Merge with mc

2010-03-17 10:37:32 -07:00 · 2010-03-17 10:37:32 -07:00 · ef54d33b11
--- a/.hgtags
+++ b/.hgtags
@ -46,3 +46,5 @@ a732c6d3c078f80635255c78bfaadffa5828a8a5 last-mozilla-central
 a732c6d3c078f80635255c78bfaadffa5828a8a5 last-mozilla-central
 925595f3c08634cc42e33158ea6858bb55623ef7 last-mozilla-central
 dba2abb7db57078c5a4810884834d3056a5d56c2 last-mozilla-central
+138f593553b66c9f815e8f57870c19d6347f7702 UPDATE_PACKAGING_R9
+138f593553b66c9f815e8f57870c19d6347f7702 UPDATE_PACKAGING_R10
--- a/accessible/src/base/Makefile.in
+++ b/accessible/src/base/Makefile.in
@ -75,7 +75,6 @@ CPPSRCS = \

 EXPORTS = \
  nsRootAccessible.h \
-  nsAccEvent.h \
  nsAccessNode.h \
  $(NULL)

--- a/accessible/src/base/nsAccEvent.cpp
+++ b/accessible/src/base/nsAccEvent.cpp
@ -37,12 +37,10 @@
 * ***** END LICENSE BLOCK ***** */

 #include "nsAccEvent.h"
-#include "nsAccessibilityAtoms.h"
+
 #include "nsApplicationAccessibleWrap.h"
-#include "nsCoreUtils.h"
-#include "nsIAccessibilityService.h"
-#include "nsIAccessNode.h"
-#include "nsIDocument.h"
+#include "nsDocAccessible.h"
+
 #include "nsIDOMDocument.h"
 #include "nsIEventStateManager.h"
 #include "nsIPersistentProperties2.h"
@ -63,7 +61,7 @@
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccEvent. nsISupports

-NS_IMPL_CYCLE_COLLECTION_2(nsAccEvent, mAccessible, mDocAccessible)
+NS_IMPL_CYCLE_COLLECTION_1(nsAccEvent, mAccessible)

 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsAccEvent)
  NS_INTERFACE_MAP_ENTRY(nsIAccessibleEvent)
@ -138,15 +136,8 @@ nsAccEvent::GetDOMNode(nsIDOMNode **aDOMNode)
  NS_ENSURE_ARG_POINTER(aDOMNode);
  *aDOMNode = nsnull;

-  if (!mNode) {
-    nsCOMPtr<nsIAccessNode> accessNode(do_QueryInterface(mAccessible));
-    NS_ENSURE_TRUE(accessNode, NS_ERROR_FAILURE);
-
-    nsCOMPtr<nsIDOMNode> DOMNode;
-    accessNode->GetDOMNode(getter_AddRefs(DOMNode));
-
-    mNode = do_QueryInterface(DOMNode);
-  }
+  if (!mNode)
+    mNode = GetNode();

  if (mNode)
    CallQueryInterface(mNode, aDOMNode);
@ -158,21 +149,39 @@ NS_IMETHODIMP
 nsAccEvent::GetAccessibleDocument(nsIAccessibleDocument **aDocAccessible)
 {
  NS_ENSURE_ARG_POINTER(aDocAccessible);
-  *aDocAccessible = nsnull;

-  if (!mDocAccessible) {
-    if (!mAccessible) {
-      nsCOMPtr<nsIAccessible> accessible;
-      GetAccessible(getter_AddRefs(accessible));
-    }
+  NS_IF_ADDREF(*aDocAccessible = GetDocAccessible());
+  return NS_OK;
+}

+////////////////////////////////////////////////////////////////////////////////
+// nsAccEvent: public methods
+
+nsINode*
+nsAccEvent::GetNode()
+{
+  if (!mNode) {
    nsCOMPtr<nsIAccessNode> accessNode(do_QueryInterface(mAccessible));
-    NS_ENSURE_TRUE(accessNode, NS_ERROR_FAILURE);
-    accessNode->GetAccessibleDocument(getter_AddRefs(mDocAccessible));
+    if (!accessNode)
+      return nsnull;
+
+    nsCOMPtr<nsIDOMNode> DOMNode;
+    accessNode->GetDOMNode(getter_AddRefs(DOMNode));
+
+    mNode = do_QueryInterface(DOMNode);
  }

-  NS_IF_ADDREF(*aDocAccessible = mDocAccessible);
-  return NS_OK;
+  return mNode;
+}
+
+nsDocAccessible*
+nsAccEvent::GetDocAccessible()
+{
+  nsINode *node = GetNode();
+  if (node)
+    return nsAccessNode::GetDocAccessibleFor(node->GetOwnerDoc());
+
+  return nsnull;
 }

 ////////////////////////////////////////////////////////////////////////////////
--- a/accessible/src/base/nsAccEvent.h
+++ b/accessible/src/base/nsAccEvent.h
@ -41,18 +41,17 @@
 #ifndef _nsAccEvent_H_
 #define _nsAccEvent_H_

-#include "nsAutoPtr.h"
+#include "nsIAccessibleEvent.h"
+
 #include "nsCOMPtr.h"
 #include "nsCOMArray.h"
-#include "nsIAccessibleEvent.h"
-#include "nsIAccessible.h"
-#include "nsIAccessibleDocument.h"
-#include "nsIDOMNode.h"
 #include "nsString.h"
 #include "nsCycleCollectionParticipant.h"
-#include "nsAccUtils.h"

-class nsIPresShell;
+#include "nsINode.h"
+#include "nsIDOMNode.h"
+
+class nsDocAccessible;

 // Constants used to point whether the event is from user input.
 enum EIsFromUserInput
@ -83,13 +82,20 @@ public:
     // eAllowDupes : More than one event of the same type is allowed.
     //    This event will always be emitted.
     eAllowDupes,
+
     // eCoalesceFromSameSubtree : For events of the same type from the same
     //    subtree or the same node, only the umbrella event on the ancestor
     //    will be emitted.
     eCoalesceFromSameSubtree,
+
+    // eCoalesceFromSameDocument : For events of the same type from the same
+    //    document, only the newest event will be emitted.
+    eCoalesceFromSameDocument,
+
     // eRemoveDupes : For repeat events, only the newest event in queue
     //    will be emitted.
     eRemoveDupes,
+
     // eDoNotEmit : This event is confirmed as a duplicate, do not emit it.
     eDoNotEmit
  };
@ -120,6 +126,9 @@ public:
  PRBool IsFromUserInput() const { return mIsFromUserInput; }
  nsIAccessible* GetAccessible() const { return mAccessible; }

+  nsINode* GetNode();
+  nsDocAccessible* GetDocAccessible();
+
 protected:
  /**
   * Get an accessible from event target node.
@ -139,7 +148,6 @@ protected:
  PRPackedBool mIsAsync;
  nsCOMPtr<nsIAccessible> mAccessible;
  nsCOMPtr<nsINode> mNode;
-  nsCOMPtr<nsIAccessibleDocument> mDocAccessible;

  friend class nsAccEventQueue;
 };
--- a/accessible/src/base/nsAccUtils.cpp
+++ b/accessible/src/base/nsAccUtils.cpp
@ -42,7 +42,6 @@
 #include "nsIAccessibleStates.h"
 #include "nsIAccessibleTypes.h"

-#include "nsAccEvent.h"
 #include "nsHyperTextAccessible.h"
 #include "nsHTMLTableAccessible.h"
 #include "nsDocAccessible.h"
--- a/accessible/src/base/nsAccessNode.cpp
+++ b/accessible/src/base/nsAccessNode.cpp
@ -36,7 +36,7 @@
 *
 * ***** END LICENSE BLOCK ***** */

-#include "nsAccessNode.h"
+#include "nsDocAccessible.h"
 #include "nsIAccessible.h"
 #include "nsAccessibilityAtoms.h"
 #include "nsHashtable.h"
@ -78,7 +78,8 @@ nsIDOMNode *nsAccessNode::gLastFocusedNode = 0;

 PRBool nsAccessNode::gIsCacheDisabled = PR_FALSE;
 PRBool nsAccessNode::gIsFormFillEnabled = PR_FALSE;
-nsAccessNodeHashtable nsAccessNode::gGlobalDocAccessibleCache;
+nsRefPtrHashtable<nsVoidPtrHashKey, nsDocAccessible>
+  nsAccessNode::gGlobalDocAccessibleCache;

 nsApplicationAccessibleWrap *nsAccessNode::gApplicationAccessible = nsnull;

@ -346,12 +347,6 @@ nsPresContext* nsAccessNode::GetPresContext()
  return presShell->GetPresContext();
 }

-// nsAccessNode protected
-already_AddRefed<nsIAccessibleDocument> nsAccessNode::GetDocAccessible()
-{
-  return GetDocAccessibleFor(mWeakShell); // Addref'd
-}
-
 already_AddRefed<nsRootAccessible> nsAccessNode::GetRootAccessible()
 {
  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
@ -432,9 +427,11 @@ nsAccessNode::GetNumChildren(PRInt32 *aNumChildren)
 }

 NS_IMETHODIMP
-nsAccessNode::GetAccessibleDocument(nsIAccessibleDocument **aDocAccessible)
+nsAccessNode::GetAccessibleDocument(nsIAccessibleDocument **aAccessibleDocument)
 {
-  *aDocAccessible = GetDocAccessibleFor(mWeakShell).get();
+  NS_ENSURE_ARG_POINTER(aAccessibleDocument);
+
+  NS_IF_ADDREF(*aAccessibleDocument = GetDocAccessibleFor(mWeakShell));
  return NS_OK;
 }

@ -643,19 +640,14 @@ nsAccessNode::GetComputedStyleCSSValue(const nsAString& aPseudoElt,
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessNode public static

-already_AddRefed<nsIAccessibleDocument>
+nsDocAccessible*
 nsAccessNode::GetDocAccessibleFor(nsIDocument *aDocument)
 {
-  if (!aDocument) {
-    return nsnull;
-  }
-
-  nsCOMPtr<nsIAccessibleDocument> docAccessible(do_QueryInterface(
-    gGlobalDocAccessibleCache.GetWeak(static_cast<void*>(aDocument))));
-  return docAccessible.forget();
+  return aDocument ?
+    gGlobalDocAccessibleCache.GetWeak(static_cast<void*>(aDocument)) : nsnull;
 }
- 
-already_AddRefed<nsIAccessibleDocument>
+
+nsDocAccessible*
 nsAccessNode::GetDocAccessibleFor(nsIWeakReference *aWeakShell)
 {
  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(aWeakShell));
@ -663,7 +655,7 @@ nsAccessNode::GetDocAccessibleFor(nsIWeakReference *aWeakShell)
    return nsnull;
  }

-  return nsAccessNode::GetDocAccessibleFor(presShell->GetDocument());
+  return GetDocAccessibleFor(presShell->GetDocument());
 }

 already_AddRefed<nsIAccessibleDocument>
@ -675,7 +667,12 @@ nsAccessNode::GetDocAccessibleFor(nsIDocShellTreeItem *aContainer,
    NS_ASSERTION(docShell, "This method currently only supports docshells");
    nsCOMPtr<nsIPresShell> presShell;
    docShell->GetPresShell(getter_AddRefs(presShell));
-    return presShell ? GetDocAccessibleFor(presShell->GetDocument()) : nsnull;
+    if (!presShell)
+      return nsnull;
+
+    nsDocAccessible *docAcc = GetDocAccessibleFor(presShell->GetDocument());
+    NS_IF_ADDREF(docAcc);
+    return docAcc;
  }

  nsCOMPtr<nsIDOMNode> node = nsCoreUtils::GetDOMNodeForContainer(aContainer);
@ -692,7 +689,7 @@ nsAccessNode::GetDocAccessibleFor(nsIDocShellTreeItem *aContainer,
  return docAccessible;
 }
 
-already_AddRefed<nsIAccessibleDocument>
+nsDocAccessible*
 nsAccessNode::GetDocAccessibleFor(nsIDOMNode *aNode)
 {
  nsCOMPtr<nsIPresShell> eventShell = nsCoreUtils::GetPresShellFor(aNode);
@ -778,3 +775,12 @@ nsAccessNode::GetLanguage(nsAString& aLanguage)
 
  return NS_OK;
 }
+
+////////////////////////////////////////////////////////////////////////////////
+// nsAccessNode protected
+
+nsDocAccessible*
+nsAccessNode::GetDocAccessible() const
+{
+  return GetDocAccessibleFor(mWeakShell);
+}
--- a/accessible/src/base/nsAccessNode.h
+++ b/accessible/src/base/nsAccessNode.h
@ -123,12 +123,6 @@ class nsAccessNode: public nsIAccessNode
     */
    static already_AddRefed<nsApplicationAccessibleWrap> GetApplicationAccessible();

-    // Static cache methods for global document cache
-    static already_AddRefed<nsIAccessibleDocument> GetDocAccessibleFor(nsIDocument *aDocument);
-    static already_AddRefed<nsIAccessibleDocument> GetDocAccessibleFor(nsIWeakReference *aWeakShell);
-    static already_AddRefed<nsIAccessibleDocument> GetDocAccessibleFor(nsIDocShellTreeItem *aContainer, PRBool aCanCreate = PR_FALSE);
-    static already_AddRefed<nsIAccessibleDocument> GetDocAccessibleFor(nsIDOMNode *aNode);
-
    already_AddRefed<nsRootAccessible> GetRootAccessible();

    static nsIDOMNode *gLastFocusedNode;
@ -173,11 +167,30 @@ class nsAccessNode: public nsIAccessNode
  PRBool IsInCache();
 #endif

+  /**
+   * Return cached document accessible.
+   */
+  static nsDocAccessible* GetDocAccessibleFor(nsIDocument *aDocument);
+  static nsDocAccessible* GetDocAccessibleFor(nsIWeakReference *aWeakShell);
+  static nsDocAccessible* GetDocAccessibleFor(nsIDOMNode *aNode);
+
+  /**
+   * Return document accessible.
+   */
+  static already_AddRefed<nsIAccessibleDocument>
+    GetDocAccessibleFor(nsIDocShellTreeItem *aContainer,
+                        PRBool aCanCreate = PR_FALSE);
+
 protected:
    nsresult MakeAccessNode(nsIDOMNode *aNode, nsIAccessNode **aAccessNode);

    nsPresContext* GetPresContext();
-    already_AddRefed<nsIAccessibleDocument> GetDocAccessible();
+
+  /**
+   * Return the document accessible for this accesnode.
+   */
+  nsDocAccessible* GetDocAccessible() const;
+
    void LastRelease();

    nsCOMPtr<nsIDOMNode> mDOMNode;
@ -199,7 +212,8 @@ protected:
    static PRBool gIsCacheDisabled;
    static PRBool gIsFormFillEnabled;

-    static nsAccessNodeHashtable gGlobalDocAccessibleCache;
+  static nsRefPtrHashtable<nsVoidPtrHashKey, nsDocAccessible>
+    gGlobalDocAccessibleCache;

 private:
  static nsApplicationAccessibleWrap *gApplicationAccessible;
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@ -38,13 +38,12 @@
 * ***** END LICENSE BLOCK ***** */

 #include "nsAccessible.h"
-#include "nsAccessibleRelation.h"
-#include "nsHyperTextAccessibleWrap.h"

-#include "nsIAccessibleDocument.h"
-#include "nsIAccessibleHyperText.h"
 #include "nsIXBLAccessible.h"
+
 #include "nsAccTreeWalker.h"
+#include "nsAccessibleRelation.h"
+#include "nsDocAccessible.h"

 #include "nsIDOMElement.h"
 #include "nsIDOMDocument.h"
@ -2900,7 +2899,7 @@ nsAccessible::GetParent()
  if (mParent)
    return mParent;

-  nsCOMPtr<nsIAccessibleDocument> docAccessible(GetDocAccessible());
+  nsDocAccessible *docAccessible = GetDocAccessible();
  NS_ASSERTION(docAccessible, "No document accessible for valid accessible!");

  if (!docAccessible)
--- a/accessible/src/base/nsCaretAccessible.cpp
+++ b/accessible/src/base/nsCaretAccessible.cpp
@ -50,7 +50,6 @@
 #include "nsISelectionPrivate.h"
 #include "nsISelection2.h"
 #include "nsServiceManagerUtils.h"
-#include "nsIViewManager.h"

 class nsIWidget;

@ -327,33 +326,27 @@ nsCaretAccessible::GetCaretRect(nsIWidget **aOutWidget)
  presShell->GetCaret(getter_AddRefs(caret));
  NS_ENSURE_TRUE(caret, caretRect);

-  PRBool isCollapsed;
-  nsIView *view;
  nsCOMPtr<nsISelection> caretSelection(do_QueryReferent(mLastUsedSelection));
  NS_ENSURE_TRUE(caretSelection, caretRect);
  
-  nsRect rect;
-  caret->GetCaretCoordinates(nsCaret::eRenderingViewCoordinates, caretSelection,
-                             &rect, &isCollapsed, &view);
-  if (!view || rect.IsEmpty()) {
-    return nsIntRect(); // Return empty rect
-  }
-
  PRBool isVisible;
  caret->GetCaretVisible(&isVisible);
  if (!isVisible) {
    return nsIntRect();  // Return empty rect
  }
-  nsPoint offsetFromWidget;
-  *aOutWidget = view->GetNearestWidget(&offsetFromWidget);
+
+  nsRect rect;
+  nsIFrame* frame = caret->GetGeometry(caretSelection, &rect);
+  if (!frame || rect.IsEmpty()) {
+    return nsIntRect(); // Return empty rect
+  }
+
+  nsPoint offset;
+  *aOutWidget = frame->GetWindowOffset(offset);
  NS_ENSURE_TRUE(*aOutWidget, nsIntRect());
+  rect.MoveBy(offset);

-  nsPresContext *presContext = presShell->GetPresContext();
-  NS_ENSURE_TRUE(presContext, nsIntRect());
-
-  rect += offsetFromWidget;
-  caretRect = rect.ToOutsidePixels(presContext->AppUnitsPerDevPixel());
-
+  caretRect = rect.ToOutsidePixels(frame->PresContext()->AppUnitsPerDevPixel());
  caretRect.MoveBy((*aOutWidget)->WidgetToScreenOffset());

  // Correct for character size, so that caret always matches the size of the character
--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@ -38,7 +38,6 @@

 #include "nsRootAccessible.h"
 #include "nsAccessibilityAtoms.h"
-#include "nsAccEvent.h"
 #include "nsAccessibilityService.h"
 #include "nsIMutableArray.h"
 #include "nsICommandManager.h"
@ -1336,6 +1335,11 @@ void nsDocAccessible::ContentStatesChanged(nsIDocument* aDocument,
  nsHTMLSelectOptionAccessible::SelectionChangedIfOption(aContent2);
 }

+void nsDocAccessible::DocumentStatesChanged(nsIDocument* aDocument,
+                                            PRInt32 aStateMask)
+{
+}
+
 void nsDocAccessible::CharacterDataWillChange(nsIDocument *aDocument,
                                              nsIContent* aContent,
                                              CharacterDataChangeInfo* aInfo)
--- a/accessible/src/base/nsEventShell.cpp
+++ b/accessible/src/base/nsEventShell.cpp
@ -329,6 +329,18 @@ nsAccEventQueue::CoalesceEvents()
      }
    } break; // case eCoalesceFromSameSubtree

+    case nsAccEvent::eCoalesceFromSameDocument:
+    {
+      for (PRInt32 index = 0; index < tail; index ++) {
+        nsAccEvent* thisEvent = mEvents[index];
+        if (thisEvent->mEventType == tailEvent->mEventType &&
+            thisEvent->mEventRule == tailEvent->mEventRule &&
+            thisEvent->GetDocAccessible() == tailEvent->GetDocAccessible()) {
+          thisEvent->mEventRule = nsAccEvent::eDoNotEmit;
+        }
+      }
+    } break; // case eCoalesceFromSameDocument
+
    case nsAccEvent::eRemoveDupes:
    {
      // Check for repeat events.
--- a/accessible/src/base/nsEventShell.h
+++ b/accessible/src/base/nsEventShell.h
@ -39,9 +39,13 @@
 #ifndef _nsEventShell_H_
 #define _nsEventShell_H_

-#include "nsCoreUtils.h"
 #include "nsAccEvent.h"

+#include "nsAutoPtr.h"
+#include "nsCoreUtils.h"
+
+class nsIPersistentProperties;
+
 /**
 * Used for everything about events.
 */
--- a/accessible/src/base/nsRootAccessible.cpp
+++ b/accessible/src/base/nsRootAccessible.cpp
@ -37,7 +37,6 @@

 // NOTE: alphabetically ordered
 #include "nsAccessibilityService.h"
-#include "nsAccEvent.h"
 #include "nsApplicationAccessibleWrap.h"

 #include "nsHTMLSelectAccessible.h"
@ -251,8 +250,9 @@ const char* const docEvents[] = {
  // debugging a11y objects with event viewers
  "mouseover",
 #endif
-  // capture DOM focus events 
+  // capture DOM focus and DOM blur events 
  "focus",
+  "blur",
  // capture Form change events 
  "select",
  // capture ValueChange events (fired whenever value changes, immediately after, whether focus moves or not)
@ -517,26 +517,10 @@ nsRootAccessible::FireAccessibleFocusEvent(nsIAccessible *aAccessible,

  gLastFocusedFrameType = (focusFrame && focusFrame->GetStyleVisibility()->IsVisible()) ? focusFrame->GetType() : 0;

-  nsCOMPtr<nsIAccessibleDocument> docAccessible = do_QueryInterface(finalFocusAccessible);
-  if (docAccessible) {
-    // Doc is gaining focus, but actual focus may be on an element within document
-    nsCOMPtr<nsIDOMNode> realFocusedNode = GetCurrentFocus();
-    if ((realFocusedNode != aNode || realFocusedNode == mDOMNode) &&
-        !(nsAccUtils::ExtendedState(finalFocusAccessible) &
-                    nsIAccessibleStates::EXT_STATE_EDITABLE)) {
-      // Suppress document focus, because real DOM focus will be fired next,
-      // except in the case of editable documents because we can't rely on a
-      // followup focus event for an element in an editable document.
-      // Make sure we never fire focus for the nsRootAccessible (mDOMNode)
-
-      // XXX todo dig deeper on editor focus inconsistency in bug 526313
-
-      return PR_FALSE;
-    }
-  }
-
+  // Coalesce focus events from the same document, because DOM focus event might
+  // be fired for the document node and then for the focused DOM element.
  FireDelayedAccessibleEvent(nsIAccessibleEvent::EVENT_FOCUS,
-                             finalFocusNode, nsAccEvent::eRemoveDupes,
+                             finalFocusNode, nsAccEvent::eCoalesceFromSameDocument,
                             aIsAsynch, aIsFromUserInput);

  return PR_TRUE;
@ -809,6 +793,11 @@ nsresult nsRootAccessible::HandleEventWithTarget(nsIDOMEvent* aEvent,
    }
    FireAccessibleFocusEvent(accessible, focusedItem, aEvent);
  }
+  else if (eventType.EqualsLiteral("blur")) {
+    NS_IF_RELEASE(gLastFocusedNode);
+    gLastFocusedFrameType = nsnull;
+    gLastFocusedAccessiblesState = 0;
+  }
  else if (eventType.EqualsLiteral("AlertActive")) { 
    nsEventShell::FireEvent(nsIAccessibleEvent::EVENT_ALERT, accessible);
  }
--- a/accessible/src/html/nsHTMLTableAccessible.cpp
+++ b/accessible/src/html/nsHTMLTableAccessible.cpp
@ -38,7 +38,9 @@
 * ***** END LICENSE BLOCK ***** */

 #include "nsHTMLTableAccessible.h"
-#include "nsAccessibilityAtoms.h"
+
+#include "nsDocAccessible.h"
+
 #include "nsIDOMElement.h"
 #include "nsIDOMDocument.h"
 #include "nsIDOMDocumentRange.h"
@ -1374,7 +1376,7 @@ nsHTMLTableAccessible::IsProbablyForLayout(PRBool *aIsProbablyForLayout)
  if (IsDefunct())
    return NS_ERROR_FAILURE;

-  nsCOMPtr<nsIAccessible> docAccessible = do_QueryInterface(nsCOMPtr<nsIAccessibleDocument>(GetDocAccessible()));
+  nsDocAccessible *docAccessible = GetDocAccessible();
  if (docAccessible) {
    PRUint32 state, extState;
    docAccessible->GetState(&state, &extState);
--- a/accessible/src/html/nsHTMLTextAccessible.cpp
+++ b/accessible/src/html/nsHTMLTextAccessible.cpp
@ -38,8 +38,9 @@
 * ***** END LICENSE BLOCK ***** */

 #include "nsHTMLTextAccessible.h"
-#include "nsIAccessibleDocument.h"
-#include "nsIAccessibleEvent.h"
+
+#include "nsDocAccessible.h"
+
 #include "nsIFrame.h"
 #include "nsPresContext.h"
 #include "nsIPresShell.h"
@ -86,8 +87,7 @@ nsHTMLTextAccessible::GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState)
  nsresult rv = nsTextAccessible::GetStateInternal(aState, aExtraState);
  NS_ENSURE_A11Y_SUCCESS(rv, rv);

-  nsCOMPtr<nsIAccessible> docAccessible = 
-    do_QueryInterface(nsCOMPtr<nsIAccessibleDocument>(GetDocAccessible()));
+  nsDocAccessible *docAccessible = GetDocAccessible();
  if (docAccessible) {
     PRUint32 state, extState;
     docAccessible->GetState(&state, &extState);
--- a/accessible/src/html/nsHyperTextAccessible.h
+++ b/accessible/src/html/nsHyperTextAccessible.h
@ -44,7 +44,6 @@
 #include "nsIAccessibleText.h"
 #include "nsIAccessibleHyperText.h"
 #include "nsIAccessibleEditableText.h"
-#include "nsAccEvent.h"
 #include "nsTextAttrs.h"

 #include "nsFrameSelection.h"
--- a/accessible/src/msaa/nsDocAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsDocAccessibleWrap.cpp
@ -283,20 +283,17 @@ struct nsSearchAccessibleInCacheArg
 };

 static PLDHashOperator
-SearchAccessibleInCache(const void* aKey, nsAccessNode* aAccessNode,
+SearchAccessibleInCache(const void* aKey, nsDocAccessible* aDocAccessible,
                        void* aUserArg)
 {
-  nsCOMPtr<nsIAccessibleDocument> accessibleDoc(do_QueryInterface(aAccessNode));
-  NS_ASSERTION(accessibleDoc,
+  NS_ASSERTION(aDocAccessible,
               "No doc accessible for the object in doc accessible cache!");

-  nsRefPtr<nsDocAccessible> docAccessible =
-    nsAccUtils::QueryObject<nsDocAccessible>(accessibleDoc);
-  if (docAccessible) {
+  if (aDocAccessible) {
    nsSearchAccessibleInCacheArg* arg =
      static_cast<nsSearchAccessibleInCacheArg*>(aUserArg);
    nsAccessNode* accessNode =
-      docAccessible->GetCachedAccessNode(arg->mUniqueID);
+      aDocAccessible->GetCachedAccessNode(arg->mUniqueID);
    if (accessNode) {
      arg->mAccessNode = accessNode;
      return PL_DHASH_STOP;
--- a/accessible/src/msaa/nsHTMLWin32ObjectAccessible.cpp
+++ b/accessible/src/msaa/nsHTMLWin32ObjectAccessible.cpp
@ -37,7 +37,6 @@
 * ***** END LICENSE BLOCK ***** */

 #include "nsHTMLWin32ObjectAccessible.h"
-#include "nsAccessibleWrap.h"

 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLWin32ObjectOwnerAccessible
--- a/accessible/src/msaa/nsTextAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsTextAccessibleWrap.cpp
@ -39,7 +39,9 @@
 // NOTE: alphabetically ordered
 #include "nsTextAccessibleWrap.h"
 #include "ISimpleDOMText_i.c"
-#include "nsIAccessibleDocument.h"
+
+#include "nsDocAccessible.h"
+
 #include "nsIFontMetrics.h"
 #include "nsIFrame.h"
 #include "nsPresContext.h"
@ -120,11 +122,11 @@ __try {
    return rv;
  }

-  nsCOMPtr<nsIAccessibleDocument> docAccessible(GetDocAccessible());
-  nsCOMPtr<nsIAccessible> accessible(do_QueryInterface(docAccessible));
-  NS_ASSERTION(accessible, "There must always be a doc accessible, but there isn't");
+  nsDocAccessible *docAccessible = GetDocAccessible();
+  NS_ASSERTION(docAccessible,
+               "There must always be a doc accessible, but there isn't. Crash!");

-  accessible->GetBounds(&docX, &docY, &docWidth, &docHeight);
+  docAccessible->GetBounds(&docX, &docY, &docWidth, &docHeight);

  nsIntRect unclippedRect(x, y, width, height);
  nsIntRect docRect(docX, docY, docWidth, docHeight);
--- a/accessible/src/xul/nsXULTextAccessible.cpp
+++ b/accessible/src/xul/nsXULTextAccessible.cpp
@ -40,7 +40,6 @@
 // NOTE: alphabetically ordered
 #include "nsAccessibilityAtoms.h"
 #include "nsCoreUtils.h"
-#include "nsAccUtils.h"
 #include "nsBaseWidgetAccessible.h"
 #include "nsIDOMXULDescriptionElement.h"
 #include "nsINameSpaceManager.h"
--- a/accessible/tests/mochitest/Makefile.in
+++ b/accessible/tests/mochitest/Makefile.in
@ -57,7 +57,6 @@ _TEST_FILES =\
 		common.js \
 		editabletext.js \
 		events.js \
-		events_scroll.html \
 		grid.js \
 		layout.js \
 		name.css \
--- a/accessible/tests/mochitest/events.js
+++ b/accessible/tests/mochitest/events.js
@ -583,6 +583,7 @@ function sequence()
 * which will be called when proper event is handled. Invokers listen default
 * event type registered in event queue object until it is passed explicetly.
 *
+ * Note, checker object is optional.
 * Note, you don't need to initialize 'target' and 'type' members of checker
 * object. The 'target' member will be initialized by invoker object and you are
 * free to use it in 'check' method.
@ -936,14 +937,16 @@ function sequenceItem(aProcessor, aEventType, aTarget, aItemID)
 function synthAction(aNodeOrID, aChecker, aEventType)
 {
  this.DOMNode = getNode(aNodeOrID);
-  aChecker.target = this.DOMNode;
+  if (aChecker)
+    aChecker.target = this.DOMNode;

  if (aEventType)
    this.eventSeq = [ new invokerChecker(aEventType, this.DOMNode) ];

  this.check = function synthAction_check(aEvent)
  {
-    aChecker.check(aEvent);
+    if (aChecker)
+      aChecker.check(aEvent);
  }

  this.getID = function synthAction_getID() { return aNodeOrID + " action"; }
--- a/accessible/tests/mochitest/events/Makefile.in
+++ b/accessible/tests/mochitest/events/Makefile.in
@ -46,6 +46,8 @@ include $(DEPTH)/config/autoconf.mk
 include $(topsrcdir)/config/rules.mk

 _TEST_FILES =\
+		focus.html \
+		scroll.html \
 		test_attrs.html \
 		test_caretmove.html \
 	$(warning	test_coalescence.html temporarily disabled) \
@ -54,6 +56,7 @@ _TEST_FILES =\
 		test_flush.html \
 		test_focus.html \
 		test_focus.xul \
+		test_focus_name.html \
 		test_focusdoc.html \
 		test_mutation.html \
 		test_scroll.xul \
--- a/accessible/tests/mochitest/events/focus.html
+++ b/accessible/tests/mochitest/events/focus.html
@ -0,0 +1,10 @@
+<html>
+
+<head>
+  <title>editable document</title>
+</head>
+
+<body contentEditable="true">
+  editable document
+</body>
+</html>
--- a/accessible/tests/mochitest/events/scroll.html
+++ b/accessible/tests/mochitest/events/scroll.html
--- a/accessible/tests/mochitest/events/test_focus.html
+++ b/accessible/tests/mochitest/events/test_focus.html
@ -19,40 +19,59 @@
          src="chrome://mochikit/content/a11y/accessible/events.js"></script>

  <script type="application/javascript">
-    /**
-     * Checker for invokers.
-     */
-    function actionChecker(aDescription)
+    function openCloseDialog(aID)
    {
-      this.check = function actionChecker_check(aEvent)
+      this.DOMNode = getNode(aID);
+
+      this.invoke = function openCloseDialog_invoke()
      {
-        var target = aEvent.accessible;
-        is(target.description, aDescription,
-           "Wrong description for " + prettyName(target));
+        var wnd = window.open("focus.html");
+        wnd.close();
+      }
+
+      this.getID = function openCloseDialog_getID()
+      {
+        return "Open close dialog on " + prettyName(aID);
      }
    }

-    var gFocusHandler = {
-      handleEvent: function gFocusHandler_handleEvent(aEvent) {
-        var elm = aEvent.target;
-        if (elm.nodeType != nsIDOMNode.ELEMENT_NODE)
-          return;
+    function focusDocument(aFrameID)
+    {
+      this.DOMNode = getNode(aFrameID).contentDocument;

-        gTooltipElm.style.display = "block";
-
-        elm.setAttribute("aria-describedby", "tooltip");
+      this.invoke = function focusDocument_invoke()
+      {
+        this.DOMNode.body.focus();
      }
-    };

-    var gBlurHandler = {
-      handleEvent: function gBlurHandler_handleEvent(aEvent) {
-        gTooltipElm.style.display = "none";
-
-        var elm = aEvent.target;
-        if (elm.nodeType == nsIDOMNode.ELEMENT_NODE)
-          elm.removeAttribute("aria-describedby");
+      this.getID = function focusDocument_getID()
+      {
+        return "Focus document of " + prettyName(aFrameID);
      }
-    };
+    }
+
+    function focusElmWhileSubdocIsFocused(aID)
+    {
+      this.DOMNode = getNode(aID);
+
+      this.invoke = function focusElmWhileSubdocIsFocused_invoke()
+      {
+        this.DOMNode.focus();
+      }
+
+      this.eventSeq = [
+        new invokerChecker(EVENT_FOCUS, this.DOMNode)
+      ];
+
+      this.unexpectedEventSeq = [
+        new invokerChecker(EVENT_FOCUS, this.DOMNode.ownerDocument)
+      ];
+
+      this.getID = function focusElmWhileSubdocIsFocused_getID()
+      {
+        return "Focus element while subdocument is focused " + prettyName(aID);
+      }
+    }

    /**
     * Do tests.
@ -62,35 +81,21 @@

    var gQueue = null;

-    var gButtonElm = null;
-    var gTextboxElm = null;
-    var gTooltipElm = null;
-
    function doTests()
    {
-      gButtonElm = getNode("button");
-      gTextboxElm = getNode("textbox");
-      gTooltipElm = getNode("tooltip");
+      gQueue = new eventQueue(EVENT_FOCUS);

-      gButtonElm.addEventListener("focus", gFocusHandler, false);
-      gButtonElm.addEventListener("blur", gBlurHandler, false);
-      gTextboxElm.addEventListener("focus", gFocusHandler, false);
-      gTextboxElm.addEventListener("blur", gBlurHandler, false);
+      gQueue.push(new synthFocus("editablearea"));
+      gQueue.push(new synthFocus("textbox"));

-      // The aria-describedby is changed on DOM focus. Accessible description
-      // should be updated when a11y focus is fired.
-      gQueue = new eventQueue(nsIAccessibleEvent.EVENT_FOCUS);
-      gQueue.onFinish = function()
-      {
-        gButtonElm.removeEventListener("focus", gFocusHandler, false);
-        gButtonElm.removeEventListener("blur", gBlurHandler, false);
-        gTextboxElm.removeEventListener("focus", gFocusHandler, false);
-        gTextboxElm.removeEventListener("blur", gBlurHandler, false);
-      }
+      gQueue.push(new synthFocus("button"));
+      gQueue.push(new openCloseDialog("button"));

-      var checker = new actionChecker("It's a tooltip");
-      gQueue.push(new synthFocus("button", checker));
-      gQueue.push(new synthTab("textbox", checker));
+      var frameNode = getNode("editabledoc");
+      gQueue.push(new focusDocument(frameNode));
+      gQueue.push(new openCloseDialog(frameNode.contentDocument));
+
+      gQueue.push(new focusElmWhileSubdocIsFocused("button"));

      gQueue.invoke(); // Will call SimpleTest.finish();
    }
@ -103,18 +108,24 @@
 <body>

  <a target="_blank"
-     href="https://bugzilla.mozilla.org/show_bug.cgi?id=520709"
-     title="mochitest to ensure name/description are updated on a11y focus if they were changed on DOM focus">
-    Mozilla Bug 520709
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=551679"
+     title="focus is not fired for focused document when switching between windows">
+    Mozilla Bug 551679
+  </a>
+  <a target="_blank"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=352220"
+     title=" Inconsistent focus events when returning to a document frame">
+    Mozilla Bug 352220
  </a>
  <p id="display"></p>
  <div id="content" style="display: none"></div>
  <pre id="test">
  </pre>

-  <div id="tooltip" style="display: none" aria-hidden="true">It's a tooltip</div>
-  <button id="button">button</button>
+  <div id="editablearea" contentEditable="true">editable area</div>
  <input id="textbox">
+  <button id="button">button</button>
+  <iframe id="editabledoc" src="focus.html"></iframe>

  <div id="eventdump"></div>
 </body>
--- a/accessible/tests/mochitest/events/test_focus_name.html
+++ b/accessible/tests/mochitest/events/test_focus_name.html
@ -0,0 +1,121 @@
+<html>
+
+<head>
+  <title>Accessible name testing on focus</title>
+
+  <link rel="stylesheet" type="text/css"
+        href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+
+  <script type="application/javascript"
+          src="chrome://mochikit/content/MochiKit/packed.js"></script>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"></script>
+
+  <script type="application/javascript"
+          src="chrome://mochikit/content/a11y/accessible/common.js"></script>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/a11y/accessible/events.js"></script>
+
+  <script type="application/javascript">
+    /**
+     * Checker for invokers.
+     */
+    function actionChecker(aDescription)
+    {
+      this.check = function actionChecker_check(aEvent)
+      {
+        var target = aEvent.accessible;
+        is(target.description, aDescription,
+           "Wrong description for " + prettyName(target));
+      }
+    }
+
+    var gFocusHandler = {
+      handleEvent: function gFocusHandler_handleEvent(aEvent) {
+        var elm = aEvent.target;
+        if (elm.nodeType != nsIDOMNode.ELEMENT_NODE)
+          return;
+
+        gTooltipElm.style.display = "block";
+
+        elm.setAttribute("aria-describedby", "tooltip");
+      }
+    };
+
+    var gBlurHandler = {
+      handleEvent: function gBlurHandler_handleEvent(aEvent) {
+        gTooltipElm.style.display = "none";
+
+        var elm = aEvent.target;
+        if (elm.nodeType == nsIDOMNode.ELEMENT_NODE)
+          elm.removeAttribute("aria-describedby");
+      }
+    };
+
+    /**
+     * Do tests.
+     */
+
+    // gA11yEventDumpID = "eventdump"; // debug stuff
+
+    var gQueue = null;
+
+    var gButtonElm = null;
+    var gTextboxElm = null;
+    var gTooltipElm = null;
+
+    function doTests()
+    {
+      gButtonElm = getNode("button");
+      gTextboxElm = getNode("textbox");
+      gTooltipElm = getNode("tooltip");
+
+      gButtonElm.addEventListener("focus", gFocusHandler, false);
+      gButtonElm.addEventListener("blur", gBlurHandler, false);
+      gTextboxElm.addEventListener("focus", gFocusHandler, false);
+      gTextboxElm.addEventListener("blur", gBlurHandler, false);
+
+      // The aria-describedby is changed on DOM focus. Accessible description
+      // should be updated when a11y focus is fired.
+      gQueue = new eventQueue(nsIAccessibleEvent.EVENT_FOCUS);
+      gQueue.onFinish = function()
+      {
+        gButtonElm.removeEventListener("focus", gFocusHandler, false);
+        gButtonElm.removeEventListener("blur", gBlurHandler, false);
+        gTextboxElm.removeEventListener("focus", gFocusHandler, false);
+        gTextboxElm.removeEventListener("blur", gBlurHandler, false);
+      }
+
+      var checker = new actionChecker("It's a tooltip");
+      gQueue.push(new synthFocus("button", checker));
+      gQueue.push(new synthTab("textbox", checker));
+
+      gQueue.invoke(); // Will call SimpleTest.finish();
+    }
+
+    SimpleTest.waitForExplicitFinish();
+    addA11yLoadEvent(doTests);
+  </script>
+</head>
+
+<body>
+
+  <a target="_blank"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=520709"
+     title="mochitest to ensure name/description are updated on a11y focus if they were changed on DOM focus">
+    Mozilla Bug 520709
+  </a>
+  <p id="display"></p>
+  <div id="content" style="display: none"></div>
+  <pre id="test">
+  </pre>
+
+  <div id="tooltip" style="display: none" aria-hidden="true">It's a tooltip</div>
+  <button id="button">button</button>
+  <input id="textbox">
+
+  <div id="eventdump"></div>
+</body>
+</html>
--- a/accessible/tests/mochitest/events/test_scroll.xul
+++ b/accessible/tests/mochitest/events/test_scroll.xul
@ -36,6 +36,8 @@

    const Ci = Components.interfaces;

+    Components.utils.import("resource://gre/modules/Services.jsm");
+
    var XULBrowserWindow = {
      isBusy: false,
      setOverLink: function (link, b) {
@ -59,7 +61,7 @@
      registerA11yEventListener(EVENT_SCROLLING_START, gScrollHandler);

      var url =
-        "chrome://mochikit/content/a11y/accessible/events_scroll.html#link1";
+        "chrome://mochikit/content/a11y/accessible/events/scroll.html#link1";

      var tabBrowser = document.getElementById("tabBrowser");
      tabBrowser.loadURI(url);
@ -101,7 +103,16 @@
        </menu>
      </menubar>

-      <tabbrowser type="content-primary" flex="1" id="tabBrowser"/>
+      <tabs id="tabbrowser-tabs" class="tabbrowser-tabs"
+            tabbrowser="tabBrowser"
+            flex="1"
+            setfocus="false">
+        <tab class="tabbrowser-tab" selected="true"/>
+      </tabs>
+      <tabbrowser id="tabBrowser"
+                  type="content-primary"
+                  tabcontainer="tabbrowser-tabs"
+                  flex="1"/>
    </vbox>
  </hbox>

--- a/accessible/tests/mochitest/name_nsRootAcc_wnd.xul
+++ b/accessible/tests/mochitest/name_nsRootAcc_wnd.xul
@ -23,6 +23,7 @@
    }

    // Hack to make xul:tabbrowser work.
+    Components.utils.import("resource://gre/modules/Services.jsm");
    var XULBrowserWindow = {
      isBusy: false,
      setOverLink: function (link, b) {
@ -109,6 +110,15 @@
    </menu>
  </menubar>

-  <tabbrowser type="content-primary" flex="1" id="content"/>
+  <tabs id="tabbrowser-tabs" class="tabbrowser-tabs"
+        tabbrowser="content"
+        flex="1"
+        setfocus="false">
+    <tab class="tabbrowser-tab" selected="true"/>
+  </tabs>
+  <tabbrowser id="content"
+              type="content-primary"
+              tabcontainer="tabbrowser-tabs"
+              flex="1"/>

 </window>
--- a/accessible/tests/mochitest/tree/test_tabbrowser.xul
+++ b/accessible/tests/mochitest/tree/test_tabbrowser.xul
@ -26,6 +26,7 @@
    const Ci = Components.interfaces;

    // Hack to make xul:tabbrowser work.
+    Components.utils.import("resource://gre/modules/Services.jsm");
    var XULBrowserWindow = {
      isBusy: false,
      setOverLink: function (link, b) {
@ -67,42 +68,39 @@

    function testAccTree()
    {
-      var accTree = {
-        role: ROLE_PANE,
+      var tabsAccTree = {
+        role: ROLE_PAGETABLIST,
        children: [
-          {
-            role: ROLE_TOOLTIP
-          },
          {
            role: ROLE_MENUPOPUP
          },
          {
-            role: ROLE_PAGETABLIST,
+            role: ROLE_PAGETAB,
            children: [
-              {
-                role: ROLE_PAGETAB,
-                children: [
-                  {
-                    role: ROLE_PUSHBUTTON
-                  }
-                ]
-              },
-              {
-                role: ROLE_PAGETAB,
-                children: [
-                  {
-                    role: ROLE_PUSHBUTTON
-                  }
-                ]
-              },
-              {
-                role: ROLE_PUSHBUTTON
-              },
              {
                role: ROLE_PUSHBUTTON
              }
            ]
          },
+          {
+            role: ROLE_PAGETAB,
+            children: [
+              {
+                role: ROLE_PUSHBUTTON
+              }
+            ]
+          },
+          {
+            role: ROLE_PUSHBUTTON
+          },
+          {
+            role: ROLE_PUSHBUTTON
+          }
+        ]
+      };
+      var tabboxAccTree = {
+        role: ROLE_PANE,
+        children: [
          {
            role: ROLE_PROPERTYPAGE
          },
@ -111,7 +109,8 @@
          }
        ]
      };
-      testAccessibleTree(getNode("tabbrowser").mTabBox, accTree);
+      testAccessibleTree(getNode("tabbrowser").tabContainer, tabsAccTree);
+      testAccessibleTree(getNode("tabbrowser").mTabBox, tabboxAccTree);

      SimpleTest.finish()
    }
@ -121,7 +120,7 @@
  ]]>
  </script>

-  <hbox flex="1" style="overflow: auto;">
+  <vbox flex="1" style="overflow: auto;">
    <body xmlns="http://www.w3.org/1999/xhtml">
      <a target="_blank"
         href="https://bugzilla.mozilla.org/show_bug.cgi?id=540389"
@ -145,8 +144,16 @@
      </menu>
    </menubar>

-    <tabbrowser type="content-primary" flex="1" id="tabbrowser"/>
-  </hbox>
+    <tabs id="tabbrowser-tabs" class="tabbrowser-tabs"
+          tabbrowser="tabbrowser"
+          setfocus="false">
+      <tab class="tabbrowser-tab" selected="true"/>
+    </tabs>
+    <tabbrowser id="tabbrowser"
+                type="content-primary"
+                tabcontainer="tabbrowser-tabs"
+                flex="1"/>
+  </vbox>

 </window>

--- a/browser/base/content/browser.css
+++ b/browser/base/content/browser.css
@ -9,6 +9,14 @@ tabbrowser {
  -moz-binding: url("chrome://browser/content/tabbrowser.xml#tabbrowser");
 }

+.tabbrowser-tabs {
+  -moz-binding: url("chrome://browser/content/tabbrowser.xml#tabbrowser-tabs");
+}
+
+.tabbrowser-tab {
+  -moz-binding: url("chrome://browser/content/tabbrowser.xml#tabbrowser-tab");
+}
+
 toolbar[printpreview="true"] {
  -moz-binding: url("chrome://global/content/printPreviewBindings.xml#printpreviewtoolbar");
 }
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@ -270,8 +270,8 @@ function SetClickAndHoldHandlers() {
 }
 #endif

-function BookmarkThisTab() {
-  PlacesCommandHook.bookmarkPage(gBrowser.mContextTab.linkedBrowser,
+function BookmarkThisTab(aTab) {
+  PlacesCommandHook.bookmarkPage(aTab.linkedBrowser,
                                 PlacesUtils.bookmarksMenuFolderId, true);
 }

@ -1216,9 +1216,7 @@ function delayedStartup(isLoadingBlank, mustLoadSidebar) {
  initializeSanitizer();

  // Enable/Disable auto-hide tabbar
-  gAutoHideTabbarPrefListener.toggleAutoHideTabbar();
-  gPrefService.addObserver(gAutoHideTabbarPrefListener.domain,
-                           gAutoHideTabbarPrefListener, false);
+  gBrowser.tabContainer.updateVisibility();

  gPrefService.addObserver(gHomeButton.prefDomain, gHomeButton, false);

@ -1405,8 +1403,6 @@ function BrowserShutdown()
  PlacesStarButton.uninit();

  try {
-    gPrefService.removeObserver(gAutoHideTabbarPrefListener.domain,
-                                gAutoHideTabbarPrefListener);
    gPrefService.removeObserver(gHomeButton.prefDomain, gHomeButton);
  } catch (ex) {
    Components.utils.reportError(ex);
@ -1516,26 +1512,6 @@ function nonBrowserWindowShutdown()
 }
 #endif

-var gAutoHideTabbarPrefListener = {
-  domain: "browser.tabs.autoHide",
-  observe: function (aSubject, aTopic, aPrefName) {
-    if (aTopic == "nsPref:changed" && aPrefName == this.domain)
-      this.toggleAutoHideTabbar();
-  },
-  toggleAutoHideTabbar: function () {
-    if (gBrowser.tabContainer.childNodes.length == 1 &&
-        window.toolbar.visible) {
-      var aVisible = false;
-      try {
-        aVisible = !gPrefService.getBoolPref(this.domain);
-      }
-      catch (e) {
-      }
-      gBrowser.setStripVisibilityTo(aVisible);
-    }
-  }
-}
-
 function initializeSanitizer()
 {
  const kDidSanitizeDomain = "privacy.sanitize.didShutdownSanitize";
@ -2595,8 +2571,6 @@ var PrintPreviewListener = {
    this._chromeState.sidebarOpen = !sidebar.hidden;
    this._sidebarCommand = sidebar.getAttribute("sidebarcommand");

-    gBrowser.mStrip.setAttribute("moz-collapsed", "true");
-
    var notificationBox = gBrowser.getNotificationBox();
    this._chromeState.notificationsOpen = !notificationBox.notificationsHidden;
    notificationBox.notificationsHidden = true;
@ -2610,8 +2584,6 @@ var PrintPreviewListener = {
    gFindBar.close();
  },
  _showChrome: function () {
-    gBrowser.mStrip.removeAttribute("moz-collapsed");
-
    if (this._chromeState.notificationsOpen)
      gBrowser.getNotificationBox().notificationsHidden = false;

@ -3676,8 +3648,7 @@ var FullScreen =
    var animateFrameAmount = 2;
    function animateUpFrame() {
      animateFrameAmount *= 2;
-      if (animateFrameAmount >=
-          (gNavToolbox.boxObject.height + gBrowser.mStrip.boxObject.height)) {
+      if (animateFrameAmount >= gNavToolbox.boxObject.height) {
        // We've animated enough
        clearInterval(FullScreen._animationInterval);
        gNavToolbox.style.marginTop = "0px";
@ -3726,7 +3697,6 @@ var FullScreen =
                                                   this._collapseCallback, false);
    }

-    gBrowser.mStrip.setAttribute("moz-collapsed", !aShow);
    var allFSToolbars = document.getElementsByTagNameNS(this._XULNS, "toolbar");
    for (var i = 0; i < allFSToolbars.length; i++) {
      if (allFSToolbars[i].getAttribute("fullscreentoolbar") == "true")
@ -5944,30 +5914,72 @@ var gMissingPluginInstaller = {
    return this.crashReportHelpURL;
  },

+  addLinkClickCallback: function (linkNode, callbackName, callbackArg) {
+    // XXX just doing (callback)(arg) was giving a same-origin error. bug?
+    let self = this;
+    linkNode.addEventListener("click",
+                              function(evt) {
+                                if (!evt.isTrusted)
+                                  return;
+                                evt.preventDefault();
+                                if (callbackArg == undefined)
+                                  callbackArg = evt;
+                                (self[callbackName])(callbackArg);
+                              },
+                              true);
+
+    linkNode.addEventListener("keydown",
+                              function(evt) {
+                                if (!evt.isTrusted)
+                                  return;
+                                if (evt.keyCode == evt.DOM_VK_RETURN) {
+                                  evt.preventDefault();
+                                  if (callbackArg == undefined)
+                                    callbackArg = evt;
+                                  evt.preventDefault();
+                                  (self[callbackName])(callbackArg);
+                                }
+                              },
+                              true);
+  },
+
+  // Callback for user clicking on a missing (unsupported) plugin.
  installSinglePlugin: function (aEvent) {
-    if (!aEvent.isTrusted)
-        return;
    var missingPluginsArray = {};

    var pluginInfo = getPluginInfo(aEvent.target);
    missingPluginsArray[pluginInfo.mimetype] = pluginInfo;

-    if (missingPluginsArray) {
-      openDialog("chrome://mozapps/content/plugins/pluginInstallerWizard.xul",
-                 "PFSWindow", "chrome,centerscreen,resizable=yes",
-                 {plugins: missingPluginsArray, browser: gBrowser.selectedBrowser});
-    }
-
-    aEvent.stopPropagation();
+    openDialog("chrome://mozapps/content/plugins/pluginInstallerWizard.xul",
+               "PFSWindow", "chrome,centerscreen,resizable=yes",
+               {plugins: missingPluginsArray, browser: gBrowser.selectedBrowser});
  },

+  // Callback for user clicking on a disabled plugin
  managePlugins: function (aEvent) {
-    if (!aEvent.isTrusted)
-        return;
    BrowserOpenAddonsMgr("plugins");
-    aEvent.stopPropagation();
  },

+  // Callback for user clicking "submit a report" link
+  submitReport : function(minidumpID) {
+    // The crash reporter wants a DOM element it can append an IFRAME to,
+    // which it uses to submit a form. Let's just give it gBrowser.
+    this.CrashSubmit.submit(minidumpID, gBrowser, null, null);
+  },
+
+  // Callback for user clicking a "reload page" link
+  reloadPage: function (browser) {
+    browser.reload();
+  },
+
+  // Callback for user clicking the help icon
+  openHelpPage: function () {
+    openHelpLink("plugin-crashed", false);
+  },
+
+
+
+  // event listener for missing/blocklisted/outdated plugins.
  newMissingPlugin: function (aEvent) {
    // Since we are expecting also untrusted events, make sure
    // that the target is a plugin
@ -5982,14 +5994,7 @@ var gMissingPluginInstaller = {
    if (aEvent.type != "PluginBlocklisted" &&
        aEvent.type != "PluginOutdated" &&
        !(aEvent.target instanceof HTMLObjectElement)) {
-      aEvent.target.addEventListener("click",
-                                     gMissingPluginInstaller.installSinglePlugin,
-                                     true);
-      aEvent.target.addEventListener("keydown",
-                                     function(evt) { if (evt.keyCode == evt.DOM_VK_RETURN)
-                                                       gMissingPluginInstaller.installSinglePlugin(evt) },
-                                     true);
-                                                    
+          gMissingPluginInstaller.addLinkClickCallback(aEvent.target, "installSinglePlugin");
    }

    let hideBarPrefName = aEvent.type == "PluginOutdated" ?
@ -6110,13 +6115,7 @@ var gMissingPluginInstaller = {
    if (!(aEvent.target instanceof Ci.nsIObjectLoadingContent))
      return;

-    aEvent.target.addEventListener("click",
-                                   gMissingPluginInstaller.managePlugins,
-                                   true);
-    aEvent.target.addEventListener("keydown",
-                                   function(evt) { if (evt.keyCode == evt.DOM_VK_RETURN)
-                                                     gMissingPluginInstaller.managePlugins(evt) },
-                                   true);
+    gMissingPluginInstaller.addLinkClickCallback(aEvent.target, "managePlugins");
  },

  // Crashed-plugin observer. Notified once per plugin crash, before events
@ -6128,17 +6127,24 @@ var gMissingPluginInstaller = {
     return;

 #ifdef MOZ_CRASHREPORTER
-    let minidumpID = subject.getPropertyAsAString("minidumpID");
-    let submitted = gCrashReporter.submitReports && minidumpID.length;
-    // The crash reporter wants a DOM element it can append an IFRAME to,
-    // which it uses to submit a form. Let's just give it gBrowser.
-    if (submitted)
-      submitted = gMissingPluginInstaller.CrashSubmit.submit(minidumpID, gBrowser, null, null);
-    propertyBag.setPropertyAsBool("submittedCrashReport", submitted);
+    let minidumpID   = propertyBag.getPropertyAsAString("minidumpID");
+    let shouldSubmit = gCrashReporter.submitReports;
+    let doPrompt     = true; // XXX followup to get via gCrashReporter
+
+    // Submit automatically when appropriate.
+    if (minidumpID && shouldSubmit && !doPrompt) {
+      this.submitReport(minidumpID);
+      // Submission is async, so we can't easily show failure UI.
+      propertyBag.setPropertyAsBool("submittedCrashReport", true);
+    }
 #endif
  },

+  // Crashed-plugin event listener. Called for every instance of a
+  // plugin in content.
  pluginInstanceCrashed: function (aEvent) {
+    let self = gMissingPluginInstaller;
+
    // Evil content could fire a fake event at us, ignore them.
    if (!aEvent.isTrusted)
      return;
@ -6147,7 +6153,10 @@ var gMissingPluginInstaller = {
      return;

    let submittedReport = aEvent.getData("submittedCrashReport");
+    let doPrompt        = true; // XXX followup for .getData("doPrompt");
+    let submitReports   = true; // XXX followup for .getData("submitReports");
    let pluginName      = aEvent.getData("pluginName");
+    let minidumpID      = aEvent.getData("minidumpID");

    // We're expecting this to be a plugin.
    let plugin = aEvent.target;
@ -6171,36 +6180,77 @@ var gMissingPluginInstaller = {
    overlay.removeAttribute("role");

 #ifdef MOZ_CRASHREPORTER
+    // Determine which message to show regarding crash reports.
    let helpClass, showClass;
-
-    // If we didn't submit a report but don't have submission disabled,
-    // we probably just didn't collect a crash report; don't put up any 
-    // special crashing text.
-    if (submittedReport) {
-      helpClass = "submitLink";
+    if (submittedReport) { // submitReports && !doPrompt, handled in observer
      showClass = "msg msgSubmitted";
    }
-    else if (!gCrashReporter.submitReports) {
-      helpClass = "notSubmitLink";
+    else if (!submitReports && !doPrompt) {
      showClass = "msg msgNotSubmitted";
    }
+    else { // doPrompt
+      showClass = "msg msgPleaseSubmit";
+      // XXX can we make the link target actually be blank?
+      let pleaseLink = doc.getAnonymousElementByAttribute(
+                            plugin, "class", "pleaseSubmitLink");
+      self.addLinkClickCallback(pleaseLink, "submitReport", minidumpID);
+    }

-    if (helpClass) {
-      let helpLink = doc.getAnonymousElementByAttribute(plugin, "class", helpClass);
-      helpLink.href = gMissingPluginInstaller.crashReportHelpURL;
-      let textToShow = doc.getAnonymousElementByAttribute(plugin, "class", showClass);
-      textToShow.style.display = "block";
+    // If we don't have a minidumpID, we can't (or didn't) submit anything.
+    // This can happen if the plugin is killed from the task manager.
+    if (!minidumpID) {
+        showClass = "msg msgNoCrashReport";
+    }
+
+    let textToShow = doc.getAnonymousElementByAttribute(plugin, "class", showClass);
+    textToShow.style.display = "block";
+
+    let bottomLinks = doc.getAnonymousElementByAttribute(plugin, "class", "msg msgBottomLinks");
+    bottomLinks.style.display = "block";
+    let helpIcon = doc.getAnonymousElementByAttribute(plugin, "class", "helpIcon");
+    self.addLinkClickCallback(helpIcon, "openHelpPage");
+
+    // If we're showing the link to manually trigger report submission, we'll
+    // want to be able to update all the instances of the UI for this crash to
+    // show an updated message when a report is submitted.
+    if (doPrompt) {
+      let observer = {
+        QueryInterface: XPCOMUtils.generateQI([Ci.nsIObserver,
+                                               Ci.nsISupportsWeakReference]),
+        observe : function(subject, topic, data) {
+          let propertyBag = subject;
+          if (!(propertyBag instanceof Ci.nsIPropertyBag2))
+            return;
+          // Ignore notifications for other crashes.
+          if (propertyBag.get("minidumpID") != minidumpID)
+            return;
+          self.updateSubmissionStatus(plugin, propertyBag, data);
+        },
+
+        handleEvent : function(event) {
+            // Not expected to be called, just here for the closure.
+        }
+      }
+
+      // Use a weak reference, so we don't have to remove it...
+      Services.obs.addObserver(observer, "crash-report-status", true);
+      // ...alas, now we need something to hold a strong reference to prevent
+      // it from being GC. But I don't want to manually manage the reference's
+      // lifetime (which should be no greater than the page).
+      // Clever solution? Use a closue with an event listener on the document.
+      // When the doc goes away, so do the listener references and the closure.
+      doc.addEventListener("mozCleverClosureHack", observer, false);
    }
 #endif

    let crashText = doc.getAnonymousElementByAttribute(plugin, "class", "msg msgCrashed");
    crashText.textContent = messageString;

-    let link = doc.getAnonymousElementByAttribute(plugin, "class", "reloadLink");
-    link.addEventListener("click", function(e) { if (e.isTrusted) browser.reload(); }, true);
+    let browser = gBrowser.getBrowserForDocument(doc.defaultView.top.document);
+
+    let link = doc.getAnonymousElementByAttribute(plugin, "class", "reloadLink");
+    self.addLinkClickCallback(link, "reloadPage", browser);

-    let browser = gBrowser.getBrowserForDocument(plugin.ownerDocument
-                                                       .defaultView.top.document);
    let notificationBox = gBrowser.getNotificationBox(browser);

    // Is the <object>'s size too small to hold what we want to show?
@ -6216,7 +6266,7 @@ var gMissingPluginInstaller = {
        // If another plugin on the page was large enough to show our UI, we
        // don't want to show a notification bar.
        if (!doc.mozNoPluginCrashedNotification)
-          showNotificationBar();
+          showNotificationBar(minidumpID);
    } else {
        // If a previous plugin on the page was too small and resulted in
        // adding a notification bar, then remove it because this plugin
@ -6231,7 +6281,7 @@ var gMissingPluginInstaller = {
        notificationBox.removeNotification(notification, true);
    }

-    function showNotificationBar() {
+    function showNotificationBar(minidumpID) {
      // If there's already an existing notification bar, don't do anything.
      let notification = notificationBox.getNotificationWithValue("plugin-crashed");
      if (notification)
@ -6240,22 +6290,68 @@ var gMissingPluginInstaller = {
      // Configure the notification bar
      let priority = notificationBox.PRIORITY_WARNING_MEDIUM;
      let iconURL = "chrome://mozapps/skin/plugins/pluginGeneric-16.png";
-      let label = gNavigatorBundle.getString("crashedpluginsMessage.reloadButton.label");
-      let accessKey = gNavigatorBundle.getString("crashedpluginsMessage.reloadButton.accesskey");
+      let reloadLabel = gNavigatorBundle.getString("crashedpluginsMessage.reloadButton.label");
+      let reloadKey   = gNavigatorBundle.getString("crashedpluginsMessage.reloadButton.accesskey");
+      let submitLabel = gNavigatorBundle.getString("crashedpluginsMessage.submitButton.label");
+      let submitKey   = gNavigatorBundle.getString("crashedpluginsMessage.submitButton.accesskey");

-      let buttons = [{
-        label: label,
-        accessKey: accessKey,
-        popup: null,
-        callback: function() { browser.reload(); },
-      }];
+      let buttons = [
+#ifdef MOZ_CRASHREPORTER
+        {
+          label: submitLabel,
+          accessKey: submitKey,
+          popup: null,
+          callback: function() { gMissingPluginInstaller.submitReport(minidumpID); },
+        },
+#endif
+        {
+          label: reloadLabel,
+          accessKey: reloadKey,
+          popup: null,
+          callback: function() { browser.reload(); },
+        }];

      let notification = notificationBox.appendNotification(messageString, "plugin-crashed",
                                                            iconURL, priority, buttons);
+
+      // Add the "learn more" link.
+      let XULNS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+      let link = notification.ownerDocument.createElementNS(XULNS, "label");
+      link.className = "text-link";
+      link.setAttribute("value", gNavigatorBundle.getString("crashedpluginsMessage.learnMore"));
+      link.href = gMissingPluginInstaller.crashReportHelpURL;
+      let description = notification.ownerDocument.getAnonymousElementByAttribute(notification, "anonid", "messageText");
+      description.appendChild(link);
    }

  },

+  updateSubmissionStatus : function (plugin, propBag, status) {
+    let doc = plugin.ownerDocument;
+
+    // One of these two may already be visible, reset them to be hidden.
+    let pleaseText     = doc.getAnonymousElementByAttribute(plugin, "class", "msg msgPleaseSubmit");
+    let submittingText = doc.getAnonymousElementByAttribute(plugin, "class", "msg msgSubmitting");
+    pleaseText.style.display = "";
+    submittingText.style.display = "";
+
+    let msgClass;
+    switch (status) {
+      case "submitting":
+        msgClass = "msg msgSubmitting";
+        break;
+      case "success":
+        msgClass = "msg msgSubmitted";
+        break;
+      case "failed":
+        msgClass = "msg msgSubmitFailed";
+        break;
+    }
+
+    let textToShow = doc.getAnonymousElementByAttribute(plugin, "class", msgClass);
+    textToShow.style.display = "block";
+  },
+
  refreshBrowser: function (aEvent) {
    // browser elements are anonymous so we can't just use target.
    var browser = aEvent.originalTarget;
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@ -311,6 +311,8 @@
              style="&dialog.style;"
              hidden="true"/>
    </panel>
+
+    <tooltip id="tabbrowser-tab-tooltip" onpopupshowing="gBrowser.createTooltip(event);"/>
  </popupset>

  <toolbox id="navigator-toolbox" class="toolbox-top" mode="icons"
@ -516,6 +518,18 @@
      </toolbaritem>
    </toolbar>

+    <toolbar id="TabsToolbar"
+             fullscreentoolbar="true"
+             collapsed="true">
+      <tabs id="tabbrowser-tabs" class="tabbrowser-tabs"
+            tabbrowser="content"
+            flex="1"
+            setfocus="false"
+            tooltip="tabbrowser-tab-tooltip">
+        <tab class="tabbrowser-tab" selected="true"/>
+      </tabs>
+    </toolbar>
+
    <toolbarpalette id="BrowserToolbarPalette">

      <toolbarbutton id="print-button" class="toolbarbutton-1 chromeclass-toolbar-additional"
@ -603,6 +617,7 @@
    <vbox id="appcontent" flex="1">
      <tabbrowser id="content" disablehistory="true"
                  flex="1" contenttooltip="aHTMLTooltip"
+                  tabcontainer="tabbrowser-tabs"
                  contentcontextmenu="contentAreaContextMenu"
                  autocompletepopup="PopupAutoComplete"
                  ondrop="contentAreaDNDObserver.onDrop(event)"
--- a/browser/base/content/tabbrowser.css
+++ b/browser/base/content/tabbrowser.css
@ -1,9 +1,5 @@
-.tabbrowser-tabs {
-  -moz-binding: url("chrome://browser/content/tabbrowser.xml#tabbrowser-tabs");
-}
-
-.tabbrowser-tab {
-  -moz-binding: url("chrome://browser/content/tabbrowser.xml#tabbrowser-tab");
+.tabbrowser-tabbox {
+  -moz-binding: url("chrome://browser/content/tabbrowser.xml#tabbrowser-tabbox");
 }

 .tabbrowser-arrowscrollbox {
@ -31,8 +27,8 @@
  display: -moz-box;
 }

-.tabs-container:not([overflow="true"]) > .tabs-newtab-button,
-.tabs-container[overflow="true"] > .tabbrowser-arrowscrollbox > .tabs-newtab-button {
+.tabbrowser-tabs:not([overflow="true"]) > .tabs-newtab-button,
+.tabbrowser-tabs[overflow="true"] > .tabbrowser-arrowscrollbox > .tabs-newtab-button {
  visibility: collapse;
 }

--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
--- a/browser/base/content/test/Makefile.in
+++ b/browser/base/content/test/Makefile.in
@ -91,6 +91,7 @@ _BROWSER_FILES = \
                 browser_bug356571.js \
                 browser_bug386835.js \
                 browser_bug405137.js \
+                 browser_bug406216.js \
                 browser_bug409481.js \
                 browser_bug413915.js \
                 browser_bug416661.js \
--- a/browser/base/content/test/browser_bug406216.js
+++ b/browser/base/content/test/browser_bug406216.js
@ -0,0 +1,86 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Firefox Browser Test Code.
+ *
+ * The Initial Developer of the Original Code is
+ * SHIMODA Hiroshi <piro@p.club.ne.jp>.
+ * Portions created by the Initial Developer are Copyright (C) 2008
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+/*
+ * "TabClose" event is possibly used for closing related tabs of the current.
+ * "removeTab" method should work correctly even if the number of tabs are
+ * changed while "TabClose" event.
+ */
+
+var count = 0;
+const URIS = ["about:config",
+              "about:plugins",
+              "about:buildconfig",
+              "data:text/html,<title>OK</title>"];
+
+function test() {
+  waitForExplicitFinish();
+  URIS.forEach(addTab);
+}
+
+function addTab(aURI, aIndex) {
+  var tab = gBrowser.addTab(aURI);
+  if (aIndex == 0)
+    gBrowser.removeTab(gBrowser.mTabs[0]);
+
+  tab.linkedBrowser.addEventListener("load", function (event) {
+    event.currentTarget.removeEventListener("load", arguments.callee, true);
+    if (++count == URIS.length)
+      executeSoon(doTabsTest);
+  }, true);
+}
+
+function doTabsTest() {
+  is(gBrowser.mTabs.length, URIS.length, "Correctly opened all expected tabs");
+
+  // sample of "close related tabs" feature
+  gBrowser.tabContainer.addEventListener("TabClose", function (event) {
+    event.currentTarget.removeEventListener("TabClose", arguments.callee, true);
+    var closedTab = event.originalTarget;
+    var scheme = closedTab.linkedBrowser.currentURI.scheme;
+    Array.slice(gBrowser.mTabs).forEach(function (aTab) {
+      if (aTab != closedTab && aTab.linkedBrowser.currentURI.scheme == scheme)
+        gBrowser.removeTab(aTab);
+    });
+  }, true);
+
+  gBrowser.removeTab(gBrowser.mTabs[0]);
+  is(gBrowser.mTabs.length, 1, "Related tabs are not closed unexpectedly");
+
+  gBrowser.addTab("about:blank");
+  gBrowser.removeTab(gBrowser.mTabs[0]);
+  finish();
+}
--- a/browser/components/safebrowsing/content/test/browser_bug415846.js
+++ b/browser/components/safebrowsing/content/test/browser_bug415846.js
@ -7,17 +7,17 @@ var menu;

 function test() {
  waitForExplicitFinish();
-  
+
  gBrowser.selectedTab = gBrowser.addTab();

  // Navigate to a normal site
-  gBrowser.addEventListener("load", testNormal, false);
+  gBrowser.addEventListener("DOMContentLoaded", testNormal, false);
  content.location = "http://example.com/";
 }

 function testNormal() {
-  gBrowser.removeEventListener("load", testNormal, false);
-  
+  gBrowser.removeEventListener("DOMContentLoaded", testNormal, false);
+
  // open the menu, to force it to update
  menu = document.getElementById("menu_HelpPopup");
  ok(menu, "Help menu should exist!");
@ -38,7 +38,7 @@ function testNormal_PopupListener() {
  // Now launch the phishing test.  Can't use onload here because error pages don't
  // fire normal load events.
  content.location = "http://www.mozilla.com/firefox/its-a-trap.html";
-  window.setTimeout(testPhishing, 2000);
+  setTimeout(testPhishing, 2000);
 }

 function testPhishing() {
--- a/browser/components/sessionstore/src/nsSessionStore.js
+++ b/browser/components/sessionstore/src/nsSessionStore.js
@ -551,6 +551,12 @@ SessionStoreService.prototype = {
    var win = aEvent.currentTarget.ownerDocument.defaultView;
    switch (aEvent.type) {
      case "load":
+        // If __SS_restore_data is set, then we need to restore the document
+        // (form data, scrolling, etc.). This will only happen when a tab is
+        // first restored.
+        if (aEvent.currentTarget.__SS_restore_data)
+          this.restoreDocument(win, aEvent.currentTarget, aEvent);
+        // We still need to call onTabLoad, so fall through to "pageshow" case.
      case "pageshow":
        this.onTabLoad(win, aEvent.currentTarget, aEvent);
        break;
@ -2113,14 +2119,6 @@ SessionStoreService.prototype = {
    Array.filter(tab.attributes, function(aAttr) {
      return (_this.xulAttributes.indexOf(aAttr.name) > -1);
    }).forEach(tab.removeAttribute, tab);
-    if (tabData.xultab) {
-      // restore attributes from the legacy Firefox 2.0/3.0 format
-      tabData.xultab.split(" ").forEach(function(aAttr) {
-        if (/^([^\s=]+)=(.*)/.test(aAttr)) {
-          tab.setAttribute(RegExp.$1, decodeURI(RegExp.$2));
-        }
-      });
-    }
    for (let name in tabData.attributes)
      tab.setAttribute(name, tabData.attributes[name]);
    
@ -2149,11 +2147,8 @@ SessionStoreService.prototype = {
      // which are not preserved in the plain history entries
      // (mainly scroll state and text data)
      browser.__SS_restore_data = tabData.entries[activeIndex] || {};
-      browser.__SS_restore_text = tabData.text || "";
      browser.__SS_restore_pageStyle = tabData.pageStyle || "";
      browser.__SS_restore_tab = tab;
-      browser.__SS_restore = this.restoreDocument_proxy;
-      browser.addEventListener("load", browser.__SS_restore, true);
    }

    // Handle userTypedValue. Setting userTypedValue seems to update gURLbar
@ -2222,14 +2217,8 @@ SessionStoreService.prototype = {
      shEntry.setScrollPosition(scrollPos[0], scrollPos[1]);
    }

-    var postdata;
-    if (aEntry.postdata_b64) {  // Firefox 3
-      postdata = atob(aEntry.postdata_b64);
-    } else if (aEntry.postdata) { // Firefox 2
-      postdata = aEntry.postdata;
-    }
-
-    if (postdata) {
+    if (aEntry.postdata_b64) {
+      var postdata = atob(aEntry.postdata_b64);
      var stream = Cc["@mozilla.org/io/string-input-stream;1"].
                   createInstance(Ci.nsIStringInputStream);
      stream.setData(postdata, postdata.length);
@ -2258,7 +2247,7 @@ SessionStoreService.prototype = {
      }
    }

-    if (aEntry.owner_b64) {  // Firefox 3
+    if (aEntry.owner_b64) {
      var ownerInput = Cc["@mozilla.org/io/string-input-stream;1"].
                       createInstance(Ci.nsIStringInputStream);
      var binaryData = atob(aEntry.owner_b64);
@ -2269,11 +2258,8 @@ SessionStoreService.prototype = {
      try { // Catch possible deserialization exceptions
        shEntry.owner = binaryStream.readObject(true);
      } catch (ex) { debug(ex); }
-    } else if (aEntry.ownerURI) { // Firefox 2
-      var uriObj = IOSvc.newURI(aEntry.ownerURI, null, null);
-      shEntry.owner = SecuritySvc.getCodebasePrincipal(uriObj);
    }
-    
+
    if (aEntry.children && shEntry instanceof Ci.nsISHContainer) {
      for (var i = 0; i < aEntry.children.length; i++) {
        //XXXzpao Wallpaper patch for bug 514751
@ -2310,52 +2296,33 @@ SessionStoreService.prototype = {
  /**
   * Restore properties to a loaded document
   */
-  restoreDocument_proxy: function sss_restoreDocument_proxy(aEvent) {
+  restoreDocument: function sss_restoreDocument(aWindow, aBrowser, aEvent) {
    // wait for the top frame to be loaded completely
    if (!aEvent || !aEvent.originalTarget || !aEvent.originalTarget.defaultView || aEvent.originalTarget.defaultView != aEvent.originalTarget.defaultView.top) {
      return;
    }
-    
+
    // always call this before injecting content into a document!
    function hasExpectedURL(aDocument, aURL)
      !aURL || aURL.replace(/#.*/, "") == aDocument.location.href.replace(/#.*/, "");
-    
-    // restore text data saved by Firefox 2.0/3.0
-    var textArray = this.__SS_restore_text ? this.__SS_restore_text.split(" ") : [];
-    function restoreTextData(aContent, aPrefix, aURL) {
-      textArray.forEach(function(aEntry) {
-        if (/^((?:\d+\|)*)(#?)([^\s=]+)=(.*)$/.test(aEntry) &&
-            RegExp.$1 == aPrefix && hasExpectedURL(aContent.document, aURL)) {
-          var document = aContent.document;
-          var node = RegExp.$2 ? document.getElementById(RegExp.$3) : document.getElementsByName(RegExp.$3)[0] || null;
-          if (node && "value" in node && node.type != "file") {
-            node.value = decodeURI(RegExp.$4);
-            
-            var event = document.createEvent("UIEvents");
-            event.initUIEvent("input", true, true, aContent, 0);
-            node.dispatchEvent(event);
-          }
-        }
-      });
-    }
-    
+
    function restoreFormData(aDocument, aData, aURL) {
      for (let key in aData) {
        if (!hasExpectedURL(aDocument, aURL))
          return;
-        
+
        let node = key.charAt(0) == "#" ? aDocument.getElementById(key.slice(1)) :
                                          XPathHelper.resolve(aDocument, key);
        if (!node)
          continue;
-        
+
        let value = aData[key];
        if (typeof value == "string" && node.type != "file") {
          if (node.value == value)
            continue; // don't dispatch an input event for no change
-          
+
          node.value = value;
-          
+
          let event = aDocument.createEvent("UIEvents");
          event.initUIEvent("input", true, true, aDocument.defaultView, 0);
          node.dispatchEvent(event);
@ -2376,16 +2343,13 @@ SessionStoreService.prototype = {
        // NB: dispatching "change" events might have unintended side-effects
      }
    }
-    
-    let selectedPageStyle = this.__SS_restore_pageStyle;
-    let window = this.ownerDocument.defaultView;
+
+    let selectedPageStyle = aBrowser.__SS_restore_pageStyle;
    function restoreTextDataAndScrolling(aContent, aData, aPrefix) {
      if (aData.formdata)
        restoreFormData(aContent.document, aData.formdata, aData.url);
-      else
-        restoreTextData(aContent, aPrefix, aData.url);
      if (aData.innerHTML) {
-        window.setTimeout(function() {
+        aWindow.setTimeout(function() {
          if (aContent.document.designMode == "on" &&
              hasExpectedURL(aContent.document, aData.url)) {
            aContent.document.body.innerHTML = aData.innerHTML;
@ -2405,31 +2369,28 @@ SessionStoreService.prototype = {
        }
      }
    }
-    
+
    // don't restore text data and scrolling state if the user has navigated
    // away before the loading completed (except for in-page navigation)
-    if (hasExpectedURL(aEvent.originalTarget, this.__SS_restore_data.url)) {
+    if (hasExpectedURL(aEvent.originalTarget, aBrowser.__SS_restore_data.url)) {
      var content = aEvent.originalTarget.defaultView;
-      if (this.currentURI.spec == "about:config") {
+      if (aBrowser.currentURI.spec == "about:config") {
        // unwrap the document for about:config because otherwise the properties
        // of the XBL bindings - as the textbox - aren't accessible (see bug 350718)
        content = content.wrappedJSObject;
      }
-      restoreTextDataAndScrolling(content, this.__SS_restore_data, "");
-      this.markupDocumentViewer.authorStyleDisabled = selectedPageStyle == "_nostyle";
-      
+      restoreTextDataAndScrolling(content, aBrowser.__SS_restore_data, "");
+      aBrowser.markupDocumentViewer.authorStyleDisabled = selectedPageStyle == "_nostyle";
+
      // notify the tabbrowser that this document has been completely restored
-      var event = this.ownerDocument.createEvent("Events");
+      var event = aBrowser.ownerDocument.createEvent("Events");
      event.initEvent("SSTabRestored", true, false);
-      this.__SS_restore_tab.dispatchEvent(event);
+      aBrowser.__SS_restore_tab.dispatchEvent(event);
    }
-    
-    this.removeEventListener("load", this.__SS_restore, true);
-    delete this.__SS_restore_data;
-    delete this.__SS_restore_text;
-    delete this.__SS_restore_pageStyle;
-    delete this.__SS_restore_tab;
-    delete this.__SS_restore;
+
+    delete aBrowser.__SS_restore_data;
+    delete aBrowser.__SS_restore_pageStyle;
+    delete aBrowser.__SS_restore_tab;
  },

  /**
@ -2523,26 +2484,11 @@ SessionStoreService.prototype = {
  },

  /**
-   * Restores cookies (accepting both Firefox 2.0 and current format)
+   * Restores cookies
   * @param aCookies
   *        Array of cookie objects
   */
  restoreCookies: function sss_restoreCookies(aCookies) {
-    if (aCookies.count && aCookies.domain1) {
-      // convert to the new cookie serialization format
-      var converted = [];
-      for (var i = 1; i <= aCookies.count; i++) {
-        // for simplicity we only accept the format we produced ourselves
-        var parsed = aCookies["value" + i].match(/^([^=;]+)=([^;]*);(?:domain=[^;]+;)?(?:path=([^;]*);)?(secure;)?(httponly;)?/);
-        if (parsed && /^https?:\/\/([^\/]+)/.test(aCookies["domain" + i]))
-          converted.push({
-            host: RegExp.$1, path: parsed[3], name: parsed[1], value: parsed[2],
-            secure: parsed[4], httponly: parsed[5]
-          });
-      }
-      aCookies = converted;
-    }
-
    // MAX_EXPIRY should be 2^63-1, but JavaScript can't handle that precision
    var MAX_EXPIRY = Math.pow(2, 62);
    for (i = 0; i < aCookies.length; i++) {
--- a/browser/components/sessionstore/test/browser/browser_394759.js
+++ b/browser/components/sessionstore/test/browser/browser_394759.js
@ -73,8 +73,8 @@ function test() {
  
    let newWin = openDialog(location, "", "chrome,all,dialog=no", testURL);
    newWin.addEventListener("load", function(aEvent) {
-      newWin.gBrowser.addEventListener("load", function(aEvent) {
-        newWin.gBrowser.removeEventListener("load", arguments.callee, true);
+      newWin.gBrowser.selectedBrowser.addEventListener("load", function(aEvent) {
+        newWin.gBrowser.selectedBrowser.removeEventListener("load", arguments.callee, true);

        executeSoon(function() {
          newWin.gBrowser.addTab().linkedBrowser.stop();
@ -101,8 +101,8 @@ function test() {
               "The reopened window was removed from Recently Closed Windows");

            newWin2.addEventListener("load", function(aEvent) {
-              newWin2.gBrowser.addEventListener("SSTabRestored", function(aEvent) {
-                newWin2.gBrowser.removeEventListener("SSTabRestored", arguments.callee, true);
+              newWin2.gBrowser.tabContainer.addEventListener("SSTabRestored", function(aEvent) {
+                newWin2.gBrowser.tabContainer.removeEventListener("SSTabRestored", arguments.callee, true);

                is(newWin2.gBrowser.tabContainer.childNodes.length, 2,
                   "The window correctly restored 2 tabs");
@ -157,8 +157,8 @@ function test() {
      let url = "http://window" + windowsToOpen.length + ".example.com";
      let win = openDialog(location, "", settings, url);
      win.addEventListener("load", function(aEvent) {
-        win.gBrowser.addEventListener("load", function(aEvent) {
-          win.gBrowser.removeEventListener("load", arguments.callee, true);
+        win.gBrowser.selectedBrowser.addEventListener("DOMContentLoaded", function(aEvent) {
+          win.gBrowser.selectedBrowser.removeEventListener("DOMContentLoaded", arguments.callee, true);
          // the window _should_ have state with a tab of url, but it doesn't
          // always happend before window.close(). addTab ensure we don't treat
          // this window as a stateless window
--- a/browser/components/sessionstore/test/browser/browser_522545.js
+++ b/browser/components/sessionstore/test/browser/browser_522545.js
@ -197,17 +197,17 @@ function test() {

  // This test simulates lots of tabs opening at once and then quitting/crashing.
  function test_getBrowserState_lotsOfTabsOpening() {
+    gBrowser.stop();
+
    let uris = [];
    for (let i = 0; i < 25; i++)
      uris.push("http://example.com/" + i);

-    // We're listening for the first non-"about:blank" load event, which should
+    // We're listening for the first load event, which should
    // indicate one of the tabs has loaded and the others haven't. So one should
    // be in a non-userTypedValue case, while others should still have
    // userTypedValue and userTypedClear set.
    gBrowser.addEventListener("load", function(aEvent) {
-      if (gBrowser.currentURI.spec == "about:blank")
-        return;
      gBrowser.removeEventListener("load", arguments.callee, true);

      let state = JSON.parse(ss.getBrowserState());
@ -219,8 +219,8 @@ function test() {
        return aTab.userTypedValue && aTab.userTypedClear && !aTab.entries.length;
      });

-      ok(hasSH, "At least one tab has it's entry in SH");
-      ok(hasUTV, "At least one tab has a userTypedValue with userTypedClear with no loaded URL");
+      ok(hasSH, "At least one tab has its entry in SH");
+      //ok(hasUTV, "At least one tab has a userTypedValue with userTypedClear with no loaded URL");

      runNextTest();

--- a/browser/config/version.txt
+++ b/browser/config/version.txt
@ -1 +1 @@
-3.7a3pre
+3.7a4pre
--- a/browser/fuel/src/fuelApplication.js
+++ b/browser/fuel/src/fuelApplication.js
@ -123,7 +123,7 @@ Window.prototype = {
   */
  _watch : function win_watch(aType) {
    var self = this;
-    this._tabbrowser.addEventListener(aType,
+    this._tabbrowser.tabContainer.addEventListener(aType,
      this._cleanup[aType] = function(e){ self._event(e); },
      true);
  },
--- a/browser/fuel/test/browser_Browser.js
+++ b/browser/fuel/test/browser_Browser.js
@ -49,11 +49,11 @@ function test() {
    is(gPageA.uri.spec, "chrome://mochikit/content/browser/browser/fuel/test/ContentA.html", "Checking 'BrowserTab.uri' after opening");
    is(gPageB.uri.spec, "chrome://mochikit/content/browser/browser/fuel/test/ContentB.html", "Checking 'BrowserTab.uri' after opening");

+    // check event
+    is(gTabOpenCount, 2, "Checking event handler for tab open");
    // check cached values from TabOpen event
    is(gPageA.uri.spec, gTabOpenPageA.uri.spec, "Checking first browser tab open is equal to page A");
    is(gPageB.uri.spec, gTabOpenPageB.uri.spec, "Checking second browser tab open is equal to page B");
-    // check event
-    is(gTabOpenCount, 2, "Checking event handler for tab open");

    // test document access
    var test1 = gPageA.document.getElementById("test1");
--- a/browser/locales/en-US/chrome/browser/browser.properties
+++ b/browser/locales/en-US/chrome/browser/browser.properties
@ -77,6 +77,9 @@ blockedpluginsMessage.searchButton.accesskey=U
 crashedpluginsMessage.title=The %S plugin has crashed.
 crashedpluginsMessage.reloadButton.label=Reload page
 crashedpluginsMessage.reloadButton.accesskey=R
+crashedpluginsMessage.submitButton.label=Submit a crash report
+crashedpluginsMessage.submitButton.accesskey=S
+crashedpluginsMessage.learnMore=Learn More…

 # Sanitize
 # LOCALIZATION NOTE (sanitizeDialog2.everything.title): When "Time range to
--- a/browser/locales/en-US/chrome/browser/tabbrowser.dtd
+++ b/browser/locales/en-US/chrome/browser/tabbrowser.dtd
@ -1,4 +1,3 @@
-<!ENTITY  untitledTab            "(Untitled)">
 <!ENTITY  newTab.label           "New Tab">
 <!ENTITY  newTab.accesskey       "N">
 <!ENTITY  closeTab.label         "Close Tab">
--- a/browser/themes/gnomestripe/browser/browser.css
+++ b/browser/themes/gnomestripe/browser/browser.css
@ -1105,6 +1105,13 @@ statusbarpanel#statusbar-display {
 }

 /* Tabs */
+#TabsToolbar {
+  -moz-appearance: none;
+  min-height: 0;
+  padding: 0;
+  -moz-box-shadow: ThreeDShadow 0 -1px inset;
+}
+
 .tabbrowser-tab {
  border: none !important;
  padding: 0px;
@ -1156,10 +1163,6 @@ statusbarpanel#statusbar-display {
  -moz-image-region: rect(0, 144px, 16px, 128px);
 }

-.tabs-bottom {
-  border-bottom: 1px solid threedshadow;
-}
-
 #context_newTab {
  list-style-image: url("chrome://browser/skin/Toolbar-small.png");
  -moz-image-region: rect(0px 64px 16px 48px);
--- a/browser/themes/pinstripe/browser/browser.css
+++ b/browser/themes/pinstripe/browser/browser.css
@ -67,11 +67,6 @@
  border-color: transparent !important;
 }

-.tabbrowser-strip:-moz-lwtheme,
-.tabbrowser-tabs:-moz-lwtheme {
-  background: none !important;
-}
-
 .tabbrowser-tab:-moz-lwtheme[selected="true"] {
  background-color: transparent !important;
 }
@ -101,7 +96,7 @@

 .tabs-newtab-button:-moz-lwtheme-darktext,
 .tabs-alltabs-button:-moz-lwtheme-darktext,
-.tabs-container:-moz-lwtheme-darktext > .tabs-closebutton,
+.tabbrowser-tabs:-moz-lwtheme-darktext > .tabs-closebutton,
 .tabbrowser-arrowscrollbox:-moz-lwtheme-darktext > .scrollbutton-up,
 .tabbrowser-arrowscrollbox:-moz-lwtheme-darktext > .scrollbutton-down,
 .tabbrowser-tab:-moz-lwtheme-darktext:not([selected="true"]) {
@ -110,7 +105,7 @@

 .tabs-newtab-button:-moz-lwtheme-brighttext,
 .tabs-alltabs-button:-moz-lwtheme-brighttext,
-.tabs-container:-moz-lwtheme-brighttext > .tabs-closebutton,
+.tabbrowser-tabs:-moz-lwtheme-brighttext > .tabs-closebutton,
 .tabbrowser-arrowscrollbox:-moz-lwtheme-brighttext > .scrollbutton-up,
 .tabbrowser-arrowscrollbox:-moz-lwtheme-brighttext > .scrollbutton-down,
 .tabbrowser-tab:-moz-lwtheme-brighttext:not([selected="true"]) {
@ -126,40 +121,6 @@
  border-top: 1px solid rgba(0,0,0,0.65);
 }

-/* ----- INACTIVE WINDOW ----- */
-
-#main-window:not([active="true"]) > #navigator-toolbox > #nav-bar {
-  background-image: url("chrome://global/skin/toolbar/toolbar-background-inactive.png");
-}
-
-#main-window:not([active="true"]) > #navigator-toolbox > #PersonalToolbar {
-  background-color: -moz-mac-chrome-inactive;
-  border-bottom-color: rgba(0, 0, 0, 0.32);
-}
-
-#main-window:not([active="true"]) > #navigator-toolbox > toolbar > toolbaritem,
-#main-window:not([active="true"]) > #navigator-toolbox > toolbar > toolbarbutton,
-#main-window:not([active="true"]) .tabs-newtab-button > .toolbarbutton-icon {
-  opacity: 0.75;
-}
-
-#main-window:not([active="true"]) > #browser > vbox > #sidebar,
-#main-window:not([active="true"]) > #browser > vbox > sidebarheader { 
-  background-color: #e8e8e8;
-}
-
-#main-window:not([active="true"]) .tabbrowser-strip {
-  background-color: #e2e2e2;
-}
-
-#main-window:not([active="true"]) .tabbrowser-tab {
-  color: #575757;
-}
-
-#main-window:not([active="true"]) .tabbrowser-tab[selected="true"] {
-  background-color: -moz-mac-chrome-inactive;
-}
-
 /* ----- BOOKMARK TOOLBAR ----- */

 #PersonalToolbar {
@ -172,6 +133,11 @@
  -moz-box-align: center;
 }

+#PersonalToolbar:-moz-window-inactive {
+  background-color: -moz-mac-chrome-inactive;
+  border-bottom-color: rgba(0, 0, 0, 0.32);
+}
+
 #personal-bookmarks {
  -moz-box-align: center;
 }
@ -198,7 +164,7 @@ toolbarbutton.bookmark-item {
  border: 0;
  -moz-border-radius: 100%;
  padding: 0 8px;
-  margin: 0;
+  margin: 0 0 1px;
  height: 16px;
 }

@ -344,6 +310,11 @@ toolbar[mode="text"] .toolbarbutton-1 > .toolbarbutton-text {
  padding-bottom: 0;
 }

+#navigator-toolbox > toolbar > toolbaritem:-moz-window-inactive,
+#navigator-toolbox > toolbar > toolbarbutton:-moz-window-inactive {
+  opacity: 0.75;
+}
+
 #back-button:-moz-locale-dir(rtl) > .toolbarbutton-icon,
 #forward-button:-moz-locale-dir(rtl) > .toolbarbutton-icon,
 #back-forward-dropmarker:-moz-locale-dir(rtl) > .toolbarbutton-icon {
@ -1369,12 +1340,17 @@ richlistitem[selected="true"][current="true"] > hbox > .ac-result-type-bookmark,

 /* ----- SIDEBAR ELEMENTS ----- */

-#sidebar { 
+#sidebar,
+sidebarheader {
  background-color: #d4dde5;
 }

-sidebarheader { 
-  background-color: #d4dde5;
+#sidebar:-moz-window-inactive,
+sidebarheader:-moz-window-inactive {
+  background-color: #e8e8e8;
+}
+
+sidebarheader {
  padding: 2px;
  text-shadow: none;
 }
@ -1464,10 +1440,6 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {
 }

 #nav-bar {
-  background-color: #9e9e9e;
-  background-image: url("chrome://global/skin/toolbar/toolbar-background.gif");
-  background-repeat: repeat-x;
-  background-position: top right;
  padding: 0 4px;
 }

@ -1486,7 +1458,7 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {

 /* ::::: tabbrowser ::::: */

-tabbrowser > tabbox {
+.tabbrowser-tabbox {
  margin: 0;
 }

@ -1565,6 +1537,10 @@ tabbrowser > tabbox {
  padding-top: 1px;
 }

+.tabs-newtab-button > .toolbarbutton-icon:-moz-window-inactive {
+  opacity: 0.75;
+}
+
 .tabbrowser-tab[selected="true"] {
  padding: 0 6px 1px;
  border-width: 2px;
@ -1575,6 +1551,10 @@ tabbrowser > tabbox {
  background-color: -moz-mac-chrome-active;
 }

+.tabbrowser-tab[selected="true"]:-moz-window-inactive {
+  background-color: -moz-mac-chrome-inactive;
+}
+
 .tabbrowser-tab:focus > .tab-text {
  -moz-box-shadow: @focusRingShadow@;
 }
@ -1584,34 +1564,36 @@ tabbrowser > tabbox {
  color: #000000;
 }

-.tabbrowser-tab:-moz-lwtheme,
-#main-window:not([active="true"]) .tabbrowser-tab:-moz-lwtheme {
+.tabbrowser-tab:-moz-window-inactive {
+  color: #575757;
+}
+
+.tabbrowser-tab:-moz-lwtheme {
  color: inherit;
  text-shadow: inherit;
 }

-.tabbrowser-strip {
+#TabsToolbar {
+  -moz-appearance: none;
  margin-top: -1px;
  border-bottom: 1px solid #404040;
-  background-color: #9B9B9B;
+}
+
+#TabsToolbar:not(:-moz-lwtheme) {
+  background: #9B9B9B url("chrome://browser/skin/tabbrowser/tabbrowser-tabs-bkgnd.png") repeat-x;
+}
+
+#TabsToolbar:not(:-moz-lwtheme):-moz-window-inactive {
+  background-color: #e2e2e2;
 }

 .tabbrowser-tabs {
-  border: none;
-  -moz-box-pack: center;
-  -moz-box-align: center;
-  background: url("chrome://browser/skin/tabbrowser/tabbrowser-tabs-bkgnd.png") repeat-x;
+  -moz-box-align: stretch;
  height: 25px;
-  margin-bottom: 0;
 }

-.tabs-left {
-  display: -moz-box;
-  width: 3px;
-}
-
-.tabbrowser-tabs[overflow="true"] .tabs-left {
-  display: none;
+.tabbrowser-tabs:not([overflow="true"]) {
+  -moz-padding-start: 3px;
 }

 /**
@ -1712,7 +1694,7 @@ tabbrowser > tabbox {
 * Tabstrip New Tab & All Tabs Buttons
 */

-.tabs-container > .tabs-newtab-button,
+.tabbrowser-tabs > .tabs-newtab-button,
 .tabs-alltabs-button {
  -moz-border-start: 2px solid;
  -moz-border-end: none;
@ -1746,11 +1728,11 @@ tabbrowser > tabbox {
 .tabs-alltabs-button:hover:active {
  -moz-image-region: rect(0, 66px, 20px, 44px);
 }
-.tabs-container > .tabs-newtab-button:hover,
+.tabbrowser-tabs > .tabs-newtab-button:hover,
 .tabs-alltabs-button:hover {
  background-color: rgba(0,0,0,0.10);
 }
-.tabs-container > .tabs-newtab-button:hover:active,
+.tabbrowser-tabs > .tabs-newtab-button:hover:active,
 .tabs-alltabs-button:hover:active {
  background-color: rgba(0,0,0,0.20);
 }
--- a/browser/themes/pinstripe/browser/places/organizer.css
+++ b/browser/themes/pinstripe/browser/places/organizer.css
@ -33,7 +33,7 @@
  border-top: @sidebarItemGraphiteFocusedBorderTop@;
 }

-window:not([active="true"]) #placesList > treechildren::-moz-tree-row(selected) {
+#placesList > treechildren:-moz-window-inactive::-moz-tree-row(selected) {
  background: @sidebarItemInactiveBackground@;
  border-top: @sidebarItemInactiveBorderTop@;
 }
@ -103,14 +103,14 @@ window:not([active="true"]) #placesList > treechildren::-moz-tree-row(selected)
                   inset 0 0 0 20px @toolbarbuttonPressedBackgroundColor@;
 }

-:root:not([active]) #placesToolbar > toolbarbutton {
+#placesToolbar > toolbarbutton:-moz-window-inactive {
  border-color: @toolbarbuttonInactiveBorderColor@;
  background-image: @toolbarbuttonInactiveBackgroundImage@;
 }

 #placesToolbar > toolbarbutton[disabled="true"] > .toolbarbutton-icon,
-:root:not([active]) #placesToolbar > toolbarbutton > .toolbarbutton-icon,
-:root:not([active]) #placesToolbar > toolbarbutton > .toolbarbutton-menu-dropmarker {
+#placesToolbar > toolbarbutton > .toolbarbutton-icon:-moz-window-inactive,
+#placesToolbar > toolbarbutton > .toolbarbutton-menu-dropmarker:-moz-window-inactive {
  opacity: 0.5; /* remove the second and third selector when we support click-through (bug 392188) */
 }

@ -177,7 +177,7 @@ window:not([active="true"]) #placesList > treechildren::-moz-tree-row(selected)

 /* Search field */

-:root:not([active="true"]) #searchFilter {
+#searchFilter:-moz-window-inactive {
  opacity: 0.7; /* remove this when we support click-through (bug 392188) */
 }

@ -200,7 +200,7 @@ window:not([active="true"]) #placesList > treechildren::-moz-tree-row(selected)
  border: 0px;
 }

-#places:not([active="true"]) > #placesView > #placesList {
+#placesList:-moz-window-inactive {
  background-color: #e8e8e8;
 }

@ -423,5 +423,5 @@ window:not([active="true"]) #placesList > treechildren::-moz-tree-row(selected)
 }

 .editBMPanel_rowLabel {
-  text-align: right !important;
+  text-align: end;
 }
--- a/browser/themes/winstripe/browser/browser.css
+++ b/browser/themes/winstripe/browser/browser.css
@ -54,16 +54,16 @@
  -moz-box-flex: 1; /* make menu items expand to fill toolbar height */
 }

+#nav-bar {
+  -moz-appearance: none;
+  border-style: none;
+}
+
 #personal-bookmarks {
  min-height: 24px;
 }

-#navigator-toolbox:-moz-system-metric(windows-default-theme):not(:-moz-lwtheme) {
-  padding-bottom: 1px; /* uxtheme border drawing fix/hack */
-}
-
-#navigator-toolbox[inFullscreen="true"],
-#navigator-toolbox[inFullscreen="true"] > #nav-bar {
+#navigator-toolbox[inFullscreen="true"] {
  border-top: none;
 }

@ -890,22 +890,20 @@ toolbar:not([iconsize="small"])[mode="icons"] #forward-button:not([disabled="tru
 }

 /* Tabstrip */
-.tabbrowser-tabs {
-  -moz-appearance: -moz-win-browsertabbar-toolbox;
-  background: -moz-dialog url("chrome://browser/skin/tabbrowser/tabbrowser-tabs-bkgnd.png") repeat-x;
-}
-
-.tabbrowser-tabs:-moz-lwtheme {
+#TabsToolbar {
  -moz-appearance: none;
-  background: none;
+  min-height: 0;
+  padding: 0;
  border-style: none;
+  margin-bottom: 2px;
+  -moz-box-shadow: ThreeDShadow 0 -1px inset, -moz-dialog 0 2px;
 }

 .tabbrowser-tabs:-moz-system-metric(touch-enabled) {
  min-height: .81cm;
 }

-.tabs-container:not([overflow="true"]) {
+.tabbrowser-tabs:not([overflow="true"]) {
  -moz-padding-start: 3px;
 }

@ -917,7 +915,7 @@ toolbar:not([iconsize="small"])[mode="icons"] #forward-button:not([disabled="tru
 .tabs-alltabs-button {
  -moz-appearance: none;
  background: url("chrome://browser/skin/tabbrowser/tab-bkgnd.png") repeat-x;
-  margin: 3px 0px 4px;
+  margin: 3px 0 1px;
  border: 2px solid;
  border-right-width: 1px;
  border-bottom: none;
@ -959,13 +957,13 @@ toolbar:not([iconsize="small"])[mode="icons"] #forward-button:not([disabled="tru
 }

 .tabbrowser-tab:not([selected="true"]):hover {
-  margin: 2px 0px 4px;
+  margin: 2px 0 1px;
  padding: 2px 1px 1px;
  background-image: url("chrome://browser/skin/tabbrowser/tab-hover-bkgnd.png");
 }

 .tabbrowser-tab[selected="true"] {
-  margin: 2px 0px 3px;
+  margin: 2px 0 0;
  padding: 1px;
  background-image: url("chrome://browser/skin/tabbrowser/tab-active-bkgnd.png");
  background-color: -moz-dialog;
@ -1022,14 +1020,6 @@ toolbar:not([iconsize="small"])[mode="icons"] #forward-button:not([disabled="tru
  -moz-image-region: rect(0px, 16px, 16px, 0px);
 }

-.tabs-bottom {
-  height: 4px;
-  margin: 0px;
-  background: -moz-dialog url("chrome://browser/skin/tabbrowser/tabstrip-bottom.png") repeat;
-  border-top: 1px solid threedshadow;
-  border-bottom: 1px solid threedshadow;
-}
-
 /* tabbrowser-tab focus ring */
 .tabbrowser-tab > .tab-text {
  border: 1px dotted transparent;
@ -1150,7 +1140,7 @@ toolbar:not([iconsize="small"])[mode="icons"] #forward-button:not([disabled="tru
 }

 .tabbrowser-arrowscrollbox > .scrollbutton-down:-moz-locale-dir(ltr),
-.tabs-container > .tabs-newtab-button:-moz-locale-dir(ltr),
+.tabbrowser-tabs > .tabs-newtab-button:-moz-locale-dir(ltr),
 .tabs-alltabs-button:-moz-locale-dir(ltr) {
  border-right-style: none;
  -moz-border-radius-topleft: 2px;
@ -1167,7 +1157,7 @@ toolbar:not([iconsize="small"])[mode="icons"] #forward-button:not([disabled="tru
 }

 .tabbrowser-arrowscrollbox > .scrollbutton-down:-moz-locale-dir(rtl),
-.tabs-container > .tabs-newtab-button:-moz-locale-dir(rtl),
+.tabbrowser-tabs > .tabs-newtab-button:-moz-locale-dir(rtl),
 .tabs-alltabs-button:-moz-locale-dir(rtl) {
  border-left-style: none;
  -moz-border-radius-topright: 2px;
@ -1258,7 +1248,7 @@ toolbar:not([iconsize="small"])[mode="icons"] #forward-button:not([disabled="tru
  -moz-image-region: rect(0px, 42px, 14px, 28px);
 }

-.tabs-container > .tabs-closebutton {
+.tabbrowser-tabs > .tabs-closebutton {
  margin: 3px 0px 3px;
  padding: 4px 2px 2px;
  background: -moz-dialog url("chrome://browser/skin/tabbrowser/tab-active-bkgnd.png") repeat-x;
@ -1267,7 +1257,7 @@ toolbar:not([iconsize="small"])[mode="icons"] #forward-button:not([disabled="tru
  -moz-border-radius-topleft: 2px;
 }

-.tabs-container > .tabs-closebutton:-moz-locale-dir(rtl) {
+.tabbrowser-tabs > .tabs-closebutton:-moz-locale-dir(rtl) {
  border-left: none;
  border-right: 1px solid threedshadow;
  -moz-border-radius-topleft: 0px;
--- a/browser/themes/winstripe/browser/jar.mn
+++ b/browser/themes/winstripe/browser/jar.mn
@ -80,12 +80,10 @@ browser.jar:
        skin/classic/browser/tabbrowser/progress-pulsing.png                    (tabbrowser/progress-pulsing.png)
        skin/classic/browser/tabbrowser/tab-arrow-left.png                      (tabbrowser/tab-arrow-left.png)
        skin/classic/browser/tabbrowser/tab-arrow-right.png                     (tabbrowser/tab-arrow-right.png)
-        skin/classic/browser/tabbrowser/tabbrowser-tabs-bkgnd.png               (tabbrowser/tabbrowser-tabs-bkgnd.png)
        skin/classic/browser/tabbrowser/tabDragIndicator.png                    (tabbrowser/tabDragIndicator.png)
        skin/classic/browser/tabbrowser/tab-bkgnd.png                           (tabbrowser/tab-bkgnd.png)
        skin/classic/browser/tabbrowser/tab-active-bkgnd.png                    (tabbrowser/tab-active-bkgnd.png)
        skin/classic/browser/tabbrowser/tab-hover-bkgnd.png                     (tabbrowser/tab-hover-bkgnd.png)
-        skin/classic/browser/tabbrowser/tabstrip-bottom.png                     (tabbrowser/tabstrip-bottom.png)

 #ifdef XP_WIN
 browser.jar:
@ -169,10 +167,8 @@ browser.jar:
        skin/classic/aero/browser/tabbrowser/progress-pulsing.png               (tabbrowser/progress-pulsing.png)
        skin/classic/aero/browser/tabbrowser/tab-arrow-left.png                 (tabbrowser/tab-arrow-left-aero.png)
        skin/classic/aero/browser/tabbrowser/tab-arrow-right.png                (tabbrowser/tab-arrow-right-aero.png)
-        skin/classic/aero/browser/tabbrowser/tabbrowser-tabs-bkgnd.png          (tabbrowser/tabbrowser-tabs-bkgnd.png)
        skin/classic/aero/browser/tabbrowser/tabDragIndicator.png               (tabbrowser/tabDragIndicator-aero.png)
        skin/classic/aero/browser/tabbrowser/tab-bkgnd.png                      (tabbrowser/tab-bkgnd.png)
        skin/classic/aero/browser/tabbrowser/tab-active-bkgnd.png               (tabbrowser/tab-active-bkgnd.png)
        skin/classic/aero/browser/tabbrowser/tab-hover-bkgnd.png                (tabbrowser/tab-hover-bkgnd.png)
-        skin/classic/aero/browser/tabbrowser/tabstrip-bottom.png                (tabbrowser/tabstrip-bottom.png)
 #endif
--- a/browser/themes/winstripe/browser/tabbrowser/tabbrowser-tabs-bkgnd.png
+++ b/browser/themes/winstripe/browser/tabbrowser/tabbrowser-tabs-bkgnd.png
--- a/browser/themes/winstripe/browser/tabbrowser/tabstrip-bottom.png
+++ b/browser/themes/winstripe/browser/tabbrowser/tabstrip-bottom.png
--- a/build/Makefile.in
+++ b/build/Makefile.in
@ -134,6 +134,26 @@ check::
        else \
          echo "TEST-PASS | build/ | unify produced a universal binary!"; \
        fi
+# try building an x86-64 binary. if that succeeds, try unifying it
+# with an i386 binary
+	-$(HOST_CC) -arch x86_64 $(srcdir)/unify-test.c -o unify-test-x86_64
+	@if test -f ./unify-test-x86_64; then \
+          if ! $(srcdir)/macosx/universal/unify ./unify-test-x86_64 ./unify-test-i386 \
+            ./unify-test-universal-64; then \
+            echo "TEST-UNEXPECTED-FAIL | build/ | unify failed to produce a universal binary with a 64-bit input!"; \
+            false; \
+          fi; \
+          if test ! -f ./unify-test-universal-64; then \
+            echo "TEST-UNEXPECTED-FAIL | build/ | unify failed to produce a universal binary with a 64-bit input!"; \
+            false; \
+          fi; \
+          if ! file -b ./unify-test-universal-64 | head -n1 | grep -q "^Mach-O universal binary"; then \
+            echo "TEST-UNEXPECTED-FAIL | build/ | unify failed to produce a universal binary with a 64-bit input!"; \
+            false; \
+          else \
+            echo "TEST-PASS | build/ | unify produced a universal binary with a 64-bit input!"; \
+          fi \
+        fi
 # try unifying two identical Java class files
 	rm -f unifytesta.class unifytestb.class unifytestc.class
 	cp $(srcdir)/unifytest.class ./unifytesta.class
--- a/build/automation.py.in
+++ b/build/automation.py.in
@ -51,6 +51,9 @@ import sys
 import threading
 import tempfile

+_DEFAULT_WEB_SERVER = "127.0.0.1"
+_DEFAULT_HTTP_PORT = 8888
+_DEFAULT_SSL_PORT = 4443

 #expand _DIST_BIN = __XPC_BIN_PATH__
 #expand _IS_WIN32 = len("__WIN32__") != 0
@ -129,6 +132,9 @@ class Automation(object):

  # timeout, in seconds
  DEFAULT_TIMEOUT = 60.0
+  DEFAULT_WEB_SERVER = _DEFAULT_WEB_SERVER
+  DEFAULT_HTTP_PORT = _DEFAULT_HTTP_PORT
+  DEFAULT_SSL_PORT = _DEFAULT_SSL_PORT

  log = logging.getLogger()

@ -141,8 +147,8 @@ class Automation(object):
    self.log.setLevel(logging.INFO)
    self.log.addHandler(handler)

-  def setServerInfo(self, server = "mochi.test", httpPort = 8888, sslPort = 4443):
-    self.webServer = server
+  def setServerInfo(self, webServer = _DEFAULT_WEB_SERVER, httpPort = _DEFAULT_HTTP_PORT, sslPort = _DEFAULT_SSL_PORT):
+    self.webServer = webServer
    self.httpPort = httpPort
    self.sslPort = sslPort

@ -316,7 +322,7 @@ user_pref("capability.principal.codebase.p%(i)d.granted",
 user_pref("capability.principal.codebase.p%(i)d.id", "%(origin)s");
 user_pref("capability.principal.codebase.p%(i)d.subjectName", "");
 """  % { "i": i,
-         "origin": (l.scheme + "://" + l.host + ":" + l.port) }
+         "origin": (l.scheme + "://" + l.host + ":" + str(l.port)) }
        prefs.append(part)

      # We need to proxy every server but the primary one.
@ -348,11 +354,14 @@ function FindProxyForURL(url, host)
  if (origins.indexOf(origin) < 0)
    return 'DIRECT';
  if (isHttp)
-    return 'PROXY 127.0.0.1:8888';
+    return 'PROXY %(remote)s:%(httpport)s';
  if (isHttps)
-    return 'PROXY 127.0.0.1:4443';
+    return 'PROXY %(remote)s:%(sslport)s';
  return 'DIRECT';
-}""" % { "origins": origins }
+}""" % { "origins": origins,
+         "remote":  self.webServer,
+         "httpport":self.httpPort,
+         "sslport": self.sslPort }
      pacURL = "".join(pacURL.splitlines())

      part += """
@ -398,8 +407,8 @@ user_pref("camino.use_system_proxy_settings", false); // Camino-only, harmless t
  
    sslTunnelConfig.write("httpproxy:1\n")
    sslTunnelConfig.write("certdbdir:%s\n" % certPath)
-    sslTunnelConfig.write("forward:127.0.0.1:8888\n")
-    sslTunnelConfig.write("listen:*:4443:pgo server certificate\n")
+    sslTunnelConfig.write("forward:127.0.0.1:%s\n" % self.httpPort)
+    sslTunnelConfig.write("listen:*:%s:pgo server certificate\n" % self.sslPort)

    # Configure automatic certificate and bind custom certificates, client authentication
    locations = self.readLocations()
@ -412,14 +421,14 @@ user_pref("camino.use_system_proxy_settings", false); // Camino-only, harmless t
          match = customCertRE.match(option)
          if match:
            customcert = match.group("nickname");
-            sslTunnelConfig.write("listen:%s:%s:4443:%s\n" %
-                      (loc.host, loc.port, customcert))
+            sslTunnelConfig.write("listen:%s:%s:%s:%s\n" %
+                      (loc.host, loc.port, self.sslPort, customcert))

          match = clientAuthRE.match(option)
          if match:
            clientauth = match.group("clientauth");
-            sslTunnelConfig.write("clientauth:%s:%s:4443:%s\n" %
-                      (loc.host, loc.port, clientauth))
+            sslTunnelConfig.write("clientauth:%s:%s:%s:%s\n" %
+                      (loc.host, loc.port, self.sslPort, clientauth))

    sslTunnelConfig.close()

--- a/build/macosx/universal/unify
+++ b/build/macosx/universal/unify
@ -1165,6 +1165,12 @@ sub readZipCRCs($) {

  package FileAttrCache;

+  # from /usr/include/mach-o/loader.h
+  use constant MH_MAGIC    => 0xfeedface;
+  use constant MH_CIGAM    => 0xcefaedfe;
+  use constant MH_MAGIC_64 => 0xfeedfacf;
+  use constant MH_CIGAM_64 => 0xcffaedfe;
+
  use Fcntl(':DEFAULT', ':mode');

  # FileAttrCache->new($path)
@ -1243,8 +1249,10 @@ sub readZipCRCs($) {
    }

    # Accept Mach-O fat files or Mach-O thin files of either endianness.
-    if ($magic == 0xfeedface ||
-        $magic == 0xcefaedfe ||
+    if ($magic == MH_MAGIC ||
+        $magic == MH_CIGAM ||
+        $magic == MH_MAGIC_64 ||
+        $magic == MH_CIGAM_64 ||
        $this->isFat()) {
      return 1;
    }
--- a/build/mobile/devicemanager.py
+++ b/build/mobile/devicemanager.py
@ -45,6 +45,14 @@ from threading import Thread
 import traceback
 import sys

+class FileError(Exception):
+  " Signifies an error which occurs while doing a file operation."
+
+  def __init__(self, msg = ''):
+    self.msg = msg
+
+  def __str__(self):
+    return self.msg

 class myProc(Thread):
  def __init__(self, hostip, hostport, cmd, new_line = True, sleeptime = 0):
@ -228,7 +236,10 @@ class DeviceManager:
        print "files are validated"
      return ''

-    self.mkDirs(destname)
+    if self.mkDirs(destname) == None:
+      print "unable to make dirs: " + destname
+      return None
+
    if (self.debug >= 2):
      print "sending: push " + destname
    
@ -253,7 +264,7 @@ class DeviceManager:
    return retVal
  
  def mkDir(self, name):
-    return self.sendCMD(['mkdr ' + name, 'quit'])
+    return self.sendCMD(['mkdr ' + name])
  
  
  # make directory structure on the device
@ -265,8 +276,9 @@ class DeviceManager:
      if (part != ""):
        name += '/' + part
        if (self.mkDir(name) == None):
+          print "failed making directory: " + str(name)
          return None
-
+    return ''

  # push localDir from host to remoteDir on the device
  def pushDir(self, localDir, remoteDir):
@ -573,9 +585,38 @@ class DeviceManager:
    return 0

  def unpackFile(self, filename):
-    self.sendCMD(['cd /tests', 'unzp ' + filename])
-    
-    
+    dir = ''
+    parts = filename.split('/')
+    if (len(parts) > 1):
+      if self.fileExists(filename):
+        dir = '/'.join(parts[:-1])
+    elif self.fileExists('/' + filename):
+      dir = '/' + filename
+    elif self.fileExists('/tests/' + filename):
+      dir = '/tests/' + filename
+    else:
+      return None
+
+    return self.sendCMD(['cd ' + dir, 'unzp ' + filename])
+
+
+  def reboot(self, wait = False):
+    self.sendCMD(['rebt'])
+
+    if wait == True:
+      time.sleep(30)
+      timeout = 270
+      done = False
+      while (not done):
+        if self.listFiles('/') != None:
+          return ''
+        print "sleeping another 10 seconds"
+        time.sleep(10)
+        timeout = timeout - 10
+        if (timeout <= 0):
+          return None
+    return ''
+
  # validate localDir from host to remoteDir on the device
  def validateDir(self, localDir, remoteDir):
    if (self.debug >= 2): print "validating directory: " + localDir + " to " + remoteDir
--- a/build/win32/Makefile.in
+++ b/build/win32/Makefile.in
@ -43,7 +43,10 @@ VPATH = @srcdir@
 include $(DEPTH)/config/autoconf.mk

 ifdef ENABLE_TESTS
-DIRS += crashinjectdll
+DIRS += \
+  crashinjectdll \
+  vmwarerecordinghelper \
+  $(NULL)

 PROGRAM = crashinject$(BIN_SUFFIX)
 USE_STATIC_LIBS = 1
--- a/build/win32/vmwarerecordinghelper/Makefile.in
+++ b/build/win32/vmwarerecordinghelper/Makefile.in
@ -0,0 +1,54 @@
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is VMWare Recording Helper.
+#
+# The Initial Developer of the Original Code is
+# The Mozilla Foundation
+#
+# Portions created by the Initial Developer are Copyright (C) 2010
+# the Mozilla Foundation <http://www.mozilla.org/>. All Rights Reserved.
+#
+# Contributor(s):
+#   Ben Turner <bent.mozilla@gmail.com>
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either the GNU General Public License Version 2 or later (the "GPL"), or
+# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+DEPTH = ../../..
+topsrcdir = @top_srcdir@
+srcdir = @srcdir@
+VPATH = @srcdir@
+
+include $(DEPTH)/config/autoconf.mk
+
+LIBRARY_NAME = vmwarerecordinghelper
+DEFFILE = $(srcdir)/$(LIBRARY_NAME).def
+
+FORCE_SHARED_LIB = 1
+USE_STATIC_LIBS = 1
+
+CPPSRCS = $(LIBRARY_NAME).cpp
+
+include $(topsrcdir)/config/rules.mk
--- a/build/win32/vmwarerecordinghelper/vmwarerecordinghelper.cpp
+++ b/build/win32/vmwarerecordinghelper/vmwarerecordinghelper.cpp
@ -11,15 +11,15 @@
 * for the specific language governing rights and limitations under the
 * License.
 *
- * The Original Code is mozilla.org code.
+ * The Original Code is VMWare Recording Helper.
 *
 * The Initial Developer of the Original Code is
- * the Mozilla Organization.
- * Portions created by the Initial Developer are Copyright (C) 1998-2002
+ * The Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
 * the Initial Developer. All Rights Reserved.
 *
 * Contributor(s):
- *   Robert Kaiser <KaiRo@KaiRo.at>
+ *   Ben Turner <bent.mozilla@gmail.com>
 *
 * Alternatively, the contents of this file may be used under the terms of
 * either the GNU General Public License Version 2 or later (the "GPL"), or
@ -35,86 +35,33 @@
 *
 * ***** END LICENSE BLOCK ***** */

-/* used by the about:plugins dialog */
+/**
+ * The following code comes from "Starting and Stopping Recording of Virtual
+ * Machine Activity from Within the Guest":
+ *
+ *   http://kb.vmware.com/selfservice/documentLink.do?externalID=1001401
+ */

-body {
-  background-color: -moz-Field;
-  color: -moz-FieldText;
-  font: message-box;
+void __cdecl
+StartRecording()
+{
+  __asm {
+    mov eax, 564d5868h
+    mov ebx, 1
+    mov cx, 47
+    mov dx, 5658h
+    in eax, dx
+  }
 }

-div#outside {
- text-align: justify;
- width: 90%;
- margin-left: 5%;
- margin-right: 5%;
-}
-
-div#plugs {
-  text-align: center;
-  font-size: xx-large;
-  font-weight: bold;
-}
-
-div#noplugs {
-  font-size: x-large;
-  font-weight: bold;
-}
-
-div#findmore {
-  margin-top: 2em;
-}
-
-div.plugname {
-  margin-top: 2em;
-  margin-bottom: 1em;
-  font-size: large;
-  text-align: left;
-  font-weight: bold;
-}
-
-dl {
-  margin: 0px 0px 3px 0px;
-}
-
-table {
-  background-color: -moz-Dialog;
-  color: -moz-DialogText;
-  font: message-box;
-  text-align: left;
-  width: 100%;
-  border: 1px solid ThreeDShadow;
-  border-spacing: 0px;
-}
-
-th {
-  text-align: center;
-  background-color: Highlight;
-  color: HighlightText;
-}
-
-th + th,
-td + td {
-  border-left: 1px dotted ThreeDShadow; 
-}
-
-td {
-  text-align: left;
-  border-top: 1px dotted ThreeDShadow;
-}
-
-th, td {
-  padding: 3px;
-}
-
-th.type, th.suff {
-  width: 20%;
-}
-
-th.desc {
-  width: 50%;
-}
-
-th.enabled {
-  width: 10%;
+void __cdecl
+StopRecording()
+{
+  __asm {
+    mov eax, 564d5868h
+    mov ebx, 2
+    mov cx, 47
+    mov dx, 5658h
+    in eax, dx 
+  }
 }
--- a/build/win32/vmwarerecordinghelper/vmwarerecordinghelper.def
+++ b/build/win32/vmwarerecordinghelper/vmwarerecordinghelper.def
@ -0,0 +1,4 @@
+LIBRARY vmwarerecordinghelper
+EXPORTS
+     StartRecording
+     StopRecording
--- a/config/milestone.txt
+++ b/config/milestone.txt
@ -10,4 +10,4 @@
 # hardcoded milestones in the tree from these two files.
 #--------------------------------------------------------

-1.9.3a3pre
+1.9.3a4pre
--- a/configure.in
+++ b/configure.in
@ -4758,6 +4758,7 @@ NECKO_COOKIES=1
 NECKO_DISK_CACHE=1
 NECKO_PROTOCOLS_DEFAULT="about data file ftp gopher http res viewsource"
 NECKO_SMALL_BUFFERS=
+BUILD_CTYPES=1
 XPC_IDISPATCH_SUPPORT=


@ -8120,12 +8121,23 @@ if test "$NECKO_COOKIES"; then
 fi

 dnl
-dnl Build jsctypes on the platforms we can.
+dnl Build jsctypes on the platforms we can, unless it's explicitly disabled.
 dnl
+MOZ_ARG_DISABLE_BOOL(ctypes,
+[  --disable-ctypes        Disable js-ctypes],
+    BUILD_CTYPES=,
+    BUILD_CTYPES=1)
 AC_SUBST(BUILD_CTYPES)
-if test "$OS_ARCH" != "WINCE" -o `echo $OS_TEST | grep -ic arm` != 1; then
-  BUILD_CTYPES=1
-  AC_DEFINE(BUILD_CTYPES)
+if test "$BUILD_CTYPES"; then
+  if test "$OS_ARCH" = "WINCE" -a `echo $OS_TEST | grep -ic arm` = 1; then
+    # Disable ctypes for arm/wince.
+    BUILD_CTYPES=
+  elif test "$_MSC_VER" && test -z $AS; then
+    # Disable ctypes if we're on MSVC and MASM is unavailable.
+    AC_MSG_ERROR([No suitable assembler found. An assembler is required to build js-ctypes. You may --disable-ctypes to avoid this. If you are building with MS Visual Studio 8 Express, you may download the MASM 8.0 package, upgrade to Visual Studio 9 Express, or install the Vista SDK.])
+  else
+    AC_DEFINE(BUILD_CTYPES)
+  fi
 fi

 dnl NECKO_ configuration options are not global
--- a/content/base/public/nsIContent.h
+++ b/content/base/public/nsIContent.h
@ -72,8 +72,8 @@ enum nsLinkState {

 // IID for the nsIContent interface
 #define NS_ICONTENT_IID       \
-{ 0xc19d6f16, 0xab13, 0x4dde, \
- { 0x99, 0x7a, 0x51, 0x04, 0xc3, 0x64, 0xd2, 0x51 } }
+{ 0x07734640, 0x0900, 0x480d, \
+ { 0x97, 0x5a, 0x31, 0xc7, 0x0e, 0xcd, 0x15, 0x2b } }

 /**
 * A node of content in a document's content model. This interface
@ -894,7 +894,7 @@ public:
   *
   * The CALLER OWNS the result and is responsible for deleting it.
   */
-  virtual nsISMILAttr* GetAnimatedAttr(const nsIAtom* aName) = 0;
+  virtual nsISMILAttr* GetAnimatedAttr(nsIAtom* aName) = 0;

   /**
    * Get the SMIL override style for this content node.  This is a style
--- a/content/base/public/nsIDocument.h
+++ b/content/base/public/nsIDocument.h
@ -115,12 +115,19 @@ class Link;
 } // namespace mozilla

 #define NS_IDOCUMENT_IID      \
-{ 0x36f0a42c, 0x089b, 0x4909, \
-  { 0xb3, 0xee, 0xc5, 0xa4, 0x00, 0x90, 0x30, 0x02 } }
+{ 0x94fb5716, 0xff00, 0x4b97, \
+ { 0x90, 0x01, 0x91, 0x65, 0x1a, 0x5f, 0xbe, 0x64 } }

 // Flag for AddStyleSheet().
 #define NS_STYLESHEET_FROM_CATALOG                (1 << 0)

+// Document states
+
+// RTL locale: specific to the XUL localedir attribute
+#define NS_DOCUMENT_STATE_RTL_LOCALE              (1 << 0)
+// Window activation status
+#define NS_DOCUMENT_STATE_WINDOW_INACTIVE         (1 << 1)
+
 //----------------------------------------------------------------------

 // Document interface.  This is implemented by all document objects in
@ -677,6 +684,11 @@ public:
                                    nsIContent* aContent2,
                                    PRInt32 aStateMask) = 0;

+  // Notify that a document state has changed.
+  // This should only be called by callers whose state is also reflected in the
+  // implementation of nsDocument::GetDocumentState.
+  virtual void DocumentStatesChanged(PRInt32 aStateMask) = 0;
+
  // Observation hooks for style data to propagate notifications
  // to document observers
  virtual void StyleRuleChanged(nsIStyleSheet* aStyleSheet,
@ -1282,6 +1294,13 @@ public:
   */
  virtual int GetDocumentLWTheme() { return Doc_Theme_None; }

+  /**
+   * Returns the document state.
+   * Document state bits have the form NS_DOCUMENT_STATE_* and are declared in
+   * nsIDocument.h.
+   */
+  virtual PRInt32 GetDocumentState() = 0;
+
  /**
   * Gets the document's cached pointer to the first <base> element in this
   * document which has an href attribute.  If the document doesn't contain any
@ -1360,7 +1379,7 @@ protected:

 #ifdef MOZ_SMIL
  // SMIL Animation Controller, lazily-initialized in GetAnimationController
-  nsAutoPtr<nsSMILAnimationController> mAnimationController;
+  nsRefPtr<nsSMILAnimationController> mAnimationController;
 #endif // MOZ_SMIL

  // Table of element properties for this document.
--- a/content/base/public/nsIDocumentObserver.h
+++ b/content/base/public/nsIDocumentObserver.h
@ -118,6 +118,15 @@ public:
                                    nsIContent* aContent2,
                                    PRInt32 aStateMask) = 0;

+  /**
+   * Notification that the state of the document has changed.
+   *
+   * @param aDocument The document being observed
+   * @param aStateMask the state that changed
+   */
+  virtual void DocumentStatesChanged(nsIDocument* aDocument,
+                                     PRInt32 aStateMask) = 0;
+
  /**
   * A StyleSheet has just been added to the document.  This method is
   * called automatically when a StyleSheet gets added to the
@ -234,6 +243,8 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsIDocumentObserver, NS_IDOCUMENT_OBSERVER_IID)
                                      nsIContent* aContent1,                 \
                                      nsIContent* aContent2,                 \
                                      PRInt32 aStateMask);                   \
+    virtual void DocumentStatesChanged(nsIDocument* aDocument,               \
+                                       PRInt32 aStateMask);                  \
    virtual void StyleSheetAdded(nsIDocument* aDocument,                     \
                                 nsIStyleSheet* aStyleSheet,                 \
                                 PRBool aDocumentSheet);                     \
@ -284,6 +295,12 @@ _class::ContentStatesChanged(nsIDocument* aDocument,                      \
                             nsIContent* aContent2,                       \
                             PRInt32 aStateMask)                          \
 {                                                                         \
+}                                                                         \
+                                                                          \
+void                                                                      \
+_class::DocumentStatesChanged(nsIDocument* aDocument,                     \
+                              PRInt32 aStateMask)                         \
+{                                                                         \
 }

 #define NS_IMPL_NSIDOCUMENTOBSERVER_CONTENT(_class)                       \
--- a/content/base/public/nsIObjectLoadingContent.idl
+++ b/content/base/public/nsIObjectLoadingContent.idl
@ -40,6 +40,7 @@
 interface nsIFrame;
 interface nsIObjectFrame;
 interface nsIPluginInstance;
+interface nsIPluginTag;
 interface nsIDOMElement;
 interface nsIDOMClientRect;

@ -124,6 +125,7 @@ interface nsIObjectLoadingContent : nsISupports
   */
  [noscript] nsIFrame getPrintFrame();

-  [noscript] void pluginCrashed(in AString pluginName,
+  [noscript] void pluginCrashed(in nsIPluginTag pluginTag,
+                                in AString minidumpID,
                                in boolean submittedCrashReport);
 };
--- a/content/base/src/Link.h
+++ b/content/base/src/Link.h
@ -50,8 +50,8 @@ namespace mozilla {
 namespace dom {

 #define MOZILLA_DOM_LINK_IMPLEMENTATION_IID \
-  { 0x0c032581, 0x1c8a, 0x4fff, \
-    { 0xbe, 0x9a, 0xfb, 0x6e, 0x2e, 0xe4, 0x22, 0x2e } }
+  { 0x2be8af0, 0x32a5, 0x41dd, \
+    { 0xa7, 0x68, 0x12, 0x55, 0xc4, 0x9a, 0xd4, 0xc5 } }

 class Link : public nsISupports
 {
@ -74,6 +74,9 @@ public:
   * @return the URI this link is for, if available.
   */
  already_AddRefed<nsIURI> GetURI() const;
+  virtual already_AddRefed<nsIURI> GetURIExternal() const {
+    return GetURI();
+  }

  /**
   * Helper methods for modifying and obtaining parts of the URI of the Link.
--- a/content/base/src/nsCSPService.cpp
+++ b/content/base/src/nsCSPService.cpp
@ -101,7 +101,6 @@ CSPService::ShouldLoad(PRUint32 aContentType,

    // find the nsDocument that initiated this request and see if it has a
    // CSP policy object
-    nsresult rv;
    nsCOMPtr<nsINode> node(do_QueryInterface(aRequestContext));
    nsCOMPtr<nsIPrincipal> principal;
    nsCOMPtr<nsIContentSecurityPolicy> csp;
@ -160,7 +159,6 @@ CSPService::ShouldProcess(PRUint32         aContentType,

    // find the nsDocument that initiated this request and see if it has a
    // CSP policy object
-    nsresult rv;
    nsCOMPtr<nsINode> node(do_QueryInterface(aRequestContext));
    nsCOMPtr<nsIPrincipal> principal;
    nsCOMPtr<nsIContentSecurityPolicy> csp;
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@ -380,7 +380,10 @@ nsContentUtils::Init()
  }

  rv = CallGetService(NS_IHISTORY_CONTRACTID, &sHistory);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_FAILED(rv)) {
+    NS_RUNTIMEABORT("Cannot get the history service");
+    return rv;
+  }

  sPtrsToPtrsToRelease = new nsTArray<nsISupports**>();
  if (!sPtrsToPtrsToRelease) {
@ -933,7 +936,7 @@ nsContentUtils::Shutdown()
  // Clean up c-style's observer 
  if (sPrefCallbackList) {
    while (sPrefCallbackList->Count() > 0) {
-      nsCOMPtr<nsPrefOldCallback> callback = (*sPrefCallbackList)[0];
+      nsRefPtr<nsPrefOldCallback> callback = (*sPrefCallbackList)[0];
      NS_ABORT_IF_FALSE(callback, "Invalid c-style callback is appended");
      if (sPrefBranch)
        sPrefBranch->RemoveObserver(callback->mPref.get(), callback);
@ -2672,7 +2675,7 @@ nsContentUtils::UnregisterPrefCallback(const char *aPref,

    int i;
    for (i = 0; i < sPrefCallbackList->Count(); i++) {
-      nsCOMPtr<nsPrefOldCallback> callback = (*sPrefCallbackList)[i];
+      nsRefPtr<nsPrefOldCallback> callback = (*sPrefCallbackList)[i];
      if (callback && callback->IsEqual(aPref, aCallback, aClosure)) {
        sPrefBranch->RemoveObserver(aPref, callback);
        sPrefCallbackList->RemoveObject(callback);
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@ -4055,6 +4055,16 @@ nsDocument::ContentStatesChanged(nsIContent* aContent1, nsIContent* aContent2,
                               (this, aContent1, aContent2, aStateMask));
 }

+void
+nsDocument::DocumentStatesChanged(PRInt32 aStateMask)
+{
+  // Invalidate our cached state.
+  mGotDocumentState &= ~aStateMask;
+  mDocumentState &= ~aStateMask;
+
+  NS_DOCUMENT_NOTIFY_OBSERVERS(DocumentStatesChanged, (this, aStateMask));
+}
+
 void
 nsDocument::StyleRuleChanged(nsIStyleSheet* aStyleSheet,
                             nsIStyleRule* aOldStyleRule,
@ -7615,6 +7625,26 @@ nsDocument::MaybePreLoadImage(nsIURI* uri)
  }
 }

+PRInt32
+nsDocument::GetDocumentState()
+{
+  if (!(mGotDocumentState & NS_DOCUMENT_STATE_RTL_LOCALE)) {
+    if (IsDocumentRightToLeft()) {
+      mDocumentState |= NS_DOCUMENT_STATE_RTL_LOCALE;
+    }
+    mGotDocumentState |= NS_DOCUMENT_STATE_RTL_LOCALE;
+  }
+  if (!(mGotDocumentState & NS_DOCUMENT_STATE_WINDOW_INACTIVE)) {
+    nsIPresShell* shell = GetPrimaryShell();
+    if (shell && shell->GetPresContext() &&
+        shell->GetPresContext()->IsTopLevelWindowInactive()) {
+      mDocumentState |= NS_DOCUMENT_STATE_WINDOW_INACTIVE;
+    }
+    mGotDocumentState |= NS_DOCUMENT_STATE_WINDOW_INACTIVE;
+  }
+  return mDocumentState;
+}
+
 namespace {

 /**
--- a/content/base/src/nsDocument.h
+++ b/content/base/src/nsDocument.h
@ -693,6 +693,7 @@ public:
  virtual void ContentStatesChanged(nsIContent* aContent1,
                                    nsIContent* aContent2,
                                    PRInt32 aStateMask);
+  virtual void DocumentStatesChanged(PRInt32 aStateMask);

  virtual void StyleRuleChanged(nsIStyleSheet* aStyleSheet,
                                nsIStyleRule* aOldStyleRule,
@ -939,6 +940,8 @@ public:

  virtual nsISupports* GetCurrentContentSink();

+  virtual PRInt32 GetDocumentState();
+
  virtual void RegisterFileDataUri(nsACString& aUri);

 protected:
@ -1134,6 +1137,9 @@ protected:

  nsCOMPtr<nsIContent> mFirstBaseNodeWithHref;

+  PRInt32 mDocumentState;
+  PRInt32 mGotDocumentState;
+
 private:
  friend class nsUnblockOnloadEvent;

--- a/content/base/src/nsGenericDOMDataNode.h
+++ b/content/base/src/nsGenericDOMDataNode.h
@ -236,7 +236,7 @@ public:
  virtual void SaveSubtreeState();

 #ifdef MOZ_SMIL
-  virtual nsISMILAttr* GetAnimatedAttr(const nsIAtom* /*aName*/)
+  virtual nsISMILAttr* GetAnimatedAttr(nsIAtom* /*aName*/)
  {
    return nsnull;
  }
--- a/content/base/src/nsGenericElement.h
+++ b/content/base/src/nsGenericElement.h
@ -431,7 +431,7 @@ public:
  virtual void SaveSubtreeState();

 #ifdef MOZ_SMIL
-  virtual nsISMILAttr* GetAnimatedAttr(const nsIAtom* /*aName*/)
+  virtual nsISMILAttr* GetAnimatedAttr(nsIAtom* /*aName*/)
  {
    return nsnull;
  }
--- a/content/base/src/nsObjectLoadingContent.cpp
+++ b/content/base/src/nsObjectLoadingContent.cpp
@ -221,13 +221,16 @@ nsPluginErrorEvent::Run()
 class nsPluginCrashedEvent : public nsRunnable {
 public:
  nsCOMPtr<nsIContent> mContent;
+  nsString mMinidumpID;
  nsString mPluginName;
  PRBool mSubmittedCrashReport;

  nsPluginCrashedEvent(nsIContent* aContent,
+                       const nsAString& aMinidumpID,
                       const nsAString& aPluginName,
                       PRBool submittedCrashReport)
    : mContent(aContent),
+      mMinidumpID(aMinidumpID),
      mPluginName(aPluginName),
      mSubmittedCrashReport(submittedCrashReport)
  {}
@ -266,6 +269,15 @@ nsPluginCrashedEvent::Run()
  
  nsCOMPtr<nsIWritableVariant> variant;

+  // add a "minidumpID" property to this event
+  variant = do_CreateInstance("@mozilla.org/variant;1");
+  if (!variant) {
+    NS_WARNING("Couldn't create minidumpID variant for PluginCrashed event!");
+    return NS_OK;
+  }
+  variant->SetAsAString(mMinidumpID);
+  containerEvent->SetData(NS_LITERAL_STRING("minidumpID"), variant);
+
  // add a "pluginName" property to this event
  variant = do_CreateInstance("@mozilla.org/variant;1");
  if (!variant) {
@ -2008,15 +2020,23 @@ nsObjectLoadingContent::SetAbsoluteScreenPosition(nsIDOMElement* element,
 }

 NS_IMETHODIMP
-nsObjectLoadingContent::PluginCrashed(const nsAString& pluginName,
+nsObjectLoadingContent::PluginCrashed(nsIPluginTag* aPluginTag,
+                                      const nsAString& minidumpID,
                                      PRBool submittedCrashReport)
 {
  AutoNotifier notifier(this, PR_TRUE);
  UnloadContent();
  mFallbackReason = ePluginCrashed;
  nsCOMPtr<nsIContent> thisContent = do_QueryInterface(static_cast<nsIImageLoadingContent*>(this));
+
+  // Note that aPluginTag in invalidated after we're called, so copy 
+  // out any data we need now.
+  nsCAutoString pluginName;
+  aPluginTag->GetName(pluginName);
+
  nsCOMPtr<nsIRunnable> ev = new nsPluginCrashedEvent(thisContent,
-                                                      pluginName,
+                                                      minidumpID,
+                                                      NS_ConvertUTF8toUTF16(pluginName),
                                                      submittedCrashReport);
  nsresult rv = NS_DispatchToCurrentThread(ev);
  if (NS_FAILED(rv)) {
--- a/content/base/src/nsPropertyTable.h
+++ b/content/base/src/nsPropertyTable.h
@ -98,6 +98,9 @@ private:
 // 0 is global.
 #define DOM_USER_DATA         1
 #define DOM_USER_DATA_HANDLER 2
+#ifdef MOZ_SMIL
+#define SMIL_MAPPED_ATTR_ANIMVAL 3
+#endif // MOZ_SMIL

 class nsPropertyTable
 {
--- a/content/base/src/nsXMLHttpRequest.cpp
+++ b/content/base/src/nsXMLHttpRequest.cpp
@ -1277,6 +1277,18 @@ nsXMLHttpRequest::GetStatusText(nsACString& aStatusText)
  nsresult rv = NS_OK;

  if (httpChannel) {
+    if (mState & XML_HTTP_REQUEST_USE_XSITE_AC) {
+      // Make sure we don't leak status information from denied cross-site
+      // requests.
+      if (mChannel) {
+        nsresult status;
+        mChannel->GetStatus(&status);
+        if (NS_FAILED(status)) {
+          return NS_ERROR_NOT_AVAILABLE;
+        }
+      }
+    }
+
    rv = httpChannel->GetResponseStatusText(aStatusText);
  }

--- a/content/base/test/Makefile.in
+++ b/content/base/test/Makefile.in
@ -360,6 +360,12 @@ _TEST_FILES = 	test_bug5141.html \
 		bug540854.sjs \
 		$(NULL)

+# This test fails on the Mac for some reason
+ifneq (,$(filter gtk2 windows,$(MOZ_WIDGET_TOOLKIT)))
+_TEST_FILES += 	test_copyimage.html \
+		$(NULL)
+endif
+
 # Disabled; see bug 492181
 #		test_plugin_freezing.html

--- a/content/base/test/file_CrossSiteXHR_inner.html
+++ b/content/base/test/file_CrossSiteXHR_inner.html
@ -45,6 +45,7 @@ window.addEventListener("message", function(e) {
  }
  xhr.onload = function () {
    res.status = xhr.status;
+    res.statusText = xhr.statusText;
    res.responseXML = xhr.responseXML ?
      (new XMLSerializer()).serializeToString(xhr.responseXML) :
      null;
@ -54,6 +55,10 @@ window.addEventListener("message", function(e) {
  xhr.onerror = function () {
    res.didFail = true;
    res.status = xhr.status;
+    try {
+      res.statusText = xhr.statusText;
+    } catch (e) {
+    }
    res.responseXML = xhr.responseXML ?
      (new XMLSerializer()).serializeToString(xhr.responseXML) :
      null;
--- a/content/base/test/file_CrossSiteXHR_inner.jar
+++ b/content/base/test/file_CrossSiteXHR_inner.jar
--- a/content/base/test/file_CrossSiteXHR_inner_data.sjs
+++ b/content/base/test/file_CrossSiteXHR_inner_data.sjs
@ -39,6 +39,7 @@ window.addEventListener("message", function(e) {\n\
  }\n\
  xhr.onload = function () {\n\
    res.status = xhr.status;\n\
+    res.statusText = xhr.statusText;\n\
    res.responseXML = xhr.responseXML ?\n\
      (new XMLSerializer()).serializeToString(xhr.responseXML) :\n\
      null;\n\
@ -48,6 +49,10 @@ window.addEventListener("message", function(e) {\n\
  xhr.onerror = function () {\n\
    res.didFail = true;\n\
    res.status = xhr.status;\n\
+    try {\n\
+      res.statusText = xhr.statusText;\n\
+    } catch (e) {\n\
+    }\n\
    res.responseXML = xhr.responseXML ?\n\
      (new XMLSerializer()).serializeToString(xhr.responseXML) :\n\
      null;\n\
--- a/content/base/test/test_CrossSiteXHR.html
+++ b/content/base/test/test_CrossSiteXHR.html
@ -134,8 +134,9 @@ function runTest() {
      loaderWindow.postMessage(req.toSource(), isNullOrigin ? "*" : origin);

      res = eval(yield);
-      is(res.didFail, false, "shouldn't have failed");
-      is(res.status, 200, "wrong status");
+      is(res.didFail, false, "shouldn't have failed for " + allowOrigin);
+      is(res.status, 200, "wrong status for " + allowOrigin);
+      is(res.statusText, "OK", "wrong status text for " + allowOrigin);
      is(res.responseXML,
         "<res>hello pass</res>",
         "wrong responseXML in test for " + allowOrigin);
@ -157,6 +158,7 @@ function runTest() {
      is(res.didFail, true, "should have failed for " + allowOrigin);
      is(res.responseText, "", "should have no text for " + allowOrigin);
      is(res.status, 0, "should have no status for " + allowOrigin);
+      is(res.statusText, undefined, "wrong status text for " + allowOrigin);
      is(res.responseXML, null, "should have no XML for " + allowOrigin);
      is(res.events.join(","),
         "opening,rs1,sending,rs1,loadstart,rs2,rs4,error",
@ -480,6 +482,7 @@ function runTest() {
    is(res.didFail, false,
      "shouldn't have failed in test for " + test.toSource());
    is(res.status, 200, "wrong status in test for " + test.toSource());
+    is(res.statusText, "OK", "wrong status text for " + test.toSource());
    if (test.method !== "HEAD") {
      is(res.responseXML, "<res>hello pass</res>",
         "wrong responseXML in test for " + test.toSource());
@ -523,6 +526,7 @@ function runTest() {
    is(res.didFail, true,
      "should have failed in test for " + test.toSource());
    is(res.status, 0, "wrong status in test for " + test.toSource());
+    is(res.statusText, undefined, "wrong status in test for " + test.toSource());
    is(res.responseXML, null,
       "wrong responseXML in test for " + test.toSource());
    is(res.responseText, "",
@ -642,6 +646,7 @@ function runTest() {
      is(res.didFail, false,
        "shouldn't have failed in test for " + test.toSource());
      is(res.status, 200, "wrong status in test for " + test.toSource());
+      is(res.statusText, "OK", "wrong status text for " + test.toSource());
      is(res.responseXML, "<res>hello pass</res>",
         "wrong responseXML in test for " + test.toSource());
      is(res.responseText, "<res>hello pass</res>\n",
@ -654,6 +659,7 @@ function runTest() {
      is(res.didFail, true,
        "should have failed in test for " + test.toSource());
      is(res.status, 0, "wrong status in test for " + test.toSource());
+      is(res.statusText, undefined, "wrong status in test for " + test.toSource());
      is(res.responseXML, null,
         "wrong responseXML in test for " + test.toSource());
      is(res.responseText, "",
@ -909,6 +915,7 @@ function runTest() {
      is(res.didFail, false,
        "shouldn't have failed in test for " + test.toSource());
      is(res.status, 200, "wrong status in test for " + test.toSource());
+      is(res.statusText, "OK", "wrong status text for " + test.toSource());
      is(res.responseXML, "<res>hello pass</res>",
         "wrong responseXML in test for " + test.toSource());
      is(res.responseText, "<res>hello pass</res>\n",
@ -921,6 +928,7 @@ function runTest() {
      is(res.didFail, true,
        "should have failed in test for " + test.toSource());
      is(res.status, 0, "wrong status in test for " + test.toSource());
+      is(res.statusText, undefined, "wrong status in test for " + test.toSource());
      is(res.responseXML, null,
         "wrong responseXML in test for " + test.toSource());
      is(res.responseText, "",
--- a/content/base/test/test_copyimage.html
+++ b/content/base/test/test_copyimage.html
@ -0,0 +1,61 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+-->
+<head>
+  <title>Test for copy image</title>
+  <script type="text/javascript" src="/MochiKit/packed.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=518249">Mozilla Bug 518249</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+function testCopyImage () {
+  netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
+
+  // selection of the node
+  var node = document.getElementById('logo');
+  var webnav = window.QueryInterface(Components.interfaces.nsIInterfaceRequestor)
+                     .getInterface(Components.interfaces.nsIWebNavigation)
+
+  var docShell = webnav.QueryInterface(Components.interfaces.nsIDocShell);
+
+  docShell.chromeEventHandler.ownerDocument.popupNode = node;
+
+  // let's copy the node
+  var documentViewer = docShell.contentViewer
+                               .QueryInterface(Components.interfaces.nsIContentViewerEdit);
+  documentViewer.copyImage(documentViewer.COPY_IMAGE_ALL);
+  
+  //--------- now check the content of the clipboard
+  var clipboard = Components.classes["@mozilla.org/widget/clipboard;1"]
+                            .getService(Components.interfaces.nsIClipboard);
+  
+  // does the clipboard contain text/unicode data ?
+  ok(clipboard.hasDataMatchingFlavors(["text/unicode"], 1, clipboard.kGlobalClipboard), "clipboard contains unicode text");
+  // does the clipboard contain text/html data ?
+  ok(clipboard.hasDataMatchingFlavors(["text/html"], 1, clipboard.kGlobalClipboard), "clipboard contains html text");
+  // does the clipboard contain image data ?
+  ok(clipboard.hasDataMatchingFlavors(["image/png"], 1, clipboard.kGlobalClipboard), "clipboard contains image");
+
+  SimpleTest.finish();
+}
+
+
+SimpleTest.waitForExplicitFinish();
+
+addLoadEvent(testCopyImage);
+
+</script>
+</pre>
+<div>
+  <img id="logo" src="about:logo">
+</div>
+</body>
+</html>
--- a/content/events/src/nsContentEventHandler.cpp
+++ b/content/events/src/nsContentEventHandler.cpp
@ -133,13 +133,12 @@ nsContentEventHandler::Init(nsQueryContentEvent* aEvent)
  rv = mPresShell->GetCaret(getter_AddRefs(caret));
  NS_ENSURE_SUCCESS(rv, rv);
  NS_ASSERTION(caret, "GetCaret succeeded, but the result is null");
+
  nsRect r;
-  nsIView* view = nsnull;
-  rv = caret->GetCaretCoordinates(nsCaret::eRenderingViewCoordinates,
-                                  mSelection, &r, &isCollapsed, &view);
-  NS_ENSURE_SUCCESS(rv, rv);
-  NS_ENSURE_TRUE(view, NS_ERROR_FAILURE);
-  aEvent->mReply.mFocusedWidget = view->GetWidget();
+  nsIFrame* frame = caret->GetGeometry(mSelection, &r);
+  NS_ENSURE_TRUE(frame, NS_ERROR_FAILURE);
+
+  aEvent->mReply.mFocusedWidget = frame->GetWindow();

  return NS_OK;
 }
@ -661,14 +660,15 @@ nsContentEventHandler::OnQueryCaretRect(nsQueryContentEvent* aEvent)
    rv = GetFlatTextOffsetOfRange(mRootContent, mFirstSelectedRange, &offset);
    NS_ENSURE_SUCCESS(rv, rv);
    if (offset == aEvent->mInput.mOffset) {
-      PRBool isCollapsed;
      nsRect rect;
-      rv = caret->GetCaretCoordinates(nsCaret::eTopLevelWindowCoordinates,
-                                      mSelection, &rect,
-                                      &isCollapsed, nsnull);
+      nsIFrame* caretFrame = caret->GetGeometry(mSelection, &rect);
+      if (!caretFrame)
+        return NS_ERROR_FAILURE;
+      nsPoint windowOffset(0, 0);
+      caretFrame->GetWindowOffset(windowOffset);
+      rect.MoveBy(windowOffset);
      aEvent->mReply.mRect =
-          rect.ToOutsidePixels(mPresContext->AppUnitsPerDevPixel());
-      NS_ENSURE_SUCCESS(rv, rv);
+        rect.ToOutsidePixels(caretFrame->PresContext()->AppUnitsPerDevPixel());
      aEvent->mSucceeded = PR_TRUE;
      return NS_OK;
    }
--- a/content/events/src/nsDOMProgressEvent.cpp
+++ b/content/events/src/nsDOMProgressEvent.cpp
@ -1,7 +1,7 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim:set ts=2 sw=2 sts=2 et cindent: */
 /* ***** BEGIN LICENSE BLOCK *****
- * Version: ML 1.1/GPL 2.0/LGPL 2.1
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
 *
 * The contents of this file are subject to the Mozilla Public License Version
 * 1.1 (the "License"); you may not use this file except in compliance with
--- a/content/events/src/nsDOMProgressEvent.h
+++ b/content/events/src/nsDOMProgressEvent.h
@ -1,7 +1,7 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim:set ts=2 sw=2 sts=2 et cindent: */
 /* ***** BEGIN LICENSE BLOCK *****
- * Version: ML 1.1/GPL 2.0/LGPL 2.1
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
 *
 * The contents of this file are subject to the Mozilla Public License Version
 * 1.1 (the "License"); you may not use this file except in compliance with
--- a/content/html/content/public/nsHTMLMediaElement.h
+++ b/content/html/content/public/nsHTMLMediaElement.h
@ -44,6 +44,7 @@
 #include "nsCycleCollectionParticipant.h"
 #include "nsILoadGroup.h"
 #include "nsIObserver.h"
+#include "ImageLayers.h"

 // Define to output information on decoding and painting framerate
 /* #define DEBUG_FRAME_RATE 1 */
@ -54,6 +55,8 @@ typedef PRUint16 nsMediaReadyState;
 class nsHTMLMediaElement : public nsGenericHTMLElement,
                           public nsIObserver
 {
+  typedef mozilla::layers::ImageContainer ImageContainer;
+
 public:
  nsHTMLMediaElement(nsINodeInfo *aNodeInfo, PRBool aFromParser = PR_FALSE);
  virtual ~nsHTMLMediaElement();
@ -159,11 +162,13 @@ public:
  // (no data has arrived for a while).
  void DownloadStalled();

-  // Draw the latest video data. See nsMediaDecoder for
-  // details.
-  void Paint(gfxContext* aContext,
-             gfxPattern::GraphicsFilter aFilter,
-             const gfxRect& aRect);
+  // Called by the media decoder and the video frame to get the
+  // ImageContainer containing the video data.
+  ImageContainer* GetImageContainer();
+
+  // Called by the video frame to get the print surface, if this is
+  // a static document and we're not actually playing video
+  gfxASurface* GetPrintSurface() { return mPrintSurface; }

  // Dispatch events
  nsresult DispatchSimpleEvent(const nsAString& aName);
@ -393,6 +398,10 @@ protected:

  nsRefPtr<nsMediaDecoder> mDecoder;

+  // A reference to the ImageContainer which contains the current frame
+  // of video to display.
+  nsRefPtr<ImageContainer> mImageContainer;
+
  // Holds a reference to the first channel we open to the media resource.
  // Once the decoder is created, control over the channel passes to the
  // decoder, and we null out this reference. We must store this in case
--- a/content/html/content/public/nsIFormSubmission.h
+++ b/content/html/content/public/nsIFormSubmission.h
@ -83,6 +83,27 @@ public:
  virtual nsresult AddNameFilePair(const nsAString& aName,
                                   nsIFile* aFile) = 0;
  
+  /**
+   * Reports whether the instance supports AddIsindex().
+   *
+   * @return true if supported.
+   */
+  virtual PRBool SupportsIsindexSubmission()
+  {
+    return PR_FALSE;
+  }
+
+  /**
+   * Adds an isindex value to the submission.
+   *
+   * @param aValue the field value
+   */
+  virtual nsresult AddIsindex(const nsAString& aValue)
+  {
+    NS_NOTREACHED("AddIsindex called when not supported");
+    return NS_ERROR_UNEXPECTED;
+  }
+
  /**
   * Given a URI and the current submission, create the final URI and data
   * stream that will be submitted.  Subclasses *must* implement this.
--- a/content/html/content/src/nsFormSubmission.cpp
+++ b/content/html/content/src/nsFormSubmission.cpp
@ -114,6 +114,13 @@ public:
  virtual nsresult GetEncodedSubmission(nsIURI* aURI,
                                        nsIInputStream** aPostDataStream);

+  virtual PRBool SupportsIsindexSubmission()
+  {
+    return PR_TRUE;
+  }
+
+  virtual nsresult AddIsindex(const nsAString& aValue);
+
 protected:

  /**
@ -169,6 +176,24 @@ nsFSURLEncoded::AddNameValuePair(const nsAString& aName,
  return NS_OK;
 }

+nsresult
+nsFSURLEncoded::AddIsindex(const nsAString& aValue)
+{
+  // Encode value
+  nsCString convValue;
+  nsresult rv = URLEncode(aValue, convValue);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Append data to string
+  if (mQueryString.IsEmpty()) {
+    mQueryString.Assign(convValue);
+  } else {
+    mQueryString += NS_LITERAL_CSTRING("&isindex=") + convValue;
+  }
+
+  return NS_OK;
+}
+
 nsresult
 nsFSURLEncoded::AddNameFilePair(const nsAString& aName,
                                nsIFile* aFile)
--- a/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/content/html/content/src/nsGenericHTMLElement.cpp
@ -2219,6 +2219,26 @@ nsGenericHTMLElement::SetContentEditable(const nsAString& aContentEditable)
  return NS_OK;
 }

+nsresult
+nsGenericHTMLElement::GetIsContentEditable(PRBool* aContentEditable)
+{
+  NS_ENSURE_ARG_POINTER(aContentEditable);
+
+  for (nsIContent* node = this; node; node = node->GetParent()) {
+    nsGenericHTMLElement* element = FromContent(node);
+    if (element) {
+      ContentEditableTristate value = element->GetContentEditableValue();
+      if (value != eInherit) {
+        *aContentEditable = value == eTrue;
+        return NS_OK;
+      }
+    }
+  }
+
+  *aContentEditable = PR_FALSE;
+  return NS_OK;
+}
+
 //----------------------------------------------------------------------

 NS_IMPL_INT_ATTR_DEFAULT_VALUE(nsGenericHTMLFrameElement, TabIndex, tabindex, 0)
--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@ -156,6 +156,7 @@ public:
  NS_IMETHOD GetDraggable(PRBool* aDraggable);
  NS_IMETHOD SetDraggable(PRBool aDraggable);
  nsresult GetContentEditable(nsAString &aContentEditable);
+  nsresult GetIsContentEditable(PRBool* aContentEditable);
  nsresult SetContentEditable(const nsAString &aContentEditable);

  // Implementation for nsIContent
--- a/content/html/content/src/nsHTMLAudioElement.cpp
+++ b/content/html/content/src/nsHTMLAudioElement.cpp
@ -1,7 +1,7 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim:set ts=2 sw=2 sts=2 et cindent: */
 /* ***** BEGIN LICENSE BLOCK *****
- * Version: ML 1.1/GPL 2.0/LGPL 2.1
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
 *
 * The contents of this file are subject to the Mozilla Public License Version
 * 1.1 (the "License"); you may not use this file except in compliance with
--- a/content/html/content/src/nsHTMLInputElement.cpp
+++ b/content/html/content/src/nsHTMLInputElement.cpp
@ -2659,15 +2659,18 @@ nsHTMLInputElement::SubmitNamesValues(nsFormSubmission* aFormSubmission,
    return NS_OK;
  }

-  // Submit
-  // (for type=image, only submit if value is non-null)
  if (mType == NS_FORM_INPUT_HIDDEN && name.EqualsLiteral("_charset_")) {
    nsCString charset;
    aFormSubmission->GetCharset(charset);
    rv = aFormSubmission->AddNameValuePair(name,
                                           NS_ConvertASCIItoUTF16(charset));
  }
-  else if (mType != NS_FORM_INPUT_IMAGE || !value.IsEmpty()) {
+  else if (mType == NS_FORM_INPUT_TEXT &&
+           name.EqualsLiteral("isindex") &&
+           aFormSubmission->SupportsIsindexSubmission()) {
+    rv = aFormSubmission->AddIsindex(value);
+  }
+  else {
    rv = aFormSubmission->AddNameValuePair(name, value);
  }

--- a/content/html/content/src/nsHTMLMediaElement.cpp
+++ b/content/html/content/src/nsHTMLMediaElement.cpp
@ -1,7 +1,7 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim:set ts=2 sw=2 sts=2 et cindent: */
 /* ***** BEGIN LICENSE BLOCK *****
- * Version: ML 1.1/GPL 2.0/LGPL 2.1
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
 *
 * The contents of this file are subject to the Mozilla Public License Version
 * 1.1 (the "License"); you may not use this file except in compliance with
@ -57,6 +57,7 @@
 #include "prlock.h"
 #include "nsThreadUtils.h"
 #include "nsContentUtils.h"
+#include "nsFrameManager.h"

 #include "nsIScriptSecurityManager.h"
 #include "nsIXPConnect.h"
@ -73,6 +74,7 @@
 #include "nsCommaSeparatedTokenizer.h"
 #include "nsMediaStream.h"

+#include "nsIDOMHTMLVideoElement.h"
 #include "nsIContentPolicy.h"
 #include "nsContentPolicyUtils.h"
 #include "nsContentErrors.h"
@ -80,6 +82,7 @@
 #include "nsCycleCollectionParticipant.h"
 #include "nsLayoutUtils.h"
 #include "nsVideoFrame.h"
+#include "BasicLayers.h"

 #ifdef MOZ_OGG
 #include "nsOggDecoder.h"
@ -98,6 +101,8 @@ static PRLogModuleInfo* gMediaElementEventsLog;
 #define LOG_EVENT(type, msg)
 #endif

+using namespace mozilla::layers;
+
 // Under certain conditions there may be no-one holding references to
 // a media element from script, DOM parent, etc, but the element may still
 // fire meaningful events in the future so we can't destroy it yet:
@ -1737,26 +1742,62 @@ void nsHTMLMediaElement::NotifyAutoplayDataReady()
  }
 }

-void nsHTMLMediaElement::Paint(gfxContext* aContext,
-                               gfxPattern::GraphicsFilter aFilter,
-                               const gfxRect& aRect)
+/**
+ * Returns a layer manager to use for the given document. Basically we
+ * look up the document hierarchy for the first document which has
+ * a presentation with an associated widget, and use that widget's
+ * layer manager.
+ */
+static already_AddRefed<LayerManager> GetLayerManagerForDoc(nsIDocument* aDoc)
 {
-  if (mPrintSurface) {
-    nsRefPtr<gfxPattern> pat = new gfxPattern(mPrintSurface);
-    if (!pat)
-      return;
-    // Make the source image fill the rectangle completely
-    pat->SetMatrix(gfxMatrix().Scale(mMediaSize.width/aRect.Width(),
-                                     mMediaSize.height/aRect.Height()));
+  while (aDoc) {
+    nsIDocument* displayDoc = aDoc->GetDisplayDocument();
+    if (displayDoc) {
+      aDoc = displayDoc;
+      continue;
+    }

-    pat->SetFilter(aFilter);
-
-    aContext->NewPath();
-    aContext->PixelSnappedRectangleAndSetPattern(aRect, pat);
-    aContext->Fill();
-  } else if (mDecoder) {
-    mDecoder->Paint(aContext, aFilter, aRect);
+    nsIPresShell* shell = aDoc->GetPrimaryShell();
+    if (shell) {
+      nsIFrame* rootFrame = shell->FrameManager()->GetRootFrame();
+      if (rootFrame) {
+        nsIWidget* widget =
+          nsLayoutUtils::GetDisplayRootFrame(rootFrame)->GetWindow();
+        if (widget) {
+          nsRefPtr<LayerManager> manager = widget->GetLayerManager();
+          return manager.forget();
+        }
+      }
+    }
+    aDoc = aDoc->GetParentDocument();
  }
+
+  nsRefPtr<LayerManager> manager = new BasicLayerManager(nsnull);
+  return manager.forget();
+}
+
+ImageContainer* nsHTMLMediaElement::GetImageContainer()
+{
+  if (mImageContainer)
+    return mImageContainer;
+
+  // If we have a print surface, this is just a static image so
+  // no image container is required
+  if (mPrintSurface)
+    return nsnull;
+
+  // Only video frames need an image container.
+  nsCOMPtr<nsIDOMHTMLVideoElement> video =
+    do_QueryInterface(static_cast<nsIContent*>(this));
+  if (!video)
+    return nsnull;
+
+  nsRefPtr<LayerManager> manager = GetLayerManagerForDoc(GetOwnerDoc());
+  if (!manager)
+    return nsnull;
+
+  mImageContainer = manager->CreateImageContainer();
+  return mImageContainer;
 }

 nsresult nsHTMLMediaElement::DispatchSimpleEvent(const nsAString& aName)
--- a/content/html/content/src/nsHTMLMediaError.cpp
+++ b/content/html/content/src/nsHTMLMediaError.cpp
@ -1,7 +1,7 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim:set ts=2 sw=2 sts=2 et cindent: */
 /* ***** BEGIN LICENSE BLOCK *****
- * Version: ML 1.1/GPL 2.0/LGPL 2.1
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
 *
 * The contents of this file are subject to the Mozilla Public License Version
 * 1.1 (the "License"); you may not use this file except in compliance with
--- a/content/html/content/src/nsHTMLSourceElement.cpp
+++ b/content/html/content/src/nsHTMLSourceElement.cpp
@ -1,7 +1,7 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim:set ts=2 sw=2 sts=2 et cindent: */
 /* ***** BEGIN LICENSE BLOCK *****
- * Version: ML 1.1/GPL 2.0/LGPL 2.1
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
 *
 * The contents of this file are subject to the Mozilla Public License Version
 * 1.1 (the "License"); you may not use this file except in compliance with
--- a/content/html/content/src/nsHTMLVideoElement.cpp
+++ b/content/html/content/src/nsHTMLVideoElement.cpp
@ -1,7 +1,7 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim:set ts=2 sw=2 sts=2 et cindent: */
 /* ***** BEGIN LICENSE BLOCK *****
- * Version: ML 1.1/GPL 2.0/LGPL 2.1
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
 *
 * The contents of this file are subject to the Mozilla Public License Version
 * 1.1 (the "License"); you may not use this file except in compliance with
--- a/content/html/content/test/Makefile.in
+++ b/content/html/content/test/Makefile.in
@ -157,6 +157,7 @@ _TEST_FILES = 	test_bug589.html \
 		test_bug457800.html \
 		test_bug536891.html \
 		test_bug536895.html \
+		test_bug458037.xhtml \
 		$(NULL)

 libs:: $(_TEST_FILES)
--- a/content/html/content/test/test_bug458037.xhtml
+++ b/content/html/content/test/test_bug458037.xhtml
@ -0,0 +1,117 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=458037
+-->
+<head>
+  <title>Test for Bug 458037</title>
+  <script type="text/javascript" src="/MochiKit/packed.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>        
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=458037">Mozilla Bug 458037</a>
+<p id="display"></p>
+<div id="content" >
+<div id="a"></div>
+<div id="b" contenteditable="true"></div>
+<div id="c" contenteditable="false"></div>
+<div id="d" contenteditable="inherit"></div>
+<div contenteditable="true">
+  <div id="e"></div>
+</div>
+<div contenteditable="false">
+  <div id="f"></div>
+</div>
+<div contenteditable="true">
+  <div id="g" contenteditable="false"></div>
+</div>
+<div contenteditable="false">
+  <div id="h" contenteditable="true"></div>
+</div>
+<div contenteditable="true">
+  <div id="i" contenteditable="inherit"></div>
+</div>
+<div contenteditable="false">
+  <div id="j" contenteditable="inherit"></div>
+</div>
+<div contenteditable="true">
+  <xul:box>
+    <div id="k"></div>
+  </xul:box>
+</div>
+<div contenteditable="false">
+  <xul:box>
+    <div id="l"></div>
+  </xul:box>
+</div>
+<div contenteditable="true">
+  <xul:box>
+    <div id="m" contenteditable="inherit"></div>
+  </xul:box>
+</div>
+<div contenteditable="false">
+  <xul:box>
+    <div id="n" contenteditable="inherit"></div>
+  </xul:box>
+</div>
+<div id="x"></div>
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+/** Test for Bug 458037 **/
+
+function test(id, expected) {
+  is(document.getElementById(id).isContentEditable, expected,
+     "Element " + id + " should " + (expected ? "" : "not ") + "be editable");
+}
+
+document.addEventListener("DOMContentLoaded", function() {
+  test("a", false);
+  test("b", true);
+  test("c", false);
+  test("d", false);
+  test("e", true);
+  test("f", false);
+  test("g", false);
+  test("h", true);
+  test("i", true);
+  test("j", false);
+  test("k", true);
+  test("l", false);
+  test("m", true);
+  test("n", false);
+
+  var d = document.getElementById("x");
+  test("x", false);
+  d.setAttribute("contenteditable", "true");
+  test("x", true);
+  d.setAttribute("contenteditable", "false");
+  test("x", false);
+  d.setAttribute("contenteditable", "inherit");
+  test("x", false);
+  d.removeAttribute("contenteditable");
+  test("x", false);
+  d.contentEditable = "true";
+  test("x", true);
+  d.contentEditable = "false";
+  test("x", false);
+  d.contentEditable = "inherit";
+  test("x", false);
+
+  // Make sure that isContentEditable is read-only
+  var exceptionCaught = false;
+  try {
+    d.isContentEditable = true;
+  } catch (e) {
+    exceptionCaught = true;
+  }
+  ok(exceptionCaught, "isContentEditable should be read only");
+}, false);
+
+</script>
+</pre>
+</body>
+</html>
+
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@ -1069,6 +1069,21 @@ nsHTMLDocument::DocumentWriteTerminationFunc(nsISupports *aRef)
  htmldoc->EndLoad();
 }

+void
+nsHTMLDocument::BeginLoad()
+{
+  if (IsEditingOn()) {
+    // Reset() blows away all event listeners in the document, and our
+    // editor relies heavily on those. Midas is turned on, to make it
+    // work, re-initialize it to give it a chance to add its event
+    // listeners again.
+
+    TurnEditingOff();
+    EditingStateChanged();
+  }
+  nsDocument::BeginLoad();
+}
+
 void
 nsHTMLDocument::EndLoad()
 {
@ -1961,7 +1976,7 @@ nsHTMLDocument::OpenCommon(const nsACString& aContentType, PRBool aReplace)
    mWillReparent = PR_TRUE;
 #endif

-    rv = window->SetNewDocument(this, nsnull, PR_FALSE);
+    rv = window->SetNewDocument(this, nsnull);
    NS_ENSURE_SUCCESS(rv, rv);

 #ifdef DEBUG
@ -1985,16 +2000,6 @@ nsHTMLDocument::OpenCommon(const nsACString& aContentType, PRBool aReplace)
    mDocumentBaseURI = baseURI;
  }

-  if (IsEditingOn()) {
-    // Reset() blows away all event listeners in the document, and our
-    // editor relies heavily on those. Midas is turned on, to make it
-    // work, re-initialize it to give it a chance to add its event
-    // listeners again.
-
-    TurnEditingOff();
-    EditingStateChanged();
-  }
-
  // Store the security info of the caller now that we're done
  // resetting the document.
  mSecurityInfo = securityInfo;
--- a/Показать больше
+++ b/Показать больше
 @ -1 +1 @@
 .7a3pre
 .7a4pre