	c #48B9E0",
-"~ 	c #5CC2E5",
-"{ 	c #6ED0EE",
-"] 	c #6FC9E9",
-"^ 	c #4994C5",
-"/ 	c #3783B9",
-"( 	c #1E5D9D",
-"_ 	c #1463A1",
-": 	c #028DC4",
-"< 	c #128DC3",
-"[ 	c #27ABD7",
-"} 	c #3CB8E0",
-"| 	c #4EC0E5",
-"1 	c #5BC3E6",
-"2 	c #50A2CE",
-"3 	c #3B7EB5",
-"4 	c #3C93C4",
-"5 	c #2164A1",
-"6 	c #145A9A",
-"7 	c #0E8FC4",
-"8 	c #007EBA",
-"9 	c #0694C8",
-"0 	c #1896C7",
-"a 	c #2B99C9",
-"b 	c #3CB7DE",
-"c 	c #48B9DF",
-"d 	c #3E95C5",
-"e 	c #2E71AB",
-"f 	c #399DCA",
-"g 	c #34A9D4",
-"h 	c #2387BE",
-"i 	c #1388C0",
-"j 	c #0059A1",
-"k 	c #005C9E",
-"l 	c #00498B",
-"m 	c #095897",
-"n 	c #1869A3",
-"o 	c #289CCA",
-"p 	c #34B1DA",
-"q 	c #3BB3DB",
-"r 	c #3BB3DA",
-"s 	c #35AFD7",
-"t 	c #2BA2CF",
-"u 	c #1E6AA2",
-"v 	c #106AA7",
-"w 	c #0258A0",
-"x 	c #00357F",
-"y 	c #002D71",
-"z 	c #003175",
-"A 	c #013A7E",
-"B 	c #084889",
-"C 	c #1577AF",
-"D 	c #1FA1CF",
-"E 	c #26A3D1",
-"F 	c #28A2CF",
-"G 	c #269ACA",
-"H 	c #2088BE",
-"I 	c #174784",
-"J 	c #0B1F5F",
-"K 	c #012568",
-"L 	c #00206A",
-"M 	c #00185A",
-"N 	c #001F62",
-"O 	c #002569",
-"P 	c #002C70",
-"Q 	c #0567A7",
-"R 	c #0D81BB",
-"S 	c #1485BD",
-"T 	c #1883BC",
-"U 	c #177DB7",
-"V 	c #144A88",
-"W 	c #0C1D5C",
-"X 	c #030B47",
-"Y 	c #00023B",
-"Z 	c #00207A",
-"` 	c #002072",
-" .	c #00236B",
-"..	c #001556",
-"+.	c #001B5E",
-"@.	c #003D81",
-"#.	c #01599E",
-"$.	c #04559E",
-"%.	c #0761A6",
-"&.	c #085499",
-"*.	c #061958",
-"=.	c #020843",
-"-.	c #000137",
-";.	c #001C79",
-">.	c #00155D",
-",.	c #000945",
-"'.	c #000B49",
-").	c #000E4C",
-"!.	c #002367",
-"~.	c #002A6F",
-"{.	c #003E8B",
-"].	c #003787",
-"^.	c #00175C",
-"/.	c #000035",
-"(.	c #000030",
-"_.	c #000E67",
-":.	c #00043B",
-"<.	c #000339",
-"[.	c #00043C",
-"}.	c #00053E",
-"|.	c #00063F",
-"1.	c #000E4F",
-"2.	c #00247E",
-"3.	c #00166A",
-"4.	c #00002E",
-"5.	c #00014F",
-"6.	c #000029",
-"7.	c #00012F",
-"8.	c #000953",
-"9.	c #000E6E",
-"0.	c #000A6C",
-"a.	c #000563",
-"b.	c #00002F",
-"c.	c #00001D",
-"d.	c #000025",
-"e.	c #000040",
-"f.	c #000033",
-"                                ",
-"          . + @ # $             ",
-"        % & * = - ; > ,         ",
-"      ' ) ! ~ { ] ^ / ( _       ",
-"    : < [ } | 1 2 3 4 5 6 7     ",
-"    8 9 0 a b c d e f g h i     ",
-"  j k l m n o p q r s t u v w   ",
-"  x y z A B C D E F G H I J K   ",
-"  L M N O P Q R S T U V W X Y   ",
-"  Z `  ...+.@.#.$.%.&.*.=.-.    ",
-"    ;.>.,.'.).!.~.{.].^./.(.    ",
-"      _.:.<.[.}.|.1.2.3.4.      ",
-"      5.6.(.4.7.8.9.0.a.        ",
-"          b.b.c.d.e.f.          ",
-"                                ",
-"                                "};
--- a/browser/app/mozicon50.xpm
+++ b/browser/app/mozicon50.xpm
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@ -358,7 +358,8 @@ pref("browser.tabs.closeButtons", 1);
 // false  return to the adjacent tab (old default)
 pref("browser.tabs.selectOwnerOnClose", true);

-pref("browser.ctrlTab.previews", true);
+pref("browser.allTabs.previews", false);
+pref("browser.ctrlTab.previews", false);
 pref("browser.ctrlTab.recentlyUsedLimit", 7);

 // Default bookmark sorting
@ -385,6 +386,11 @@ pref("general.warnOnAboutConfig",                 false);
 pref("javascript.options.showInConsole",          false);
 #endif

+#ifdef WINCE
+// Set the threshold higher to avoid some slow script warnings
+pref("dom.max_script_run_time",                   20);
+#endif
+
 // Make the status bar reliably present and unaffected by pages
 pref("dom.disable_window_open_feature.status",    true);
 // This is the pref to control the location bar, change this to true to 
@ -861,6 +867,7 @@ pref("browser.urlbar.delay", 1000);

 // disable safe browsing, due to perf hit
 pref("browser.safebrowsing.enabled", false);
+pref("browser.safebrowsing.malware.enabled", false);

 // don't check for default browser
 pref("browser.shell.checkDefaultBrowser", false);
--- a/browser/base/content/browser-menubar.inc
+++ b/browser/base/content/browser-menubar.inc
@ -441,6 +441,12 @@
                          type="checkbox"
                          command="View:FullScreen"/>
 #endif
+                <menuitem id="menu_showAllTabs"
+                          hidden="true"
+                          accesskey="&showAllTabsCmd.accesskey;"
+                          label="&showAllTabsCmd.label;"
+                          command="Browser:ShowAllTabs"
+                          key="key_showAllTabs"/>
                <menuseparator hidden="true" id="documentDirection-separator"/>
                <menuitem id="documentDirection-swap"
                          hidden="true"
--- a/browser/base/content/browser-sets.inc
+++ b/browser/base/content/browser-sets.inc
@ -115,6 +115,7 @@
    </command>
    <command id="Browser:NextTab" oncommand="gBrowser.mTabContainer.advanceSelectedTab(1, true);"/>
    <command id="Browser:PrevTab" oncommand="gBrowser.mTabContainer.advanceSelectedTab(-1, true);"/>
+    <command id="Browser:ShowAllTabs" oncommand="allTabs.open();"/>
    <command id="cmd_fullZoomReduce"  oncommand="FullZoom.reduce()"/>
    <command id="cmd_fullZoomEnlarge" oncommand="FullZoom.enlarge()"/>
    <command id="cmd_fullZoomReset"   oncommand="FullZoom.reset()"/>
@ -317,7 +318,9 @@
    <key                          key="&fullZoomEnlargeCmd.commandkey3;" command="cmd_fullZoomEnlarge" modifiers="accel"/>
    <key id="key_fullZoomReset"   key="&fullZoomResetCmd.commandkey;"    command="cmd_fullZoomReset"   modifiers="accel"/>
    <key                          key="&fullZoomResetCmd.commandkey2;"   command="cmd_fullZoomReset"   modifiers="accel"/>
-    
+
+    <key id="key_showAllTabs" command="Browser:ShowAllTabs" keycode="VK_TAB" modifiers="control,shift"/>
+
    <key id="key_switchTextDirection" key="&bidiSwitchTextDirectionItem.commandkey;" command="cmd_switchTextDirection" modifiers="accel,shift" />

    <key id="key_privatebrowsing" command="Tools:PrivateBrowsing" key="&privateBrowsingCmd.commandkey;" modifiers="accel,shift"/>
--- a/browser/base/content/browser-tabPreviews.js
+++ b/browser/base/content/browser-tabPreviews.js
--- a/browser/base/content/browser-tabPreviews.xml
+++ b/browser/base/content/browser-tabPreviews.xml
@ -41,21 +41,49 @@
          xmlns="http://www.mozilla.org/xbl"
          xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
          xmlns:xbl="http://www.mozilla.org/xbl">
-  <binding id="ctrlTab-thumbnail">
-    <content align="center">
-      <children/>
-      <xul:label xbl:inherits="value=label,crop"/>
+  <binding id="ctrlTab-preview" extends="chrome://global/content/bindings/button.xml#button-base">
+    <content pack="center">
+      <xul:stack>
+        <xul:vbox class="ctrlTab-preview-inner" align="center" pack="center"
+                  xbl:inherits="width=canvaswidth">
+          <xul:hbox class="tabPreview-canvas" xbl:inherits="style=canvasstyle">
+            <children/>
+          </xul:hbox>
+          <xul:label xbl:inherits="value=label,crop" class="plain"/>
+        </xul:vbox>
+        <xul:hbox class="ctrlTab-favicon-container" xbl:inherits="hidden=noicon">
+          <xul:image class="ctrlTab-favicon" xbl:inherits="src=image"/>
+        </xul:hbox>
+      </xul:stack>
    </content>
    <handlers>
-      <handler event="click" button="0" action="ctrlTab.selectThumbnail(this);"/>
-      <handler event="click" button="1" action="gBrowser.removeTab(this._tab);"/>
+      <handler event="mouseover" action="ctrlTab._mouseOverFocus(this);"/>
+      <handler event="command" action="ctrlTab.pick(this);"/>
+      <handler event="click" button="1" action="ctrlTab.remove(this);"/>
 #ifdef XP_MACOSX
 # Control+click is a right click on OS X
-      <handler event="click" button="2"><![CDATA[
-        if (!ctrlTab.sticky)
-          ctrlTab.selectThumbnail(this);
-      ]]></handler>
+      <handler event="click" button="2" action="ctrlTab.pick(this);"/>
 #endif
    </handlers>
  </binding>
+
+  <binding id="allTabs-preview" extends="chrome://global/content/bindings/button.xml#button-base">
+    <content pack="center" align="center">
+      <xul:stack>
+        <xul:vbox class="allTabs-preview-inner" align="center" pack="center">
+          <xul:hbox class="tabPreview-canvas" xbl:inherits="style=canvasstyle">
+            <children/>
+          </xul:hbox>
+          <xul:label flex="1" xbl:inherits="value=label,crop" class="allTabs-preview-label plain"/>
+        </xul:vbox>
+        <xul:hbox class="allTabs-favicon-container">
+          <xul:image class="allTabs-favicon" xbl:inherits="src=image"/>
+        </xul:hbox>
+      </xul:stack>
+    </content>
+    <handlers>
+      <handler event="command" action="allTabs.pick(this);"/>
+      <handler event="click" button="1" action="gBrowser.removeTab(this._tab);"/>
+    </handlers>
+  </binding>
 </bindings>
--- a/browser/base/content/browser.css
+++ b/browser/base/content/browser.css
@ -65,6 +65,13 @@ toolbarpaletteitem[place="palette"] > toolbaritem > hbox[type="places"] {
  font-weight: bold;
 }

+%ifdef MOZ_WIDGET_GTK2
+/* Bookmarks override the "images-in-menus" metric in xul.css */
+.bookmark-item > .menu-iconic-left {
+  visibility: inherit;
+}
+%endif
+
 #editBMPanel_tagsSelector {
  /* override default listbox width from xul.css */
  width: auto;
@ -116,24 +123,46 @@ window[chromehidden~="toolbar"] toolbar:not(.toolbar-primary):not(.chromeclass-m
  display: -moz-box;
 }

-/* Tab Previews */
-#ctrlTab-panel {
-  -moz-user-focus: normal;
+/* ::::: Keyboard UI Panel ::::: */
+.KUI-panel-closebutton {
+  -moz-binding: url("chrome://global/content/bindings/toolbarbutton.xml#toolbarbutton-image");
 }

-.ctrlTab-thumbnail {
-  -moz-binding: url("chrome://browser/content/browser-tabPreviews.xml#ctrlTab-thumbnail");
+.ctrlTab-preview > html|canvas,
+.allTabs-preview > html|canvas {
+  min-width: inherit;
+  max-width: inherit;
+  min-height: inherit;
+  max-height: inherit;
 }

-.ctrlTab-thumbnail:not([valid]) {
-  visibility: hidden;
+.ctrlTab-favicon-container,
+.allTabs-favicon-container {
+  -moz-box-align: start;
+  -moz-box-pack: start;
 }

-#ctrlTab-pages {
+.ctrlTab-favicon,
+.allTabs-favicon {
+  width: 16px;
+  height: 16px;
+}
+
+/* ::::: Ctrl-Tab Panel ::::: */
+.ctrlTab-preview {
+  -moz-binding: url("chrome://browser/content/browser-tabPreviews.xml#ctrlTab-preview");
+}
+
+/* ::::: All Tabs Panel ::::: */
+.allTabs-preview {
+  -moz-binding: url("chrome://browser/content/browser-tabPreviews.xml#allTabs-preview");
+}
+
+#allTabs-tab-close-button {
+  -moz-binding: url("chrome://global/content/bindings/toolbarbutton.xml#toolbarbutton-image");
+  margin: 0;
+}
+
+#allTabs-container {
  display: block;
-  text-align: center;
-}
- 
-.ctrlTab-pagePointer {
-  display: inline-block;
 }
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@ -1058,6 +1058,8 @@ function BrowserStartup() {
    gURLBar.setAttribute("enablehistory", "false");
  }

+  allTabs.readPref();
+
  setTimeout(delayedStartup, 0, isLoadingBlank, mustLoadSidebar);
 }

@ -1318,7 +1320,9 @@ function delayedStartup(isLoadingBlank, mustLoadSidebar) {
  gBrowser.addEventListener("command", BrowserOnCommand, false);

  tabPreviews.init();
-  ctrlTab.init();
+  ctrlTab.readPref();
+  gPrefService.addObserver(ctrlTab.prefName, ctrlTab, false);
+  gPrefService.addObserver(allTabs.prefName, allTabs, false);

  // Initialize the microsummary service by retrieving it, prompting its factory
  // to create its singleton, whose constructor initializes the service.
@ -1371,6 +1375,7 @@ function BrowserShutdown()
 {
  tabPreviews.uninit();
  ctrlTab.uninit();
+  allTabs.uninit();

  gGestureSupport.init(false);

@ -2646,16 +2651,22 @@ var browserDragAndDrop = {
        case "text/x-moz-url":
          var split = dt.getData(type).split("\n");
          return [split[0], split[1]];
-        case "application/x-moz-file":
-          var file = dt.mozGetDataAt(type, 0);
-          var name = file instanceof Components.interfaces.nsIFile ? file.leafName : "";
-          var ioService = Components.classes["@mozilla.org/network/io-service;1"]
-                                    .getService(Components.interfaces.nsIIOService);
-          var fileHandler = ioService.getProtocolHandler("file")
-                                     .QueryInterface(Components.interfaces.nsIFileProtocolHandler);
-          return [fileHandler.getURLSpecFromFile(file), name];
      }
    }
+
+    // For shortcuts, we want to check for the file type last, so that the
+    // url pointed to in one of the url types is found first before the file
+    // type, which points to the actual file.
+    var file = dt.mozGetDataAt("application/x-moz-file", 0);
+    if (file) {
+      var name = file instanceof Ci.nsIFile ? file.leafName : "";
+      var ioService = Cc["@mozilla.org/network/io-service;1"]
+                                .getService(Ci.nsIIOService);
+      var fileHandler = ioService.getProtocolHandler("file")
+                                 .QueryInterface(Ci.nsIFileProtocolHandler);
+      return [fileHandler.getURLSpecFromFile(file), name];
+    }
+
    return [ , ];
  },

@ -4964,20 +4975,20 @@ function middleMousePaste(event)
 */

 var contentAreaDNDObserver = {
-  onDragOver: function (aEvent)
-    {
-      var types = aEvent.dataTransfer.types;
-      if (types.contains("application/x-moz-file") ||
-          types.contains("text/x-moz-url") ||
-          types.contains("text/uri-list") ||
-          types.contains("text/plain"))
-        aEvent.preventDefault();
-    },
  onDrop: function (aEvent)
    {
      if (aEvent.getPreventDefault())
        return;

+      var types = aEvent.dataTransfer.types;
+      if (!types.contains("application/x-moz-file") &&
+          !types.contains("text/x-moz-url") &&
+          !types.contains("text/uri-list") &&
+          !types.contains("text/plain")) {
+        aEvent.preventDefault();
+        return;
+      }
+
      let [url, name] = browserDragAndDrop.getDragURLFromDataTransfer(aEvent.dataTransfer);

      // valid urls don't contain spaces ' '; if we have a space it
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@ -242,30 +242,44 @@
      <label crop="center" flex="1" class="tooltip-label"/>
    </tooltip>

-    <panel id="ctrlTab-panel" class="KUI-panel" hidden="true" norestorefocus="true" ignorekeys="true">
+    <panel id="ctrlTab-panel" class="KUI-panel" hidden="true" norestorefocus="true" level="top">
+      <hbox>
+        <button class="ctrlTab-preview" flex="1"/>
+        <button class="ctrlTab-preview" flex="1"/>
+        <button class="ctrlTab-preview" flex="1"/>
+        <button class="ctrlTab-preview" flex="1"/>
+        <button class="ctrlTab-preview" flex="1"/>
+        <button class="ctrlTab-preview" flex="1"/>
+      </hbox>
      <hbox pack="center">
-        <textbox id="ctrlTab-search"
+        <button id="ctrlTab-showAll" class="ctrlTab-preview" noicon="true"/>
+      </hbox>
+    </panel>
+
+    <panel id="allTabs-panel" hidden="true" norestorefocus="true" ignorekeys="true"
+# XXX: KUI style disabled, because the transparent background slows down
+#      interacting with the panel, esp. the search field.
+#           class="KUI-panel"
+           onmouseover="allTabs._updateTabCloseButton(event);">
+      <hbox id="allTabs-meta" align="center">
+        <spacer flex="1"/>
+        <textbox id="allTabs-filter"
+                 tooltiptext="&allTabs.filter.emptyText;"
                 type="search"
-                 emptytext="&ctrlTab.search.emptyText;"
-                 oncommand="ctrlTab.search();"
-                 onfocus="ctrlTab.sticky = true;"/>
+                 oncommand="allTabs.filter();"/>
+        <spacer flex="1"/>
+        <toolbarbutton class="KUI-panel-closebutton"
+                       oncommand="allTabs.close()"
+                       tooltiptext="&closeCmd.label;"/>
      </hbox>
-      <hbox class="ctrlTab-row">
-        <hbox flex="1" pack="center"><vbox class="ctrlTab-thumbnail"/></hbox>
-        <vbox class="ctrlTab-thumbnail"/>
-        <hbox flex="1" pack="center"><vbox class="ctrlTab-thumbnail"/></hbox>
-      </hbox>
-      <hbox class="ctrlTab-row">
-        <hbox flex="1" pack="center"><vbox class="ctrlTab-thumbnail"/></hbox>
-        <vbox class="ctrlTab-thumbnail"/>
-        <hbox flex="1" pack="center"><vbox class="ctrlTab-thumbnail"/></hbox>
-      </hbox>
-      <hbox class="ctrlTab-row">
-        <hbox flex="1" pack="center"><vbox class="ctrlTab-thumbnail"/></hbox>
-        <vbox class="ctrlTab-thumbnail"/>
-        <hbox flex="1" pack="center"><vbox class="ctrlTab-thumbnail"/></hbox>
-      </hbox>
-      <hbox id="ctrlTab-pages"/>
+      <stack id="allTabs-stack">
+        <box id="allTabs-container"/>
+        <toolbarbutton id="allTabs-tab-close-button"
+                       class="tab-close-button"
+                       oncommand="allTabs.closeTab(event);"
+                       tooltiptext="&closeCmd.label;"
+                       style="visibility:hidden"/>
+      </stack>
    </panel>
  </popupset>

--- a/browser/base/content/sanitize.xul
+++ b/browser/base/content/sanitize.xul
@ -42,7 +42,6 @@
 # ***** END LICENSE BLOCK *****

 <?xml-stylesheet href="chrome://global/skin/"?>
-<?xml-stylesheet href="chrome://browser/skin/preferences/preferences.css" type="text/css"?> 
 <?xml-stylesheet href="chrome://browser/skin/sanitizeDialog.css"?>

 #ifdef CRH_DIALOG_TREE_VIEW
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@ -2879,8 +2879,11 @@
          <xul:stack align="center" pack="end" chromedir="&locale.dir;">
            <xul:hbox flex="1" class="tabs-alltabs-box-animate" anonid="alltabs-box-animate"/>
            <xul:toolbarbutton class="tabs-alltabs-button" anonid="alltabs-button"
-                               tooltiptext="&listAllTabs.label;"
-                               oncommand="ctrlTab.open(true);"/>
+                               type="menu"
+                               tooltiptext="&listAllTabs.label;">
+             <xul:menupopup class="tabs-alltabs-popup" anonid="alltabs-popup"
+                            position="after_end"/>
+            </xul:toolbarbutton>
          </xul:stack>
          <xul:toolbarbutton anonid="tabs-closebutton"
                             class="close-button tabs-closebutton" chromedir="&locale.dir;"/>
@ -3293,25 +3296,6 @@
  <binding id="tabbrowser-alltabs-popup"
           extends="chrome://global/content/bindings/popup.xml#popup">
    <implementation implements="nsIDOMEventListener">
-      <field name="_xulWindow">
-        null
-      </field>
-
-      <constructor><![CDATA[
-        // We cannot cache the XULBrowserWindow object itself since it might
-        // be set after this binding is constructed.
-        try {
-          this._xulWindow = 
-            window.QueryInterface(Components.interfaces.nsIInterfaceRequestor)
-                  .getInterface(Components.interfaces.nsIWebNavigation)
-                  .QueryInterface(Components.interfaces.nsIDocShellTreeItem)
-                  .treeOwner
-                  .QueryInterface(Components.interfaces.nsIInterfaceRequestor)
-                  .getInterface(Components.interfaces.nsIXULWindow);
-        }
-        catch(ex) { }
-      ]]></constructor>
-
      <method name="_menuItemOnCommand">
        <parameter name="aEvent"/>

@ -3471,9 +3455,6 @@

      <handler event="DOMMenuItemActive">
      <![CDATA[
-        if (!this._xulWindow || !this._xulWindow.XULBrowserWindow)
-          return;
-
        var tab = event.target.tab;
        if (tab) {
          var statusText = tab.linkedBrowser.currentURI.spec;
@ -3484,16 +3465,13 @@
            statusText = " ";
          }

-          this._xulWindow.XULBrowserWindow.setOverLink(statusText, null);
+          XULBrowserWindow.setOverLink(statusText, null);
        }
      ]]></handler>

      <handler event="DOMMenuItemInactive">
      <![CDATA[
-        if (!this._xulWindow || !this._xulWindow.XULBrowserWindow)
-          return;
-
-        this._xulWindow.XULBrowserWindow.setOverLink("", null);
+        XULBrowserWindow.setOverLink("", null);
      ]]></handler>

    </handlers>
--- a/browser/base/content/test/browser_ctrlTab.js
+++ b/browser/base/content/test/browser_ctrlTab.js
@ -1,5 +1,5 @@
 function test() {
-  waitForExplicitFinish();
+  gPrefService.setBoolPref("browser.ctrlTab.previews", true);

  gBrowser.addTab();
  gBrowser.addTab();
@ -9,7 +9,7 @@ function test() {

  ctrlTabTest([2]      , 1, 0);
  ctrlTabTest([2, 3, 1], 2, 2);
-  ctrlTabTest([]       , 4, 2);
+  ctrlTabTest([]       , 5, 2);

  {
    let selectedIndex = gBrowser.tabContainer.selectedIndex;
@ -27,9 +27,12 @@ function test() {
    is(gBrowser.mTabs.length, tabs - 1, "Ctrl+Tab -> Ctrl+W removes one tab");
    releaseCtrl();
  }
-  assertTabs(3);

-  ctrlTabTest([2, 1, 0], 7, 1);
+  assertTabs(3);
+  ctrlTabTest([2, 1, 0], 9, 1);
+
+  gBrowser.addTab();
+  assertTabs(4);

  { // test for bug 445369
    selectTabs([1, 2, 0]);
@ -49,12 +52,12 @@ function test() {
    ok(gBrowser.selectedTab == selectedTab,
       "Ctrl+Tab*2 -> Ctrl+W -> Ctrl+Shift+Tab*2 keeps the selected tab");
  }
+  gBrowser.removeTab(gBrowser.tabContainer.lastChild);
  assertTabs(2);

  ctrlTabTest([1], 1, 0);

  gBrowser.removeTab(gBrowser.tabContainer.lastChild);
-
  assertTabs(1);

  { // test for bug 445768
@ -71,65 +74,8 @@ function test() {
       "Ctrl+Tab doesn't change focus if one tab is open");
  }

-  gBrowser.addTab();
-  gBrowser.addTab();
-  gBrowser.addTab();
-
-  assertTabs(4);
-  selectTabs([0, 1, 2, 3]);
-  pressCtrlTab();
-  ctrlTab.panel.addEventListener("popupshown", stickyTests, false);
-
-  function stickyTests() {
-    ctrlTab.panel.removeEventListener("popupshown", stickyTests, false);
-
-    EventUtils.synthesizeKey("f", { ctrlKey: true });
-    is(document.activeElement, ctrlTab.searchField.inputField,
-       "Ctrl+Tab -> Ctrl+F focuses the panel's search field");
-
-    releaseCtrl();
-    ok(isOpen(),
-       "panel is sticky after focusing the search field and releasing the Ctrl key");
-
-    EventUtils.synthesizeKey("f", {});
-    EventUtils.synthesizeKey("o", {});
-    EventUtils.synthesizeKey("o", {});
-    is(ctrlTab.searchField.value, "foo",
-       "text entered into search field");
-
-    EventUtils.synthesizeKey("VK_RETURN", {});
-    ok(isOpen(),
-       "Enter key kicks pending search off; the panel stays open as there's no match");
-    is(ctrlTab.searchField.value, "foo",
-       "search field value persists after Enter pressed");
-
-    EventUtils.synthesizeKey("VK_ESCAPE", {});
-    is(ctrlTab.searchField.value, "",
-       "ESC key clears the search field");
-    ok(isOpen(),
-       "Clearing the search field with ESC keeps the panel open");
-
-    // blur the search field
-    EventUtils.synthesizeKey("VK_TAB", {});
-    isnot(document.activeElement, ctrlTab.searchField.inputField,
-          "Tab key blurs the panel's search field");
-
-    // advance selection and close panel
-    EventUtils.synthesizeKey("VK_TAB", {});
-    EventUtils.synthesizeKey("VK_TAB", {});
-    EventUtils.synthesizeKey("VK_RETURN", {});
-    ok(!isOpen(),
-       "Enter key closes the panel");
-    is(gBrowser.tabContainer.selectedIndex, 1,
-       "Tab key advances the selection while the panel is sticky");
-
-    gBrowser.removeCurrentTab();
-    gBrowser.removeCurrentTab();
-    gBrowser.removeCurrentTab();
-    assertTabs(1);
-    finish();
-  }
-
+  // cleanup
+  gPrefService.clearUserPref("browser.ctrlTab.previews");

  /* private utility functions */

@ -140,7 +86,7 @@ function test() {
    EventUtils.synthesizeKey("VK_CONTROL", { type: "keyup" });

  function isOpen()
-    ctrlTab.panel.state == "showing" || ctrlTab.panel.state == "open";
+    ctrlTab.isOpen;

  function assertTabs(aTabs) {
    var tabs = gBrowser.mTabs.length;
--- a/browser/base/content/test/browser_tabfocus.js
+++ b/browser/base/content/test/browser_tabfocus.js
@ -4,13 +4,17 @@

 let testPage1 = "data:text/html,<html id='tab1'><body><button id='button1'>Tab 1</button></body></html>";
 let testPage2 = "data:text/html,<html id='tab2'><body><button id='button2'>Tab 2</button></body></html>";
+let testPage3 = "data:text/html,<html id='tab3'><body><button id='button3'>Tab 3</button></body></html>";
+
+var browser1;

 function test() {
  waitForExplicitFinish();

  var tab1 = gBrowser.addTab();
+  browser1 = gBrowser.getBrowserForTab(tab1);
+
  var tab2 = gBrowser.addTab();
-  var browser1 = gBrowser.getBrowserForTab(tab1);
  var browser2 = gBrowser.getBrowserForTab(tab2);

  gURLBar.focus();
@ -119,10 +123,15 @@ function test() {
    expectFocusShift(function () gBrowser.selectedTab = tab1,
                     browser1.contentWindow, null, true,
                     "focusedWindow after tab switch from no focus to no focus");
-    
-    gBrowser.removeCurrentTab();
-    gBrowser.removeCurrentTab();
-    finish();
+
+    window.addEventListener("focus", _browser_tabfocus_test_eventOccured, true);
+    window.addEventListener("blur", _browser_tabfocus_test_eventOccured, true);
+
+    // next, check whether navigating forward, focusing the urlbar and then
+    // navigating back maintains the focus in the urlbar.
+    browser1.addEventListener("pageshow", _browser_tabfocus_navigation_test_eventOccured, true);
+    button1.focus();
+    browser1.contentWindow.location = testPage3;
  }

  browser1.addEventListener("load", check, true);
@ -152,6 +161,24 @@ function _browser_tabfocus_test_eventOccured(event)
  _browser_tabfocus_test_events += event.type + ": " + id;
 }

+function _browser_tabfocus_navigation_test_eventOccured(event)
+{
+  if (event.target instanceof Document) {
+    var contentwin = event.target.defaultView;
+    if (contentwin.location.toString().indexOf("3") > 0) {
+      // just moved forward, so focus the urlbar and go back
+      gURLBar.focus();
+      setTimeout(function () contentwin.history.back(), 0);
+    }
+    else if (contentwin.location.toString().indexOf("2") > 0) {
+      is(window.document.activeElement, gURLBar.inputField, "urlbar still focused after navigating back");
+      gBrowser.removeCurrentTab();
+      gBrowser.removeCurrentTab();
+      finish();
+    }
+  }
+}
+
 function getId(element)
 {
  return (element.localName == "input") ? "urlbar" : element.id;
--- a/browser/branding/unofficial/Makefile.in
+++ b/browser/branding/unofficial/Makefile.in
@ -24,8 +24,6 @@ BROWSER_APP_FILES = \
 	default32.png \
 	default48.png \
 	mozicon128.png \
-	mozicon16.xpm \
-	mozicon50.xpm \
 	firefox.ico \
 	document.ico \
 	$(NULL)
--- a/browser/branding/unofficial/mozicon16.xpm
+++ b/browser/branding/unofficial/mozicon16.xpm
@ -1,156 +0,0 @@
-/* XPM */
-static char * mozicon16_xpm[] = {
-"16 16 137 2",
-"  	c None",
-". 	c #388BBF",
-"+ 	c #59ADD6",
-"@ 	c #68CEEF",
-"# 	c #62CCEE",
-"$ 	c #45AAD7",
-"% 	c #3578AF",
-"& 	c #4A93C3",
-"* 	c #5EA9D2",
-"= 	c #72D1EF",
-"- 	c #6DCCEC",
-"; 	c #4B9FCE",
-"> 	c #3483BA",
-", 	c #1E67A5",
-"' 	c #1B6BA5",
-") 	c #2F7AB0",
-"! 	c #48B9E0",
-"~ 	c #5CC2E5",
-"{ 	c #6ED0EE",
-"] 	c #6FC9E9",
-"^ 	c #4994C5",
-"/ 	c #3783B9",
-"( 	c #1E5D9D",
-"_ 	c #1463A1",
-": 	c #028DC4",
-"< 	c #128DC3",
-"[ 	c #27ABD7",
-"} 	c #3CB8E0",
-"| 	c #4EC0E5",
-"1 	c #5BC3E6",
-"2 	c #50A2CE",
-"3 	c #3B7EB5",
-"4 	c #3C93C4",
-"5 	c #2164A1",
-"6 	c #145A9A",
-"7 	c #0E8FC4",
-"8 	c #007EBA",
-"9 	c #0694C8",
-"0 	c #1896C7",
-"a 	c #2B99C9",
-"b 	c #3CB7DE",
-"c 	c #48B9DF",
-"d 	c #3E95C5",
-"e 	c #2E71AB",
-"f 	c #399DCA",
-"g 	c #34A9D4",
-"h 	c #2387BE",
-"i 	c #1388C0",
-"j 	c #0059A1",
-"k 	c #005C9E",
-"l 	c #00498B",
-"m 	c #095897",
-"n 	c #1869A3",
-"o 	c #289CCA",
-"p 	c #34B1DA",
-"q 	c #3BB3DB",
-"r 	c #3BB3DA",
-"s 	c #35AFD7",
-"t 	c #2BA2CF",
-"u 	c #1E6AA2",
-"v 	c #106AA7",
-"w 	c #0258A0",
-"x 	c #00357F",
-"y 	c #002D71",
-"z 	c #003175",
-"A 	c #013A7E",
-"B 	c #084889",
-"C 	c #1577AF",
-"D 	c #1FA1CF",
-"E 	c #26A3D1",
-"F 	c #28A2CF",
-"G 	c #269ACA",
-"H 	c #2088BE",
-"I 	c #174784",
-"J 	c #0B1F5F",
-"K 	c #012568",
-"L 	c #00206A",
-"M 	c #00185A",
-"N 	c #001F62",
-"O 	c #002569",
-"P 	c #002C70",
-"Q 	c #0567A7",
-"R 	c #0D81BB",
-"S 	c #1485BD",
-"T 	c #1883BC",
-"U 	c #177DB7",
-"V 	c #144A88",
-"W 	c #0C1D5C",
-"X 	c #030B47",
-"Y 	c #00023B",
-"Z 	c #00207A",
-"` 	c #002072",
-" .	c #00236B",
-"..	c #001556",
-"+.	c #001B5E",
-"@.	c #003D81",
-"#.	c #01599E",
-"$.	c #04559E",
-"%.	c #0761A6",
-"&.	c #085499",
-"*.	c #061958",
-"=.	c #020843",
-"-.	c #000137",
-";.	c #001C79",
-">.	c #00155D",
-",.	c #000945",
-"'.	c #000B49",
-").	c #000E4C",
-"!.	c #002367",
-"~.	c #002A6F",
-"{.	c #003E8B",
-"].	c #003787",
-"^.	c #00175C",
-"/.	c #000035",
-"(.	c #000030",
-"_.	c #000E67",
-":.	c #00043B",
-"<.	c #000339",
-"[.	c #00043C",
-"}.	c #00053E",
-"|.	c #00063F",
-"1.	c #000E4F",
-"2.	c #00247E",
-"3.	c #00166A",
-"4.	c #00002E",
-"5.	c #00014F",
-"6.	c #000029",
-"7.	c #00012F",
-"8.	c #000953",
-"9.	c #000E6E",
-"0.	c #000A6C",
-"a.	c #000563",
-"b.	c #00002F",
-"c.	c #00001D",
-"d.	c #000025",
-"e.	c #000040",
-"f.	c #000033",
-"                                ",
-"          . + @ # $             ",
-"        % & * = - ; > ,         ",
-"      ' ) ! ~ { ] ^ / ( _       ",
-"    : < [ } | 1 2 3 4 5 6 7     ",
-"    8 9 0 a b c d e f g h i     ",
-"  j k l m n o p q r s t u v w   ",
-"  x y z A B C D E F G H I J K   ",
-"  L M N O P Q R S T U V W X Y   ",
-"  Z `  ...+.@.#.$.%.&.*.=.-.    ",
-"    ;.>.,.'.).!.~.{.].^./.(.    ",
-"      _.:.<.[.}.|.1.2.3.4.      ",
-"      5.6.(.4.7.8.9.0.a.        ",
-"          b.b.c.d.e.f.          ",
-"                                ",
-"                                "};
--- a/browser/branding/unofficial/mozicon50.xpm
+++ b/browser/branding/unofficial/mozicon50.xpm
--- a/browser/components/build/Makefile.in
+++ b/browser/components/build/Makefile.in
@ -91,4 +91,12 @@ EXTRA_DSO_LDOPTS += \
  $(NULL)
 endif

+ifndef MOZ_ENABLE_LIBXUL
+ifeq ($(MOZ_WIDGET_TOOLKIT),windows)
+# Doesn't work, couldn't figure out why
+#EXTRA_DSO_LIBS += thebes
+EXTRA_DSO_LDOPTS += $(LIBXUL_DIST)/lib/$(LIB_PREFIX)thebes.$(LIB_SUFFIX)
+endif
+endif
+
 include $(topsrcdir)/config/rules.mk
--- a/browser/components/places/content/tree.xml
+++ b/browser/components/places/content/tree.xml
@ -760,7 +760,7 @@
            orientation = Ci.nsITreeView.DROP_ON;
          }

-          return this.view.canDrop(row.value, orientation);
+          return this.view.canDrop(row.value, orientation, aEvent.dataTransfer);
        ]]></body>
      </method>
      
@ -769,8 +769,8 @@
        <parameter name="aEvent"/>
        <parameter name="aFlavour"/>
        <parameter name="aDragSession"/>
-        <body><![CDATA[      
-          if (!this.canDrop(aEvent, aDragSession))
+        <body><![CDATA[
+          if (!this.canDrop(aEvent, aDragSession, aEvent.dataTransfer))
            aEvent.dataTransfer.effectAllowed = "none";
        ]]></body>
      </method>
--- a/browser/components/sessionstore/src/nsSessionStore.js
+++ b/browser/components/sessionstore/src/nsSessionStore.js
@ -1510,7 +1510,7 @@ SessionStoreService.prototype = {
    // get the domain for each URL
    function extractHosts(aEntry) {
      if (/^https?:\/\/(?:[^@\/\s]+@)?([\w.-]+)/.test(aEntry.url)) {
-        if (!hosts[RegExp.$1] && this._checkPrivacyLevel(this._getURIFromString(aEntry.url).schemeIs("https"))) {
+        if (!hosts[RegExp.$1] && _this._checkPrivacyLevel(_this._getURIFromString(aEntry.url).schemeIs("https"))) {
          hosts[RegExp.$1] = true;
        }
      }
@ -1522,7 +1522,8 @@ SessionStoreService.prototype = {
      }
    }

-    this._windows[aWindow.__SSi].tabs.forEach(function(aTabData) { aTabData.entries.forEach(extractHosts, this); }, this);
+    var _this = this;
+    this._windows[aWindow.__SSi].tabs.forEach(function(aTabData) { aTabData.entries.forEach(extractHosts); });
  },

  /**
@ -1550,6 +1551,7 @@ SessionStoreService.prototype = {
      aWindows[i].cookies = [];

    var jscookies = {};
+    var _this = this;
    // MAX_EXPIRY should be 2^63-1, but JavaScript can't handle that precision
    var MAX_EXPIRY = Math.pow(2, 62);
    aWindows.forEach(function(aWindow) {
@ -1557,7 +1559,7 @@ SessionStoreService.prototype = {
        var list = cm.getCookiesFromHost(host);
        while (list.hasMoreElements()) {
          var cookie = list.getNext().QueryInterface(Ci.nsICookie2);
-          if (cookie.isSession && this._checkPrivacyLevel(cookie.isSecure)) {
+          if (cookie.isSession && _this._checkPrivacyLevel(cookie.isSecure)) {
            // use the cookie's host, path, and name as keys into a hash,
            // to make sure we serialize each cookie only once
            var isInHash = false;
@ -1582,7 +1584,7 @@ SessionStoreService.prototype = {
          }
        }
      }
-    }, this);
+    });

    // don't include empty cookie sections
    for (i = 0; i < aWindows.length; i++)
--- a/browser/components/shell/src/nsGNOMEShellService.cpp
+++ b/browser/components/shell/src/nsGNOMEShellService.cpp
@ -47,7 +47,6 @@
 #include "nsIGConfService.h"
 #include "nsIGnomeVFSService.h"
 #include "nsIStringBundle.h"
-#include "gfxIImageFrame.h"
 #include "nsIOutputStream.h"
 #include "nsIProcess.h"
 #include "nsNetUtil.h"
@ -55,7 +54,6 @@
 #include "nsIImageLoadingContent.h"
 #include "imgIRequest.h"
 #include "imgIContainer.h"
-#include "nsIImage.h"
 #include "prprf.h"
 #ifdef MOZ_WIDGET_GTK2
 #include "nsIImageToPixbuf.h"
@ -349,12 +347,8 @@ nsGNOMEShellService::SetShouldCheckDefaultBrowser(PRBool aShouldCheck)
 }

 static nsresult
-WriteImage(const nsCString& aPath, gfxIImageFrame* aImage)
+WriteImage(const nsCString& aPath, imgIContainer* aImage)
 {
-  nsCOMPtr<nsIImage> img(do_GetInterface(aImage));
-  if (!img)
-      return NS_ERROR_NOT_AVAILABLE;
-
 #ifndef MOZ_WIDGET_GTK2
  return NS_ERROR_NOT_AVAILABLE;
 #else
@ -363,7 +357,7 @@ WriteImage(const nsCString& aPath, gfxIImageFrame* aImage)
  if (!imgToPixbuf)
      return NS_ERROR_NOT_AVAILABLE;

-  GdkPixbuf* pixbuf = imgToPixbuf->ConvertImageToPixbuf(img);
+  GdkPixbuf* pixbuf = imgToPixbuf->ConvertImageToPixbuf(aImage);
  if (!pixbuf)
      return NS_ERROR_NOT_AVAILABLE;

@ -379,8 +373,6 @@ nsGNOMEShellService::SetDesktopBackground(nsIDOMElement* aElement,
                                          PRInt32 aPosition)
 {
  nsresult rv;
-  nsCOMPtr<gfxIImageFrame> gfxFrame;
-
  nsCOMPtr<nsIImageLoadingContent> imageContent = do_QueryInterface(aElement, &rv);
  if (!imageContent) return rv;

@ -393,12 +385,6 @@ nsGNOMEShellService::SetDesktopBackground(nsIDOMElement* aElement,
  rv = request->GetImage(getter_AddRefs(container));
  if (!container) return rv;

-  // get the current frame, which holds the image data
-  container->GetCurrentFrame(getter_AddRefs(gfxFrame));
-
-  if (!gfxFrame)
-    return NS_ERROR_FAILURE;
-
  // Write the background file to the home directory.
  nsCAutoString filePath(PR_GetEnv("HOME"));

@ -423,7 +409,7 @@ nsGNOMEShellService::SetDesktopBackground(nsIDOMElement* aElement,
  filePath.Append("_wallpaper.png");

  // write the image to a file in the home dir
-  rv = WriteImage(filePath, gfxFrame);
+  rv = WriteImage(filePath, container);

  // if the file was written successfully, set it as the system wallpaper
  nsCOMPtr<nsIGConfService> gconf = do_GetService(NS_GCONFSERVICE_CONTRACTID);
--- a/browser/components/shell/src/nsWindowsShellService.cpp
+++ b/browser/components/shell/src/nsWindowsShellService.cpp
@ -41,7 +41,6 @@
 *
 * ***** END LICENSE BLOCK ***** */

-#include "gfxIImageFrame.h"
 #include "imgIContainer.h"
 #include "imgIRequest.h"
 #include "nsIDOMDocument.h"
@ -519,23 +518,18 @@ nsWindowsShellService::SetShouldCheckDefaultBrowser(PRBool aShouldCheck)
 }

 static nsresult
-WriteBitmap(nsIFile* aFile, gfxIImageFrame* aImage)
+WriteBitmap(nsIFile* aFile, imgIContainer* aImage)
 {
-  PRInt32 width, height;
-  aImage->GetWidth(&width);
-  aImage->GetHeight(&height);
+  nsRefPtr<gfxImageSurface> image;
+  nsresult rv = aImage->CopyCurrentFrame(getter_AddRefs(image));
+  NS_ENSURE_SUCCESS(rv, rv);

-  PRUint8* bits;
-  PRUint32 length;
-  aImage->LockImageData();
-  aImage->GetImageData(&bits, &length);
-  if (!bits) {
-      aImage->UnlockImageData();
-      return NS_ERROR_FAILURE;
-  }
+  PRInt32 width = image->Width();
+  PRInt32 height = image->Height();

-  PRUint32 bpr;
-  aImage->GetImageBytesPerRow(&bpr);
+  PRUint8* bits = image->Data();
+  PRUint32 length = image->GetDataSize();
+  PRUint32 bpr = PRUint32(image->Stride());
  PRInt32 bitCount = bpr/width;

  // initialize these bitmap structs which we will later
@ -562,7 +556,7 @@ WriteBitmap(nsIFile* aFile, gfxIImageFrame* aImage)

  // get a file output stream
  nsCOMPtr<nsIOutputStream> stream;
-  nsresult rv = NS_NewLocalFileOutputStream(getter_AddRefs(stream), aFile);
+  rv = NS_NewLocalFileOutputStream(getter_AddRefs(stream), aFile);
  NS_ENSURE_SUCCESS(rv, rv);

  // write the bitmap headers and rgb pixel data to the file
@ -592,7 +586,6 @@ WriteBitmap(nsIFile* aFile, gfxIImageFrame* aImage)
    stream->Close();
  }

-  aImage->UnlockImageData();
  return rv;
 }

@ -602,8 +595,7 @@ nsWindowsShellService::SetDesktopBackground(nsIDOMElement* aElement,
 {
  nsresult rv;

-  nsCOMPtr<gfxIImageFrame> gfxFrame;
-
+  nsCOMPtr<imgIContainer> container;
  nsCOMPtr<nsIDOMHTMLImageElement> imgElement(do_QueryInterface(aElement));
  if (!imgElement) {
    // XXX write background loading stuff!
@ -620,18 +612,11 @@ nsWindowsShellService::SetDesktopBackground(nsIDOMElement* aElement,
                                  getter_AddRefs(request));
    if (!request)
      return rv;
-    nsCOMPtr<imgIContainer> container;
    rv = request->GetImage(getter_AddRefs(container));
    if (!container)
      return NS_ERROR_FAILURE;
-
-    // get the current frame, which holds the image data
-    container->GetCurrentFrame(getter_AddRefs(gfxFrame));
  }

-  if (!gfxFrame)
-    return NS_ERROR_FAILURE;
-
  // get the file name from localized strings
  nsCOMPtr<nsIStringBundleService>
    bundleService(do_GetService(NS_STRINGBUNDLE_CONTRACTID, &rv));
@ -664,7 +649,7 @@ nsWindowsShellService::SetDesktopBackground(nsIDOMElement* aElement,
  NS_ENSURE_SUCCESS(rv, rv);

  // write the bitmap to a file in the profile directory
-  rv = WriteBitmap(file, gfxFrame);
+  rv = WriteBitmap(file, container);

  // if the file was written successfully, set it as the system wallpaper
  if (NS_SUCCEEDED(rv)) {
--- a/browser/locales/en-US/chrome/browser/browser.dtd
+++ b/browser/locales/en-US/chrome/browser/browser.dtd
@ -50,6 +50,8 @@
 <!ENTITY pageInfoCmd.commandkey "i">
 <!ENTITY fullScreenCmd.label "Full Screen">
 <!ENTITY fullScreenCmd.accesskey "F">
+<!ENTITY showAllTabsCmd.label "Show All Tabs">
+<!ENTITY showAllTabsCmd.accesskey "A">

 <!ENTITY fullScreenMinimize.tooltip "Minimize">
 <!ENTITY fullScreenRestore.tooltip "Restore">
@ -444,4 +446,4 @@ just addresses the organization to follow, e.g. "This site is run by " -->

 <!ENTITY downloadMonitor2.tooltip "Click to open downloads window">

-<!ENTITY ctrlTab.search.emptyText "Search Tabs">
+<!ENTITY allTabs.filter.emptyText "Search Tabs">
--- a/browser/locales/en-US/chrome/browser/browser.properties
+++ b/browser/locales/en-US/chrome/browser/browser.properties
@ -209,6 +209,12 @@ privateBrowsingYesTitle=&Start Private Browsing
 privateBrowsingNoTitle=&Cancel
 privateBrowsingNeverAsk=&Do not show this message again

+# Ctrl-Tab
+# LOCALIZATION NOTE (ctrlTab.showAll.label): #1 represents the number
+# of tabs in the current browser window. It will always be 2 at least.
+# See: http://developer.mozilla.org/en/docs/Localization_and_Plurals
+ctrlTab.showAll.label=;Show all #1 tabs
+
 # LOCALIZATION NOTE (addKeywordTitleAutoFill): %S will be replaced by the page's title
 # Used as the bookmark name when saving a keyword for a search field.
 addKeywordTitleAutoFill=Search %S
--- a/browser/themes/gnomestripe/browser/KUI-close.png
+++ b/browser/themes/gnomestripe/browser/KUI-close.png
--- a/browser/themes/gnomestripe/browser/browser.css
+++ b/browser/themes/gnomestripe/browser/browser.css
@ -1377,42 +1377,91 @@ toolbar[mode="text"] > #window-controls > toolbarbutton > .toolbarbutton-text {
  -moz-image-region: rect(0px 16px 16px 0px);
 }

-/* ::::: Ctrl-Tab Panel ::::: */
+
+/* ::::: Keyboard UI Panel ::::: */
+
+.KUI-panel-closebutton {
+  list-style-image: url(KUI-close.png);
+}
+
+.KUI-panel-closebutton > .toolbarbutton-icon {
+  margin: 0;
+}
+
+/* ::::: Ctrl-Tab and All Tabs Panels ::::: */
+
+.ctrlTab-preview,
+.allTabs-preview {
+  -moz-appearance: toolbarbutton;
+}
+
+.tabPreview-canvas {
+  -moz-box-shadow: 0 0 5px ThreeDShadow;
+}
+
+.ctrlTab-preview:focus .tabPreview-canvas,
+.ctrlTab-preview:hover .tabPreview-canvas,
+.allTabs-preview:focus .tabPreview-canvas,
+.allTabs-preview:hover .tabPreview-canvas {
+  -moz-box-shadow: none;
+}
+
+.ctrlTab-favicon[src],
+.allTabs-favicon[src] {
+  background-color: white;
+  padding: 2px;
+/* XXX: Upscaling images is ugly on Linux (bug 422179)
+  width: 24px;
+  height: 24px;
+  opacity: .7;
+*/
+  width: 20px;
+  height: 20px;
+  opacity: .8;
+}
+
+/* Ctrl-Tab */
+
 #ctrlTab-panel {
-  padding-top: 15px;
+  padding: 10px;
 }

-#ctrlTab-search {
-  margin: 0 0 15px;
+.ctrlTab-preview:not(#ctrlTab-showAll) .tabPreview-canvas {
+  margin-bottom: 2px;
 }

-.ctrlTab-thumbnail {
-  margin-bottom: 15px;
-  cursor: pointer;
+#ctrlTab-showAll {
+  -moz-appearance: button;
+  color: ButtonText;
+  padding: 0 3px;
+  margin-top: 10px;
 }

-.ctrlTab-thumbnail > html|canvas {
-  border: 1px solid ThreeDShadow;
-  margin: -1px;
+/* All Tabs */
+
+#allTabs-panel {
+  /* compensate for the widget border and padding to center the panel correctly */
+  margin-left: -13px;
 }

-.ctrlTab-thumbnail[selected="true"] ,
-.ctrlTab-thumbnail:hover {
-  background: Highlight;
-  color: HighlightText;
-  -moz-box-shadow: 0 0 2px Highlight, 0 0 2px Highlight, 0 0 3px Highlight, 0 0 4px Highlight, 0 0 10px Highlight, 0 0 15px Highlight;
-}
- 
-.ctrlTab-pagePointer {
-  margin: 0 1em 1em;
-  width: 1.5em;
-  height: 1.5em;
-  -moz-border-radius: .75em;
-  background: ThreeDShadow;
-  cursor: pointer;
+#allTabs-tab-close-button {
+  /*XXX without this, the closebutton can cause the panel to expand horizontally */
+  margin-right: -16px;
 }

-.ctrlTab-pagePointer[selected="true"] {
-  background: ThreeDDarkShadow;
-  cursor: default;
+#allTabs-meta {
+  padding: 5px;
+}
+
+#allTabs-filter {
+  -moz-margin-start: 36px;
+  -moz-margin-end: 0;
+}
+
+#allTabs-stack {
+  margin: 10px;
+}
+
+.allTabs-preview-label {
+  -moz-transform: translate(0, -1px);
 }
--- a/browser/themes/gnomestripe/browser/jar.mn
+++ b/browser/themes/gnomestripe/browser/jar.mn
@ -12,6 +12,7 @@ classic.jar:
  skin/classic/browser/Go-arrow.png
  skin/classic/browser/identity.png
  skin/classic/browser/Info.png
+  skin/classic/browser/KUI-close.png
  skin/classic/browser/monitor.png
  skin/classic/browser/monitor_16-10.png
 * skin/classic/browser/pageInfo.css
--- a/browser/themes/pinstripe/browser/KUI-close.png
+++ b/browser/themes/pinstripe/browser/KUI-close.png
--- a/browser/themes/pinstripe/browser/browser.css
+++ b/browser/themes/pinstripe/browser/browser.css
@ -924,8 +924,9 @@ statusbarpanel#statusbar-display {
 .ac-result-type-keyword,
 .autocomplete-treebody::-moz-tree-image(keyword, treecolAutoCompleteImage) {
  list-style-image: url(chrome://global/skin/icons/search-textbox.png);
-  width: 16px;
-  height: 16px;
+  margin: 2px;
+  width: 12px;
+  height: 12px;
 }

 richlistitem[selected="true"][current="true"] > hbox > .ac-result-type-bookmark,
@ -1515,7 +1516,7 @@ tabbrowser > tabbox {
  opacity: .6;
 }

-.tab-text {
+.tabbrowser-tab > .tab-text {
  margin-top: 3px;
  margin-bottom: 0;
  font: message-box;
@ -2124,63 +2125,143 @@ tabpanels.plain {
 }

 /* ::::: Keyboard UI Panel ::::: */
+
 .KUI-panel {
  -moz-appearance: none;
-  background: rgba(68, 68, 68, .9) url(KUI-background.png) repeat-x;
+  background: rgba(27%,27%,27%,.9) url(KUI-background.png) repeat-x;
  color: white;
-  border: 1px solid rgba(255, 255, 255, 0.15);
-  -moz-border-radius: 10px;
-  margin-top: -1px;
-  margin-left: -1px;
+  border: 1px solid rgba(100%,100%,100%,.15);
+  -moz-border-radius: 20px;
 }

-.KUI-panel[level="top"] ,
-#ctrlTab-panel:not([sticky]) {
-  background-color: rgba(68, 68, 68, .5);
+.KUI-panel[level="top"] {
+  background-color: rgba(27%,27%,27%,.65);
+  border-style: none;
  -moz-window-shadow: none;
 }

-/* ::::: Ctrl-Tab Panel ::::: */
+.KUI-panel-closebutton {
+  list-style-image: url(KUI-close.png);
+  -moz-appearance: none;
+  border: none;
+  padding: 0;
+  width: 24px;
+  height: 24px;
+}
+
+.KUI-panel-closebutton:not(:hover) {
+  opacity: .6;
+}
+
+.KUI-panel-closebutton > .toolbarbutton-icon {
+  margin: 0;
+}
+
+/* ::::: Ctrl-Tab and All Tabs Panels ::::: */
+
+.tabPreview-canvas {
+  -moz-box-shadow: 1px 1px 3px rgb(12%,12%,12%);
+}
+
+.ctrlTab-favicon-container,
+.allTabs-favicon-container {
+  -moz-box-pack: end;
+}
+
+.ctrlTab-favicon[src],
+.allTabs-favicon[src] {
+  background-color: white;
+  width: 24px;
+  height: 24px;
+  padding: 2px;
+  opacity: .7;
+}
+
+/* Ctrl-Tab */
+
 #ctrlTab-panel {
-  padding-top: 20px;
+  padding: 20px 10px 15px;
+  text-shadow: 0 0 1px rgb(27%,27%,27%), 0 0 3px rgb(27%,27%,27%);
+}
+
+.ctrlTab-preview:not(#ctrlTab-showAll) .ctrlTab-preview-inner {
+  padding-bottom: 2px;
+}
+
+.ctrlTab-preview:not(#ctrlTab-showAll) .tabPreview-canvas {
+  margin-bottom: 2px;
+}
+
+.ctrlTab-preview:focus:not(#ctrlTab-showAll) .ctrlTab-preview-inner {
+  background-color: #ccc;
+  color: black;
+  text-shadow: 0 0 1px white;
+  -moz-box-shadow: 0 0 0 1px rgba(255,255,255,.5), 0 0 5px 1px -moz-mac-focusring, 0 0 8px white;
+  padding: 2px;
+  margin: -2px -2px 0;
+}
+
+.ctrlTab-preview:focus .tabPreview-canvas {
+  -moz-box-shadow: none;
+}
+
+#ctrlTab-showAll {
+  -moz-appearance: button;
+  color: ButtonText;
+  text-shadow: none;
+  padding: 0 3px;
+  margin-top: 15px;
  font-size: 1.2em;
-  text-shadow: 0 0 3px black, 0 0 3px black;
 }

-#ctrlTab-search {
-  margin: 0 0 20px;
+#ctrlTab-showAll:focus {
+  -moz-box-shadow: 0 0 8px white;
+  -moz-border-radius: 100%;
 }

-.ctrlTab-thumbnail {
-  margin-bottom: 20px;
-  cursor: pointer;
-  font-weight: bold;
+/* All Tabs */
+
+#allTabs-panel {
+  padding: 10px;
+  margin-left: -10px;
 }

-.ctrlTab-thumbnail > html|canvas {
-  border: 2px solid white;
-  margin: -2px;
+#allTabs-panel:not(.KUI-panel) {
+  -moz-appearance: none;
+  background: rgb(27%,27%,27%) url(KUI-background.png) repeat-x;
+  border: none;
+  color: white;
 }

-.ctrlTab-thumbnail[selected="true"] ,
-.ctrlTab-thumbnail:hover {
-  background: Highlight;
-  color: HighlightText;
-  -moz-box-shadow: 0 0 2px Highlight, 0 0 2px Highlight, 0 0 3px Highlight, 0 0 4px Highlight, 0 0 10px Highlight, 0 0 20px white;
-  text-shadow: 0 0 3px transparent;
+#allTabs-meta {
+  margin-bottom: 10px;
 }

-.ctrlTab-pagePointer {
-  margin: 0 1em 1em;
-  width: 1.5em;
-  height: 1.5em;
-  -moz-border-radius: .75em;
-  background: rgba(0, 0, 0, .5);
-  border: 1px solid rgba(255, 255, 255, .3);
-  cursor: pointer;
+#allTabs-filter {
+  -moz-margin-start: 24px;
+  -moz-margin-end: 0;
 }

-.ctrlTab-pagePointer[selected="true"] {
-  background: rgba(255, 255, 255, .6);
-  cursor: default;
+#allTabs-tab-close-button {
+  /*XXX without this, the closebutton can cause the panel to expand horizontally */
+  margin-right: -16px;
+}
+
+#allTabs-tab-close-button > .toolbarbutton-icon {
+  margin: 0;
+}
+
+.allTabs-preview:hover,
+.allTabs-preview[closebuttonhover] {
+  background-color: rgba(100%,100%,100%,.15);
+  -moz-border-radius: 6px;
+}
+
+.allTabs-preview:focus {
+  background-color: rgba(100%,100%,100%,.3);
+  -moz-border-radius: 6px;
+}
+
+.allTabs-preview-label {
+  -moz-transform: translate(0, -1px);
 }
--- a/browser/themes/pinstripe/browser/jar.mn
+++ b/browser/themes/pinstripe/browser/jar.mn
@ -30,6 +30,7 @@ classic.jar:
  skin/classic/browser/identity.png
  skin/classic/browser/Info.png
  skin/classic/browser/KUI-background.png
+  skin/classic/browser/KUI-close.png
  skin/classic/browser/menu-back.png
  skin/classic/browser/menu-forward.png
  skin/classic/browser/page-livemarks.png
@ -110,8 +111,6 @@ classic.jar:
  skin/classic/browser/preferences/Options.png              (preferences/Options.png)
  skin/classic/browser/preferences/saveFile.png             (preferences/saveFile.png)
  skin/classic/browser/preferences/preferences.css          (preferences/preferences.css)
-  skin/classic/browser/preferences/panebutton-active.png    (preferences/panebutton-active.png)
-  skin/classic/browser/preferences/panebutton-inactive.png  (preferences/panebutton-inactive.png)
  skin/classic/browser/preferences/applications.css         (preferences/applications.css)
  skin/classic/browser/tabbrowser/alltabs-box-bkgnd-icon.png             (tabbrowser/alltabs-box-bkgnd-icon.png)
  skin/classic/browser/tabbrowser/alltabs-box-overflow-bkgnd-animate.png (tabbrowser/alltabs-box-overflow-bkgnd-animate.png)
--- a/browser/themes/pinstripe/browser/preferences/preferences.css
+++ b/browser/themes/pinstripe/browser/preferences/preferences.css
@ -39,14 +39,6 @@
 # ***** END LICENSE BLOCK *****
 */

-.prefWindow-dlgbuttons {
-  margin: 0 12px 8px;
-}
-
-#BrowserPreferences .prefWindow-dlgbuttons {
-  padding-top: 0 !important;
-}
-
 .windowDialog {
  padding: 12px;
  font: -moz-dialog;
@ -54,35 +46,6 @@

 .paneSelector {
  list-style-image: url("chrome://browser/skin/preferences/Options.png");
-  padding: 1px 4px;
-  -moz-appearance: -moz-mac-unified-toolbar;
-  margin: 0;
-}
-
-radio[pane] {
-  border: solid transparent;
-  border-width: 0 2px;
-  padding: 5px 4px 3px;
-  margin: 0;
-  -moz-appearance: none;
-  text-shadow: rgba(255, 255, 255, 0.4) 0 1px;
-}
-
-radio[pane]:active:hover {
-  text-shadow: none;
-}
-
-radio[pane][selected="true"] {
-  -moz-border-image: url("chrome://browser/skin/preferences/panebutton-active.png") 0 2 repeat stretch;
-}
-
-#BrowserPreferences:not([active="true"]) radio[pane][selected="true"] {
-  -moz-border-image: url("chrome://browser/skin/preferences/panebutton-inactive.png") 0 2 repeat stretch;
-}
-
-.paneButtonLabel {
-  margin: 0;
-  padding: 0;
 }

 /* ----- GENERAL BUTTON ----- */
@ -197,8 +160,9 @@ tabpanels {
 }

 caption {
-  border-bottom: 1px solid #ECECEC;
-  padding: 4px 4px 0px 0px !important;
+  -moz-padding-start: 5px;
+  padding-top: 4px;
+  padding-bottom: 2px;
 }

 #paneMain description,
@ -217,13 +181,17 @@ caption {
  -moz-box-align: center;
 }

-#popupPolicyRow, #enableSoftwareInstallRow, #enableImagesRow {
+#popupPolicyRow,
+#enableSoftwareInstallRow,
+#enableImagesRow {
  margin-bottom: 4px !important;
  padding-bottom: 4px !important;
  border-bottom: 1px solid #ccc;
 }

-#browserUseCurrent, #browserUseBookmark, #browserUseBlank {
+#browserUseCurrent,
+#browserUseBookmark,
+#browserUseBlank {
  margin-top: 10px;
 }

--- a/browser/themes/winstripe/browser/KUI-close.png
+++ b/browser/themes/winstripe/browser/KUI-close.png
--- a/browser/themes/winstripe/browser/browser-aero.css
+++ b/browser/themes/winstripe/browser/browser-aero.css
@ -63,17 +63,29 @@
  z-index: 10;
 }

+/*XXX Bug 473152 - Aero Glass clips panel content
+#allTabs-panel:-moz-system-metric(windows-compositor),*/
 #ctrlTab-panel:-moz-system-metric(windows-compositor) {
  background: transparent;
  -moz-appearance: -moz-win-glass;
  -moz-border-radius: 0;
  border: none;
-  font: "Segoe UI", window;
-  font-weight: normal;
+  font: normal 1.2em "Segoe UI";
  color: black;
  text-shadow: white -1px -1px .5em, white -1px 1px .5em, white 1px 1px .5em, white 1px -1px .5em;
 }

+/*XXX Bug 473152 - Aero Glass clips panel content
+.allTabs-preview:hover:-moz-system-metric(windows-compositor),
+.allTabs-preview[closebuttonhover]:-moz-system-metric(windows-compositor) {
+  background: rgba(0,0,0,.15) url(KUI-background.png) repeat-x;
+}
+
+.allTabs-preview:focus:-moz-system-metric(windows-compositor) {
+  background: rgba(0,0,0,.3) url(KUI-background.png) repeat-x;
+}
+*/
+
 /* ::::: fullscreen window controls ::::: */

 #window-controls {
--- a/browser/themes/winstripe/browser/browser.css
+++ b/browser/themes/winstripe/browser/browser.css
@ -1390,7 +1390,7 @@ tabpanels {
 }

 /* tabbrowser-tab focus ring */
-.tab-text {
+.tabbrowser-tab > .tab-text {
  border: 1px dotted transparent;
 }

@ -2022,63 +2022,138 @@ toolbarbutton.bookmark-item[dragover="true"][open="true"] {
 }

 /* ::::: Keyboard UI Panel ::::: */
+
 .KUI-panel {
  -moz-appearance: none;
-  background: rgba(68, 68, 68, .9) url(KUI-background.png) repeat-x;
+  background: rgba(27%,27%,27%,.9) url(KUI-background.png) repeat-x;
  color: white;
-  border: 1px solid rgba(255, 255, 255, 0.15);
-  -moz-border-radius: 10px;
-  margin-top: -1px;
-  margin-left: -1px;
+  border: 1px solid rgba(100%,100%,100%,.15);
+  -moz-border-radius: 20px;
 }

-.KUI-panel[level="top"] ,
-#ctrlTab-panel:not([sticky]) {
-  background-color: rgba(68, 68, 68, .5);
-  -moz-window-shadow: none;
+.KUI-panel[level="top"] {
+  background-color: rgba(27%,27%,27%,.65);
+  border-style: none;
 }

-/* ::::: Ctrl-Tab Panel ::::: */
+.KUI-panel-closebutton {
+  list-style-image: url(KUI-close.png);
+  -moz-appearance: none;
+  border: none;
+  padding: 0;
+  width: 24px;
+  height: 24px;
+}
+
+.KUI-panel-closebutton:not(:hover) {
+  opacity: .6;
+}
+
+.KUI-panel-closebutton > .toolbarbutton-icon {
+  margin: 0;
+}
+
+/* ::::: Ctrl-Tab and All Tabs Panels ::::: */
+
+.tabPreview-canvas {
+  -moz-box-shadow: 1px 1px 3px rgb(12%,12%,12%);
+}
+
+.ctrlTab-favicon[src],
+.allTabs-favicon[src] {
+  background-color: white;
+  width: 24px;
+  height: 24px;
+  padding: 2px;
+  opacity: .7;
+}
+
+/* Ctrl-Tab */
+
 #ctrlTab-panel {
-  padding-top: 20px;
-  font-size: 1.2em;
-  text-shadow: 0 0 3px black, 0 0 3px black, 0 0 3px black;
-}
-
-#ctrlTab-search {
-  margin: 0 0 20px;
-}
-
-.ctrlTab-thumbnail {
-  margin-bottom: 20px;
-  cursor: pointer;
+  padding: 20px 10px 15px;
  font-weight: bold;
+  text-shadow: 0 0 1px rgb(27%,27%,27%), 0 0 3px rgb(27%,27%,27%);
 }

-.ctrlTab-thumbnail > html|canvas {
-  border: 2px solid white;
-  margin: -2px;
+.ctrlTab-preview:not(#ctrlTab-showAll) .ctrlTab-preview-inner {
+  padding-bottom: 2px;
 }

-.ctrlTab-thumbnail[selected="true"] ,
-.ctrlTab-thumbnail:hover {
-  background: Highlight;
-  color: HighlightText;
-  -moz-box-shadow: 0 0 2px Highlight, 0 0 2px Highlight, 0 0 3px Highlight, 0 0 4px Highlight, 0 0 10px Highlight, 0 0 20px white;
-  text-shadow: 0 0 3px transparent;
+.ctrlTab-preview:not(#ctrlTab-showAll) .tabPreview-canvas {
+  margin-bottom: 2px;
 }

-.ctrlTab-pagePointer {
-  margin: 0 1em 1em;
-  width: 1.5em;
-  height: 1.5em;
-  -moz-border-radius: .75em;
-  background: rgba(0, 0, 0, .5);
-  border: 1px solid rgba(255, 255, 255, .3);
-  cursor: pointer;
+.ctrlTab-preview:focus:not(#ctrlTab-showAll) .ctrlTab-preview-inner {
+  background-color: #ccc;
+  color: black;
+  text-shadow: 0 0 1px white;
+  -moz-box-shadow: 0 0 0 1px rgba(255,255,255,.5), 0 0 5px 1px Highlight, 0 0 8px white;
+  padding: 2px;
+  margin: -2px -2px 0;
 }

-.ctrlTab-pagePointer[selected="true"] {
-  background: rgba(255, 255, 255, .6);
-  cursor: default;
+.ctrlTab-preview:focus .tabPreview-canvas {
+  -moz-box-shadow: none;
+}
+
+#ctrlTab-showAll {
+  -moz-appearance: button;
+  color: ButtonText;
+  font-weight: normal;
+  text-shadow: none;
+  padding: 3px 5px;
+  margin-top: 15px;
+}
+
+#ctrlTab-showAll:focus {
+  -moz-box-shadow: 0 0 8px white;
+  -moz-border-radius: 3px;
+}
+
+/* All Tabs */
+
+#allTabs-panel {
+  padding: 10px;
+  margin-left: -10px;
+}
+
+#allTabs-panel:not(.KUI-panel) {
+  -moz-appearance: none;
+  background: rgb(27%,27%,27%) url(KUI-background.png) repeat-x;
+  border: none;
+  color: white;
+}
+
+#allTabs-meta {
+  margin-bottom: 10px;
+}
+
+#allTabs-filter {
+  -moz-margin-start: 24px;
+  -moz-margin-end: 0;
+}
+
+#allTabs-tab-close-button {
+  /*XXX without this, the closebutton can cause the panel to expand horizontally */
+  margin-right: -16px;
+}
+
+#allTabs-tab-close-button > .toolbarbutton-icon {
+  margin: 0;
+}
+
+.allTabs-preview:hover,
+.allTabs-preview[closebuttonhover] {
+  background-color: rgba(100%,100%,100%,.15);
+  -moz-border-radius: 4px;
+}
+
+.allTabs-preview:focus {
+  background-color: rgba(100%,100%,100%,.3);
+  -moz-border-radius: 4px;
+}
+
+.allTabs-preview-label {
+  -moz-transform: translate(0, -1px);
 }
--- a/browser/themes/winstripe/browser/jar.mn
+++ b/browser/themes/winstripe/browser/jar.mn
@ -14,6 +14,7 @@ classic.jar:
        skin/classic/browser/Info.png                                (Info.png)
        skin/classic/browser/identity.png                            (identity.png)
        skin/classic/browser/KUI-background.png
+        skin/classic/browser/KUI-close.png
        skin/classic/browser/mainwindow-dropdown-arrow.png
        skin/classic/browser/pageInfo.css
        skin/classic/browser/pageInfo.png                            (pageInfo.png)
@ -106,6 +107,7 @@ classic.jar:
        skin/classic/aero/browser/Info.png                           (Info-aero.png)
        skin/classic/aero/browser/identity.png                       (identity-aero.png)
        skin/classic/aero/browser/KUI-background.png
+        skin/classic/aero/browser/KUI-close.png
        skin/classic/aero/browser/mainwindow-dropdown-arrow.png      (mainwindow-dropdown-arrow-aero.png)
        skin/classic/aero/browser/pageInfo.css
        skin/classic/aero/browser/pageInfo.png                       (pageInfo-aero.png)
--- a/build/automation-build.mk
+++ b/build/automation-build.mk
@ -24,7 +24,7 @@ endif
 _PROFILE_DIR = $(TARGET_DEPTH)/_profile/pgo
 _SYMBOLS_PATH = $(TARGET_DIST)/crashreporter-symbols

-ABSOLUTE_TOPSRCDIR = $(call core_abspath,$(topsrcdir))
+ABSOLUTE_TOPSRCDIR = $(call core_abspath,$(MOZILLA_DIR))
 _CERTS_SRC_DIR = $(ABSOLUTE_TOPSRCDIR)/build/pgo/certs

 AUTOMATION_PPARGS = 	\
@ -65,10 +65,10 @@ AUTOMATION_PPARGS += -DIS_DEBUG_BUILD=0
 endif

 $(CURDIR)/automationutils.py:
-	$(INSTALL) $(topsrcdir)/build/automationutils.py .
+	$(INSTALL) $(MOZILLA_DIR)/build/automationutils.py .

-automation.py: $(topsrcdir)/build/automation.py.in $(topsrcdir)/build/automation-build.mk $(CURDIR)/automationutils.py
-	$(PYTHON) $(topsrcdir)/config/Preprocessor.py \
+automation.py: $(MOZILLA_DIR)/build/automation.py.in $(MOZILLA_DIR)/build/automation-build.mk $(CURDIR)/automationutils.py
+	$(PYTHON) $(MOZILLA_DIR)/config/Preprocessor.py \
 	$(AUTOMATION_PPARGS) $(DEFINES) $(ACDEFINES) $< > $@

 GARBAGE += automation.py $(CURDIR)/automationutils.py
--- a/build/unix/mozilla.in
+++ b/build/unix/mozilla.in
@ -67,6 +67,8 @@ else
  while [ -h "$progname" ]; do
    bn=`basename "$progname"`
    cd `dirname "$progname"`
+    # Resolve symlink of dirname
+    cd `/bin/pwd`
    progname=`/bin/ls -l "$bn" | sed -e 's/^.* -> //' `
    progbase=`basename "$progname"`
    if [ ! -x "$progname" ]; then
@ -76,7 +78,7 @@ else
    run_moz="$curdir/run-mozilla.sh"
    if [ -x "$run_moz" ]; then
      cd "$curdir"
-      dist_bin=`pwd`
+      dist_bin=`/bin/pwd`
      run_moz="$dist_bin/run-mozilla.sh"
      found=1
      break
--- a/build/unix/run-mozilla.sh
+++ b/build/unix/run-mozilla.sh
@ -110,12 +110,12 @@ moz_get_debugger()
 	done="no"
 	for d in $debuggers
 	do
-		moz_test_binary /bin/type
+		moz_test_binary /bin/which
 		if [ $? -eq 1 ]
 		then
-			dpath=`LC_MESSAGES=C type ${d} | awk '{print $3;}' | sed -e 's/\.$//'`	
-		else 	
 			dpath=`which ${d}`	
+		else 	
+			dpath=`LC_MESSAGES=C type ${d} | awk '{print $3;}' | sed -e 's/\.$//'`	
 		fi
 		if [ -x "$dpath" ]
 		then
@ -156,12 +156,12 @@ moz_debug_program()
 	fi
 	if [ -n "$moz_debugger" ]
 	then
-		moz_test_binary /bin/type
+		moz_test_binary /bin/which
 		if [ $? -eq 1 ]
 		then	
-			debugger=`LC_MESSAGES=C type $moz_debugger | awk '{print $3;}' | sed -e 's/\.$//'` 
-		else
 			debugger=`which $moz_debugger` 
+		else
+			debugger=`LC_MESSAGES=C type $moz_debugger | awk '{print $3;}' | sed -e 's/\.$//'` 
 		fi	
 	else
 		debugger=`moz_get_debugger`
--- a/build/wince/tools/linkargs.c
+++ b/build/wince/tools/linkargs.c
@ -30,6 +30,12 @@ void addLinkArgs(int k, int s, int *i, int *j, char** args, char** argv) {
  args[(*i)++] = "/MAP";
  args[(*i)++] = "/MAPINFO:EXPORTS";

+  if (getenv("LOCK_DLLS") != NULL) {
+    // lock our dlls in memory
+    args[(*i)++] = "/SECTION:.text,\!P";
+    args[(*i)++] = "/SECTION:.rdata,\!P";
+  }
+
 #ifdef HAVE_SHUNT   // simple test to see if we're in configure or not
  if(getenv("NO_SHUNT") == NULL) {
    args[(*i)++] = "/LIBPATH:\"" SHUNT_LIB "\"";
--- a/config/Makefile.in
+++ b/config/Makefile.in
@ -48,12 +48,13 @@ include $(DEPTH)/config/autoconf.mk
 # headers, so that we can use it to set up the wrapped system headers.
 VISIBILITY_FLAGS =

-ifneq (,$(CROSS_COMPILE)$(filter-out WINNT OS2,$(OS_ARCH)))
-ifneq ($(OS_ARCH), WINCE)
 HOST_PROGRAM	= nsinstall$(HOST_BIN_SUFFIX)
+
+ifeq (WINNT,$(HOST_OS_ARCH))
+HOST_CSRCS	= nsinstall_win.c
+else
 HOST_CSRCS	= nsinstall.c pathsub.c
 endif
-endif

 PLSRCS		= nfspwd.pl

@ -90,6 +91,8 @@ NO_INSTALL=1

 include $(topsrcdir)/config/rules.mk

+HOST_CFLAGS += -DUNICODE -D_UNICODE
+
 ifeq ($(OS_CONFIG),SunOS4.1)
 NSPR_CFLAGS	+= -I$(srcdir)/../nsprpub/pr/include/md
 endif
--- a/config/config.mk
+++ b/config/config.mk
@ -785,15 +785,11 @@ endif
 ifdef NSINSTALL_BIN
 NSINSTALL	= $(CYGWIN_WRAPPER) $(NSINSTALL_BIN)
 else
-ifeq (WINNT,$(CROSS_COMPILE)$(OS_ARCH))
-NSINSTALL	= $(CYGWIN_WRAPPER) $(MOZ_TOOLS_DIR)/bin/nsinstall
-else
 ifeq (OS2,$(CROSS_COMPILE)$(OS_ARCH))
 NSINSTALL	= $(MOZ_TOOLS_DIR)/nsinstall
 else
 NSINSTALL	= $(CONFIG_TOOLS)/nsinstall
 endif # OS2
-endif # WINNT
 endif # NSINSTALL_BIN


--- a/config/makedep.cpp
+++ b/config/makedep.cpp
@ -49,7 +49,6 @@ int mainReturn = 0;
 BOOL b16 = FALSE;
 BOOL bSimple = FALSE;

-//	freopen won't work on stdout in win16
 FILE *pAltFile = stdout;

 CStringArray includeDirectories;
--- a/config/nsinstall_win.c
+++ b/config/nsinstall_win.c
@ -0,0 +1,708 @@
+/*
+ * The nsinstall command for Win32
+ *
+ * Our gmake makefiles use the nsinstall command to create the
+ * object directories or installing headers and libs. This code was originally
+ * taken from shmsdos.c
+ */
+
+#include <direct.h>
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
+#include <windows.h>
+#pragma hdrstop
+
+/*
+ * sh_FileFcn --
+ *
+ * A function that operates on a file.  The pathname is either
+ * absolute or relative to the current directory, and contains
+ * no wildcard characters such as * and ?.   Additional arguments
+ * can be passed to the function via the arg pointer.
+ */
+
+typedef BOOL (*sh_FileFcn)(
+        wchar_t *pathName,
+        WIN32_FIND_DATA *fileData,
+        void *arg);
+
+static int shellCp (wchar_t **pArgv); 
+static int shellNsinstall (wchar_t **pArgv);
+static int shellMkdir (wchar_t **pArgv); 
+static BOOL sh_EnumerateFiles(const wchar_t *pattern, const wchar_t *where,
+        sh_FileFcn fileFcn, void *arg, int *nFiles);
+static const char *sh_GetLastErrorMessage(void);
+static BOOL sh_DoCopy(wchar_t *srcFileName, DWORD srcFileAttributes,
+        wchar_t *dstFileName, DWORD dstFileAttributes,
+        int force, int recursive);
+
+#define LONGPATH_PREFIX L"\\\\?\\"
+#define ARRAY_LEN(a) (sizeof(a) / sizeof(a[0]))
+#define STR_LEN(a) (ARRAY_LEN(a) - 1)
+
+/* changes all forward slashes in token to backslashes */
+void changeForwardSlashesToBackSlashes ( wchar_t *arg )
+{
+    if ( arg == NULL )
+        return;
+
+    while ( *arg ) {
+        if ( *arg == '/' )
+            *arg = '\\';
+        arg++;
+    }
+}
+
+int wmain(int argc, wchar_t *argv[ ])
+{
+    return shellNsinstall ( argv + 1 );
+}
+
+static int
+shellNsinstall (wchar_t **pArgv)
+{
+    int retVal = 0;     /* exit status */
+    int dirOnly = 0;    /* 1 if and only if -D is specified */
+    wchar_t **pSrc;
+    wchar_t **pDst;
+
+    /*
+     * Process the command-line options.  We ignore the
+     * options except for -D.  Some options, such as -m,
+     * are followed by an argument.  We need to skip the
+     * argument too.
+     */
+    while ( *pArgv && **pArgv == '-' ) {
+        wchar_t c = (*pArgv)[1];  /* The char after '-' */
+
+        if ( c == 'D' ) {
+            dirOnly = 1;
+        } else if ( c == 'm' ) {
+            pArgv++;  /* skip the next argument */
+        }
+        pArgv++;
+    }
+
+    if ( !dirOnly ) {
+        /* There are files to install.  Get source files */
+        if ( *pArgv ) {
+            pSrc = pArgv++;
+        } else {
+            fprintf( stderr, "nsinstall: not enough arguments\n");
+            return 3;
+        }
+    }
+
+    /* Get to last token to find destination directory */
+    if ( *pArgv ) {
+        pDst = pArgv++;
+        if ( dirOnly && *pArgv ) {
+            fprintf( stderr, "nsinstall: too many arguments with -D\n");
+            return 3;
+        }
+    } else {
+        fprintf( stderr, "nsinstall: not enough arguments\n");
+        return 3;
+    }
+    while ( *pArgv ) 
+        pDst = pArgv++;
+
+    retVal = shellMkdir ( pDst );
+    if ( retVal )
+        return retVal;
+    if ( !dirOnly )
+        retVal = shellCp ( pSrc );
+    return retVal;
+}
+
+static int
+shellMkdir (wchar_t **pArgv) 
+{
+    int retVal = 0; /* assume valid return */
+    wchar_t *arg;
+    wchar_t *pArg;
+    wchar_t path[_MAX_PATH];
+    wchar_t tmpPath[_MAX_PATH];
+    wchar_t *pTmpPath = tmpPath;
+
+    /* All the options are simply ignored in this implementation */
+    while ( *pArgv && **pArgv == '-' ) {
+        if ( (*pArgv)[1] == 'm' ) {
+            pArgv++;  /* skip the next argument (mode) */
+        }
+        pArgv++;
+    }
+
+    while ( *pArgv ) {
+        arg = *pArgv;
+        changeForwardSlashesToBackSlashes ( arg );
+        pArg = arg;
+        pTmpPath = tmpPath;
+        while ( 1 ) {
+            /* create part of path */
+            while ( *pArg ) {
+                *pTmpPath++ = *pArg++;
+                if ( *pArg == '\\' )
+                    break;
+            }
+            *pTmpPath = '\0';
+
+            /* check if directory already exists */
+            _wgetcwd ( path, _MAX_PATH );
+            if ( _wchdir ( tmpPath ) != -1 ) {
+                _wchdir ( path );
+            } else {
+                if ( _wmkdir ( tmpPath ) == -1 ) {
+                    printf ( "%ls: ", tmpPath );
+                    perror ( "Could not create the directory" );
+                    retVal = 3;
+                    break;
+                }
+            }
+            if ( *pArg == '\0' )      /* complete path? */
+                break;
+            /* loop for next directory */
+        }
+
+        pArgv++;
+    }
+    return retVal;
+}
+
+static const char *
+sh_GetLastErrorMessage()
+{
+    static char buf[128];
+
+    FormatMessageA(
+            FORMAT_MESSAGE_FROM_SYSTEM,
+            NULL,
+            GetLastError(),
+            MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),  /* default language */
+            buf,
+            sizeof(buf),
+            NULL
+    );
+    return buf;
+}
+
+/*
+ * struct sh_FileData --
+ *
+ * A pointer to the sh_FileData structure is passed into sh_RecordFileData,
+ * which will fill in the fields.
+ */
+
+struct sh_FileData {
+    wchar_t pathName[_MAX_PATH];
+    DWORD dwFileAttributes;
+};
+
+/*
+ * sh_RecordFileData --
+ *
+ * Record the pathname and attributes of the file in
+ * the sh_FileData structure pointed to by arg.
+ *
+ * Always return TRUE (successful completion).
+ *
+ * This function is intended to be passed into sh_EnumerateFiles
+ * to see if a certain pattern expands to exactly one file/directory,
+ * and if so, record its pathname and attributes.
+ */
+
+static BOOL
+sh_RecordFileData(wchar_t *pathName, WIN32_FIND_DATA *findData, void *arg)
+{
+    struct sh_FileData *fData = (struct sh_FileData *) arg;
+
+    wcscpy(fData->pathName, pathName);
+    fData->dwFileAttributes = findData->dwFileAttributes;
+    return TRUE;
+}
+
+static BOOL
+sh_DoCopy(wchar_t *srcFileName,
+          DWORD srcFileAttributes,
+          wchar_t *dstFileName,
+          DWORD dstFileAttributes,
+          int force,
+          int recursive
+)
+{
+    if (dstFileAttributes != 0xFFFFFFFF) {
+        if ((dstFileAttributes & FILE_ATTRIBUTE_READONLY) && force) {
+            dstFileAttributes &= ~FILE_ATTRIBUTE_READONLY;
+            SetFileAttributes(dstFileName, dstFileAttributes);
+        }
+    }
+
+    if (srcFileAttributes & FILE_ATTRIBUTE_DIRECTORY) {
+        fprintf(stderr, "nsinstall: %ls is a directory\n",
+                srcFileName);
+        return FALSE;
+    } else {
+        DWORD r;
+        wchar_t longSrc[1004] = LONGPATH_PREFIX;
+        wchar_t longDst[1004] = LONGPATH_PREFIX;
+        r = GetFullPathName(srcFileName, 1000, longSrc + STR_LEN(LONGPATH_PREFIX), NULL);
+        if (!r) {
+            fprintf(stderr, "nsinstall: couldn't get full path of %ls: %s\n",
+                    srcFileName, sh_GetLastErrorMessage());
+            return FALSE;
+        }
+        r = GetFullPathName(dstFileName, 1000, longDst + ARRAY_LEN(LONGPATH_PREFIX) - 1, NULL);
+        if (!r) {
+            fprintf(stderr, "nsinstall: couldn't get full path of %ls: %s\n",
+                    dstFileName, sh_GetLastErrorMessage());
+            return FALSE;
+        }
+
+        if (!CopyFile(longSrc, longDst, FALSE)) {
+            fprintf(stderr, "nsinstall: cannot copy %ls to %ls: %s\n",
+                    srcFileName, dstFileName, sh_GetLastErrorMessage());
+            return FALSE;
+        }
+    }
+    return TRUE;
+}
+
+/*
+ * struct sh_CpCmdArg --
+ *
+ * A pointer to the sh_CpCmdArg structure is passed into sh_CpFileCmd.
+ * The sh_CpCmdArg contains information about the cp command, and
+ * provide a buffer for constructing the destination file name.
+ */
+
+struct sh_CpCmdArg {
+    int force;                /* -f option, ok to overwrite an existing
+                               * read-only destination file */
+    int recursive;            /* -r or -R option, recursively copy
+                               * directories. Note: this field is not used
+                               * by nsinstall and should always be 0. */
+    wchar_t *dstFileName;        /* a buffer for constructing the destination
+                               * file name */
+    wchar_t *dstFileNameMarker;  /* points to where in the dstFileName buffer
+                               * we should write the file component of the
+                               * destination file */
+};
+
+/*
+ * sh_CpFileCmd --
+ *
+ * Copy a file to the destination directory
+ * 
+ * This function is intended to be passed into sh_EnumerateFiles to
+ * copy all the files specified by the pattern to the destination
+ * directory.
+ *
+ * Return TRUE if the file is successfully copied, and FALSE otherwise.
+ */
+
+static BOOL
+sh_CpFileCmd(wchar_t *pathName, WIN32_FIND_DATA *findData, void *cpArg)
+{
+    BOOL retVal = TRUE;
+    struct sh_CpCmdArg *arg = (struct sh_CpCmdArg *) cpArg;
+
+    wcscpy(arg->dstFileNameMarker, findData->cFileName);
+    return sh_DoCopy(pathName, findData->dwFileAttributes,
+            arg->dstFileName, GetFileAttributes(arg->dstFileName),
+            arg->force, arg->recursive);
+}
+
+static int
+shellCp (wchar_t **pArgv) 
+{
+    int retVal = 0;
+    wchar_t **pSrc;
+    wchar_t **pDst;
+    struct sh_CpCmdArg arg;
+    struct sh_FileData dstData;
+    int dstIsDir = 0;
+    int n;
+
+    arg.force = 0;
+    arg.recursive = 0;
+    arg.dstFileName = dstData.pathName;
+    arg.dstFileNameMarker = 0;
+
+    while (*pArgv && **pArgv == '-') {
+        wchar_t *p = *pArgv;
+
+        while (*(++p)) {
+            if (*p == 'f') {
+                arg.force = 1;
+            }
+        }
+        pArgv++;
+    }
+
+    /* the first source file */
+    if (*pArgv) {
+        pSrc = pArgv++;
+    } else {
+        fprintf(stderr, "nsinstall: not enough arguments\n");
+        return 3;
+    }
+
+    /* get to the last token to find destination */
+    if (*pArgv) {
+        pDst = pArgv++;
+    } else {
+        fprintf(stderr, "nsinstall: not enough arguments\n");
+        return 3;
+    }
+    while (*pArgv) {
+        pDst = pArgv++;
+    }
+
+    /*
+     * The destination pattern must unambiguously expand to exactly
+     * one file or directory.
+     */
+
+    changeForwardSlashesToBackSlashes(*pDst);
+    sh_EnumerateFiles(*pDst, *pDst, sh_RecordFileData, &dstData, &n);
+    assert(n >= 0);
+    if (n == 1) {
+        /*
+         * Is the destination a file or directory?
+         */
+
+        if (dstData.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) {
+            dstIsDir = 1;
+        }
+    } else if (n > 1) {
+        fprintf(stderr, "nsinstall: %ls: ambiguous destination file "
+                "or directory\n", *pDst);
+        return 3;
+    } else {
+        /*
+         * n == 0, meaning that destination file or directory does
+         * not exist.  In this case the destination file directory
+         * name must be fully specified.
+         */
+
+        wchar_t *p;
+
+        for (p = *pDst; *p; p++) {
+            if (*p == '*' || *p == '?') {
+                fprintf(stderr, "nsinstall: %ls: No such file or directory\n",
+                        *pDst);
+                return 3;
+            }
+        }
+
+        /*
+         * Do not include the trailing \, if any, unless it is a root
+         * directory (\ or X:\).
+         */
+
+        if (p > *pDst && p[-1] == '\\' && p != *pDst + 1 && p[-2] != ':') {
+            p[-1] = '\0';
+        }
+        wcscpy(dstData.pathName, *pDst);
+        dstData.dwFileAttributes = 0xFFFFFFFF;
+    }
+
+    /*
+     * If there are two or more source files, the destination has
+     * to be a directory.
+     */
+
+    if (pDst - pSrc > 1 && !dstIsDir) {
+        fprintf(stderr, "nsinstall: cannot copy more than"
+                " one file to the same destination file\n");
+        return 3;
+    }
+
+    if (dstIsDir) {
+        arg.dstFileNameMarker = arg.dstFileName + wcslen(arg.dstFileName);
+
+        /*
+         * Now arg.dstFileNameMarker is pointing to the null byte at the
+         * end of string.  We want to make sure that there is a \ at the
+         * end of string, and arg.dstFileNameMarker should point right
+         * after that \. 
+         */
+
+        if (arg.dstFileNameMarker[-1] != '\\') {
+            *(arg.dstFileNameMarker++) = '\\';
+        }
+    }
+    
+    if (!dstIsDir) {
+        struct sh_FileData srcData;
+
+        assert(pDst - pSrc == 1);
+        changeForwardSlashesToBackSlashes(*pSrc);
+        sh_EnumerateFiles(*pSrc, *pSrc, sh_RecordFileData, &srcData, &n);
+        if (n == 0) {
+            fprintf(stderr, "nsinstall: %ls: No such file or directory\n",
+                    *pSrc);
+            retVal = 3;
+        } else if (n > 1) {
+            fprintf(stderr, "nsinstall: cannot copy more than one file or "
+                    "directory to the same destination\n");
+            retVal = 3;
+        } else {
+            assert(n == 1);
+            if (sh_DoCopy(srcData.pathName, srcData.dwFileAttributes,
+                    dstData.pathName, dstData.dwFileAttributes,
+                    arg.force, arg.recursive) == FALSE) {
+                retVal = 3;
+            }
+        }
+        return retVal;
+    }
+
+    for ( ; *pSrc != *pDst; pSrc++) {
+        BOOL rv;
+
+        changeForwardSlashesToBackSlashes(*pSrc);
+        rv = sh_EnumerateFiles(*pSrc, *pSrc, sh_CpFileCmd, &arg, &n);
+        if (rv == FALSE) {
+            retVal = 3;
+        } else {
+            if (n == 0) {
+                fprintf(stderr, "nsinstall: %ls: No such file or directory\n",
+                        *pSrc);
+                retVal = 3;
+            }
+        }
+    }
+
+    return retVal;
+}
+
+/*
+ * sh_EnumerateFiles --
+ *
+ * Enumerate all the files in the specified pattern, which is a pathname
+ * containing possibly wildcard characters such as * and ?.  fileFcn
+ * is called on each file, passing the expanded file name, a pointer
+ * to the file's WIN32_FILE_DATA, and the arg pointer.
+ * 
+ * It is assumed that there are no wildcard characters before the
+ * character pointed to by 'where'.
+ *
+ * On return, *nFiles stores the number of files enumerated.  *nFiles is
+ * set to this number whether sh_EnumerateFiles or 'fileFcn' succeeds
+ * or not.
+ *
+ * Return TRUE if the files are successfully enumerated and all
+ * 'fileFcn' invocations succeeded.  Return FALSE if something went
+ * wrong.
+ */
+
+static BOOL sh_EnumerateFiles(
+        const wchar_t *pattern,
+        const wchar_t *where,
+        sh_FileFcn fileFcn,
+        void *arg,
+        int *nFiles
+        )
+{
+    WIN32_FIND_DATA fileData;
+    HANDLE hSearch;
+    const wchar_t *src;
+    wchar_t *dst;
+    wchar_t fileName[_MAX_PATH];
+    wchar_t *fileNameMarker = fileName;
+    wchar_t *oldFileNameMarker;
+    BOOL hasWildcard = FALSE;
+    BOOL retVal = TRUE;
+    BOOL patternEndsInDotStar = FALSE;
+    BOOL patternEndsInDot = FALSE;  /* a special case of
+                                     * patternEndsInDotStar */
+    int numDotsInPattern;
+    int len;
+    
+    /*
+     * Windows expands patterns ending in ".", ".*", ".**", etc.
+     * differently from the glob expansion on Unix.  For example,
+     * both "foo." and "foo.*" match "foo", and "*.*" matches
+     * everything, including filenames with no dots.  So we need
+     * to throw away extra files returned by the FindNextFile()
+     * function.  We require that a matched filename have at least
+     * the number of dots in the pattern.
+     */
+    len = wcslen(pattern);
+    if (len >= 2) {
+        /* Start from the end of pattern and go backward */
+        const wchar_t *p = &pattern[len - 1];
+
+        /* We can have zero or more *'s */
+        while (p >= pattern && *p == '*') {
+            p--;
+        }
+        if (p >= pattern && *p == '.') {
+            patternEndsInDotStar = TRUE;
+            if (p == &pattern[len - 1]) {
+                patternEndsInDot = TRUE;
+            }
+            p--;
+            numDotsInPattern = 1;
+            while (p >= pattern && *p != '\\') {
+                if (*p == '.') {
+                    numDotsInPattern++;
+                }
+                p--;
+            }
+        }
+    }
+
+    *nFiles = 0;
+
+    /*
+     * Copy pattern to fileName, but only up to and not including
+     * the first \ after the first wildcard letter.
+     *
+     * Make fileNameMarker point to one of the following:
+     * - the start of fileName, if fileName does not contain any \.
+     * - right after the \ before the first wildcard letter, if there is
+     *   a wildcard character.
+     * - right after the last \, if there is no wildcard character.
+     */
+
+    dst = fileName;
+    src = pattern;
+    while (src < where) {
+        if (*src == '\\') {
+            oldFileNameMarker = fileNameMarker;
+            fileNameMarker = dst + 1;
+        }
+        *(dst++) = *(src++);
+    }
+
+    while (*src && *src != '*' && *src != '?') {
+        if (*src == '\\') {
+            oldFileNameMarker = fileNameMarker;
+            fileNameMarker = dst + 1;
+        }
+        *(dst++) = *(src++);
+    }
+
+    if (*src) {
+        /*
+         * Must have seen the first wildcard letter
+         */
+
+        hasWildcard = TRUE;
+        while (*src && *src != '\\') {
+            *(dst++) = *(src++);
+        }
+    }
+    
+    /* Now src points to either null or \ */
+
+    assert(*src == '\0' || *src == '\\');
+    assert(hasWildcard || *src == '\0');
+    *dst = '\0';
+
+    /*
+     * If the pattern does not contain any wildcard characters, then
+     * we don't need to go the FindFirstFile route.
+     */
+
+    if (!hasWildcard) {
+        /*
+         * See if it is the root directory, \, or X:\.
+         */
+
+        assert(!wcscmp(fileName, pattern));
+        assert(wcslen(fileName) >= 1);
+        if (dst[-1] == '\\' && (dst == fileName + 1 || dst[-2] == ':')) {
+            fileData.cFileName[0] = '\0';
+        } else {
+            /*
+             * Do not include the trailing \, if any
+             */
+
+            if (dst[-1] == '\\') {
+                assert(*fileNameMarker == '\0');
+                dst[-1] = '\0';
+                fileNameMarker = oldFileNameMarker;
+            } 
+            wcscpy(fileData.cFileName, fileNameMarker);
+        }
+        fileData.dwFileAttributes = GetFileAttributes(fileName);
+        if (fileData.dwFileAttributes == 0xFFFFFFFF) {
+            return TRUE;
+        }
+        *nFiles = 1;
+        return (*fileFcn)(fileName, &fileData, arg);
+    }
+
+    hSearch = FindFirstFile(fileName, &fileData);
+    if (hSearch == INVALID_HANDLE_VALUE) {
+        return retVal;
+    }
+
+    do {
+        if (!wcscmp(fileData.cFileName, L".")
+                || !wcscmp(fileData.cFileName, L"..")) {
+            /* 
+             * Skip over . and ..
+             */
+
+            continue;
+        }
+
+        if (patternEndsInDotStar) {
+            int nDots = 0;
+            wchar_t *p = fileData.cFileName;
+            while (*p) {
+                if (*p == '.') {
+                    nDots++;
+                }
+                p++;
+            }
+            /* Now p points to the null byte at the end of file name */
+            if (patternEndsInDot && (p == fileData.cFileName
+                    || p[-1] != '.')) {
+                /*
+                 * File name does not end in dot.  Skip this file.
+                 * Note: windows file name probably cannot end in dot,
+                 * but we do this check anyway.
+                 */
+                continue;
+            }
+            if (nDots < numDotsInPattern) {
+                /*
+                 * Not enough dots in file name.  Must be an extra
+                 * file in matching .* pattern.  Skip this file.
+                 */
+                continue;
+            }
+        }
+
+        wcscpy(fileNameMarker, fileData.cFileName);
+        if (*src && *(src + 1)) {
+            /*
+             * More to go.  Recurse.
+             */
+
+            int n;
+
+            assert(*src == '\\');
+            where = fileName + wcslen(fileName);
+            wcscat(fileName, src);
+            sh_EnumerateFiles(fileName, where, fileFcn, arg, &n);
+            *nFiles += n;
+        } else {
+            assert(wcschr(fileName, '*') == NULL);
+            assert(wcschr(fileName, '?') == NULL);
+            (*nFiles)++;
+            if ((*fileFcn)(fileName, &fileData, arg) == FALSE) {
+                retVal = FALSE;
+            }
+        }
+    } while (FindNextFile(hSearch, &fileData));
+
+    FindClose(hSearch);
+    return retVal;
+}
--- a/config/rules.mk
+++ b/config/rules.mk
@ -139,8 +139,8 @@ endif
 testxpcobjdir = $(DEPTH)/_tests/xpcshell

 # Test file installation
-ifdef NSINSTALL_BIN
-# nsinstall in moztools can't recursively copy directories, so use nsinstall.py
+ifneq (,$(filter WINNT os2-emx,$(HOST_OS_ARCH)))
+# Windows and OS/2 nsinstall can't recursively copy directories, so use nsinstall.py
 TEST_INSTALLER = $(PYTHON) $(topsrcdir)/config/nsinstall.py
 else
 TEST_INSTALLER = $(INSTALL)
@ -337,7 +337,7 @@ endif # SHARED_LIBRARY_NAME
 endif # MOZ_MAPINFO

 ifdef DEFFILE
-OS_LDFLAGS += -DEF:$(DEFFILE)
+OS_LDFLAGS += -DEF:$(call normalizepath,$(DEFFILE))
 EXTRA_DEPS += $(DEFFILE)
 endif

--- a/configure.in
+++ b/configure.in
@ -822,12 +822,9 @@ if test -z "$PYTHON"; then
    AC_MSG_ERROR([python was not found in \$PATH])
 fi

-MOZ_PATH_PROGS(NSINSTALL_BIN, nsinstall )
 if test -z "$COMPILE_ENVIRONMENT"; then
-if test -z "$NSINSTALL_BIN" || test "$NSINSTALL_BIN" = ":"; then
    NSINSTALL_BIN='$(PYTHON) $(topsrcdir)/config/nsinstall.py'
 fi
-fi
 AC_SUBST(NSINSTALL_BIN)

 MOZ_PATH_PROG(DOXYGEN, doxygen, :)
@ -2162,9 +2159,6 @@ case "$target" in
        MKSHLIB_FORCE_ALL=
        MKSHLIB_UNFORCE_ALL=
        DSO_LDOPTS=-SUBSYSTEM:WINDOWS
-        _USE_CPP_INCLUDE_FLAG=1
-        _DEFINES_CFLAGS='-FI mozilla-config.h -DMOZILLA_CLIENT'
-        _DEFINES_CXXFLAGS='-FI mozilla-config.h -DMOZILLA_CLIENT'
        CFLAGS="$CFLAGS -W3 -Gy -Fd\$(COMPILE_PDBFILE)"
        CXXFLAGS="$CXXFLAGS -W3 -Gy -Fd\$(COMPILE_PDBFILE)"
        LIBS="$LIBS kernel32.lib user32.lib gdi32.lib winmm.lib wsock32.lib advapi32.lib"
@ -2888,7 +2882,24 @@ else
    AC_MSG_RESULT(no)
 fi

-AC_LANG_C
+AC_LANG_CPLUSPLUS
+
+dnl Check for usable char16_t (2 bytes, unsigned)
+dnl (we might not need the unsignedness check anymore)
+AC_CACHE_CHECK(for usable char16_t (2 bytes, unsigned),
+    ac_cv_have_usable_char16_t,
+    [AC_TRY_COMPILE([$configure_static_assert_macros],
+                    [CONFIGURE_STATIC_ASSERT(sizeof(char16_t) == 2);
+                     CONFIGURE_STATIC_ASSERT(char16_t(-1) > char16_t(0));
+                     CONFIGURE_STATIC_ASSERT(sizeof((u"hello")[0]) == 2);
+                     CONFIGURE_STATIC_ASSERT(sizeof(u'a') == 2);
+                     CONFIGURE_STATIC_ASSERT(u'\xFFFF' > u'\x0')],
+                    ac_cv_have_usable_char16_t="yes",
+                    ac_cv_have_usable_char16_t="no")])
+if test "$ac_cv_have_usable_char16_t" = "yes"; then
+    AC_DEFINE(HAVE_CPP_CHAR16_T)
+    HAVE_CPP_CHAR16_T=1
+fi

 dnl Check for usable wchar_t (2 bytes, unsigned)
 dnl (we really don't need the unsignedness check anymore)
@ -2905,15 +2916,13 @@ AC_CACHE_CHECK(for usable wchar_t (2 bytes, unsigned),
 if test "$ac_cv_have_usable_wchar_v2" = "yes"; then
    AC_DEFINE(HAVE_CPP_2BYTE_WCHAR_T)
    HAVE_CPP_2BYTE_WCHAR_T=1
-else
+elif test "$ac_cv_have_usable_char16_t" != "yes"; then
 dnl This is really gcc-only
 dnl Do this test using CXX only since some versions of gcc
 dnl 2.95-2.97 have a signed wchar_t in c++ only and some versions
 dnl only have short-wchar support for c++.
 dnl Note that we assume that mac & win32 have short wchar (see nscore.h)

-    AC_LANG_SAVE
-    AC_LANG_CPLUSPLUS
    _SAVE_CXXFLAGS=$CXXFLAGS
    CXXFLAGS="$CXXFLAGS -fshort-wchar"

@ -2933,9 +2942,10 @@ dnl Note that we assume that mac & win32 have short wchar (see nscore.h)
    else    
        CXXFLAGS=$_SAVE_CXXFLAGS
    fi
-    AC_LANG_RESTORE
 fi

+AC_LANG_C
+
 dnl Check for .hidden assembler directive and visibility attribute.
 dnl Borrowed from glibc configure.in
 dnl ===============================================================
@ -4575,7 +4585,6 @@ case "$target_os" in
        if test -z "$GNU_CC"; then 
            XPC_IDISPATCH_SUPPORT=1
            MOZ_NO_ACTIVEX_SUPPORT=
-            MOZ_ACTIVEX_SCRIPTING_SUPPORT=1
        fi
        ;;
 esac
@ -6074,11 +6083,11 @@ MOZ_ARG_DISABLE_BOOL(activex,
    MOZ_NO_ACTIVEX_SUPPORT= )
 AC_SUBST(MOZ_NO_ACTIVEX_SUPPORT)

-MOZ_ARG_DISABLE_BOOL(activex-scripting,
-[  --disable-activex-scripting
-                          Disable building of ActiveX scripting support (win32)],
-    MOZ_ACTIVEX_SCRIPTING_SUPPORT=,
-    MOZ_ACTIVEX_SCRIPTING_SUPPORT=1)
+MOZ_ARG_ENABLE_BOOL(activex-scripting,
+[  --enable-activex-scripting
+                          Enable building of ActiveX scripting support (win32)],
+    MOZ_ACTIVEX_SCRIPTING_SUPPORT=1,
+    MOZ_ACTIVEX_SCRIPTING_SUPPORT=)
 AC_SUBST(MOZ_ACTIVEX_SCRIPTING_SUPPORT)

 if test -n "$MOZ_NO_ACTIVEX_SUPPORT" -a -n "$MOZ_ACTIVEX_SCRIPTING_SUPPORT";
@ -7383,12 +7392,9 @@ if test "$_cpp_md_flag"; then
  fi
 else
  COMPILER_DEPEND=
-  dnl Don't override this for MSVC
-  if test -z "$_WIN32_MSVC"; then
-    _USE_CPP_INCLUDE_FLAG=
-    _DEFINES_CFLAGS='$(ACDEFINES) -D_MOZILLA_CONFIG_H_ -DMOZILLA_CLIENT'
-    _DEFINES_CXXFLAGS='$(ACDEFINES) -D_MOZILLA_CONFIG_H_ -DMOZILLA_CLIENT'
-  fi
+  _USE_CPP_INCLUDE_FLAG=
+  _DEFINES_CFLAGS='$(ACDEFINES) -D_MOZILLA_CONFIG_H_ -DMOZILLA_CLIENT'
+  _DEFINES_CXXFLAGS='$(ACDEFINES) -D_MOZILLA_CONFIG_H_ -DMOZILLA_CLIENT'
 fi
 fi # MOZ_AUTO_DEPS
 MDDEPDIR='.deps'
@ -7945,6 +7951,8 @@ if test "$NECKO_WIFI"; then
    AC_CHECK_HEADER([iwlib.h])
    if test "$ac_cv_header_iwlib_h" = "yes"; then
      NECKO_WIFI=1
+    else
+      AC_MSG_ERROR([Can't find header iwlib.h for Necko WiFi scanning (might be in package libiw-dev (Ubuntu) or wireless-tools-devel (Fedora)); use --disable-necko-wifi to disable])
    fi
  elif test "$OS_ARCH" = "Darwin"; then
    NECKO_WIFI=1
@ -8396,6 +8404,7 @@ HAVE_CPP_2BYTE_WCHAR_T
 HAVE_CPP_ACCESS_CHANGING_USING
 HAVE_CPP_AMBIGUITY_RESOLVING_USING
 HAVE_CPP_BOOL
+HAVE_CPP_CHAR16_T
 HAVE_CPP_DYNAMIC_CAST_TO_VOID_PTR
 HAVE_CPP_EXPLICIT
 HAVE_CPP_MODERN_SPECIALIZE_TEMPLATE_SYNTAX
--- a/content/base/public/nsContentUtils.h
+++ b/content/base/public/nsContentUtils.h
@ -78,12 +78,12 @@ class nsIThreadJSContextStack;
 class nsIParserService;
 class nsIIOService;
 class nsIURI;
+class imgIContainer;
 class imgIDecoderObserver;
 class imgIRequest;
 class imgILoader;
 class imgICache;
 class nsIPrefBranch;
-class nsIImage;
 class nsIImageLoadingContent;
 class nsIDOMHTMLFormElement;
 class nsIDOMDocument;
@ -654,13 +654,13 @@ public:
  static PRBool IsImageInCache(nsIURI* aURI);

  /**
-   * Method to get an nsIImage from an image loading content
+   * Method to get an imgIContainer from an image loading content
   *
   * @param aContent The image loading content.  Must not be null.
   * @param aRequest The image request [out]
-   * @return the nsIImage corresponding to the first frame of the image
+   * @return the imgIContainer corresponding to the first frame of the image
   */
-  static already_AddRefed<nsIImage> GetImageFromContent(nsIImageLoadingContent* aContent, imgIRequest **aRequest = nsnull);
+  static already_AddRefed<imgIContainer> GetImageFromContent(nsIImageLoadingContent* aContent, imgIRequest **aRequest = nsnull);

  /**
   * Method that decides whether a content node is draggable
--- a/content/base/src/nsAttrAndChildArray.cpp
+++ b/content/base/src/nsAttrAndChildArray.cpp
@ -768,16 +768,14 @@ nsAttrAndChildArray::GrowBy(PRUint32 aGrowSize)
    size = PR_BIT(PR_CeilingLog2(minSize));
  }

-  Impl* newImpl = static_cast<Impl*>
-                             (mImpl ? PR_Realloc(mImpl, size * sizeof(void*)) :
-              PR_Malloc(size * sizeof(void*)));
+  PRBool needToInitialize = !mImpl;
+  Impl* newImpl = static_cast<Impl*>(PR_Realloc(mImpl, size * sizeof(void*)));
  NS_ENSURE_TRUE(newImpl, PR_FALSE);

-  Impl* oldImpl = mImpl;
  mImpl = newImpl;

  // Set initial counts if we didn't have a buffer before
-  if (!oldImpl) {
+  if (needToInitialize) {
    mImpl->mMappedAttrs = nsnull;
    SetAttrSlotAndChildCount(0, 0);
  }
--- a/content/base/src/nsContentAreaDragDrop.cpp
+++ b/content/base/src/nsContentAreaDragDrop.cpp
@ -80,7 +80,6 @@
 #include "nsINameSpaceManager.h"
 #include "nsUnicharUtils.h"
 #include "nsIURL.h"
-#include "nsIImage.h"
 #include "nsIDocument.h"
 #include "nsIScriptSecurityManager.h"
 #include "nsIPrincipal.h"
@ -93,6 +92,7 @@
 #include "nsEscape.h"
 #include "nsContentUtils.h"
 #include "nsIMIMEService.h"
+#include "imgIContainer.h"
 #include "imgIRequest.h"
 #include "nsContentCID.h"
 #include "nsDOMDataTransfer.h"
@ -171,7 +171,7 @@ private:
  nsString mInfoString;

  PRBool mIsAnchor;
-  nsCOMPtr<nsIImage> mImage;
+  nsCOMPtr<imgIContainer> mImage;
 };


@ -972,7 +972,7 @@ nsTransferableFactory::Produce(nsDOMDataTransfer* aDataTransfer,
        nsCOMPtr<imgIRequest> imgRequest;

        // grab the image data, and its request.
-        nsCOMPtr<nsIImage> img =
+        nsCOMPtr<imgIContainer> img =
          nsContentUtils::GetImageFromContent(image,
                                              getter_AddRefs(imgRequest));

--- a/content/base/src/nsContentAreaDragDrop.h
+++ b/content/base/src/nsContentAreaDragDrop.h
@ -53,7 +53,6 @@ class nsIDOMDocument;
 class nsIDOMDragEvent;
 class nsISelection;
 class nsITransferable;
-class nsIImage;
 class nsIPresShell;
 class nsPresContext;
 class nsIContent;
--- a/content/base/src/nsContentSink.cpp
+++ b/content/base/src/nsContentSink.cpp
@ -1560,7 +1560,7 @@ nsContentSink::DidProcessATokenImpl()
    nsIViewManager* vm = shell->GetViewManager();
    NS_ENSURE_TRUE(vm, NS_ERROR_FAILURE);
    nsCOMPtr<nsIWidget> widget;
-    vm->GetWidget(getter_AddRefs(widget));
+    vm->GetRootWidget(getter_AddRefs(widget));
    mHasPendingEvent = widget && widget->HasPendingInputEvent();
  }

--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@ -98,8 +98,6 @@
 #include "imgIRequest.h"
 #include "imgIContainer.h"
 #include "imgILoader.h"
-#include "nsIImage.h"
-#include "gfxIImageFrame.h"
 #include "nsIImageLoadingContent.h"
 #include "nsIInterfaceRequestor.h"
 #include "nsIInterfaceRequestorUtils.h"
@ -2446,7 +2444,7 @@ nsContentUtils::LoadImage(nsIURI* aURI, nsIDocument* aLoadingDocument,
 }

 // static
-already_AddRefed<nsIImage>
+already_AddRefed<imgIContainer>
 nsContentUtils::GetImageFromContent(nsIImageLoadingContent* aContent,
                                    imgIRequest **aRequest)
 {
@ -2470,26 +2468,11 @@ nsContentUtils::GetImageFromContent(nsIImageLoadingContent* aContent,
    return nsnull;
  }

-  nsCOMPtr<gfxIImageFrame> imgFrame;
-  imgContainer->GetFrameAt(0, getter_AddRefs(imgFrame));
-
-  if (!imgFrame) {
-    return nsnull;
-  }
-
-  nsCOMPtr<nsIInterfaceRequestor> ir = do_QueryInterface(imgFrame);
-
-  if (!ir) {
-    return nsnull;
-  }
-
  if (aRequest) {
    imgRequest.swap(*aRequest);
  }

-  nsIImage* image = nsnull;
-  CallGetInterface(ir.get(), &image);
-  return image;
+  return imgContainer.forget();
 }

 // static
--- a/content/base/src/nsCopySupport.cpp
+++ b/content/base/src/nsCopySupport.cpp
@ -49,6 +49,7 @@
 #include "nsXPCOM.h"
 #include "nsISupportsPrimitives.h"
 #include "nsIDOMRange.h"
+#include "imgIContainer.h"

 #include "nsIDocShell.h"
 #include "nsIContentViewerEdit.h"
@ -65,7 +66,6 @@
 // image copy stuff
 #include "nsIImageLoadingContent.h"
 #include "nsIInterfaceRequestorUtils.h"
-#include "nsIImage.h"
 #include "nsContentUtils.h"
 #include "nsContentCID.h"

@ -463,7 +463,7 @@ nsCopySupport::ImageCopy(nsIImageLoadingContent* aImageElement,

  if (aCopyFlags & nsIContentViewerEdit::COPY_IMAGE_DATA) {
    // get the image data from the element
-    nsCOMPtr<nsIImage> image =
+    nsCOMPtr<imgIContainer> image =
      nsContentUtils::GetImageFromContent(aImageElement);
    NS_ENSURE_TRUE(image, NS_ERROR_FAILURE);

--- a/content/base/src/nsGenericElement.cpp
+++ b/content/base/src/nsGenericElement.cpp
@ -1753,10 +1753,6 @@ nsGenericElement::nsDOMSlots::nsDOMSlots(PtrBits aFlags)

 nsGenericElement::nsDOMSlots::~nsDOMSlots()
 {
-  if (mStyle) {
-    mStyle->DropReference();
-  }
-
  if (mAttributeMap) {
    mAttributeMap->DropReference();
  }
@ -4057,7 +4053,12 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsGenericElement)
  {
    nsDOMSlots *slots = tmp->GetExistingDOMSlots();
    if (slots) {
+      NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "slots mStyle");
+      cb.NoteXPCOMChild(slots->mStyle.get());
+
+      NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "slots mAttributeMap");
      cb.NoteXPCOMChild(slots->mAttributeMap.get());
+
      if (tmp->IsNodeOfType(nsINode::eXUL))
        cb.NoteXPCOMChild(slots->mControllers);
      cb.NoteXPCOMChild(
--- a/content/base/src/nsImageLoadingContent.cpp
+++ b/content/base/src/nsImageLoadingContent.cpp
@ -55,7 +55,6 @@
 #include "nsIURI.h"
 #include "nsILoadGroup.h"
 #include "imgIContainer.h"
-#include "gfxIImageFrame.h"
 #include "imgILoader.h"
 #include "nsThreadUtils.h"
 #include "nsNetUtil.h"
@ -158,10 +157,9 @@ nsImageLoadingContent::~nsImageLoadingContent()
 */
 NS_IMETHODIMP
 nsImageLoadingContent::FrameChanged(imgIContainer* aContainer,
-                                    gfxIImageFrame* aFrame,
                                    nsIntRect* aDirtyRect)
 {
-  LOOP_OVER_OBSERVERS(FrameChanged(aContainer, aFrame, aDirtyRect));
+  LOOP_OVER_OBSERVERS(FrameChanged(aContainer, aDirtyRect));
  return NS_OK;
 }
            
@ -196,7 +194,7 @@ nsImageLoadingContent::OnStartContainer(imgIRequest* aRequest,

 NS_IMETHODIMP
 nsImageLoadingContent::OnStartFrame(imgIRequest* aRequest,
-                                    gfxIImageFrame* aFrame)
+                                    PRUint32 aFrame)
 {
  LOOP_OVER_OBSERVERS(OnStartFrame(aRequest, aFrame));
  return NS_OK;    
@ -204,16 +202,16 @@ nsImageLoadingContent::OnStartFrame(imgIRequest* aRequest,

 NS_IMETHODIMP
 nsImageLoadingContent::OnDataAvailable(imgIRequest* aRequest,
-                                       gfxIImageFrame* aFrame,
+                                       PRBool aCurrentFrame,
                                       const nsIntRect* aRect)
 {
-  LOOP_OVER_OBSERVERS(OnDataAvailable(aRequest, aFrame, aRect));
+  LOOP_OVER_OBSERVERS(OnDataAvailable(aRequest, aCurrentFrame, aRect));
  return NS_OK;
 }

 NS_IMETHODIMP
 nsImageLoadingContent::OnStopFrame(imgIRequest* aRequest,
-                                   gfxIImageFrame* aFrame)
+                                   PRUint32 aFrame)
 {
  LOOP_OVER_OBSERVERS(OnStopFrame(aRequest, aFrame));
  return NS_OK;
--- a/content/base/src/nsStubImageDecoderObserver.cpp
+++ b/content/base/src/nsStubImageDecoderObserver.cpp
@ -58,14 +58,14 @@ nsStubImageDecoderObserver::OnStartContainer(imgIRequest *aRequest,

 NS_IMETHODIMP
 nsStubImageDecoderObserver::OnStartFrame(imgIRequest *aRequest,
-                                         gfxIImageFrame *aFrame)
+                                         PRUint32 aFrame)
 {
    return NS_OK;
 }

 NS_IMETHODIMP
 nsStubImageDecoderObserver::OnDataAvailable(imgIRequest *aRequest,
-                                            gfxIImageFrame *aFrame,
+                                            PRBool aCurrentFrame,
                                            const nsIntRect * aRect)
 {
    return NS_OK;
@ -73,7 +73,7 @@ nsStubImageDecoderObserver::OnDataAvailable(imgIRequest *aRequest,

 NS_IMETHODIMP
 nsStubImageDecoderObserver::OnStopFrame(imgIRequest *aRequest,
-                                        gfxIImageFrame *aFrame)
+                                        PRUint32 aFrame)
 {
    return NS_OK;
 }
@ -102,7 +102,6 @@ nsStubImageDecoderObserver::OnStopRequest(imgIRequest *aRequest,

 NS_IMETHODIMP
 nsStubImageDecoderObserver::FrameChanged(imgIContainer *aContainer,
-                                         gfxIImageFrame *aFrame,
                                         nsIntRect * aDirtyRect)
 {
    return NS_OK;
--- a/content/canvas/src/nsCanvasRenderingContext2D.cpp
+++ b/content/canvas/src/nsCanvasRenderingContext2D.cpp
@ -3338,6 +3338,9 @@ nsCanvasRenderingContext2D::DrawWindow(nsIDOMWindow* aWindow, float aX, float aY
    if (flags & nsIDOMCanvasRenderingContext2D::DRAWWINDOW_DRAW_CARET) {
        renderDocFlags |= nsIPresShell::RENDER_CARET;
    }
+    if (flags & nsIDOMCanvasRenderingContext2D::DRAWWINDOW_DRAW_VIEW) {
+        renderDocFlags &= ~nsIPresShell::RENDER_IGNORE_VIEWPORT_SCROLLING;
+    }

    PRBool oldDisableValue = nsLayoutUtils::sDisableGetUsedXAssertions;
    nsLayoutUtils::sDisableGetUsedXAssertions = oldDisableValue || skipFlush;
--- a/content/events/src/nsEventStateManager.cpp
+++ b/content/events/src/nsEventStateManager.cpp
@ -95,7 +95,6 @@
 #include "nsIWebNavigation.h"
 #include "nsIContentViewer.h"
 #include "nsIPrefBranch2.h"
-#include "nsIObjectFrame.h"
 #ifdef MOZ_XUL
 #include "nsXULPopupManager.h"
 #endif
@ -210,12 +209,6 @@ PrintDocTree(nsIDocShellTreeItem* aParentItem, int aLevel)
  nsCOMPtr<nsIDOMWindowInternal> domwin = doc ? doc->GetWindow() : nsnull;
  nsIURI* uri = doc ? doc->GetDocumentURI() : nsnull;

-  nsCOMPtr<nsIWidget> widget;
-  nsIViewManager* vm = presShell ? presShell->GetViewManager() : nsnull;
-  if (vm) {
-    vm->GetWidget(getter_AddRefs(widget));
-  }
-
  printf("DS %p  Type %s  Cnt %d  Doc %p  DW %p  EM %p%c",
    static_cast<void*>(parentAsDocShell.get()),
    type==nsIDocShellTreeItem::typeChrome?"Chrome":"Content",
@ -3726,25 +3719,25 @@ nsEventStateManager::CheckForAndDispatchClick(nsPresContext* aPresContext,
 NS_IMETHODIMP
 nsEventStateManager::GetEventTarget(nsIFrame **aFrame)
 {
-  if (!mCurrentTarget && mCurrentTargetContent) {
-    if (mPresContext) {
-      nsIPresShell *shell = mPresContext->GetPresShell();
-      if (shell) {
-        mCurrentTarget = shell->GetPrimaryFrameFor(mCurrentTargetContent);
-      }
+  nsIPresShell *shell;
+  if (mCurrentTarget ||
+      !mPresContext ||
+      !(shell = mPresContext->GetPresShell())) {
+    *aFrame = mCurrentTarget;
+    return NS_OK;
+  }
+
+  if (mCurrentTargetContent) {
+    mCurrentTarget = shell->GetPrimaryFrameFor(mCurrentTargetContent);
+    if (mCurrentTarget) {
+      *aFrame = mCurrentTarget;
+      return NS_OK;
    }
  }

-  if (!mCurrentTarget) {
-    nsIPresShell *presShell = mPresContext->GetPresShell();
-    if (presShell) {
-      nsIFrame* frame = nsnull;
-      presShell->GetEventTargetFrame(&frame);
-      mCurrentTarget = frame;
-    }
-  }
-
-  *aFrame = mCurrentTarget;
+  nsIFrame* frame = nsnull;
+  shell->GetEventTargetFrame(&frame);
+  *aFrame = mCurrentTarget = frame;
  return NS_OK;
 }

--- a/content/events/src/nsIMEStateManager.cpp
+++ b/content/events/src/nsIMEStateManager.cpp
@ -222,7 +222,7 @@ nsIMEStateManager::GetWidget(nsPresContext* aPresContext)
  if (!vm)
    return nsnull;
  nsCOMPtr<nsIWidget> widget = nsnull;
-  nsresult rv = vm->GetWidget(getter_AddRefs(widget));
+  nsresult rv = vm->GetRootWidget(getter_AddRefs(widget));
  NS_ENSURE_SUCCESS(rv, nsnull);
  return widget;
 }
@ -497,7 +497,7 @@ nsIMEStateManager::OnTextStateFocus(nsPresContext* aPresContext,
  NS_ENSURE_TRUE(vm, NS_ERROR_NOT_AVAILABLE);

  nsCOMPtr<nsIWidget> widget;
-  nsresult rv = vm->GetWidget(getter_AddRefs(widget));
+  nsresult rv = vm->GetRootWidget(getter_AddRefs(widget));
  NS_ENSURE_SUCCESS(rv, NS_ERROR_NOT_AVAILABLE);

  rv = widget->OnIMEFocusChange(PR_TRUE);
--- a/content/html/content/crashtests/504183-1.html
+++ b/content/html/content/crashtests/504183-1.html
@ -0,0 +1,12 @@
+<html class="reftest-wait">
+<input id="a" type="file">
+<script>
+function doe() {
+var elem = document.getElementById('a');
+elem.style.display = "none";
+elem.focus();
+document.documentElement.className = "";
+}
+setTimeout(doe, 0);
+</script>
+</html>
--- a/content/html/content/crashtests/crashtests.list
+++ b/content/html/content/crashtests/crashtests.list
@ -9,3 +9,4 @@ load 382568-1.html
 load 423371-1.html
 load 451123-1.html
 load 453406-1.html
+load 504183-1.html
--- a/content/html/content/src/nsHTMLInputElement.cpp
+++ b/content/html/content/src/nsHTMLInputElement.cpp
@ -1368,6 +1368,7 @@ nsHTMLInputElement::Focus()
          nsIFocusManager* fm = nsFocusManager::GetFocusManager();
          if (fm && element)
            fm->SetFocus(element, 0);
+          break;
        }

        childFrame = childFrame->GetNextSibling();
--- a/content/html/content/src/nsHTMLOptionElement.cpp
+++ b/content/html/content/src/nsHTMLOptionElement.cpp
@ -508,9 +508,7 @@ nsHTMLOptionElement::Initialize(nsISupports* aOwner,
      if (argc > 2) {
        // The third (optional) parameter is the defaultSelected value
        JSBool defaultSelected;
-        if (!JS_ValueToBoolean(aContext, argv[2], &defaultSelected)) {
-            return NS_ERROR_FAILURE;
-        }
+        JS_ValueToBoolean(aContext, argv[2], &defaultSelected);
        if (defaultSelected) {
          result = SetAttr(kNameSpaceID_None, nsGkAtoms::selected,
                           EmptyString(), PR_FALSE);
@ -520,9 +518,7 @@ nsHTMLOptionElement::Initialize(nsISupports* aOwner,
        // XXX This is *untested* behavior.  Should work though.
        if (argc > 3) {
          JSBool selected;
-          if (!JS_ValueToBoolean(aContext, argv[3], &selected)) {
-            return NS_ERROR_FAILURE;
-          }
+          JS_ValueToBoolean(aContext, argv[3], &selected);

          return SetSelected(selected);
        }
--- a/content/html/parser/Makefile.in
+++ b/content/html/parser/Makefile.in
@ -1,52 +0,0 @@
-#
-# ***** BEGIN LICENSE BLOCK *****
-# Version: MPL 1.1/GPL 2.0/LGPL 2.1
-#
-# The contents of this file are subject to the Mozilla Public License Version
-# 1.1 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-# http://www.mozilla.org/MPL/
-#
-# Software distributed under the License is distributed on an "AS IS" basis,
-# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-# for the specific language governing rights and limitations under the
-# License.
-#
-# The Original Code is mozilla.org code.
-#
-# The Initial Developer of the Original Code is
-# Netscape Communications Corporation.
-# Portions created by the Initial Developer are Copyright (C) 1998
-# the Initial Developer. All Rights Reserved.
-#
-# Contributor(s):
-#
-# Alternatively, the contents of this file may be used under the terms of
-# either of the GNU General Public License Version 2 or later (the "GPL"),
-# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-# in which case the provisions of the GPL or the LGPL are applicable instead
-# of those above. If you wish to allow use of your version of this file only
-# under the terms of either the GPL or the LGPL, and not to allow others to
-# use your version of this file under the terms of the MPL, indicate your
-# decision by deleting the provisions above and replace them with the notice
-# and other provisions required by the GPL or the LGPL. If you do not delete
-# the provisions above, a recipient may use your version of this file under
-# the terms of any one of the MPL, the GPL or the LGPL.
-#
-# ***** END LICENSE BLOCK *****
-
-DEPTH		= ../../..
-topsrcdir	= @top_srcdir@
-srcdir		= @srcdir@
-VPATH		= @srcdir@
-
-include $(DEPTH)/config/autoconf.mk
-
-DIRS		= public src
-
-# ifdef ENABLE_TESTS
-# DIRS		+= test
-# endif
-
-include $(topsrcdir)/config/rules.mk
-
--- a/content/html/parser/javasrc/README.txt
+++ b/content/html/parser/javasrc/README.txt
@ -1,9 +0,0 @@
-The *.java files in this directory are the source files from which the 
-corresponding nsHtml5*.cpp and nsHtml5*.h files were generated in
-../src/.
-
-You can obtain the full Java version of the parser and the translator
-program from
-svn co http://svn.versiondude.net/whattf/htmlparser/trunk/ htmlparser
-
-See run-cpp-translate.sh at the top level of the SVN checkout.
--- a/content/html/parser/public/Makefile.in
+++ b/content/html/parser/public/Makefile.in
@ -1,51 +0,0 @@
-#
-# ***** BEGIN LICENSE BLOCK *****
-# Version: MPL 1.1/GPL 2.0/LGPL 2.1
-#
-# The contents of this file are subject to the Mozilla Public License Version
-# 1.1 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-# http://www.mozilla.org/MPL/
-#
-# Software distributed under the License is distributed on an "AS IS" basis,
-# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-# for the specific language governing rights and limitations under the
-# License.
-#
-# The Original Code is mozilla.org code.
-#
-# The Initial Developer of the Original Code is
-# Netscape Communications Corporation.
-# Portions created by the Initial Developer are Copyright (C) 1998
-# the Initial Developer. All Rights Reserved.
-#
-# Contributor(s):
-#
-# Alternatively, the contents of this file may be used under the terms of
-# either of the GNU General Public License Version 2 or later (the "GPL"),
-# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-# in which case the provisions of the GPL or the LGPL are applicable instead
-# of those above. If you wish to allow use of your version of this file only
-# under the terms of either the GPL or the LGPL, and not to allow others to
-# use your version of this file under the terms of the MPL, indicate your
-# decision by deleting the provisions above and replace them with the notice
-# and other provisions required by the GPL or the LGPL. If you do not delete
-# the provisions above, a recipient may use your version of this file under
-# the terms of any one of the MPL, the GPL or the LGPL.
-#
-# ***** END LICENSE BLOCK *****
-
-DEPTH		= ../../../..
-topsrcdir	= @top_srcdir@
-srcdir		= @srcdir@
-VPATH		= @srcdir@
-
-include $(DEPTH)/config/autoconf.mk
-
-MODULE		= html5
-
-EXPORTS		= \
-    nsHtml5Module.h \
-		$(NULL)
-
-include $(topsrcdir)/config/rules.mk
--- a/content/media/ogg/nsOggDecoder.cpp
+++ b/content/media/ogg/nsOggDecoder.cpp
@ -926,13 +926,14 @@ void nsOggDecodeStateMachine::PlayFrame() {
        if (time == prevTime)
          break;
        prevTime = time;
-        if (time < frame->mTime) {
-          mon.Wait(PR_MillisecondsToInterval(PRInt64((frame->mTime - time)*1000)));
-          if (mState == DECODER_STATE_SHUTDOWN)
-            return;
-          continue;
-        }
-        break;
+        // Is it time for the next frame?  Using an integer here avoids f.p.
+        // rounding errors that can cause multiple 0ms waits (Bug 495352)
+        PRInt64 wait = PRInt64((frame->mTime - time)*1000);
+        if (wait <= 0)
+          break;
+        mon.Wait(PR_MillisecondsToInterval(wait));
+        if (mState == DECODER_STATE_SHUTDOWN)
+          return;
      }

      mDecodedFrames.Pop();
--- a/content/smil/nsSMILAnimationFunction.cpp
+++ b/content/smil/nsSMILAnimationFunction.cpp
@ -607,13 +607,11 @@ nsSMILAnimationFunction::ScaleIntervalProgress(double& aProgress,
  if (!HasAttr(nsGkAtoms::keySplines))
    return;

-  NS_ASSERTION(aIntervalIndex >= 0 &&
-               aIntervalIndex < (PRUint32)mKeySplines.Length(),
+  NS_ASSERTION(aIntervalIndex < (PRUint32)mKeySplines.Length(),
               "Invalid interval index.");
  NS_ASSERTION(aNumIntervals >= 1, "Invalid number of intervals.");

-  if (aIntervalIndex < 0 ||
-      aIntervalIndex >= (PRUint32)mKeySplines.Length() ||
+  if (aIntervalIndex >= (PRUint32)mKeySplines.Length() ||
      aNumIntervals < 1)
    return;

--- a/content/svg/content/src/nsSVGElement.cpp
+++ b/content/svg/content/src/nsSVGElement.cpp
@ -932,8 +932,8 @@ nsSVGElement::GetOwnerSVGElement(nsIDOMSVGSVGElement * *aOwnerSVGElement)
 NS_IMETHODIMP
 nsSVGElement::GetViewportElement(nsIDOMSVGElement * *aViewportElement)
 {
-  nsSVGUtils::GetNearestViewportElement(this, aViewportElement);
-  return NS_OK; // we can't throw exceptions from this API.
+  *aViewportElement = nsSVGUtils::GetNearestViewportElement(this).get();
+  return NS_OK;
 }

 //----------------------------------------------------------------------
--- a/content/svg/content/src/nsSVGFilters.cpp
+++ b/content/svg/content/src/nsSVGFilters.cpp
@ -57,16 +57,14 @@
 #include "nsIDocument.h"
 #include "nsIFrame.h"
 #include "gfxContext.h"
+#include "gfxMatrix.h"
 #include "nsSVGLengthList.h"
 #include "nsIDOMSVGURIReference.h"
 #include "nsImageLoadingContent.h"
 #include "imgIContainer.h"
-#include "gfxIImageFrame.h"
-#include "nsIImage.h"
 #include "nsNetUtil.h"
 #include "nsSVGPreserveAspectRatio.h"
 #include "nsIInterfaceRequestorUtils.h"
-#include "nsSVGMatrix.h"
 #include "nsSVGFilterElement.h"
 #include "nsSVGString.h"

@ -5191,8 +5189,7 @@ public:
  NS_IMETHOD OnStopDecode(imgIRequest *aRequest, nsresult status,
                          const PRUnichar *statusArg);
  // imgIContainerObserver
-  NS_IMETHOD FrameChanged(imgIContainer *aContainer, gfxIImageFrame *newframe,
-                          nsIntRect *dirtyRect);
+  NS_IMETHOD FrameChanged(imgIContainer *aContainer, nsIntRect *dirtyRect);
  // imgIContainerObserver
  NS_IMETHOD OnStartContainer(imgIRequest *aRequest,
                              imgIContainer *aContainer);
@ -5378,38 +5375,36 @@ nsSVGFEImageElement::Filter(nsSVGFilterInstance *instance,
  if (currentRequest)
    currentRequest->GetImage(getter_AddRefs(imageContainer));

-  nsCOMPtr<gfxIImageFrame> currentFrame;
+  nsRefPtr<gfxASurface> currentFrame;
  if (imageContainer)
    imageContainer->GetCurrentFrame(getter_AddRefs(currentFrame));

-  nsRefPtr<gfxPattern> thebesPattern = nsnull;
-  if (currentFrame) {
-    nsCOMPtr<nsIImage> img(do_GetInterface(currentFrame));
-
-    img->GetPattern(getter_AddRefs(thebesPattern));
-  }
+  // We need to wrap the surface in a pattern to have somewhere to set the
+  // graphics filter.
+  nsRefPtr<gfxPattern> thebesPattern;
+  if (currentFrame)
+    thebesPattern = new gfxPattern(currentFrame);

  if (thebesPattern) {
    thebesPattern->SetFilter(nsLayoutUtils::GetGraphicsFilterForFrame(frame));

-    PRInt32 x, y, nativeWidth, nativeHeight;
-    currentFrame->GetX(&x);
-    currentFrame->GetY(&y);
-    currentFrame->GetWidth(&nativeWidth);
-    currentFrame->GetHeight(&nativeHeight);
+    PRInt32 nativeWidth, nativeHeight;
+    imageContainer->GetWidth(&nativeWidth);
+    imageContainer->GetHeight(&nativeHeight);

-    nsCOMPtr<nsIDOMSVGMatrix> trans;
    const gfxRect& filterSubregion = aTarget->mFilterPrimitiveSubregion;
-    trans = nsSVGUtils::GetViewBoxTransform(filterSubregion.Width(), filterSubregion.Height(),
-                                            x, y,
-                                            nativeWidth, nativeHeight,
-                                            mPreserveAspectRatio);
-    nsCOMPtr<nsIDOMSVGMatrix> xy, fini;
-    NS_NewSVGMatrix(getter_AddRefs(xy), 1, 0, 0, 1, filterSubregion.X(), filterSubregion.Y());
-    xy->Multiply(trans, getter_AddRefs(fini));

+    gfxMatrix viewBoxTM =
+      nsSVGUtils::GetViewBoxTransform(filterSubregion.Width(), filterSubregion.Height(),
+                                      0,0, nativeWidth, nativeHeight,
+                                      mPreserveAspectRatio);
+
+    gfxMatrix xyTM = gfxMatrix().Translate(gfxPoint(filterSubregion.X(), filterSubregion.Y()));
+
+    gfxMatrix TM = viewBoxTM * xyTM;
+    
    gfxContext ctx(aTarget->mImage);
-    nsSVGUtils::CompositePatternMatrix(&ctx, thebesPattern, fini, nativeWidth, nativeHeight, 1.0);
+    nsSVGUtils::CompositePatternMatrix(&ctx, thebesPattern, TM, nativeWidth, nativeHeight, 1.0);
  }

  return NS_OK;
@ -5457,11 +5452,10 @@ nsSVGFEImageElement::OnStopDecode(imgIRequest *aRequest,

 NS_IMETHODIMP
 nsSVGFEImageElement::FrameChanged(imgIContainer *aContainer,
-                                  gfxIImageFrame *newframe,
                                  nsIntRect *dirtyRect)
 {
  nsresult rv =
-    nsImageLoadingContent::FrameChanged(aContainer, newframe, dirtyRect);
+    nsImageLoadingContent::FrameChanged(aContainer, dirtyRect);
  Invalidate();
  return rv;
 }
--- a/content/svg/content/src/nsSVGForeignObjectElement.cpp
+++ b/content/svg/content/src/nsSVGForeignObjectElement.cpp
@ -117,25 +117,6 @@ nsSVGForeignObjectElement::PrependLocalTransformTo(const gfxMatrix &aMatrix)
  return gfxMatrix().Translate(gfxPoint(x, y)) * matrix;
 }

-nsresult
-nsSVGForeignObjectElement::AppendTransform(nsIDOMSVGMatrix *aCTM,
-                                           nsIDOMSVGMatrix **_retval)
-{
-  nsresult rv;
-  // foreignObject is one of establishing-viewport elements.
-  // so we are translated by foreignObject's x and y attribs.
-  float x, y;
-  GetAnimatedLengthValues(&x, &y, nsnull);
-  nsCOMPtr<nsIDOMSVGMatrix> translate;
-  rv = NS_NewSVGMatrix(getter_AddRefs(translate), 1, 0, 0, 1, x, y);
-  if (NS_FAILED(rv)) return rv;
-  nsCOMPtr<nsIDOMSVGMatrix> tmp;
-  rv = aCTM->Multiply(translate, getter_AddRefs(tmp));
-  if (NS_FAILED(rv)) return rv;
-
-  return nsSVGGraphicElement::AppendTransform(tmp, _retval);
-}
-
 //----------------------------------------------------------------------
 // nsIContent methods

--- a/content/svg/content/src/nsSVGForeignObjectElement.h
+++ b/content/svg/content/src/nsSVGForeignObjectElement.h
@ -74,9 +74,6 @@ public:

  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;

-  // public helpers
-  nsresult AppendTransform(nsIDOMSVGMatrix *aCTM,
-                           nsIDOMSVGMatrix **_retval);
 protected:

  virtual LengthAttributesInfo GetLengthInfo();
--- a/content/svg/content/src/nsSVGGraphicElement.cpp
+++ b/content/svg/content/src/nsSVGGraphicElement.cpp
@ -75,14 +75,15 @@ nsSVGGraphicElement::nsSVGGraphicElement(nsINodeInfo *aNodeInfo)
 /* readonly attribute nsIDOMSVGElement nearestViewportElement; */
 NS_IMETHODIMP nsSVGGraphicElement::GetNearestViewportElement(nsIDOMSVGElement * *aNearestViewportElement)
 {
-  nsSVGUtils::GetNearestViewportElement(this, aNearestViewportElement);
-  return NS_OK; // we can't throw exceptions from this API.
+  *aNearestViewportElement = nsSVGUtils::GetNearestViewportElement(this).get();
+  return NS_OK;
 }

 /* readonly attribute nsIDOMSVGElement farthestViewportElement; */
 NS_IMETHODIMP nsSVGGraphicElement::GetFarthestViewportElement(nsIDOMSVGElement * *aFarthestViewportElement)
 {
-  return nsSVGUtils::GetFarthestViewportElement(this, aFarthestViewportElement);
+  *aFarthestViewportElement = nsSVGUtils::GetFarthestViewportElement(this).get();
+  return NS_OK;
 }

 /* nsIDOMSVGRect getBBox (); */
@ -102,41 +103,20 @@ NS_IMETHODIMP nsSVGGraphicElement::GetBBox(nsIDOMSVGRect **_retval)
  return NS_ERROR_FAILURE;
 }

-/* Helper for GetCTM and GetScreenCTM */
-nsresult
-nsSVGGraphicElement::AppendTransform(nsIDOMSVGMatrix *aCTM,
-                                     nsIDOMSVGMatrix **_retval)
-{
-  if (!mTransforms) {
-    *_retval = aCTM;
-    NS_ADDREF(*_retval);
-    return NS_OK;
-  }
-
-  // append our local transformations
-  nsCOMPtr<nsIDOMSVGTransformList> transforms;
-  mTransforms->GetAnimVal(getter_AddRefs(transforms));
-  NS_ENSURE_TRUE(transforms, NS_ERROR_FAILURE);
-  nsCOMPtr<nsIDOMSVGMatrix> matrix =
-    nsSVGTransformList::GetConsolidationMatrix(transforms);
-  if (!matrix) {
-    *_retval = aCTM;
-    NS_ADDREF(*_retval);
-    return NS_OK;
-  }
-  return aCTM->Multiply(matrix, _retval);  // addrefs, so we don't
-}
-
 /* nsIDOMSVGMatrix getCTM (); */
 NS_IMETHODIMP nsSVGGraphicElement::GetCTM(nsIDOMSVGMatrix * *aCTM)
 {
-  return nsSVGUtils::GetCTM(this, aCTM);
+  gfxMatrix m = nsSVGUtils::GetCTM(this, PR_FALSE);
+  *aCTM = m.IsSingular() ? nsnull : NS_NewSVGMatrix(m).get();
+  return NS_OK;
 }

 /* nsIDOMSVGMatrix getScreenCTM (); */
 NS_IMETHODIMP nsSVGGraphicElement::GetScreenCTM(nsIDOMSVGMatrix * *aCTM)
 {
-  return nsSVGUtils::GetScreenCTM(this, aCTM);
+  gfxMatrix m = nsSVGUtils::GetCTM(this, PR_TRUE);
+  *aCTM = m.IsSingular() ? nsnull : NS_NewSVGMatrix(m).get();
+  return NS_OK;
 }

 /* nsIDOMSVGMatrix getTransformToElement (in nsIDOMSVGElement element); */
--- a/content/svg/content/src/nsSVGGraphicElement.h
+++ b/content/svg/content/src/nsSVGGraphicElement.h
@ -64,9 +64,6 @@ public:

  virtual gfxMatrix PrependLocalTransformTo(const gfxMatrix &aMatrix);

-  // public helpers
-  virtual nsresult AppendTransform(nsIDOMSVGMatrix *aCTM,
-                                   nsIDOMSVGMatrix **_retval);
 protected:
  // nsSVGElement overrides
  virtual PRBool IsEventName(nsIAtom* aName);
--- a/content/svg/content/src/nsSVGLength.cpp
+++ b/content/svg/content/src/nsSVGLength.cpp
@ -38,7 +38,6 @@
 * ***** END LICENSE BLOCK ***** */

 #include "nsSVGLength.h"
-#include "nsIDOMSVGMatrix.h"
 #include "nsGkAtoms.h"
 #include "nsSVGValue.h"
 #include "nsTextFormatter.h"
--- a/content/svg/content/src/nsSVGMarkerElement.cpp
+++ b/content/svg/content/src/nsSVGMarkerElement.cpp
@ -42,6 +42,7 @@
 #include "nsDOMError.h"
 #include "nsSVGUtils.h"
 #include "nsSVGMarkerElement.h"
+#include "gfxMatrix.h"

 nsSVGElement::LengthInfo nsSVGMarkerElement::sLengthInfo[4] =
 {
@ -376,10 +377,9 @@ nsSVGMarkerElement::GetPreserveAspectRatio()
 //----------------------------------------------------------------------
 // public helpers

-nsresult
+gfxMatrix
 nsSVGMarkerElement::GetMarkerTransform(float aStrokeWidth,
-                                       float aX, float aY, float aAngle,
-                                       nsIDOMSVGMatrix **_retval)
+                                       float aX, float aY, float aAngle)
 {
  float scale = 1.0;
  if (mEnumAttributes[MARKERUNITS].GetAnimValue() ==
@ -390,22 +390,14 @@ nsSVGMarkerElement::GetMarkerTransform(float aStrokeWidth,
    aAngle = mAngleAttributes[ORIENT].GetAnimValue();
  }

-  nsCOMPtr<nsIDOMSVGMatrix> matrix;
-  NS_NewSVGMatrix(getter_AddRefs(matrix),
-                  cos(aAngle) * scale,   sin(aAngle) * scale,
-                  -sin(aAngle) * scale,  cos(aAngle) * scale,
-                  aX,                    aY);
-    
-  *_retval = matrix;
-  NS_IF_ADDREF(*_retval);
-  return NS_OK;
+  return gfxMatrix(cos(aAngle) * scale,   sin(aAngle) * scale,
+                   -sin(aAngle) * scale,  cos(aAngle) * scale,
+                   aX,                    aY);
 }

-nsresult
-nsSVGMarkerElement::GetViewboxToViewportTransform(nsIDOMSVGMatrix **_retval)
+gfxMatrix
+nsSVGMarkerElement::GetViewBoxTransform()
 {
-  *_retval = nsnull;
-
  if (!mViewBoxToViewportTransform) {
    float viewportWidth =
      mLengthAttributes[MARKERWIDTH].GetAnimValue(mCoordCtx);
@ -415,32 +407,27 @@ nsSVGMarkerElement::GetViewboxToViewportTransform(nsIDOMSVGMatrix **_retval)
    const nsSVGViewBoxRect& viewbox = mViewBox.GetAnimValue(); 

    if (viewbox.width <= 0.0f || viewbox.height <= 0.0f) {
-      return NS_ERROR_FAILURE; // invalid - don't paint element
+      return gfxMatrix(0.0, 0.0, 0.0, 0.0, 0.0, 0.0); // invalid - don't paint element
    }

    float refX = mLengthAttributes[REFX].GetAnimValue(mCoordCtx);
    float refY = mLengthAttributes[REFY].GetAnimValue(mCoordCtx);

-    nsCOMPtr<nsIDOMSVGMatrix> vb2vp =
+    gfxMatrix viewBoxTM =
      nsSVGUtils::GetViewBoxTransform(viewportWidth, viewportHeight,
                                      viewbox.x, viewbox.y,
                                      viewbox.width, viewbox.height,
                                      mPreserveAspectRatio,
                                      PR_TRUE);
-    NS_ENSURE_TRUE(vb2vp, NS_ERROR_OUT_OF_MEMORY);
-    gfxPoint ref = nsSVGUtils::ConvertSVGMatrixToThebes(vb2vp).
-                    Transform(gfxPoint(refX, refY));

-    nsCOMPtr<nsIDOMSVGMatrix> translate;
-    NS_NewSVGMatrix(getter_AddRefs(translate),
-                    1.0f, 0.0f, 0.0f, 1.0f, -ref.x, -ref.y);
-    NS_ENSURE_TRUE(translate, NS_ERROR_OUT_OF_MEMORY);
-    translate->Multiply(vb2vp, getter_AddRefs(mViewBoxToViewportTransform));
+    gfxPoint ref = viewBoxTM.Transform(gfxPoint(refX, refY));
+
+    gfxMatrix TM = viewBoxTM * gfxMatrix().Translate(gfxPoint(-ref.x, -ref.y));
+
+    mViewBoxToViewportTransform = NS_NewSVGMatrix(TM);
  }

-  *_retval = mViewBoxToViewportTransform;
-  NS_IF_ADDREF(*_retval);
-  return NS_OK;
+  return nsSVGUtils::ConvertSVGMatrixToThebes(mViewBoxToViewportTransform);
 }


--- a/content/svg/content/src/nsSVGMarkerElement.h
+++ b/content/svg/content/src/nsSVGMarkerElement.h
@ -131,10 +131,9 @@ public:
  virtual void DidChangePreserveAspectRatio(PRBool aDoSetAttr);

  // public helpers
-  nsresult GetMarkerTransform(float aStrokeWidth,
-                              float aX, float aY, float aAngle,
-                              nsIDOMSVGMatrix **_retval);
-  nsresult GetViewboxToViewportTransform(nsIDOMSVGMatrix **_retval);
+  gfxMatrix GetMarkerTransform(float aStrokeWidth,
+                               float aX, float aY, float aAngle);
+  gfxMatrix GetViewBoxTransform();

  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;

--- a/content/svg/content/src/nsSVGPathElement.cpp
+++ b/content/svg/content/src/nsSVGPathElement.cpp
@ -102,7 +102,7 @@ nsSVGPathElement::GetTotalLength(float *_retval)
 {
  *_retval = 0;

-  nsRefPtr<gfxFlattenedPath> flat = GetFlattenedPath(nsnull);
+  nsRefPtr<gfxFlattenedPath> flat = GetFlattenedPath(gfxMatrix());

  if (!flat)
    return NS_ERROR_FAILURE;
@ -118,7 +118,7 @@ nsSVGPathElement::GetPointAtLength(float distance, nsIDOMSVGPoint **_retval)
 {
  NS_ENSURE_FINITE(distance, NS_ERROR_ILLEGAL_VALUE);

-  nsRefPtr<gfxFlattenedPath> flat = GetFlattenedPath(nsnull);
+  nsRefPtr<gfxFlattenedPath> flat = GetFlattenedPath(gfxMatrix());
  if (!flat)
    return NS_ERROR_FAILURE;

@ -494,16 +494,12 @@ nsSVGPathElement::DidModifySVGObservable(nsISVGValue* observable,
 }

 already_AddRefed<gfxFlattenedPath>
-nsSVGPathElement::GetFlattenedPath(nsIDOMSVGMatrix *aMatrix)
+nsSVGPathElement::GetFlattenedPath(const gfxMatrix &aMatrix)
 {
  gfxContext ctx(nsSVGUtils::GetThebesComputationalSurface());

-  if (aMatrix) {
-    ctx.SetMatrix(nsSVGUtils::ConvertSVGMatrixToThebes(aMatrix));
-  }
-
+  ctx.SetMatrix(aMatrix);
  mPathData.Playback(&ctx);
-
  ctx.IdentityMatrix();

  return ctx.GetFlattenedPath();
--- a/content/svg/content/src/nsSVGPathElement.h
+++ b/content/svg/content/src/nsSVGPathElement.h
@ -104,7 +104,7 @@ public:
  virtual void GetMarkPoints(nsTArray<nsSVGMark> *aMarks);
  virtual void ConstructPath(gfxContext *aCtx);

-  virtual already_AddRefed<gfxFlattenedPath> GetFlattenedPath(nsIDOMSVGMatrix *aMatrix);
+  virtual already_AddRefed<gfxFlattenedPath> GetFlattenedPath(const gfxMatrix &aMatrix);

  // nsIContent interface
  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
--- a/content/svg/content/src/nsSVGPathGeometryElement.cpp
+++ b/content/svg/content/src/nsSVGPathGeometryElement.cpp
@ -67,7 +67,7 @@ nsSVGPathGeometryElement::GetMarkPoints(nsTArray<nsSVGMark> *aMarks)
 }

 already_AddRefed<gfxFlattenedPath>
-nsSVGPathGeometryElement::GetFlattenedPath(nsIDOMSVGMatrix *aMatrix)
+nsSVGPathGeometryElement::GetFlattenedPath(const gfxMatrix &aMatrix)
 {
  return nsnull;
 }
--- a/content/svg/content/src/nsSVGPathGeometryElement.h
+++ b/content/svg/content/src/nsSVGPathGeometryElement.h
@ -40,6 +40,7 @@
 #include "nsSVGGraphicElement.h"
 #include "nsTArray.h"
 #include "gfxPath.h"
+#include "gfxMatrix.h"

 struct nsSVGMark {
  float x, y, angle;
@ -47,7 +48,6 @@ struct nsSVGMark {
    x(aX), y(aY), angle(aAngle) {}
 };

-class nsIDOMSVGMatrix;
 class gfxContext;

 typedef nsSVGGraphicElement nsSVGPathGeometryElementBase;
@ -61,7 +61,7 @@ public:
  virtual PRBool IsMarkable();
  virtual void GetMarkPoints(nsTArray<nsSVGMark> *aMarks);
  virtual void ConstructPath(gfxContext *aCtx) = 0;
-  virtual already_AddRefed<gfxFlattenedPath> GetFlattenedPath(nsIDOMSVGMatrix *aMatrix);
+  virtual already_AddRefed<gfxFlattenedPath> GetFlattenedPath(const gfxMatrix &aMatrix);
 };

 #endif
--- a/content/svg/content/src/nsSVGPatternElement.cpp
+++ b/content/svg/content/src/nsSVGPatternElement.cpp
@ -40,7 +40,6 @@
 #include "nsSVGAnimatedTransformList.h"
 #include "nsCOMPtr.h"
 #include "nsGkAtoms.h"
-#include "nsSVGMatrix.h"
 #include "nsSVGPatternElement.h"
 #include "nsIFrame.h"

--- a/content/svg/content/src/nsSVGSVGElement.cpp
+++ b/content/svg/content/src/nsSVGSVGElement.cpp
@ -746,15 +746,16 @@ nsSVGSVGElement::GetPreserveAspectRatio(nsIDOMSVGAnimatedPreserveAspectRatio
 NS_IMETHODIMP
 nsSVGSVGElement::GetNearestViewportElement(nsIDOMSVGElement * *aNearestViewportElement)
 {
-  nsSVGUtils::GetNearestViewportElement(this, aNearestViewportElement);
-  return NS_OK; // we can't throw exceptions from this API.
+  *aNearestViewportElement = nsSVGUtils::GetNearestViewportElement(this).get();
+  return NS_OK;
 }

 /* readonly attribute nsIDOMSVGElement farthestViewportElement; */
 NS_IMETHODIMP
 nsSVGSVGElement::GetFarthestViewportElement(nsIDOMSVGElement * *aFarthestViewportElement)
 {
-  return nsSVGUtils::GetFarthestViewportElement(this, aFarthestViewportElement);
+  *aFarthestViewportElement = nsSVGUtils::GetFarthestViewportElement(this).get();
+  return NS_OK;
 }

 /* nsIDOMSVGRect getBBox (); */
@ -775,68 +776,22 @@ nsSVGSVGElement::GetBBox(nsIDOMSVGRect **_retval)
  return NS_ERROR_NOT_IMPLEMENTED; // XXX: outer svg
 }

-nsresult
-nsSVGSVGElement::AppendTransform(nsIDOMSVGMatrix *aCTM,
-                                 nsIDOMSVGMatrix **_retval)
-{
-  nsresult rv;
-
-  // first check what are our parents and calculate offsets accordingly.
-
-  float s=1, x=0, y=0;
-  nsIContent *ancestor = nsSVGUtils::GetParentElement(this);
-  if (ancestor && ancestor->GetNameSpaceID() == kNameSpaceID_SVG &&
-                  ancestor->Tag() == nsGkAtoms::foreignObject) {
-    // this is a nested <svg> element. immediate parent is an <foreignObject> element.
-    // we ignore this <svg> element's x and y attribs in layout so do the same.
-  } else {
-    nsCOMPtr<nsIDOMSVGElement> nearestViewportElement;
-    rv = nsSVGUtils::GetNearestViewportElement(this, getter_AddRefs(nearestViewportElement));
-    if (NS_FAILED(rv)) return rv;
-
-    if (!nearestViewportElement) {
-      if (IsRoot()) {
-        // we're the root element. get our currentScale and currentTranslate vals
-        s = mCurrentScale;
-        x = mCurrentTranslate.GetX();
-        y = mCurrentTranslate.GetY();
-      } else {
-        // we're inline in some non-SVG content. get our offset from the root
-        GetOffsetToAncestor(nsnull, x, y);
-      }
-    } else {
-      // this is a nested <svg> element.
-      GetAnimatedLengthValues(&x, &y, nsnull);
-    }
-  }
-
-  nsCOMPtr<nsIDOMSVGMatrix> local;
-  rv = NS_NewSVGMatrix(getter_AddRefs(local), s, 0, 0, s, x, y);
-  if (NS_FAILED(rv)) return rv;
-
-  // finally append our viewbox transform
-
-  nsCOMPtr<nsIDOMSVGMatrix> viewbox;
-  rv = GetViewboxToViewportTransform(getter_AddRefs(viewbox));
-  if (NS_FAILED(rv)) return rv;
-  nsCOMPtr<nsIDOMSVGMatrix> tmp;
-  rv = local->Multiply(viewbox, getter_AddRefs(tmp)); // addrefs, so we don't
-  if (NS_FAILED(rv)) return rv;
-  return aCTM->Multiply(tmp, _retval); // addrefs, so we don't
-}
-
 /* nsIDOMSVGMatrix getCTM (); */
 NS_IMETHODIMP
 nsSVGSVGElement::GetCTM(nsIDOMSVGMatrix * *aCTM)
 {
-  return nsSVGUtils::GetCTM(this, aCTM);
+  gfxMatrix m = nsSVGUtils::GetCTM(this, PR_FALSE);
+  *aCTM = m.IsSingular() ? nsnull : NS_NewSVGMatrix(m).get();
+  return NS_OK;
 }

 /* nsIDOMSVGMatrix getScreenCTM (); */
 NS_IMETHODIMP
 nsSVGSVGElement::GetScreenCTM(nsIDOMSVGMatrix **aCTM)
 {
-  return nsSVGUtils::GetScreenCTM(this, aCTM);
+  gfxMatrix m = nsSVGUtils::GetCTM(this, PR_TRUE);
+  *aCTM = m.IsSingular() ? nsnull : NS_NewSVGMatrix(m).get();
+  return NS_OK;
 }

 /* nsIDOMSVGMatrix getTransformToElement (in nsIDOMSVGElement element); */
@ -1027,43 +982,36 @@ nsSVGSVGElement::IsEventName(nsIAtom* aName)
 //----------------------------------------------------------------------
 // public helpers:

-nsresult
-nsSVGSVGElement::GetViewboxToViewportTransform(nsIDOMSVGMatrix **_retval)
+gfxMatrix
+nsSVGSVGElement::GetViewBoxTransform()
 {
-  *_retval = nsnull;
-
  float viewportWidth, viewportHeight;
-  nsSVGSVGElement *ctx = GetCtx();
-  if (!ctx) {
-    // outer svg
-    viewportWidth = mViewportWidth;
-    viewportHeight = mViewportHeight;
-  } else {
+  if (nsSVGUtils::IsInnerSVG(this)) {
+    nsSVGSVGElement *ctx = GetCtx();
    viewportWidth = mLengthAttributes[WIDTH].GetAnimValue(ctx);
    viewportHeight = mLengthAttributes[HEIGHT].GetAnimValue(ctx);
-  }
-
-  nsSVGViewBoxRect viewbox;
-  if (mViewBox.IsValid()) {
-    viewbox = mViewBox.GetAnimValue();
  } else {
-    viewbox.x = viewbox.y = 0.0f;
-    viewbox.width  = viewportWidth;
-    viewbox.height = viewportHeight;
+    viewportWidth = mViewportWidth;
+    viewportHeight = mViewportHeight;
  }

-  if (viewbox.width <= 0.0f || viewbox.height <= 0.0f) {
-    return NS_ERROR_FAILURE; // invalid - don't paint element
+  nsSVGViewBoxRect viewBox;
+  if (mViewBox.IsValid()) {
+    viewBox = mViewBox.GetAnimValue();
+  } else {
+    viewBox.x = viewBox.y = 0.0f;
+    viewBox.width  = viewportWidth;
+    viewBox.height = viewportHeight;
  }

-  nsCOMPtr<nsIDOMSVGMatrix> xform =
-    nsSVGUtils::GetViewBoxTransform(viewportWidth, viewportHeight,
-                                    viewbox.x, viewbox.y,
-                                    viewbox.width, viewbox.height,
-                                    mPreserveAspectRatio);
-  xform.swap(*_retval);
+  if (viewBox.width <= 0.0f || viewBox.height <= 0.0f) {
+    return gfxMatrix(0.0, 0.0, 0.0, 0.0, 0.0, 0.0); // singular
+  }

-  return NS_OK;
+  return nsSVGUtils::GetViewBoxTransform(viewportWidth, viewportHeight,
+                                         viewBox.x, viewBox.y,
+                                         viewBox.width, viewBox.height,
+                                         mPreserveAspectRatio);
 }

 #ifdef MOZ_SMIL
@ -1124,43 +1072,6 @@ nsSVGSVGElement::UnbindFromTree(PRBool aDeep, PRBool aNullParent)
 //----------------------------------------------------------------------
 // implementation helpers

-// if an ancestor isn't specified, obtains offset from root frame
-void nsSVGSVGElement::GetOffsetToAncestor(nsIContent* ancestor,
-                                          float &x, float &y)
-{
-  x = 0.0f;
-  y = 0.0f;
-
-  nsIDocument *document = GetCurrentDoc();
-  if (!document) return;
-
-  // Flush all pending notifications so that our frames are uptodate
-  // Make sure to do this before we start grabbing layout objects like
-  // presshells.
-  document->FlushPendingNotifications(Flush_Layout);
-  
-  nsIPresShell *presShell = document->GetPrimaryShell();
-  if (!presShell) {
-    return;
-  }
-
-  nsPresContext *context = presShell->GetPresContext();
-  if (!context) {
-    return;
-  }
-
-  nsIFrame* frame = presShell->GetPrimaryFrameFor(this);
-  nsIFrame* ancestorFrame = ancestor ?
-                            presShell->GetPrimaryFrameFor(ancestor) :
-                            presShell->GetRootFrame();
-
-  if (frame && ancestorFrame) {
-    nsPoint point = frame->GetOffsetTo(ancestorFrame);
-    x = nsPresContext::AppUnitsToFloatCSSPixels(point.x);
-    y = nsPresContext::AppUnitsToFloatCSSPixels(point.y);
-  }
-}
-
 #ifdef MOZ_SMIL
 PRBool
 nsSVGSVGElement::WillBeOutermostSVG(nsIContent* aParent,
@ -1261,19 +1172,21 @@ nsSVGSVGElement::GetMMPerPx(PRUint8 aCtxType)
 /* virtual */ gfxMatrix
 nsSVGSVGElement::PrependLocalTransformTo(const gfxMatrix &aMatrix)
 {
-  NS_ASSERTION(GetCtx(), "Should not be called on outer-<svg>");
-
-  float x, y;
-  GetAnimatedLengthValues(&x, &y, nsnull);
-  gfxMatrix matrix = aMatrix;
-  matrix.PreMultiply(gfxMatrix().Translate(gfxPoint(x, y)));
-
-  nsCOMPtr<nsIDOMSVGMatrix> viewBoxTM;
-  nsresult res = GetViewboxToViewportTransform(getter_AddRefs(viewBoxTM));
-  if (NS_FAILED(res)) {
-    return gfxMatrix(0.0, 0.0, 0.0, 0.0, 0.0, 0.0); // singular
+  if (nsSVGUtils::IsInnerSVG(this)) {
+    float x, y;
+    GetAnimatedLengthValues(&x, &y, nsnull);
+    return GetViewBoxTransform() * gfxMatrix().Translate(gfxPoint(x, y)) * aMatrix;
  }
-  return matrix.PreMultiply(nsSVGUtils::ConvertSVGMatrixToThebes(viewBoxTM));
+
+  if (IsRoot()) {
+    gfxMatrix zoomPanTM;
+    zoomPanTM.Translate(gfxPoint(mCurrentTranslate.GetX(), mCurrentTranslate.GetY()));
+    zoomPanTM.Scale(mCurrentScale, mCurrentScale);
+    return GetViewBoxTransform() * zoomPanTM * aMatrix;
+  }
+
+  // outer-<svg>, but inline in some other content:
+  return GetViewBoxTransform() * aMatrix;
 }

 void
--- a/content/svg/content/src/nsSVGSVGElement.h
+++ b/content/svg/content/src/nsSVGSVGElement.h
@ -199,9 +199,7 @@ public:
  float GetMMPerPx(PRUint8 mCtxType = 0);

  // public helpers:
-  nsresult GetViewboxToViewportTransform(nsIDOMSVGMatrix **_retval);
-  nsresult AppendTransform(nsIDOMSVGMatrix *aCTM,
-                           nsIDOMSVGMatrix **_retval);
+  gfxMatrix GetViewBoxTransform();

  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;

@ -226,7 +224,6 @@ protected:
 #endif // MOZ_SMIL   

  // implementation helpers:
-  void GetOffsetToAncestor(nsIContent* ancestor, float &x, float &y);

  PRBool IsRoot() {
    NS_ASSERTION((IsInDoc() && !GetParent()) ==
--- a/content/xbl/src/nsXBLWindowKeyHandler.cpp
+++ b/content/xbl/src/nsXBLWindowKeyHandler.cpp
@ -360,8 +360,7 @@ nsXBLWindowKeyHandler::WalkHandlers(nsIDOMKeyEvent* aKeyEvent, nsIAtom* aEventTy

  WalkHandlersInternal(aKeyEvent, aEventType, mHandler);

-  nsINativeKeyBindings *nativeBindings;
-  if (isEditor && (nativeBindings = GetEditorKeyBindings())) {
+  if (isEditor && GetEditorKeyBindings()) {
    nsNativeKeyEvent nativeEvent;
    // get the DOM window we're attached to
    nsCOMPtr<nsIControllers> controllers;
--- a/db/sqlite3/src/Makefile.in
+++ b/db/sqlite3/src/Makefile.in
@ -53,14 +53,25 @@ LIB_IS_C_ONLY    = 1

 ifeq (,$(filter-out WINNT WINCE,$(OS_ARCH)))
 ifndef GNU_CC
-DEFFILE = $(win_srcdir)/sqlite.def
+DEFFILE = $(CURDIR)/sqlite-processed.def
 RCFILE  = sqlite.rc
 RESFILE = sqlite.res

-GARBAGE += sqlite-version.h
+GARBAGE += \
+  sqlite-version.h \
+  $(DEFFILE) \
+  $(NULL)

+# We generate the appropriate version header file with our python script.
 sqlite-version.h: sqlite-version.py sqlite3.h
 	$(PYTHON) $^ > $@
+
+# We have to preprocess our def file because we need different symbols in debug
+# builds exposed that are not built in non-debug builds.
+$(DEFFILE): sqlite.def
+	@$(PYTHON) $(topsrcdir)/config/Preprocessor.py $(DEFINES) \
+	  $(srcdir)/sqlite.def > $(DEFFILE)
+
 export:: sqlite-version.h
 endif
 endif
@ -84,8 +95,8 @@ EXPORTS = \
  $(NULL)

 CSRCS = \
-	sqlite3.c \
-	$(NULL)
+  sqlite3.c \
+  $(NULL)

 # -DSQLITE_SECURE_DELETE=1 will cause SQLITE to 0-fill delete data so we
 # don't have to vacuum to make sure the data is not visible in the file.
@ -103,6 +114,11 @@ ifeq ($(MOZ_WIDGET_TOOLKIT),cocoa)
 DEFINES += -DSQLITE_ENABLE_LOCKING_STYLE=1
 endif

+# Turn on SQLite's assertions in debug builds.
+ifdef MOZ_DEBUG
+DEFINES += -DSQLITE_DEBUG=1
+endif
+
 ifeq ($(OS_ARCH),OS2)
 ifdef MOZ_OS2_HIGH_MEMORY
 DEFINES += -DOS2_HIGH_MEMORY
@ -115,6 +131,7 @@ include $(topsrcdir)/config/rules.mk
 LOCAL_INCLUDES += -I$(srcdir)

 ifeq ($(OS_ARCH),OS2)
-ADD_TO_DEF_FILE = sed -e '1,/^EXPORTS$$/ d' -e 's,sqlite3,_\0,' -e 's,\ DATA.*$$,,' \
-		$(srcdir)/sqlite.def >> $(DEF_FILE)
+ADD_TO_DEF_FILE = $(PYTHON) $(topsrcdir)/config/Preprocessor.py $(DEFINES) \
+       $(srcdir)/sqlite.def | sed -e '1,/^EXPORTS$$/ d' -e 's,sqlite3,_\0,' \
+       -e 's,\ DATA.*$$,,' >> $(DEF_FILE)
 endif
--- a/db/sqlite3/src/sqlite.def
+++ b/db/sqlite3/src/sqlite.def
@ -175,3 +175,7 @@ EXPORTS
        sqlite3_vfs_unregister
        sqlite3_vfs_register
        sqlite3_vmprintf
+#ifdef SQLITE_DEBUG
+        sqlite3_mutex_held
+        sqlite3_mutex_notheld
+#endif
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@ -4141,8 +4141,6 @@ nsDocShell::InitWindow(nativeWindow parentNativeWindow,
                       nsIWidget * parentWidget, PRInt32 x, PRInt32 y,
                       PRInt32 cx, PRInt32 cy)
 {
-    NS_ENSURE_ARG(parentWidget);        // DocShells must get a widget for a parent
-
    SetParentWidget(parentWidget);
    SetPositionAndSize(x, y, cx, cy, PR_FALSE);

@ -6341,22 +6339,11 @@ nsDocShell::CaptureState()
    NS_ENSURE_SUCCESS(rv, rv);

    // Capture the current content viewer bounds.
-    nsCOMPtr<nsIPresShell> shell;
-    nsDocShell::GetPresShell(getter_AddRefs(shell));
-    if (shell) {
-        nsIViewManager *vm = shell->GetViewManager();
-        if (vm) {
-            nsIView *rootView = nsnull;
-            vm->GetRootView(rootView);
-            if (rootView) {
-                nsIWidget *widget = rootView->GetWidget();
-                if (widget) {
-                    nsIntRect bounds(0, 0, 0, 0);
-                    widget->GetBounds(bounds);
-                    rv = mOSHE->SetViewerBounds(bounds);
-                }
-            }
-        }
+    if (mContentViewer) {
+        nsIntRect bounds;
+        mContentViewer->GetBounds(bounds);
+        rv = mOSHE->SetViewerBounds(bounds);
+        NS_ENSURE_SUCCESS(rv, rv);
    }

    // Capture the docshell hierarchy.
@ -6690,10 +6677,7 @@ nsDocShell::RestoreFromHistory()
                rootViewSibling = oldRootView->GetNextSibling();
                rootViewParent = oldRootView->GetParent();

-                nsIWidget *widget = oldRootView->GetWidget();
-                if (widget) {
-                    widget->GetBounds(newBounds);
-                }
+                mContentViewer->GetBounds(newBounds);
            }
        }
    }
@ -6938,15 +6922,12 @@ nsDocShell::RestoreFromHistory()
    // cached viewer size (skipping the resize if they are equal).

    if (newRootView) {
-        nsIWidget *widget = newRootView->GetWidget();
-        if (widget && !newBounds.IsEmpty() && newBounds != oldBounds) {
+        if (!newBounds.IsEmpty() && newBounds != oldBounds) {
 #ifdef DEBUG_PAGE_CACHE
            printf("resize widget(%d, %d, %d, %d)\n", newBounds.x,
                   newBounds.y, newBounds.width, newBounds.height);
 #endif
-
-            widget->Resize(newBounds.x, newBounds.y, newBounds.width,
-                           newBounds.height, PR_FALSE);
+            mContentViewer->SetBounds(newBounds);
        }
    }

--- a/docshell/test/chrome/bug298622_window.xul
+++ b/docshell/test/chrome/bug298622_window.xul
@ -71,6 +71,10 @@
        onNavComplete: nextTest
      });
      yield;
+
+      // Make sure we unsuppress painting before continuing
+      SimpleTest.executeSoon(nextTest);
+      yield;
      
      // Search for some text that's on the second page (but not on
      // the first page), and verify that it can be found.
@ -78,6 +82,14 @@
      document.getElementById("cmd_find").doCommand();
      ok(!gFindBar.hidden, "failed to open findbar");
      enterStringIntoFindField("A generic page");
+
+      // Make sure the key events above have time to be processed
+      // before continuing
+      SimpleTest.executeSoon(nextTest);
+      yield;
+
+      is(gFindBar._findField.inputField.value, "A generic page",
+        "expected text not present in find input field");
      is(TestWindow.getWindow().getSelection().toString().toLowerCase(),
         "a generic page",
         "find failed on second page loaded");
--- a/Показать больше
+++ b/Показать больше