diff --git a/accessible/src/base/AccEvent.cpp b/accessible/src/base/AccEvent.cpp
index 661a8d46d147..e28cdfecb625 100644
--- a/accessible/src/base/AccEvent.cpp
+++ b/accessible/src/base/AccEvent.cpp
@@ -12,6 +12,7 @@
 #include "States.h"
 
 #include "nsEventStateManager.h"
+#include "mozilla/Selection.h"
 
 using namespace mozilla;
 using namespace mozilla::a11y;
@@ -126,13 +127,22 @@ AccShowEvent::
 ////////////////////////////////////////////////////////////////////////////////
 
 AccTextSelChangeEvent::AccTextSelChangeEvent(HyperTextAccessible* aTarget,
-                                             nsISelection* aSelection) :
+                                             Selection* aSelection,
+                                             int32_t aReason) :
   AccEvent(nsIAccessibleEvent::EVENT_TEXT_SELECTION_CHANGED, aTarget,
            eAutoDetect, eCoalesceTextSelChange),
-  mSel(aSelection) {}
+  mSel(aSelection), mReason(aReason) {}
 
 AccTextSelChangeEvent::~AccTextSelChangeEvent() { }
 
+bool
+AccTextSelChangeEvent::IsCaretMoveOnly() const
+{
+  return mSel->GetRangeCount() == 1 && mSel->IsCollapsed() &&
+    ((mReason & (nsISelectionListener::COLLAPSETOSTART_REASON |
+                 nsISelectionListener::COLLAPSETOEND_REASON)) == 0);
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 // AccSelChangeEvent
 ////////////////////////////////////////////////////////////////////////////////
diff --git a/accessible/src/base/AccEvent.h b/accessible/src/base/AccEvent.h
index 10a9e0ce9b0c..15a48be201d1 100644
--- a/accessible/src/base/AccEvent.h
+++ b/accessible/src/base/AccEvent.h
@@ -10,9 +10,10 @@
 
 #include "mozilla/a11y/Accessible.h"
 
-class nsISelection;
-
 namespace mozilla {
+
+class Selection;
+
 namespace a11y {
 
 class DocAccessible;
@@ -366,7 +367,8 @@ private:
 class AccTextSelChangeEvent : public AccEvent
 {
 public:
-  AccTextSelChangeEvent(HyperTextAccessible* aTarget, nsISelection* aSelection);
+  AccTextSelChangeEvent(HyperTextAccessible* aTarget, Selection* aSelection,
+                        int32_t aReason);
   virtual ~AccTextSelChangeEvent();
 
   // AccEvent
@@ -376,8 +378,16 @@ public:
     return AccEvent::GetEventGroups() | (1U << eTextSelChangeEvent);
   }
 
+  // AccTextSelChangeEvent
+
+  /**
+   * Return true if the text selection change wasn't caused by pure caret move.
+   */
+  bool IsCaretMoveOnly() const;
+
 private:
-  nsCOMPtr<nsISelection> mSel;
+  nsRefPtr<Selection> mSel;
+  int32_t mReason;
 
   friend class EventQueue;
   friend class SelectionManager;
diff --git a/accessible/src/base/Logging.cpp b/accessible/src/base/Logging.cpp
index 435b79f358b1..330581b16c7b 100644
--- a/accessible/src/base/Logging.cpp
+++ b/accessible/src/base/Logging.cpp
@@ -582,7 +582,8 @@ logging::FocusDispatched(Accessible* aTarget)
 }
 
 void
-logging::SelChange(nsISelection* aSelection, DocAccessible* aDocument)
+logging::SelChange(nsISelection* aSelection, DocAccessible* aDocument,
+                   int16_t aReason)
 {
   nsCOMPtr<nsISelectionPrivate> privSel(do_QueryInterface(aSelection));
 
@@ -598,8 +599,10 @@ logging::SelChange(nsISelection* aSelection, DocAccessible* aDocument)
     strType = "unknown";
 
   bool isIgnored = !aDocument || !aDocument->IsContentLoaded();
-  printf("\nSelection changed, selection type: %s, notification %s\n",
-         strType, (isIgnored ? "ignored" : "pending"));
+  printf("\nSelection changed, selection type: %s, notification %s, reason: %d\n",
+         strType, (isIgnored ? "ignored" : "pending"), aReason);
+
+  Stack();
 }
 
 void
diff --git a/accessible/src/base/Logging.h b/accessible/src/base/Logging.h
index 35705bd90718..09fc7767ee25 100644
--- a/accessible/src/base/Logging.h
+++ b/accessible/src/base/Logging.h
@@ -118,7 +118,8 @@ void FocusDispatched(Accessible* aTarget);
 /**
  * Log the selection change.
  */
-void SelChange(nsISelection* aSelection, DocAccessible* aDocument);
+void SelChange(nsISelection* aSelection, DocAccessible* aDocument,
+               int16_t aReason);
 
 /**
  * Log the message ('title: text' format) on new line. Print the start and end
diff --git a/accessible/src/base/SelectionManager.cpp b/accessible/src/base/SelectionManager.cpp
index 5ea58d4bdc60..afc556b286e7 100644
--- a/accessible/src/base/SelectionManager.cpp
+++ b/accessible/src/base/SelectionManager.cpp
@@ -14,13 +14,23 @@
 #include "nsIAccessibleTypes.h"
 #include "nsIDOMDocument.h"
 #include "nsIPresShell.h"
-#include "nsISelectionPrivate.h"
 #include "mozilla/Selection.h"
 #include "mozilla/dom/Element.h"
 
 using namespace mozilla;
 using namespace mozilla::a11y;
 
+struct mozilla::a11y::SelData
+{
+  SelData(Selection* aSel, int32_t aReason) :
+    mSel(aSel), mReason(aReason) {}
+
+  nsRefPtr<Selection> mSel;
+  int16_t mReason;
+
+  NS_INLINE_DECL_REFCOUNTING(SelData);
+};
+
 void
 SelectionManager::ClearControlSelectionListener()
 {
@@ -110,17 +120,16 @@ SelectionManager::RemoveDocSelectionListener(nsIPresShell* aPresShell)
 void
 SelectionManager::ProcessTextSelChangeEvent(AccEvent* aEvent)
 {
+  // Fire selection change event if it's not pure caret-move selection change,
+  // i.e. the accessible has or had not collapsed selection.
   AccTextSelChangeEvent* event = downcast_accEvent(aEvent);
-  Selection* sel = static_cast<Selection*>(event->mSel.get());
-
-  // Fire selection change event if it's not pure caret-move selection change.
-  if (sel->GetRangeCount() != 1 || !sel->IsCollapsed())
+  if (!event->IsCaretMoveOnly())
     nsEventShell::FireEvent(aEvent);
 
   // Fire caret move event if there's a caret in the selection.
   nsINode* caretCntrNode =
-    nsCoreUtils::GetDOMNodeFromDOMPoint(sel->GetFocusNode(),
-                                        sel->FocusOffset());
+    nsCoreUtils::GetDOMNodeFromDOMPoint(event->mSel->GetFocusNode(),
+                                        event->mSel->FocusOffset());
   if (!caretCntrNode)
     return;
 
@@ -150,7 +159,7 @@ SelectionManager::NotifySelectionChanged(nsIDOMDocument* aDOMDocument,
 
 #ifdef A11Y_LOG
   if (logging::IsEnabled(logging::eSelection))
-    logging::SelChange(aSelection, document);
+    logging::SelChange(aSelection, document, aReason);
 #endif
 
   // Don't fire events until document is loaded.
@@ -158,17 +167,19 @@ SelectionManager::NotifySelectionChanged(nsIDOMDocument* aDOMDocument,
     // Selection manager has longer lifetime than any document accessible,
     // so that we are guaranteed that the notification is processed before
     // the selection manager is destroyed.
-    document->HandleNotification<SelectionManager, nsISelection>
-      (this, &SelectionManager::ProcessSelectionChanged, aSelection);
+    nsRefPtr<SelData> selData =
+      new SelData(static_cast<Selection*>(aSelection), aReason);
+    document->HandleNotification<SelectionManager, SelData>
+      (this, &SelectionManager::ProcessSelectionChanged, selData);
   }
 
   return NS_OK;
 }
 
 void
-SelectionManager::ProcessSelectionChanged(nsISelection* aSelection)
+SelectionManager::ProcessSelectionChanged(SelData* aSelData)
 {
-  Selection* selection = static_cast<Selection*>(aSelection);
+  Selection* selection = aSelData->mSel;
   if (!selection->GetPresShell())
     return;
 
@@ -176,11 +187,12 @@ SelectionManager::ProcessSelectionChanged(nsISelection* aSelection)
   nsINode* cntrNode = nullptr;
   if (range)
     cntrNode = range->GetCommonAncestor();
+
   if (!cntrNode) {
     cntrNode = selection->GetFrameSelection()->GetAncestorLimiter();
     if (!cntrNode) {
       cntrNode = selection->GetPresShell()->GetDocument();
-      NS_ASSERTION(selection->GetPresShell()->ConstFrameSelection() == selection->GetFrameSelection(),
+      NS_ASSERTION(aSelData->mSel->GetPresShell()->ConstFrameSelection() == selection->GetFrameSelection(),
                    "Wrong selection container was used!");
     }
   }
@@ -192,7 +204,8 @@ SelectionManager::ProcessSelectionChanged(nsISelection* aSelection)
   }
 
   if (selection->GetType() == nsISelectionController::SELECTION_NORMAL) {
-    nsRefPtr<AccEvent> event = new AccTextSelChangeEvent(text, aSelection);
+    nsRefPtr<AccEvent> event =
+      new AccTextSelChangeEvent(text, selection, aSelData->mReason);
     text->Document()->FireDelayedEvent(event);
 
   } else if (selection->GetType() == nsISelectionController::SELECTION_SPELLCHECK) {
diff --git a/accessible/src/base/SelectionManager.h b/accessible/src/base/SelectionManager.h
index 7d2f5c6fff85..1fc9b28b1063 100644
--- a/accessible/src/base/SelectionManager.h
+++ b/accessible/src/base/SelectionManager.h
@@ -38,6 +38,8 @@ class AccEvent;
  * selection change events.
  */
 
+struct SelData;
+
 class SelectionManager : public nsISelectionListener
 {
 public:
@@ -83,7 +85,7 @@ protected:
   /**
    * Process DOM selection change. Fire selection and caret move events.
    */
-  void ProcessSelectionChanged(nsISelection* aSelection);
+  void ProcessSelectionChanged(SelData* aSelData);
 
 private:
   // Currently focused control.
diff --git a/accessible/src/jsat/EventManager.jsm b/accessible/src/jsat/EventManager.jsm
index a67192ea98eb..5774ab7e234a 100644
--- a/accessible/src/jsat/EventManager.jsm
+++ b/accessible/src/jsat/EventManager.jsm
@@ -155,12 +155,18 @@ this.EventManager.prototype = {
         let event = aEvent.
           QueryInterface(Ci.nsIAccessibleVirtualCursorChangeEvent);
         let reason = event.reason;
+        let oldAccessible = event.oldAccessible;
+
+        if (oldAccessible && oldAccessible.role == Roles.INTERNAL_FRAME) {
+          let mm = Utils.getMessageManager(oldAccessible.DOMNode);
+          mm.sendAsyncMessage('AccessFu:ClearCursor', {});
+        }
 
         if (this.editState.editing) {
           aEvent.accessibleDocument.takeFocus();
         }
         this.present(
-          Presentation.pivotChanged(position, event.oldAccessible, reason,
+          Presentation.pivotChanged(position, oldAccessible, reason,
                                     pivot.startOffset, pivot.endOffset));
 
         break;
@@ -184,7 +190,7 @@ this.EventManager.prototype = {
       }
       case Events.SCROLLING_START:
       {
-        let vc = Utils.getVirtualCursor(aEvent.accessibleDocument);
+        let vc = Utils.getVirtualCursor(this.contentScope.content.document);
         vc.moveNext(TraversalRules.Simple, aEvent.accessible, true);
         break;
       }
@@ -275,7 +281,7 @@ this.EventManager.prototype = {
         let doc = aEvent.accessibleDocument;
         if (acc.role != Roles.DOCUMENT && doc.role != Roles.CHROME_WINDOW) {
           this.contentScope.content.clearTimeout(this._autoMove);
-          let vc = Utils.getVirtualCursor(doc);
+          let vc = Utils.getVirtualCursor(this.contentScope.content.document);
           vc.moveNext(TraversalRules.Simple, acc, true);
         }
         break;
@@ -283,7 +289,7 @@ this.EventManager.prototype = {
       case Events.DOCUMENT_LOAD_COMPLETE:
       {
         this._autoMove = this.contentScope.content.setTimeout(() => {
-          Utils.getVirtualCursor(aEvent.accessibleDocument)
+          Utils.getVirtualCursor(this.contentScope.content.document)
             .moveNext(TraversalRules.Simple, aEvent.accessible, true);
         }, 500);
         break;
diff --git a/accessible/src/jsat/content-script.js b/accessible/src/jsat/content-script.js
index 953fc24b4ea8..a61f68934a6a 100644
--- a/accessible/src/jsat/content-script.js
+++ b/accessible/src/jsat/content-script.js
@@ -27,6 +27,15 @@ Logger.debug('content-script.js');
 
 let eventManager = null;
 
+function clearCursor(aMessage) {
+  try {
+    Utils.getVirtualCursor(content.document).position = null;
+    forwardToChild(aMessage);
+  } catch (x) {
+    Logger.logException(x);
+  }
+}
+
 function moveCursor(aMessage) {
   if (Logger.logLevel >= Logger.DEBUG) {
     Logger.debug(aMessage.name, JSON.stringify(aMessage.json, null, ' '));
@@ -144,7 +153,11 @@ function forwardToChild(aMessage, aListener, aVCPosition) {
   }
 
   let mm = Utils.getMessageManager(acc.DOMNode);
-  mm.addMessageListener(aMessage.name, aListener);
+
+  if (aListener) {
+    mm.addMessageListener(aMessage.name, aListener);
+  }
+
   // XXX: This is a silly way to make a deep copy
   let newJSON = JSON.parse(JSON.stringify(aMessage.json));
   newJSON.origin = 'parent';
@@ -381,6 +394,7 @@ addMessageListener(
     addMessageListener('AccessFu:AdjustRange', adjustRange);
     addMessageListener('AccessFu:MoveCaret', moveCaret);
     addMessageListener('AccessFu:MoveByGranularity', moveByGranularity);
+    addMessageListener('AccessFu:ClearCursor', clearCursor);
 
     if (!eventManager) {
       eventManager = new EventManager(this);
@@ -401,6 +415,7 @@ addMessageListener(
     removeMessageListener('AccessFu:Scroll', scroll);
     removeMessageListener('AccessFu:MoveCaret', moveCaret);
     removeMessageListener('AccessFu:MoveByGranularity', moveByGranularity);
+    removeMessageListener('AccessFu:ClearCursor', clearCursor);
 
     eventManager.stop();
   });
diff --git a/accessible/src/windows/msaa/nsWinUtils.cpp b/accessible/src/windows/msaa/nsWinUtils.cpp
index 42ad3d6076e1..bafe0d46a808 100644
--- a/accessible/src/windows/msaa/nsWinUtils.cpp
+++ b/accessible/src/windows/msaa/nsWinUtils.cpp
@@ -16,7 +16,7 @@
 #include "nsIArray.h"
 #include "nsIDocument.h"
 #include "nsIDocShellTreeItem.h"
-#include "nsIXULRuntime.h"
+#include "nsXULAppAPI.h"
 
 using namespace mozilla;
 using namespace mozilla::a11y;
@@ -59,7 +59,7 @@ nsWinUtils::MaybeStartWindowEmulation()
   // with tabs.
   if (Compatibility::IsJAWS() || Compatibility::IsWE() ||
       Compatibility::IsDolphin() ||
-      BrowserTabsRemote()) {
+      XRE_GetProcessType() == GeckoProcessType_Content) {
     RegisterNativeWindow(kClassNameTabContent);
     sHWNDCache = new nsRefPtrHashtable<nsPtrHashKey<void>, DocAccessible>(4);
     return true;
diff --git a/accessible/tests/mochitest/events.js b/accessible/tests/mochitest/events.js
index 525d56d6631d..9029a7605900 100644
--- a/accessible/tests/mochitest/events.js
+++ b/accessible/tests/mochitest/events.js
@@ -1212,17 +1212,17 @@ function synthUpKey(aNodeOrID, aCheckerOrEventSeq, aArgs)
 /**
  * Left arrow key invoker.
  */
-function synthLeftKey(aNodeOrID, aCheckerOrEventSeq)
+function synthLeftKey(aNodeOrID, aCheckerOrEventSeq, aArgs)
 {
-  this.__proto__ = new synthKey(aNodeOrID, "VK_LEFT", null, aCheckerOrEventSeq);
+  this.__proto__ = new synthKey(aNodeOrID, "VK_LEFT", aArgs, aCheckerOrEventSeq);
 }
 
 /**
  * Right arrow key invoker.
  */
-function synthRightKey(aNodeOrID, aCheckerOrEventSeq)
+function synthRightKey(aNodeOrID, aCheckerOrEventSeq, aArgs)
 {
-  this.__proto__ = new synthKey(aNodeOrID, "VK_RIGHT", null, aCheckerOrEventSeq);
+  this.__proto__ = new synthKey(aNodeOrID, "VK_RIGHT", aArgs, aCheckerOrEventSeq);
 }
 
 /**
@@ -1764,7 +1764,12 @@ function textSelectionChecker(aID, aStartOffset, aEndOffset)
 
   this.check = function textSelectionChecker_check(aEvent)
   {
-    testTextGetSelection(aID, aStartOffset, aEndOffset, 0);
+    if (aStartOffset == aEndOffset) {
+      is(getAccessible(aID, [nsIAccessibleText]).caretOffset, aStartOffset,
+         "Wrong collapsed selection!");
+    } else {
+      testTextGetSelection(aID, aStartOffset, aEndOffset, 0);
+    }
   }
 }
 
diff --git a/accessible/tests/mochitest/events/test_textselchange.html b/accessible/tests/mochitest/events/test_textselchange.html
index 62b9ec263927..9347f7d3c697 100644
--- a/accessible/tests/mochitest/events/test_textselchange.html
+++ b/accessible/tests/mochitest/events/test_textselchange.html
@@ -24,19 +24,30 @@
     // gA11yEventDumpID = "eventdump"; // debug stuff
     //gA11yEventDumpToConsole = true;
 
+    function getOnclickSeq(aID)
+    {
+      return [
+        new caretMoveChecker(0, aID), 
+        new unexpectedInvokerChecker(EVENT_TEXT_SELECTION_CHANGED, aID)
+      ];
+    }
+
     function doTests()
     {
       // test caret move events and caret offsets
       gQueue = new eventQueue();
 
-      var onclickSeq = [
-        new caretMoveChecker(0, "c1_p1"), 
-        new unexpectedInvokerChecker(EVENT_TEXT_SELECTION_CHANGED, "c1_p1")
-      ];
-      gQueue.push(new synthClick("c1_p1", onclickSeq));
+      gQueue.push(new synthClick("c1_p1", getOnclickSeq("c1_p1")));
       gQueue.push(new synthDownKey("c1", new textSelectionChecker("c1", 0, 1), { shiftKey: true }));
       gQueue.push(new synthDownKey("c1", new textSelectionChecker("c1", 0, 2), { shiftKey: true }));
 
+      gQueue.push(new synthClick("ta1", getOnclickSeq("ta1")));
+      gQueue.push(new synthRightKey("ta1",
+                                    new textSelectionChecker("ta1", 0, 1),
+                                    { shiftKey: true }));
+      gQueue.push(new synthLeftKey("ta1",
+                                    new textSelectionChecker("ta1", 0, 0)));
+
       gQueue.invoke(); // Will call SimpleTest.finish();
     }
 
@@ -52,6 +63,11 @@
      title="Text selection change event has a wrong target when selection is spanned through several objects">
     Bug 762934
   </a>
+  <a target="_blank"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=956032"
+     title="Text selection change event missed when selected text becomes unselected">
+    Bug 956032
+  </a>
   <p id="display"></p>
   <div id="content" style="display: none"></div>
   <pre id="test">
@@ -62,6 +78,8 @@
     <p id="c1_p2">paragraph</p>
   </div>
 
+  <textarea id="ta1">Hello world</textarea>
+
   <div id="eventdump"></div>
 </body>
 </html>
diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
index cb949b078fda..92acb511009b 100644
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -978,7 +978,16 @@ pref("dom.ipc.plugins.enabled.x86_64", true);
 pref("dom.ipc.plugins.enabled", true);
 #endif
 
+#if defined(NIGHTLY_BUILD) && defined(XP_MACOSX)
+// In Nightly, browser.tabs.remote is enabled on platforms that
+// support OMTC. However, users won't actually get remote tabs unless
+// they enable browser.tabs.remote.autostart or they use the "New OOP
+// Window" menu option.
+pref("browser.tabs.remote", true);
+#else
 pref("browser.tabs.remote", false);
+#endif
+pref("browser.tabs.remote.autostart", false);
 
 // This pref governs whether we attempt to work around problems caused by
 // plugins using OS calls to manipulate the cursor while running out-of-
diff --git a/browser/base/content/browser-menubar.inc b/browser/base/content/browser-menubar.inc
index 72518385787c..80522d0efe2d 100644
--- a/browser/base/content/browser-menubar.inc
+++ b/browser/base/content/browser-menubar.inc
@@ -27,6 +27,14 @@
                           accesskey="&newPrivateWindow.accesskey;"
                           command="Tools:PrivateBrowsing"
                           key="key_privatebrowsing"/>
+                <menuitem id="menu_newRemoteWindow"
+                          label="New OOP Window"
+                          hidden="true"
+                          command="Tools:RemoteWindow"/>
+                <menuitem id="menu_newNonRemoteWindow"
+                          label="New In-process Window"
+                          hidden="true"
+                          command="Tools:NonRemoteWindow"/>
                 <menuitem id="menu_openFile"
                           label="&openFileCmd.label;"
                           command="Browser:OpenFile"
diff --git a/browser/base/content/browser-sets.inc b/browser/base/content/browser-sets.inc
index 4793a8b939f5..68607ce9d288 100644
--- a/browser/base/content/browser-sets.inc
+++ b/browser/base/content/browser-sets.inc
@@ -20,7 +20,7 @@
     <command id="cmd_handleBackspace" oncommand="BrowserHandleBackspace();" />
     <command id="cmd_handleShiftBackspace" oncommand="BrowserHandleShiftBackspace();" />
 
-    <command id="cmd_newNavigatorTab" oncommand="BrowserOpenTab();"/>
+    <command id="cmd_newNavigatorTab" oncommand="BrowserOpenNewTabOrWindow(event);"/>
     <command id="Browser:OpenFile"  oncommand="BrowserOpenFileWindow();"/>
     <command id="Browser:SavePage" oncommand="saveDocument(window.content.document);"/>
 
@@ -106,6 +106,10 @@
      oncommand="Cc['@mozilla.org/browser/browserglue;1'].getService(Ci.nsIBrowserGlue).sanitize(window);"/>
     <command id="Tools:PrivateBrowsing"
       oncommand="OpenBrowserWindow({private: true});"/>
+    <command id="Tools:RemoteWindow"
+      oncommand="OpenBrowserWindow({remote: true});"/>
+    <command id="Tools:NonRemoteWindow"
+      oncommand="OpenBrowserWindow({remote: false});"/>
     <command id="History:UndoCloseTab" oncommand="undoCloseTab();"/>
     <command id="History:UndoCloseWindow" oncommand="undoCloseWindow();"/>
     <command id="Social:SharePage" oncommand="SocialShare.sharePage();" disabled="true"/>
diff --git a/browser/base/content/browser-tabPreviews.js b/browser/base/content/browser-tabPreviews.js
index 9a4268ed721f..eb2611b84100 100644
--- a/browser/base/content/browser-tabPreviews.js
+++ b/browser/base/content/browser-tabPreviews.js
@@ -202,14 +202,9 @@ var ctrlTab = {
     list = list.filter(function (tab) !tab.closing);
 
     if (this.recentlyUsedLimit != 0) {
-      let recentlyUsedTabs = [];
-      for (let tab of this._recentlyUsedTabs) {
-        if (!tab.hidden && !tab.closing) {
-          recentlyUsedTabs.push(tab);
-          if (this.recentlyUsedLimit > 0 && recentlyUsedTabs.length >= this.recentlyUsedLimit)
-            break;
-        }
-      }
+      let recentlyUsedTabs = this._recentlyUsedTabs;
+      if (this.recentlyUsedLimit > 0)
+        recentlyUsedTabs = this._recentlyUsedTabs.slice(0, this.recentlyUsedLimit);
       for (let i = recentlyUsedTabs.length - 1; i >= 0; i--) {
         list.splice(list.indexOf(recentlyUsedTabs[i]), 1);
         list.unshift(recentlyUsedTabs[i]);
diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index f5f558091b00..2fd3a0ff94c1 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -757,7 +757,11 @@ var gBrowserInit = {
   delayedStartupFinished: false,
 
   onLoad: function() {
-    gMultiProcessBrowser = Services.appinfo.browserTabsRemote;
+    gMultiProcessBrowser =
+      window.QueryInterface(Ci.nsIInterfaceRequestor)
+      .getInterface(Ci.nsIWebNavigation)
+      .QueryInterface(Ci.nsILoadContext)
+      .useRemoteTabs;
 
     var mustLoadSidebar = false;
 
@@ -1023,6 +1027,7 @@ var gBrowserInit = {
     IndexedDBPromptHelper.init();
     gFormSubmitObserver.init();
     SocialUI.init();
+    gRemoteTabsUI.init();
 
     // Initialize the full zoom setting.
     // We do this before the session restore service gets initialized so we can
@@ -3186,6 +3191,12 @@ function OpenBrowserWindow(options)
     extraFeatures = ",non-private";
   }
 
+  if (options && options.remote) {
+    extraFeatures += ",remote";
+  } else if (options && options.remote === false) {
+    extraFeatures += ",non-remote";
+  }
+
   // if and only if the current window is a browser window and it has a document with a character
   // set, then extract the current charset menu setting from the current document and use it to
   // initialize the new browser window...
@@ -6866,6 +6877,28 @@ let gPrivateBrowsingUI = {
   }
 };
 
+let gRemoteTabsUI = {
+  init: function() {
+    if (window.location.href != getBrowserURL()) {
+      return;
+    }
+
+    let remoteTabs = gPrefService.getBoolPref("browser.tabs.remote");
+    let autostart = gPrefService.getBoolPref("browser.tabs.remote.autostart");
+
+    let newRemoteWindow = document.getElementById("menu_newRemoteWindow");
+    let newNonRemoteWindow = document.getElementById("menu_newNonRemoteWindow");
+
+    if (!remoteTabs) {
+      newRemoteWindow.hidden = true;
+      newNonRemoteWindow.hidden = true;
+      return;
+    }
+
+    newRemoteWindow.hidden = autostart;
+    newNonRemoteWindow.hidden = !autostart;
+  }
+};
 
 /**
  * Switch to a tab that has a given URI, and focusses its browser window.
@@ -7203,3 +7236,11 @@ let BrowserChromeTest = {
       this._cb = cb;
   }
 };
+
+function BrowserOpenNewTabOrWindow(event) {
+  if (event.shiftKey) {
+    OpenBrowserWindow();
+  } else {
+    BrowserOpenTab();
+  }
+}
diff --git a/browser/base/content/content.js b/browser/base/content/content.js
index 9f05daa3034d..37483a2d2fd4 100644
--- a/browser/base/content/content.js
+++ b/browser/base/content/content.js
@@ -35,7 +35,7 @@ addMessageListener("Browser:HideSessionRestoreButton", function (message) {
   }
 });
 
-if (Services.prefs.getBoolPref("browser.tabs.remote")) {
+if (Services.appinfo.processType == Services.appinfo.PROCESS_TYPE_CONTENT) {
   addEventListener("contextmenu", function (event) {
     sendAsyncMessage("contextmenu", {}, { event: event });
   }, false);
diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 4874ca7f4d93..8f2c28a324b2 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -3054,7 +3054,11 @@
               "-moz-default-background-color" :
               Services.prefs.getCharPref("browser.display.background_color");
 
-          if (Services.appinfo.browserTabsRemote) {
+          let remote = window.QueryInterface(Ci.nsIInterfaceRequestor)
+            .getInterface(Ci.nsIWebNavigation)
+            .QueryInterface(Ci.nsILoadContext)
+            .useRemoteTabs;
+          if (remote) {
             messageManager.addMessageListener("DOMTitleChanged", this);
             messageManager.addMessageListener("contextmenu", this);
           }
@@ -3121,7 +3125,7 @@
           document.removeEventListener("keypress", this, false);
           window.removeEventListener("sizemodechange", this, false);
 
-          if (Services.appinfo.browserTabsRemote) {
+          if (gMultiProcessBrowser) {
             messageManager.removeMessageListener("DOMTitleChanged", this);
             messageManager.removeMessageListener("contextmenu", this);
           }
diff --git a/browser/base/content/test/general/browser_pluginnotification.js b/browser/base/content/test/general/browser_pluginnotification.js
index 593b6de8b2c1..82da6a3068e5 100644
--- a/browser/base/content/test/general/browser_pluginnotification.js
+++ b/browser/base/content/test/general/browser_pluginnotification.js
@@ -729,21 +729,23 @@ function test22() {
   is(objLoadingContent.displayedType, Ci.nsIObjectLoadingContent.TYPE_PLUGIN, "Test 22, plugin should have started");
   ok(pluginNode.activated, "Test 22, plugin should be activated");
 
-  // Reload plugin
-  var oldVal = pluginNode.getObjectValue();
-  pluginNode.src = pluginNode.src;
-  is(objLoadingContent.displayedType, Ci.nsIObjectLoadingContent.TYPE_PLUGIN, "Test 22, Plugin should have retained activated state");
-  ok(pluginNode.activated, "Test 22, plugin should have remained activated");
-  // Sanity, ensure that we actually reloaded the instance, since this behavior might change in the future.
-  var pluginsDiffer;
-  try {
-    pluginNode.checkObjectValue(oldVal);
-  } catch (e) {
-    pluginsDiffer = true;
-  }
-  ok(pluginsDiffer, "Test 22, plugin should have reloaded");
+  // Spin event loop for plugin to finish spawning
+  executeSoon(function() {
+    var oldVal = pluginNode.getObjectValue();
+    pluginNode.src = pluginNode.src;
+    is(objLoadingContent.displayedType, Ci.nsIObjectLoadingContent.TYPE_PLUGIN, "Test 22, Plugin should have retained activated state");
+    ok(pluginNode.activated, "Test 22, plugin should have remained activated");
+    // Sanity, ensure that we actually reloaded the instance, since this behavior might change in the future.
+    var pluginsDiffer;
+    try {
+      pluginNode.checkObjectValue(oldVal);
+    } catch (e) {
+      pluginsDiffer = true;
+    }
+    ok(pluginsDiffer, "Test 22, plugin should have reloaded");
 
-  prepareTest(runAfterPluginBindingAttached(test23), gTestRoot + "plugin_test.html");
+    prepareTest(runAfterPluginBindingAttached(test23), gTestRoot + "plugin_test.html");
+  });
 }
 
 // Tests that a click-to-play plugin resets its activated state when changing types
diff --git a/browser/components/customizableui/content/panelUI.inc.xul b/browser/components/customizableui/content/panelUI.inc.xul
index 5bfec9b569e2..d7b6622896e5 100644
--- a/browser/components/customizableui/content/panelUI.inc.xul
+++ b/browser/components/customizableui/content/panelUI.inc.xul
@@ -120,7 +120,6 @@
                        oncommand="PlacesCommandHook.showPlacesOrganizer('UnfiledBookmarks'); PanelUI.hide();"/>
         <toolbarseparator/>
         <toolbaritem id="panelMenu_bookmarksMenu"
-                     flex="1"
                      orient="vertical"
                      smoothscroll="false"
                      onclick="if (event.button == 1) BookmarkingUI.onPanelMenuViewCommand(event, this._placesView);"
@@ -145,7 +144,7 @@
 
     <panelview id="PanelUI-helpView" flex="1" class="PanelUI-subView">
       <label value="&helpMenu.label;" class="panel-subview-header"/>
-      <vbox id="PanelUI-helpItems"/>
+      <vbox id="PanelUI-helpItems" class="panel-subview-body"/>
     </panelview>
 
     <panelview id="PanelUI-developer" flex="1">
diff --git a/browser/components/customizableui/content/panelUI.js b/browser/components/customizableui/content/panelUI.js
index 0f4d491e3b59..f797f47bcceb 100644
--- a/browser/components/customizableui/content/panelUI.js
+++ b/browser/components/customizableui/content/panelUI.js
@@ -303,6 +303,7 @@ const PanelUI = {
 
       let multiView = document.createElement("panelmultiview");
       tempPanel.appendChild(multiView);
+      multiView.setAttribute("mainViewIsSubView", "true");
       multiView.setMainView(viewNode);
       viewNode.classList.add("cui-widget-panelview");
       CustomizableUI.addPanelCloseListeners(tempPanel);
diff --git a/browser/components/customizableui/content/panelUI.xml b/browser/components/customizableui/content/panelUI.xml
index 63eb103049d2..ff5a1346dd64 100644
--- a/browser/components/customizableui/content/panelUI.xml
+++ b/browser/components/customizableui/content/panelUI.xml
@@ -66,6 +66,8 @@
       <property name="_mainViewId" onget="return this.getAttribute('mainViewId');" onset="this.setAttribute('mainViewId', val); return val;"/>
       <property name="_mainView" readonly="true"
                 onget="return this._mainViewId ? document.getElementById(this._mainViewId) : null;"/>
+      <property name="showingSubViewAsMainView" readonly="true"
+                onget="return this.getAttribute('mainViewIsSubView') == 'true'"/>
 
       <property name="ignoreMutations">
         <getter>
@@ -322,8 +324,13 @@
       <method name="_syncContainerWithMainView">
         <body><![CDATA[
           if (!this.ignoreMutations && !this.showingSubView && !this._transitioning) {
-            this._viewContainer.style.height =
-              this._mainView.scrollHeight + "px";
+            let height;
+            if (this.showingSubViewAsMainView) {
+              height = this._heightOfSubview(this._mainView);
+            } else {
+              height = this._mainView.scrollHeight;
+            }
+            this._viewContainer.style.height = height + "px";
           }
         ]]></body>
       </method>
diff --git a/browser/components/customizableui/src/CustomizableUI.jsm b/browser/components/customizableui/src/CustomizableUI.jsm
index 18f5a302c0c5..6e232cf7a5b5 100644
--- a/browser/components/customizableui/src/CustomizableUI.jsm
+++ b/browser/components/customizableui/src/CustomizableUI.jsm
@@ -3139,7 +3139,7 @@ function WidgetSingleWrapper(aWidget, aNode) {
   this.__defineGetter__("anchor", function() {
     let anchorId;
     // First check for an anchor for the area:
-    let placement = CustomizableUIInternal.getPlacementOfWidget(aWidgetId);
+    let placement = CustomizableUIInternal.getPlacementOfWidget(aWidget.id);
     if (placement) {
       anchorId = gAreas.get(placement.area).get("anchor");
     }
diff --git a/browser/components/customizableui/src/CustomizeMode.jsm b/browser/components/customizableui/src/CustomizeMode.jsm
index 7cc6e918160e..9f39e2896113 100644
--- a/browser/components/customizableui/src/CustomizeMode.jsm
+++ b/browser/components/customizableui/src/CustomizeMode.jsm
@@ -854,6 +854,7 @@ CustomizeMode.prototype = {
       this.persistCurrentSets(true);
 
       this._updateResetButton();
+      this._updateEmptyPaletteNotice();
       this._showPanelCustomizationPlaceholders();
       this.resetting = false;
     }.bind(this)).then(null, ERROR);
@@ -955,8 +956,10 @@ CustomizeMode.prototype = {
 
   _onUIChange: function() {
     this._changed = true;
-    this._updateResetButton();
-    this._updateEmptyPaletteNotice();
+    if (!this.resetting) {
+      this._updateResetButton();
+      this._updateEmptyPaletteNotice();
+    }
     this.dispatchToolboxEvent("customizationchange");
   },
 
diff --git a/browser/config/mozconfigs/hazards b/browser/config/mozconfigs/hazards
new file mode 100644
index 000000000000..cf8bb4352f33
--- /dev/null
+++ b/browser/config/mozconfigs/hazards
@@ -0,0 +1,18 @@
+# This mozconfig is used when compiling the browser for the SM(Hf) rooting
+# hazard analysis build, see
+# https://wiki.mozilla.org/Javascript:SpiderMonkey:ExactStackRooting
+
+. "$topsrcdir/build/unix/mozconfig.linux"
+
+# The configuration options are chosen to compile the most code
+# (--enable-debug, --enable-tests) in the trickiest way possible
+# (--enable-optimize) to maximize the chance of seeing tricky static orderings.
+ac_add_options --enable-debug
+ac_add_options --enable-tests
+ac_add_options --enable-optimize
+
+CFLAGS="$CFLAGS -Wno-attributes"
+CPPFLAGS="$CPPFLAGS -Wno-attributes"
+CXXFLAGS="$CXXFLAGS -Wno-attributes"
+
+. "$topsrcdir/build/mozconfig.common.override"
diff --git a/browser/devtools/debugger/debugger-controller.js b/browser/devtools/debugger/debugger-controller.js
index b606a4fc56bc..a31ba04cc34d 100644
--- a/browser/devtools/debugger/debugger-controller.js
+++ b/browser/devtools/debugger/debugger-controller.js
@@ -29,6 +29,9 @@ const EVENTS = {
   SOURCE_SHOWN: "Debugger:EditorSourceShown",
   SOURCE_ERROR_SHOWN: "Debugger:EditorSourceErrorShown",
 
+  // When the editor has shown a source and set the line / column position
+  EDITOR_LOCATION_SET: "Debugger:EditorLocationSet",
+
   // When scopes, variables, properties and watch expressions are fetched and
   // displayed in the variables view.
   FETCHED_SCOPES: "Debugger:FetchedScopes",
@@ -1300,7 +1303,7 @@ SourceScripts.prototype = {
     deferred.promise.pretty = wantPretty;
     this._cache.set(aSource.url, deferred.promise);
 
-    const afterToggle = ({ error, message, source: text }) => {
+    const afterToggle = ({ error, message, source: text, contentType }) => {
       if (error) {
         // Revert the rejected promise from the cache, so that the original
         // source's text may be shown when the source is selected.
@@ -1308,7 +1311,7 @@ SourceScripts.prototype = {
         deferred.reject([aSource, message || error]);
         return;
       }
-      deferred.resolve([aSource, text]);
+      deferred.resolve([aSource, text, contentType]);
     };
 
     if (wantPretty) {
@@ -1360,14 +1363,15 @@ SourceScripts.prototype = {
     }
 
     // Get the source text from the active thread.
-    this.activeThread.source(aSource).source(({ error, message, source: text }) => {
+    this.activeThread.source(aSource)
+        .source(({ error, message, source: text, contentType }) => {
       if (aOnTimeout) {
         window.clearTimeout(fetchTimeout);
       }
       if (error) {
         deferred.reject([aSource, message || error]);
       } else {
-        deferred.resolve([aSource, text]);
+        deferred.resolve([aSource, text, contentType]);
       }
     });
 
@@ -1406,13 +1410,13 @@ SourceScripts.prototype = {
     }
 
     /* Called if fetching a source finishes successfully. */
-    function onFetch([aSource, aText]) {
+    function onFetch([aSource, aText, aContentType]) {
       // If fetching the source has previously timed out, discard it this time.
       if (!pending.has(aSource.url)) {
         return;
       }
       pending.delete(aSource.url);
-      fetched.push([aSource.url, aText]);
+      fetched.push([aSource.url, aText, aContentType]);
       maybeFinish();
     }
 
diff --git a/browser/devtools/debugger/debugger-view.js b/browser/devtools/debugger/debugger-view.js
index d2b978ae3de6..dc0987be27ef 100644
--- a/browser/devtools/debugger/debugger-view.js
+++ b/browser/devtools/debugger/debugger-view.js
@@ -388,7 +388,8 @@ let DebuggerView = {
     this._setEditorText(L10N.getStr("loadingText"));
     this._editorSource = { url: aSource.url, promise: deferred.promise };
 
-    DebuggerController.SourceScripts.getText(aSource).then(([, aText]) => {
+    DebuggerController.SourceScripts.getText(aSource)
+                                    .then(([, aText, aContentType]) => {
       // Avoid setting an unexpected source. This may happen when switching
       // very fast between sources that haven't been fetched yet.
       if (this._editorSource.url != aSource.url) {
@@ -396,7 +397,7 @@ let DebuggerView = {
       }
 
       this._setEditorText(aText);
-      this._setEditorMode(aSource.url, aSource.contentType, aText);
+      this._setEditorMode(aSource.url, aContentType, aText);
 
       // Synchronize any other components with the currently displayed source.
       DebuggerView.Sources.selectedValue = aSource.url;
@@ -406,7 +407,7 @@ let DebuggerView = {
 
       // Resolve and notify that a source file was shown.
       window.emit(EVENTS.SOURCE_SHOWN, aSource);
-      deferred.resolve([aSource, aText]);
+      deferred.resolve([aSource, aText, aContentType]);
     },
     ([, aError]) => {
       let msg = L10N.getStr("errorLoadingText") + DevToolsUtils.safeErrorString(aError);
@@ -466,10 +467,14 @@ let DebuggerView = {
 
     // Make sure the requested source client is shown in the editor, then
     // update the source editor's caret position and debug location.
-    return this._setEditorSource(sourceForm, aFlags).then(() => {
+    return this._setEditorSource(sourceForm, aFlags)
+               .then(([,, aContentType]) => {
+      // Record the contentType learned from fetching
+      sourceForm.contentType = aContentType;
       // Line numbers in the source editor should start from 1. If invalid
       // or not specified, then don't do anything.
       if (aLine < 1) {
+        window.emit(EVENTS.EDITOR_LOCATION_SET);
         return;
       }
       if (aFlags.charOffset) {
@@ -485,6 +490,7 @@ let DebuggerView = {
       if (!aFlags.noDebug) {
         this.editor.setDebugLocation(aLine - 1);
       }
+      window.emit(EVENTS.EDITOR_LOCATION_SET);
     }).then(null, console.error);
   },
 
diff --git a/browser/devtools/debugger/test/browser.ini b/browser/devtools/debugger/test/browser.ini
index 769807c3e5f9..37f62cec9cdb 100644
--- a/browser/devtools/debugger/test/browser.ini
+++ b/browser/devtools/debugger/test/browser.ini
@@ -28,6 +28,8 @@ support-files =
   code_ugly-5.js
   code_ugly-6.js
   code_ugly-7.js
+  code_ugly-8
+  code_ugly-8^headers^
   doc_auto-pretty-print-01.html
   doc_auto-pretty-print-02.html
   doc_binary_search.html
@@ -56,6 +58,7 @@ support-files =
   doc_pause-exceptions.html
   doc_pretty-print.html
   doc_pretty-print-2.html
+  doc_pretty-print-3.html
   doc_random-javascript.html
   doc_recursion-stack.html
   doc_scope-variable.html
@@ -161,6 +164,7 @@ support-files =
 [browser_dbg_pretty-print-10.js]
 [browser_dbg_pretty-print-11.js]
 [browser_dbg_pretty-print-12.js]
+[browser_dbg_pretty-print-13.js]
 [browser_dbg_progress-listener-bug.js]
 [browser_dbg_reload-preferred-script-01.js]
 [browser_dbg_reload-preferred-script-02.js]
diff --git a/browser/devtools/debugger/test/browser_dbg_pretty-print-13.js b/browser/devtools/debugger/test/browser_dbg_pretty-print-13.js
new file mode 100644
index 000000000000..e6bec34bda1b
--- /dev/null
+++ b/browser/devtools/debugger/test/browser_dbg_pretty-print-13.js
@@ -0,0 +1,87 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/**
+ * Make sure that clicking the pretty print button prettifies the source, even
+ * when the source URL does not end in ".js", but the content type is
+ * JavaScript.
+ */
+
+const TAB_URL = EXAMPLE_URL + "doc_pretty-print-3.html";
+
+let gTab, gDebuggee, gPanel, gDebugger;
+let gEditor, gSources;
+
+function test() {
+  initDebugger(TAB_URL).then(([aTab, aDebuggee, aPanel]) => {
+    gTab = aTab;
+    gDebuggee = aDebuggee;
+    gPanel = aPanel;
+    gDebugger = gPanel.panelWin;
+    gEditor = gDebugger.DebuggerView.editor;
+    gSources = gDebugger.DebuggerView.Sources;
+
+    promise.all([waitForSourceShown(gPanel, "code_ugly-8"),
+                 waitForEditorLocationSet(gPanel)])
+      .then(testSourceIsUgly)
+      .then(() => {
+        const finished = waitForSourceShown(gPanel, "code_ugly-8");
+        clickPrettyPrintButton();
+        testProgressBarShown();
+        return finished;
+      })
+      .then(testSourceIsPretty)
+      .then(testEditorShown)
+      .then(testSourceIsStillPretty)
+      .then(() => closeDebuggerAndFinish(gPanel))
+      .then(null, aError => {
+        ok(false, "Got an error: " + DevToolsUtils.safeErrorString(aError));
+      });
+  });
+}
+
+function testSourceIsUgly() {
+  ok(!gEditor.getText().contains("\n    "),
+     "The source shouldn't be pretty printed yet.");
+}
+
+function clickPrettyPrintButton() {
+  gDebugger.document.getElementById("pretty-print").click();
+}
+
+function testProgressBarShown() {
+  const deck = gDebugger.document.getElementById("editor-deck");
+  is(deck.selectedIndex, 2, "The progress bar should be shown");
+}
+
+function testSourceIsPretty() {
+  ok(gEditor.getText().contains("\n    "),
+     "The source should be pretty printed.")
+}
+
+function testEditorShown() {
+  const deck = gDebugger.document.getElementById("editor-deck");
+  is(deck.selectedIndex, 0, "The editor should be shown");
+}
+
+function testSourceIsStillPretty() {
+  const deferred = promise.defer();
+
+  const { source } = gSources.selectedItem.attachment;
+  gDebugger.DebuggerController.SourceScripts.getText(source).then(([, text]) => {
+    ok(text.contains("\n    "),
+       "Subsequent calls to getText return the pretty printed source.");
+    deferred.resolve();
+  });
+
+  return deferred.promise;
+}
+
+registerCleanupFunction(function() {
+  gTab = null;
+  gDebuggee = null;
+  gPanel = null;
+  gDebugger = null;
+  gEditor = null;
+  gSources = null;
+});
diff --git a/browser/devtools/debugger/test/code_ugly-8 b/browser/devtools/debugger/test/code_ugly-8
new file mode 100644
index 000000000000..dc0d185005d3
--- /dev/null
+++ b/browser/devtools/debugger/test/code_ugly-8
@@ -0,0 +1,3 @@
+function foo() { var a=1; var b=2; bar(a, b); }
+function bar(c, d) { debugger; }
+foo();
diff --git a/browser/devtools/debugger/test/code_ugly-8^headers^ b/browser/devtools/debugger/test/code_ugly-8^headers^
new file mode 100644
index 000000000000..a17a9a3a12ce
--- /dev/null
+++ b/browser/devtools/debugger/test/code_ugly-8^headers^
@@ -0,0 +1 @@
+Content-Type: application/javascript
diff --git a/browser/devtools/debugger/test/doc_pretty-print-3.html b/browser/devtools/debugger/test/doc_pretty-print-3.html
new file mode 100644
index 000000000000..6192642f3c77
--- /dev/null
+++ b/browser/devtools/debugger/test/doc_pretty-print-3.html
@@ -0,0 +1,8 @@
+<!-- Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/ -->
+<!DOCTYPE html>
+<head>
+  <meta charset="utf-8"/>
+  <title>Debugger Pretty Printing Test Page</title>
+</head>
+<script src="code_ugly-8"></script>
diff --git a/browser/devtools/debugger/test/head.js b/browser/devtools/debugger/test/head.js
index b6bf30db60ff..bf0ed6d1c099 100644
--- a/browser/devtools/debugger/test/head.js
+++ b/browser/devtools/debugger/test/head.js
@@ -236,6 +236,11 @@ function waitForSourceShown(aPanel, aUrl) {
   });
 }
 
+function waitForEditorLocationSet(aPanel) {
+  return waitForDebuggerEvents(aPanel,
+                               aPanel.panelWin.EVENTS.EDITOR_LOCATION_SET);
+}
+
 function ensureSourceIs(aPanel, aUrl, aWaitFlag = false) {
   if (aPanel.panelWin.DebuggerView.Sources.selectedValue.contains(aUrl)) {
     ok(true, "Expected source is shown: " + aUrl);
diff --git a/browser/devtools/styleeditor/StyleEditorUI.jsm b/browser/devtools/styleeditor/StyleEditorUI.jsm
index e8477b23f43e..73a2a588b439 100644
--- a/browser/devtools/styleeditor/StyleEditorUI.jsm
+++ b/browser/devtools/styleeditor/StyleEditorUI.jsm
@@ -205,7 +205,8 @@ StyleEditorUI.prototype = {
     // remember saved file locations
     for (let editor of this.editors) {
       if (editor.savedFile) {
-        this.savedLocations[editor.styleSheet.href] = editor.savedFile;
+        let identifier = this.getStyleSheetIdentifier(editor.styleSheet);
+        this.savedLocations[identifier] = editor.savedFile;
       }
     }
 
@@ -257,7 +258,8 @@ StyleEditorUI.prototype = {
    */
   _addStyleSheetEditor: function(styleSheet, file, isNew) {
     // recall location of saved file for this sheet after page reload
-    let savedFile = this.savedLocations[styleSheet.href];
+    let identifier = this.getStyleSheetIdentifier(styleSheet);
+    let savedFile = this.savedLocations[identifier];
     if (savedFile && !file) {
       file = savedFile;
     }
@@ -526,6 +528,18 @@ StyleEditorUI.prototype = {
     return deferred.promise;
   },
 
+  /**
+   * Returns an identifier for the given style sheet.
+   *
+   * @param {StyleSheet} aStyleSheet
+   *        The style sheet to be identified.
+   */
+  getStyleSheetIdentifier: function (aStyleSheet) {
+    // Identify inline style sheets by their host page URI and index at the page.
+    return aStyleSheet.href ? aStyleSheet.href :
+            "inline-" + aStyleSheet.styleSheetIndex + "-at-" + aStyleSheet.nodeHref;
+  },
+
   /**
    * selects a stylesheet and optionally moves the cursor to a selected line
    *
diff --git a/browser/devtools/styleeditor/test/browser.ini b/browser/devtools/styleeditor/test/browser.ini
index 39b995b9f8ea..248028c5d2c2 100644
--- a/browser/devtools/styleeditor/test/browser.ini
+++ b/browser/devtools/styleeditor/test/browser.ini
@@ -7,6 +7,8 @@ support-files =
   import.css
   import.html
   import2.css
+  inline-1.html
+  inline-2.html
   longload.html
   media-small.css
   media.html
@@ -37,6 +39,7 @@ support-files =
 [browser_styleeditor_import.js]
 [browser_styleeditor_import_rule.js]
 [browser_styleeditor_init.js]
+[browser_styleeditor_inline_friendly_names.js]
 [browser_styleeditor_loading.js]
 [browser_styleeditor_new.js]
 [browser_styleeditor_nostyle.js]
diff --git a/browser/devtools/styleeditor/test/browser_styleeditor_inline_friendly_names.js b/browser/devtools/styleeditor/test/browser_styleeditor_inline_friendly_names.js
new file mode 100644
index 000000000000..d859a69c35ed
--- /dev/null
+++ b/browser/devtools/styleeditor/test/browser_styleeditor_inline_friendly_names.js
@@ -0,0 +1,150 @@
+/* vim: set ts=2 et sw=2 tw=80: */
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+let gUI;
+
+const FIRST_TEST_PAGE = TEST_BASE + "inline-1.html"
+const SECOND_TEST_PAGE = TEST_BASE + "inline-2.html"
+const SAVE_PATH = "test.css";
+
+function test()
+{
+  waitForExplicitFinish();
+
+  addTabAndOpenStyleEditor(function(panel) {
+    gUI = panel.UI;
+
+    // First test that identifiers are correcly generated. If not other tests
+    // are likely to fail.
+    testIndentifierGeneration();
+
+    waitForEditors(2)
+    .then(saveFirstInlineStyleSheet)
+    .then(testFriendlyNamesAfterSave)
+    .then(reloadPage)
+    .then(testFriendlyNamesAfterSave)
+    .then(navigateToAnotherPage)
+    .then(testFriendlyNamesAfterNavigation)
+    .then(finishTests);
+  });
+
+  content.location = FIRST_TEST_PAGE;
+}
+
+function testIndentifierGeneration() {
+  let fakeStyleSheetFile = {
+    "href": "http://example.com/test.css",
+    "nodeHref": "http://example.com/",
+    "styleSheetIndex": 1
+  }
+
+  let fakeInlineStyleSheet = {
+    "href": null,
+    "nodeHref": "http://example.com/",
+    "styleSheetIndex": 2
+  }
+
+  is(gUI.getStyleSheetIdentifier(fakeStyleSheetFile), "http://example.com/test.css",
+    "URI is the identifier of style sheet file.");
+
+  is(gUI.getStyleSheetIdentifier(fakeInlineStyleSheet), "inline-2-at-http://example.com/",
+    "Inline style sheets are identified by their page and position at that page.");
+}
+
+function saveFirstInlineStyleSheet() {
+  let deferred = promise.defer();
+  let editor = gUI.editors[0];
+
+  let destFile = FileUtils.getFile("ProfD", [SAVE_PATH]);
+
+  editor.saveToFile(destFile, function (file) {
+    ok(file, "File was correctly saved.");
+    deferred.resolve();
+  });
+
+  return deferred.promise;
+}
+
+function testFriendlyNamesAfterSave() {
+  let firstEditor = gUI.editors[0];
+  let secondEditor = gUI.editors[1];
+
+  // The friendly name of first sheet should've been remembered, the second should
+  // not be the same (bug 969900).
+  is(firstEditor.friendlyName, SAVE_PATH,
+    "Friendly name is correct for the saved inline style sheet.");
+  isnot(secondEditor.friendlyName, SAVE_PATH,
+    "Friendly name is for the second inline style sheet is not the same as first.");
+
+  return promise.resolve(null);
+}
+
+function reloadPage() {
+  info("Reloading page.");
+  content.location.reload();
+  return waitForEditors(2);
+}
+
+function navigateToAnotherPage() {
+  info("Navigating to another page.");
+  let deferred = promise.defer();
+  gBrowser.removeCurrentTab();
+
+  gUI = null;
+
+  addTabAndOpenStyleEditor(function(panel) {
+    gUI = panel.UI;
+
+    waitForEditors(2).then(deferred.resolve);
+  });
+
+  content.location = SECOND_TEST_PAGE;
+  return deferred.promise;
+}
+
+function testFriendlyNamesAfterNavigation() {
+  let firstEditor = gUI.editors[0];
+  let secondEditor = gUI.editors[1];
+
+  // Inline style sheets shouldn't have the name of previously saved file as the
+  // page is different.
+  isnot(firstEditor.friendlyName, SAVE_PATH,
+    "The first editor doesn't have the save path as a friendly name.");
+  isnot(secondEditor.friendlyName, SAVE_PATH,
+    "The second editor doesn't have the save path as a friendly name.");
+
+  return promise.resolve(null);
+}
+
+function finishTests() {
+  gUI = null;
+  finish();
+}
+
+/**
+ * Waits for all editors to be added.
+ *
+ * @param {int} aNumberOfEditors
+ *        The number of editors to wait until proceeding.
+ *
+ * Returns a promise that's resolved once all editors are added.
+ */
+function waitForEditors(aNumberOfEditors) {
+  let deferred = promise.defer();
+  let count = 0;
+
+  info("Waiting for " + aNumberOfEditors + " editors to be added");
+  gUI.on("editor-added", function editorAdded(event, editor) {
+    if (++count == aNumberOfEditors) {
+        info("All editors added. Resolving promise.");
+        gUI.off("editor-added", editorAdded);
+        gUI.editors[0].getSourceEditor().then(deferred.resolve);
+    }
+    else {
+        info ("Editor " + count + " of " + aNumberOfEditors + " added.");
+    }
+  });
+
+  return deferred.promise;
+}
diff --git a/browser/devtools/styleeditor/test/inline-1.html b/browser/devtools/styleeditor/test/inline-1.html
new file mode 100644
index 000000000000..76478893b2d9
--- /dev/null
+++ b/browser/devtools/styleeditor/test/inline-1.html
@@ -0,0 +1,19 @@
+<!doctype html>
+<html>
+ <head>
+  <title>Inline test page #1</title>
+  <style type="text/css">
+    .second {
+     font-size:2em;
+    }
+  </style>
+  <style type="text/css">
+    .first {
+     font-size:3em;
+    }
+  </style>
+ </head>
+ <body class="first">
+   Inline test page #1
+ </body>
+</html>
diff --git a/browser/devtools/styleeditor/test/inline-2.html b/browser/devtools/styleeditor/test/inline-2.html
new file mode 100644
index 000000000000..e25285c31e55
--- /dev/null
+++ b/browser/devtools/styleeditor/test/inline-2.html
@@ -0,0 +1,19 @@
+<!doctype html>
+<html>
+ <head>
+  <title>Inline test page #2</title>
+  <style type="text/css">
+    .second {
+     font-size:2em;
+    }
+  </style>
+  <style type="text/css">
+    .first {
+     font-size:3em;
+    }
+  </style>
+ </head>
+ <body class="second">
+   Inline test page #2
+ </body>
+</html>
diff --git a/browser/devtools/webconsole/test/browser_webconsole_bug_601352_scroll.js b/browser/devtools/webconsole/test/browser_webconsole_bug_601352_scroll.js
index 444d3b9a6b2f..3e3d8461879f 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_bug_601352_scroll.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_bug_601352_scroll.js
@@ -1,59 +1,71 @@
-/* vim:set ts=2 sw=2 sts=2 et: */
-/* ***** BEGIN LICENSE BLOCK *****
- * Any copyright is dedicated to the Public Domain.
- * http://creativecommons.org/publicdomain/zero/1.0/
- *
- * Contributor(s):
- *  Mihai Șucan <mihai.sucan@gmail.com>
- *
- * ***** END LICENSE BLOCK ***** */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-function consoleOpened(HUD) {
-  HUD.jsterm.clearOutput();
+// Test that the console output scrolls to JS eval results when there are many
+// messages displayed. See bug 601352.
 
-  let longMessage = "";
-  for (let i = 0; i < 50; i++) {
-    longMessage += "LongNonwrappingMessage";
-  }
+function test() {
+  Task.spawn(runner).then(finishTest);
 
-  for (let i = 0; i < 50; i++) {
-    content.console.log("test message " + i);
-  }
+  function* runner() {
+    let {tab} = yield loadTab("data:text/html;charset=utf-8,Web Console test for bug 601352");
+    let hud = yield openConsole(tab);
+    hud.jsterm.clearOutput();
 
-  content.console.log(longMessage);
+    let longMessage = "";
+    for (let i = 0; i < 50; i++) {
+      longMessage += "LongNonwrappingMessage";
+    }
 
-  for (let i = 0; i < 50; i++) {
-    content.console.log("test message " + i);
-  }
+    for (let i = 0; i < 50; i++) {
+      content.console.log("test1 message " + i);
+    }
 
-  HUD.jsterm.execute("1+1", performTest);
+    content.console.log(longMessage);
 
-  function performTest(node) {
-    let scrollNode = HUD.outputNode.parentNode;
+    for (let i = 0; i < 50; i++) {
+      content.console.log("test2 message " + i);
+    }
+
+    yield waitForMessages({
+      webconsole: hud,
+      messages: [{
+        text: "test1 message 0",
+      }, {
+        text: "test1 message 49",
+      }, {
+        text: "LongNonwrappingMessage",
+      }, {
+        text: "test2 message 0",
+      }, {
+        text: "test2 message 49",
+      }],
+    });
+
+    let nodeDeferred = promise.defer();
+    hud.jsterm.execute("1+1", (node) => { nodeDeferred.resolve(node); });
+    let node = yield nodeDeferred.promise;
+
+    let scrollNode = hud.outputNode.parentNode;
     let rectNode = node.getBoundingClientRect();
     let rectOutput = scrollNode.getBoundingClientRect();
+    console.debug("rectNode", rectNode, "rectOutput", rectOutput);
+    console.log("scrollNode scrollHeight", scrollNode.scrollHeight, "scrollTop", scrollNode.scrollTop, "clientHeight", scrollNode.clientHeight);
 
     isnot(scrollNode.scrollTop, 0, "scroll location is not at the top");
 
-    // Visible scroll viewport.
-    let height = scrollNode.scrollHeight - scrollNode.scrollTop;
+    // The bounding client rect .top/left coordinates are relative to the
+    // console iframe.
 
-    // Top position of the last message node, relative to the outputNode.
-    let top = rectNode.top + scrollNode.scrollTop;
-    let bottom = top + node.clientHeight;
-    info("output height " + height + " node top " + top + " node bottom " + bottom + " node height " + node.clientHeight);
+    // Visible scroll viewport.
+    let height = rectOutput.height;
+
+    // Top and bottom coordinates of the last message node, relative to the outputNode.
+    let top = rectNode.top - rectOutput.top;
+    let bottom = top + rectNode.height;
+    info("node top " + top + " node bottom " + bottom + " node clientHeight " + node.clientHeight);
 
     ok(top >= 0 && bottom <= height, "last message is visible");
-
-    finishTest();
-  };
+  }
 }
-
-function test() {
-  addTab("data:text/html;charset=utf-8,Web Console test for bug 601352");
-  browser.addEventListener("load", function tabLoad(aEvent) {
-    browser.removeEventListener(aEvent.type, tabLoad, true);
-    openConsole(null, consoleOpened);
-  }, true);
-}
-
diff --git a/browser/metro/base/content/bindings/bindings.xml b/browser/metro/base/content/bindings/bindings.xml
index f06b2c0bc20d..11fa1b329a2a 100644
--- a/browser/metro/base/content/bindings/bindings.xml
+++ b/browser/metro/base/content/bindings/bindings.xml
@@ -196,7 +196,7 @@
         if (event.mozInputSource == Ci.nsIDOMMouseEvent.MOZ_SOURCE_TOUCH) {
           if (typeof SelectionHelperUI != 'undefined') {
             SelectionHelperUI.attachEditSession(ChromeSelectionHandler,
-                                                event.clientX, event.clientY);
+                event.clientX, event.clientY, this);
           } else {
             // If we don't have access to SelectionHelperUI then we are using this
             // binding for browser content (e.g. about:config)
@@ -295,7 +295,7 @@
           if (event.mozInputSource == Ci.nsIDOMMouseEvent.MOZ_SOURCE_TOUCH) {
             if (typeof SelectionHelperUI != 'undefined') {
               SelectionHelperUI.attachEditSession(ChromeSelectionHandler,
-                                                  event.clientX, event.clientY);
+                  event.clientX, event.clientY, this);
             } else {
               // If we don't have access to SelectionHelperUI then we are using this
               // binding for browser content (e.g. about:config)
diff --git a/browser/metro/base/content/bindings/urlbar.xml b/browser/metro/base/content/bindings/urlbar.xml
index 86a432a4e578..51ef2220a10c 100644
--- a/browser/metro/base/content/bindings/urlbar.xml
+++ b/browser/metro/base/content/bindings/urlbar.xml
@@ -292,6 +292,12 @@
 
             if (aShouldDismiss)
               ContextUI.dismissTabs();
+
+            if (!InputSourceHelper.isPrecise && this.textLength) {
+              let inputRectangle = this.inputField.getBoundingClientRect();
+              SelectionHelperUI.attachEditSession(ChromeSelectionHandler,
+                  inputRectangle.left, inputRectangle.top, this);
+            }
           ]]>
         </body>
       </method>
@@ -448,6 +454,15 @@
 
       <handler event="click" phase="capturing">
         <![CDATA[
+          // workaround for bug 925457: taping browser chrome resets last tap
+          // co-ordinates to 'undefined' so that we know not to shift the
+          // browser when the keyboard is up in SelectionHandler's
+          // _calcNewContentPosition().
+          Browser.selectedTab.browser.messageManager.sendAsyncMessage(
+              "Browser:ResetLastPos", {
+                xPos: null,
+                yPos: null
+              });
           this.beginEditing(true);
         ]]>
       </handler>
diff --git a/browser/metro/base/content/browser.xul b/browser/metro/base/content/browser.xul
index 558a5c936a7c..14685f995966 100644
--- a/browser/metro/base/content/browser.xul
+++ b/browser/metro/base/content/browser.xul
@@ -482,8 +482,7 @@ Desktop browser's sync prefs.
                      autocompletepopup="urlbar-autocomplete"
                      completeselectedindex="true"
                      placeholder="&urlbar.emptytext;"
-                     tabscrolling="true"
-                     onclick="SelectionHelperUI.urlbarTextboxClick(this);"/>
+                     tabscrolling="true" />
 
             <toolbarbutton id="go-button"
                            class="urlbar-button"
diff --git a/browser/metro/base/content/helperui/ChromeSelectionHandler.js b/browser/metro/base/content/helperui/ChromeSelectionHandler.js
index c5b5fbfb7415..72be0cb0076b 100644
--- a/browser/metro/base/content/helperui/ChromeSelectionHandler.js
+++ b/browser/metro/base/content/helperui/ChromeSelectionHandler.js
@@ -33,7 +33,7 @@ var ChromeSelectionHandler = {
   _onSelectionAttach: function _onSelectionAttach(aJson) {
     this._domWinUtils = Util.getWindowUtils(window);
     this._contentWindow = window;
-    this._targetElement = this._domWinUtils.elementFromPoint(aJson.xPos, aJson.yPos, true, false);
+    this._targetElement = aJson.target;
     this._targetIsEditable = this._targetElement instanceof Components.interfaces.nsIDOMXULTextBoxElement;
     if (!this._targetIsEditable) {
       this._onFail("not an editable?", this._targetElement);
diff --git a/browser/metro/base/content/helperui/SelectionHelperUI.js b/browser/metro/base/content/helperui/SelectionHelperUI.js
index 50a3725bfb49..c4aaabb68fe0 100644
--- a/browser/metro/base/content/helperui/SelectionHelperUI.js
+++ b/browser/metro/base/content/helperui/SelectionHelperUI.js
@@ -435,10 +435,12 @@ var SelectionHelperUI = {
    *
    * Attaches to existing selection and begins editing.
    *
-   * @param aMsgTarget - Browser or chrome message target
-   * @param aX, aY - Browser relative client coordinates.
+   * @param aMsgTarget - Browser or chrome message target.
+   * @param aX Tap browser relative client X coordinate.
+   * @param aY Tap browser relative client Y coordinate.
+   * @param aTarget Actual tap target (optional).
    */
-  attachEditSession: function attachEditSession(aMsgTarget, aX, aY) {
+  attachEditSession: function attachEditSession(aMsgTarget, aX, aY, aTarget) {
     if (!aMsgTarget || this.isActive)
       return;
     this._init(aMsgTarget);
@@ -448,6 +450,7 @@ var SelectionHelperUI = {
     // back with information on the current selection. SelectionAttach
     // takes client coordinates.
     this._sendAsyncMessage("Browser:SelectionAttach", {
+      target: aTarget,
       xPos: aX,
       yPos: aY
     });
@@ -464,11 +467,12 @@ var SelectionHelperUI = {
    * Once the user starts a drag, the caret marker is hidden, and
    * the start and end markers take over.
    *
-   * @param aMsgTarget - Browser or chrome message target
-   * @param aX, aY - Browser relative client coordinates of the tap
-   * that initiated the session.
+   * @param aMsgTarget - Browser or chrome message target.
+   * @param aX Tap browser relative client X coordinate.
+   * @param aY Tap browser relative client Y coordinate.
+   * @param aTarget Actual tap target (optional).
    */
-  attachToCaret: function attachToCaret(aMsgTarget, aX, aY) {
+  attachToCaret: function attachToCaret(aMsgTarget, aX, aY, aTarget) {
     if (!this.isActive) {
       this._init(aMsgTarget);
       this._setupDebugOptions();
@@ -476,9 +480,14 @@ var SelectionHelperUI = {
       this._hideMonocles();
     }
 
-    this._lastPoint = { xPos: aX, yPos: aY };
+    this._lastCaretAttachment = {
+      target: aTarget,
+      xPos: aX,
+      yPos: aY
+    };
 
     this._sendAsyncMessage("Browser:CaretAttach", {
+      target: aTarget,
       xPos: aX,
       yPos: aY
     });
@@ -516,38 +525,14 @@ var SelectionHelperUI = {
     });
   },
 
-  /*
-   * Event handler on the navbar text input. Called from navbar bindings
-   * when focus is applied to the edit.
-   */
-  urlbarTextboxClick: function(aEdit) {
-    // workaround for bug 925457: taping browser chrome resets last tap
-    // co-ordinates to 'undefined' so that we know not to shift the browser
-    // when the keyboard is up in SelectionHandler's _calcNewContentPosition().
-    Browser.selectedTab.browser.messageManager.sendAsyncMessage("Browser:ResetLastPos", {
-      xPos: null,
-      yPos: null
-    });
-
-    if (InputSourceHelper.isPrecise || !aEdit.textLength) {
-      return;
-    }
-
-    // Enable selection when there's text in the control
-    let innerRect = aEdit.inputField.getBoundingClientRect();
-    this.attachEditSession(ChromeSelectionHandler,
-                           innerRect.left,
-                           innerRect.top);
-  },
-
   /*
    * Click handler for chrome pages loaded into the browser (about:config).
    * Called from the text input bindings via the attach_edit_session_to_content
    * observer.
    */
   chromeTextboxClick: function (aEvent) {
-    this.attachEditSession(Browser.selectedTab.browser,
-                           aEvent.clientX, aEvent.clientY);
+    this.attachEditSession(Browser.selectedTab.browser, aEvent.clientX,
+        aEvent.clientY, aEvent.target);
   },
 
   /*
@@ -875,12 +860,13 @@ var SelectionHelperUI = {
 
   /*
    * Handles taps that move the current caret around in text edits,
-   * clear active selection and focus when neccessary, or change
-   * modes. Only active afer SelectionHandlerUI is initialized.
+   * clear active selection and focus when necessary, or change
+   * modes. Only active after SelectionHandlerUI is initialized.
    */
   _onClick: function(aEvent) {
     if (this.layerMode == kChromeLayer && this._targetIsEditable) {
-      this.attachToCaret(this._msgTarget, aEvent.clientX, aEvent.clientY);
+      this.attachToCaret(this._msgTarget, aEvent.clientX, aEvent.clientY,
+          aEvent.target);
     }
   },
 
@@ -909,7 +895,8 @@ var SelectionHelperUI = {
    */
   _onDeckOffsetChanged: function _onDeckOffsetChanged(aEvent) {
     // Update the monocle position and display
-    this.attachToCaret(null, this._lastPoint.xPos, this._lastPoint.yPos);
+    this.attachToCaret(null, this._lastCaretAttachment.xPos,
+        this._lastCaretAttachment.yPos, this._lastCaretAttachment.target);
   },
 
   /*
diff --git a/browser/metro/base/tests/mochitest/browser_selection_urlbar.js b/browser/metro/base/tests/mochitest/browser_selection_urlbar.js
index 07179b3d4bc7..b7745f798257 100644
--- a/browser/metro/base/tests/mochitest/browser_selection_urlbar.js
+++ b/browser/metro/base/tests/mochitest/browser_selection_urlbar.js
@@ -107,7 +107,8 @@ gTests.push({
     let autocompletePopup = document.getElementById("urlbar-autocomplete-scroll");
     yield waitForEvent(autocompletePopup, "transitionend");
 
-    SelectionHelperUI.attachEditSession(ChromeSelectionHandler, editCoords.x, editCoords.y);
+    SelectionHelperUI.attachEditSession(ChromeSelectionHandler, editCoords.x,
+        editCoords.y, edit);
     ok(SelectionHelperUI.isSelectionUIVisible, "selection enabled");
 
     let selection = edit.QueryInterface(Components.interfaces.nsIDOMXULTextBoxElement)
@@ -136,7 +137,8 @@ gTests.push({
     edit.value = "wikipedia.org";
     edit.select();
     let editCoords = logicalCoordsForElement(edit);
-    SelectionHelperUI.attachEditSession(ChromeSelectionHandler, editCoords.x, editCoords.y);
+    SelectionHelperUI.attachEditSession(ChromeSelectionHandler, editCoords.x,
+        editCoords.y, edit);
     edit.blur();
     ok(!SelectionHelperUI.isSelectionUIVisible, "selection no longer enabled");
     clearSelection(edit);
@@ -228,6 +230,26 @@ gTests.push({
   }
 });
 
+gTests.push({
+  desc: "Bug 957646 - Selection monocles sometimes don't display when tapping" +
+        " text ion the nav bar.",
+  run: function() {
+    yield showNavBar();
+
+    let edit = document.getElementById("urlbar-edit");
+    edit.value = "about:mozilla";
+
+    let editRectangle = edit.getBoundingClientRect();
+
+    // Tap outside the input but close enough for fluffing to take effect.
+    sendTap(window, editRectangle.left + 50, editRectangle.top - 2);
+
+    yield waitForCondition(function () {
+      return SelectionHelperUI.isSelectionUIVisible;
+    });
+  }
+});
+
 function test() {
   if (!isLandscapeMode()) {
     todo(false, "browser_selection_tests need landscape mode to run.");
diff --git a/browser/metro/base/tests/mochitest/browser_ui_telemetry.js b/browser/metro/base/tests/mochitest/browser_ui_telemetry.js
index 7c5c3965d1a4..398c2bcad79f 100644
--- a/browser/metro/base/tests/mochitest/browser_ui_telemetry.js
+++ b/browser/metro/base/tests/mochitest/browser_ui_telemetry.js
@@ -26,3 +26,41 @@ gTests.push({
     ok(simpleMeasurements.UITelemetry["metro-ui"]["window-height"], "window-height measurement was captured");
   }
 });
+
+gTests.push({
+  desc: "Test tab count telemetry",
+  run: function() {
+    // Wait for Session Manager to be initialized.
+    yield waitForCondition(() => window.__SSID);
+
+    Services.obs.notifyObservers(null, "reset-telemetry-vars", null);
+    yield waitForCondition(function () {
+      let simpleMeasurements = getTelemetryPayload().simpleMeasurements;
+      return simpleMeasurements.UITelemetry["metro-tabs"]["currTabCount"] == 1;
+    });
+
+    let simpleMeasurements = getTelemetryPayload().simpleMeasurements;
+    is(simpleMeasurements.UITelemetry["metro-tabs"]["currTabCount"], 1);
+    is(simpleMeasurements.UITelemetry["metro-tabs"]["maxTabCount"], 1);
+
+    let tab2 = Browser.addTab("about:mozilla");
+    simpleMeasurements = getTelemetryPayload().simpleMeasurements;
+    is(simpleMeasurements.UITelemetry["metro-tabs"]["currTabCount"], 2);
+    is(simpleMeasurements.UITelemetry["metro-tabs"]["maxTabCount"], 2);
+
+    let tab3 = Browser.addTab("about:config");
+    simpleMeasurements = getTelemetryPayload().simpleMeasurements;
+    is(simpleMeasurements.UITelemetry["metro-tabs"]["currTabCount"], 3);
+    is(simpleMeasurements.UITelemetry["metro-tabs"]["maxTabCount"], 3);
+
+    Browser.closeTab(tab2, { forceClose: true } );
+    simpleMeasurements = getTelemetryPayload().simpleMeasurements;
+    is(simpleMeasurements.UITelemetry["metro-tabs"]["currTabCount"], 2);
+    is(simpleMeasurements.UITelemetry["metro-tabs"]["maxTabCount"], 3);
+
+    Browser.closeTab(tab3, { forceClose: true } );
+    simpleMeasurements = getTelemetryPayload().simpleMeasurements;
+    is(simpleMeasurements.UITelemetry["metro-tabs"]["currTabCount"], 1);
+    is(simpleMeasurements.UITelemetry["metro-tabs"]["maxTabCount"], 3);
+  }
+});
\ No newline at end of file
diff --git a/browser/metro/components/SessionStore.js b/browser/metro/components/SessionStore.js
index 83e61c99cf11..5ffaebf5afd0 100644
--- a/browser/metro/components/SessionStore.js
+++ b/browser/metro/components/SessionStore.js
@@ -24,6 +24,9 @@ XPCOMUtils.defineLazyGetter(this, "NetUtil", function() {
   return NetUtil;
 });
 
+XPCOMUtils.defineLazyModuleGetter(this, "UITelemetry",
+  "resource://gre/modules/UITelemetry.jsm");
+
 // -----------------------------------------------------------------------
 // Session Store
 // -----------------------------------------------------------------------
@@ -52,6 +55,9 @@ SessionStore.prototype = {
   _maxTabsUndo: 1,
   _shouldRestore: false,
 
+  // Tab telemetry variables
+  _maxTabsOpen: 1,
+
   init: function ss_init() {
     // Get file references
     this._sessionFile = Services.dirsvc.get("ProfD", Ci.nsILocalFile);
@@ -63,6 +69,13 @@ SessionStore.prototype = {
 
     this._loadState = STATE_STOPPED;
 
+    try {
+      UITelemetry.addSimpleMeasureFunction("metro-tabs",
+                                          this._getTabStats.bind(this));
+    } catch (ex) {
+      // swallow exception that occurs if metro-tabs measure is already set up
+    }
+
     try {
       let shutdownWasUnclean = false;
 
@@ -184,6 +197,13 @@ SessionStore.prototype = {
     })
   },
 
+  _getTabStats: function() {
+    return {
+      currTabCount: this._currTabCount,
+      maxTabCount: this._maxTabsOpen
+    };
+  },
+
   observe: function ss_observe(aSubject, aTopic, aData) {
     let self = this;
     let observerService = Services.obs;
@@ -197,6 +217,7 @@ SessionStore.prototype = {
         observerService.addObserver(this, "quit-application-requested", true);
         observerService.addObserver(this, "quit-application-granted", true);
         observerService.addObserver(this, "quit-application", true);
+        observerService.addObserver(this, "reset-telemetry-vars", true);
         break;
       case "final-ui-startup":
         observerService.removeObserver(this, "final-ui-startup");
@@ -264,6 +285,7 @@ SessionStore.prototype = {
         observerService.removeObserver(this, "quit-application-requested");
         observerService.removeObserver(this, "quit-application-granted");
         observerService.removeObserver(this, "quit-application");
+        observerService.removeObserver(this, "reset-telemetry-vars");
 
         // If a save has been queued, kill the timer and save state now
         if (this._saveTimer) {
@@ -295,13 +317,24 @@ SessionStore.prototype = {
         this._saveTimer = null;
         this.saveState();
         break;
+      case "reset-telemetry-vars":
+        // Used in mochitests only.
+        this._maxTabsOpen = 1;
     }
   },
 
+  updateTabTelemetryVars: function(window) {
+    this._currTabCount = window.Browser.tabs.length;
+      if (this._currTabCount > this._maxTabsOpen) {
+        this._maxTabsOpen = this._currTabCount;
+      }
+  },
+
   handleEvent: function ss_handleEvent(aEvent) {
     let window = aEvent.currentTarget.ownerDocument.defaultView;
     switch (aEvent.type) {
       case "TabOpen":
+        this.updateTabTelemetryVars(window);
       case "TabClose": {
         let browser = aEvent.originalTarget.linkedBrowser;
         if (aEvent.type == "TabOpen") {
@@ -313,6 +346,9 @@ SessionStore.prototype = {
         }
         break;
     }
+      case "TabRemove":
+        this.updateTabTelemetryVars(window);
+        break;
       case "TabSelect": {
         let browser = aEvent.originalTarget.linkedBrowser;
         this.onTabSelect(window, browser);
@@ -361,6 +397,7 @@ SessionStore.prototype = {
     let tabContainer = aWindow.document.getElementById("tabs");
     tabContainer.addEventListener("TabOpen", this, true);
     tabContainer.addEventListener("TabClose", this, true);
+    tabContainer.addEventListener("TabRemove", this, true);
     tabContainer.addEventListener("TabSelect", this, true);
   },
 
@@ -372,6 +409,7 @@ SessionStore.prototype = {
     let tabContainer = aWindow.document.getElementById("tabs");
     tabContainer.removeEventListener("TabOpen", this, true);
     tabContainer.removeEventListener("TabClose", this, true);
+    tabContainer.removeEventListener("TabRemove", this, true);
     tabContainer.removeEventListener("TabSelect", this, true);
 
     if (this._loadState == STATE_RUNNING) {
diff --git a/browser/metro/theme/platform.css b/browser/metro/theme/platform.css
index 9ea744283655..d7c2dbcb0faf 100644
--- a/browser/metro/theme/platform.css
+++ b/browser/metro/theme/platform.css
@@ -640,10 +640,12 @@ tabmodalprompt:not([promptType="promptUserAndPass"]) .infoContainer {
 
 .meta {
   background-color: @panel_light_color@;
+  /* bug 969354
   background-image: url("chrome://browser/skin/images/firefox-watermark.png");
   background-repeat: no-repeat;
   background-position: center center;
   background-attachment: fixed;
+  */
 }
 
 /* needs to observe the viewstate */
diff --git a/browser/themes/linux/browser.css b/browser/themes/linux/browser.css
index 47d5027ab0a4..81df687068f0 100644
--- a/browser/themes/linux/browser.css
+++ b/browser/themes/linux/browser.css
@@ -560,6 +560,11 @@ menuitem:not([type]):not(.menuitem-tooltip):not(.menuitem-iconic-tooltip) {
   -moz-appearance: none;
 }
 
+:-moz-any(#TabsToolbar, #nav-bar) .toolbarbutton-1[open="true"],
+:-moz-any(#TabsToolbar, #nav-bar) .toolbarbutton-1:hover:active {
+  padding: 3px;
+}
+
 :-moz-any(#TabsToolbar, #nav-bar) .toolbarbutton-1 > .toolbarbutton-menubutton-button > .toolbarbutton-icon,
 :-moz-any(#TabsToolbar, #nav-bar) .toolbarbutton-1 > .toolbarbutton-menubutton-dropmarker > .dropmarker-icon,
 :-moz-any(#TabsToolbar, #nav-bar) .toolbarbutton-1 > .toolbarbutton-icon {
diff --git a/browser/themes/linux/devtools/computedview.css b/browser/themes/linux/devtools/computedview.css
index de7ab6929e31..9b0f65a12862 100644
--- a/browser/themes/linux/devtools/computedview.css
+++ b/browser/themes/linux/devtools/computedview.css
@@ -41,7 +41,8 @@ body {
 }
 
 .property-name {
-  width: 50%;
+  /* -12px is so the expander triangle isn't pushed up above the property */
+  width: calc(100% - 12px);
   overflow-x: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
@@ -49,8 +50,7 @@ body {
 }
 
 .property-value {
-  width: 50%;
-  max-width: 100%;
+  width: 100%;
   overflow-x: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
@@ -75,7 +75,8 @@ body {
     width: 200px;
   }
   .property-value {
-    width: auto;
+    /* -212px is accounting for the 200px property-name and the 12px triangle */
+    width: calc(100% - 212px);
   }
 }
 
diff --git a/browser/themes/linux/downloads/indicator.css b/browser/themes/linux/downloads/indicator.css
index e2dcba899ada..8db39f09a5ce 100644
--- a/browser/themes/linux/downloads/indicator.css
+++ b/browser/themes/linux/downloads/indicator.css
@@ -22,6 +22,8 @@
 #downloads-button[cui-areatype="toolbar"] > #downloads-indicator-anchor > #downloads-indicator-icon {
   background: -moz-image-rect(url("chrome://browser/skin/Toolbar.png"),
                               0, 198, 18, 180) center no-repeat;
+  min-width: 18px;
+  min-height: 18px;
 }
 
 #downloads-button[cui-areatype="toolbar"][attention] > #downloads-indicator-anchor > #downloads-indicator-icon {
diff --git a/browser/themes/osx/browser.css b/browser/themes/osx/browser.css
index 99a44ebdf46e..cb9e16ef276f 100644
--- a/browser/themes/osx/browser.css
+++ b/browser/themes/osx/browser.css
@@ -2573,24 +2573,13 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {
       url(chrome://browser/skin/tabbrowser/tab-background-start@2x.png);
   }
 
+  .tabbrowser-tab:hover > .tab-stack > .tab-background:not([selected=true]),
   .tabs-newtab-button:hover {
     background-image: url(chrome://browser/skin/tabbrowser/tab-background-start@2x.png),
                       url(chrome://browser/skin/tabbrowser/tab-background-middle@2x.png),
                       url(chrome://browser/skin/tabbrowser/tab-background-end@2x.png);
   }
 
-  .tabbrowser-tab:hover > .tab-stack > .tab-background > .tab-background-middle:not([selected=true]) {
-    background-image: url(chrome://browser/skin/tabbrowser/tab-background-middle@2x.png);
-  }
-
-  .tabbrowser-tab:hover > .tab-stack > .tab-background > .tab-background-start:not([selected=true]) {
-    background-image: url(chrome://browser/skin/tabbrowser/tab-background-start@2x.png);
-  }
-
-  .tabbrowser-tab:hover > .tab-stack > .tab-background > .tab-background-end:not([selected=true]) {
-    background-image: url(chrome://browser/skin/tabbrowser/tab-background-end@2x.png);
-  }
-
   .tab-background-middle[selected=true] {
     background-image: url(chrome://browser/skin/tabbrowser/tab-active-middle@2x.png),
                       @fgTabTexture@,
@@ -4125,6 +4114,10 @@ window > chatbox {
   margin-bottom: 0px;
 }
 
+#main-window:not([tabsintitlebar]):-moz-lwtheme > #titlebar {
+  margin-bottom: 5px;
+}
+
 #main-window[tabsintitlebar]:-moz-lwtheme > #titlebar > #titlebar-content {
   margin-top: 11px;
   margin-bottom: 11px;
diff --git a/browser/themes/osx/devtools/computedview.css b/browser/themes/osx/devtools/computedview.css
index 1eb1d1757040..42b0c26ff81e 100644
--- a/browser/themes/osx/devtools/computedview.css
+++ b/browser/themes/osx/devtools/computedview.css
@@ -59,7 +59,8 @@ body {
 }
 
 .property-name {
-  width: 50%;
+  /* -12px is so the expander triangle isn't pushed up above the property */
+  width: calc(100% - 12px);
   overflow-x: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
@@ -67,8 +68,7 @@ body {
 }
 
 .property-value {
-  width: 50%;
-  max-width: 100%;
+  width: 100%;
   overflow-x: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
@@ -93,7 +93,8 @@ body {
     width: 200px;
   }
   .property-value {
-    width: auto;
+    /* -212px is accounting for the 200px property-name and the 12px triangle */
+    width: calc(100% - 212px);
   }
 }
 
diff --git a/browser/themes/shared/devtools/netmonitor.inc.css b/browser/themes/shared/devtools/netmonitor.inc.css
index 64f56626ae25..0d6c4c77ae71 100644
--- a/browser/themes/shared/devtools/netmonitor.inc.css
+++ b/browser/themes/shared/devtools/netmonitor.inc.css
@@ -494,15 +494,15 @@ box.requests-menu-status {
 
 /* Footer */
 
-#requests-menu-footer {
-  border-top: solid 1px hsla(210,5%,5%,.3);
-}
-
 .theme-dark #requests-menu-footer {
+  border-top: 1px solid @table_itemDarkStartBorder@;
+  box-shadow: 0 1px 0 @table_itemDarkEndBorder@ inset;
   background: url(background-noise-toolbar.png), #343c45; /* Toolbars */
 }
 
 .theme-light #requests-menu-footer {
+  border-top: 1px solid @table_itemLightStartBorder@;
+  box-shadow: 0 1px 0 @table_itemLightEndBorder@ inset;
   background: url(background-noise-toolbar.png), #f0f1f2; /* Toolbars */
 }
 
@@ -530,14 +530,14 @@ box.requests-menu-status {
 
 .theme-dark .requests-menu-footer-spacer:not(:first-child),
 .theme-dark .requests-menu-footer-button:not(:first-child) {
-  -moz-border-start: 1px solid @table_itemDarkStartBorder@;
-  box-shadow: -1px 0 0 @table_itemDarkEndBorder@;
+  -moz-border-start: 1px solid @table_itemDarkEndBorder@;
+  box-shadow: -1px 0 0 @table_itemDarkStartBorder@;
 }
 
 .theme-light .requests-menu-footer-spacer:not(:first-child),
 .theme-light .requests-menu-footer-button:not(:first-child) {
-  -moz-border-start: 1px solid @table_itemLightStartBorder@;
-  box-shadow: -1px 0 0 @table_itemLightEndBorder@;
+  -moz-border-start: 1px solid @table_itemLightEndBorder@;
+  box-shadow: -1px 0 0 @table_itemLightStartBorder@;
 }
 
 .requests-menu-footer-button {
@@ -546,18 +546,25 @@ box.requests-menu-status {
 }
 
 .requests-menu-footer-button:hover {
-  background: rgba(0,0,0,0.20);
+  background: rgba(0,0,0,0.10);
 }
 
-.requests-menu-footer-button:hover:active {
-  background: rgba(0,0,0,0.35);
+.theme-dark .requests-menu-footer-button:hover:active {
+  background-color: rgba(29,79,115,0.4); /* Select Highlight Blue at 40% opacity */
 }
 
-.requests-menu-footer-button:not(:active)[checked] {
-  background-color: rgba(0,0,0,0.25);
-  background-image: radial-gradient(farthest-side at center top, hsla(200,100%,70%,.7), hsla(200,100%,70%,0.3));
-  background-size: 100% 1px;
-  background-repeat: no-repeat;
+.theme-light .requests-menu-footer-button:hover:active {
+  background-color: rgba(76,158,217,0.4); /* Select Highlight Blue at 40% opacity */
+}
+
+.theme-dark .requests-menu-footer-button:not(:active)[checked] {
+  background-color: rgba(29,79,115,1); /* Select Highlight Blue */
+  color: rgba(245,247,250,1); /* Light foreground text */
+}
+
+.theme-light .requests-menu-footer-button:not(:active)[checked] {
+  background-color: rgba(76,158,217,1); /* Select Highlight Blue */
+  color: rgba(245,247,250,1); /* Light foreground text */
 }
 
 .requests-menu-footer-label {
diff --git a/browser/themes/shared/devtools/toolbars.inc.css b/browser/themes/shared/devtools/toolbars.inc.css
index 81c6763ec1bc..a91a48d94a76 100644
--- a/browser/themes/shared/devtools/toolbars.inc.css
+++ b/browser/themes/shared/devtools/toolbars.inc.css
@@ -393,6 +393,10 @@
   background-image: linear-gradient(transparent, transparent), @smallSeparatorDark@;
 }
 
+.theme-dark .devtools-sidebar-tabs > tabs > tab:hover {
+  background-image: linear-gradient(hsla(206,37%,4%,.2), hsla(206,37%,4%,.2)), @smallSeparatorDark@;
+}
+
 .theme-dark .devtools-sidebar-tabs > tabs > tab:hover:active {
   background-image: linear-gradient(hsla(206,37%,4%,.4), hsla(206,37%,4%,.4)), @smallSeparatorDark@;
 }
diff --git a/browser/themes/shared/tabs.inc.css b/browser/themes/shared/tabs.inc.css
index b6d975ed239b..223f4e8c082d 100644
--- a/browser/themes/shared/tabs.inc.css
+++ b/browser/themes/shared/tabs.inc.css
@@ -224,6 +224,7 @@
 /* End selected tab */
 
 /* new tab button border and gradient on hover */
+.tabbrowser-tab:hover > .tab-stack > .tab-background:not([selected=true]),
 .tabs-newtab-button:hover {
   background-image: url(chrome://browser/skin/tabbrowser/tab-background-start.png),
                     url(chrome://browser/skin/tabbrowser/tab-background-middle.png),
@@ -233,27 +234,6 @@
   background-size: @tabCurveWidth@ 100%, calc(100% - (2 * @tabCurveWidth@)) 100%, @tabCurveWidth@ 100%;
 }
 
-/* normal tab border and gradient on hover */
-.tabbrowser-tab:hover > .tab-stack > .tab-background > .tab-background-middle:not([selected=true]) {
-  background-image: url(chrome://browser/skin/tabbrowser/tab-background-middle.png);
-  background-repeat: repeat-x;
-  background-size: auto 100%;
-}
-
-.tabbrowser-tab:hover > .tab-stack > .tab-background > .tab-background-start:not([selected=true]),
-.tabbrowser-tab:hover > .tab-stack > .tab-background > .tab-background-end:not([selected=true]) {
-  background-repeat: no-repeat;
-  background-size: 100% 100%;
-}
-
-.tabbrowser-tab:hover > .tab-stack > .tab-background > .tab-background-start:not([selected=true]) {
-  background-image: url(chrome://browser/skin/tabbrowser/tab-background-start.png);
-}
-
-.tabbrowser-tab:hover > .tab-stack > .tab-background > .tab-background-end:not([selected=true]) {
-  background-image: url(chrome://browser/skin/tabbrowser/tab-background-end.png);
-}
-
 /* Tab pointer-events */
 .tabbrowser-tab {
   pointer-events: none;
diff --git a/browser/themes/windows/devtools/computedview.css b/browser/themes/windows/devtools/computedview.css
index 1eb1d1757040..42b0c26ff81e 100644
--- a/browser/themes/windows/devtools/computedview.css
+++ b/browser/themes/windows/devtools/computedview.css
@@ -59,7 +59,8 @@ body {
 }
 
 .property-name {
-  width: 50%;
+  /* -12px is so the expander triangle isn't pushed up above the property */
+  width: calc(100% - 12px);
   overflow-x: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
@@ -67,8 +68,7 @@ body {
 }
 
 .property-value {
-  width: 50%;
-  max-width: 100%;
+  width: 100%;
   overflow-x: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
@@ -93,7 +93,8 @@ body {
     width: 200px;
   }
   .property-value {
-    width: auto;
+    /* -212px is accounting for the 200px property-name and the 12px triangle */
+    width: calc(100% - 212px);
   }
 }
 
diff --git a/build/mobile/b2gautomation.py b/build/mobile/b2gautomation.py
index 387118c3a983..f2c624bafece 100644
--- a/build/mobile/b2gautomation.py
+++ b/build/mobile/b2gautomation.py
@@ -140,11 +140,9 @@ class B2GRemoteAutomation(Automation):
             output.
         """
         timeout = timeout or 120
-        responseDueBy = time.time() + timeout
         while True:
-            currentlog = proc.stdout
+            currentlog = proc.getStdoutLines(timeout)
             if currentlog:
-                responseDueBy = time.time() + timeout
                 print currentlog
                 # Match the test filepath from the last TEST-START line found in the new
                 # log content. These lines are in the form:
@@ -155,11 +153,10 @@ class B2GRemoteAutomation(Automation):
                 if hasattr(self, 'logFinish') and self.logFinish in currentlog:
                     return 0
             else:
-                if time.time() > responseDueBy:
-                    self.log.info("TEST-UNEXPECTED-FAIL | %s | application timed "
-                                  "out after %d seconds with no output",
-                                  self.lastTestSeen, int(timeout))
-                    return 1
+                self.log.info("TEST-UNEXPECTED-FAIL | %s | application timed "
+                              "out after %d seconds with no output",
+                              self.lastTestSeen, int(timeout))
+                return 1
 
     def getDeviceStatus(self, serial=None):
         # Get the current status of the device.  If we know the device
@@ -329,16 +326,22 @@ class B2GRemoteAutomation(Automation):
             # a dummy value to make the automation happy
             return 0
 
-        @property
-        def stdout(self):
+        def getStdoutLines(self, timeout):
             # Return any lines in the queue used by the
             # b2g process handler.
             lines = []
+            # get all of the lines that are currently available
             while True:
                 try:
                     lines.append(self.queue.get_nowait())
                 except Queue.Empty:
                     break
+
+            # wait 'timeout' for any additional lines
+            try:
+                lines.append(self.queue.get(True, timeout))
+            except Queue.Empty:
+                pass
             return '\n'.join(lines)
 
         def wait(self, timeout=None):
diff --git a/build/mobile/robocop/Driver.java b/build/mobile/robocop/Driver.java
index d615a41cce61..0fa2d87422e7 100644
--- a/build/mobile/robocop/Driver.java
+++ b/build/mobile/robocop/Driver.java
@@ -12,10 +12,10 @@ public interface Driver {
      * Find the first Element using the given method.
      * 
      * @param activity The activity the element belongs to
-     * @param name The name of the element
+     * @param id The resource id of the element
      * @return The first matching element on the current context, or null if not found.
      */
-    Element findElement(Activity activity, String name);
+    Element findElement(Activity activity, int id);
 
     /**
      * Sets up scroll handling so that data is received from the extension.
diff --git a/build/mobile/robocop/FennecNativeDriver.java b/build/mobile/robocop/FennecNativeDriver.java
index 8f6ed8c5ee71..e780b022a714 100644
--- a/build/mobile/robocop/FennecNativeDriver.java
+++ b/build/mobile/robocop/FennecNativeDriver.java
@@ -16,16 +16,13 @@ import java.io.FileReader;
 import java.io.FileWriter;
 import java.io.FileOutputStream;
 import java.io.IOException;
-import java.io.OutputStream;
 import java.io.PrintWriter;
 import java.nio.IntBuffer;
-import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
 import android.app.Activity;
-import android.opengl.GLSurfaceView;
 import android.view.View;
 import android.util.Log;
 
@@ -36,8 +33,6 @@ import com.jayway.android.robotium.solo.Solo;
 public class FennecNativeDriver implements Driver {
     private static final int FRAME_TIME_THRESHOLD = 25;     // allow 25ms per frame (40fps)
 
-    // Map of IDs to element names.
-    private HashMap mLocators = null;
     private Activity mActivity;
     private Solo mSolo;
     private String mRootPath;
@@ -67,9 +62,6 @@ public class FennecNativeDriver implements Driver {
         mActivity = activity;
         mSolo = robocop;
         mRootPath = rootPath;
-
-        // Set up table of fennec_ids.
-        mLocators = convertTextToTable(getFile(mRootPath + "/fennec_ids.txt"));
     }
 
     //Information on the location of the Gecko Frame.
@@ -80,7 +72,7 @@ public class FennecNativeDriver implements Driver {
     private int mGeckoWidth = 1024;
 
     private void getGeckoInfo() {
-        View geckoLayout = mActivity.findViewById(Integer.decode((String)mLocators.get("gecko_layout")));
+        View geckoLayout = mActivity.findViewById(R.id.gecko_layout);
         if (geckoLayout != null) {
             int[] pos = new int[2];
             geckoLayout.getLocationOnScreen(pos);
@@ -122,21 +114,12 @@ public class FennecNativeDriver implements Driver {
         return mGeckoWidth;
     }
 
-    /** Find the named element in the list of known Fennec views. 
+    /** Find the element with given id.
+     *
      *  @return An Element representing the view, or null if the view is not found.
      */
-    public Element findElement(Activity activity, String name) {
-        if (name == null) {
-            FennecNativeDriver.log(FennecNativeDriver.LogLevel.ERROR,
-                "Can not findElements when passed a null");
-            return null;
-        }
-        if (mLocators.containsKey(name)) {
-            return new FennecNativeElement(Integer.decode((String)mLocators.get(name)), activity, mSolo);
-        }
-        FennecNativeDriver.log(FennecNativeDriver.LogLevel.ERROR,
-            "findElement: Element '"+name+"' does not exist in the list");
-        return null;
+    public Element findElement(Activity activity, int id) {
+        return new FennecNativeElement(id, activity);
     }
 
     public void startFrameRecording() {
diff --git a/build/mobile/robocop/FennecNativeElement.java b/build/mobile/robocop/FennecNativeElement.java
index c50d965345b6..6a10dc8b7290 100644
--- a/build/mobile/robocop/FennecNativeElement.java
+++ b/build/mobile/robocop/FennecNativeElement.java
@@ -7,26 +7,17 @@ package org.mozilla.gecko;
 import android.app.Activity;
 import android.view.View;
 import android.view.ViewGroup;
-import android.widget.Button;
 import android.widget.EditText;
-import android.widget.ListView;
-import android.widget.TextView;
 import android.widget.TextSwitcher;
-import android.app.Instrumentation;
-import com.jayway.android.robotium.solo.Solo;
-import java.util.List;
+import android.widget.TextView;
 
 public class FennecNativeElement implements Element {
     private final Activity mActivity;
     private Integer mId;
-    private Solo mSolo;
-    // max time to wait for thread synchronization
-    private static final int MAX_WAIT_MS = 60000;
 
-    public FennecNativeElement(Integer id, Activity activity, Solo solo) {
+    public FennecNativeElement(Integer id, Activity activity) {
         mId = id;
         mActivity = activity;
-        mSolo = solo;
     }
 
     public Integer getId() {
diff --git a/config/makefiles/java-build.mk b/config/makefiles/java-build.mk
index b3f34ab1d033..2c703f704277 100644
--- a/config/makefiles/java-build.mk
+++ b/config/makefiles/java-build.mk
@@ -83,9 +83,17 @@ ifdef JAVA_JAR_TARGETS #{
 # Arg 3: List of extra jars to link against.  We do not use VPATH so
 #        jars must be relative to $(CURDIR).
 # Arg 4: Additional JAVAC_FLAGS.
+
+# Note: Proguard fails when stale .class files corresponding to
+# removed inner classes are present in the object directory.  These
+# stale class files get packaged into the .jar file, which then gets
+# processed by Proguard.  To work around this, we always delete any
+# existing jarfile-classes directory and start fresh.
+
 define java_jar_template
 $(1): $(2) $(3)
 	$$(REPORT_BUILD)
+	@$$(RM) -rf $(1:.jar=)-classes
 	@$$(NSINSTALL) -D $(1:.jar=)-classes
 	@$$(if $$(filter-out .,$$(@D)),$$(NSINSTALL) -D $$(@D))
 	$$(JAVAC) $$(JAVAC_FLAGS)\
diff --git a/content/base/src/nsFrameMessageManager.cpp b/content/base/src/nsFrameMessageManager.cpp
index 4ab5bfd0f94e..18cc7120352e 100644
--- a/content/base/src/nsFrameMessageManager.cpp
+++ b/content/base/src/nsFrameMessageManager.cpp
@@ -29,7 +29,6 @@
 #include "nsIDOMClassInfo.h"
 #include "nsIDOMFile.h"
 #include "xpcpublic.h"
-#include "mozilla/Debug.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/dom/StructuredCloneUtils.h"
 #include "JavaScriptChild.h"
@@ -38,6 +37,9 @@
 #include "nsPrintfCString.h"
 #include <algorithm>
 
+#ifdef ANDROID
+#include <android/log.h>
+#endif
 #ifdef XP_WIN
 #include <windows.h>
 # if defined(SendMessage)
@@ -721,7 +723,16 @@ nsFrameMessageManager::GetChildAt(uint32_t aIndex,
 NS_IMETHODIMP
 nsFrameMessageManager::Dump(const nsAString& aStr)
 {
-  PrintToDebugger(aStr, stdout);
+#ifdef ANDROID
+  __android_log_print(ANDROID_LOG_INFO, "Gecko", "%s", NS_ConvertUTF16toUTF8(aStr).get());
+#endif
+#ifdef XP_WIN
+  if (IsDebuggerPresent()) {
+    OutputDebugStringW(PromiseFlatString(aStr).get());
+  }
+#endif
+  fputs(NS_ConvertUTF16toUTF8(aStr).get(), stdout);
+  fflush(stdout);
   return NS_OK;
 }
 
diff --git a/content/base/src/nsObjectLoadingContent.cpp b/content/base/src/nsObjectLoadingContent.cpp
index 9100dd1ce187..bcb827649c14 100644
--- a/content/base/src/nsObjectLoadingContent.cpp
+++ b/content/base/src/nsObjectLoadingContent.cpp
@@ -2622,7 +2622,7 @@ nsObjectLoadingContent::ScriptRequestPluginInstance(JSContext* aCx,
       NS_NOTREACHED("failed to dispatch PluginScripted event");
     }
     mScriptRequested = true;
-  } else if (mType == eType_Plugin && !mInstanceOwner &&
+  } else if (callerIsContentJS && mType == eType_Plugin && !mInstanceOwner &&
              nsContentUtils::IsSafeToRunScript() &&
              InActiveDocument(thisContent)) {
     // If we're configured as a plugin in an active document and it's safe to
@@ -3434,7 +3434,8 @@ nsObjectLoadingContent::DoNewResolve(JSContext* aCx, JS::Handle<JSObject*> aObje
                                      JS::Handle<jsid> aId,
                                      JS::MutableHandle<JSPropertyDescriptor> aDesc)
 {
-  // We don't resolve anything; we just try to make sure we're instantiated
+  // We don't resolve anything; we just try to make sure we're instantiated.
+  // This purposefully does not fire for chrome/xray resolves, see bug 967694
 
   nsRefPtr<nsNPAPIPluginInstance> pi;
   nsresult rv = ScriptRequestPluginInstance(aCx, getter_AddRefs(pi));
@@ -3450,8 +3451,8 @@ nsObjectLoadingContent::GetOwnPropertyNames(JSContext* aCx,
                                             ErrorResult& aRv)
 {
   // Just like DoNewResolve, just make sure we're instantiated.  That will do
-  // the work our Enumerate hook needs to do, and we don't want to return these
-  // property names from Xrays anyway.
+  // the work our Enumerate hook needs to do.  This purposefully does not fire
+  // for xray resolves, see bug 967694
   nsRefPtr<nsNPAPIPluginInstance> pi;
   aRv = ScriptRequestPluginInstance(aCx, getter_AddRefs(pi));
 }
diff --git a/content/canvas/src/WebGLContext.h b/content/canvas/src/WebGLContext.h
index a467c3970ea3..27cb18f29af1 100644
--- a/content/canvas/src/WebGLContext.h
+++ b/content/canvas/src/WebGLContext.h
@@ -367,6 +367,7 @@ public:
     void GetShaderInfoLog(WebGLShader *shader, nsACString& retval);
     void GetShaderInfoLog(WebGLShader *shader, nsAString& retval);
     void GetShaderSource(WebGLShader *shader, nsAString& retval);
+    void GetShaderTranslatedSource(WebGLShader *shader, nsAString& retval);
     JS::Value GetTexParameter(GLenum target, GLenum pname);
     JS::Value GetTexParameter(JSContext * /* unused */, GLenum target,
                               GLenum pname) {
@@ -906,6 +907,7 @@ protected:
         WEBGL_compressed_texture_pvrtc,
         WEBGL_compressed_texture_s3tc,
         WEBGL_debug_renderer_info,
+        WEBGL_debug_shaders,
         WEBGL_depth_texture,
         WEBGL_lose_context,
         WEBGL_draw_buffers,
diff --git a/content/canvas/src/WebGLContextExtensions.cpp b/content/canvas/src/WebGLContextExtensions.cpp
index 3570cb880c3d..8df15a5abe44 100644
--- a/content/canvas/src/WebGLContextExtensions.cpp
+++ b/content/canvas/src/WebGLContextExtensions.cpp
@@ -29,6 +29,7 @@ static const char *sExtensionNames[] = {
     "WEBGL_compressed_texture_pvrtc",
     "WEBGL_compressed_texture_s3tc",
     "WEBGL_debug_renderer_info",
+    "WEBGL_debug_shaders",
     "WEBGL_depth_texture",
     "WEBGL_lose_context",
     "WEBGL_draw_buffers",
@@ -53,13 +54,23 @@ WebGLContext::IsExtensionEnabled(WebGLExtensionID ext) const {
 
 bool WebGLContext::IsExtensionSupported(JSContext *cx, WebGLExtensionID ext) const
 {
+    bool allowPrivilegedExts = false;
+
     // Chrome contexts need access to debug information even when
     // webgl.disable-extensions is set. This is used in the graphics
     // section of about:support.
-    if (xpc::AccessCheck::isChrome(js::GetContextCompartment(cx))) {
+    if (xpc::AccessCheck::isChrome(js::GetContextCompartment(cx)))
+        allowPrivilegedExts = true;
+
+    if (Preferences::GetBool("webgl.enable-privileged-extensions", false))
+        allowPrivilegedExts = true;
+
+    if (allowPrivilegedExts) {
         switch (ext) {
             case WEBGL_debug_renderer_info:
                 return true;
+            case WEBGL_debug_shaders:
+                return true;
             default:
                 // For warnings-as-errors.
                 break;
@@ -163,7 +174,7 @@ WebGLContext::GetExtension(JSContext *cx, const nsAString& aName, ErrorResult& r
     for (size_t i = 0; i < size_t(WebGLExtensionID_max); i++)
     {
         WebGLExtensionID extension = WebGLExtensionID(i);
-        
+
         if (CompareWebGLExtensionName(name, GetExtensionString(extension))) {
             ext = extension;
             break;
@@ -251,6 +262,9 @@ WebGLContext::EnableExtension(WebGLExtensionID ext)
         case WEBGL_debug_renderer_info:
             obj = new WebGLExtensionDebugRendererInfo(this);
             break;
+        case WEBGL_debug_shaders:
+            obj = new WebGLExtensionDebugShaders(this);
+            break;
         case WEBGL_depth_texture:
             obj = new WebGLExtensionDepthTexture(this);
             break;
diff --git a/content/canvas/src/WebGLContextGL.cpp b/content/canvas/src/WebGLContextGL.cpp
index b127b3197888..bf85c7b5a9df 100644
--- a/content/canvas/src/WebGLContextGL.cpp
+++ b/content/canvas/src/WebGLContextGL.cpp
@@ -3299,13 +3299,17 @@ WebGLContext::CompileShader(WebGLShader *shader)
                                                     nsDependentCString(mapped_name)));
             }
 
-            size_t len = 0;
-            ShGetInfo(compiler, SH_OBJECT_CODE_LENGTH, &len);
+            size_t lenWithNull = 0;
+            ShGetInfo(compiler, SH_OBJECT_CODE_LENGTH, &lenWithNull);
+            MOZ_ASSERT(lenWithNull >= 1);
+            size_t len = lenWithNull - 1;
 
             nsAutoCString translatedSrc;
-            translatedSrc.SetLength(len);
+            translatedSrc.SetLength(len); // Allocates len+1, for the null-term.
             ShGetObjectCode(compiler, translatedSrc.BeginWriting());
 
+            CopyASCIItoUTF16(translatedSrc, shader->mTranslatedSource);
+
             const char *ts = translatedSrc.get();
 
 #ifdef WEBGL2_BYPASS_ANGLE
@@ -3324,6 +3328,8 @@ WebGLContext::CompileShader(WebGLShader *shader)
             // that's really bad, as that means we can't be 100% conformant. We should work towards always
             // using ANGLE identifier mapping.
             gl->fShaderSource(shadername, 1, &s, nullptr);
+
+            CopyASCIItoUTF16(s, shader->mTranslatedSource);
         }
 
         shader->SetTranslationSuccess();
@@ -3617,8 +3623,7 @@ WebGLContext::GetShaderPrecisionFormat(GLenum shadertype, GLenum precisiontype)
 void
 WebGLContext::GetShaderSource(WebGLShader *shader, nsAString& retval)
 {
-    if (IsContextLost())
-    {
+    if (IsContextLost()) {
         retval.SetIsVoid(true);
         return;
     }
@@ -3651,6 +3656,20 @@ WebGLContext::ShaderSource(WebGLShader *shader, const nsAString& source)
     shader->SetNeedsTranslation();
 }
 
+void
+WebGLContext::GetShaderTranslatedSource(WebGLShader *shader, nsAString& retval)
+{
+    if (IsContextLost()) {
+        retval.SetIsVoid(true);
+        return;
+    }
+
+    if (!ValidateObject("getShaderTranslatedSource: shader", shader))
+        return;
+
+    retval.Assign(shader->TranslatedSource());
+}
+
 GLenum WebGLContext::CheckedTexImage2D(GLenum target,
                                        GLint level,
                                        GLenum internalFormat,
diff --git a/content/canvas/src/WebGLExtensionDebugShaders.cpp b/content/canvas/src/WebGLExtensionDebugShaders.cpp
new file mode 100644
index 000000000000..eb12d34fdb73
--- /dev/null
+++ b/content/canvas/src/WebGLExtensionDebugShaders.cpp
@@ -0,0 +1,36 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "WebGLContext.h"
+#include "WebGLExtensions.h"
+#include "mozilla/dom/WebGLRenderingContextBinding.h"
+
+using namespace mozilla;
+
+WebGLExtensionDebugShaders::WebGLExtensionDebugShaders(WebGLContext* context)
+    : WebGLExtensionBase(context)
+{
+}
+
+WebGLExtensionDebugShaders::~WebGLExtensionDebugShaders()
+{
+}
+
+/* If no source has been defined, compileShader() has not been called,
+ * or the translation has failed for shader, an empty string is
+ * returned; otherwise, return the translated source.
+ */
+void
+WebGLExtensionDebugShaders::GetTranslatedShaderSource(WebGLShader* shader,
+                                                      nsAString& retval)
+{
+    mContext->GetShaderTranslatedSource(shader, retval);
+
+    if (retval.IsVoid()) {
+        CopyASCIItoUTF16("", retval);
+    }
+}
+
+IMPL_WEBGL_EXTENSION_GOOP(WebGLExtensionDebugShaders)
diff --git a/content/canvas/src/WebGLExtensions.h b/content/canvas/src/WebGLExtensions.h
index b58d5cbbdff4..2047dceedffa 100644
--- a/content/canvas/src/WebGLExtensions.h
+++ b/content/canvas/src/WebGLExtensions.h
@@ -76,6 +76,18 @@ public:
     DECL_WEBGL_EXTENSION_GOOP
 };
 
+class WebGLExtensionDebugShaders
+    : public WebGLExtensionBase
+{
+public:
+    WebGLExtensionDebugShaders(WebGLContext*);
+    virtual ~WebGLExtensionDebugShaders();
+
+    void GetTranslatedShaderSource(WebGLShader* shader, nsAString& retval);
+
+    DECL_WEBGL_EXTENSION_GOOP
+};
+
 class WebGLExtensionDepthTexture
     : public WebGLExtensionBase
 {
diff --git a/content/canvas/src/WebGLShader.h b/content/canvas/src/WebGLShader.h
index ef4fe6b3d57b..64bb8d72f092 100644
--- a/content/canvas/src/WebGLShader.h
+++ b/content/canvas/src/WebGLShader.h
@@ -72,6 +72,8 @@ public:
 
     const nsCString& TranslationLog() const { return mTranslationLog; }
 
+    const nsString& TranslatedSource() const { return mTranslatedSource; }
+
     WebGLContext *GetParentObject() const {
         return Context();
     }
@@ -87,6 +89,7 @@ protected:
     GLuint mGLName;
     GLenum mType;
     nsString mSource;
+    nsString mTranslatedSource;
     nsCString mTranslationLog; // The translation log should contain only ASCII characters
     bool mNeedsTranslation;
     nsTArray<WebGLMappedIdentifier> mAttributes;
diff --git a/content/canvas/src/moz.build b/content/canvas/src/moz.build
index 8ef6815056ca..6fcaa34381fb 100644
--- a/content/canvas/src/moz.build
+++ b/content/canvas/src/moz.build
@@ -48,6 +48,7 @@ if CONFIG['MOZ_WEBGL']:
         'WebGLExtensionCompressedTexturePVRTC.cpp',
         'WebGLExtensionCompressedTextureS3TC.cpp',
         'WebGLExtensionDebugRendererInfo.cpp',
+        'WebGLExtensionDebugShaders.cpp',
         'WebGLExtensionDepthTexture.cpp',
         'WebGLExtensionDrawBuffers.cpp',
         'WebGLExtensionElementIndexUint.cpp',
diff --git a/content/canvas/test/webgl/conformance/extensions/webgl-debug-shaders.html b/content/canvas/test/webgl/conformance/extensions/webgl-debug-shaders.html
index 947df8e32159..69340681cfad 100644
--- a/content/canvas/test/webgl/conformance/extensions/webgl-debug-shaders.html
+++ b/content/canvas/test/webgl/conformance/extensions/webgl-debug-shaders.html
@@ -75,9 +75,9 @@ function runTestEnabled() {
 
     // if no source has been defined or compileShader() has not been called,
     // getTranslatedShaderSource() should return an empty string.
-    shouldBeNull("ext.getTranslatedShaderSource(shader)");
+    shouldBe("ext.getTranslatedShaderSource(shader)", '""');
     gl.shaderSource(shader, source);
-    shouldBeNull("ext.getTranslatedShaderSource(shader)");
+    shouldBe("ext.getTranslatedShaderSource(shader)", '""');
     gl.compileShader(shader);
     shouldBeTrue("gl.getShaderParameter(shader, gl.COMPILE_STATUS)");
     var translatedSource = ext.getTranslatedShaderSource(shader);
diff --git a/content/canvas/test/webgl/non-conf-tests/mochitest.ini b/content/canvas/test/webgl/non-conf-tests/mochitest.ini
index cf5f41c5de48..91b8c2986def 100644
--- a/content/canvas/test/webgl/non-conf-tests/mochitest.ini
+++ b/content/canvas/test/webgl/non-conf-tests/mochitest.ini
@@ -5,6 +5,7 @@ support-files =
 
 [test_highp_fs.html]
 [test_no_arr_points.html]
+[test_privileged_exts.html]
 [test_webgl_available.html]
 [test_webgl_conformance.html]
 [test_webgl_request_context.html]
diff --git a/content/canvas/test/webgl/non-conf-tests/test_privileged_exts.html b/content/canvas/test/webgl/non-conf-tests/test_privileged_exts.html
new file mode 100644
index 000000000000..d84af4e7f03e
--- /dev/null
+++ b/content/canvas/test/webgl/non-conf-tests/test_privileged_exts.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<title>WebGL test: Check for privileged ext access.</title>
+<script src="/MochiKit/MochiKit.js"></script>
+<script src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" href="/tests/SimpleTest/test.css">
+<script src="webgl-util.js"></script>
+<script src="driver-info.js"></script>
+</head>
+<body>
+<canvas id="c"></canvas>
+<script>
+
+function TestExt(gl, name) {
+  var ext = gl.getExtension(name);
+  ok(!ext, 'Should not have access to \'' + name + '\'.');
+}
+
+(function() {
+  var gl = WebGLUtil.getWebGL('c');
+  if (!gl) {
+    todo(gl, 'Get GL working here first.');
+    return;
+  }
+
+  // Privileged extensions:
+  TestExt(gl, 'WEBGL_debug_renderer_info');
+})();
+
+</script>
+</body>
+</html>
diff --git a/content/media/webaudio/blink/IRC_Composite_C_R0195-incl.cpp b/content/media/webaudio/blink/IRC_Composite_C_R0195-incl.cpp
index 9fe14f3d8c08..daffb114fd35 100644
--- a/content/media/webaudio/blink/IRC_Composite_C_R0195-incl.cpp
+++ b/content/media/webaudio/blink/IRC_Composite_C_R0195-incl.cpp
@@ -416,15 +416,23 @@ const int16_t irc_composite_c_r0195_p090[][256] =
   {/* IRC_Composite_C_R0195_T000_P090.wav */
    {-1,1,-1,1,-1,1,-1,2,-2,2,-3,3,-3,4,-5,5,-7,8,-10,14,-25,-385,-133,-356,-344,-390,-312,-438,-400,-852,-107,-995,-245,-186,1358,-771,1473,28,-1710,-3762,-3025,4119,8200,5927,-785,1558,2250,1837,2098,631,-318,150,-77,1215,-23,792,865,600,981,659,366,950,511,766,502,516,589,299,331,571,105,609,462,485,538,594,470,640,393,432,325,604,259,355,336,454,33,263,182,-24,-124,121,-231,-50,-93,49,-230,-101,25,-196,-123,-21,-160,-161,-132,-136,-155,-268,-121,-146,-311,-112,-328,-201,-220,-280,-214,-304,-233,-227,-250,-242,-334,-256,-283,-393,-267,-285,-332,-331,-224,-295,-279,-171,-151,-361,-199,-239,-227,-317,-168,-211,-370,-182,-150,-343,-204,-192,-224,-319,-203,-137,-357,-146,-223,-237,-276,-162,-201,-262,-186,-209,-147,-267,-46,-252,-162,-146,-182,-199,-143,-218,-204,-108,-250,-163,-90,-241,-137,-125,-122,-272,-111,-188,-211,-160,-160,-164,-201,-231,-114,-175,-180,-212,-172,-181,-129,-130,-77,-150,-114,-39,12,-122,-9,-11,-46,-21,-4,7,-73,-20,-50,-21,-80,-102,2,-103,-66,-67,-8,-41,-119,-26,29,-208,3,-108,-34,-228,114,-196,-84,-28,1,-109,-92,77,-169,-27,48,-12,-79,3,-100,-44,-53,13,-103,-90,-14,-91,-23,-64,-21,-116}};
 
+struct Elevation
+{
+    /**
+     * An array of |count| impulse responses of 256 samples for the left ear.
+     * The impulse responses in each elevation are at equally spaced azimuths
+     * for a full 360 degree revolution, ordered clockwise from in front the
+     * listener.
+     */
+    const int16_t (*azimuths)[256];
+    int count;
+};
+
 /**
  * irc_composite_c_r0195 is an array with each element containing data for one
- * elevation.  For each elevation, |azimuths| is an array of |count| impulse
- * responses of 256 samples for the left ear.  The impulse responses in each
- * elevation are at equally spaced azimuths for a full 360 degree revolution,
- * ordered clockwise from in front the listener.
+ * elevation.
  */
-const struct { const int16_t (*azimuths)[256]; int count; }
-  irc_composite_c_r0195[] =
+const Elevation irc_composite_c_r0195[] =
   {{irc_composite_c_r0195_p315, MOZ_ARRAY_LENGTH(irc_composite_c_r0195_p315)},
    {irc_composite_c_r0195_p330, MOZ_ARRAY_LENGTH(irc_composite_c_r0195_p330)},
    {irc_composite_c_r0195_p345, MOZ_ARRAY_LENGTH(irc_composite_c_r0195_p345)},
diff --git a/content/svg/content/src/SVGFEOffsetElement.cpp b/content/svg/content/src/SVGFEOffsetElement.cpp
index 58c348e12d98..f1995ac3345d 100644
--- a/content/svg/content/src/SVGFEOffsetElement.cpp
+++ b/content/svg/content/src/SVGFEOffsetElement.cpp
@@ -6,7 +6,6 @@
 #include "mozilla/dom/SVGFEOffsetElement.h"
 #include "mozilla/dom/SVGFEOffsetElementBinding.h"
 #include "nsSVGFilterInstance.h"
-#include "gfxContext.h"
 
 NS_IMPL_NS_NEW_NAMESPACED_SVG_ELEMENT(FEOffset)
 
@@ -60,15 +59,6 @@ SVGFEOffsetElement::Dy()
   return mNumberAttributes[DY].ToDOMAnimatedNumber(this);
 }
 
-nsIntPoint
-SVGFEOffsetElement::GetOffset(const nsSVGFilterInstance& aInstance)
-{
-  return nsIntPoint(int32_t(aInstance.GetPrimitiveNumber(
-                              SVGContentUtils::X, &mNumberAttributes[DX])),
-                    int32_t(aInstance.GetPrimitiveNumber(
-                              SVGContentUtils::Y, &mNumberAttributes[DY])));
-}
-
 FilterPrimitiveDescription
 SVGFEOffsetElement::GetPrimitiveDescription(nsSVGFilterInstance* aInstance,
                                             const IntRect& aFilterSubregion,
@@ -76,8 +66,11 @@ SVGFEOffsetElement::GetPrimitiveDescription(nsSVGFilterInstance* aInstance,
                                             nsTArray<RefPtr<SourceSurface>>& aInputImages)
 {
   FilterPrimitiveDescription descr(FilterPrimitiveDescription::eOffset);
-  nsIntPoint offset = GetOffset(*aInstance);
-  descr.Attributes().Set(eOffsetOffset, IntPoint(offset.x, offset.y));
+  IntPoint offset(int32_t(aInstance->GetPrimitiveNumber(
+                            SVGContentUtils::X, &mNumberAttributes[DX])),
+                  int32_t(aInstance->GetPrimitiveNumber(
+                            SVGContentUtils::Y, &mNumberAttributes[DY])));
+  descr.Attributes().Set(eOffsetOffset, offset);
   return descr;
 }
 
diff --git a/content/svg/content/src/SVGFEOffsetElement.h b/content/svg/content/src/SVGFEOffsetElement.h
index e63dc194f0a2..b0cb3b04359a 100644
--- a/content/svg/content/src/SVGFEOffsetElement.h
+++ b/content/svg/content/src/SVGFEOffsetElement.h
@@ -49,8 +49,6 @@ public:
   already_AddRefed<SVGAnimatedNumber> Dy();
 
 protected:
-  nsIntPoint GetOffset(const nsSVGFilterInstance& aInstance);
-
   virtual NumberAttributesInfo GetNumberInfo() MOZ_OVERRIDE;
   virtual StringAttributesInfo GetStringInfo() MOZ_OVERRIDE;
 
diff --git a/content/svg/content/src/SVGFilterElement.cpp b/content/svg/content/src/SVGFilterElement.cpp
index 79a1ba28bb23..b5cda94fb037 100644
--- a/content/svg/content/src/SVGFilterElement.cpp
+++ b/content/svg/content/src/SVGFilterElement.cpp
@@ -160,7 +160,7 @@ SVGFilterElement::Invalidate()
     nsTObserverArray<nsIMutationObserver*>::ForwardIterator iter(*observers);
     while (iter.HasMore()) {
       nsCOMPtr<nsIMutationObserver> obs(iter.GetNext());
-      nsCOMPtr<nsISVGFilterProperty> filter = do_QueryInterface(obs);
+      nsCOMPtr<nsISVGFilterReference> filter = do_QueryInterface(obs);
       if (filter)
         filter->Invalidate();
     }
diff --git a/docshell/base/LoadContext.cpp b/docshell/base/LoadContext.cpp
index a4419dadc29d..59f203301022 100644
--- a/docshell/base/LoadContext.cpp
+++ b/docshell/base/LoadContext.cpp
@@ -89,6 +89,26 @@ LoadContext::SetPrivateBrowsing(bool aUsePrivateBrowsing)
   return NS_ERROR_UNEXPECTED;
 }
 
+NS_IMETHODIMP
+LoadContext::GetUseRemoteTabs(bool* aUseRemoteTabs)
+{
+  MOZ_ASSERT(mIsNotNull);
+
+  NS_ENSURE_ARG_POINTER(aUseRemoteTabs);
+
+  *aUseRemoteTabs = mUseRemoteTabs;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+LoadContext::SetRemoteTabs(bool aUseRemoteTabs)
+{
+  MOZ_ASSERT(mIsNotNull);
+
+  // We shouldn't need this on parent...
+  return NS_ERROR_UNEXPECTED;
+}
+
 NS_IMETHODIMP
 LoadContext::GetIsInBrowserElement(bool* aIsInBrowserElement)
 {
diff --git a/docshell/base/LoadContext.h b/docshell/base/LoadContext.h
index 9cbc040f1fb9..48a7b41fca76 100644
--- a/docshell/base/LoadContext.h
+++ b/docshell/base/LoadContext.h
@@ -48,6 +48,7 @@ public:
     , mAppId(aAppId)
     , mIsContent(aToCopy.mIsContent)
     , mUsePrivateBrowsing(aToCopy.mUsePrivateBrowsing)
+    , mUseRemoteTabs(aToCopy.mUseRemoteTabs)
     , mIsInBrowserElement(aInBrowser)
 #ifdef DEBUG
     , mIsNotNull(aToCopy.mIsNotNull)
@@ -58,11 +59,13 @@ public:
               uint32_t aAppId,
               bool aIsContent,
               bool aUsePrivateBrowsing,
+              bool aUseRemoteTabs,
               bool aIsInBrowserElement)
     : mTopFrameElement(do_GetWeakReference(aTopFrameElement))
     , mAppId(aAppId)
     , mIsContent(aIsContent)
     , mUsePrivateBrowsing(aUsePrivateBrowsing)
+    , mUseRemoteTabs(aUseRemoteTabs)
     , mIsInBrowserElement(aIsInBrowserElement)
 #ifdef DEBUG
     , mIsNotNull(true)
@@ -75,6 +78,7 @@ public:
     , mAppId(aAppId)
     , mIsContent(false)
     , mUsePrivateBrowsing(false)
+    , mUseRemoteTabs(false)
     , mIsInBrowserElement(false)
 #ifdef DEBUG
     , mIsNotNull(true)
@@ -86,6 +90,7 @@ private:
   uint32_t      mAppId;
   bool          mIsContent;
   bool          mUsePrivateBrowsing;
+  bool          mUseRemoteTabs;
   bool          mIsInBrowserElement;
 #ifdef DEBUG
   bool          mIsNotNull;
diff --git a/docshell/base/SerializedLoadContext.cpp b/docshell/base/SerializedLoadContext.cpp
index e67bdcdd8bf5..ff61184b6c2a 100644
--- a/docshell/base/SerializedLoadContext.cpp
+++ b/docshell/base/SerializedLoadContext.cpp
@@ -59,6 +59,7 @@ SerializedLoadContext::Init(nsILoadContext* aLoadContext)
     mIsPrivateBitValid = true;
     aLoadContext->GetIsContent(&mIsContent);
     aLoadContext->GetUsePrivateBrowsing(&mUsePrivateBrowsing);
+    aLoadContext->GetUseRemoteTabs(&mUseRemoteTabs);
     aLoadContext->GetAppId(&mAppId);
     aLoadContext->GetIsInBrowserElement(&mIsInBrowserElement);
   } else {
@@ -68,6 +69,7 @@ SerializedLoadContext::Init(nsILoadContext* aLoadContext)
     // we won't be GetInterfaced to nsILoadContext
     mIsContent = true;
     mUsePrivateBrowsing = false;
+    mUseRemoteTabs = false;
     mAppId = 0;
     mIsInBrowserElement = false;
   }
diff --git a/docshell/base/SerializedLoadContext.h b/docshell/base/SerializedLoadContext.h
index fb19109cbfad..f02206922f88 100644
--- a/docshell/base/SerializedLoadContext.h
+++ b/docshell/base/SerializedLoadContext.h
@@ -54,6 +54,7 @@ public:
   bool          mIsPrivateBitValid;
   bool          mIsContent;
   bool          mUsePrivateBrowsing;
+  bool          mUseRemoteTabs;
   bool          mIsInBrowserElement;
   uint32_t      mAppId;
 };
@@ -70,6 +71,7 @@ struct ParamTraits<SerializedLoadContext>
     WriteParam(aMsg, aParam.mIsContent);
     WriteParam(aMsg, aParam.mIsPrivateBitValid);
     WriteParam(aMsg, aParam.mUsePrivateBrowsing);
+    WriteParam(aMsg, aParam.mUseRemoteTabs);
     WriteParam(aMsg, aParam.mAppId);
     WriteParam(aMsg, aParam.mIsInBrowserElement);
   }
@@ -80,6 +82,7 @@ struct ParamTraits<SerializedLoadContext>
         !ReadParam(aMsg, aIter, &aResult->mIsContent)  ||
         !ReadParam(aMsg, aIter, &aResult->mIsPrivateBitValid)  ||
         !ReadParam(aMsg, aIter, &aResult->mUsePrivateBrowsing)  ||
+        !ReadParam(aMsg, aIter, &aResult->mUseRemoteTabs)  ||
         !ReadParam(aMsg, aIter, &aResult->mAppId)  ||
         !ReadParam(aMsg, aIter, &aResult->mIsInBrowserElement)) {
       return false;
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 42102496dfed..67a88448c47a 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -829,6 +829,7 @@ nsDocShell::nsDocShell():
     mIsAppTab(false),
     mUseGlobalHistory(false),
     mInPrivateBrowsing(false),
+    mUseRemoteTabs(false),
     mDeviceSizeIsPageSize(false),
     mCanExecuteScripts(false),
     mFiredUnloadEvent(false),
@@ -2245,6 +2246,29 @@ nsDocShell::SetPrivateBrowsing(bool aUsePrivateBrowsing)
     return NS_OK;
 }
 
+NS_IMETHODIMP
+nsDocShell::GetUseRemoteTabs(bool* aUseRemoteTabs)
+{
+    NS_ENSURE_ARG_POINTER(aUseRemoteTabs);
+
+    *aUseRemoteTabs = mUseRemoteTabs;
+    return NS_OK;
+}
+
+NS_IMETHODIMP
+nsDocShell::SetRemoteTabs(bool aUseRemoteTabs)
+{
+#ifdef MOZ_CRASHREPORTER
+    if (aUseRemoteTabs) {
+        CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("DOMIPCEnabled"),
+                                           NS_LITERAL_CSTRING("1"));
+    }
+#endif
+
+    mUseRemoteTabs = aUseRemoteTabs;
+    return NS_OK;
+}
+
 NS_IMETHODIMP
 nsDocShell::SetAffectPrivateSessionLifetime(bool aAffectLifetime)
 {
diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
index c4a3be42f9ce..7756f17eb107 100644
--- a/docshell/base/nsDocShell.h
+++ b/docshell/base/nsDocShell.h
@@ -213,6 +213,8 @@ public:
     NS_IMETHOD GetUsePrivateBrowsing(bool*);
     NS_IMETHOD SetUsePrivateBrowsing(bool);
     NS_IMETHOD SetPrivateBrowsing(bool);
+    NS_IMETHOD GetUseRemoteTabs(bool*);
+    NS_IMETHOD SetRemoteTabs(bool);
 
     // Restores a cached presentation from history (mLSHE).
     // This method swaps out the content viewer and simulates loads for
@@ -830,6 +832,7 @@ protected:
     bool                       mIsAppTab;
     bool                       mUseGlobalHistory;
     bool                       mInPrivateBrowsing;
+    bool                       mUseRemoteTabs;
     bool                       mDeviceSizeIsPageSize;
 
     // Because scriptability depends on the mAllowJavascript values of our
diff --git a/docshell/base/nsILoadContext.idl b/docshell/base/nsILoadContext.idl
index e3dba3135f51..87327c5883f9 100644
--- a/docshell/base/nsILoadContext.idl
+++ b/docshell/base/nsILoadContext.idl
@@ -14,7 +14,7 @@ interface nsIDOMElement;
  * can be queried for various information about where the load is
  * happening.
  */
-[scriptable, uuid(d0029474-0cc4-42fd-bb21-d9ff22f5293c)]
+[scriptable, uuid(852ed1f0-8ec0-11e3-baa8-0800200c9a66)]
 interface nsILoadContext : nsISupports
 {
   /**
@@ -66,6 +66,11 @@ interface nsILoadContext : nsISupports
    */
   attribute boolean usePrivateBrowsing;
 
+  /**
+   * Attribute that determines if remote (out-of-process) tabs should be used.
+   */
+  readonly attribute boolean useRemoteTabs;
+
 %{C++
   /**
    * De-XPCOMed getter to make call-sites cleaner.
@@ -75,6 +80,12 @@ interface nsILoadContext : nsISupports
     GetUsePrivateBrowsing(&usingPB);
     return usingPB;
   }
+
+  bool UseRemoteTabs() {
+    bool usingRT;
+    GetUseRemoteTabs(&usingRT);
+    return usingRT;
+  }
 %}
 
   /**
@@ -82,6 +93,11 @@ interface nsILoadContext : nsISupports
    */
   [noscript] void SetPrivateBrowsing(in boolean aInPrivateBrowsing);
 
+  /**
+   * Set the remote tabs state of the load context, meant to be used internally.
+   */
+  [noscript] void SetRemoteTabs(in boolean aUseRemoteTabs);
+
   /**
    * Returns true iff the load is occurring inside a browser element.
    */
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 61b09b7f0c6c..c1dc3af8dcde 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -232,6 +232,10 @@ class nsIScriptTimeoutHandler;
 #endif // check
 #include "AccessCheck.h"
 
+#ifdef ANDROID
+#include <android/log.h>
+#endif
+
 #ifdef PR_LOGGING
 static PRLogModuleInfo* gDOMLeakPRLog;
 #endif
@@ -5809,7 +5813,31 @@ nsGlobalWindow::Dump(const nsAString& aStr)
     return NS_OK;
   }
 
-  PrintToDebugger(aStr, gDumpFile ? gDumpFile : stdout);
+  char *cstr = ToNewUTF8String(aStr);
+
+#if defined(XP_MACOSX)
+  // have to convert \r to \n so that printing to the console works
+  char *c = cstr, *cEnd = cstr + strlen(cstr);
+  while (c < cEnd) {
+    if (*c == '\r')
+      *c = '\n';
+    c++;
+  }
+#endif
+
+  if (cstr) {
+#ifdef XP_WIN
+    PrintToDebugger(cstr);
+#endif
+#ifdef ANDROID
+    __android_log_write(ANDROID_LOG_INFO, "GeckoDump", cstr);
+#endif
+    FILE *fp = gDumpFile ? gDumpFile : stdout;
+    fputs(cstr, fp);
+    fflush(fp);
+    nsMemory::Free(cstr);
+  }
+
   return NS_OK;
 }
 
diff --git a/dom/bindings/Bindings.conf b/dom/bindings/Bindings.conf
index 347071376d3d..42acf2432668 100644
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@@ -1370,6 +1370,11 @@ DOMInterfaces = {
     'headerFile': 'WebGLExtensions.h'
 },
 
+'WebGLExtensionDebugShaders': {
+    'nativeType': 'mozilla::WebGLExtensionDebugShaders',
+    'headerFile': 'WebGLExtensions.h'
+},
+
 'WebGLExtensionElementIndexUint': {
     'nativeType': 'mozilla::WebGLExtensionElementIndexUint',
     'headerFile': 'WebGLExtensions.h'
diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index d01b2d017ef6..30a86260f1dc 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -696,6 +696,8 @@ TabChild::Init()
   MOZ_ASSERT(loadContext);
   loadContext->SetPrivateBrowsing(
       mChromeFlags & nsIWebBrowserChrome::CHROME_PRIVATE_WINDOW);
+  loadContext->SetRemoteTabs(
+      mChromeFlags & nsIWebBrowserChrome::CHROME_REMOTE_WINDOW);
 
   nsCOMPtr<nsIWebProgress> webProgress = do_GetInterface(docShell);
   NS_ENSURE_TRUE(webProgress, NS_ERROR_FAILURE);
diff --git a/dom/ipc/TabParent.cpp b/dom/ipc/TabParent.cpp
index 2e1b09c81b6e..54b644226eb4 100644
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -1919,6 +1919,7 @@ TabParent::GetLoadContext()
                                   OwnOrContainingAppId(),
                                   true /* aIsContent */,
                                   mChromeFlags & nsIWebBrowserChrome::CHROME_PRIVATE_WINDOW,
+                                  mChromeFlags & nsIWebBrowserChrome::CHROME_REMOTE_WINDOW,
                                   IsBrowserElement());
     mLoadContext = loadContext;
   }
diff --git a/dom/plugins/test/mochitest/mochitest.ini b/dom/plugins/test/mochitest/mochitest.ini
index 0882a6e03f9d..0b076b83e4e6 100644
--- a/dom/plugins/test/mochitest/mochitest.ini
+++ b/dom/plugins/test/mochitest/mochitest.ini
@@ -32,6 +32,7 @@ support-files =
 [test_bug813906.html]
 [test_bug854082.html]
 [test_bug863792.html]
+[test_bug967694.html]
 [test_cocoa_focus.html]
 skip-if = toolkit != "cocoa"
 support-files = cocoa_focus.html
diff --git a/dom/plugins/test/mochitest/test_bug967694.html b/dom/plugins/test/mochitest/test_bug967694.html
new file mode 100644
index 000000000000..eae26419f047
--- /dev/null
+++ b/dom/plugins/test/mochitest/test_bug967694.html
@@ -0,0 +1,78 @@
+<!doctype html>
+<html>
+<head>
+  <title>Test for Bug 967694</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="utils.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+
+  <meta http-equiv="content-type" content="text/html; charset=utf-8">
+</head>
+<body>
+<script type="application/javascript">
+
+// Touching a plugin from chrome scope should not spawn it, bug should
+// synchronously spawn it from content scope
+
+setTestPluginEnabledState(SpecialPowers.Ci.nsIPluginTag.STATE_ENABLED);
+
+var plugin;
+var spPlugin;
+
+function recreatePlugin() {
+  if (plugin) {
+    document.body.removeChild(plugin);
+  }
+  plugin = document.createElement("embed");
+  plugin.type = "application/x-test";
+
+  document.body.appendChild(plugin);
+  // Plugin should now be queued for async spawning.
+  spPlugin = SpecialPowers.wrap(plugin);
+
+  is(spPlugin.displayedType, spPlugin.TYPE_PLUGIN, "Should be configured as plugin");
+  ok(!spPlugin.hasRunningPlugin, "Should not be spawned yet");
+}
+
+recreatePlugin();
+
+// Try various JS operations with chrome context
+var thrown = false;
+// Get and set non-existent Property
+var hi = spPlugin._testShouldntExist;
+spPlugin._testShouldntExist = 5;
+// Call some test-plugin function
+try {
+  var val = spPlugin.getObjectValue();
+} catch (e) {
+  thrown = true;
+}
+
+ok(thrown, "Function call should have thrown");
+ok(!spPlugin.hasRunningPlugin, "Plugin should not have spawned");
+
+// Try property access from content
+var hi = plugin._testShouldntExistContent;
+ok(spPlugin.hasRunningPlugin, "Should've caused plugin to spawn");
+
+// Property set
+recreatePlugin();
+plugin._testShouldntExistContent = 5;
+ok(spPlugin.hasRunningPlugin, "Should've caused plugin to spawn");
+
+// Call test plugin function. Should succeed.
+recreatePlugin();
+thrown = false;
+try {
+  var value = plugin.getObjectValue();
+} catch (e) {
+  thrown = true;
+}
+
+ok(!thrown, "Call should have succeeded");
+ok(spPlugin.hasRunningPlugin, "Call should have synchronously spawned plugin");
+ok(plugin.checkObjectValue(value), "Plugin should recognize self");
+
+</script>
+</body>
+</html>
diff --git a/dom/plugins/test/mochitest/test_clear_site_data.html b/dom/plugins/test/mochitest/test_clear_site_data.html
index 749376d8deff..4836fca1409d 100644
--- a/dom/plugins/test/mochitest/test_clear_site_data.html
+++ b/dom/plugins/test/mochitest/test_clear_site_data.html
@@ -21,12 +21,17 @@
     const FLAG_CLEAR_ALL = pluginHostIface.FLAG_CLEAR_ALL;
     const FLAG_CLEAR_CACHE = pluginHostIface.FLAG_CLEAR_CACHE;
 
-    // Make sure clearing by timerange is supported.
     var p = document.getElementById("plugin1");
-    p.setSitesWithDataCapabilities(true);
 
-    ok(PluginUtils.withTestPlugin(runTest), "Test plugin found");
-    SimpleTest.finish();
+    // Since we're running with chrome permissions, accessing the plugin wont
+    // synchronously spawn it -- wait for the async spawning to finish.
+    SimpleTest.executeSoon(function() {
+      // Make sure clearing by timerange is supported.
+      p.setSitesWithDataCapabilities(true);
+
+      ok(PluginUtils.withTestPlugin(runTest), "Test plugin found");
+      SimpleTest.finish();
+    });
 
     function stored(needles) {
       var something = pluginHost.siteHasData(this.pluginTag, null);
diff --git a/dom/src/storage/DOMStorage.cpp b/dom/src/storage/DOMStorage.cpp
index 20a69a7a4b0c..a2d81819540c 100644
--- a/dom/src/storage/DOMStorage.cpp
+++ b/dom/src/storage/DOMStorage.cpp
@@ -161,14 +161,15 @@ namespace {
 class StorageNotifierRunnable : public nsRunnable
 {
 public:
-  StorageNotifierRunnable(nsISupports* aSubject)
-    : mSubject(aSubject)
+  StorageNotifierRunnable(nsISupports* aSubject, const char16_t* aType)
+    : mSubject(aSubject), mType(aType)
   { }
 
   NS_DECL_NSIRUNNABLE
 
 private:
   nsCOMPtr<nsISupports> mSubject;
+  const char16_t* mType;
 };
 
 NS_IMETHODIMP
@@ -177,7 +178,7 @@ StorageNotifierRunnable::Run()
   nsCOMPtr<nsIObserverService> observerService =
     mozilla::services::GetObserverService();
   if (observerService) {
-    observerService->NotifyObservers(mSubject, "dom-storage2-changed", nullptr);
+    observerService->NotifyObservers(mSubject, "dom-storage2-changed", mType);
   }
   return NS_OK;
 }
@@ -207,7 +208,11 @@ DOMStorage::BroadcastChangeNotification(const nsSubstring& aKey,
     return;
   }
 
-  nsRefPtr<StorageNotifierRunnable> r = new StorageNotifierRunnable(event);
+  nsRefPtr<StorageNotifierRunnable> r =
+    new StorageNotifierRunnable(event,
+                                GetType() == LocalStorage
+                                  ? MOZ_UTF16("localStorage")
+                                  : MOZ_UTF16("sessionStorage"));
   NS_DispatchToMainThread(r);
 }
 
diff --git a/dom/system/OSFileConstants.cpp b/dom/system/OSFileConstants.cpp
index 2452201d0aab..38aab2e7f51e 100644
--- a/dom/system/OSFileConstants.cpp
+++ b/dom/system/OSFileConstants.cpp
@@ -13,9 +13,13 @@
 #include "unistd.h"
 #include "dirent.h"
 #include "sys/stat.h"
-#if !defined(ANDROID)
+#if defined(ANDROID)
+#include <sys/vfs.h>
+#define statvfs statfs
+#else
+#include "sys/statvfs.h"
 #include <spawn.h>
-#endif // !defined(ANDROID)
+#endif // defined(ANDROID)
 #endif // defined(XP_UNIX)
 
 #if defined(XP_LINUX)
@@ -526,6 +530,9 @@ static const dom::ConstantSpec gLibcProperties[] =
   // The size of |time_t|.
   { "OSFILE_SIZEOF_TIME_T", INT_TO_JSVAL(sizeof (time_t)) },
 
+  // The size of |fsblkcnt_t|.
+  { "OSFILE_SIZEOF_FSBLKCNT_T", INT_TO_JSVAL(sizeof (fsblkcnt_t)) },
+
 #if !defined(ANDROID)
   // The size of |posix_spawn_file_actions_t|.
   { "OSFILE_SIZEOF_POSIX_SPAWN_FILE_ACTIONS_T", INT_TO_JSVAL(sizeof (posix_spawn_file_actions_t)) },
@@ -585,6 +592,13 @@ static const dom::ConstantSpec gLibcProperties[] =
   { "OSFILE_OFFSETOF_STAT_ST_BIRTHTIME", INT_TO_JSVAL(offsetof (struct stat, st_birthtime)) },
 #endif // defined(_DARWIN_FEATURE_64_BIT_INODE)
 
+  // Defining |statvfs|
+
+  { "OSFILE_SIZEOF_STATVFS", INT_TO_JSVAL(sizeof (struct statvfs)) },
+
+  { "OSFILE_OFFSETOF_STATVFS_F_BSIZE", INT_TO_JSVAL(offsetof (struct statvfs, f_bsize)) },
+  { "OSFILE_OFFSETOF_STATVFS_F_BAVAIL", INT_TO_JSVAL(offsetof (struct statvfs, f_bavail)) },
+
 #endif // defined(XP_UNIX)
 
 
diff --git a/dom/tests/mochitest/storageevent/mochitest.ini b/dom/tests/mochitest/storageevent/mochitest.ini
index f953d06ff880..e16d9cd2e965 100644
--- a/dom/tests/mochitest/storageevent/mochitest.ini
+++ b/dom/tests/mochitest/storageevent/mochitest.ini
@@ -12,5 +12,6 @@ support-files =
 
 [test_storageLocalStorageEventCheckNoPropagation.html]
 [test_storageLocalStorageEventCheckPropagation.html]
+[test_storageNotifications.html]
 [test_storageSessionStorageEventCheckNoPropagation.html]
 [test_storageSessionStorageEventCheckPropagation.html]
diff --git a/dom/tests/mochitest/storageevent/test_storageNotifications.html b/dom/tests/mochitest/storageevent/test_storageNotifications.html
new file mode 100644
index 000000000000..8d11a5a77827
--- /dev/null
+++ b/dom/tests/mochitest/storageevent/test_storageNotifications.html
@@ -0,0 +1,127 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>sessionStorage basic test</title>
+
+<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+
+<script type="application/javascript;version=1.7">
+
+var expectedTypes = [
+  "localStorage",
+  "localStorage",
+  "sessionStorage",
+  "localStorage",
+  "sessionStorage",
+  "sessionStorage",
+  "localStorage",
+  "sessionStorage",
+  "localStorage",
+  "sessionStorage",
+  "localStorage",
+  "sessionStorage",
+  "sessionStorage",
+  "localStorage",
+  "sessionStorage",
+  "localStorage",
+];
+
+var tests = Tests();
+function setup() {
+  sessionStorage.clear();
+  SimpleTest.executeSoon(function() {
+    tests.next();
+  });
+}
+
+function Tests()
+{
+  // Initially check the both storages are empty
+  is(sessionStorage.length, 0, "Session storage is empty [1]");
+  is(localStorage.length, 0, "Local storage is empty [1]");
+
+  var onStorageChanged = {
+    observe: function(subject, topic, type) {
+      if (topic == "dom-storage2-changed") {
+        ok(expectedTypes.length > 0, "Not more then expected events encountered");
+        is(type, expectedTypes.shift(), "Expected type of the storage notificaiton");
+        tests.next();
+      }
+    }
+  }
+
+  // Listen for dom-storage2-changed notification
+  SpecialPowers.Services.obs.addObserver(onStorageChanged,
+    "dom-storage2-changed", false);
+
+  // add an empty-value key
+  localStorage.setItem("empty", "");
+  yield undefined;
+
+  localStorage.setItem("empty", "value-1");
+  yield undefined;
+
+  sessionStorage.setItem("empty", "");
+  yield undefined;
+
+  localStorage.removeItem("empty");
+  yield undefined;
+
+  sessionStorage.setItem("empty", "value-1");
+  yield undefined;
+
+  sessionStorage.removeItem("empty");
+  yield undefined;
+
+  localStorage.setItem("key1", "value-1");
+  yield undefined;
+
+  sessionStorage.setItem("key2", "value-2");
+  yield undefined;
+
+  localStorage.setItem("key1", "value-1-2");
+  yield undefined;
+
+  sessionStorage.setItem("key2", "value-2-2");
+  yield undefined;
+
+  localStorage.setItem("key3", "value-3");
+  yield undefined;
+
+  sessionStorage.setItem("key4", "value-4");
+  yield undefined;
+
+  sessionStorage.removeItem("key4");
+  yield undefined;
+
+  localStorage.setItem("key4", "value-4");
+  yield undefined;
+
+  sessionStorage.clear();
+  yield undefined;
+
+  localStorage.clear();
+  yield undefined;
+
+  SimpleTest.executeSoon(function () {
+    SpecialPowers.Services.obs.removeObserver(onStorageChanged,
+      "dom-storage2-changed", false);
+    is(expectedTypes.length, 0, "received the correct number of events");
+
+    sessionStorage.clear();
+    localStorage.clear();
+    tests = null;
+    SimpleTest.finish();
+  });
+}
+
+SimpleTest.waitForExplicitFinish();
+
+</script>
+
+</head>
+
+<body onload="setup();">
+
+</body>
+</html>
diff --git a/dom/webidl/WebGLRenderingContext.webidl b/dom/webidl/WebGLRenderingContext.webidl
index 4fe15ea0aaf6..be3dd3018ea7 100644
--- a/dom/webidl/WebGLRenderingContext.webidl
+++ b/dom/webidl/WebGLRenderingContext.webidl
@@ -805,6 +805,12 @@ interface WebGLExtensionDebugRendererInfo
     const GLenum UNMASKED_RENDERER_WEBGL      = 0x9246;
 };
 
+[NoInterfaceObject]
+interface WebGLExtensionDebugShaders
+{
+    DOMString getTranslatedShaderSource(WebGLShader? shader);
+};
+
 [NoInterfaceObject]
 interface WebGLExtensionDepthTexture
 {
diff --git a/dom/workers/WorkerScope.cpp b/dom/workers/WorkerScope.cpp
index ed39af8ea419..f66f5ae29277 100644
--- a/dom/workers/WorkerScope.cpp
+++ b/dom/workers/WorkerScope.cpp
@@ -7,11 +7,14 @@
 #include "WorkerScope.h"
 
 #include "jsapi.h"
-#include "mozilla/Debug.h"
 #include "mozilla/dom/FunctionBinding.h"
 #include "mozilla/dom/DedicatedWorkerGlobalScopeBinding.h"
 #include "mozilla/dom/SharedWorkerGlobalScopeBinding.h"
 
+#ifdef ANDROID
+#include <android/log.h>
+#endif
+
 #include "Console.h"
 #include "Location.h"
 #include "Navigator.h"
@@ -258,8 +261,13 @@ WorkerGlobalScope::Dump(const Optional<nsAString>& aString) const
     return;
   }
 
-  PrintToDebugger(aString.Value(), stdout, kPrintToStream
-                                           | kPrintInfoLog);
+  NS_ConvertUTF16toUTF8 str(aString.Value());
+
+#ifdef ANDROID
+  __android_log_print(ANDROID_LOG_INFO, "Gecko", "%s", str.get());
+#endif
+  fputs(str.get(), stdout);
+  fflush(stdout);
 }
 
 DedicatedWorkerGlobalScope::DedicatedWorkerGlobalScope(WorkerPrivate* aWorkerPrivate)
diff --git a/embedding/browser/webBrowser/nsIWebBrowserChrome.idl b/embedding/browser/webBrowser/nsIWebBrowserChrome.idl
index 30f55565957a..e7a43150a8c1 100644
--- a/embedding/browser/webBrowser/nsIWebBrowserChrome.idl
+++ b/embedding/browser/webBrowser/nsIWebBrowserChrome.idl
@@ -80,6 +80,9 @@ interface nsIWebBrowserChrome : nsISupports
     // Whether this was opened by nsGlobalWindow::ShowModalDialog.
     const unsigned long CHROME_MODAL_CONTENT_WINDOW   = 0x00080000;
 
+    // Whether this window should use remote (out-of-process) tabs.
+    const unsigned long CHROME_REMOTE_WINDOW          = 0x00100000;
+
     // Prevents new window animations on Mac OS X Lion.  Ignored on other
     // platforms.
     const unsigned long CHROME_MAC_SUPPRESS_ANIMATION = 0x01000000;
diff --git a/embedding/components/commandhandler/src/nsControllerCommandTable.cpp b/embedding/components/commandhandler/src/nsControllerCommandTable.cpp
index 6112231840bf..dc3ff0859fe8 100644
--- a/embedding/components/commandhandler/src/nsControllerCommandTable.cpp
+++ b/embedding/components/commandhandler/src/nsControllerCommandTable.cpp
@@ -17,7 +17,7 @@ NS_NewControllerCommandTable(nsIControllerCommandTable** aResult);
 
 
 nsControllerCommandTable::nsControllerCommandTable()
-: mCommandsTable(NUM_COMMANDS_BOUNDS, false)
+: mCommandsTable(NUM_COMMANDS_BOUNDS)
 , mMutable(true)
 {
 }
@@ -40,15 +40,9 @@ NS_IMETHODIMP
 nsControllerCommandTable::RegisterCommand(const char * aCommandName, nsIControllerCommand *aCommand)
 {
   NS_ENSURE_TRUE(mMutable, NS_ERROR_FAILURE);
-  
-  nsCStringKey commandKey(aCommandName);
-  
-  if (mCommandsTable.Put(&commandKey, aCommand))
-  {
-#if DEBUG
-    NS_WARNING("Replacing existing command -- ");
-#endif
-  }  
+
+  mCommandsTable.Put(nsDependentCString(aCommandName), aCommand);
+
   return NS_OK;
 }
 
@@ -58,10 +52,14 @@ nsControllerCommandTable::UnregisterCommand(const char * aCommandName, nsIContro
 {
   NS_ENSURE_TRUE(mMutable, NS_ERROR_FAILURE);
 
-  nsCStringKey commandKey(aCommandName);
+  nsDependentCString commandKey(aCommandName);
 
-  bool wasRemoved = mCommandsTable.Remove(&commandKey);
-  return wasRemoved ? NS_OK : NS_ERROR_FAILURE;
+  if (!mCommandsTable.Get(commandKey, nullptr)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  mCommandsTable.Remove(commandKey);
+  return NS_OK;
 }
 
 
@@ -69,15 +67,14 @@ NS_IMETHODIMP
 nsControllerCommandTable::FindCommandHandler(const char * aCommandName, nsIControllerCommand **outCommand)
 {
   NS_ENSURE_ARG_POINTER(outCommand);
-  
+
   *outCommand = nullptr;
-  
-  nsCStringKey commandKey(aCommandName);
-  nsISupports* foundCommand = mCommandsTable.Get(&commandKey);
+
+  nsCOMPtr<nsIControllerCommand> foundCommand;
+  mCommandsTable.Get(nsDependentCString(aCommandName), getter_AddRefs(foundCommand));
   if (!foundCommand) return NS_ERROR_FAILURE;
-  
-  // no need to addref since the .Get does it for us
-  *outCommand = reinterpret_cast<nsIControllerCommand*>(foundCommand);
+
+  foundCommand.forget(outCommand);
   return NS_OK;
 }
 
@@ -90,18 +87,18 @@ nsControllerCommandTable::IsCommandEnabled(const char * aCommandName, nsISupport
   NS_ENSURE_ARG_POINTER(aResult);
 
   *aResult = false;
-      
-  // find the command  
+
+  // find the command
   nsCOMPtr<nsIControllerCommand> commandHandler;
-  FindCommandHandler(aCommandName, getter_AddRefs(commandHandler));  
-  if (!commandHandler) 
+  FindCommandHandler(aCommandName, getter_AddRefs(commandHandler));
+  if (!commandHandler)
   {
 #if DEBUG
     NS_WARNING("Controller command table asked about a command that it does not handle -- ");
 #endif
     return NS_OK;    // we don't handle this command
   }
-  
+
   return commandHandler->IsCommandEnabled(aCommandName, aCommandRefCon, aResult);
 }
 
@@ -109,9 +106,9 @@ nsControllerCommandTable::IsCommandEnabled(const char * aCommandName, nsISupport
 NS_IMETHODIMP
 nsControllerCommandTable::UpdateCommandState(const char * aCommandName, nsISupports *aCommandRefCon)
 {
-  // find the command  
+  // find the command
   nsCOMPtr<nsIControllerCommand> commandHandler;
-  FindCommandHandler(aCommandName, getter_AddRefs(commandHandler));  
+  FindCommandHandler(aCommandName, getter_AddRefs(commandHandler));
   if (!commandHandler)
   {
 #if DEBUG
@@ -119,7 +116,7 @@ nsControllerCommandTable::UpdateCommandState(const char * aCommandName, nsISuppo
 #endif
     return NS_OK;    // we don't handle this command
   }
-  
+
   return NS_ERROR_NOT_IMPLEMENTED;
 }
 
@@ -131,8 +128,8 @@ nsControllerCommandTable::SupportsCommand(const char * aCommandName, nsISupports
   // XXX: need to check the readonly and disabled states
 
   *aResult = false;
-  
-  // find the command  
+
+  // find the command
   nsCOMPtr<nsIControllerCommand> commandHandler;
   FindCommandHandler(aCommandName, getter_AddRefs(commandHandler));
 
@@ -144,7 +141,7 @@ nsControllerCommandTable::SupportsCommand(const char * aCommandName, nsISupports
 NS_IMETHODIMP
 nsControllerCommandTable::DoCommand(const char * aCommandName, nsISupports *aCommandRefCon)
 {
-  // find the command  
+  // find the command
   nsCOMPtr<nsIControllerCommand> commandHandler;
   FindCommandHandler(aCommandName, getter_AddRefs(commandHandler));
   if (!commandHandler)
@@ -154,14 +151,14 @@ nsControllerCommandTable::DoCommand(const char * aCommandName, nsISupports *aCom
 #endif
     return NS_OK;    // we don't handle this command
   }
-  
+
   return commandHandler->DoCommand(aCommandName, aCommandRefCon);
 }
 
 NS_IMETHODIMP
 nsControllerCommandTable::DoCommandParams(const char *aCommandName, nsICommandParams *aParams, nsISupports *aCommandRefCon)
 {
-  // find the command  
+  // find the command
   nsCOMPtr<nsIControllerCommand> commandHandler;
   FindCommandHandler(aCommandName, getter_AddRefs(commandHandler));
   if (!commandHandler)
@@ -178,7 +175,7 @@ nsControllerCommandTable::DoCommandParams(const char *aCommandName, nsICommandPa
 NS_IMETHODIMP
 nsControllerCommandTable::GetCommandState(const char *aCommandName, nsICommandParams *aParams, nsISupports *aCommandRefCon)
 {
-  // find the command  
+  // find the command
   nsCOMPtr<nsIControllerCommand> commandHandler;
   FindCommandHandler(aCommandName, getter_AddRefs(commandHandler));
   if (!commandHandler)
@@ -207,6 +204,3 @@ NS_NewControllerCommandTable(nsIControllerCommandTable** aResult)
   *aResult = newCommandTable;
   return NS_OK;
 }
-
-
-
diff --git a/embedding/components/commandhandler/src/nsControllerCommandTable.h b/embedding/components/commandhandler/src/nsControllerCommandTable.h
index c1b29c26bffb..fbc092324a35 100644
--- a/embedding/components/commandhandler/src/nsControllerCommandTable.h
+++ b/embedding/components/commandhandler/src/nsControllerCommandTable.h
@@ -9,7 +9,7 @@
 
 #include "nsIControllerCommandTable.h"
 #include "nsWeakReference.h"
-#include "nsHashtable.h"
+#include "nsInterfaceHashtable.h"
 
 class nsIControllerCommand;
 
@@ -27,8 +27,11 @@ public:
 
 protected:
 
-  nsSupportsHashtable   mCommandsTable;   // hash table of nsIControllerCommands, keyed by command name
-  bool                  mMutable;         // are we mutable?
+  // Hash table of nsIControllerCommands, keyed by command name.
+  nsInterfaceHashtable<nsCStringHashKey, nsIControllerCommand> mCommandsTable;
+
+  // Are we mutable?
+  bool mMutable;
 };
 
 
diff --git a/embedding/components/windowwatcher/src/nsWindowWatcher.cpp b/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
index 83d9ad82f523..38b27d67d7e4 100644
--- a/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
+++ b/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
@@ -41,6 +41,7 @@
 #include "nsIWindowCreator.h"
 #include "nsIWindowCreator2.h"
 #include "nsIXPConnect.h"
+#include "nsIXULRuntime.h"
 #include "nsPIDOMWindow.h"
 #include "nsIMarkupDocumentViewer.h"
 #include "nsIContentViewer.h"
@@ -834,17 +835,24 @@ nsWindowWatcher::OpenWindowInternal(nsIDOMWindow *aParent,
     }
   }
 
+  // We rely on CalculateChromeFlags to decide whether remote (out-of-process)
+  // tabs should be used.
+  bool isRemoteWindow =
+    !!(chromeFlags & nsIWebBrowserChrome::CHROME_REMOTE_WINDOW);
+
   if (isNewToplevelWindow) {
     nsCOMPtr<nsIDocShellTreeItem> childRoot;
     newDocShellItem->GetRootTreeItem(getter_AddRefs(childRoot));
     nsCOMPtr<nsILoadContext> childContext = do_QueryInterface(childRoot);
     if (childContext) {
       childContext->SetPrivateBrowsing(isPrivateBrowsingWindow);
+      childContext->SetRemoteTabs(isRemoteWindow);
     }
   } else if (windowIsNew) {
     nsCOMPtr<nsILoadContext> childContext = do_QueryInterface(newDocShellItem);
     if (childContext) {
       childContext->SetPrivateBrowsing(isPrivateBrowsingWindow);
+      childContext->SetRemoteTabs(isRemoteWindow);
     }
   }
 
@@ -1428,6 +1436,19 @@ uint32_t nsWindowWatcher::CalculateChromeFlags(nsIDOMWindow *aParent,
       nsIWebBrowserChrome::CHROME_NON_PRIVATE_WINDOW : 0;
   }
 
+  // Determine whether the window should have remote tabs.
+  if (isCallerChrome) {
+    bool remote;
+    if (Preferences::GetBool("browser.tabs.remote.autostart")) {
+      remote = !WinHasOption(aFeatures, "non-remote", 0, &presenceFlag);
+    } else {
+      remote = WinHasOption(aFeatures, "remote", 0, &presenceFlag);
+    }
+    if (remote) {
+      chromeFlags |= nsIWebBrowserChrome::CHROME_REMOTE_WINDOW;
+    }
+  }
+
   nsresult rv;
 
   nsCOMPtr<nsIPrefBranch> prefBranch;
diff --git a/gfx/thebes/gfxUtils.cpp b/gfx/thebes/gfxUtils.cpp
index d533d17df789..41a5b6530eed 100644
--- a/gfx/thebes/gfxUtils.cpp
+++ b/gfx/thebes/gfxUtils.cpp
@@ -885,6 +885,46 @@ gfxUtils::CopyAsDataURL(DrawTarget* aDT)
   }
 }
 
+/* static */ void
+gfxUtils::WriteAsPNG(RefPtr<gfx::SourceSurface> aSourceSurface, const char* aFile)
+{
+  RefPtr<gfx::DataSourceSurface> dataSurface = aSourceSurface->GetDataSurface();
+  RefPtr<gfx::DrawTarget> dt
+            = gfxPlatform::GetPlatform()
+                ->CreateDrawTargetForData(dataSurface->GetData(),
+                                          dataSurface->GetSize(),
+                                          dataSurface->Stride(),
+                                          aSourceSurface->GetFormat());
+  gfxUtils::WriteAsPNG(dt.get(), aFile);
+}
+
+/* static */ void
+gfxUtils::DumpAsDataURL(RefPtr<gfx::SourceSurface> aSourceSurface)
+{
+  RefPtr<gfx::DataSourceSurface> dataSurface = aSourceSurface->GetDataSurface();
+  RefPtr<gfx::DrawTarget> dt
+            = gfxPlatform::GetPlatform()
+                ->CreateDrawTargetForData(dataSurface->GetData(),
+                                          dataSurface->GetSize(),
+                                          dataSurface->Stride(),
+                                          aSourceSurface->GetFormat());
+  gfxUtils::DumpAsDataURL(dt.get());
+}
+
+/* static */ void
+gfxUtils::CopyAsDataURL(RefPtr<gfx::SourceSurface> aSourceSurface)
+{
+  RefPtr<gfx::DataSourceSurface> dataSurface = aSourceSurface->GetDataSurface();
+  RefPtr<gfx::DrawTarget> dt
+            = gfxPlatform::GetPlatform()
+                ->CreateDrawTargetForData(dataSurface->GetData(),
+                                          dataSurface->GetSize(),
+                                          dataSurface->Stride(),
+                                          aSourceSurface->GetFormat());
+
+  gfxUtils::CopyAsDataURL(dt.get());
+}
+
 bool gfxUtils::sDumpPaintList = getenv("MOZ_DUMP_PAINT_LIST") != 0;
 bool gfxUtils::sDumpPainting = getenv("MOZ_DUMP_PAINT") != 0;
 bool gfxUtils::sDumpPaintingToFile = getenv("MOZ_DUMP_PAINT_TO_FILE") != 0;
diff --git a/gfx/thebes/gfxUtils.h b/gfx/thebes/gfxUtils.h
index 0bb4f8815d68..a19153e22d3b 100644
--- a/gfx/thebes/gfxUtils.h
+++ b/gfx/thebes/gfxUtils.h
@@ -177,6 +177,24 @@ public:
     static bool sDumpPainting;
     static bool sDumpPaintingToFile;
     static FILE* sDumpPaintFile;
+
+    /**
+     * Writes a binary PNG file.
+     * Expensive. Creates a DataSourceSurface, then a DrawTarget, then passes to DrawTarget overloads
+     */
+    static void WriteAsPNG(mozilla::RefPtr<mozilla::gfx::SourceSurface> aSourceSurface, const char* aFile);
+
+    /**
+     * Write as a PNG encoded Data URL to stdout.
+     * Expensive. Creates a DataSourceSurface, then a DrawTarget, then passes to DrawTarget overloads
+     */
+    static void DumpAsDataURL(mozilla::RefPtr<mozilla::gfx::SourceSurface> aSourceSurface);
+
+    /**
+     * Copy a PNG encoded Data URL to the clipboard.
+     * Expensive. Creates a DataSourceSurface, then a DrawTarget, then passes to DrawTarget overloads
+     */
+    static void CopyAsDataURL(mozilla::RefPtr<mozilla::gfx::SourceSurface> aSourceSurface);
 #endif
 };
 
diff --git a/gfx/thebes/gfxWindowsPlatform.cpp b/gfx/thebes/gfxWindowsPlatform.cpp
index d7a1f0f0f7da..a662ae35bf9c 100644
--- a/gfx/thebes/gfxWindowsPlatform.cpp
+++ b/gfx/thebes/gfxWindowsPlatform.cpp
@@ -626,7 +626,9 @@ gfxWindowsPlatform::CreatePlatformFontList()
     mUsingGDIFonts = false;
     gfxPlatformFontList *pfl;
 #ifdef CAIRO_HAS_DWRITE_FONT
-    if (GetDWriteFactory()) {
+    // bug 630201 - older pre-RTM versions of Direct2D/DirectWrite cause odd
+    // crashers so blacklist them altogether
+    if (IsWin7RTMOrLater() && GetDWriteFactory()) {
         pfl = new gfxDWriteFontList();
         if (NS_SUCCEEDED(pfl->InitFontList())) {
             return pfl;
diff --git a/ipc/chromium/src/base/pickle.cc b/ipc/chromium/src/base/pickle.cc
index 79af6be28b29..3d58226f0d23 100644
--- a/ipc/chromium/src/base/pickle.cc
+++ b/ipc/chromium/src/base/pickle.cc
@@ -14,6 +14,8 @@
 #include <string>
 #include <algorithm>
 
+#include "nsDebug.h"
+
 //------------------------------------------------------------------------------
 
 static_assert(MOZ_ALIGNOF(Pickle::memberAlignmentType) >= MOZ_ALIGNOF(uint32_t),
@@ -114,6 +116,9 @@ Pickle::Pickle(int header_size)
   DCHECK(static_cast<memberAlignmentType>(header_size) >= sizeof(Header));
   DCHECK(header_size <= kPayloadUnit);
   Resize(kPayloadUnit);
+  if (!header_) {
+    NS_ABORT_OOM(kPayloadUnit);
+  }
   header_->payload_size = 0;
 }
 
@@ -133,7 +138,9 @@ Pickle::Pickle(const Pickle& other)
       variable_buffer_offset_(other.variable_buffer_offset_) {
   uint32_t payload_size = header_size_ + other.header_->payload_size;
   bool resized = Resize(payload_size);
-  CHECK(resized);  // Realloc failed.
+  if (!resized) {
+    NS_ABORT_OOM(payload_size);
+  }
   memcpy(header_, other.header_, payload_size);
 }
 
@@ -149,7 +156,9 @@ Pickle& Pickle::operator=(const Pickle& other) {
     header_size_ = other.header_size_;
   }
   bool resized = Resize(other.header_size_ + other.header_->payload_size);
-  CHECK(resized);  // Realloc failed.
+  if (!resized) {
+    NS_ABORT_OOM(other.header_size_ + other.header_->payload_size);
+  }
   memcpy(header_, other.header_, header_size_ + other.header_->payload_size);
   variable_buffer_offset_ = other.variable_buffer_offset_;
   return *this;
diff --git a/js/src/assembler/wtf/SegmentedVector.h b/js/src/assembler/wtf/SegmentedVector.h
index 508c06e0c28a..b3ff09dd759a 100644
--- a/js/src/assembler/wtf/SegmentedVector.h
+++ b/js/src/assembler/wtf/SegmentedVector.h
@@ -29,6 +29,7 @@
 #ifndef assembler_wtf_SegmentedVector_h
 #define assembler_wtf_SegmentedVector_h
 
+#include "js/Utility.h"
 #include "js/Vector.h"
 
 namespace WTF {
@@ -149,7 +150,7 @@ namespace WTF {
             }
 
             if (!segmentExistsFor(m_size - 1))
-                m_segments.append(new Segment);
+                m_segments.append(js_new<Segment>());
             //segmentFor(m_size - 1)->uncheckedAppend(value);
             segmentFor(m_size - 1)->append(value);
         }
@@ -247,7 +248,7 @@ namespace WTF {
         {
             ASSERT(segmentIndex <= m_segments.size());
             if (segmentIndex == m_segments.size())
-                m_segments.append(new Segment);
+                m_segments.append(js_new<Segment>());
             m_segments[segmentIndex]->grow(size);
         }
 
diff --git a/js/src/builtin/SIMD.cpp b/js/src/builtin/SIMD.cpp
index 7236378df837..d308cd51d365 100644
--- a/js/src/builtin/SIMD.cpp
+++ b/js/src/builtin/SIMD.cpp
@@ -46,8 +46,10 @@ extern const JSFunctionSpec Int32x4Methods[];
             return false; \
         } \
         TypedDatum &datum = args.thisv().toObject().as<TypedDatum>();        \
-        TypeRepresentation *typeRepr = datum.typeRepresentation(); \
-        if (typeRepr->kind() != TypeRepresentation::X4 || typeRepr->asX4()->type() != Type32x4::type) { \
+        TypeDescr &descr = datum.typeDescr(); \
+        if (descr.kind() != TypeDescr::X4 || \
+            descr.as<X4TypeDescr>().type() != Type32x4::type) \
+        {  \
             JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_INCOMPATIBLE_PROTO, \
                                  X4TypeDescr::class_.name, laneNames[lane], \
                                  InformalValueTypeName(args.thisv())); \
@@ -77,8 +79,10 @@ extern const JSFunctionSpec Int32x4Methods[];
             return false; \
         } \
         TypedDatum &datum = args.thisv().toObject().as<TypedDatum>();        \
-        TypeRepresentation *typeRepr = datum.typeRepresentation(); \
-        if (typeRepr->kind() != TypeRepresentation::X4 || typeRepr->asX4()->type() != Type32x4::type) { \
+        TypeDescr &descr = datum.typeDescr(); \
+        if (descr.kind() != TypeDescr::X4 || \
+            descr.as<X4TypeDescr>().type() != Type32x4::type) \
+        { \
             JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_INCOMPATIBLE_PROTO, \
                                  X4TypeDescr::class_.name, "signMask", \
                                  InformalValueTypeName(args.thisv())); \
@@ -99,7 +103,7 @@ extern const JSFunctionSpec Int32x4Methods[];
 
 const Class X4TypeDescr::class_ = {
     "X4",
-    JSCLASS_HAS_RESERVED_SLOTS(JS_TYPEOBJ_X4_SLOTS),
+    JSCLASS_HAS_RESERVED_SLOTS(JS_DESCR_SLOTS),
     JS_PropertyStub,         /* addProperty */
     JS_DeletePropertyStub,   /* delProperty */
     JS_PropertyStub,         /* getProperty */
@@ -118,14 +122,14 @@ const Class X4TypeDescr::class_ = {
 namespace js {
 class Int32x4Defn {
   public:
-    static const X4TypeRepresentation::Type type = X4TypeRepresentation::TYPE_INT32;
+    static const X4TypeDescr::Type type = X4TypeDescr::TYPE_INT32;
     static const JSFunctionSpec TypeDescriptorMethods[];
     static const JSPropertySpec TypedDatumProperties[];
     static const JSFunctionSpec TypedDatumMethods[];
 };
 class Float32x4Defn {
   public:
-    static const X4TypeRepresentation::Type type = X4TypeRepresentation::TYPE_FLOAT32;
+    static const X4TypeDescr::Type type = X4TypeDescr::TYPE_FLOAT32;
     static const JSFunctionSpec TypeDescriptorMethods[];
     static const JSPropertySpec TypedDatumProperties[];
     static const JSFunctionSpec TypedDatumMethods[];
@@ -133,7 +137,7 @@ class Float32x4Defn {
 } // namespace js
 
 const JSFunctionSpec js::Float32x4Defn::TypeDescriptorMethods[] = {
-    JS_FN("toSource", TypeDescrToSource, 0, 0),
+    JS_SELF_HOSTED_FN("toSource", "DescrToSourceMethod", 0, 0),
     JS_SELF_HOSTED_FN("handle", "HandleCreate", 2, 0),
     JS_SELF_HOSTED_FN("array", "ArrayShorthand", 1, 0),
     JS_SELF_HOSTED_FN("equivalent", "TypeDescrEquivalent", 1, 0),
@@ -155,7 +159,7 @@ const JSFunctionSpec js::Float32x4Defn::TypedDatumMethods[] = {
 };
 
 const JSFunctionSpec js::Int32x4Defn::TypeDescriptorMethods[] = {
-    JS_FN("toSource", TypeDescrToSource, 0, 0),
+    JS_SELF_HOSTED_FN("toSource", "DescrToSourceMethod", 0, 0),
     JS_SELF_HOSTED_FN("handle", "HandleCreate", 2, 0),
     JS_SELF_HOSTED_FN("array", "ArrayShorthand", 1, 0),
     JS_SELF_HOSTED_FN("equivalent", "TypeDescrEquivalent", 1, 0),
@@ -201,16 +205,14 @@ CreateX4Class(JSContext *cx, Handle<GlobalObject*> global)
     if (!proto)
         return nullptr;
 
-    // Create type constructor itself.
+    // Create type constructor itself and initialize its reserved slots.
 
     Rooted<X4TypeDescr*> x4(cx);
-    x4 = NewObjectWithProto<X4TypeDescr>(cx, funcProto, global);
+    x4 = NewObjectWithProto<X4TypeDescr>(cx, funcProto, global, TenuredObject);
     if (!x4 || !InitializeCommonTypeDescriptorProperties(cx, x4, typeReprObj))
         return nullptr;
-
-    // Link type constructor to the type representation.
-
-    x4->initReservedSlot(JS_TYPEOBJ_SLOT_TYPE_REPR, ObjectValue(*typeReprObj));
+    x4->initReservedSlot(JS_DESCR_SLOT_TYPE_REPR, ObjectValue(*typeReprObj));
+    x4->initReservedSlot(JS_DESCR_SLOT_TYPE, Int32Value(T::type));
 
     // Link constructor to prototype and install properties.
 
@@ -245,13 +247,12 @@ X4TypeDescr::call(JSContext *cx, unsigned argc, Value *vp)
             return false;
     }
 
-    Rooted<X4TypeDescr*> typeObj(cx, &args.callee().as<X4TypeDescr>());
-    Rooted<TypedObject*> result(cx, TypedObject::createZeroed(cx, typeObj, 0));
+    Rooted<X4TypeDescr*> descr(cx, &args.callee().as<X4TypeDescr>());
+    Rooted<TypedObject*> result(cx, TypedObject::createZeroed(cx, descr, 0));
     if (!result)
         return false;
 
-    X4TypeRepresentation *typeRepr = typeObj->typeRepresentation()->asX4();
-    switch (typeRepr->type()) {
+    switch (descr->type()) {
 #define STORE_LANES(_constant, _type, _name)                                  \
       case _constant:                                                         \
       {                                                                       \
@@ -369,10 +370,10 @@ static bool
 ObjectIsVector(JSObject &obj) {
     if (!obj.is<TypedDatum>())
         return false;
-    TypeRepresentation *typeRepr = obj.as<TypedDatum>().typeRepresentation();
-    if (typeRepr->kind() != TypeRepresentation::X4)
+    TypeDescr &typeRepr = obj.as<TypedDatum>().typeDescr();
+    if (typeRepr.kind() != TypeDescr::X4)
         return false;
-    return typeRepr->asX4()->type() == V::type;
+    return typeRepr.as<X4TypeDescr>().type() == V::type;
 }
 
 template<typename V>
diff --git a/js/src/builtin/SIMD.h b/js/src/builtin/SIMD.h
index 487a1dde2494..a81f743dcc3d 100644
--- a/js/src/builtin/SIMD.h
+++ b/js/src/builtin/SIMD.h
@@ -33,8 +33,8 @@ class SIMDObject : public JSObject
 struct Float32x4 {
     typedef float Elem;
     static const int32_t lanes = 4;
-    static const X4TypeRepresentation::Type type =
-        X4TypeRepresentation::TYPE_FLOAT32;
+    static const X4TypeDescr::Type type =
+        X4TypeDescr::TYPE_FLOAT32;
 
     static TypeDescr &GetTypeDescr(GlobalObject &global) {
         return global.float32x4TypeDescr().as<TypeDescr>();
@@ -53,8 +53,8 @@ struct Float32x4 {
 struct Int32x4 {
     typedef int32_t Elem;
     static const int32_t lanes = 4;
-    static const X4TypeRepresentation::Type type =
-        X4TypeRepresentation::TYPE_INT32;
+    static const X4TypeDescr::Type type =
+        X4TypeDescr::TYPE_INT32;
 
     static TypeDescr &GetTypeDescr(GlobalObject &global) {
         return global.int32x4TypeDescr().as<TypeDescr>();
diff --git a/js/src/builtin/TypeRepresentation.cpp b/js/src/builtin/TypeRepresentation.cpp
index f098ccd9aae6..66ca58caddb9 100644
--- a/js/src/builtin/TypeRepresentation.cpp
+++ b/js/src/builtin/TypeRepresentation.cpp
@@ -56,23 +56,23 @@ TypeRepresentationHasher::match(TypeRepresentation *key1,
         return false;
 
     switch (key1->kind()) {
-      case TypeRepresentation::Scalar:
+      case TypeDescr::Scalar:
         return matchScalars(key1->asScalar(), key2->asScalar());
 
-      case TypeRepresentation::Reference:
+      case TypeDescr::Reference:
         return matchReferences(key1->asReference(), key2->asReference());
 
-      case TypeRepresentation::X4:
+      case TypeDescr::X4:
         return matchX4s(key1->asX4(), key2->asX4());
 
-      case TypeRepresentation::Struct:
+      case TypeDescr::Struct:
         return matchStructs(key1->asStruct(), key2->asStruct());
 
-      case TypeRepresentation::SizedArray:
+      case TypeDescr::SizedArray:
         return matchSizedArrays(key1->asSizedArray(),
                                 key2->asSizedArray());
 
-      case TypeRepresentation::UnsizedArray:
+      case TypeDescr::UnsizedArray:
         return matchUnsizedArrays(key1->asUnsizedArray(),
                                   key2->asUnsizedArray());
     }
@@ -139,22 +139,22 @@ TypeRepresentationHasher::matchUnsizedArrays(UnsizedArrayTypeRepresentation *key
 HashNumber
 TypeRepresentationHasher::hash(TypeRepresentation *key) {
     switch (key->kind()) {
-      case TypeRepresentation::Scalar:
+      case TypeDescr::Scalar:
         return hashScalar(key->asScalar());
 
-      case TypeRepresentation::Reference:
+      case TypeDescr::Reference:
         return hashReference(key->asReference());
 
-      case TypeRepresentation::X4:
+      case TypeDescr::X4:
         return hashX4(key->asX4());
 
-      case TypeRepresentation::Struct:
+      case TypeDescr::Struct:
         return hashStruct(key->asStruct());
 
-      case TypeRepresentation::UnsizedArray:
+      case TypeDescr::UnsizedArray:
         return hashUnsizedArray(key->asUnsizedArray());
 
-      case TypeRepresentation::SizedArray:
+      case TypeDescr::SizedArray:
         return hashSizedArray(key->asSizedArray());
     }
 
@@ -205,27 +205,25 @@ TypeRepresentationHasher::hashUnsizedArray(UnsizedArrayTypeRepresentation *key)
 ///////////////////////////////////////////////////////////////////////////
 // Constructors
 
-TypeRepresentation::TypeRepresentation(Kind kind, bool opaque)
+TypeRepresentation::TypeRepresentation(TypeDescr::Kind kind, bool opaque)
   : kind_(kind),
     opaque_(opaque)
 {}
 
-SizedTypeRepresentation::SizedTypeRepresentation(Kind kind, bool opaque,
-                                                 size_t size, size_t align)
+SizedTypeRepresentation::SizedTypeRepresentation(SizedTypeDescr::Kind kind,
+                                                 bool opaque,
+                                                 size_t size,
+                                                 size_t align)
   : TypeRepresentation(kind, opaque),
     size_(size),
     alignment_(align)
 {}
 
-static size_t ScalarSizes[] = {
-#define SCALAR_SIZE(_kind, _type, _name)                        \
-    sizeof(_type),
-    JS_FOR_EACH_SCALAR_TYPE_REPR(SCALAR_SIZE) 0
-#undef SCALAR_SIZE
-};
-
-ScalarTypeRepresentation::ScalarTypeRepresentation(Type type)
-  : SizedTypeRepresentation(Scalar, false, ScalarSizes[type], ScalarSizes[type]),
+ScalarTypeRepresentation::ScalarTypeRepresentation(ScalarTypeDescr::Type type)
+  : SizedTypeRepresentation(TypeDescr::Scalar,
+                            false,
+                            ScalarTypeDescr::size(type),
+                            ScalarTypeDescr::alignment(type)),
     type_(type)
 {
 }
@@ -237,24 +235,24 @@ static size_t X4Sizes[] = {
 #undef X4_SIZE
 };
 
-X4TypeRepresentation::X4TypeRepresentation(Type type)
-  : SizedTypeRepresentation(X4, false, X4Sizes[type], X4Sizes[type]),
+X4TypeRepresentation::X4TypeRepresentation(X4TypeDescr::Type type)
+  : SizedTypeRepresentation(X4TypeDescr::X4, false, X4Sizes[type], X4Sizes[type]),
     type_(type)
 {
 }
 
-ReferenceTypeRepresentation::ReferenceTypeRepresentation(Type type)
-  : SizedTypeRepresentation(Reference, true, 0, 1),
+ReferenceTypeRepresentation::ReferenceTypeRepresentation(ReferenceTypeDescr::Type type)
+  : SizedTypeRepresentation(TypeDescr::Reference, true, 0, 1),
     type_(type)
 {
     switch (type) {
-      case TYPE_ANY:
+      case ReferenceTypeDescr::TYPE_ANY:
         size_ = sizeof(js::HeapValue);
         alignment_ = MOZ_ALIGNOF(js::HeapValue);
         break;
 
-      case TYPE_OBJECT:
-      case TYPE_STRING:
+      case ReferenceTypeDescr::TYPE_OBJECT:
+      case ReferenceTypeDescr::TYPE_STRING:
         size_ = sizeof(js::HeapPtrObject);
         alignment_ = MOZ_ALIGNOF(js::HeapPtrObject);
         break;
@@ -263,7 +261,7 @@ ReferenceTypeRepresentation::ReferenceTypeRepresentation(Type type)
 
 SizedArrayTypeRepresentation::SizedArrayTypeRepresentation(SizedTypeRepresentation *element,
                                                            size_t length)
-  : SizedTypeRepresentation(SizedArray, element->opaque(),
+  : SizedTypeRepresentation(TypeDescr::SizedArray, element->opaque(),
                             element->size() * length, element->alignment()),
     element_(element),
     length_(length)
@@ -271,7 +269,7 @@ SizedArrayTypeRepresentation::SizedArrayTypeRepresentation(SizedTypeRepresentati
 }
 
 UnsizedArrayTypeRepresentation::UnsizedArrayTypeRepresentation(SizedTypeRepresentation *element)
-  : TypeRepresentation(UnsizedArray, element->opaque()),
+  : TypeRepresentation(TypeDescr::UnsizedArray, element->opaque()),
     element_(element)
 {
 }
@@ -292,7 +290,7 @@ StructField::StructField(size_t index,
 {}
 
 StructTypeRepresentation::StructTypeRepresentation()
-  : SizedTypeRepresentation(Struct, false, 0, 1),
+  : SizedTypeRepresentation(TypeDescr::Struct, false, 0, 1),
     fieldCount_(0) // see ::init() below!
 {
     // note: size_, alignment_, and opaque_ are computed in ::init() below
@@ -366,20 +364,7 @@ TypeRepresentation::addToTableOrFree(JSContext *cx,
     Rooted<GlobalObject*> global(cx, cx->global());
     JSCompartment *comp = cx->compartment();
 
-    // First, try to create the TI type object to associate with this
-    // type representation. Since nothing is in the table yet, if this
-    // fails we can just return and pretend this whole endeavor was
-    // just a bad dream.
-    RootedObject proto(cx);
-    const Class *clasp;
-    if (!TypedObjectModuleObject::getSuitableClaspAndProto(cx, kind(), &clasp, &proto)) {
-        return nullptr;
-    }
-    RootedTypeObject typeObject(cx, comp->types.newTypeObject(cx, clasp, proto));
-    if (!typeObject)
-        return nullptr;
-
-    // Next, attempt to add the type representation to the table.
+    // First, attempt to add the type representation to the table.
     if (!comp->typeReprs.relookupOrAdd(p, this, this)) {
         js_ReportOutOfMemory(cx);
         js_free(this); // do not finalize, not present in the table
@@ -396,63 +381,23 @@ TypeRepresentation::addToTableOrFree(JSContext *cx,
     // remove ourselves from the table ourselves and report an error.
     RootedObject ownerObject(cx);
     ownerObject = NewObjectWithGivenProto(cx, &class_, objectProto,
-                                          cx->global());
+                                          cx->global(), TenuredObject);
     if (!ownerObject) {
         comp->typeReprs.remove(this);
         js_free(this);
         return nullptr;
     }
-
     ownerObject->setPrivate(this);
-
-    // Assign the various reserved slots:
     ownerObject->initReservedSlot(JS_TYPEREPR_SLOT_KIND, Int32Value(kind()));
-
-    if (isSized()) {
-        ownerObject->initReservedSlot(JS_TYPEREPR_SLOT_SIZE,
-                                      Int32Value(asSized()->size()));
-        ownerObject->initReservedSlot(JS_TYPEREPR_SLOT_ALIGNMENT,
-                                      Int32Value(asSized()->alignment()));
-    }
-
-    switch (kind()) {
-      case UnsizedArray:
-        break;
-
-      case SizedArray:
-        ownerObject->initReservedSlot(JS_TYPEREPR_SLOT_LENGTH,
-                                      Int32Value(asSizedArray()->length()));
-        break;
-
-      case Scalar:
-        ownerObject->initReservedSlot(JS_TYPEREPR_SLOT_TYPE,
-                                      Int32Value(asScalar()->type()));
-        break;
-
-      case Reference:
-        ownerObject->initReservedSlot(JS_TYPEREPR_SLOT_TYPE,
-                                      Int32Value(asReference()->type()));
-        break;
-
-      case X4:
-        ownerObject->initReservedSlot(JS_TYPEREPR_SLOT_TYPE,
-                                      Int32Value(asX4()->type()));
-        break;
-
-      case Struct:
-        break;
-    }
-
     ownerObject_.init(ownerObject);
-    typeObject_.init(typeObject);
     return &*ownerObject;
 }
 
 namespace js {
 class TypeRepresentationHelper {
   public:
-    template<typename T>
-    static JSObject *CreateSimple(JSContext *cx, typename T::Type type) {
+    template<typename D, typename T>
+    static JSObject *CreateSimple(JSContext *cx, typename D::Type type) {
         JSCompartment *comp = cx->compartment();
 
         TypeRepresentationHash::AddPtr p;
@@ -477,23 +422,25 @@ class TypeRepresentationHelper {
 /*static*/
 JSObject *
 ScalarTypeRepresentation::Create(JSContext *cx,
-                                 ScalarTypeRepresentation::Type type)
+                                 ScalarTypeDescr::Type type)
 {
-    return TypeRepresentationHelper::CreateSimple<ScalarTypeRepresentation>(cx, type);
+    return TypeRepresentationHelper::CreateSimple<ScalarTypeDescr,
+                                                  ScalarTypeRepresentation>(cx, type);
 }
 
 /*static*/
 JSObject *
 X4TypeRepresentation::Create(JSContext *cx,
-                             X4TypeRepresentation::Type type)
+                             X4TypeDescr::Type type)
 {
-    return TypeRepresentationHelper::CreateSimple<X4TypeRepresentation>(cx, type);
+    return TypeRepresentationHelper::CreateSimple<X4TypeDescr,
+                                                  X4TypeRepresentation>(cx, type);
 }
 
 /*static*/
 JSObject *
 ReferenceTypeRepresentation::Create(JSContext *cx,
-                                    ReferenceTypeRepresentation::Type type)
+                                    ReferenceTypeDescr::Type type)
 {
     JSCompartment *comp = cx->compartment();
 
@@ -617,7 +564,6 @@ TypeRepresentation::mark(JSTracer *trace)
     // contents. This is the typical scheme for marking objects.  See
     // gc/Marking.cpp for more details.
     gc::MarkObject(trace, &ownerObject_, "typeRepresentation_ownerObject");
-    gc::MarkTypeObject(trace, &typeObject_, "typeRepresentation_typeObject");
 }
 
 /*static*/ void
@@ -632,20 +578,20 @@ TypeRepresentation::traceFields(JSTracer *trace)
     mark(trace); // don't forget to mark the self-reference here!
 
     switch (kind()) {
-      case Scalar:
-      case Reference:
-      case X4:
+      case TypeDescr::Scalar:
+      case TypeDescr::Reference:
+      case TypeDescr::X4:
         break;
 
-      case Struct:
+      case TypeDescr::Struct:
         asStruct()->traceStructFields(trace);
         break;
 
-      case SizedArray:
+      case TypeDescr::SizedArray:
         asSizedArray()->traceSizedArrayFields(trace);
         break;
 
-      case UnsizedArray:
+      case TypeDescr::UnsizedArray:
         asUnsizedArray()->traceUnsizedArrayFields(trace);
         break;
     }
@@ -686,166 +632,6 @@ TypeRepresentation::obj_finalize(js::FreeOp *fop, JSObject *object)
     js_free(typeRepr);
 }
 
-///////////////////////////////////////////////////////////////////////////
-// To string
-
-bool
-TypeRepresentation::appendString(JSContext *cx, StringBuffer &contents)
-{
-    switch (kind()) {
-      case Scalar:
-        return asScalar()->appendStringScalar(cx, contents);
-
-      case Reference:
-        return asReference()->appendStringReference(cx, contents);
-
-      case X4:
-        return asX4()->appendStringX4(cx, contents);
-
-      case SizedArray:
-        return asSizedArray()->appendStringSizedArray(cx, contents);
-
-      case UnsizedArray:
-        return asUnsizedArray()->appendStringUnsizedArray(cx, contents);
-
-      case Struct:
-        return asStruct()->appendStringStruct(cx, contents);
-    }
-
-    MOZ_ASSUME_UNREACHABLE("Invalid kind");
-    return false;
-}
-
-/*static*/ const char *
-ScalarTypeRepresentation::typeName(Type type)
-{
-    switch (type) {
-#define NUMERIC_TYPE_TO_STRING(constant_, type_, name_) \
-        case constant_: return #name_;
-        JS_FOR_EACH_SCALAR_TYPE_REPR(NUMERIC_TYPE_TO_STRING)
-    }
-    MOZ_ASSUME_UNREACHABLE("Invalid type");
-}
-
-bool
-ScalarTypeRepresentation::appendStringScalar(JSContext *cx, StringBuffer &contents)
-{
-    switch (type()) {
-#define NUMERIC_TYPE_APPEND_STRING(constant_, type_, name_)                   \
-        case constant_: return contents.append(#name_);
-        JS_FOR_EACH_SCALAR_TYPE_REPR(NUMERIC_TYPE_APPEND_STRING)
-    }
-    MOZ_ASSUME_UNREACHABLE("Invalid type");
-}
-
-/*static*/ const char *
-ReferenceTypeRepresentation::typeName(Type type)
-{
-    switch (type) {
-#define NUMERIC_TYPE_TO_STRING(constant_, type_, name_) \
-        case constant_: return #name_;
-        JS_FOR_EACH_REFERENCE_TYPE_REPR(NUMERIC_TYPE_TO_STRING)
-    }
-    MOZ_ASSUME_UNREACHABLE("Invalid type");
-}
-
-bool
-ReferenceTypeRepresentation::appendStringReference(JSContext *cx, StringBuffer &contents)
-{
-    switch (type()) {
-#define NUMERIC_TYPE_APPEND_STRING(constant_, type_, name_)                   \
-        case constant_: return contents.append(#name_);
-        JS_FOR_EACH_REFERENCE_TYPE_REPR(NUMERIC_TYPE_APPEND_STRING)
-    }
-    MOZ_ASSUME_UNREACHABLE("Invalid type");
-}
-
-bool
-X4TypeRepresentation::appendStringX4(JSContext *cx, StringBuffer &contents)
-{
-    switch (type()) {
-      case TYPE_FLOAT32:
-        return contents.append("float32x4");
-      case TYPE_INT32:
-        return contents.append("int32x4");
-    }
-    MOZ_ASSUME_UNREACHABLE("Invalid type");
-}
-
-bool
-SizedArrayTypeRepresentation::appendStringSizedArray(JSContext *cx, StringBuffer &contents)
-{
-    SizedTypeRepresentation *elementType = element();
-    while (elementType->isSizedArray())
-        elementType = elementType->asSizedArray()->element();
-    if (!elementType->appendString(cx, contents))
-        return false;
-
-    contents.append(".array(");
-    SizedArrayTypeRepresentation *arrayType = this;
-    while (arrayType != nullptr) {
-        if (!NumberValueToStringBuffer(cx, NumberValue(length()), contents))
-            return false;
-
-        if (arrayType->element()->isSizedArray()) {
-            if (!contents.append(","))
-                return false;
-            arrayType = arrayType->element()->asSizedArray();
-        } else {
-            break;
-        }
-    }
-
-    if (!contents.append(")"))
-        return false;
-
-    return true;
-}
-
-bool
-UnsizedArrayTypeRepresentation::appendStringUnsizedArray(JSContext *cx, StringBuffer &contents)
-{
-    if (!element()->appendString(cx, contents))
-        return false;
-
-    if (!contents.append(".array()"))
-        return false;
-
-    return true;
-}
-
-bool
-StructTypeRepresentation::appendStringStruct(JSContext *cx, StringBuffer &contents)
-{
-    if (!contents.append("StructType({"))
-        return false;
-
-    for (size_t i = 0; i < fieldCount(); i++) {
-        const StructField &fld = field(i);
-
-        if (i > 0)
-            contents.append(", ");
-
-        RootedString idString(cx, fld.propertyName);
-        if (!idString)
-            return false;
-
-        if (!contents.append(idString))
-            return false;
-
-        if (!contents.append(": "))
-            return false;
-
-        if (!fld.typeRepr->appendString(cx, contents))
-            return false;
-    }
-
-    if (!contents.append("})"))
-        return false;
-
-    return true;
-}
-
 ///////////////////////////////////////////////////////////////////////////
 // Walking memory
 
@@ -859,15 +645,15 @@ visitReferences(SizedTypeRepresentation *repr,
         return;
 
     switch (repr->kind()) {
-      case TypeRepresentation::Scalar:
-      case TypeRepresentation::X4:
+      case TypeDescr::Scalar:
+      case TypeDescr::X4:
         return;
 
-      case TypeRepresentation::Reference:
+      case TypeDescr::Reference:
         visitor.visitReference(repr->asReference(), mem);
         return;
 
-      case TypeRepresentation::SizedArray:
+      case TypeDescr::SizedArray:
       {
         SizedArrayTypeRepresentation *arrayRepr = repr->asSizedArray();
         SizedTypeRepresentation *elementRepr = arrayRepr->element();
@@ -878,12 +664,12 @@ visitReferences(SizedTypeRepresentation *repr,
         return;
       }
 
-      case TypeRepresentation::UnsizedArray:
+      case TypeDescr::UnsizedArray:
       {
         MOZ_ASSUME_UNREACHABLE("Only Sized Type representations");
       }
 
-      case TypeRepresentation::Struct:
+      case TypeDescr::Struct:
       {
         StructTypeRepresentation *structRepr = repr->asStruct();
         for (size_t i = 0; i < structRepr->fieldCount(); i++) {
@@ -917,14 +703,14 @@ void
 js::MemoryInitVisitor::visitReference(ReferenceTypeRepresentation *repr, uint8_t *mem)
 {
     switch (repr->type()) {
-      case ReferenceTypeRepresentation::TYPE_ANY:
+      case ReferenceTypeDescr::TYPE_ANY:
       {
         js::HeapValue *heapValue = reinterpret_cast<js::HeapValue *>(mem);
         heapValue->init(UndefinedValue());
         return;
       }
 
-      case ReferenceTypeRepresentation::TYPE_OBJECT:
+      case ReferenceTypeDescr::TYPE_OBJECT:
       {
         js::HeapPtrObject *objectPtr =
             reinterpret_cast<js::HeapPtrObject *>(mem);
@@ -932,7 +718,7 @@ js::MemoryInitVisitor::visitReference(ReferenceTypeRepresentation *repr, uint8_t
         return;
       }
 
-      case ReferenceTypeRepresentation::TYPE_STRING:
+      case ReferenceTypeDescr::TYPE_STRING:
       {
         js::HeapPtrString *stringPtr =
             reinterpret_cast<js::HeapPtrString *>(mem);
@@ -987,14 +773,14 @@ void
 js::MemoryTracingVisitor::visitReference(ReferenceTypeRepresentation *repr, uint8_t *mem)
 {
     switch (repr->type()) {
-      case ReferenceTypeRepresentation::TYPE_ANY:
+      case ReferenceTypeDescr::TYPE_ANY:
       {
         js::HeapValue *heapValue = reinterpret_cast<js::HeapValue *>(mem);
         gc::MarkValue(trace_, heapValue, "reference-val");
         return;
       }
 
-      case ReferenceTypeRepresentation::TYPE_OBJECT:
+      case ReferenceTypeDescr::TYPE_OBJECT:
       {
         js::HeapPtrObject *objectPtr =
             reinterpret_cast<js::HeapPtrObject *>(mem);
@@ -1003,7 +789,7 @@ js::MemoryTracingVisitor::visitReference(ReferenceTypeRepresentation *repr, uint
         return;
       }
 
-      case ReferenceTypeRepresentation::TYPE_STRING:
+      case ReferenceTypeDescr::TYPE_STRING:
       {
         js::HeapPtrString *stringPtr =
             reinterpret_cast<js::HeapPtrString *>(mem);
diff --git a/js/src/builtin/TypeRepresentation.h b/js/src/builtin/TypeRepresentation.h
index 482f17493475..ec1e4e4d78e5 100644
--- a/js/src/builtin/TypeRepresentation.h
+++ b/js/src/builtin/TypeRepresentation.h
@@ -70,6 +70,7 @@
 #include "jscntxt.h"
 #include "jspubtd.h"
 
+#include "builtin/TypedObject.h"
 #include "builtin/TypedObjectConstants.h"
 #include "gc/Barrier.h"
 #include "js/HashTable.h"
@@ -123,23 +124,13 @@ typedef js::HashSet<TypeRepresentation *,
 class TypeRepresentationHelper;
 
 class TypeRepresentation {
-  public:
-    enum Kind {
-        Scalar = JS_TYPEREPR_SCALAR_KIND,
-        Reference = JS_TYPEREPR_REFERENCE_KIND,
-        X4 = JS_TYPEREPR_X4_KIND,
-        Struct = JS_TYPEREPR_STRUCT_KIND,
-        SizedArray = JS_TYPEREPR_SIZED_ARRAY_KIND,
-        UnsizedArray = JS_TYPEREPR_UNSIZED_ARRAY_KIND,
-    };
-
   protected:
-    TypeRepresentation(Kind kind, bool opaque);
+    TypeRepresentation(TypeDescr::Kind kind, bool opaque);
 
     // in order to call addToTableOrFree()
     friend class TypeRepresentationHelper;
 
-    Kind kind_;
+    TypeDescr::Kind kind_;
     bool opaque_;
 
     JSObject *addToTableOrFree(JSContext *cx, TypeRepresentationHash::AddPtr &p);
@@ -150,59 +141,49 @@ class TypeRepresentation {
     static void obj_finalize(js::FreeOp *fop, JSObject *object);
 
     HeapPtrObject ownerObject_;
-    HeapPtrTypeObject typeObject_;
     void traceFields(JSTracer *tracer);
 
   public:
-    Kind kind() const { return kind_; }
+    TypeDescr::Kind kind() const { return kind_; }
     bool opaque() const { return opaque_; }
     bool transparent() const { return !opaque_; }
     JSObject *ownerObject() const { return ownerObject_.get(); }
-    types::TypeObject *typeObject() const { return typeObject_.get(); }
-
-    // Appends a stringified form of this type representation onto
-    // buffer, for use in error messages and the like.
-    bool appendString(JSContext *cx, StringBuffer &buffer);
 
     static bool isOwnerObject(JSObject &obj);
     static TypeRepresentation *fromOwnerObject(JSObject &obj);
 
-    static bool isSized(Kind kind) {
-        return kind > JS_TYPEREPR_MAX_UNSIZED_KIND;
-    }
-
     bool isSized() const {
-        return isSized(kind());
+        return TypeDescr::isSized(kind());
     }
 
     inline SizedTypeRepresentation *asSized();
 
     bool isScalar() const {
-        return kind() == Scalar;
+        return kind() == TypeDescr::Scalar;
     }
 
     inline ScalarTypeRepresentation *asScalar();
 
     bool isReference() const {
-        return kind() == Reference;
+        return kind() == TypeDescr::Reference;
     }
 
     inline ReferenceTypeRepresentation *asReference();
 
     bool isX4() const {
-        return kind() == X4;
+        return kind() == TypeDescr::X4;
     }
 
     inline X4TypeRepresentation *asX4();
 
     bool isSizedArray() const {
-        return kind() == SizedArray;
+        return kind() == TypeDescr::SizedArray;
     }
 
     inline SizedArrayTypeRepresentation *asSizedArray();
 
     bool isUnsizedArray() const {
-        return kind() == UnsizedArray;
+        return kind() == TypeDescr::UnsizedArray;
     }
 
     inline UnsizedArrayTypeRepresentation *asUnsizedArray();
@@ -212,7 +193,7 @@ class TypeRepresentation {
     }
 
     bool isStruct() const {
-        return kind() == Struct;
+        return kind() == TypeDescr::Struct;
     }
 
     inline StructTypeRepresentation *asStruct();
@@ -222,7 +203,7 @@ class TypeRepresentation {
 
 class SizedTypeRepresentation : public TypeRepresentation {
   protected:
-    SizedTypeRepresentation(Kind kind, bool opaque, size_t size, size_t align);
+    SizedTypeRepresentation(TypeDescr::Kind kind, bool opaque, size_t size, size_t align);
 
     size_t size_;
     size_t alignment_;
@@ -240,147 +221,64 @@ class SizedTypeRepresentation : public TypeRepresentation {
 };
 
 class ScalarTypeRepresentation : public SizedTypeRepresentation {
-  public:
-    // Must match order of JS_FOR_EACH_SCALAR_TYPE_REPR below
-    enum Type {
-        TYPE_INT8 = JS_SCALARTYPEREPR_INT8,
-        TYPE_UINT8 = JS_SCALARTYPEREPR_UINT8,
-        TYPE_INT16 = JS_SCALARTYPEREPR_INT16,
-        TYPE_UINT16 = JS_SCALARTYPEREPR_UINT16,
-        TYPE_INT32 = JS_SCALARTYPEREPR_INT32,
-        TYPE_UINT32 = JS_SCALARTYPEREPR_UINT32,
-        TYPE_FLOAT32 = JS_SCALARTYPEREPR_FLOAT32,
-        TYPE_FLOAT64 = JS_SCALARTYPEREPR_FLOAT64,
-
-        /*
-         * Special type that's a uint8_t, but assignments are clamped to 0 .. 255.
-         * Treat the raw data type as a uint8_t.
-         */
-        TYPE_UINT8_CLAMPED = JS_SCALARTYPEREPR_UINT8_CLAMPED,
-    };
-    static const int32_t TYPE_MAX = TYPE_UINT8_CLAMPED + 1;
-
   private:
-    // so TypeRepresentation can call appendStringScalar() etc
-    friend class TypeRepresentation;
-
     // in order to call constructor
     friend class TypeRepresentationHelper;
 
-    const Type type_;
+    const ScalarTypeDescr::Type type_;
 
-    explicit ScalarTypeRepresentation(Type type);
-
-    // See TypeRepresentation::appendString()
-    bool appendStringScalar(JSContext *cx, StringBuffer &buffer);
+    explicit ScalarTypeRepresentation(ScalarTypeDescr::Type type);
 
   public:
-    Type type() const {
+    ScalarTypeDescr::Type type() const {
         return type_;
     }
 
     const char *typeName() const {
-        return typeName(type());
+        return ScalarTypeDescr::typeName(type());
     }
 
-    static const char *typeName(Type type);
-    static JSObject *Create(JSContext *cx, Type type);
+    static JSObject *Create(JSContext *cx, ScalarTypeDescr::Type type);
 };
 
-// Enumerates the cases of ScalarTypeRepresentation::Type which have
-// unique C representation. In particular, omits Uint8Clamped since it
-// is just a Uint8.
-#define JS_FOR_EACH_UNIQUE_SCALAR_TYPE_REPR_CTYPE(macro_)                     \
-    macro_(ScalarTypeRepresentation::TYPE_INT8,    int8_t,   int8)            \
-    macro_(ScalarTypeRepresentation::TYPE_UINT8,   uint8_t,  uint8)           \
-    macro_(ScalarTypeRepresentation::TYPE_INT16,   int16_t,  int16)           \
-    macro_(ScalarTypeRepresentation::TYPE_UINT16,  uint16_t, uint16)          \
-    macro_(ScalarTypeRepresentation::TYPE_INT32,   int32_t,  int32)           \
-    macro_(ScalarTypeRepresentation::TYPE_UINT32,  uint32_t, uint32)          \
-    macro_(ScalarTypeRepresentation::TYPE_FLOAT32, float,    float32)         \
-    macro_(ScalarTypeRepresentation::TYPE_FLOAT64, double,   float64)
-
-// Must be in same order as the enum ScalarTypeRepresentation::Type:
-#define JS_FOR_EACH_SCALAR_TYPE_REPR(macro_)                                    \
-    JS_FOR_EACH_UNIQUE_SCALAR_TYPE_REPR_CTYPE(macro_)                           \
-    macro_(ScalarTypeRepresentation::TYPE_UINT8_CLAMPED, uint8_t, uint8Clamped)
-
 class ReferenceTypeRepresentation : public SizedTypeRepresentation {
-  public:
-    // Must match order of JS_FOR_EACH_REFERENCE_TYPE_REPR below
-    enum Type {
-        TYPE_ANY = JS_REFERENCETYPEREPR_ANY,
-        TYPE_OBJECT = JS_REFERENCETYPEREPR_OBJECT,
-        TYPE_STRING = JS_REFERENCETYPEREPR_STRING,
-    };
-    static const int32_t TYPE_MAX = TYPE_STRING + 1;
-
   private:
-    // so TypeRepresentation can call appendStringScalar() etc
-    friend class TypeRepresentation;
+    ReferenceTypeDescr::Type type_;
 
-    Type type_;
-
-    explicit ReferenceTypeRepresentation(Type type);
-
-    // See TypeRepresentation::appendString()
-    bool appendStringReference(JSContext *cx, StringBuffer &buffer);
+    explicit ReferenceTypeRepresentation(ReferenceTypeDescr::Type type);
 
   public:
-    Type type() const {
+    ReferenceTypeDescr::Type type() const {
         return type_;
     }
 
     const char *typeName() const {
-        return typeName(type());
+        return ReferenceTypeDescr::typeName(type());
     }
 
-    static const char *typeName(Type type);
-    static JSObject *Create(JSContext *cx, Type type);
+    static JSObject *Create(JSContext *cx, ReferenceTypeDescr::Type type);
 };
 
-#define JS_FOR_EACH_REFERENCE_TYPE_REPR(macro_)                             \
-    macro_(ReferenceTypeRepresentation::TYPE_ANY,    HeapValue, Any)        \
-    macro_(ReferenceTypeRepresentation::TYPE_OBJECT, HeapPtrObject, Object) \
-    macro_(ReferenceTypeRepresentation::TYPE_STRING, HeapPtrString, string)
-
 class X4TypeRepresentation : public SizedTypeRepresentation {
-  public:
-    enum Type {
-        TYPE_INT32 = JS_X4TYPEREPR_INT32,
-        TYPE_FLOAT32 = JS_X4TYPEREPR_FLOAT32,
-    };
-
   private:
-    // so TypeRepresentation can call appendStringScalar() etc
-    friend class TypeRepresentation;
-
     // in order to call constructor
     friend class TypeRepresentationHelper;
 
-    const Type type_;
+    const X4TypeDescr::Type type_;
 
-    explicit X4TypeRepresentation(Type type);
-
-    // See TypeRepresentation::appendString()
-    bool appendStringX4(JSContext *cx, StringBuffer &buffer);
+    explicit X4TypeRepresentation(X4TypeDescr::Type type);
 
   public:
-    Type type() const {
+    X4TypeDescr::Type type() const {
         return type_;
     }
 
-    static JSObject *Create(JSContext *cx, Type type);
+    static JSObject *Create(JSContext *cx, X4TypeDescr::Type type);
 };
 
-// Must be in same order as the enum ScalarTypeRepresentation::Type:
-#define JS_FOR_EACH_X4_TYPE_REPR(macro_)                                      \
-    macro_(X4TypeRepresentation::TYPE_INT32, int32_t, int32)                  \
-    macro_(X4TypeRepresentation::TYPE_FLOAT32, float, float32)
-
 class UnsizedArrayTypeRepresentation : public TypeRepresentation {
   private:
-    // so TypeRepresentation can call appendStringArray() etc
+    // so TypeRepresentation can call tracing routines
     friend class TypeRepresentation;
 
     SizedTypeRepresentation *element_;
@@ -390,9 +288,6 @@ class UnsizedArrayTypeRepresentation : public TypeRepresentation {
     // See TypeRepresentation::traceFields()
     void traceUnsizedArrayFields(JSTracer *trace);
 
-    // See TypeRepresentation::appendString()
-    bool appendStringUnsizedArray(JSContext *cx, StringBuffer &buffer);
-
   public:
     SizedTypeRepresentation *element() {
         return element_;
@@ -404,7 +299,7 @@ class UnsizedArrayTypeRepresentation : public TypeRepresentation {
 
 class SizedArrayTypeRepresentation : public SizedTypeRepresentation {
   private:
-    // so TypeRepresentation can call appendStringSizedArray() etc
+    // so TypeRepresentation can call traceSizedArrayFields()
     friend class TypeRepresentation;
 
     SizedTypeRepresentation *element_;
@@ -416,9 +311,6 @@ class SizedArrayTypeRepresentation : public SizedTypeRepresentation {
     // See TypeRepresentation::traceFields()
     void traceSizedArrayFields(JSTracer *trace);
 
-    // See TypeRepresentation::appendString()
-    bool appendStringSizedArray(JSContext *cx, StringBuffer &buffer);
-
   public:
     SizedTypeRepresentation *element() {
         return element_;
@@ -447,7 +339,7 @@ struct StructField {
 
 class StructTypeRepresentation : public SizedTypeRepresentation {
   private:
-    // so TypeRepresentation can call appendStringStruct() etc
+    // so TypeRepresentation can call traceStructFields() etc
     friend class TypeRepresentation;
 
     size_t fieldCount_;
@@ -469,9 +361,6 @@ class StructTypeRepresentation : public SizedTypeRepresentation {
     // See TypeRepresentation::traceFields()
     void traceStructFields(JSTracer *trace);
 
-    // See TypeRepresentation::appendString()
-    bool appendStringStruct(JSContext *cx, StringBuffer &buffer);
-
   public:
     size_t fieldCount() const {
         return fieldCount_;
diff --git a/js/src/builtin/TypedObject.cpp b/js/src/builtin/TypedObject.cpp
index 6586fe929f1c..0feb9a87a624 100644
--- a/js/src/builtin/TypedObject.cpp
+++ b/js/src/builtin/TypedObject.cpp
@@ -67,31 +67,6 @@ ToObjectIf(HandleValue value)
     return &value.toObject().as<T>();
 }
 
-bool
-js::TypeDescrToSource(JSContext *cx, unsigned int argc, Value *vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-
-    Rooted<TypeDescr*> thisObj(cx, ToObjectIf<TypeDescr>(args.thisv()));
-    if (!thisObj) {
-        JS_ReportErrorNumber(cx, js_GetErrorMessage,
-                             nullptr, JSMSG_TYPEDOBJECT_HANDLE_BAD_ARGS,
-                             "this", "type object");
-        return false;
-    }
-
-    StringBuffer contents(cx);
-    if (!thisObj->typeRepresentation()->appendString(cx, contents))
-        return false;
-
-    RootedString result(cx, contents.finishString());
-    if (!result)
-        return false;
-
-    args.rval().setString(result);
-    return true;
-}
-
 /*
  * Overwrites the contents of `datum` at offset `offset` with `val`
  * converted to the type `typeObj`. This is done by delegating to
@@ -130,15 +105,14 @@ ConvertAndCopyTo(JSContext *cx,
         return false;
 
     InvokeArgs args(cx);
-    if (!args.init(5))
+    if (!args.init(4))
         return false;
 
     args.setCallee(ObjectValue(*func));
-    args[0].setObject(typeObj->typeRepresentationOwnerObj());
-    args[1].setObject(*typeObj);
-    args[2].setObject(*datum);
-    args[3].setInt32(offset);
-    args[4].set(val);
+    args[0].setObject(*typeObj);
+    args[1].setObject(*datum);
+    args[2].setInt32(offset);
+    args[3].set(val);
 
     return Invoke(cx, args);
 }
@@ -156,7 +130,6 @@ ConvertAndCopyTo(JSContext *cx, HandleTypedDatum datum, HandleValue val)
  */
 static bool
 Reify(JSContext *cx,
-      TypeRepresentation *typeRepr,
       HandleTypeDescr type,
       HandleTypedDatum datum,
       size_t offset,
@@ -167,14 +140,13 @@ Reify(JSContext *cx,
         return false;
 
     InvokeArgs args(cx);
-    if (!args.init(4))
+    if (!args.init(3))
         return false;
 
     args.setCallee(ObjectValue(*func));
-    args[0].setObject(*typeRepr->ownerObject());
-    args[1].setObject(*type);
-    args[2].setObject(*datum);
-    args[3].setInt32(offset);
+    args[0].setObject(*type);
+    args[1].setObject(*datum);
+    args[2].setInt32(offset);
 
     if (!Invoke(cx, args))
         return false;
@@ -202,6 +174,20 @@ GetPrototype(JSContext *cx, HandleObject obj)
     return &prototypeVal.toObject();
 }
 
+/***************************************************************************
+ * Type descriptors
+ */
+
+TypeRepresentation *
+TypeDescr::typeRepresentation() const {
+    return TypeRepresentation::fromOwnerObject(typeRepresentationOwnerObj());
+}
+
+TypeDescr::Kind
+TypeDescr::kind() const {
+    return typeRepresentation()->kind();
+}
+
 /***************************************************************************
  * Scalar type objects
  *
@@ -213,7 +199,7 @@ GetPrototype(JSContext *cx, HandleObject obj)
 
 const Class js::ScalarTypeDescr::class_ = {
     "Scalar",
-    JSCLASS_HAS_RESERVED_SLOTS(JS_TYPEOBJ_SCALAR_SLOTS),
+    JSCLASS_HAS_RESERVED_SLOTS(JS_DESCR_SLOTS),
     JS_PropertyStub,       /* addProperty */
     JS_DeletePropertyStub, /* delProperty */
     JS_PropertyStub,       /* getProperty */
@@ -229,13 +215,43 @@ const Class js::ScalarTypeDescr::class_ = {
 };
 
 const JSFunctionSpec js::ScalarTypeDescr::typeObjectMethods[] = {
-    JS_FN("toSource", TypeDescrToSource, 0, 0),
+    JS_SELF_HOSTED_FN("toSource", "DescrToSourceMethod", 0, 0),
     {"handle", {nullptr, nullptr}, 2, 0, "HandleCreate"},
     {"array", {nullptr, nullptr}, 1, 0, "ArrayShorthand"},
     {"equivalent", {nullptr, nullptr}, 1, 0, "TypeDescrEquivalent"},
     JS_FS_END
 };
 
+static size_t ScalarSizes[] = {
+#define SCALAR_SIZE(_kind, _type, _name)                        \
+    sizeof(_type),
+    JS_FOR_EACH_SCALAR_TYPE_REPR(SCALAR_SIZE) 0
+#undef SCALAR_SIZE
+};
+
+size_t
+ScalarTypeDescr::size(Type t)
+{
+    return ScalarSizes[t];
+}
+
+size_t
+ScalarTypeDescr::alignment(Type t)
+{
+    return ScalarSizes[t];
+}
+
+/*static*/ const char *
+ScalarTypeDescr::typeName(Type type)
+{
+    switch (type) {
+#define NUMERIC_TYPE_TO_STRING(constant_, type_, name_) \
+        case constant_: return #name_;
+        JS_FOR_EACH_SCALAR_TYPE_REPR(NUMERIC_TYPE_TO_STRING)
+    }
+    MOZ_ASSUME_UNREACHABLE("Invalid type");
+}
+
 bool
 ScalarTypeDescr::call(JSContext *cx, unsigned argc, Value *vp)
 {
@@ -248,13 +264,13 @@ ScalarTypeDescr::call(JSContext *cx, unsigned argc, Value *vp)
 
     ScalarTypeRepresentation *typeRepr =
         args.callee().as<ScalarTypeDescr>().typeRepresentation()->asScalar();
-    ScalarTypeRepresentation::Type type = typeRepr->type();
+    ScalarTypeDescr::Type type = typeRepr->type();
 
     double number;
     if (!ToNumber(cx, args[0], &number))
         return false;
 
-    if (type == ScalarTypeRepresentation::TYPE_UINT8_CLAMPED)
+    if (type == ScalarTypeDescr::TYPE_UINT8_CLAMPED)
         number = ClampDoubleToUint8(number);
 
     switch (type) {
@@ -284,7 +300,7 @@ ScalarTypeDescr::call(JSContext *cx, unsigned argc, Value *vp)
 
 const Class js::ReferenceTypeDescr::class_ = {
     "Reference",
-    JSCLASS_HAS_RESERVED_SLOTS(JS_TYPEOBJ_REFERENCE_SLOTS),
+    JSCLASS_HAS_RESERVED_SLOTS(JS_DESCR_SLOTS),
     JS_PropertyStub,       /* addProperty */
     JS_DeletePropertyStub, /* delProperty */
     JS_PropertyStub,       /* getProperty */
@@ -300,13 +316,24 @@ const Class js::ReferenceTypeDescr::class_ = {
 };
 
 const JSFunctionSpec js::ReferenceTypeDescr::typeObjectMethods[] = {
-    JS_FN("toSource", TypeDescrToSource, 0, 0),
+    JS_SELF_HOSTED_FN("toSource", "DescrToSourceMethod", 0, 0),
     {"handle", {nullptr, nullptr}, 2, 0, "HandleCreate"},
     {"array", {nullptr, nullptr}, 1, 0, "ArrayShorthand"},
     {"equivalent", {nullptr, nullptr}, 1, 0, "TypeDescrEquivalent"},
     JS_FS_END
 };
 
+/*static*/ const char *
+ReferenceTypeDescr::typeName(Type type)
+{
+    switch (type) {
+#define NUMERIC_TYPE_TO_STRING(constant_, type_, name_) \
+        case constant_: return #name_;
+        JS_FOR_EACH_REFERENCE_TYPE_REPR(NUMERIC_TYPE_TO_STRING)
+    }
+    MOZ_ASSUME_UNREACHABLE("Invalid type");
+}
+
 bool
 js::ReferenceTypeDescr::call(JSContext *cx, unsigned argc, Value *vp)
 {
@@ -324,11 +351,11 @@ js::ReferenceTypeDescr::call(JSContext *cx, unsigned argc, Value *vp)
     }
 
     switch (typeRepr->type()) {
-      case ReferenceTypeRepresentation::TYPE_ANY:
+      case ReferenceTypeDescr::TYPE_ANY:
         args.rval().set(args[0]);
         return true;
 
-      case ReferenceTypeRepresentation::TYPE_OBJECT:
+      case ReferenceTypeDescr::TYPE_OBJECT:
       {
         RootedObject obj(cx, ToObject(cx, args[0]));
         if (!obj)
@@ -337,7 +364,7 @@ js::ReferenceTypeDescr::call(JSContext *cx, unsigned argc, Value *vp)
         return true;
       }
 
-      case ReferenceTypeRepresentation::TYPE_STRING:
+      case ReferenceTypeDescr::TYPE_STRING:
       {
         RootedString obj(cx, ToString<CanGC>(cx, args[0]));
         if (!obj)
@@ -397,12 +424,13 @@ CreatePrototypeObjectForComplexTypeInstance(JSContext *cx,
     if (!ctorPrototypePrototype)
         return nullptr;
 
-    return NewObjectWithProto<JSObject>(cx, &*ctorPrototypePrototype, nullptr);
+    return NewObjectWithProto<JSObject>(cx, &*ctorPrototypePrototype, nullptr,
+                                        TenuredObject);
 }
 
 const Class UnsizedArrayTypeDescr::class_ = {
     "ArrayType",
-    JSCLASS_HAS_RESERVED_SLOTS(JS_TYPEOBJ_ARRAY_SLOTS),
+    JSCLASS_HAS_RESERVED_SLOTS(JS_DESCR_SLOTS),
     JS_PropertyStub,
     JS_DeletePropertyStub,
     JS_PropertyStub,
@@ -419,7 +447,7 @@ const Class UnsizedArrayTypeDescr::class_ = {
 
 const Class SizedArrayTypeDescr::class_ = {
     "ArrayType",
-    JSCLASS_HAS_RESERVED_SLOTS(JS_TYPEOBJ_ARRAY_SLOTS),
+    JSCLASS_HAS_RESERVED_SLOTS(JS_DESCR_SLOTS),
     JS_PropertyStub,
     JS_DeletePropertyStub,
     JS_PropertyStub,
@@ -442,7 +470,7 @@ const JSFunctionSpec ArrayMetaTypeDescr::typeObjectMethods[] = {
     {"handle", {nullptr, nullptr}, 2, 0, "HandleCreate"},
     {"array", {nullptr, nullptr}, 1, 0, "ArrayShorthand"},
     JS_FN("dimension", UnsizedArrayTypeDescr::dimension, 1, 0),
-    JS_FN("toSource", TypeDescrToSource, 0, 0),
+    JS_SELF_HOSTED_FN("toSource", "DescrToSourceMethod", 0, 0),
     {"equivalent", {nullptr, nullptr}, 1, 0, "TypeDescrEquivalent"},
     JS_SELF_HOSTED_FN("build",    "TypedObjectArrayTypeBuild", 3, 0),
     JS_SELF_HOSTED_FN("buildPar", "TypedObjectArrayTypeBuildPar", 3, 0),
@@ -477,6 +505,17 @@ js::InitializeCommonTypeDescriptorProperties(JSContext *cx,
     TypeRepresentation *typeRepr =
         TypeRepresentation::fromOwnerObject(*typeReprOwnerObj);
 
+    // Regardless of whether the data is transparent, we always
+    // store the internal size/alignment slots.
+    if (typeRepr->isSized()) {
+        SizedTypeRepresentation *sizedTypeRepr = typeRepr->asSized();
+        obj->initReservedSlot(JS_DESCR_SLOT_SIZE,
+                              Int32Value(sizedTypeRepr->size()));
+        obj->initReservedSlot(JS_DESCR_SLOT_ALIGNMENT,
+                              Int32Value(sizedTypeRepr->alignment()));
+    }
+
+    // If data is transparent, also store the public slots.
     if (typeRepr->transparent() && typeRepr->isSized()) {
         SizedTypeRepresentation *sizedTypeRepr = typeRepr->asSized();
 
@@ -542,10 +581,11 @@ ArrayMetaTypeDescr::create(JSContext *cx,
 {
     JS_ASSERT(TypeRepresentation::isOwnerObject(*arrayTypeReprObj));
 
-    Rooted<T*> obj(cx, NewObjectWithProto<T>(cx, arrayTypePrototype, nullptr));
+    Rooted<T*> obj(cx, NewObjectWithProto<T>(cx, arrayTypePrototype, nullptr,
+                                             TenuredObject));
     if (!obj)
         return nullptr;
-    obj->initReservedSlot(JS_TYPEOBJ_SLOT_TYPE_REPR,
+    obj->initReservedSlot(JS_DESCR_SLOT_TYPE_REPR,
                           ObjectValue(*arrayTypeReprObj));
 
     RootedValue elementTypeVal(cx, ObjectValue(*elementType));
@@ -554,7 +594,7 @@ ArrayMetaTypeDescr::create(JSContext *cx,
                                   JSPROP_READONLY | JSPROP_PERMANENT))
         return nullptr;
 
-    obj->initReservedSlot(JS_TYPEOBJ_SLOT_ARRAY_ELEM_TYPE, elementTypeVal);
+    obj->initReservedSlot(JS_DESCR_SLOT_ARRAY_ELEM_TYPE, elementTypeVal);
 
     if (!InitializeCommonTypeDescriptorProperties(cx, obj, arrayTypeReprObj))
         return nullptr;
@@ -597,7 +637,8 @@ ArrayMetaTypeDescr::construct(JSContext *cx, unsigned argc, Value *vp)
 
     Rooted<SizedTypeDescr*> elementType(cx);
     elementType = &args[0].toObject().as<SizedTypeDescr>();
-    SizedTypeRepresentation *elementTypeRepr = elementType->typeRepresentation();
+    SizedTypeRepresentation *elementTypeRepr =
+        elementType->typeRepresentation()->asSized();
 
     // construct the type repr
     RootedObject arrayTypeReprObj(
@@ -661,12 +702,14 @@ UnsizedArrayTypeDescr::dimension(JSContext *cx, unsigned int argc, jsval *vp)
 
     // Create the sized type object.
     Rooted<SizedTypeDescr*> elementType(cx, &unsizedTypeDescr->elementType());
-    RootedObject obj(cx);
+    Rooted<SizedArrayTypeDescr*> obj(cx);
     obj = ArrayMetaTypeDescr::create<SizedArrayTypeDescr>(
         cx, unsizedTypeDescr, sizedTypeReprObj, elementType);
     if (!obj)
         return false;
 
+    obj->initReservedSlot(JS_DESCR_SLOT_SIZED_ARRAY_LENGTH, Int32Value(length));
+
     // Add `length` property.
     RootedValue lengthVal(cx, Int32Value(length));
     if (!JSObject::defineProperty(cx, obj, cx->names().length,
@@ -692,7 +735,7 @@ UnsizedArrayTypeDescr::dimension(JSContext *cx, unsigned int argc, jsval *vp)
 
 const Class StructTypeDescr::class_ = {
     "StructType",
-    JSCLASS_HAS_RESERVED_SLOTS(JS_TYPEOBJ_STRUCT_SLOTS) |
+    JSCLASS_HAS_RESERVED_SLOTS(JS_DESCR_SLOTS) |
     JSCLASS_HAS_PRIVATE, // used to store FieldList
     JS_PropertyStub,
     JS_DeletePropertyStub,
@@ -715,7 +758,7 @@ const JSPropertySpec StructMetaTypeDescr::typeObjectProperties[] = {
 const JSFunctionSpec StructMetaTypeDescr::typeObjectMethods[] = {
     {"handle", {nullptr, nullptr}, 2, 0, "HandleCreate"},
     {"array", {nullptr, nullptr}, 1, 0, "ArrayShorthand"},
-    JS_FN("toSource", TypeDescrToSource, 0, 0),
+    JS_SELF_HOSTED_FN("toSource", "DescrToSourceMethod", 0, 0),
     {"equivalent", {nullptr, nullptr}, 1, 0, "TypeDescrEquivalent"},
     JS_FS_END
 };
@@ -792,45 +835,64 @@ StructMetaTypeDescr::layout(JSContext *cx,
         return false;
     StructTypeRepresentation *typeRepr =
         TypeRepresentation::fromOwnerObject(*typeReprObj)->asStruct();
-    structType->initReservedSlot(JS_TYPEOBJ_SLOT_TYPE_REPR,
+    structType->initReservedSlot(JS_DESCR_SLOT_TYPE_REPR,
                                  ObjectValue(*typeReprObj));
 
-    // Construct for internal use an array with the type object for each field.
-    RootedObject fieldTypeVec(
-        cx, NewDenseCopiedArray(cx, fieldTypeObjs.length(),
-                                fieldTypeObjs.begin()));
-    if (!fieldTypeVec)
-        return false;
-
-    structType->initReservedSlot(JS_TYPEOBJ_SLOT_STRUCT_FIELD_TYPES,
-                                 ObjectValue(*fieldTypeVec));
-
-    // Construct the fieldNames vector
-    AutoValueVector fieldNameValues(cx);
-    for (unsigned int i = 0; i < ids.length(); i++) {
-        RootedValue value(cx, IdToValue(ids[i]));
-        if (!fieldNameValues.append(value))
+    // Construct for internal use an array with names of each field
+    {
+        AutoValueVector fieldNameValues(cx);
+        for (unsigned int i = 0; i < ids.length(); i++) {
+            RootedValue value(cx, IdToValue(ids[i]));
+            if (!fieldNameValues.append(value))
+                return false;
+        }
+        RootedObject fieldNamesVec(cx);
+        fieldNamesVec = NewDenseCopiedArray(cx, fieldNameValues.length(),
+                                            fieldNameValues.begin(), nullptr,
+                                            TenuredObject);
+        if (!fieldNamesVec)
             return false;
+        structType->initReservedSlot(JS_DESCR_SLOT_STRUCT_FIELD_NAMES,
+                                     ObjectValue(*fieldNamesVec));
     }
-    RootedObject fieldNamesVec(
-        cx, NewDenseCopiedArray(cx, fieldNameValues.length(),
-                                fieldNameValues.begin()));
-    if (!fieldNamesVec)
-        return false;
-    RootedValue fieldNamesVecValue(cx, ObjectValue(*fieldNamesVec));
-    if (!JSObject::defineProperty(cx, structType, cx->names().fieldNames,
-                                  fieldNamesVecValue, nullptr, nullptr,
-                                  JSPROP_READONLY | JSPROP_PERMANENT))
-        return false;
 
-    // Construct the fieldNames, fieldOffsets and fieldTypes objects:
-    // fieldNames : [ string ]
+    // Construct for internal use an array with the type object for each field.
+    {
+        RootedObject fieldTypeVec(cx);
+        fieldTypeVec = NewDenseCopiedArray(cx, fieldTypeObjs.length(),
+                                           fieldTypeObjs.begin(), nullptr,
+                                           TenuredObject);
+        if (!fieldTypeVec)
+            return false;
+        structType->initReservedSlot(JS_DESCR_SLOT_STRUCT_FIELD_TYPES,
+                                     ObjectValue(*fieldTypeVec));
+    }
+
+    // Construct for internal use an array with the offset for each field.
+    {
+        AutoValueVector fieldOffsets(cx);
+        for (size_t i = 0; i < typeRepr->fieldCount(); i++) {
+            const StructField &field = typeRepr->field(i);
+            if (!fieldOffsets.append(Int32Value(field.offset)))
+                return false;
+        }
+        RootedObject fieldOffsetsVec(cx);
+        fieldOffsetsVec = NewDenseCopiedArray(cx, fieldOffsets.length(),
+                                              fieldOffsets.begin(), nullptr,
+                                              TenuredObject);
+        if (!fieldOffsetsVec)
+            return false;
+        structType->initReservedSlot(JS_DESCR_SLOT_STRUCT_FIELD_OFFSETS,
+                                     ObjectValue(*fieldOffsetsVec));
+    }
+
+    // Construct the fieldOffsets and fieldTypes objects:
     // fieldOffsets : { string: integer, ... }
     // fieldTypes : { string: Type, ... }
-    RootedObject fieldOffsets(
-        cx, NewObjectWithProto<JSObject>(cx, nullptr, nullptr));
-    RootedObject fieldTypes(
-        cx, NewObjectWithProto<JSObject>(cx, nullptr, nullptr));
+    RootedObject fieldOffsets(cx);
+    fieldOffsets = NewObjectWithProto<JSObject>(cx, nullptr, nullptr, TenuredObject);
+    RootedObject fieldTypes(cx);
+    fieldTypes = NewObjectWithProto<JSObject>(cx, nullptr, nullptr, TenuredObject);
     for (size_t i = 0; i < typeRepr->fieldCount(); i++) {
         const StructField &field = typeRepr->field(i);
         RootedId fieldId(cx, NameToId(field.propertyName));
@@ -849,6 +911,12 @@ StructMetaTypeDescr::layout(JSContext *cx,
             return false;
     }
 
+    if (!JSObject::freeze(cx, fieldOffsets))
+        return false;
+
+    if (!JSObject::freeze(cx, fieldTypes))
+        return false;
+
     RootedValue fieldOffsetsValue(cx, ObjectValue(*fieldOffsets));
     if (!JSObject::defineProperty(cx, structType, cx->names().fieldOffsets,
                                   fieldOffsetsValue, nullptr, nullptr,
@@ -874,7 +942,8 @@ StructMetaTypeDescr::create(JSContext *cx,
         return nullptr;
 
     Rooted<StructTypeDescr*> descr(cx);
-    descr = NewObjectWithProto<StructTypeDescr>(cx, structTypePrototype, nullptr);
+    descr = NewObjectWithProto<StructTypeDescr>(cx, structTypePrototype, nullptr,
+                                                TenuredObject);
     if (!descr)
         return nullptr;
 
@@ -926,6 +995,40 @@ StructMetaTypeDescr::construct(JSContext *cx, unsigned int argc, Value *vp)
     return false;
 }
 
+bool
+StructTypeDescr::fieldIndex(jsid id, size_t *out)
+{
+    JSObject &fieldNames =
+        getReservedSlot(JS_DESCR_SLOT_STRUCT_FIELD_NAMES).toObject();
+    size_t l = fieldNames.getDenseInitializedLength();
+    for (size_t i = 0; i < l; i++) {
+        JSAtom &a = fieldNames.getDenseElement(i).toString()->asAtom();
+        if (JSID_IS_ATOM(id, &a)) {
+            *out = i;
+            return true;
+        }
+    }
+    return false;
+}
+
+size_t
+StructTypeDescr::fieldOffset(size_t index)
+{
+    JSObject &fieldOffsets =
+        getReservedSlot(JS_DESCR_SLOT_STRUCT_FIELD_OFFSETS).toObject();
+    JS_ASSERT(index < fieldOffsets.getDenseInitializedLength());
+    return fieldOffsets.getDenseElement(index).toInt32();
+}
+
+SizedTypeDescr&
+StructTypeDescr::fieldDescr(size_t index)
+{
+    JSObject &fieldDescrs =
+        getReservedSlot(JS_DESCR_SLOT_STRUCT_FIELD_TYPES).toObject();
+    JS_ASSERT(index < fieldDescrs.getDenseInitializedLength());
+    return fieldDescrs.getDenseElement(index).toObject().as<SizedTypeDescr>();
+}
+
 /******************************************************************************
  * Creating the TypedObject "module"
  *
@@ -979,13 +1082,14 @@ static bool
 DefineSimpleTypeDescr(JSContext *cx,
                       Handle<GlobalObject *> global,
                       HandleObject module,
-                      typename T::TypeRepr::Type type,
+                      typename T::Type type,
                       HandlePropertyName className)
 {
     RootedObject funcProto(cx, global->getOrCreateFunctionPrototype(cx));
     JS_ASSERT(funcProto);
 
-    Rooted<T*> numFun(cx, NewObjectWithProto<T>(cx, funcProto, global));
+    Rooted<T*> numFun(cx, NewObjectWithProto<T>(cx, funcProto, global,
+                                                TenuredObject));
     if (!numFun)
         return false;
 
@@ -993,12 +1097,14 @@ DefineSimpleTypeDescr(JSContext *cx,
     if (!typeReprObj)
         return false;
 
-    numFun->initReservedSlot(JS_TYPEOBJ_SLOT_TYPE_REPR,
+    numFun->initReservedSlot(JS_DESCR_SLOT_TYPE_REPR,
                              ObjectValue(*typeReprObj));
 
     if (!InitializeCommonTypeDescriptorProperties(cx, numFun, typeReprObj))
         return false;
 
+    numFun->initReservedSlot(JS_DESCR_SLOT_TYPE, Int32Value(type));
+
     if (!JS_DefineFunctions(cx, numFun, T::typeObjectMethods))
         return false;
 
@@ -1211,39 +1317,39 @@ js_InitTypedObjectDummy(JSContext *cx, HandleObject obj)
  */
 /*static*/ bool
 TypedObjectModuleObject::getSuitableClaspAndProto(JSContext *cx,
-                                                  TypeRepresentation::Kind kind,
+                                                  TypeDescr::Kind kind,
                                                   const Class **clasp,
                                                   MutableHandleObject proto)
 {
     Rooted<GlobalObject *> global(cx, cx->global());
     JS_ASSERT(global);
     switch (kind) {
-      case TypeRepresentation::Scalar:
+      case TypeDescr::Scalar:
         *clasp = &ScalarTypeDescr::class_;
         proto.set(global->getOrCreateFunctionPrototype(cx));
         break;
 
-      case TypeRepresentation::Reference:
+      case TypeDescr::Reference:
         *clasp = &ReferenceTypeDescr::class_;
         proto.set(global->getOrCreateFunctionPrototype(cx));
         break;
 
-      case TypeRepresentation::X4:
+      case TypeDescr::X4:
         *clasp = &X4TypeDescr::class_;
         proto.set(global->getOrCreateFunctionPrototype(cx));
         break;
 
-      case TypeRepresentation::Struct:
+      case TypeDescr::Struct:
         *clasp = &StructTypeDescr::class_;
         proto.set(&global->getTypedObjectModule().getSlot(StructTypePrototype).toObject());
         break;
 
-      case TypeRepresentation::SizedArray:
+      case TypeDescr::SizedArray:
         *clasp = &SizedArrayTypeDescr::class_;
         proto.set(&global->getTypedObjectModule().getSlot(ArrayTypePrototype).toObject());
         break;
 
-      case TypeRepresentation::UnsizedArray:
+      case TypeDescr::UnsizedArray:
         *clasp = &UnsizedArrayTypeDescr::class_;
         proto.set(&global->getTypedObjectModule().getSlot(ArrayTypePrototype).toObject());
         break;
@@ -1314,13 +1420,8 @@ TypedDatum::createUnattachedWithClass(JSContext *cx,
         // FIXME Bug 929651           ^~~~~~~~~~~~~~~~~~~~~~~~~~~
         RootedTypeObject typeObj(cx, obj->getType(cx));
         if (typeObj) {
-            TypeRepresentation *typeRepr = type->typeRepresentation();
-            if (!typeObj->addTypedObjectAddendum(cx,
-                                                 types::TypeTypedObject::Datum,
-                                                 typeRepr))
-            {
+            if (!typeObj->addTypedObjectAddendum(cx, type))
                 return nullptr;
-            }
         }
     }
 
@@ -1357,16 +1458,16 @@ DatumLengthFromType(TypeDescr &descr)
 {
     TypeRepresentation *typeRepr = descr.typeRepresentation();
     switch (typeRepr->kind()) {
-      case TypeRepresentation::Scalar:
-      case TypeRepresentation::Reference:
-      case TypeRepresentation::Struct:
-      case TypeRepresentation::X4:
+      case TypeDescr::Scalar:
+      case TypeDescr::Reference:
+      case TypeDescr::Struct:
+      case TypeDescr::X4:
         return 0;
 
-      case TypeRepresentation::SizedArray:
+      case TypeDescr::SizedArray:
         return typeRepr->asSizedArray()->length();
 
-      case TypeRepresentation::UnsizedArray:
+      case TypeDescr::UnsizedArray:
         MOZ_ASSUME_UNREACHABLE("DatumLengthFromType() invoked on unsized type");
     }
     MOZ_ASSUME_UNREACHABLE("Invalid kind");
@@ -1396,13 +1497,20 @@ ReportDatumTypeError(JSContext *cx,
                      const unsigned errorNumber,
                      HandleTypedDatum obj)
 {
-    TypeRepresentation *typeRepr = obj->typeRepresentation();
-
-    StringBuffer contents(cx);
-    if (!typeRepr->appendString(cx, contents))
+    // Serialize type string using self-hosted function DescrToSource
+    RootedFunction func(
+        cx, SelfHostedFunction(cx, cx->names().DescrToSource));
+    if (!func)
+        return false;
+    InvokeArgs args(cx);
+    if (!args.init(1))
+        return false;
+    args.setCallee(ObjectValue(*func));
+    args[0].setObject(obj->typeDescr());
+    if (!Invoke(cx, args))
         return false;
 
-    RootedString result(cx, contents.finishString());
+    RootedString result(cx, args.rval().toString());
     if (!result)
         return false;
 
@@ -1433,15 +1541,15 @@ TypedDatum::obj_trace(JSTracer *trace, JSObject *object)
             return; // unattached handle or partially constructed
 
         switch (repr->kind()) {
-          case TypeRepresentation::Scalar:
-          case TypeRepresentation::Reference:
-          case TypeRepresentation::Struct:
-          case TypeRepresentation::SizedArray:
-          case TypeRepresentation::X4:
+          case TypeDescr::Scalar:
+          case TypeDescr::Reference:
+          case TypeDescr::Struct:
+          case TypeDescr::SizedArray:
+          case TypeDescr::X4:
             repr->asSized()->traceInstance(trace, mem, 1);
             break;
 
-          case TypeRepresentation::UnsizedArray:
+          case TypeDescr::UnsizedArray:
             repr->asUnsizedArray()->element()->traceInstance(trace, mem, datum.length());
             break;
         }
@@ -1475,13 +1583,13 @@ TypedDatum::obj_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id,
     TypeRepresentation *typeRepr = typeDescr->typeRepresentation();
 
     switch (typeRepr->kind()) {
-      case TypeRepresentation::Scalar:
-      case TypeRepresentation::Reference:
-      case TypeRepresentation::X4:
+      case TypeDescr::Scalar:
+      case TypeDescr::Reference:
+      case TypeDescr::X4:
         break;
 
-      case TypeRepresentation::SizedArray:
-      case TypeRepresentation::UnsizedArray:
+      case TypeDescr::SizedArray:
+      case TypeDescr::UnsizedArray:
       {
         uint32_t index;
         if (js_IdIsIndex(id, &index))
@@ -1495,7 +1603,7 @@ TypedDatum::obj_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id,
         break;
       }
 
-      case TypeRepresentation::Struct:
+      case TypeDescr::Struct:
       {
         StructTypeRepresentation *structTypeRepr = typeRepr->asStruct();
         const StructField *field = structTypeRepr->fieldNamed(id);
@@ -1604,34 +1712,6 @@ TypedDatum::obj_defineSpecial(JSContext *cx, HandleObject obj, HandleSpecialId s
     return obj_defineGeneric(cx, obj, id, v, getter, setter, attrs);
 }
 
-static SizedTypeDescr *
-StructFieldType(JSContext *cx,
-                HandleStructTypeDescr type,
-                int32_t fieldIndex)
-{
-    // Recover the original type object here (`field` contains
-    // only its canonical form). The difference is observable,
-    // e.g. in a program like:
-    //
-    //     var Point1 = new StructType({x:uint8, y:uint8});
-    //     var Point2 = new StructType({x:uint8, y:uint8});
-    //     var Line1 = new StructType({start:Point1, end: Point1});
-    //     var Line2 = new StructType({start:Point2, end: Point2});
-    //     var line1 = new Line1(...);
-    //     var line2 = new Line2(...);
-    //
-    // In this scenario, line1.start.type() === Point1 and
-    // line2.start.type() === Point2.
-    RootedObject fieldTypes(
-        cx, &type->getReservedSlot(JS_TYPEOBJ_SLOT_STRUCT_FIELD_TYPES).toObject());
-    RootedValue fieldTypeVal(cx);
-    if (!JSObject::getElement(cx, fieldTypes, fieldTypes,
-                              fieldIndex, &fieldTypeVal))
-        return nullptr;
-
-    return &fieldTypeVal.toObject().as<SizedTypeDescr>();
-}
-
 bool
 TypedDatum::obj_getGeneric(JSContext *cx, HandleObject obj, HandleObject receiver,
                            HandleId id, MutableHandleValue vp)
@@ -1648,15 +1728,15 @@ TypedDatum::obj_getGeneric(JSContext *cx, HandleObject obj, HandleObject receive
 
     TypeRepresentation *typeRepr = datum->typeRepresentation();
     switch (typeRepr->kind()) {
-      case TypeRepresentation::Scalar:
-      case TypeRepresentation::Reference:
+      case TypeDescr::Scalar:
+      case TypeDescr::Reference:
         break;
 
-      case TypeRepresentation::X4:
+      case TypeDescr::X4:
         break;
 
-      case TypeRepresentation::SizedArray:
-      case TypeRepresentation::UnsizedArray:
+      case TypeDescr::SizedArray:
+      case TypeDescr::UnsizedArray:
         if (JSID_IS_ATOM(id, cx->names().length)) {
             if (!datum->typedMem()) { // unattached
                 JS_ReportErrorNumber(
@@ -1670,21 +1750,16 @@ TypedDatum::obj_getGeneric(JSContext *cx, HandleObject obj, HandleObject receive
         }
         break;
 
-      case TypeRepresentation::Struct: {
-        Rooted<StructTypeDescr*> type(cx);
-        type = &datum->typeDescr().as<StructTypeDescr>();
+      case TypeDescr::Struct: {
+        Rooted<StructTypeDescr*> descr(cx, &datum->typeDescr().as<StructTypeDescr>());
 
-        StructTypeRepresentation *structTypeRepr = typeRepr->asStruct();
-        const StructField *field = structTypeRepr->fieldNamed(id);
-        if (!field)
+        size_t fieldIndex;
+        if (!descr->fieldIndex(id, &fieldIndex))
             break;
 
-        Rooted<SizedTypeDescr*> fieldType(cx);
-        fieldType = StructFieldType(cx, type, field->index);
-        if (!fieldType)
-            return false;
-
-        return Reify(cx, field->typeRepr, fieldType, datum, field->offset, vp);
+        size_t offset = descr->fieldOffset(fieldIndex);
+        Rooted<SizedTypeDescr*> fieldType(cx, &descr->fieldDescr(fieldIndex));
+        return Reify(cx, fieldType, datum, offset, vp);
       }
     }
 
@@ -1712,20 +1787,19 @@ TypedDatum::obj_getElement(JSContext *cx, HandleObject obj, HandleObject receive
     JS_ASSERT(obj->is<TypedDatum>());
     Rooted<TypedDatum *> datum(cx, &obj->as<TypedDatum>());
     Rooted<TypeDescr *> descr(cx, &datum->typeDescr());
-    TypeRepresentation *typeRepr = datum->typeRepresentation();
 
-    switch (typeRepr->kind()) {
-      case TypeRepresentation::Scalar:
-      case TypeRepresentation::Reference:
-      case TypeRepresentation::X4:
-      case TypeRepresentation::Struct:
+    switch (descr->kind()) {
+      case TypeDescr::Scalar:
+      case TypeDescr::Reference:
+      case TypeDescr::X4:
+      case TypeDescr::Struct:
         break;
 
-      case TypeRepresentation::SizedArray:
+      case TypeDescr::SizedArray:
         return obj_getArrayElement<SizedArrayTypeDescr>(cx, datum, descr,
                                                         index, vp);
 
-      case TypeRepresentation::UnsizedArray:
+      case TypeDescr::UnsizedArray:
         return obj_getArrayElement<UnsizedArrayTypeDescr>(cx, datum, descr,
                                                           index, vp);
     }
@@ -1754,11 +1828,9 @@ TypedDatum::obj_getArrayElement(JSContext *cx,
         return true;
     }
 
-    Rooted<SizedTypeDescr*> elementType(cx);
-    elementType = &typeDescr->as<T>().elementType();
-    SizedTypeRepresentation *elementTypeRepr = elementType->typeRepresentation();
-    size_t offset = elementTypeRepr->size() * index;
-    return Reify(cx, elementTypeRepr, elementType, datum, offset, vp);
+    Rooted<SizedTypeDescr*> elementType(cx, &typeDescr->as<T>().elementType());
+    size_t offset = elementType->size() * index;
+    return Reify(cx, elementType, datum, offset, vp);
 }
 
 bool
@@ -1783,15 +1855,15 @@ TypedDatum::obj_setGeneric(JSContext *cx, HandleObject obj, HandleId id,
 
     TypeRepresentation *typeRepr = datum->typeRepresentation();
     switch (typeRepr->kind()) {
-      case ScalarTypeRepresentation::Scalar:
-      case TypeRepresentation::Reference:
+      case ScalarTypeDescr::Scalar:
+      case TypeDescr::Reference:
         break;
 
-      case ScalarTypeRepresentation::X4:
+      case ScalarTypeDescr::X4:
         break;
 
-      case ScalarTypeRepresentation::SizedArray:
-      case ScalarTypeRepresentation::UnsizedArray:
+      case ScalarTypeDescr::SizedArray:
+      case ScalarTypeDescr::UnsizedArray:
         if (JSID_IS_ATOM(id, cx->names().length)) {
             JS_ReportErrorNumber(cx, js_GetErrorMessage,
                                  nullptr, JSMSG_CANT_REDEFINE_ARRAY_LENGTH);
@@ -1799,18 +1871,16 @@ TypedDatum::obj_setGeneric(JSContext *cx, HandleObject obj, HandleId id,
         }
         break;
 
-      case ScalarTypeRepresentation::Struct: {
-        const StructField *field = typeRepr->asStruct()->fieldNamed(id);
-        if (!field)
+      case ScalarTypeDescr::Struct: {
+        Rooted<StructTypeDescr*> descr(cx, &datum->typeDescr().as<StructTypeDescr>());
+
+        size_t fieldIndex;
+        if (!descr->fieldIndex(id, &fieldIndex))
             break;
 
-        Rooted<StructTypeDescr *> descr(cx, &datum->typeDescr().as<StructTypeDescr>());
-        Rooted<SizedTypeDescr*> fieldType(cx);
-        fieldType = StructFieldType(cx, descr, field->index);
-        if (!fieldType)
-            return false;
-
-        return ConvertAndCopyTo(cx, fieldType, datum, field->offset, vp);
+        size_t offset = descr->fieldOffset(fieldIndex);
+        Rooted<SizedTypeDescr*> fieldType(cx, &descr->fieldDescr(fieldIndex));
+        return ConvertAndCopyTo(cx, fieldType, datum, offset, vp);
       }
     }
 
@@ -1833,19 +1903,18 @@ TypedDatum::obj_setElement(JSContext *cx, HandleObject obj, uint32_t index,
     JS_ASSERT(obj->is<TypedDatum>());
     Rooted<TypedDatum *> datum(cx, &obj->as<TypedDatum>());
     Rooted<TypeDescr *> descr(cx, &datum->typeDescr());
-    TypeRepresentation *typeRepr = datum->typeRepresentation();
 
-    switch (typeRepr->kind()) {
-      case TypeRepresentation::Scalar:
-      case TypeRepresentation::Reference:
-      case TypeRepresentation::X4:
-      case TypeRepresentation::Struct:
+    switch (descr->kind()) {
+      case TypeDescr::Scalar:
+      case TypeDescr::Reference:
+      case TypeDescr::X4:
+      case TypeDescr::Struct:
         break;
 
-      case TypeRepresentation::SizedArray:
+      case TypeDescr::SizedArray:
         return obj_setArrayElement<SizedArrayTypeDescr>(cx, datum, descr, index, vp);
 
-      case TypeRepresentation::UnsizedArray:
+      case TypeDescr::UnsizedArray:
         return obj_setArrayElement<UnsizedArrayTypeDescr>(cx, datum, descr, index, vp);
     }
 
@@ -1870,8 +1939,7 @@ TypedDatum::obj_setArrayElement(JSContext *cx,
 
     Rooted<SizedTypeDescr*> elementType(cx);
     elementType = &descr->as<T>().elementType();
-    SizedTypeRepresentation *elementTypeRepr = elementType->typeRepresentation();
-    size_t offset = elementTypeRepr->size() * index;
+    size_t offset = elementType->size() * index;
     return ConvertAndCopyTo(cx, elementType, datum, offset, vp);
 }
 
@@ -1893,15 +1961,15 @@ TypedDatum::obj_getGenericAttributes(JSContext *cx, HandleObject obj,
     TypeRepresentation *typeRepr = datum->typeRepresentation();
 
     switch (typeRepr->kind()) {
-      case TypeRepresentation::Scalar:
-      case TypeRepresentation::Reference:
+      case TypeDescr::Scalar:
+      case TypeDescr::Reference:
         break;
 
-      case TypeRepresentation::X4:
+      case TypeDescr::X4:
         break;
 
-      case TypeRepresentation::SizedArray:
-      case TypeRepresentation::UnsizedArray:
+      case TypeDescr::SizedArray:
+      case TypeDescr::UnsizedArray:
         if (js_IdIsIndex(id, &index)) {
             *attrsp = JSPROP_ENUMERATE | JSPROP_PERMANENT;
             return true;
@@ -1912,7 +1980,7 @@ TypedDatum::obj_getGenericAttributes(JSContext *cx, HandleObject obj,
         }
         break;
 
-      case TypeRepresentation::Struct:
+      case TypeDescr::Struct:
         if (typeRepr->asStruct()->fieldNamed(id) != nullptr) {
             *attrsp = JSPROP_ENUMERATE | JSPROP_PERMANENT;
             return true;
@@ -1937,16 +2005,16 @@ IsOwnId(JSContext *cx, HandleObject obj, HandleId id)
     TypeRepresentation *typeRepr = datum->typeRepresentation();
 
     switch (typeRepr->kind()) {
-      case TypeRepresentation::Scalar:
-      case TypeRepresentation::Reference:
-      case TypeRepresentation::X4:
+      case TypeDescr::Scalar:
+      case TypeDescr::Reference:
+      case TypeDescr::X4:
         return false;
 
-      case TypeRepresentation::SizedArray:
-      case TypeRepresentation::UnsizedArray:
+      case TypeDescr::SizedArray:
+      case TypeDescr::UnsizedArray:
         return js_IdIsIndex(id, &index) || JSID_IS_ATOM(id, cx->names().length);
 
-      case TypeRepresentation::Struct:
+      case TypeDescr::Struct:
         return typeRepr->asStruct()->fieldNamed(id) != nullptr;
     }
 
@@ -2030,9 +2098,9 @@ TypedDatum::obj_enumerate(JSContext *cx, HandleObject obj, JSIterateOp enum_op,
     TypeRepresentation *typeRepr = datum->typeRepresentation();
 
     switch (typeRepr->kind()) {
-      case TypeRepresentation::Scalar:
-      case TypeRepresentation::Reference:
-      case TypeRepresentation::X4:
+      case TypeDescr::Scalar:
+      case TypeDescr::Reference:
+      case TypeDescr::X4:
         switch (enum_op) {
           case JSENUMERATE_INIT_ALL:
           case JSENUMERATE_INIT:
@@ -2046,8 +2114,8 @@ TypedDatum::obj_enumerate(JSContext *cx, HandleObject obj, JSIterateOp enum_op,
         }
         break;
 
-      case TypeRepresentation::SizedArray:
-      case TypeRepresentation::UnsizedArray:
+      case TypeDescr::SizedArray:
+      case TypeDescr::UnsizedArray:
         switch (enum_op) {
           case JSENUMERATE_INIT_ALL:
           case JSENUMERATE_INIT:
@@ -2074,7 +2142,7 @@ TypedDatum::obj_enumerate(JSContext *cx, HandleObject obj, JSIterateOp enum_op,
         }
         break;
 
-      case TypeRepresentation::Struct:
+      case TypeDescr::Struct:
         switch (enum_op) {
           case JSENUMERATE_INIT_ALL:
           case JSENUMERATE_INIT:
@@ -2177,13 +2245,14 @@ TypedObject::createZeroed(JSContext *cx,
     // Allocate and initialize the memory for this instance.
     // Also initialize the JS_DATUM_SLOT_LENGTH slot.
     TypeRepresentation *typeRepr = descr->typeRepresentation();
-    switch (typeRepr->kind()) {
-      case TypeRepresentation::Scalar:
-      case TypeRepresentation::Reference:
-      case TypeRepresentation::Struct:
-      case TypeRepresentation::X4:
+    switch (descr->kind()) {
+      case TypeDescr::Scalar:
+      case TypeDescr::Reference:
+      case TypeDescr::Struct:
+      case TypeDescr::X4:
       {
-        uint8_t *memory = (uint8_t*) cx->malloc_(typeRepr->asSized()->size());
+        uint8_t *memory =
+            (uint8_t*) cx->malloc_(descr->as<SizedTypeDescr>().size());
         if (!memory)
             return nullptr;
         typeRepr->asSized()->initInstance(cx->runtime(), memory, 1);
@@ -2191,9 +2260,10 @@ TypedObject::createZeroed(JSContext *cx,
         return obj;
       }
 
-      case TypeRepresentation::SizedArray:
+      case TypeDescr::SizedArray:
       {
-        uint8_t *memory = (uint8_t*) cx->malloc_(typeRepr->asSizedArray()->size());
+        uint8_t *memory =
+            (uint8_t*) cx->malloc_(descr->as<SizedTypeDescr>().size());
         if (!memory)
             return nullptr;
         typeRepr->asSizedArray()->initInstance(cx->runtime(), memory, 1);
@@ -2201,7 +2271,7 @@ TypedObject::createZeroed(JSContext *cx,
         return obj;
       }
 
-      case TypeRepresentation::UnsizedArray:
+      case TypeDescr::UnsizedArray:
       {
         SizedTypeRepresentation *elementTypeRepr =
             typeRepr->asUnsizedArray()->element();
@@ -2240,18 +2310,18 @@ TypedObject::construct(JSContext *cx, unsigned int argc, Value *vp)
     uint32_t nextArg = 0;
     int32_t length = 0;
     switch (typeRepr->kind()) {
-      case TypeRepresentation::Scalar:
-      case TypeRepresentation::Reference:
-      case TypeRepresentation::Struct:
-      case TypeRepresentation::X4:
+      case TypeDescr::Scalar:
+      case TypeDescr::Reference:
+      case TypeDescr::Struct:
+      case TypeDescr::X4:
         length = 0;
         break;
 
-      case TypeRepresentation::SizedArray:
+      case TypeDescr::SizedArray:
         length = typeRepr->asSizedArray()->length();
         break;
 
-      case TypeRepresentation::UnsizedArray:
+      case TypeDescr::UnsizedArray:
         // First argument is a length.
         if (nextArg >= argc || !args[nextArg].isInt32()) {
             JS_ReportErrorNumber(cx, js_GetErrorMessage,
diff --git a/js/src/builtin/TypedObject.h b/js/src/builtin/TypedObject.h
index de71a9bc18fb..40e278b73e8d 100644
--- a/js/src/builtin/TypedObject.h
+++ b/js/src/builtin/TypedObject.h
@@ -10,7 +10,6 @@
 #include "jsobj.h"
 
 #include "builtin/TypedObjectConstants.h"
-#include "builtin/TypeRepresentation.h"
 
 /*
  * -------------
@@ -96,29 +95,12 @@
 
 namespace js {
 
+class TypeRepresentation;
+class ScalarTypeRepresentation;
+class ReferenceTypeRepresentation;
+class X4TypeRepresentation;
 class StructTypeDescr;
 
-/*
- * This object exists in order to encapsulate the typed object types
- * somewhat, rather than sticking them all into the global object.
- * Eventually it will go away and become a module.
- */
-class TypedObjectModuleObject : public JSObject {
-  public:
-    enum Slot {
-        ArrayTypePrototype,
-        StructTypePrototype,
-        SlotCount
-    };
-
-    static const Class class_;
-
-    static bool getSuitableClaspAndProto(JSContext *cx,
-                                         TypeRepresentation::Kind kind,
-                                         const Class **clasp,
-                                         MutableHandleObject proto);
-};
-
 /*
  * Helper method for converting a double into other scalar
  * types in the same way that JavaScript would. In particular,
@@ -139,22 +121,50 @@ static T ConvertScalar(double d)
     }
 }
 
-bool TypeDescrToSource(JSContext *cx, unsigned int argc, Value *vp);
-
 class TypeDescr : public JSObject
 {
   public:
+    enum Kind {
+        Scalar = JS_TYPEREPR_SCALAR_KIND,
+        Reference = JS_TYPEREPR_REFERENCE_KIND,
+        X4 = JS_TYPEREPR_X4_KIND,
+        Struct = JS_TYPEREPR_STRUCT_KIND,
+        SizedArray = JS_TYPEREPR_SIZED_ARRAY_KIND,
+        UnsizedArray = JS_TYPEREPR_UNSIZED_ARRAY_KIND,
+    };
+
+    static bool isSized(Kind kind) {
+        return kind > JS_TYPEREPR_MAX_UNSIZED_KIND;
+    }
+
     JSObject &typeRepresentationOwnerObj() const {
-        return getReservedSlot(JS_TYPEOBJ_SLOT_TYPE_REPR).toObject();
+        return getReservedSlot(JS_DESCR_SLOT_TYPE_REPR).toObject();
     }
 
-    TypeRepresentation *typeRepresentation() const {
-        return TypeRepresentation::fromOwnerObject(typeRepresentationOwnerObj());
-    }
+    TypeRepresentation *typeRepresentation() const;
 
-    TypeRepresentation::Kind kind() const {
-        return typeRepresentation()->kind();
-    }
+    TypeDescr::Kind kind() const;
+};
+
+/*
+ * This object exists in order to encapsulate the typed object types
+ * somewhat, rather than sticking them all into the global object.
+ * Eventually it will go away and become a module.
+ */
+class TypedObjectModuleObject : public JSObject {
+  public:
+    enum Slot {
+        ArrayTypePrototype,
+        StructTypePrototype,
+        SlotCount
+    };
+
+    static const Class class_;
+
+    static bool getSuitableClaspAndProto(JSContext *cx,
+                                         TypeDescr::Kind kind,
+                                         const Class **clasp,
+                                         MutableHandleObject proto);
 };
 
 typedef Handle<TypeDescr*> HandleTypeDescr;
@@ -166,12 +176,8 @@ bool InitializeCommonTypeDescriptorProperties(JSContext *cx,
 class SizedTypeDescr : public TypeDescr
 {
   public:
-    SizedTypeRepresentation *typeRepresentation() const {
-        return ((TypeDescr*)this)->typeRepresentation()->asSized();
-    }
-
     size_t size() {
-        return typeRepresentation()->size();
+        return getReservedSlot(JS_DESCR_SLOT_SIZE).toInt32();
     }
 };
 
@@ -188,39 +194,115 @@ class SimpleTypeDescr : public SizedTypeDescr
 class ScalarTypeDescr : public SimpleTypeDescr
 {
   public:
+    // Must match order of JS_FOR_EACH_SCALAR_TYPE_REPR below
+    enum Type {
+        TYPE_INT8 = JS_SCALARTYPEREPR_INT8,
+        TYPE_UINT8 = JS_SCALARTYPEREPR_UINT8,
+        TYPE_INT16 = JS_SCALARTYPEREPR_INT16,
+        TYPE_UINT16 = JS_SCALARTYPEREPR_UINT16,
+        TYPE_INT32 = JS_SCALARTYPEREPR_INT32,
+        TYPE_UINT32 = JS_SCALARTYPEREPR_UINT32,
+        TYPE_FLOAT32 = JS_SCALARTYPEREPR_FLOAT32,
+        TYPE_FLOAT64 = JS_SCALARTYPEREPR_FLOAT64,
+
+        /*
+         * Special type that's a uint8_t, but assignments are clamped to 0 .. 255.
+         * Treat the raw data type as a uint8_t.
+         */
+        TYPE_UINT8_CLAMPED = JS_SCALARTYPEREPR_UINT8_CLAMPED,
+    };
+    static const int32_t TYPE_MAX = TYPE_UINT8_CLAMPED + 1;
+
+    static size_t size(Type t);
+    static size_t alignment(Type t);
+    static const char *typeName(Type type);
+
     static const Class class_;
     static const JSFunctionSpec typeObjectMethods[];
     typedef ScalarTypeRepresentation TypeRepr;
 
+    ScalarTypeDescr::Type type() const {
+        return (ScalarTypeDescr::Type) getReservedSlot(JS_DESCR_SLOT_TYPE).toInt32();
+    }
+
     static bool call(JSContext *cx, unsigned argc, Value *vp);
 };
 
+// Enumerates the cases of ScalarTypeDescr::Type which have
+// unique C representation. In particular, omits Uint8Clamped since it
+// is just a Uint8.
+#define JS_FOR_EACH_UNIQUE_SCALAR_TYPE_REPR_CTYPE(macro_)                     \
+    macro_(ScalarTypeDescr::TYPE_INT8,    int8_t,   int8)            \
+    macro_(ScalarTypeDescr::TYPE_UINT8,   uint8_t,  uint8)           \
+    macro_(ScalarTypeDescr::TYPE_INT16,   int16_t,  int16)           \
+    macro_(ScalarTypeDescr::TYPE_UINT16,  uint16_t, uint16)          \
+    macro_(ScalarTypeDescr::TYPE_INT32,   int32_t,  int32)           \
+    macro_(ScalarTypeDescr::TYPE_UINT32,  uint32_t, uint32)          \
+    macro_(ScalarTypeDescr::TYPE_FLOAT32, float,    float32)         \
+    macro_(ScalarTypeDescr::TYPE_FLOAT64, double,   float64)
+
+// Must be in same order as the enum ScalarTypeDescr::Type:
+#define JS_FOR_EACH_SCALAR_TYPE_REPR(macro_)                                    \
+    JS_FOR_EACH_UNIQUE_SCALAR_TYPE_REPR_CTYPE(macro_)                           \
+    macro_(ScalarTypeDescr::TYPE_UINT8_CLAMPED, uint8_t, uint8Clamped)
+
 // Type for reference type constructors like `Any`, `String`, and
 // `Object`. All such type constructors share a common js::Class and
 // JSFunctionSpec. All these types are opaque.
 class ReferenceTypeDescr : public SimpleTypeDescr
 {
   public:
+    // Must match order of JS_FOR_EACH_REFERENCE_TYPE_REPR below
+    enum Type {
+        TYPE_ANY = JS_REFERENCETYPEREPR_ANY,
+        TYPE_OBJECT = JS_REFERENCETYPEREPR_OBJECT,
+        TYPE_STRING = JS_REFERENCETYPEREPR_STRING,
+    };
+    static const int32_t TYPE_MAX = TYPE_STRING + 1;
+    static const char *typeName(Type type);
+
     static const Class class_;
     static const JSFunctionSpec typeObjectMethods[];
     typedef ReferenceTypeRepresentation TypeRepr;
 
+    ReferenceTypeDescr::Type type() const {
+        return (ReferenceTypeDescr::Type) getReservedSlot(JS_DESCR_SLOT_TYPE).toInt32();
+    }
+
     static bool call(JSContext *cx, unsigned argc, Value *vp);
 };
 
+#define JS_FOR_EACH_REFERENCE_TYPE_REPR(macro_)                    \
+    macro_(ReferenceTypeDescr::TYPE_ANY,    HeapValue, Any)        \
+    macro_(ReferenceTypeDescr::TYPE_OBJECT, HeapPtrObject, Object) \
+    macro_(ReferenceTypeDescr::TYPE_STRING, HeapPtrString, string)
+
 /*
  * Type descriptors `float32x4` and `int32x4`
  */
 class X4TypeDescr : public SizedTypeDescr
 {
-  private:
   public:
+    enum Type {
+        TYPE_INT32 = JS_X4TYPEREPR_INT32,
+        TYPE_FLOAT32 = JS_X4TYPEREPR_FLOAT32,
+    };
+
     static const Class class_;
+    typedef X4TypeRepresentation TypeRepr;
+
+    X4TypeDescr::Type type() const {
+        return (X4TypeDescr::Type) getReservedSlot(JS_DESCR_SLOT_TYPE).toInt32();
+    }
 
     static bool call(JSContext *cx, unsigned argc, Value *vp);
     static bool is(const Value &v);
 };
 
+#define JS_FOR_EACH_X4_TYPE_REPR(macro_)                             \
+    macro_(X4TypeDescr::TYPE_INT32, int32_t, int32)                  \
+    macro_(X4TypeDescr::TYPE_FLOAT32, float, float32)
+
 /*
  * Properties and methods of the `ArrayType` meta type object. There
  * is no `class_` field because `ArrayType` is just a native
@@ -276,7 +358,7 @@ class UnsizedArrayTypeDescr : public TypeDescr
     static bool dimension(JSContext *cx, unsigned int argc, jsval *vp);
 
     SizedTypeDescr &elementType() {
-        return getReservedSlot(JS_TYPEOBJ_SLOT_ARRAY_ELEM_TYPE).toObject().as<SizedTypeDescr>();
+        return getReservedSlot(JS_DESCR_SLOT_ARRAY_ELEM_TYPE).toObject().as<SizedTypeDescr>();
     }
 };
 
@@ -289,7 +371,11 @@ class SizedArrayTypeDescr : public SizedTypeDescr
     static const Class class_;
 
     SizedTypeDescr &elementType() {
-        return getReservedSlot(JS_TYPEOBJ_SLOT_ARRAY_ELEM_TYPE).toObject().as<SizedTypeDescr>();
+        return getReservedSlot(JS_DESCR_SLOT_ARRAY_ELEM_TYPE).toObject().as<SizedTypeDescr>();
+    }
+
+    size_t length() {
+        return (size_t) getReservedSlot(JS_DESCR_SLOT_SIZED_ARRAY_LENGTH).toInt32();
     }
 };
 
@@ -326,15 +412,21 @@ class StructMetaTypeDescr : public JSObject
     // This is the function that gets called when the user
     // does `new StructType(...)`. It produces a struct type object.
     static bool construct(JSContext *cx, unsigned argc, Value *vp);
-
-    static bool convertAndCopyTo(JSContext *cx,
-                                 StructTypeRepresentation *typeRepr,
-                                 HandleValue from, uint8_t *mem);
 };
 
 class StructTypeDescr : public SizedTypeDescr {
   public:
     static const Class class_;
+
+    // Set `*out` to the index of the field named `id` and returns true,
+    // or return false if no such field exists.
+    bool fieldIndex(jsid id, size_t *out);
+
+    // Return the type descr of the field at index `index`.
+    SizedTypeDescr &fieldDescr(size_t index);
+
+    // Return the offset of the field at index `index`.
+    size_t fieldOffset(size_t index);
 };
 
 typedef Handle<StructTypeDescr*> HandleStructTypeDescr;
@@ -495,22 +587,22 @@ class TypedDatum : public JSObject
     }
 
     size_t length() const {
-        JS_ASSERT(typeRepresentation()->isAnyArray());
         return getReservedSlot(JS_DATUM_SLOT_LENGTH).toInt32();
     }
 
     size_t size() const {
-        TypeRepresentation *typeRepr = typeRepresentation();
-        switch (typeRepr->kind()) {
-          case TypeRepresentation::Scalar:
-          case TypeRepresentation::X4:
-          case TypeRepresentation::Reference:
-          case TypeRepresentation::Struct:
-          case TypeRepresentation::SizedArray:
-            return typeRepr->asSized()->size();
+        switch (typeDescr().kind()) {
+          case TypeDescr::Scalar:
+          case TypeDescr::X4:
+          case TypeDescr::Reference:
+          case TypeDescr::Struct:
+          case TypeDescr::SizedArray:
+            return typeDescr().as<SizedTypeDescr>().size();
 
-          case TypeRepresentation::UnsizedArray:
-            return typeRepr->asUnsizedArray()->element()->size() * length();
+          case TypeDescr::UnsizedArray: {
+            SizedTypeDescr &elementType = typeDescr().as<UnsizedArrayTypeDescr>().elementType();
+            return elementType.size() * length();
+          }
         }
         MOZ_ASSUME_UNREACHABLE("unhandled typerepresentation kind");
     }
diff --git a/js/src/builtin/TypedObject.js b/js/src/builtin/TypedObject.js
index cbede52fb8ca..d2b0af721ea8 100644
--- a/js/src/builtin/TypedObject.js
+++ b/js/src/builtin/TypedObject.js
@@ -3,10 +3,29 @@
 ///////////////////////////////////////////////////////////////////////////
 // Getters and setters for various slots.
 
+// Type repr slots
+
+#define REPR_KIND(obj)   \
+    TO_INT32(UnsafeGetReservedSlot(obj, JS_TYPEREPR_SLOT_KIND))
+
 // Type object slots
 
-#define TYPE_TYPE_REPR(obj) \
-    UnsafeGetReservedSlot(obj, JS_TYPEOBJ_SLOT_TYPE_REPR)
+#define DESCR_TYPE_REPR(obj) \
+    UnsafeGetReservedSlot(obj, JS_DESCR_SLOT_TYPE_REPR)
+#define DESCR_KIND(obj) \
+    REPR_KIND(DESCR_TYPE_REPR(obj))
+#define DESCR_SIZE(obj) \
+    UnsafeGetReservedSlot(obj, JS_DESCR_SLOT_SIZE)
+#define DESCR_SIZED_ARRAY_LENGTH(obj) \
+    TO_INT32(UnsafeGetReservedSlot(obj, JS_DESCR_SLOT_SIZED_ARRAY_LENGTH))
+#define DESCR_TYPE(obj)   \
+    UnsafeGetReservedSlot(obj, JS_DESCR_SLOT_TYPE)
+#define DESCR_STRUCT_FIELD_NAMES(obj) \
+    UnsafeGetReservedSlot(obj, JS_DESCR_SLOT_STRUCT_FIELD_NAMES)
+#define DESCR_STRUCT_FIELD_TYPES(obj) \
+    UnsafeGetReservedSlot(obj, JS_DESCR_SLOT_STRUCT_FIELD_TYPES)
+#define DESCR_STRUCT_FIELD_OFFSETS(obj) \
+    UnsafeGetReservedSlot(obj, JS_DESCR_SLOT_STRUCT_FIELD_OFFSETS)
 
 // Typed object slots
 
@@ -17,25 +36,97 @@
 #define DATUM_LENGTH(obj) \
     TO_INT32(UnsafeGetReservedSlot(obj, JS_DATUM_SLOT_LENGTH))
 
-// Type repr slots
-
-#define REPR_KIND(obj)   \
-    TO_INT32(UnsafeGetReservedSlot(obj, JS_TYPEREPR_SLOT_KIND))
-#define REPR_SIZE(obj)   \
-    TO_INT32(UnsafeGetReservedSlot(obj, JS_TYPEREPR_SLOT_SIZE))
-#define REPR_ALIGNMENT(obj) \
-    TO_INT32(UnsafeGetReservedSlot(obj, JS_TYPEREPR_SLOT_ALIGNMENT))
-#define REPR_LENGTH(obj)   \
-    TO_INT32(UnsafeGetReservedSlot(obj, JS_TYPEREPR_SLOT_LENGTH))
-#define REPR_TYPE(obj)   \
-    TO_INT32(UnsafeGetReservedSlot(obj, JS_TYPEREPR_SLOT_TYPE))
-
 #define HAS_PROPERTY(obj, prop) \
     callFunction(std_Object_hasOwnProperty, obj, prop)
 
 function DATUM_TYPE_REPR(obj) {
   // Eventually this will be a slot on typed objects
-  return TYPE_TYPE_REPR(DATUM_TYPE_DESCR(obj));
+  return DESCR_TYPE_REPR(DATUM_TYPE_DESCR(obj));
+}
+
+///////////////////////////////////////////////////////////////////////////
+// DescrToSource
+//
+// Converts a type descriptor to a descriptive string
+
+// toSource() for type descriptors.
+//
+// Warning: user exposed!
+function DescrToSourceMethod() {
+  if (!IsObject(this) || !ObjectIsTypeDescr(this))
+    ThrowError(JSMSG_INCOMPATIBLE_PROTO, "Type", "toSource", "value");
+
+  return DescrToSource(this);
+}
+
+function DescrToSource(descr) {
+  assert(IsObject(descr) && ObjectIsTypeDescr(descr),
+         "DescrToSource: not type descr");
+
+  switch (DESCR_KIND(descr)) {
+  case JS_TYPEREPR_SCALAR_KIND:
+    switch (DESCR_TYPE(descr)) {
+    case JS_SCALARTYPEREPR_INT8: return "int8";
+    case JS_SCALARTYPEREPR_UINT8: return "uint8";
+    case JS_SCALARTYPEREPR_UINT8_CLAMPED: return "uint8Clamped";
+    case JS_SCALARTYPEREPR_INT16: return "int16";
+    case JS_SCALARTYPEREPR_UINT16: return "uint16";
+    case JS_SCALARTYPEREPR_INT32: return "int32";
+    case JS_SCALARTYPEREPR_UINT32: return "uint32";
+    case JS_SCALARTYPEREPR_FLOAT32: return "float32";
+    case JS_SCALARTYPEREPR_FLOAT64: return "float64";
+    }
+    assert(false, "Unhandled type: " + DESCR_TYPE(descr));
+    return undefined;
+
+  case JS_TYPEREPR_REFERENCE_KIND:
+    switch (DESCR_TYPE(descr)) {
+    case JS_REFERENCETYPEREPR_ANY: return "any";
+    case JS_REFERENCETYPEREPR_OBJECT: return "Object";
+    case JS_REFERENCETYPEREPR_STRING: return "string";
+    }
+    assert(false, "Unhandled type: " + DESCR_TYPE(descr));
+    return undefined;
+
+  case JS_TYPEREPR_X4_KIND:
+    switch (DESCR_TYPE(descr)) {
+    case JS_X4TYPEREPR_FLOAT32: return "float32x4";
+    case JS_X4TYPEREPR_INT32: return "int32x4";
+    }
+    assert(false, "Unhandled type: " + DESCR_TYPE(descr));
+    return undefined;
+
+  case JS_TYPEREPR_STRUCT_KIND:
+    var result = "new StructType({";
+    var fieldNames = DESCR_STRUCT_FIELD_NAMES(descr);
+    var fieldTypes = DESCR_STRUCT_FIELD_TYPES(descr);
+    for (var i = 0; i < fieldNames.length; i++) {
+      if (i != 0)
+        result += ", ";
+
+      result += fieldNames[i];
+      result += ": ";
+      result += DescrToSource(fieldTypes[i]);
+    }
+    result += "})";
+    return result;
+
+  case JS_TYPEREPR_UNSIZED_ARRAY_KIND:
+    return "new ArrayType(" + DescrToSource(descr.elementType) + ")";
+
+  case JS_TYPEREPR_SIZED_ARRAY_KIND:
+    var result = ".array";
+    var sep = "(";
+    while (DESCR_KIND(descr) == JS_TYPEREPR_SIZED_ARRAY_KIND) {
+      result += sep + DESCR_SIZED_ARRAY_LENGTH(descr);
+      descr = descr.elementType;
+      sep = ", ";
+    }
+    return DescrToSource(descr) + result + ")";
+  }
+
+  assert(false, "Unhandled kind: " + DESCR_KIND(descr));
+  return undefined;
 }
 
 ///////////////////////////////////////////////////////////////////////////
@@ -43,8 +134,7 @@ function DATUM_TYPE_REPR(obj) {
 //
 // TypedObjectPointers are internal structs used to represent a
 // pointer into typed object memory. They pull together:
-// - typeRepr: the internal type representation
-// - descr: the user-visible type object
+// - descr: the type descriptor
 // - datum: the typed object that contains the allocated block of memory
 // - offset: an offset into that typed object
 //
@@ -58,8 +148,11 @@ function DATUM_TYPE_REPR(obj) {
 // they mutate the receiver in place, because it makes for prettier
 // code.
 
-function TypedObjectPointer(typeRepr, descr, datum, offset) {
-  this.typeRepr = typeRepr;
+function TypedObjectPointer(descr, datum, offset) {
+  assert(IsObject(descr) && ObjectIsTypeDescr(descr), "Not descr");
+  assert(IsObject(datum) && ObjectIsTypedDatum(datum), "Not datum");
+  assert(TO_INT32(offset) === offset, "offset not int");
+
   this.descr = descr;
   this.datum = datum;
   this.offset = offset;
@@ -68,25 +161,20 @@ function TypedObjectPointer(typeRepr, descr, datum, offset) {
 MakeConstructible(TypedObjectPointer, {});
 
 TypedObjectPointer.fromTypedDatum = function(typed) {
-  return new TypedObjectPointer(DATUM_TYPE_REPR(typed),
-                                DATUM_TYPE_DESCR(typed),
-                                typed,
-                                0);
+  return new TypedObjectPointer(DATUM_TYPE_DESCR(typed), typed, 0);
 }
 
 #ifdef DEBUG
 TypedObjectPointer.prototype.toString = function() {
-  return "Ptr(" + this.descr.toSource() + " @ " + this.offset + ")";
+  return "Ptr(" + DescrToSource(this.descr) + " @ " + this.offset + ")";
 };
 #endif
 
 TypedObjectPointer.prototype.copy = function() {
-  return new TypedObjectPointer(this.typeRepr, this.descr,
-                                this.datum, this.offset);
+  return new TypedObjectPointer(this.descr, this.datum, this.offset);
 };
 
 TypedObjectPointer.prototype.reset = function(inPtr) {
-  this.typeRepr = inPtr.typeRepr;
   this.descr = inPtr.descr;
   this.datum = inPtr.datum;
   this.offset = inPtr.offset;
@@ -94,19 +182,21 @@ TypedObjectPointer.prototype.reset = function(inPtr) {
 };
 
 TypedObjectPointer.prototype.kind = function() {
-  return REPR_KIND(this.typeRepr);
+  return DESCR_KIND(this.descr);
 }
 
+// Extract the length. This does a switch on kind, so it's
+// best if we can avoid it.
 TypedObjectPointer.prototype.length = function() {
   switch (this.kind()) {
   case JS_TYPEREPR_SIZED_ARRAY_KIND:
-    return REPR_LENGTH(this.typeRepr);
+    return DESCR_SIZED_ARRAY_LENGTH(this.descr);
 
   case JS_TYPEREPR_UNSIZED_ARRAY_KIND:
-    return DATUM_LENGTH(this.datum);
+    return this.datum.length;
   }
-  assert(false, "length() invoked on non-array-type");
-  return 0;
+  assert(false, "Invalid kind for length");
+  return false;
 }
 
 ///////////////////////////////////////////////////////////////////////////
@@ -125,15 +215,10 @@ TypedObjectPointer.prototype.moveTo = function(propName) {
     break;
 
   case JS_TYPEREPR_SIZED_ARRAY_KIND:
+    return this.moveToArray(propName, DESCR_SIZED_ARRAY_LENGTH(this.descr));
+
   case JS_TYPEREPR_UNSIZED_ARRAY_KIND:
-    // For an array, property must be an element. Note that we use the
-    // length as loaded from the type *representation* as opposed to
-    // the type *object*; this is because some type objects represent
-    // unsized arrays and hence do not have a length.
-    var index = TO_INT32(propName);
-    if (index === propName && index >= 0 && index < this.length())
-      return this.moveToElem(index);
-    break;
+    return this.moveToArray(propName, this.datum.length);
 
   case JS_TYPEREPR_STRUCT_KIND:
     if (HAS_PROPERTY(this.descr.fieldTypes, propName))
@@ -145,6 +230,20 @@ TypedObjectPointer.prototype.moveTo = function(propName) {
   return undefined;
 };
 
+TypedObjectPointer.prototype.moveToArray = function(propName, length) {
+  // For an array, property must be an element. Note that we take
+  // the length as an argument rather than loading it from the descriptor.
+  // This is because this same helper is used for *unsized arrays*, where
+  // the length is drawn from the datum, and *sized arrays*, where the
+  // length is drawn from the type.
+  var index = TO_INT32(propName);
+  if (index === propName && index >= 0 && index < length)
+    return this.moveToElem(index);
+
+  ThrowError(JSMSG_TYPEDOBJECT_NO_SUCH_PROP, propName);
+  return undefined;
+}
+
 // Adjust `this` in place to point at the element `index`.  `this`
 // must be a array type and `index` must be within bounds. Returns
 // `this`.
@@ -155,13 +254,11 @@ TypedObjectPointer.prototype.moveToElem = function(index) {
   assert(TO_INT32(index) === index,
          "moveToElem invoked with non-integer index");
   assert(index >= 0 && index < this.length(),
-         "moveToElem invoked with out-of-bounds index: " + index);
+         "moveToElem invoked with negative index: " + index);
 
-  var elementTypeObj = this.descr.elementType;
-  var elementTypeRepr = TYPE_TYPE_REPR(elementTypeObj);
-  this.typeRepr = elementTypeRepr;
-  this.descr = elementTypeObj;
-  var elementSize = REPR_SIZE(elementTypeRepr);
+  var elementDescr = this.descr.elementType;
+  this.descr = elementDescr;
+  var elementSize = DESCR_SIZE(elementDescr);
 
   // Note: we do not allow construction of arrays where the offset
   // of an element cannot be represented by an int32.
@@ -170,22 +267,36 @@ TypedObjectPointer.prototype.moveToElem = function(index) {
   return this;
 };
 
+TypedObjectPointer.prototype.moveToField = function(propName) {
+  var fieldNames = DESCR_STRUCT_FIELD_NAMES(this.descr);
+  var index = fieldNames.indexOf(propName);
+  if (index != -1)
+    return this.moveToFieldIndex(index);
+
+  ThrowError(JSMSG_TYPEDOBJECT_NO_SUCH_PROP, propName);
+  return undefined;
+}
+
 // Adjust `this` to point at the field `propName`.  `this` must be a
 // struct type and `propName` must be a valid field name. Returns
 // `this`.
-TypedObjectPointer.prototype.moveToField = function(propName) {
+TypedObjectPointer.prototype.moveToFieldIndex = function(index) {
   assert(this.kind() == JS_TYPEREPR_STRUCT_KIND,
-         "moveToField invoked on non-struct");
-  assert(HAS_PROPERTY(this.descr.fieldTypes, propName),
-         "moveToField invoked with undefined field");
+         "moveToFieldIndex invoked on non-struct");
+  assert(index >= 0 && index < DESCR_STRUCT_FIELD_NAMES(this.descr).length,
+         "moveToFieldIndex invoked with invalid field index " + index);
 
-  var fieldTypeObj = this.descr.fieldTypes[propName];
-  var fieldOffset = TO_INT32(this.descr.fieldOffsets[propName]);
-  this.descr = fieldTypeObj;
-  this.typeRepr = TYPE_TYPE_REPR(fieldTypeObj);
+  var fieldDescr = DESCR_STRUCT_FIELD_TYPES(this.descr)[index];
+  var fieldOffset = TO_INT32(DESCR_STRUCT_FIELD_OFFSETS(this.descr)[index]);
 
-  // Note: we do not allow construction of structs where the
-  // offset of a field cannot be represented by an int32.
+  assert(IsObject(fieldDescr) && ObjectIsTypeDescr(fieldDescr),
+         "bad field descr");
+  assert(TO_INT32(fieldOffset) === fieldOffset,
+         "bad field offset");
+  assert(fieldOffset >= 0 && fieldOffset < DESCR_SIZE(this.descr),
+         "out of bounds field offset");
+
+  this.descr = fieldDescr;
   this.offset += fieldOffset;
 
   return this;
@@ -206,7 +317,7 @@ TypedObjectPointer.prototype.moveToField = function(propName) {
 TypedObjectPointer.prototype.get = function() {
   assert(ObjectIsAttached(this.datum), "get() called with unattached datum");
 
-  switch (REPR_KIND(this.typeRepr)) {
+  switch (this.kind()) {
   case JS_TYPEREPR_SCALAR_KIND:
     return this.getScalar();
 
@@ -223,15 +334,15 @@ TypedObjectPointer.prototype.get = function() {
     return NewDerivedTypedDatum(this.descr, this.datum, this.offset);
 
   case JS_TYPEREPR_UNSIZED_ARRAY_KIND:
-    assert(false, "Unhandled repr kind: " + REPR_KIND(this.typeRepr));
+    assert(false, "Unhandled repr kind: " + this.kind());
   }
 
-  assert(false, "Unhandled kind: " + REPR_KIND(this.typeRepr));
+  assert(false, "Unhandled kind: " + this.kind());
   return undefined;
 }
 
 TypedObjectPointer.prototype.getScalar = function() {
-  var type = REPR_TYPE(this.typeRepr);
+  var type = DESCR_TYPE(this.descr);
   switch (type) {
   case JS_SCALARTYPEREPR_INT8:
     return Load_int8(this.datum, this.offset);
@@ -264,7 +375,7 @@ TypedObjectPointer.prototype.getScalar = function() {
 }
 
 TypedObjectPointer.prototype.getReference = function() {
-  var type = REPR_TYPE(this.typeRepr);
+  var type = DESCR_TYPE(this.descr);
   switch (type) {
   case JS_REFERENCETYPEREPR_ANY:
     return Load_Any(this.datum, this.offset);
@@ -281,7 +392,7 @@ TypedObjectPointer.prototype.getReference = function() {
 }
 
 TypedObjectPointer.prototype.getX4 = function() {
-  var type = REPR_TYPE(this.typeRepr);
+  var type = DESCR_TYPE(this.descr);
   switch (type) {
   case JS_X4TYPEREPR_FLOAT32:
     var x = Load_float32(this.datum, this.offset + 0);
@@ -313,23 +424,22 @@ TypedObjectPointer.prototype.getX4 = function() {
 TypedObjectPointer.prototype.set = function(fromValue) {
   assert(ObjectIsAttached(this.datum), "set() called with unattached datum");
 
-  var typeRepr = this.typeRepr;
-
   // Fast path: `fromValue` is a typed object with same type
   // representation as the destination. In that case, we can just do a
   // memcpy.
   if (IsObject(fromValue) && ObjectIsTypedDatum(fromValue)) {
+    var typeRepr = DESCR_TYPE_REPR(this.descr);
     if (!typeRepr.variable && DATUM_TYPE_REPR(fromValue) === typeRepr) {
       if (!ObjectIsAttached(fromValue))
         ThrowError(JSMSG_TYPEDOBJECT_HANDLE_UNATTACHED);
 
-      var size = REPR_SIZE(typeRepr);
+      var size = DESCR_SIZE(this.descr);
       Memcpy(this.datum, this.offset, fromValue, 0, size);
       return;
     }
   }
 
-  switch (REPR_KIND(typeRepr)) {
+  switch (this.kind()) {
   case JS_TYPEREPR_SCALAR_KIND:
     this.setScalar(fromValue);
     return;
@@ -343,25 +453,14 @@ TypedObjectPointer.prototype.set = function(fromValue) {
     return;
 
   case JS_TYPEREPR_SIZED_ARRAY_KIND:
+    if (this.setArray(fromValue, DESCR_SIZED_ARRAY_LENGTH(this.descr)))
+      return;
+    break;
+
   case JS_TYPEREPR_UNSIZED_ARRAY_KIND:
-    if (!IsObject(fromValue))
-      break;
-
-    // Check that "array-like" fromValue has an appropriate length.
-    var length = this.length();
-    if (fromValue.length !== length)
-      break;
-
-    // Adapt each element.
-    if (length > 0) {
-      var tempPtr = this.copy().moveToElem(0);
-      var size = REPR_SIZE(tempPtr.typeRepr);
-      for (var i = 0; i < length; i++) {
-        tempPtr.set(fromValue[i]);
-        tempPtr.offset += size;
-      }
-    }
-    return;
+    if (this.setArray(fromValue, this.datum.length))
+      return;
+    break;
 
   case JS_TYPEREPR_STRUCT_KIND:
     if (!IsObject(fromValue))
@@ -369,25 +468,46 @@ TypedObjectPointer.prototype.set = function(fromValue) {
 
     // Adapt each field.
     var tempPtr = this.copy();
-    var fieldNames = this.descr.fieldNames;
+    var fieldNames = DESCR_STRUCT_FIELD_NAMES(this.descr);
     for (var i = 0; i < fieldNames.length; i++) {
       var fieldName = fieldNames[i];
-      tempPtr.reset(this).moveToField(fieldName).set(fromValue[fieldName]);
+      tempPtr.reset(this).moveToFieldIndex(i).set(fromValue[fieldName]);
     }
     return;
   }
 
   ThrowError(JSMSG_CANT_CONVERT_TO,
              typeof(fromValue),
-             this.typeRepr.toSource());
+             DescrToSource(this.descr));
+}
+
+TypedObjectPointer.prototype.setArray = function(fromValue, length) {
+  if (!IsObject(fromValue))
+    return false;
+
+  // Check that "array-like" fromValue has an appropriate length.
+  if (fromValue.length !== length)
+    return false;
+
+  // Adapt each element.
+  if (length > 0) {
+    var tempPtr = this.copy().moveToElem(0);
+    var size = DESCR_SIZE(tempPtr.descr);
+    for (var i = 0; i < length; i++) {
+      tempPtr.set(fromValue[i]);
+      tempPtr.offset += size;
+    }
+  }
+
+  return true;
 }
 
 // Sets `fromValue` to `this` assuming that `this` is a scalar type.
 TypedObjectPointer.prototype.setScalar = function(fromValue) {
-  assert(REPR_KIND(this.typeRepr) == JS_TYPEREPR_SCALAR_KIND,
+  assert(this.kind() == JS_TYPEREPR_SCALAR_KIND,
          "setScalar called with non-scalar");
 
-  var type = REPR_TYPE(this.typeRepr);
+  var type = DESCR_TYPE(this.descr);
   switch (type) {
   case JS_SCALARTYPEREPR_INT8:
     return Store_int8(this.datum, this.offset,
@@ -429,7 +549,7 @@ TypedObjectPointer.prototype.setScalar = function(fromValue) {
 }
 
 TypedObjectPointer.prototype.setReference = function(fromValue) {
-  var type = REPR_TYPE(this.typeRepr);
+  var type = DESCR_TYPE(this.descr);
   switch (type) {
   case JS_REFERENCETYPEREPR_ANY:
     return Store_Any(this.datum, this.offset, fromValue);
@@ -454,7 +574,7 @@ TypedObjectPointer.prototype.setX4 = function(fromValue) {
   // to "adapt" fromValue, but there are no legal adaptions.
   ThrowError(JSMSG_CANT_CONVERT_TO,
              typeof(fromValue),
-             this.typeRepr.toSource());
+             DescrToSource(this.descr));
 }
 
 ///////////////////////////////////////////////////////////////////////////
@@ -463,15 +583,12 @@ TypedObjectPointer.prototype.setX4 = function(fromValue) {
 // These helpers are invoked by C++ code or used as method bodies.
 
 // Wrapper for use from C++ code.
-function ConvertAndCopyTo(destTypeRepr,
-                          destTypeObj,
+function ConvertAndCopyTo(destDescr,
                           destDatum,
                           destOffset,
                           fromValue)
 {
-  assert(IsObject(destTypeRepr) && ObjectIsTypeRepresentation(destTypeRepr),
-         "ConvertAndCopyTo: not type repr");
-  assert(IsObject(destTypeObj) && ObjectIsTypeDescr(destTypeObj),
+  assert(IsObject(destDescr) && ObjectIsTypeDescr(destDescr),
          "ConvertAndCopyTo: not type obj");
   assert(IsObject(destDatum) && ObjectIsTypedDatum(destDatum),
          "ConvertAndCopyTo: not type datum");
@@ -479,19 +596,15 @@ function ConvertAndCopyTo(destTypeRepr,
   if (!ObjectIsAttached(destDatum))
     ThrowError(JSMSG_TYPEDOBJECT_HANDLE_UNATTACHED);
 
-  var ptr = new TypedObjectPointer(destTypeRepr, destTypeObj,
-                                   destDatum, destOffset);
+  var ptr = new TypedObjectPointer(destDescr, destDatum, destOffset);
   ptr.set(fromValue);
 }
 
 // Wrapper for use from C++ code.
-function Reify(sourceTypeRepr,
-               sourceTypeObj,
+function Reify(sourceDescr,
                sourceDatum,
                sourceOffset) {
-  assert(IsObject(sourceTypeRepr) && ObjectIsTypeRepresentation(sourceTypeRepr),
-         "Reify: not type repr");
-  assert(IsObject(sourceTypeObj) && ObjectIsTypeDescr(sourceTypeObj),
+  assert(IsObject(sourceDescr) && ObjectIsTypeDescr(sourceDescr),
          "Reify: not type obj");
   assert(IsObject(sourceDatum) && ObjectIsTypedDatum(sourceDatum),
          "Reify: not type datum");
@@ -499,15 +612,17 @@ function Reify(sourceTypeRepr,
   if (!ObjectIsAttached(sourceDatum))
     ThrowError(JSMSG_TYPEDOBJECT_HANDLE_UNATTACHED);
 
-  var ptr = new TypedObjectPointer(sourceTypeRepr, sourceTypeObj,
-                                   sourceDatum, sourceOffset);
+  var ptr = new TypedObjectPointer(sourceDescr, sourceDatum, sourceOffset);
 
   return ptr.get();
 }
 
 function FillTypedArrayWithValue(destArray, fromValue) {
-  var typeRepr = DATUM_TYPE_REPR(destArray);
-  var length = REPR_LENGTH(typeRepr);
+  assert(IsObject(handle) && ObjectIsTypedDatum(destArray),
+         "FillTypedArrayWithValue: not typed handle");
+
+  var descr = DATUM_TYPE_DESCR(destArray);
+  var length = DESCR_SIZED_ARRAY_LENGTH(descr);
   if (length === 0)
     return;
 
@@ -517,19 +632,19 @@ function FillTypedArrayWithValue(destArray, fromValue) {
   ptr.set(fromValue);
 
   // Stamp out the remaining copies:
-  var elementSize = REPR_SIZE(ptr.typeRepr);
+  var elementSize = DESCR_SIZE(ptr.descr);
   var totalSize = length * elementSize;
   for (var offset = elementSize; offset < totalSize; offset += elementSize)
     Memcpy(destArray, offset, destArray, 0, elementSize);
 }
 
 // Warning: user exposed!
-function TypeDescrEquivalent(otherTypeObj) {
+function TypeDescrEquivalent(otherDescr) {
   if (!IsObject(this) || !ObjectIsTypeDescr(this))
     ThrowError(JSMSG_TYPEDOBJECT_HANDLE_BAD_ARGS, "this", "type object");
-  if (!IsObject(otherTypeObj) || !ObjectIsTypeDescr(otherTypeObj))
+  if (!IsObject(otherDescr) || !ObjectIsTypeDescr(otherDescr))
     ThrowError(JSMSG_TYPEDOBJECT_HANDLE_BAD_ARGS, "1", "type object");
-  return TYPE_TYPE_REPR(this) === TYPE_TYPE_REPR(otherTypeObj);
+  return DESCR_TYPE_REPR(this) === DESCR_TYPE_REPR(otherDescr);
 }
 
 // TypedArray.redimension(newArrayType)
@@ -562,7 +677,7 @@ function TypedArrayRedimension(newArrayType) {
   // Peel away the outermost array layers from the type of `this` to find
   // the core element type. In the process, count the number of elements.
   var oldArrayType = DATUM_TYPE_DESCR(this);
-  var oldArrayReprKind = REPR_KIND(TYPE_TYPE_REPR(oldArrayType));
+  var oldArrayReprKind = DESCR_KIND(oldArrayType);
   var oldElementType = oldArrayType;
   var oldElementCount = 1;
   switch (oldArrayReprKind) {
@@ -577,7 +692,7 @@ function TypedArrayRedimension(newArrayType) {
   default:
     ThrowError(JSMSG_TYPEDOBJECT_HANDLE_BAD_ARGS, "this", "typed array");
   }
-  while (REPR_KIND(TYPE_TYPE_REPR(oldElementType)) === JS_TYPEREPR_SIZED_ARRAY_KIND) {
+  while (DESCR_KIND(oldElementType) === JS_TYPEREPR_SIZED_ARRAY_KIND) {
     oldElementCount *= oldElementType.length;
     oldElementType = oldElementType.elementType;
   }
@@ -586,7 +701,7 @@ function TypedArrayRedimension(newArrayType) {
   // process, count the number of elements.
   var newElementType = newArrayType;
   var newElementCount = 1;
-  while (REPR_KIND(TYPE_TYPE_REPR(newElementType)) == JS_TYPEREPR_SIZED_ARRAY_KIND) {
+  while (DESCR_KIND(newElementType) == JS_TYPEREPR_SIZED_ARRAY_KIND) {
     newElementCount *= newElementType.length;
     newElementType = newElementType.elementType;
   }
@@ -598,14 +713,13 @@ function TypedArrayRedimension(newArrayType) {
   }
 
   // Check that the element types are equivalent.
-  if (TYPE_TYPE_REPR(oldElementType) !== TYPE_TYPE_REPR(newElementType)) {
+  if (DESCR_TYPE_REPR(oldElementType) !== DESCR_TYPE_REPR(newElementType)) {
     ThrowError(JSMSG_TYPEDOBJECT_HANDLE_BAD_ARGS, 1,
                "New element type is not equivalent to old element type");
   }
 
   // Together, this should imply that the sizes are unchanged.
-  assert(REPR_SIZE(TYPE_TYPE_REPR(oldArrayType)) ==
-         REPR_SIZE(TYPE_TYPE_REPR(newArrayType)),
+  assert(DESCR_SIZE(oldArrayType) == DESCR_SIZE(newArrayType),
          "Byte sizes should be equal");
 
   // Rewrap the data from `this` in a new type.
@@ -626,7 +740,7 @@ function HandleCreate(obj, ...path) {
   if (!IsObject(this) || !ObjectIsTypeDescr(this))
     ThrowError(JSMSG_INCOMPATIBLE_PROTO, "Type", "handle", "value");
 
-  switch (REPR_KIND(TYPE_TYPE_REPR(this))) {
+  switch (DESCR_KIND(this)) {
   case JS_TYPEREPR_SCALAR_KIND:
   case JS_TYPEREPR_REFERENCE_KIND:
   case JS_TYPEREPR_X4_KIND:
@@ -667,7 +781,7 @@ function HandleMoveInternal(handle, obj, path) {
     ptr.moveTo(path[i]);
 
   // Check that the new destination is equivalent to the handle type.
-  if (ptr.typeRepr !== DATUM_TYPE_REPR(handle))
+  if (DESCR_TYPE_REPR(ptr.descr) !== DATUM_TYPE_REPR(handle))
     ThrowError(JSMSG_TYPEDOBJECT_HANDLE_BAD_TYPE);
 
   AttachHandle(handle, ptr.datum, ptr.offset)
@@ -724,11 +838,11 @@ function X4ToSource() {
   if (!IsObject(this) || !ObjectIsTypedDatum(this))
     ThrowError(JSMSG_INCOMPATIBLE_PROTO, "X4", "toSource", typeof this);
 
-  var repr = DATUM_TYPE_REPR(this);
-  if (REPR_KIND(repr) != JS_TYPEREPR_X4_KIND)
+  if (DESCR_KIND(this) != JS_TYPEREPR_X4_KIND)
     ThrowError(JSMSG_INCOMPATIBLE_PROTO, "X4", "toSource", typeof this);
 
-  var type = REPR_TYPE(repr);
+  var descr = DATUM_TYPE_DESCR(this);
+  var type = DESCR_TYPE(descr);
   return X4ProtoString(type)+"("+this.x+", "+this.y+", "+this.z+", "+this.w+")";
 }
 
@@ -799,7 +913,7 @@ function TypedObjectArrayTypeBuild(a,b,c) {
 
   if (!IsObject(this) || !ObjectIsTypeDescr(this))
     ThrowError(JSMSG_TYPEDOBJECT_HANDLE_BAD_ARGS, "this", "type object");
-  var kind = REPR_KIND(TYPE_TYPE_REPR(this));
+  var kind = DESCR_KIND(this);
   switch (kind) {
   case JS_TYPEREPR_SIZED_ARRAY_KIND:
     if (typeof a === "function") // XXX here and elsewhere: these type dispatches are fragile at best.
@@ -979,7 +1093,7 @@ function GET_BIT(data, index) {
 function TypeDescrIsArrayType(t) {
   assert(IsObject(t) && ObjectIsTypeDescr(t), "TypeDescrIsArrayType called on non-type-object");
 
-  var kind = REPR_KIND(TYPE_TYPE_REPR(t));
+  var kind = DESCR_KIND(t);
   switch (kind) {
   case JS_TYPEREPR_SIZED_ARRAY_KIND:
   case JS_TYPEREPR_UNSIZED_ARRAY_KIND:
@@ -997,7 +1111,7 @@ function TypeDescrIsArrayType(t) {
 function TypeDescrIsSizedArrayType(t) {
   assert(IsObject(t) && ObjectIsTypeDescr(t), "TypeDescrIsSizedArrayType called on non-type-object");
 
-  var kind = REPR_KIND(TYPE_TYPE_REPR(t));
+  var kind = DESCR_KIND(t);
   switch (kind) {
   case JS_TYPEREPR_SIZED_ARRAY_KIND:
     return true;
@@ -1015,7 +1129,7 @@ function TypeDescrIsSizedArrayType(t) {
 function TypeDescrIsSimpleType(t) {
   assert(IsObject(t) && ObjectIsTypeDescr(t), "TypeDescrIsSimpleType called on non-type-object");
 
-  var kind = REPR_KIND(TYPE_TYPE_REPR(t));
+  var kind = DESCR_KIND(t);
   switch (kind) {
   case JS_TYPEREPR_SCALAR_KIND:
   case JS_TYPEREPR_REFERENCE_KIND:
@@ -1071,7 +1185,7 @@ function BuildTypedSeqImpl(arrayType, len, depth, func) {
       HandleSet(handle, r);                 // *handle = r
     }
     // Increment indices.
-    offset += REPR_SIZE(TYPE_TYPE_REPR(grainType));
+    offset += DESCR_SIZE(grainType);
     IncrementIterationSpace(indices, iterationSpace);
   }
 
@@ -1148,7 +1262,7 @@ function MapUntypedSeqImpl(inArray, outputType, maybeFunc) {
   var result = outputType.variable ? new outputType(inArray.length) : new outputType();
 
   var outHandle = callFunction(HandleCreate, outGrainType);
-  var outUnitSize = REPR_SIZE(TYPE_TYPE_REPR(outGrainType));
+  var outUnitSize = DESCR_SIZE(outGrainType);
 
   // Core of map computation starts here (comparable to
   // DoMapTypedSeqDepth1 and DoMapTypedSeqDepthN below).
@@ -1208,8 +1322,8 @@ function MapTypedSeqImpl(inArray, depth, outputType, func) {
 
   var inHandle = callFunction(HandleCreate, inGrainType);
   var outHandle = callFunction(HandleCreate, outGrainType);
-  var inUnitSize = REPR_SIZE(TYPE_TYPE_REPR(inGrainType));
-  var outUnitSize = REPR_SIZE(TYPE_TYPE_REPR(outGrainType));
+  var inUnitSize = DESCR_SIZE(inGrainType);
+  var outUnitSize = DESCR_SIZE(outGrainType);
 
   var inGrainTypeIsSimple = TypeDescrIsSimpleType(inGrainType);
 
diff --git a/js/src/builtin/TypedObjectConstants.h b/js/src/builtin/TypedObjectConstants.h
index f1613cdfe4b3..975de1693e33 100644
--- a/js/src/builtin/TypedObjectConstants.h
+++ b/js/src/builtin/TypedObjectConstants.h
@@ -13,29 +13,31 @@
 // Slots for type objects
 //
 // Some slots apply to all type objects and some are specific to
-// particular kinds of type objects. Because all type objects, at
-// least for now, have a distinct class, we can assign them distinct
-// numbers of slots depending on their kind.
+// particular kinds of type objects. For simplicity we use the same
+// number of slots no matter what kind of type descriptor we are
+// working with, even though this is mildly wasteful.
 
 // Slots on all type objects
-#define JS_TYPEOBJ_SLOT_TYPE_REPR          0  // Associated Type Representation
+#define JS_DESCR_SLOT_TYPE_REPR          0  // Associated Type Representation
+#define JS_DESCR_SLOT_SIZE               1  // Size in bytes, if sized
+#define JS_DESCR_SLOT_ALIGNMENT          2  // Alignment in bytes, if sized
 
-// Slots on scalars
-#define JS_TYPEOBJ_SCALAR_SLOTS            1  // Maximum number
+// Slots on scalars, references, and x4s
+#define JS_DESCR_SLOT_TYPE               3  // Type code
 
-// Slots on references
-#define JS_TYPEOBJ_REFERENCE_SLOTS         1  // Maximum number
+// Slots on all array descriptors
+#define JS_DESCR_SLOT_ARRAY_ELEM_TYPE    3
 
-// Slots on x4s
-#define JS_TYPEOBJ_X4_SLOTS                1  // Maximum number
+// Slots on sized array descriptors
+#define JS_DESCR_SLOT_SIZED_ARRAY_LENGTH 4
 
-// Slots on array type objects
-#define JS_TYPEOBJ_SLOT_ARRAY_ELEM_TYPE    1
-#define JS_TYPEOBJ_ARRAY_SLOTS             3  // Maximum number
+// Slots on struct type objects
+#define JS_DESCR_SLOT_STRUCT_FIELD_NAMES 3
+#define JS_DESCR_SLOT_STRUCT_FIELD_TYPES 4
+#define JS_DESCR_SLOT_STRUCT_FIELD_OFFSETS 5
 
-// Slots on structs
-#define JS_TYPEOBJ_SLOT_STRUCT_FIELD_TYPES 1
-#define JS_TYPEOBJ_STRUCT_SLOTS            2  // Maximum number
+// Maximum number of slots for any descriptor
+#define JS_DESCR_SLOTS                   6
 
 ///////////////////////////////////////////////////////////////////////////
 // Slots for type representation objects
diff --git a/js/src/ctypes/CTypes.cpp b/js/src/ctypes/CTypes.cpp
index edcdd7e14d7c..5713e0399bab 100644
--- a/js/src/ctypes/CTypes.cpp
+++ b/js/src/ctypes/CTypes.cpp
@@ -31,10 +31,12 @@
 #include <windows.h>
 #endif
 
+#include "jscntxt.h"
+#include "jsfun.h"
 #include "jsnum.h"
 #include "jsprf.h"
 
-#include "builtin/TypeRepresentation.h"
+#include "builtin/TypedObject.h"
 #include "ctypes/Library.h"
 
 using namespace std;
@@ -2183,29 +2185,29 @@ bool CanConvertTypedArrayItemTo(JSObject *baseType, JSObject *valObj, JSContext
   }
   TypeCode elementTypeCode;
   switch (JS_GetArrayBufferViewType(valObj)) {
-  case ScalarTypeRepresentation::TYPE_INT8:
+  case ScalarTypeDescr::TYPE_INT8:
     elementTypeCode = TYPE_int8_t;
     break;
-  case ScalarTypeRepresentation::TYPE_UINT8:
-  case ScalarTypeRepresentation::TYPE_UINT8_CLAMPED:
+  case ScalarTypeDescr::TYPE_UINT8:
+  case ScalarTypeDescr::TYPE_UINT8_CLAMPED:
     elementTypeCode = TYPE_uint8_t;
     break;
-  case ScalarTypeRepresentation::TYPE_INT16:
+  case ScalarTypeDescr::TYPE_INT16:
     elementTypeCode = TYPE_int16_t;
     break;
-  case ScalarTypeRepresentation::TYPE_UINT16:
+  case ScalarTypeDescr::TYPE_UINT16:
     elementTypeCode = TYPE_uint16_t;
     break;
-  case ScalarTypeRepresentation::TYPE_INT32:
+  case ScalarTypeDescr::TYPE_INT32:
     elementTypeCode = TYPE_int32_t;
     break;
-  case ScalarTypeRepresentation::TYPE_UINT32:
+  case ScalarTypeDescr::TYPE_UINT32:
     elementTypeCode = TYPE_uint32_t;
     break;
-  case ScalarTypeRepresentation::TYPE_FLOAT32:
+  case ScalarTypeDescr::TYPE_FLOAT32:
     elementTypeCode = TYPE_float32_t;
     break;
-  case ScalarTypeRepresentation::TYPE_FLOAT64:
+  case ScalarTypeDescr::TYPE_FLOAT64:
     elementTypeCode = TYPE_float64_t;
     break;
   default:
diff --git a/js/src/devtools/rootAnalysis/build/gcc.manifest b/js/src/devtools/rootAnalysis/build/gcc.manifest
new file mode 100644
index 000000000000..a86c570cce37
--- /dev/null
+++ b/js/src/devtools/rootAnalysis/build/gcc.manifest
@@ -0,0 +1,17 @@
+[
+{
+"gcc_version": "4.7.2"
+},
+{
+"size": 79831648,
+"digest": "958d0dfb531ac6911187cf57907317144a547b884c79dcb483668f0e468ab9f031492ab49177edebf6a6437680b69f54a346a37b4316da78c0ff87aa39c5f2c3",
+"algorithm": "sha512",
+"filename": "gcc.tar.xz"
+},
+{
+"size": 40,
+"digest": "459b332864aece4742cd1a6886e56cf3f202e5c27bb481cfae6145ce3e2e52fb34d1448788c6618e58a26a64e415341895326d293e0d2968e56efc0ae990acd0",
+"algorithm": "sha512",
+"filename": "setup.sh.gcc"
+}
+]
diff --git a/js/src/devtools/rootAnalysis/build/sixgill.manifest b/js/src/devtools/rootAnalysis/build/sixgill.manifest
new file mode 100644
index 000000000000..9eba53a8f396
--- /dev/null
+++ b/js/src/devtools/rootAnalysis/build/sixgill.manifest
@@ -0,0 +1,17 @@
+[
+{
+"sixgill_version": "0.9.1-177"
+},
+{
+"size": 2562168,
+"digest": "1421953d217bf084bf5da62b322f52e4735f4dbea5c663733ce558c908e268a69500b824a0973157f94915a1ec83f0473df24135de6b43dea2e12e4bdc0b091c",
+"algorithm": "sha512",
+"filename": "sixgill.tar.xz"
+},
+{
+"size": 48,
+"digest": "9f4a123b8b037c4313c7065f872e07af38390f352f2498b41779c389fa1a0712e5f588d7b3d9a124875916f5257434da83553b560d7d146192f3f6c8da6f0412",
+"algorithm": "sha512",
+"filename": "setup.sh.sixgill"
+}
+]
diff --git a/js/src/devtools/rootAnalysis/loadCallgraph.js b/js/src/devtools/rootAnalysis/loadCallgraph.js
index f94517c1402b..d6fca37b945d 100644
--- a/js/src/devtools/rootAnalysis/loadCallgraph.js
+++ b/js/src/devtools/rootAnalysis/loadCallgraph.js
@@ -174,7 +174,7 @@ function loadCallgraph(file)
 
     // Recursively find all callers and add them to the set of gcFunctions.
     while (worklist.length) {
-        name = worklist.pop();
+        name = worklist.shift();
         assert(name in gcFunctions);
         if (!(name in callerGraph))
             continue;
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index 6339893ebbff..9df76a6e94cb 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -1142,7 +1142,7 @@ ScanTypeObject(GCMarker *gcmarker, types::TypeObject *type)
         PushMarkStack(gcmarker, type->newScript()->fun);
         PushMarkStack(gcmarker, type->newScript()->templateObject);
     } else if (type->hasTypedObject()) {
-        PushMarkStack(gcmarker, type->typedObject()->typeRepr->ownerObject());
+        PushMarkStack(gcmarker, type->typedObject()->descrHeapPtr());
     }
 
     if (type->interpretedFunction)
@@ -1169,7 +1169,7 @@ gc::MarkChildren(JSTracer *trc, types::TypeObject *type)
         MarkObject(trc, &type->newScript()->fun, "type_new_function");
         MarkObject(trc, &type->newScript()->templateObject, "type_new_template");
     } else if (type->hasTypedObject()) {
-        type->typedObject()->typeRepr->mark(trc);
+        MarkObject(trc, &type->typedObject()->descrHeapPtr(), "type_heap_ptr");
     }
 
     if (type->interpretedFunction)
diff --git a/js/src/jit-test/tests/debug/onEnterFrame-07.js b/js/src/jit-test/tests/debug/onEnterFrame-07.js
new file mode 100644
index 000000000000..ce4316bab4ad
--- /dev/null
+++ b/js/src/jit-test/tests/debug/onEnterFrame-07.js
@@ -0,0 +1,15 @@
+var g = newGlobal();
+var dbg = new Debugger(g);
+var visibleFrames = 0;
+dbg.onEnterFrame = function (frame) {
+  print("> " + frame.script.url);
+  visibleFrames++;
+}
+
+g.eval("(" + function iife() {
+  [1].forEach(function noop() {});
+  for (let x of [1]) {}
+} + ")()");
+
+// 1 for eval, 1 for iife(), 1 for noop()
+assertEq(visibleFrames, 3);
diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index 020d0589e715..f56a18776474 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -3821,9 +3821,9 @@ static bool
 TypedArrayRequiresFloatingPoint(TypedArrayObject *tarr)
 {
     uint32_t type = tarr->type();
-    return (type == ScalarTypeRepresentation::TYPE_UINT32 ||
-            type == ScalarTypeRepresentation::TYPE_FLOAT32 ||
-            type == ScalarTypeRepresentation::TYPE_FLOAT64);
+    return (type == ScalarTypeDescr::TYPE_UINT32 ||
+            type == ScalarTypeDescr::TYPE_FLOAT32 ||
+            type == ScalarTypeDescr::TYPE_FLOAT64);
 }
 
 static bool
@@ -5489,10 +5489,10 @@ ICSetElem_TypedArray::Compiler::generateStubCode(MacroAssembler &masm)
     regs.take(scratchReg);
     Register secondScratch = regs.takeAny();
 
-    if (type_ == ScalarTypeRepresentation::TYPE_FLOAT32 || type_ == ScalarTypeRepresentation::TYPE_FLOAT64) {
+    if (type_ == ScalarTypeDescr::TYPE_FLOAT32 || type_ == ScalarTypeDescr::TYPE_FLOAT64) {
         masm.ensureDouble(value, FloatReg0, &failure);
         if (LIRGenerator::allowFloat32Optimizations() &&
-            type_ == ScalarTypeRepresentation::TYPE_FLOAT32)
+            type_ == ScalarTypeDescr::TYPE_FLOAT32)
         {
             masm.convertDoubleToFloat32(FloatReg0, ScratchFloatReg);
             masm.storeToTypedFloatArray(type_, ScratchFloatReg, dest);
@@ -5500,7 +5500,7 @@ ICSetElem_TypedArray::Compiler::generateStubCode(MacroAssembler &masm)
             masm.storeToTypedFloatArray(type_, FloatReg0, dest);
         }
         EmitReturnFromIC(masm);
-    } else if (type_ == ScalarTypeRepresentation::TYPE_UINT8_CLAMPED) {
+    } else if (type_ == ScalarTypeDescr::TYPE_UINT8_CLAMPED) {
         Label notInt32;
         masm.branchTestInt32(Assembler::NotEqual, value, &notInt32);
         masm.unboxInt32(value, secondScratch);
@@ -6468,7 +6468,7 @@ ICGetProp_TypedArrayLength::Compiler::generateStubCode(MacroAssembler &masm)
     masm.branchPtr(Assembler::Below, scratch, ImmPtr(&TypedArrayObject::classes[0]),
                    &failure);
     masm.branchPtr(Assembler::AboveOrEqual, scratch,
-                   ImmPtr(&TypedArrayObject::classes[ScalarTypeRepresentation::TYPE_MAX]),
+                   ImmPtr(&TypedArrayObject::classes[ScalarTypeDescr::TYPE_MAX]),
                    &failure);
 
     // Load length from fixed slot.
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 1c06b107fecd..ce9eb6785c62 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -7366,8 +7366,8 @@ template <typename T>
 static inline void
 StoreToTypedArray(MacroAssembler &masm, int arrayType, const LAllocation *value, const T &dest)
 {
-    if (arrayType == ScalarTypeRepresentation::TYPE_FLOAT32 ||
-        arrayType == ScalarTypeRepresentation::TYPE_FLOAT64)
+    if (arrayType == ScalarTypeDescr::TYPE_FLOAT32 ||
+        arrayType == ScalarTypeDescr::TYPE_FLOAT64)
     {
         masm.storeToTypedFloatArray(arrayType, ToFloatRegister(value), dest);
     } else {
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 05df90f7263f..4b2d9e140bc0 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -10,7 +10,6 @@
 
 #include "builtin/Eval.h"
 #include "builtin/TypedObject.h"
-#include "builtin/TypeRepresentation.h"
 #include "frontend/SourceNotes.h"
 #include "jit/BaselineFrame.h"
 #include "jit/BaselineInspector.h"
@@ -113,7 +112,7 @@ IonBuilder::IonBuilder(JSContext *analysisContext, CompileCompartment *comp,
     analysisContext(analysisContext),
     baselineFrame_(baselineFrame),
     abortReason_(AbortReason_Disable),
-    reprSetHash_(nullptr),
+    descrSetHash_(nullptr),
     constraints_(constraints),
     analysis_(*temp, info->script()),
     thisTypes(nullptr),
@@ -6615,50 +6614,50 @@ IonBuilder::getElemTryTypedObject(bool *emitted, MDefinition *obj, MDefinition *
 {
     JS_ASSERT(*emitted == false);
 
-    TypeRepresentationSet objTypeReprs;
-    if (!lookupTypeRepresentationSet(obj, &objTypeReprs))
+    TypeDescrSet objDescrs;
+    if (!lookupTypeDescrSet(obj, &objDescrs))
         return false;
 
-    if (!objTypeReprs.allOfArrayKind())
+    if (!objDescrs.allOfArrayKind())
         return true;
 
-    TypeRepresentationSet elemTypeReprs;
-    if (!objTypeReprs.arrayElementType(*this, &elemTypeReprs))
+    TypeDescrSet elemDescrs;
+    if (!objDescrs.arrayElementType(*this, &elemDescrs))
         return false;
-    if (elemTypeReprs.empty())
+    if (elemDescrs.empty())
         return true;
 
-    JS_ASSERT(TypeRepresentation::isSized(elemTypeReprs.kind()));
+    JS_ASSERT(TypeDescr::isSized(elemDescrs.kind()));
 
     size_t elemSize;
-    if (!elemTypeReprs.allHaveSameSize(&elemSize))
+    if (!elemDescrs.allHaveSameSize(&elemSize))
         return true;
 
-    switch (elemTypeReprs.kind()) {
-      case TypeRepresentation::X4:
+    switch (elemDescrs.kind()) {
+      case TypeDescr::X4:
         // FIXME (bug 894105): load into a MIRType_float32x4 etc
         return true;
 
-      case TypeRepresentation::Struct:
-      case TypeRepresentation::SizedArray:
+      case TypeDescr::Struct:
+      case TypeDescr::SizedArray:
         return getElemTryComplexElemOfTypedObject(emitted,
                                                   obj,
                                                   index,
-                                                  objTypeReprs,
-                                                  elemTypeReprs,
+                                                  objDescrs,
+                                                  elemDescrs,
                                                   elemSize);
-      case TypeRepresentation::Scalar:
+      case TypeDescr::Scalar:
         return getElemTryScalarElemOfTypedObject(emitted,
                                                  obj,
                                                  index,
-                                                 objTypeReprs,
-                                                 elemTypeReprs,
+                                                 objDescrs,
+                                                 elemDescrs,
                                                  elemSize);
 
-      case TypeRepresentation::Reference:
+      case TypeDescr::Reference:
         return true;
 
-      case TypeRepresentation::UnsizedArray:
+      case TypeDescr::UnsizedArray:
         MOZ_ASSUME_UNREACHABLE("Unsized arrays cannot be element types");
     }
 
@@ -6666,7 +6665,7 @@ IonBuilder::getElemTryTypedObject(bool *emitted, MDefinition *obj, MDefinition *
 }
 
 static MIRType
-MIRTypeForTypedArrayRead(ScalarTypeRepresentation::Type arrayType,
+MIRTypeForTypedArrayRead(ScalarTypeDescr::Type arrayType,
                          bool observedDouble);
 
 bool
@@ -6674,7 +6673,7 @@ IonBuilder::checkTypedObjectIndexInBounds(size_t elemSize,
                                           MDefinition *obj,
                                           MDefinition *index,
                                           MDefinition **indexAsByteOffset,
-                                          TypeRepresentationSet objTypeReprs)
+                                          TypeDescrSet objDescrs)
 {
     // Ensure index is an integer.
     MInstruction *idInt32 = MToInt32::New(alloc(), index);
@@ -6686,7 +6685,7 @@ IonBuilder::checkTypedObjectIndexInBounds(size_t elemSize,
     // Value to int32 using truncation.
     size_t lenOfAll;
     MDefinition *length;
-    if (objTypeReprs.hasKnownArrayLength(&lenOfAll)) {
+    if (objDescrs.hasKnownArrayLength(&lenOfAll)) {
         length = constantInt(lenOfAll);
     } else {
         MInstruction *lengthValue = MLoadFixedSlot::New(alloc(), obj, JS_DATUM_SLOT_LENGTH);
@@ -6714,40 +6713,40 @@ bool
 IonBuilder::getElemTryScalarElemOfTypedObject(bool *emitted,
                                               MDefinition *obj,
                                               MDefinition *index,
-                                              TypeRepresentationSet objTypeReprs,
-                                              TypeRepresentationSet elemTypeReprs,
+                                              TypeDescrSet objDescrs,
+                                              TypeDescrSet elemDescrs,
                                               size_t elemSize)
 {
-    JS_ASSERT(objTypeReprs.allOfArrayKind());
+    JS_ASSERT(objDescrs.allOfArrayKind());
 
     // Must always be loading the same scalar type
-    if (!elemTypeReprs.singleton())
+    ScalarTypeDescr::Type elemType;
+    if (!elemDescrs.scalarType(&elemType))
         return true;
-    ScalarTypeRepresentation *elemTypeRepr = elemTypeReprs.getTypeRepresentation()->asScalar();
-    JS_ASSERT(elemSize == elemTypeRepr->alignment());
+    JS_ASSERT(elemSize == ScalarTypeDescr::alignment(elemType));
 
     MDefinition *indexAsByteOffset;
-    if (!checkTypedObjectIndexInBounds(elemSize, obj, index, &indexAsByteOffset, objTypeReprs))
+    if (!checkTypedObjectIndexInBounds(elemSize, obj, index, &indexAsByteOffset, objDescrs))
         return false;
 
-    return pushScalarLoadFromTypedObject(emitted, obj, indexAsByteOffset, elemTypeRepr);
+    return pushScalarLoadFromTypedObject(emitted, obj, indexAsByteOffset, elemType);
 }
 
 bool
 IonBuilder::pushScalarLoadFromTypedObject(bool *emitted,
                                           MDefinition *obj,
                                           MDefinition *offset,
-                                          ScalarTypeRepresentation *elemTypeRepr)
+                                          ScalarTypeDescr::Type elemType)
 {
-    size_t size = elemTypeRepr->size();
-    JS_ASSERT(size == elemTypeRepr->alignment());
+    size_t size = ScalarTypeDescr::size(elemType);
+    JS_ASSERT(size == ScalarTypeDescr::alignment(elemType));
 
     // Find location within the owner object.
     MDefinition *elements, *scaledOffset;
     loadTypedObjectElements(obj, offset, size, &elements, &scaledOffset);
 
     // Load the element.
-    MLoadTypedArrayElement *load = MLoadTypedArrayElement::New(alloc(), elements, scaledOffset, elemTypeRepr->type());
+    MLoadTypedArrayElement *load = MLoadTypedArrayElement::New(alloc(), elements, scaledOffset, elemType);
     current->add(load);
     current->push(load);
 
@@ -6760,7 +6759,7 @@ IonBuilder::pushScalarLoadFromTypedObject(bool *emitted,
 
     // Note: knownType is not necessarily in resultTypes; e.g. if we
     // have only observed integers coming out of float array.
-    MIRType knownType = MIRTypeForTypedArrayRead(elemTypeRepr->type(), allowDouble);
+    MIRType knownType = MIRTypeForTypedArrayRead(elemType, allowDouble);
 
     // Note: we can ignore the type barrier here, we know the type must
     // be valid and unbarriered. Also, need not set resultTypeSet,
@@ -6776,28 +6775,28 @@ bool
 IonBuilder::getElemTryComplexElemOfTypedObject(bool *emitted,
                                                MDefinition *obj,
                                                MDefinition *index,
-                                               TypeRepresentationSet objTypeReprs,
-                                               TypeRepresentationSet elemTypeReprs,
+                                               TypeDescrSet objDescrs,
+                                               TypeDescrSet elemDescrs,
                                                size_t elemSize)
 {
-    JS_ASSERT(objTypeReprs.allOfArrayKind());
+    JS_ASSERT(objDescrs.allOfArrayKind());
 
     MDefinition *type = loadTypedObjectType(obj);
     MDefinition *elemTypeObj = typeObjectForElementFromArrayStructType(type);
 
     MDefinition *indexAsByteOffset;
-    if (!checkTypedObjectIndexInBounds(elemSize, obj, index, &indexAsByteOffset, objTypeReprs))
+    if (!checkTypedObjectIndexInBounds(elemSize, obj, index, &indexAsByteOffset, objDescrs))
         return false;
 
     return pushDerivedTypedObject(emitted, obj, indexAsByteOffset,
-                                  elemTypeReprs, elemTypeObj);
+                                  elemDescrs, elemTypeObj);
 }
 
 bool
 IonBuilder::pushDerivedTypedObject(bool *emitted,
                                    MDefinition *obj,
                                    MDefinition *offset,
-                                   TypeRepresentationSet derivedTypeReprs,
+                                   TypeDescrSet derivedTypeDescrs,
                                    MDefinition *derivedTypeObj)
 {
     // Find location within the owner object.
@@ -6806,7 +6805,7 @@ IonBuilder::pushDerivedTypedObject(bool *emitted,
 
     // Create the derived datum.
     MInstruction *derivedTypedObj = MNewDerivedTypedObject::New(alloc(),
-                                                                derivedTypeReprs,
+                                                                derivedTypeDescrs,
                                                                 derivedTypeObj,
                                                                 owner,
                                                                 ownerOffset);
@@ -6870,7 +6869,7 @@ IonBuilder::getElemTryTypedStatic(bool *emitted, MDefinition *obj, MDefinition *
 {
     JS_ASSERT(*emitted == false);
 
-    ScalarTypeRepresentation::Type arrayType;
+    ScalarTypeDescr::Type arrayType;
     if (!ElementAccessIsTypedArray(obj, index, &arrayType))
         return true;
 
@@ -6931,7 +6930,7 @@ IonBuilder::getElemTryTypedArray(bool *emitted, MDefinition *obj, MDefinition *i
 {
     JS_ASSERT(*emitted == false);
 
-    ScalarTypeRepresentation::Type arrayType;
+    ScalarTypeDescr::Type arrayType;
     if (!ElementAccessIsTypedArray(obj, index, &arrayType))
         return true;
 
@@ -7280,22 +7279,22 @@ IonBuilder::convertShiftToMaskForStaticTypedArray(MDefinition *id,
 }
 
 static MIRType
-MIRTypeForTypedArrayRead(ScalarTypeRepresentation::Type arrayType,
+MIRTypeForTypedArrayRead(ScalarTypeDescr::Type arrayType,
                          bool observedDouble)
 {
     switch (arrayType) {
-      case ScalarTypeRepresentation::TYPE_INT8:
-      case ScalarTypeRepresentation::TYPE_UINT8:
-      case ScalarTypeRepresentation::TYPE_UINT8_CLAMPED:
-      case ScalarTypeRepresentation::TYPE_INT16:
-      case ScalarTypeRepresentation::TYPE_UINT16:
-      case ScalarTypeRepresentation::TYPE_INT32:
+      case ScalarTypeDescr::TYPE_INT8:
+      case ScalarTypeDescr::TYPE_UINT8:
+      case ScalarTypeDescr::TYPE_UINT8_CLAMPED:
+      case ScalarTypeDescr::TYPE_INT16:
+      case ScalarTypeDescr::TYPE_UINT16:
+      case ScalarTypeDescr::TYPE_INT32:
         return MIRType_Int32;
-      case ScalarTypeRepresentation::TYPE_UINT32:
+      case ScalarTypeDescr::TYPE_UINT32:
         return observedDouble ? MIRType_Double : MIRType_Int32;
-      case ScalarTypeRepresentation::TYPE_FLOAT32:
+      case ScalarTypeDescr::TYPE_FLOAT32:
         return (LIRGenerator::allowFloat32Optimizations()) ? MIRType_Float32 : MIRType_Double;
-      case ScalarTypeRepresentation::TYPE_FLOAT64:
+      case ScalarTypeDescr::TYPE_FLOAT64:
         return MIRType_Double;
     }
     MOZ_ASSUME_UNREACHABLE("Unknown typed array type");
@@ -7303,7 +7302,7 @@ MIRTypeForTypedArrayRead(ScalarTypeRepresentation::Type arrayType,
 
 bool
 IonBuilder::jsop_getelem_typed(MDefinition *obj, MDefinition *index,
-                               ScalarTypeRepresentation::Type arrayType)
+                               ScalarTypeDescr::Type arrayType)
 {
     types::TemporaryTypeSet *types = bytecodeTypes(pc);
 
@@ -7356,18 +7355,18 @@ IonBuilder::jsop_getelem_typed(MDefinition *obj, MDefinition *index,
         // will bailout when we read a double.
         bool needsBarrier = true;
         switch (arrayType) {
-          case ScalarTypeRepresentation::TYPE_INT8:
-          case ScalarTypeRepresentation::TYPE_UINT8:
-          case ScalarTypeRepresentation::TYPE_UINT8_CLAMPED:
-          case ScalarTypeRepresentation::TYPE_INT16:
-          case ScalarTypeRepresentation::TYPE_UINT16:
-          case ScalarTypeRepresentation::TYPE_INT32:
-          case ScalarTypeRepresentation::TYPE_UINT32:
+          case ScalarTypeDescr::TYPE_INT8:
+          case ScalarTypeDescr::TYPE_UINT8:
+          case ScalarTypeDescr::TYPE_UINT8_CLAMPED:
+          case ScalarTypeDescr::TYPE_INT16:
+          case ScalarTypeDescr::TYPE_UINT16:
+          case ScalarTypeDescr::TYPE_INT32:
+          case ScalarTypeDescr::TYPE_UINT32:
             if (types->hasType(types::Type::Int32Type()))
                 needsBarrier = false;
             break;
-          case ScalarTypeRepresentation::TYPE_FLOAT32:
-          case ScalarTypeRepresentation::TYPE_FLOAT64:
+          case ScalarTypeDescr::TYPE_FLOAT32:
+          case ScalarTypeDescr::TYPE_FLOAT64:
             if (allowDouble)
                 needsBarrier = false;
             break;
@@ -7431,44 +7430,44 @@ IonBuilder::setElemTryTypedObject(bool *emitted, MDefinition *obj,
 {
     JS_ASSERT(*emitted == false);
 
-    TypeRepresentationSet objTypeReprs;
-    if (!lookupTypeRepresentationSet(obj, &objTypeReprs))
+    TypeDescrSet objTypeDescrs;
+    if (!lookupTypeDescrSet(obj, &objTypeDescrs))
         return false;
 
-    if (!objTypeReprs.allOfArrayKind())
+    if (!objTypeDescrs.allOfArrayKind())
         return true;
 
-    TypeRepresentationSet elemTypeReprs;
-    if (!objTypeReprs.arrayElementType(*this, &elemTypeReprs))
+    TypeDescrSet elemTypeDescrs;
+    if (!objTypeDescrs.arrayElementType(*this, &elemTypeDescrs))
         return false;
-    if (elemTypeReprs.empty())
+    if (elemTypeDescrs.empty())
         return true;
 
-    JS_ASSERT(TypeRepresentation::isSized(elemTypeReprs.kind()));
+    JS_ASSERT(TypeDescr::isSized(elemTypeDescrs.kind()));
 
     size_t elemSize;
-    if (!elemTypeReprs.allHaveSameSize(&elemSize))
+    if (!elemTypeDescrs.allHaveSameSize(&elemSize))
         return true;
 
-    switch (elemTypeReprs.kind()) {
-      case TypeRepresentation::X4:
+    switch (elemTypeDescrs.kind()) {
+      case TypeDescr::X4:
         // FIXME (bug 894105): store a MIRType_float32x4 etc
         return true;
 
-      case TypeRepresentation::Reference:
-      case TypeRepresentation::Struct:
-      case TypeRepresentation::SizedArray:
-      case TypeRepresentation::UnsizedArray:
+      case TypeDescr::Reference:
+      case TypeDescr::Struct:
+      case TypeDescr::SizedArray:
+      case TypeDescr::UnsizedArray:
         // For now, only optimize storing scalars.
         return true;
 
-      case TypeRepresentation::Scalar:
+      case TypeDescr::Scalar:
         return setElemTryScalarPropOfTypedObject(emitted,
                                                  obj,
                                                  index,
-                                                 objTypeReprs,
+                                                 objTypeDescrs,
                                                  value,
-                                                 elemTypeReprs,
+                                                 elemTypeDescrs,
                                                  elemSize);
     }
 
@@ -7479,24 +7478,23 @@ bool
 IonBuilder::setElemTryScalarPropOfTypedObject(bool *emitted,
                                               MDefinition *obj,
                                               MDefinition *index,
-                                              TypeRepresentationSet objTypeReprs,
+                                              TypeDescrSet objTypeDescrs,
                                               MDefinition *value,
-                                              TypeRepresentationSet elemTypeReprs,
+                                              TypeDescrSet elemTypeDescrs,
                                               size_t elemSize)
 {
-    // Must always be storing the same scalar type
-    if (!elemTypeReprs.singleton())
+    // Must always be loading the same scalar type
+    ScalarTypeDescr::Type elemType;
+    if (!elemTypeDescrs.scalarType(&elemType))
         return true;
-
-    ScalarTypeRepresentation *elemTypeRepr =
-        elemTypeReprs.getTypeRepresentation()->asScalar();
+    JS_ASSERT(elemSize == ScalarTypeDescr::alignment(elemType));
 
     MDefinition *indexAsByteOffset;
-    if (!checkTypedObjectIndexInBounds(elemSize, obj, index, &indexAsByteOffset, objTypeReprs))
+    if (!checkTypedObjectIndexInBounds(elemSize, obj, index, &indexAsByteOffset, objTypeDescrs))
         return false;
 
     // Store the element
-    if (!storeScalarTypedObjectValue(obj, indexAsByteOffset, elemTypeRepr, value))
+    if (!storeScalarTypedObjectValue(obj, indexAsByteOffset, elemType, value))
         return false;
 
     current->push(value);
@@ -7511,7 +7509,7 @@ IonBuilder::setElemTryTypedStatic(bool *emitted, MDefinition *object,
 {
     JS_ASSERT(*emitted == false);
 
-    ScalarTypeRepresentation::Type arrayType;
+    ScalarTypeDescr::Type arrayType;
     if (!ElementAccessIsTypedArray(object, index, &arrayType))
         return true;
 
@@ -7562,7 +7560,7 @@ IonBuilder::setElemTryTypedArray(bool *emitted, MDefinition *object,
 {
     JS_ASSERT(*emitted == false);
 
-    ScalarTypeRepresentation::Type arrayType;
+    ScalarTypeDescr::Type arrayType;
     if (!ElementAccessIsTypedArray(object, index, &arrayType))
         return true;
 
@@ -7782,7 +7780,7 @@ IonBuilder::jsop_setelem_dense(types::TemporaryTypeSet::DoubleConversion convers
 
 
 bool
-IonBuilder::jsop_setelem_typed(ScalarTypeRepresentation::Type arrayType,
+IonBuilder::jsop_setelem_typed(ScalarTypeDescr::Type arrayType,
                                SetElemSafety safety,
                                MDefinition *obj, MDefinition *id, MDefinition *value)
 {
@@ -7817,7 +7815,7 @@ IonBuilder::jsop_setelem_typed(ScalarTypeRepresentation::Type arrayType,
 
     // Clamp value to [0, 255] for Uint8ClampedArray.
     MDefinition *toWrite = value;
-    if (arrayType == ScalarTypeRepresentation::TYPE_UINT8_CLAMPED) {
+    if (arrayType == ScalarTypeDescr::TYPE_UINT8_CLAMPED) {
         toWrite = MClampToUint8::New(alloc(), value);
         current->add(toWrite->toInstruction());
     }
@@ -7890,7 +7888,7 @@ IonBuilder::jsop_length_fastPath()
             return true;
         }
 
-        if (objTypes && objTypes->getTypedArrayType() != ScalarTypeRepresentation::TYPE_MAX) {
+        if (objTypes && objTypes->getTypedArrayType() != ScalarTypeDescr::TYPE_MAX) {
             current->pop();
             MInstruction *length = getTypedArrayLength(obj);
             current->add(length);
@@ -8444,38 +8442,38 @@ bool
 IonBuilder::getPropTryTypedObject(bool *emitted, PropertyName *name,
                                   types::TemporaryTypeSet *resultTypes)
 {
-    TypeRepresentationSet fieldTypeReprs;
+    TypeDescrSet fieldDescrs;
     int32_t fieldOffset;
     size_t fieldIndex;
     if (!lookupTypedObjectField(current->peek(-1), name, &fieldOffset,
-                                &fieldTypeReprs, &fieldIndex))
+                                &fieldDescrs, &fieldIndex))
         return false;
-    if (fieldTypeReprs.empty())
+    if (fieldDescrs.empty())
         return true;
 
-    switch (fieldTypeReprs.kind()) {
-      case TypeRepresentation::Reference:
+    switch (fieldDescrs.kind()) {
+      case TypeDescr::Reference:
         return true;
 
-      case TypeRepresentation::X4:
+      case TypeDescr::X4:
         // FIXME (bug 894104): load into a MIRType_float32x4 etc
         return true;
 
-      case TypeRepresentation::Struct:
-      case TypeRepresentation::SizedArray:
+      case TypeDescr::Struct:
+      case TypeDescr::SizedArray:
         return getPropTryComplexPropOfTypedObject(emitted,
                                                   fieldOffset,
-                                                  fieldTypeReprs,
+                                                  fieldDescrs,
                                                   fieldIndex,
                                                   resultTypes);
 
-      case TypeRepresentation::Scalar:
+      case TypeDescr::Scalar:
         return getPropTryScalarPropOfTypedObject(emitted,
                                                  fieldOffset,
-                                                 fieldTypeReprs,
+                                                 fieldDescrs,
                                                  resultTypes);
 
-      case TypeRepresentation::UnsizedArray:
+      case TypeDescr::UnsizedArray:
         MOZ_ASSUME_UNREACHABLE("Field of unsized array type");
     }
 
@@ -8485,26 +8483,26 @@ IonBuilder::getPropTryTypedObject(bool *emitted, PropertyName *name,
 bool
 IonBuilder::getPropTryScalarPropOfTypedObject(bool *emitted,
                                               int32_t fieldOffset,
-                                              TypeRepresentationSet fieldTypeReprs,
+                                              TypeDescrSet fieldDescrs,
                                               types::TemporaryTypeSet *resultTypes)
 {
     // Must always be loading the same scalar type
-    if (!fieldTypeReprs.singleton())
+    ScalarTypeDescr::Type fieldType;
+    if (!fieldDescrs.scalarType(&fieldType))
         return true;
-    ScalarTypeRepresentation *fieldTypeRepr = fieldTypeReprs.getTypeRepresentation()->asScalar();
 
     // OK, perform the optimization
 
     MDefinition *typedObj = current->pop();
 
     return pushScalarLoadFromTypedObject(emitted, typedObj, constantInt(fieldOffset),
-                                         fieldTypeRepr);
+                                         fieldType);
 }
 
 bool
 IonBuilder::getPropTryComplexPropOfTypedObject(bool *emitted,
                                                int32_t fieldOffset,
-                                               TypeRepresentationSet fieldTypeReprs,
+                                               TypeDescrSet fieldDescrs,
                                                size_t fieldIndex,
                                                types::TemporaryTypeSet *resultTypes)
 {
@@ -8522,7 +8520,7 @@ IonBuilder::getPropTryComplexPropOfTypedObject(bool *emitted,
     MDefinition *fieldTypeObj = typeObjectForFieldFromStructType(type, fieldIndex);
 
     return pushDerivedTypedObject(emitted, typedObj, constantInt(fieldOffset),
-                                  fieldTypeReprs, fieldTypeObj);
+                                  fieldDescrs, fieldTypeObj);
 }
 
 bool
@@ -8976,30 +8974,30 @@ bool
 IonBuilder::setPropTryTypedObject(bool *emitted, MDefinition *obj,
                                   PropertyName *name, MDefinition *value)
 {
-    TypeRepresentationSet fieldTypeReprs;
+    TypeDescrSet fieldDescrs;
     int32_t fieldOffset;
     size_t fieldIndex;
-    if (!lookupTypedObjectField(obj, name, &fieldOffset, &fieldTypeReprs,
+    if (!lookupTypedObjectField(obj, name, &fieldOffset, &fieldDescrs,
                                 &fieldIndex))
         return false;
-    if (fieldTypeReprs.empty())
+    if (fieldDescrs.empty())
         return true;
 
-    switch (fieldTypeReprs.kind()) {
-      case TypeRepresentation::X4:
+    switch (fieldDescrs.kind()) {
+      case TypeDescr::X4:
         // FIXME (bug 894104): store into a MIRType_float32x4 etc
         return true;
 
-      case TypeRepresentation::Reference:
-      case TypeRepresentation::Struct:
-      case TypeRepresentation::SizedArray:
-      case TypeRepresentation::UnsizedArray:
+      case TypeDescr::Reference:
+      case TypeDescr::Struct:
+      case TypeDescr::SizedArray:
+      case TypeDescr::UnsizedArray:
         // For now, only optimize storing scalars.
         return true;
 
-      case TypeRepresentation::Scalar:
+      case TypeDescr::Scalar:
         return setPropTryScalarPropOfTypedObject(emitted, obj, fieldOffset,
-                                                 value, fieldTypeReprs);
+                                                 value, fieldDescrs);
     }
 
     MOZ_ASSUME_UNREACHABLE("Unknown kind");
@@ -9010,17 +9008,16 @@ IonBuilder::setPropTryScalarPropOfTypedObject(bool *emitted,
                                               MDefinition *obj,
                                               int32_t fieldOffset,
                                               MDefinition *value,
-                                              TypeRepresentationSet fieldTypeReprs)
+                                              TypeDescrSet fieldDescrs)
 {
-    // Must always be storing the same scalar type
-    if (!fieldTypeReprs.singleton())
+    // Must always be loading the same scalar type
+    ScalarTypeDescr::Type fieldType;
+    if (!fieldDescrs.scalarType(&fieldType))
         return true;
-    ScalarTypeRepresentation *fieldTypeRepr =
-        fieldTypeReprs.getTypeRepresentation()->asScalar();
 
     // OK! Perform the optimization.
 
-    if (!storeScalarTypedObjectValue(obj, constantInt(fieldOffset), fieldTypeRepr, value))
+    if (!storeScalarTypedObjectValue(obj, constantInt(fieldOffset), fieldType, value))
         return false;
 
     current->push(value);
@@ -9804,43 +9801,41 @@ IonBuilder::bytecodeTypes(jsbytecode *pc)
     return types::TypeScript::BytecodeTypes(script(), pc, &typeArrayHint, typeArray);
 }
 
-TypeRepresentationSetHash *
-IonBuilder::getOrCreateReprSetHash()
+TypeDescrSetHash *
+IonBuilder::getOrCreateDescrSetHash()
 {
-    if (!reprSetHash_) {
-        TypeRepresentationSetHash *hash =
-            alloc_->lifoAlloc()->new_<TypeRepresentationSetHash>(alloc());
+    if (!descrSetHash_) {
+        TypeDescrSetHash *hash =
+            alloc_->lifoAlloc()->new_<TypeDescrSetHash>(alloc());
         if (!hash || !hash->init())
             return nullptr;
 
-        reprSetHash_ = hash;
+        descrSetHash_ = hash;
     }
-    return reprSetHash_;
+    return descrSetHash_;
 }
 
 bool
-IonBuilder::lookupTypeRepresentationSet(MDefinition *typedObj,
-                                        TypeRepresentationSet *out)
+IonBuilder::lookupTypeDescrSet(MDefinition *typedObj,
+                                        TypeDescrSet *out)
 {
-    *out = TypeRepresentationSet(); // default to unknown
+    *out = TypeDescrSet(); // default to unknown
 
-    // Extract TypeRepresentationSet directly if we can
+    // Extract TypeDescrSet directly if we can
     if (typedObj->isNewDerivedTypedObject()) {
         *out = typedObj->toNewDerivedTypedObject()->set();
         return true;
     }
 
     types::TemporaryTypeSet *types = typedObj->resultTypeSet();
-    return typeSetToTypeRepresentationSet(types, out,
-                                          types::TypeTypedObject::Datum);
+    return typeSetToTypeDescrSet(types, out);
 }
 
 bool
-IonBuilder::typeSetToTypeRepresentationSet(types::TemporaryTypeSet *types,
-                                           TypeRepresentationSet *out,
-                                           types::TypeTypedObject::Kind kind)
+IonBuilder::typeSetToTypeDescrSet(types::TemporaryTypeSet *types,
+                                  TypeDescrSet *out)
 {
-    // Extract TypeRepresentationSet directly if we can
+    // Extract TypeDescrSet directly if we can
     if (!types || types->getKnownTypeTag() != JSVAL_TYPE_OBJECT)
         return true;
 
@@ -9848,7 +9843,7 @@ IonBuilder::typeSetToTypeRepresentationSet(types::TemporaryTypeSet *types,
     if (types->unknownObject())
         return true;
 
-    TypeRepresentationSetBuilder set;
+    TypeDescrSetBuilder set;
     for (uint32_t i = 0; i < types->getObjectCount(); i++) {
         types::TypeObject *type = types->getTypeObject(i);
         if (!type || type->unknownProperties())
@@ -9857,11 +9852,8 @@ IonBuilder::typeSetToTypeRepresentationSet(types::TemporaryTypeSet *types,
         if (!type->hasTypedObject())
             return true;
 
-        if (type->typedObject()->kind != kind)
-            return true;
-
-        TypeRepresentation *typeRepr = type->typedObject()->typeRepr;
-        if (!set.insert(typeRepr))
+        TypeDescr &descr = type->typedObject()->descr();
+        if (!set.insert(&descr))
             return false;
     }
 
@@ -9954,34 +9946,34 @@ IonBuilder::loadTypedObjectElements(MDefinition *typedObj,
 
 // Looks up the offset/type-repr-set of the field `id`, given the type
 // set `objTypes` of the field owner. Note that even when true is
-// returned, `*fieldTypeReprs` might be empty if no useful type/offset
+// returned, `*fieldDescrs` might be empty if no useful type/offset
 // pair could be determined.
 bool
 IonBuilder::lookupTypedObjectField(MDefinition *typedObj,
                                    PropertyName *name,
                                    int32_t *fieldOffset,
-                                   TypeRepresentationSet *fieldTypeReprs,
+                                   TypeDescrSet *fieldDescrs,
                                    size_t *fieldIndex)
 {
-    TypeRepresentationSet objTypeReprs;
-    if (!lookupTypeRepresentationSet(typedObj, &objTypeReprs))
+    TypeDescrSet objDescrs;
+    if (!lookupTypeDescrSet(typedObj, &objDescrs))
         return false;
 
     // Must be accessing a struct.
-    if (!objTypeReprs.allOfKind(TypeRepresentation::Struct))
+    if (!objDescrs.allOfKind(TypeDescr::Struct))
         return true;
 
     // Determine the type/offset of the field `name`, if any.
     size_t offset;
-    if (!objTypeReprs.fieldNamed(*this, NameToId(name), &offset,
-                                 fieldTypeReprs, fieldIndex))
+    if (!objDescrs.fieldNamed(*this, NameToId(name), &offset,
+                                 fieldDescrs, fieldIndex))
         return false;
-    if (fieldTypeReprs->empty())
+    if (fieldDescrs->empty())
         return true;
 
     // Field offset must be representable as signed integer.
     if (offset >= size_t(INT_MAX)) {
-        *fieldTypeReprs = TypeRepresentationSet();
+        *fieldDescrs = TypeDescrSet();
         return true;
     }
 
@@ -9994,7 +9986,7 @@ IonBuilder::lookupTypedObjectField(MDefinition *typedObj,
 MDefinition *
 IonBuilder::typeObjectForElementFromArrayStructType(MDefinition *typeObj)
 {
-    MInstruction *elemType = MLoadFixedSlot::New(alloc(), typeObj, JS_TYPEOBJ_SLOT_ARRAY_ELEM_TYPE);
+    MInstruction *elemType = MLoadFixedSlot::New(alloc(), typeObj, JS_DESCR_SLOT_ARRAY_ELEM_TYPE);
     current->add(elemType);
 
     MInstruction *unboxElemType = MUnbox::New(alloc(), elemType, MIRType_Object, MUnbox::Infallible);
@@ -10009,7 +10001,7 @@ IonBuilder::typeObjectForFieldFromStructType(MDefinition *typeObj,
 {
     // Load list of field type objects.
 
-    MInstruction *fieldTypes = MLoadFixedSlot::New(alloc(), typeObj, JS_TYPEOBJ_SLOT_STRUCT_FIELD_TYPES);
+    MInstruction *fieldTypes = MLoadFixedSlot::New(alloc(), typeObj, JS_DESCR_SLOT_STRUCT_FIELD_TYPES);
     current->add(fieldTypes);
 
     MInstruction *unboxFieldTypes = MUnbox::New(alloc(), fieldTypes, MIRType_Object, MUnbox::Infallible);
@@ -10034,23 +10026,24 @@ IonBuilder::typeObjectForFieldFromStructType(MDefinition *typeObj,
 bool
 IonBuilder::storeScalarTypedObjectValue(MDefinition *typedObj,
                                         MDefinition *offset,
-                                        ScalarTypeRepresentation *typeRepr,
+                                        ScalarTypeDescr::Type type,
                                         MDefinition *value)
 {
     // Find location within the owner object.
     MDefinition *elements, *scaledOffset;
-    loadTypedObjectElements(typedObj, offset, typeRepr->alignment(), &elements, &scaledOffset);
+    size_t alignment = ScalarTypeDescr::alignment(type);
+    loadTypedObjectElements(typedObj, offset, alignment, &elements, &scaledOffset);
 
     // Clamp value to [0, 255] when type is Uint8Clamped
     MDefinition *toWrite = value;
-    if (typeRepr->type() == ScalarTypeRepresentation::TYPE_UINT8_CLAMPED) {
+    if (type == ScalarTypeDescr::TYPE_UINT8_CLAMPED) {
         toWrite = MClampToUint8::New(alloc(), value);
         current->add(toWrite->toInstruction());
     }
 
     MStoreTypedArrayElement *store =
         MStoreTypedArrayElement::New(alloc(), elements, scaledOffset, toWrite,
-                                     typeRepr->type());
+                                     type);
     current->add(store);
 
     return true;
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index af49edad6260..8dc3cb9ed798 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -17,7 +17,7 @@
 #include "jit/MIR.h"
 #include "jit/MIRGenerator.h"
 #include "jit/MIRGraph.h"
-#include "jit/TypeRepresentationSet.h"
+#include "jit/TypeDescrSet.h"
 
 namespace js {
 namespace jit {
@@ -395,11 +395,11 @@ class IonBuilder : public MIRGenerator
                                types::TemporaryTypeSet *resultTypes);
     bool getPropTryScalarPropOfTypedObject(bool *emitted,
                                            int32_t fieldOffset,
-                                           TypeRepresentationSet fieldTypeReprs,
+                                           TypeDescrSet fieldTypeReprs,
                                            types::TemporaryTypeSet *resultTypes);
     bool getPropTryComplexPropOfTypedObject(bool *emitted,
                                             int32_t fieldOffset,
-                                            TypeRepresentationSet fieldTypeReprs,
+                                            TypeDescrSet fieldTypeReprs,
                                             size_t fieldIndex,
                                             types::TemporaryTypeSet *resultTypes);
     bool getPropTryCache(bool *emitted, PropertyName *name,
@@ -424,21 +424,20 @@ class IonBuilder : public MIRGenerator
                                            MDefinition *obj,
                                            int32_t fieldOffset,
                                            MDefinition *value,
-                                           TypeRepresentationSet fieldTypeReprs);
+                                           TypeDescrSet fieldTypeReprs);
     bool setPropTryCache(bool *emitted, MDefinition *obj,
                          PropertyName *name, MDefinition *value,
                          bool barrier, types::TemporaryTypeSet *objTypes);
 
     // binary data lookup helpers.
-    bool lookupTypeRepresentationSet(MDefinition *typedObj,
-                                     TypeRepresentationSet *out);
-    bool typeSetToTypeRepresentationSet(types::TemporaryTypeSet *types,
-                                        TypeRepresentationSet *out,
-                                        types::TypeTypedObject::Kind kind);
+    bool lookupTypeDescrSet(MDefinition *typedObj,
+                                     TypeDescrSet *out);
+    bool typeSetToTypeDescrSet(types::TemporaryTypeSet *types,
+                                        TypeDescrSet *out);
     bool lookupTypedObjectField(MDefinition *typedObj,
                                 PropertyName *name,
                                 int32_t *fieldOffset,
-                                TypeRepresentationSet *fieldTypeReprs,
+                                TypeDescrSet *fieldTypeReprs,
                                 size_t *fieldIndex);
     MDefinition *loadTypedObjectType(MDefinition *value);
     void loadTypedObjectData(MDefinition *typedObj,
@@ -455,22 +454,22 @@ class IonBuilder : public MIRGenerator
                                                   size_t fieldIndex);
     bool storeScalarTypedObjectValue(MDefinition *typedObj,
                                      MDefinition *offset,
-                                     ScalarTypeRepresentation *typeRepr,
+                                     ScalarTypeDescr::Type type,
                                      MDefinition *value);
     bool checkTypedObjectIndexInBounds(size_t elemSize,
                                        MDefinition *obj,
                                        MDefinition *index,
                                        MDefinition **indexAsByteOffset,
-                                       TypeRepresentationSet objTypeReprs);
+                                       TypeDescrSet objTypeDescrs);
     bool pushDerivedTypedObject(bool *emitted,
                                 MDefinition *obj,
                                 MDefinition *offset,
-                                TypeRepresentationSet derivedTypeReprs,
+                                TypeDescrSet derivedTypeDescrs,
                                 MDefinition *derivedTypeObj);
     bool pushScalarLoadFromTypedObject(bool *emitted,
                                        MDefinition *obj,
                                        MDefinition *offset,
-                                       ScalarTypeRepresentation* type);
+                                       ScalarTypeDescr::Type type);
 
     // jsop_setelem() helpers.
     bool setElemTryTypedArray(bool *emitted, MDefinition *object,
@@ -488,9 +487,9 @@ class IonBuilder : public MIRGenerator
     bool setElemTryScalarPropOfTypedObject(bool *emitted,
                                            MDefinition *obj,
                                            MDefinition *index,
-                                           TypeRepresentationSet objTypeReprs,
+                                           TypeDescrSet objTypeReprs,
                                            MDefinition *value,
-                                           TypeRepresentationSet elemTypeReprs,
+                                           TypeDescrSet elemTypeReprs,
                                            size_t elemSize);
 
     // jsop_getelem() helpers.
@@ -505,14 +504,14 @@ class IonBuilder : public MIRGenerator
     bool getElemTryScalarElemOfTypedObject(bool *emitted,
                                            MDefinition *obj,
                                            MDefinition *index,
-                                           TypeRepresentationSet objTypeReprs,
-                                           TypeRepresentationSet elemTypeReprs,
+                                           TypeDescrSet objTypeReprs,
+                                           TypeDescrSet elemTypeReprs,
                                            size_t elemSize);
     bool getElemTryComplexElemOfTypedObject(bool *emitted,
                                             MDefinition *obj,
                                             MDefinition *index,
-                                            TypeRepresentationSet objTypeReprs,
-                                            TypeRepresentationSet elemTypeReprs,
+                                            TypeDescrSet objTypeReprs,
+                                            TypeDescrSet elemTypeReprs,
                                             size_t elemSize);
 
     // Typed array helpers.
@@ -550,12 +549,12 @@ class IonBuilder : public MIRGenerator
     bool jsop_bindname(PropertyName *name);
     bool jsop_getelem();
     bool jsop_getelem_dense(MDefinition *obj, MDefinition *index);
-    bool jsop_getelem_typed(MDefinition *obj, MDefinition *index, ScalarTypeRepresentation::Type arrayType);
+    bool jsop_getelem_typed(MDefinition *obj, MDefinition *index, ScalarTypeDescr::Type arrayType);
     bool jsop_setelem();
     bool jsop_setelem_dense(types::TemporaryTypeSet::DoubleConversion conversion,
                             SetElemSafety safety,
                             MDefinition *object, MDefinition *index, MDefinition *value);
-    bool jsop_setelem_typed(ScalarTypeRepresentation::Type arrayType,
+    bool jsop_setelem_typed(ScalarTypeDescr::Type arrayType,
                             SetElemSafety safety,
                             MDefinition *object, MDefinition *index, MDefinition *value);
     bool jsop_length();
@@ -659,7 +658,7 @@ class IonBuilder : public MIRGenerator
     InliningStatus inlineUnsafePutElements(CallInfo &callInfo);
     bool inlineUnsafeSetDenseArrayElement(CallInfo &callInfo, uint32_t base);
     bool inlineUnsafeSetTypedArrayElement(CallInfo &callInfo, uint32_t base,
-                                          ScalarTypeRepresentation::Type arrayType);
+                                          ScalarTypeDescr::Type arrayType);
     InliningStatus inlineNewDenseArray(CallInfo &callInfo);
     InliningStatus inlineNewDenseArrayForSequentialExecution(CallInfo &callInfo);
     InliningStatus inlineNewDenseArrayForParallelExecution(CallInfo &callInfo);
@@ -765,7 +764,7 @@ class IonBuilder : public MIRGenerator
 
     AbortReason abortReason() { return abortReason_; }
 
-    TypeRepresentationSetHash *getOrCreateReprSetHash(); // fallible
+    TypeDescrSetHash *getOrCreateDescrSetHash(); // fallible
 
     types::CompilerConstraintList *constraints() {
         return constraints_;
@@ -783,7 +782,7 @@ class IonBuilder : public MIRGenerator
     JSContext *analysisContext;
     BaselineFrameInspector *baselineFrame_;
     AbortReason abortReason_;
-    TypeRepresentationSetHash *reprSetHash_;
+    TypeDescrSetHash *descrSetHash_;
 
     // Constraints for recording dependencies on type information.
     types::CompilerConstraintList *constraints_;
diff --git a/js/src/jit/IonCaches.cpp b/js/src/jit/IonCaches.cpp
index cde23d5f1d8f..9476c84b426f 100644
--- a/js/src/jit/IonCaches.cpp
+++ b/js/src/jit/IonCaches.cpp
@@ -12,7 +12,7 @@
 #include "jsproxy.h"
 #include "jstypes.h"
 
-#include "builtin/TypeRepresentation.h"
+#include "builtin/TypedObject.h"
 #include "jit/Ion.h"
 #include "jit/IonLinker.h"
 #include "jit/IonSpewer.h"
@@ -1089,7 +1089,7 @@ GenerateTypedArrayLength(JSContext *cx, MacroAssembler &masm, IonCache::StubAtta
     masm.branchPtr(Assembler::Below, tmpReg, ImmPtr(&TypedArrayObject::classes[0]),
                    &failures);
     masm.branchPtr(Assembler::AboveOrEqual, tmpReg,
-                   ImmPtr(&TypedArrayObject::classes[ScalarTypeRepresentation::TYPE_MAX]),
+                   ImmPtr(&TypedArrayObject::classes[ScalarTypeDescr::TYPE_MAX]),
                    &failures);
 
     // Load length.
@@ -3161,8 +3161,8 @@ GetElementIC::canAttachTypedArrayElement(JSObject *obj, const Value &idval,
     // The output register is not yet specialized as a float register, the only
     // way to accept float typed arrays for now is to return a Value type.
     uint32_t arrayType = obj->as<TypedArrayObject>().type();
-    if (arrayType == ScalarTypeRepresentation::TYPE_FLOAT32 ||
-        arrayType == ScalarTypeRepresentation::TYPE_FLOAT64)
+    if (arrayType == ScalarTypeDescr::TYPE_FLOAT32 ||
+        arrayType == ScalarTypeDescr::TYPE_FLOAT64)
     {
         return output.hasValue();
     }
@@ -3721,7 +3721,7 @@ GenerateSetTypedArrayElement(JSContext *cx, MacroAssembler &masm, IonCache::Stub
     int width = TypedArrayObject::slotWidth(arrayType);
     BaseIndex target(elements, index, ScaleFromElemWidth(width));
 
-    if (arrayType == ScalarTypeRepresentation::TYPE_FLOAT32) {
+    if (arrayType == ScalarTypeDescr::TYPE_FLOAT32) {
         if (LIRGenerator::allowFloat32Optimizations()) {
             if (!masm.convertConstantOrRegisterToFloat(cx, value, tempFloat, &failures))
                 return false;
@@ -3730,7 +3730,7 @@ GenerateSetTypedArrayElement(JSContext *cx, MacroAssembler &masm, IonCache::Stub
                 return false;
         }
         masm.storeToTypedFloatArray(arrayType, tempFloat, target);
-    } else if (arrayType == ScalarTypeRepresentation::TYPE_FLOAT64) {
+    } else if (arrayType == ScalarTypeDescr::TYPE_FLOAT64) {
         if (!masm.convertConstantOrRegisterToDouble(cx, value, tempFloat, &failures))
             return false;
         masm.storeToTypedFloatArray(arrayType, tempFloat, target);
@@ -3740,7 +3740,7 @@ GenerateSetTypedArrayElement(JSContext *cx, MacroAssembler &masm, IonCache::Stub
         // afterwards.
         masm.push(object);
 
-        if (arrayType == ScalarTypeRepresentation::TYPE_UINT8_CLAMPED) {
+        if (arrayType == ScalarTypeDescr::TYPE_UINT8_CLAMPED) {
             if (!masm.clampConstantOrRegisterToUint8(cx, value, tempFloat, object,
                                                      &popObjectAndFail))
             {
diff --git a/js/src/jit/IonMacroAssembler.cpp b/js/src/jit/IonMacroAssembler.cpp
index 3f10669e4f2b..894f9b5d3900 100644
--- a/js/src/jit/IonMacroAssembler.cpp
+++ b/js/src/jit/IonMacroAssembler.cpp
@@ -9,7 +9,7 @@
 #include "jsinfer.h"
 #include "jsprf.h"
 
-#include "builtin/TypeRepresentation.h"
+#include "builtin/TypedObject.h"
 #include "jit/Bailouts.h"
 #include "jit/BaselineFrame.h"
 #include "jit/BaselineIC.h"
@@ -375,7 +375,7 @@ static void
 StoreToTypedFloatArray(MacroAssembler &masm, int arrayType, const S &value, const T &dest)
 {
     switch (arrayType) {
-      case ScalarTypeRepresentation::TYPE_FLOAT32:
+      case ScalarTypeDescr::TYPE_FLOAT32:
         if (LIRGenerator::allowFloat32Optimizations()) {
             masm.storeFloat32(value, dest);
         } else {
@@ -387,7 +387,7 @@ StoreToTypedFloatArray(MacroAssembler &masm, int arrayType, const S &value, cons
             masm.storeFloat32(ScratchFloatReg, dest);
         }
         break;
-      case ScalarTypeRepresentation::TYPE_FLOAT64:
+      case ScalarTypeDescr::TYPE_FLOAT64:
 #ifdef JS_MORE_DETERMINISTIC
         // See the comment in ToDoubleForTypedArray.
         masm.canonicalizeDouble(value);
@@ -418,23 +418,23 @@ MacroAssembler::loadFromTypedArray(int arrayType, const T &src, AnyRegister dest
                                    Label *fail)
 {
     switch (arrayType) {
-      case ScalarTypeRepresentation::TYPE_INT8:
+      case ScalarTypeDescr::TYPE_INT8:
         load8SignExtend(src, dest.gpr());
         break;
-      case ScalarTypeRepresentation::TYPE_UINT8:
-      case ScalarTypeRepresentation::TYPE_UINT8_CLAMPED:
+      case ScalarTypeDescr::TYPE_UINT8:
+      case ScalarTypeDescr::TYPE_UINT8_CLAMPED:
         load8ZeroExtend(src, dest.gpr());
         break;
-      case ScalarTypeRepresentation::TYPE_INT16:
+      case ScalarTypeDescr::TYPE_INT16:
         load16SignExtend(src, dest.gpr());
         break;
-      case ScalarTypeRepresentation::TYPE_UINT16:
+      case ScalarTypeDescr::TYPE_UINT16:
         load16ZeroExtend(src, dest.gpr());
         break;
-      case ScalarTypeRepresentation::TYPE_INT32:
+      case ScalarTypeDescr::TYPE_INT32:
         load32(src, dest.gpr());
         break;
-      case ScalarTypeRepresentation::TYPE_UINT32:
+      case ScalarTypeDescr::TYPE_UINT32:
         if (dest.isFloat()) {
             load32(src, temp);
             convertUInt32ToDouble(temp, dest.fpu());
@@ -448,7 +448,7 @@ MacroAssembler::loadFromTypedArray(int arrayType, const T &src, AnyRegister dest
             j(Assembler::Signed, fail);
         }
         break;
-      case ScalarTypeRepresentation::TYPE_FLOAT32:
+      case ScalarTypeDescr::TYPE_FLOAT32:
         if (LIRGenerator::allowFloat32Optimizations()) {
             loadFloat32(src, dest.fpu());
             canonicalizeFloat(dest.fpu());
@@ -457,7 +457,7 @@ MacroAssembler::loadFromTypedArray(int arrayType, const T &src, AnyRegister dest
             canonicalizeDouble(dest.fpu());
         }
         break;
-      case ScalarTypeRepresentation::TYPE_FLOAT64:
+      case ScalarTypeDescr::TYPE_FLOAT64:
         loadDouble(src, dest.fpu());
         canonicalizeDouble(dest.fpu());
         break;
@@ -477,16 +477,16 @@ MacroAssembler::loadFromTypedArray(int arrayType, const T &src, const ValueOpera
                                    bool allowDouble, Register temp, Label *fail)
 {
     switch (arrayType) {
-      case ScalarTypeRepresentation::TYPE_INT8:
-      case ScalarTypeRepresentation::TYPE_UINT8:
-      case ScalarTypeRepresentation::TYPE_UINT8_CLAMPED:
-      case ScalarTypeRepresentation::TYPE_INT16:
-      case ScalarTypeRepresentation::TYPE_UINT16:
-      case ScalarTypeRepresentation::TYPE_INT32:
+      case ScalarTypeDescr::TYPE_INT8:
+      case ScalarTypeDescr::TYPE_UINT8:
+      case ScalarTypeDescr::TYPE_UINT8_CLAMPED:
+      case ScalarTypeDescr::TYPE_INT16:
+      case ScalarTypeDescr::TYPE_UINT16:
+      case ScalarTypeDescr::TYPE_INT32:
         loadFromTypedArray(arrayType, src, AnyRegister(dest.scratchReg()), InvalidReg, nullptr);
         tagValue(JSVAL_TYPE_INT32, dest.scratchReg(), dest);
         break;
-      case ScalarTypeRepresentation::TYPE_UINT32:
+      case ScalarTypeDescr::TYPE_UINT32:
         // Don't clobber dest when we could fail, instead use temp.
         load32(src, temp);
         test32(temp, temp);
@@ -511,14 +511,14 @@ MacroAssembler::loadFromTypedArray(int arrayType, const T &src, const ValueOpera
             tagValue(JSVAL_TYPE_INT32, temp, dest);
         }
         break;
-      case ScalarTypeRepresentation::TYPE_FLOAT32:
+      case ScalarTypeDescr::TYPE_FLOAT32:
         loadFromTypedArray(arrayType, src, AnyRegister(ScratchFloatReg), dest.scratchReg(),
                            nullptr);
         if (LIRGenerator::allowFloat32Optimizations())
             convertFloat32ToDouble(ScratchFloatReg, ScratchFloatReg);
         boxDouble(ScratchFloatReg, dest);
         break;
-      case ScalarTypeRepresentation::TYPE_FLOAT64:
+      case ScalarTypeDescr::TYPE_FLOAT64:
         loadFromTypedArray(arrayType, src, AnyRegister(ScratchFloatReg), dest.scratchReg(),
                            nullptr);
         boxDouble(ScratchFloatReg, dest);
diff --git a/js/src/jit/IonMacroAssembler.h b/js/src/jit/IonMacroAssembler.h
index a61d9b649f2c..9d230292c257 100644
--- a/js/src/jit/IonMacroAssembler.h
+++ b/js/src/jit/IonMacroAssembler.h
@@ -698,17 +698,17 @@ class MacroAssembler : public MacroAssemblerSpecific
     template<typename S, typename T>
     void storeToTypedIntArray(int arrayType, const S &value, const T &dest) {
         switch (arrayType) {
-          case ScalarTypeRepresentation::TYPE_INT8:
-          case ScalarTypeRepresentation::TYPE_UINT8:
-          case ScalarTypeRepresentation::TYPE_UINT8_CLAMPED:
+          case ScalarTypeDescr::TYPE_INT8:
+          case ScalarTypeDescr::TYPE_UINT8:
+          case ScalarTypeDescr::TYPE_UINT8_CLAMPED:
             store8(value, dest);
             break;
-          case ScalarTypeRepresentation::TYPE_INT16:
-          case ScalarTypeRepresentation::TYPE_UINT16:
+          case ScalarTypeDescr::TYPE_INT16:
+          case ScalarTypeDescr::TYPE_UINT16:
             store16(value, dest);
             break;
-          case ScalarTypeRepresentation::TYPE_INT32:
-          case ScalarTypeRepresentation::TYPE_UINT32:
+          case ScalarTypeDescr::TYPE_INT32:
+          case ScalarTypeDescr::TYPE_UINT32:
             store32(value, dest);
             break;
           default:
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index c21cfcf6d61e..44df0e88151c 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -2652,7 +2652,7 @@ LIRGenerator::visitLoadTypedArrayElement(MLoadTypedArrayElement *ins)
 
     // We need a temp register for Uint32Array with known double result.
     LDefinition tempDef = LDefinition::BogusTemp();
-    if (ins->arrayType() == ScalarTypeRepresentation::TYPE_UINT32 && IsFloatingPointType(ins->type()))
+    if (ins->arrayType() == ScalarTypeDescr::TYPE_UINT32 && IsFloatingPointType(ins->type()))
         tempDef = temp();
 
     LLoadTypedArrayElement *lir = new(alloc()) LLoadTypedArrayElement(elements, index, tempDef);
@@ -2725,9 +2725,9 @@ LIRGenerator::visitStoreTypedArrayElement(MStoreTypedArrayElement *ins)
 
     if (ins->isFloatArray()) {
         DebugOnly<bool> optimizeFloat32 = allowFloat32Optimizations();
-        JS_ASSERT_IF(optimizeFloat32 && ins->arrayType() == ScalarTypeRepresentation::TYPE_FLOAT32,
+        JS_ASSERT_IF(optimizeFloat32 && ins->arrayType() == ScalarTypeDescr::TYPE_FLOAT32,
                      ins->value()->type() == MIRType_Float32);
-        JS_ASSERT_IF(!optimizeFloat32 || ins->arrayType() == ScalarTypeRepresentation::TYPE_FLOAT64,
+        JS_ASSERT_IF(!optimizeFloat32 || ins->arrayType() == ScalarTypeDescr::TYPE_FLOAT64,
                      ins->value()->type() == MIRType_Double);
     } else {
         JS_ASSERT(ins->value()->type() == MIRType_Int32);
@@ -2754,9 +2754,9 @@ LIRGenerator::visitStoreTypedArrayElementHole(MStoreTypedArrayElementHole *ins)
 
     if (ins->isFloatArray()) {
         DebugOnly<bool> optimizeFloat32 = allowFloat32Optimizations();
-        JS_ASSERT_IF(optimizeFloat32 && ins->arrayType() == ScalarTypeRepresentation::TYPE_FLOAT32,
+        JS_ASSERT_IF(optimizeFloat32 && ins->arrayType() == ScalarTypeDescr::TYPE_FLOAT32,
                      ins->value()->type() == MIRType_Float32);
-        JS_ASSERT_IF(!optimizeFloat32 || ins->arrayType() == ScalarTypeRepresentation::TYPE_FLOAT64,
+        JS_ASSERT_IF(!optimizeFloat32 || ins->arrayType() == ScalarTypeDescr::TYPE_FLOAT64,
                      ins->value()->type() == MIRType_Double);
     } else {
         JS_ASSERT(ins->value()->type() == MIRType_Int32);
diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
index 9c4b0c4c8848..1beef8c18799 100644
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -1257,7 +1257,7 @@ IonBuilder::inlineUnsafePutElements(CallInfo &callInfo)
 
         // We can only inline setelem on dense arrays that do not need type
         // barriers and on typed arrays.
-        ScalarTypeRepresentation::Type arrayType;
+        ScalarTypeDescr::Type arrayType;
         if ((!isDenseNative || writeNeedsBarrier) &&
             !ElementAccessIsTypedArray(obj, id, &arrayType))
         {
@@ -1286,7 +1286,7 @@ IonBuilder::inlineUnsafePutElements(CallInfo &callInfo)
             continue;
         }
 
-        ScalarTypeRepresentation::Type arrayType;
+        ScalarTypeDescr::Type arrayType;
         if (ElementAccessIsTypedArray(obj, id, &arrayType)) {
             if (!inlineUnsafeSetTypedArrayElement(callInfo, base, arrayType))
                 return InliningStatus_Error;
@@ -1323,7 +1323,7 @@ IonBuilder::inlineUnsafeSetDenseArrayElement(CallInfo &callInfo, uint32_t base)
 bool
 IonBuilder::inlineUnsafeSetTypedArrayElement(CallInfo &callInfo,
                                              uint32_t base,
-                                             ScalarTypeRepresentation::Type arrayType)
+                                             ScalarTypeDescr::Type arrayType)
 {
     // Note: we do not check the conditions that are asserted as true
     // in intrinsic_UnsafePutElements():
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index a0598f8b3d5f..ca27229b0380 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -571,7 +571,7 @@ void
 MLoadTypedArrayElement::printOpcode(FILE *fp) const
 {
     MDefinition::printOpcode(fp);
-    fprintf(fp, " %s", ScalarTypeRepresentation::typeName(arrayType()));
+    fprintf(fp, " %s", ScalarTypeDescr::typeName(arrayType()));
 }
 
 void
@@ -2926,7 +2926,7 @@ jit::ElementAccessIsDenseNative(MDefinition *obj, MDefinition *id)
 
 bool
 jit::ElementAccessIsTypedArray(MDefinition *obj, MDefinition *id,
-                               ScalarTypeRepresentation::Type *arrayType)
+                               ScalarTypeDescr::Type *arrayType)
 {
     if (obj->mightBeType(MIRType_String))
         return false;
@@ -2938,8 +2938,8 @@ jit::ElementAccessIsTypedArray(MDefinition *obj, MDefinition *id,
     if (!types)
         return false;
 
-    *arrayType = (ScalarTypeRepresentation::Type) types->getTypedArrayType();
-    return *arrayType != ScalarTypeRepresentation::TYPE_MAX;
+    *arrayType = (ScalarTypeDescr::Type) types->getTypedArrayType();
+    return *arrayType != ScalarTypeDescr::TYPE_MAX;
 }
 
 bool
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 023268db8b0f..da91041cbc42 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -22,8 +22,8 @@
 #include "jit/IonAllocPolicy.h"
 #include "jit/IonMacroAssembler.h"
 #include "jit/MOpcodes.h"
+#include "jit/TypeDescrSet.h"
 #include "jit/TypePolicy.h"
-#include "jit/TypeRepresentationSet.h"
 #include "vm/ScopeObject.h"
 #include "vm/TypedArrayObject.h"
 
@@ -85,8 +85,6 @@ class MUse;
 class MIRGraph;
 class MResumePoint;
 
-static inline bool isOSRLikeValue (MDefinition *def);
-
 // Represents a use of a node.
 class MUse : public TempObject, public InlineListNode<MUse>
 {
@@ -1559,9 +1557,9 @@ class MNewDerivedTypedObject
                       IntPolicy<2> >
 {
   private:
-    TypeRepresentationSet set_;
+    TypeDescrSet set_;
 
-    MNewDerivedTypedObject(TypeRepresentationSet set,
+    MNewDerivedTypedObject(TypeDescrSet set,
                            MDefinition *type,
                            MDefinition *owner,
                            MDefinition *offset)
@@ -1575,13 +1573,13 @@ class MNewDerivedTypedObject
   public:
     INSTRUCTION_HEADER(NewDerivedTypedObject);
 
-    static MNewDerivedTypedObject *New(TempAllocator &alloc, TypeRepresentationSet set,
+    static MNewDerivedTypedObject *New(TempAllocator &alloc, TypeDescrSet set,
                                        MDefinition *type, MDefinition *owner, MDefinition *offset)
     {
         return new(alloc) MNewDerivedTypedObject(set, type, owner, offset);
     }
 
-    TypeRepresentationSet set() const {
+    TypeDescrSet set() const {
         return set_;
     }
 
@@ -2254,12 +2252,18 @@ class MCompare
     bool operandMightEmulateUndefined_;
     bool operandsAreNeverNaN_;
 
+    // When a floating-point comparison is converted to an integer comparison
+    // (when range analysis proves it safe), we need to convert the operands
+    // to integer as well.
+    bool truncateOperands_;
+
     MCompare(MDefinition *left, MDefinition *right, JSOp jsop)
       : MBinaryInstruction(left, right),
         compareType_(Compare_Unknown),
         jsop_(jsop),
         operandMightEmulateUndefined_(true),
-        operandsAreNeverNaN_(false)
+        operandsAreNeverNaN_(false),
+        truncateOperands_(false)
     {
         setResultType(MIRType_Boolean);
         setMovable();
@@ -6101,34 +6105,34 @@ class MArrayConcat
 class MLoadTypedArrayElement
   : public MBinaryInstruction
 {
-    ScalarTypeRepresentation::Type arrayType_;
+    ScalarTypeDescr::Type arrayType_;
 
     MLoadTypedArrayElement(MDefinition *elements, MDefinition *index,
-                           ScalarTypeRepresentation::Type arrayType)
+                           ScalarTypeDescr::Type arrayType)
       : MBinaryInstruction(elements, index), arrayType_(arrayType)
     {
         setResultType(MIRType_Value);
         setMovable();
         JS_ASSERT(elements->type() == MIRType_Elements);
         JS_ASSERT(index->type() == MIRType_Int32);
-        JS_ASSERT(arrayType >= 0 && arrayType < ScalarTypeRepresentation::TYPE_MAX);
+        JS_ASSERT(arrayType >= 0 && arrayType < ScalarTypeDescr::TYPE_MAX);
     }
 
   public:
     INSTRUCTION_HEADER(LoadTypedArrayElement)
 
     static MLoadTypedArrayElement *New(TempAllocator &alloc, MDefinition *elements, MDefinition *index,
-                                       ScalarTypeRepresentation::Type arrayType)
+                                       ScalarTypeDescr::Type arrayType)
     {
         return new(alloc) MLoadTypedArrayElement(elements, index, arrayType);
     }
 
-    ScalarTypeRepresentation::Type arrayType() const {
+    ScalarTypeDescr::Type arrayType() const {
         return arrayType_;
     }
     bool fallible() const {
         // Bailout if the result does not fit in an int32.
-        return arrayType_ == ScalarTypeRepresentation::TYPE_UINT32 && type() == MIRType_Int32;
+        return arrayType_ == ScalarTypeDescr::TYPE_UINT32 && type() == MIRType_Int32;
     }
     MDefinition *elements() const {
         return getOperand(0);
@@ -6144,7 +6148,7 @@ class MLoadTypedArrayElement
 
     void computeRange(TempAllocator &alloc);
 
-    bool canProduceFloat32() const { return arrayType_ == ScalarTypeRepresentation::TYPE_FLOAT32; }
+    bool canProduceFloat32() const { return arrayType_ == ScalarTypeDescr::TYPE_FLOAT32; }
 };
 
 // Load a value from a typed array. Out-of-bounds accesses are handled using
@@ -6162,7 +6166,7 @@ class MLoadTypedArrayElementHole
         setResultType(MIRType_Value);
         setMovable();
         JS_ASSERT(index->type() == MIRType_Int32);
-        JS_ASSERT(arrayType >= 0 && arrayType < ScalarTypeRepresentation::TYPE_MAX);
+        JS_ASSERT(arrayType >= 0 && arrayType < ScalarTypeDescr::TYPE_MAX);
     }
 
   public:
@@ -6181,7 +6185,7 @@ class MLoadTypedArrayElementHole
         return allowDouble_;
     }
     bool fallible() const {
-        return arrayType_ == ScalarTypeRepresentation::TYPE_UINT32 && !allowDouble_;
+        return arrayType_ == ScalarTypeDescr::TYPE_UINT32 && !allowDouble_;
     }
     TypePolicy *typePolicy() {
         return this;
@@ -6195,7 +6199,7 @@ class MLoadTypedArrayElementHole
     AliasSet getAliasSet() const {
         return AliasSet::Load(AliasSet::TypedArrayElement);
     }
-    bool canProduceFloat32() const { return arrayType_ == ScalarTypeRepresentation::TYPE_FLOAT32; }
+    bool canProduceFloat32() const { return arrayType_ == ScalarTypeDescr::TYPE_FLOAT32; }
 };
 
 // Load a value fallibly or infallibly from a statically known typed array.
@@ -6207,9 +6211,9 @@ class MLoadTypedArrayElementStatic
       : MUnaryInstruction(ptr), typedArray_(typedArray), fallible_(true)
     {
         int type = typedArray_->type();
-        if (type == ScalarTypeRepresentation::TYPE_FLOAT32)
+        if (type == ScalarTypeDescr::TYPE_FLOAT32)
             setResultType(MIRType_Float32);
-        else if (type == ScalarTypeRepresentation::TYPE_FLOAT64)
+        else if (type == ScalarTypeDescr::TYPE_FLOAT64)
             setResultType(MIRType_Double);
         else
             setResultType(MIRType_Int32);
@@ -6252,7 +6256,7 @@ class MLoadTypedArrayElementStatic
 
     void computeRange(TempAllocator &alloc);
     bool truncate();
-    bool canProduceFloat32() const { return typedArray_->type() == ScalarTypeRepresentation::TYPE_FLOAT32; }
+    bool canProduceFloat32() const { return typedArray_->type() == ScalarTypeDescr::TYPE_FLOAT32; }
 };
 
 class MStoreTypedArrayElement
@@ -6271,7 +6275,7 @@ class MStoreTypedArrayElement
         setMovable();
         JS_ASSERT(elements->type() == MIRType_Elements);
         JS_ASSERT(index->type() == MIRType_Int32);
-        JS_ASSERT(arrayType >= 0 && arrayType < ScalarTypeRepresentation::TYPE_MAX);
+        JS_ASSERT(arrayType >= 0 && arrayType < ScalarTypeDescr::TYPE_MAX);
     }
 
   public:
@@ -6287,13 +6291,13 @@ class MStoreTypedArrayElement
         return arrayType_;
     }
     bool isByteArray() const {
-        return (arrayType_ == ScalarTypeRepresentation::TYPE_INT8 ||
-                arrayType_ == ScalarTypeRepresentation::TYPE_UINT8 ||
-                arrayType_ == ScalarTypeRepresentation::TYPE_UINT8_CLAMPED);
+        return (arrayType_ == ScalarTypeDescr::TYPE_INT8 ||
+                arrayType_ == ScalarTypeDescr::TYPE_UINT8 ||
+                arrayType_ == ScalarTypeDescr::TYPE_UINT8_CLAMPED);
     }
     bool isFloatArray() const {
-        return (arrayType_ == ScalarTypeRepresentation::TYPE_FLOAT32 ||
-                arrayType_ == ScalarTypeRepresentation::TYPE_FLOAT64);
+        return (arrayType_ == ScalarTypeDescr::TYPE_FLOAT32 ||
+                arrayType_ == ScalarTypeDescr::TYPE_FLOAT64);
     }
     TypePolicy *typePolicy() {
         return this;
@@ -6318,7 +6322,7 @@ class MStoreTypedArrayElement
     }
     bool isOperandTruncated(size_t index) const;
 
-    bool canConsumeFloat32() const { return arrayType_ == ScalarTypeRepresentation::TYPE_FLOAT32; }
+    bool canConsumeFloat32() const { return arrayType_ == ScalarTypeDescr::TYPE_FLOAT32; }
 };
 
 class MStoreTypedArrayElementHole
@@ -6339,7 +6343,7 @@ class MStoreTypedArrayElementHole
         JS_ASSERT(elements->type() == MIRType_Elements);
         JS_ASSERT(length->type() == MIRType_Int32);
         JS_ASSERT(index->type() == MIRType_Int32);
-        JS_ASSERT(arrayType >= 0 && arrayType < ScalarTypeRepresentation::TYPE_MAX);
+        JS_ASSERT(arrayType >= 0 && arrayType < ScalarTypeDescr::TYPE_MAX);
     }
 
   public:
@@ -6356,13 +6360,13 @@ class MStoreTypedArrayElementHole
         return arrayType_;
     }
     bool isByteArray() const {
-        return (arrayType_ == ScalarTypeRepresentation::TYPE_INT8 ||
-                arrayType_ == ScalarTypeRepresentation::TYPE_UINT8 ||
-                arrayType_ == ScalarTypeRepresentation::TYPE_UINT8_CLAMPED);
+        return (arrayType_ == ScalarTypeDescr::TYPE_INT8 ||
+                arrayType_ == ScalarTypeDescr::TYPE_UINT8 ||
+                arrayType_ == ScalarTypeDescr::TYPE_UINT8_CLAMPED);
     }
     bool isFloatArray() const {
-        return (arrayType_ == ScalarTypeRepresentation::TYPE_FLOAT32 ||
-                arrayType_ == ScalarTypeRepresentation::TYPE_FLOAT64);
+        return (arrayType_ == ScalarTypeDescr::TYPE_FLOAT32 ||
+                arrayType_ == ScalarTypeDescr::TYPE_FLOAT64);
     }
     TypePolicy *typePolicy() {
         return this;
@@ -6384,7 +6388,7 @@ class MStoreTypedArrayElementHole
     }
     bool isOperandTruncated(size_t index) const;
 
-    bool canConsumeFloat32() const { return arrayType_ == ScalarTypeRepresentation::TYPE_FLOAT32; }
+    bool canConsumeFloat32() const { return arrayType_ == ScalarTypeDescr::TYPE_FLOAT32; }
 };
 
 // Store a value infallibly to a statically known typed array.
@@ -6429,7 +6433,7 @@ class MStoreTypedArrayElementStatic :
     }
     bool isOperandTruncated(size_t index) const;
 
-    bool canConsumeFloat32() const { return typedArray_->type() == ScalarTypeRepresentation::TYPE_FLOAT32; }
+    bool canConsumeFloat32() const { return typedArray_->type() == ScalarTypeDescr::TYPE_FLOAT32; }
 };
 
 // Compute an "effective address", i.e., a compound computation of the form:
@@ -9741,24 +9745,13 @@ MInstruction *MDefinition::toInstruction()
     return (MInstruction *)this;
 }
 
-static inline bool isOSRLikeValue (MDefinition *def) {
-    if (def->isOsrValue())
-        return true;
-
-    if (def->isUnbox())
-        if (def->getOperand(0)->isOsrValue())
-            return true;
-
-    return false;
-}
-
 typedef Vector<MDefinition *, 8, IonAllocPolicy> MDefinitionVector;
 
 // Helper functions used to decide how to build MIR.
 
 bool ElementAccessIsDenseNative(MDefinition *obj, MDefinition *id);
 bool ElementAccessIsTypedArray(MDefinition *obj, MDefinition *id,
-                               ScalarTypeRepresentation::Type *arrayType);
+                               ScalarTypeDescr::Type *arrayType);
 bool ElementAccessIsPacked(types::CompilerConstraintList *constraints, MDefinition *obj);
 bool ElementAccessHasExtraIndexedProperty(types::CompilerConstraintList *constraints,
                                           MDefinition *obj);
diff --git a/js/src/jit/RangeAnalysis.cpp b/js/src/jit/RangeAnalysis.cpp
index a977f297a555..d9bd076ae15b 100644
--- a/js/src/jit/RangeAnalysis.cpp
+++ b/js/src/jit/RangeAnalysis.cpp
@@ -998,16 +998,12 @@ MPhi::computeRange(TempAllocator &alloc)
         return;
 
     Range *range = nullptr;
-    JS_ASSERT(!isOSRLikeValue(getOperand(0)));
     for (size_t i = 0, e = numOperands(); i < e; i++) {
         if (getOperand(i)->block()->unreachable()) {
             IonSpew(IonSpew_Range, "Ignoring unreachable input %d", getOperand(i)->id());
             continue;
         }
 
-        if (isOSRLikeValue(getOperand(i)))
-            continue;
-
         // Peek at the pre-bailout range so we can take a short-cut; if any of
         // the operands has an unknown range, this phi has an unknown range.
         if (!getOperand(i)->range())
@@ -1392,23 +1388,23 @@ MToInt32::computeRange(TempAllocator &alloc)
 static Range *GetTypedArrayRange(TempAllocator &alloc, int type)
 {
     switch (type) {
-      case ScalarTypeRepresentation::TYPE_UINT8_CLAMPED:
-      case ScalarTypeRepresentation::TYPE_UINT8:
+      case ScalarTypeDescr::TYPE_UINT8_CLAMPED:
+      case ScalarTypeDescr::TYPE_UINT8:
         return Range::NewUInt32Range(alloc, 0, UINT8_MAX);
-      case ScalarTypeRepresentation::TYPE_UINT16:
+      case ScalarTypeDescr::TYPE_UINT16:
         return Range::NewUInt32Range(alloc, 0, UINT16_MAX);
-      case ScalarTypeRepresentation::TYPE_UINT32:
+      case ScalarTypeDescr::TYPE_UINT32:
         return Range::NewUInt32Range(alloc, 0, UINT32_MAX);
 
-      case ScalarTypeRepresentation::TYPE_INT8:
+      case ScalarTypeDescr::TYPE_INT8:
         return Range::NewInt32Range(alloc, INT8_MIN, INT8_MAX);
-      case ScalarTypeRepresentation::TYPE_INT16:
+      case ScalarTypeDescr::TYPE_INT16:
         return Range::NewInt32Range(alloc, INT16_MIN, INT16_MAX);
-      case ScalarTypeRepresentation::TYPE_INT32:
+      case ScalarTypeDescr::TYPE_INT32:
         return Range::NewInt32Range(alloc, INT32_MIN, INT32_MAX);
 
-      case ScalarTypeRepresentation::TYPE_FLOAT32:
-      case ScalarTypeRepresentation::TYPE_FLOAT64:
+      case ScalarTypeDescr::TYPE_FLOAT32:
+      case ScalarTypeDescr::TYPE_FLOAT64:
         break;
     }
 
@@ -1428,7 +1424,7 @@ MLoadTypedArrayElementStatic::computeRange(TempAllocator &alloc)
 {
     // We don't currently use MLoadTypedArrayElementStatic for uint32, so we
     // don't have to worry about it returning a value outside our type.
-    JS_ASSERT(typedArray_->type() != ScalarTypeRepresentation::TYPE_UINT32);
+    JS_ASSERT(typedArray_->type() != ScalarTypeDescr::TYPE_UINT32);
 
     setRange(GetTypedArrayRange(alloc, typedArray_->type()));
 }
@@ -2338,13 +2334,21 @@ MCompare::truncate()
         return false;
 
     compareType_ = Compare_Int32;
+
+    // Truncating the operands won't change their value, but it will change
+    // their type, which we need because we now expect integer inputs.
+    truncateOperands_ = true;
+
     return true;
 }
 
 bool
 MCompare::isOperandTruncated(size_t index) const
 {
-    return compareType() == Compare_Int32;
+    // If we're doing an int32 comparison on operands which were previously
+    // floating-point, convert them!
+    JS_ASSERT_IF(truncateOperands_, isInt32Comparison());
+    return truncateOperands_;
 }
 
 // Ensure that all observables uses can work with a truncated
diff --git a/js/src/jit/TypeRepresentationSet.cpp b/js/src/jit/TypeDescrSet.cpp
similarity index 50%
rename from js/src/jit/TypeRepresentationSet.cpp
rename to js/src/jit/TypeDescrSet.cpp
index 0beec9f39367..38c57ded21de 100644
--- a/js/src/jit/TypeRepresentationSet.cpp
+++ b/js/src/jit/TypeDescrSet.cpp
@@ -4,20 +4,21 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "jit/TypeRepresentationSet.h"
+#include "jit/TypeDescrSet.h"
 
 #include "mozilla/HashFunctions.h"
 
+#include "builtin/TypedObject.h"
 #include "jit/IonBuilder.h"
 
 using namespace js;
 using namespace jit;
 
 ///////////////////////////////////////////////////////////////////////////
-// TypeRepresentationSet hasher
+// TypeDescrSet hasher
 
 HashNumber
-TypeRepresentationSetHasher::hash(TypeRepresentationSet key)
+TypeDescrSetHasher::hash(TypeDescrSet key)
 {
     HashNumber hn = mozilla::HashGeneric(key.length());
     for (size_t i = 0; i < key.length(); i++)
@@ -26,8 +27,7 @@ TypeRepresentationSetHasher::hash(TypeRepresentationSet key)
 }
 
 bool
-TypeRepresentationSetHasher::match(TypeRepresentationSet key1,
-                                   TypeRepresentationSet key2)
+TypeDescrSetHasher::match(TypeDescrSet key1, TypeDescrSet key2)
 {
     if (key1.length() != key2.length())
         return false;
@@ -42,54 +42,59 @@ TypeRepresentationSetHasher::match(TypeRepresentationSet key1,
 }
 
 ///////////////////////////////////////////////////////////////////////////
-// TypeRepresentationSetBuilder
+// TypeDescrSetBuilder
 
-TypeRepresentationSetBuilder::TypeRepresentationSetBuilder()
+TypeDescrSetBuilder::TypeDescrSetBuilder()
   : invalid_(false)
 {}
 
 bool
-TypeRepresentationSetBuilder::insert(TypeRepresentation *typeRepr)
+TypeDescrSetBuilder::insert(TypeDescr *descr)
 {
+    // All type descriptors should be tenured, so it is safe to assume
+    // that the pointers do not change during compilation, since no
+    // major GC can overlap with compilation.
+    JS_ASSERT(!GetIonContext()->runtime->isInsideNursery(descr));
+
     if (invalid_)
         return true;
 
     if (entries_.empty())
-        return entries_.append(typeRepr);
+        return entries_.append(descr);
 
     // Check that this new type repr is of the same basic kind as the
     // ones we have seen thus far. If not, for example if we have an
     // `int` and a `struct`, then convert this set to the invalid set.
-    TypeRepresentation *entry0 = entries_[0];
-    if (typeRepr->kind() != entry0->kind()) {
+    TypeDescr *entry0 = entries_[0];
+    if (descr->kind() != entry0->kind()) {
         invalid_ = true;
         entries_.clear();
         return true;
     }
 
     // Otherwise, use binary search to find the right place to insert
-    // the type descriptor. We keep list sorted by the *address* of
-    // the type representations within.
-    uintptr_t typeReprAddr = (uintptr_t) typeRepr;
+    // the TypeDescr. We keep the list sorted by the *address* of
+    // the TypeDescrs within.
+    uintptr_t descrAddr = (uintptr_t) descr;
     size_t min = 0;
     size_t max = entries_.length();
     while (min != max) {
         size_t i = min + ((max - min) >> 1); // average w/o fear of overflow
 
         uintptr_t entryiaddr = (uintptr_t) entries_[i];
-        if (entryiaddr == typeReprAddr)
-            return true; // typeRepr already present in the set
+        if (entryiaddr == descrAddr)
+            return true; // descr already present in the set
 
-        if (entryiaddr < typeReprAddr) {
-            // typeRepr lies to the right of entry i
+        if (entryiaddr < descrAddr) {
+            // descr lies to the right of entry i
             min = i + 1;
         } else {
-            // typeRepr lies to the left of entry i
+            // descr lies to the left of entry i
             max = i;
         }
     }
 
-    // As a sanity check, give up if the TypeRepresentationSet grows too large.
+    // As a sanity check, give up if the TypeDescrSet grows too large.
     if (entries_.length() >= 512) {
         invalid_ = true;
         entries_.clear();
@@ -98,41 +103,40 @@ TypeRepresentationSetBuilder::insert(TypeRepresentation *typeRepr)
 
     // Not present. Insert at position `min`.
     if (min == entries_.length())
-        return entries_.append(typeRepr);
-    TypeRepresentation **insertLoc = &entries_[min];
-    return entries_.insert(insertLoc, typeRepr) != nullptr;
+        return entries_.append(descr);
+    TypeDescr **insertLoc = &entries_[min];
+    return entries_.insert(insertLoc, descr) != nullptr;
 }
 
 bool
-TypeRepresentationSetBuilder::build(IonBuilder &builder,
-                                    TypeRepresentationSet *out)
+TypeDescrSetBuilder::build(IonBuilder &builder, TypeDescrSet *out)
 {
     if (invalid_) {
-        *out = TypeRepresentationSet();
+        *out = TypeDescrSet();
         return true;
     }
 
-    TypeRepresentationSetHash *table = builder.getOrCreateReprSetHash();
+    TypeDescrSetHash *table = builder.getOrCreateDescrSetHash();
     if (!table)
         return false;
 
     // Check if there is already a copy in the hashtable.
     size_t length = entries_.length();
-    TypeRepresentationSet tempSet(length, entries_.begin());
-    TypeRepresentationSetHash::AddPtr p = table->lookupForAdd(tempSet);
+    TypeDescrSet tempSet(length, entries_.begin());
+    TypeDescrSetHash::AddPtr p = table->lookupForAdd(tempSet);
     if (p) {
         *out = *p;
         return true;
     }
 
     // If not, allocate a permanent copy in Ion temp memory and add it.
-    size_t space = sizeof(TypeRepresentation*) * length;
-    TypeRepresentation **array = (TypeRepresentation**)
+    size_t space = sizeof(TypeDescr*) * length;
+    TypeDescr **array = (TypeDescr**)
         GetIonContext()->temp->allocate(space);
     if (!array)
         return false;
     memcpy(array, entries_.begin(), space);
-    TypeRepresentationSet permSet(length, array);
+    TypeDescrSet permSet(length, array);
     if (!table->add(p, permSet))
         return false;
 
@@ -141,66 +145,53 @@ TypeRepresentationSetBuilder::build(IonBuilder &builder,
 }
 
 ///////////////////////////////////////////////////////////////////////////
-// TypeRepresentationSet
+// TypeDescrSet
 
-TypeRepresentationSet::TypeRepresentationSet(const TypeRepresentationSet &c)
+TypeDescrSet::TypeDescrSet(const TypeDescrSet &c)
   : length_(c.length_),
     entries_(c.entries_)
 {}
 
-TypeRepresentationSet::TypeRepresentationSet(size_t length,
-                                             TypeRepresentation **entries)
+TypeDescrSet::TypeDescrSet(size_t length,
+                           TypeDescr **entries)
   : length_(length),
     entries_(entries)
 {}
 
-TypeRepresentationSet::TypeRepresentationSet()
+TypeDescrSet::TypeDescrSet()
   : length_(0),
     entries_(nullptr)
 {}
 
 bool
-TypeRepresentationSet::empty()
+TypeDescrSet::empty()
 {
     return length_ == 0;
 }
 
 bool
-TypeRepresentationSet::singleton()
-{
-    return length_ == 1;
-}
-
-TypeRepresentation *
-TypeRepresentationSet::getTypeRepresentation()
-{
-    JS_ASSERT(singleton());
-    return get(0);
-}
-
-bool
-TypeRepresentationSet::allOfArrayKind()
+TypeDescrSet::allOfArrayKind()
 {
     if (empty())
         return false;
 
     switch (kind()) {
-      case TypeRepresentation::SizedArray:
-      case TypeRepresentation::UnsizedArray:
+      case TypeDescr::SizedArray:
+      case TypeDescr::UnsizedArray:
         return true;
 
-      case TypeRepresentation::X4:
-      case TypeRepresentation::Reference:
-      case TypeRepresentation::Scalar:
-      case TypeRepresentation::Struct:
+      case TypeDescr::X4:
+      case TypeDescr::Reference:
+      case TypeDescr::Scalar:
+      case TypeDescr::Struct:
         return false;
     }
 
-    MOZ_ASSUME_UNREACHABLE("Invalid kind() in TypeRepresentationSet");
+    MOZ_ASSUME_UNREACHABLE("Invalid kind() in TypeDescrSet");
 }
 
 bool
-TypeRepresentationSet::allOfKind(TypeRepresentation::Kind aKind)
+TypeDescrSet::allOfKind(TypeDescr::Kind aKind)
 {
     if (empty())
         return false;
@@ -209,16 +200,16 @@ TypeRepresentationSet::allOfKind(TypeRepresentation::Kind aKind)
 }
 
 bool
-TypeRepresentationSet::allHaveSameSize(size_t *out)
+TypeDescrSet::allHaveSameSize(size_t *out)
 {
     if (empty())
         return false;
 
-    JS_ASSERT(TypeRepresentation::isSized(kind()));
+    JS_ASSERT(TypeDescr::isSized(kind()));
 
-    size_t size = get(0)->asSized()->size();
+    size_t size = get(0)->as<SizedTypeDescr>().size();
     for (size_t i = 1; i < length(); i++) {
-        if (get(i)->asSized()->size() != size)
+        if (get(i)->as<SizedTypeDescr>().size() != size)
             return false;
     }
 
@@ -226,25 +217,60 @@ TypeRepresentationSet::allHaveSameSize(size_t *out)
     return true;
 }
 
-TypeRepresentation::Kind
-TypeRepresentationSet::kind()
+TypeDescr::Kind
+TypeDescrSet::kind()
 {
     JS_ASSERT(!empty());
     return get(0)->kind();
 }
 
+template<typename T>
 bool
-TypeRepresentationSet::hasKnownArrayLength(size_t *l)
+TypeDescrSet::genericType(typename T::Type *out)
+{
+    JS_ASSERT(allOfKind(TypeDescr::Scalar));
+
+    typename T::Type type = get(0)->as<T>().type();
+    for (size_t i = 1; i < length(); i++) {
+        if (get(i)->as<T>().type() != type)
+            return false;
+    }
+
+    *out = type;
+    return true;
+}
+
+bool
+TypeDescrSet::scalarType(ScalarTypeDescr::Type *out)
+{
+    return genericType<ScalarTypeDescr>(out);
+}
+
+bool
+TypeDescrSet::referenceType(ReferenceTypeDescr::Type *out)
+{
+    return genericType<ReferenceTypeDescr>(out);
+}
+
+bool
+TypeDescrSet::x4Type(X4TypeDescr::Type *out)
+{
+    return genericType<X4TypeDescr>(out);
+}
+
+bool
+TypeDescrSet::hasKnownArrayLength(size_t *l)
 {
     switch (kind()) {
-      case TypeRepresentation::UnsizedArray:
+      case TypeDescr::UnsizedArray:
         return false;
 
-      case TypeRepresentation::SizedArray:
+      case TypeDescr::SizedArray:
       {
-        const size_t result = get(0)->asSizedArray()->length();
+        const size_t result = get(0)->as<SizedArrayTypeDescr>().length();
         for (size_t i = 1; i < length(); i++) {
-            if (get(i)->asSizedArray()->length() != result)
+            size_t l = get(i)->as<SizedArrayTypeDescr>().length();
+            if (l != result)
                 return false;
         }
         *l = result;
@@ -257,19 +283,18 @@ TypeRepresentationSet::hasKnownArrayLength(size_t *l)
 }
 
 bool
-TypeRepresentationSet::arrayElementType(IonBuilder &builder,
-                                        TypeRepresentationSet *out)
+TypeDescrSet::arrayElementType(IonBuilder &builder, TypeDescrSet *out)
 {
-    TypeRepresentationSetBuilder elementTypes;
+    TypeDescrSetBuilder elementTypes;
     for (size_t i = 0; i < length(); i++) {
         switch (kind()) {
-          case TypeRepresentation::UnsizedArray:
-            if (!elementTypes.insert(get(i)->asUnsizedArray()->element()))
+          case TypeDescr::UnsizedArray:
+            if (!elementTypes.insert(&get(i)->as<UnsizedArrayTypeDescr>().elementType()))
                 return false;
             break;
 
-          case TypeRepresentation::SizedArray:
-            if (!elementTypes.insert(get(i)->asSizedArray()->element()))
+          case TypeDescr::SizedArray:
+            if (!elementTypes.insert(&get(i)->as<SizedArrayTypeDescr>().elementType()))
                 return false;
             break;
 
@@ -281,49 +306,52 @@ TypeRepresentationSet::arrayElementType(IonBuilder &builder,
 }
 
 bool
-TypeRepresentationSet::fieldNamed(IonBuilder &builder,
-                                  jsid id,
-                                  size_t *offset,
-                                  TypeRepresentationSet *out,
-                                  size_t *index)
+TypeDescrSet::fieldNamed(IonBuilder &builder,
+                         jsid id,
+                         size_t *offset,
+                         TypeDescrSet *out,
+                         size_t *index)
 {
-    JS_ASSERT(kind() == TypeRepresentation::Struct);
+    JS_ASSERT(kind() == TypeDescr::Struct);
 
     // Initialize `*offset` and `*out` for the case where incompatible
     // or absent fields are found.
     *offset = SIZE_MAX;
     *index = SIZE_MAX;
-    *out = TypeRepresentationSet();
+    *out = TypeDescrSet();
 
     // Remember offset of the first field.
     size_t offset0;
     size_t index0;
-    TypeRepresentationSetBuilder fieldTypes;
+    TypeDescrSetBuilder fieldTypes;
     {
-        const StructField *field = get(0)->asStruct()->fieldNamed(id);
-        if (!field)
+        StructTypeDescr &descr0 = get(0)->as<StructTypeDescr>();
+        if (!descr0.fieldIndex(id, &index0))
             return true;
 
-        offset0 = field->offset;
-        index0 = field->index;
-        if (!fieldTypes.insert(field->typeRepr))
+        offset0 = descr0.fieldOffset(index0);
+        if (!fieldTypes.insert(&descr0.fieldDescr(index0)))
             return false;
     }
 
     // Check that all subsequent fields are at the same offset
     // and compute the union of their types.
     for (size_t i = 1; i < length(); i++) {
-        const StructField *field = get(i)->asStruct()->fieldNamed(id);
-        if (!field)
+        StructTypeDescr &descri = get(0)->as<StructTypeDescr>();
+
+        size_t indexi;
+        if (!descri.fieldIndex(id, &indexi))
             return true;
 
-        if (field->offset != offset0)
-            return true;
-
-        if (field->index != index0)
+        // Track whether all indices agree, but do not require it to be true
+        if (indexi != index0)
             index0 = SIZE_MAX;
 
-        if (!fieldTypes.insert(field->typeRepr))
+        // Require that all offsets agree
+        if (descri.fieldOffset(indexi) != offset0)
+            return true;
+
+        if (!fieldTypes.insert(&descri.fieldDescr(indexi)))
             return false;
     }
 
diff --git a/js/src/jit/TypeRepresentationSet.h b/js/src/jit/TypeDescrSet.h
similarity index 66%
rename from js/src/jit/TypeRepresentationSet.h
rename to js/src/jit/TypeDescrSet.h
index 9207d665abf3..e30e0b6ca9bb 100644
--- a/js/src/jit/TypeRepresentationSet.h
+++ b/js/src/jit/TypeDescrSet.h
@@ -7,7 +7,7 @@
 #ifndef jit_TypeRepresentationSet_h
 #define jit_TypeRepresentationSet_h
 
-#include "builtin/TypeRepresentation.h"
+#include "builtin/TypedObject.h"
 #include "jit/IonAllocPolicy.h"
 #include "js/HashTable.h"
 
@@ -37,59 +37,59 @@ namespace js {
 namespace jit {
 
 class IonBuilder;
-class TypeRepresentationSet;
+class TypeDescrSet;
 
-class TypeRepresentationSetBuilder {
+class TypeDescrSetBuilder {
   private:
-    Vector<TypeRepresentation *, 4, SystemAllocPolicy> entries_;
+    Vector<TypeDescr *, 4, SystemAllocPolicy> entries_;
     bool invalid_;
 
-    bool overlaps(TypeRepresentation *a, TypeRepresentation *b);
-
   public:
-    TypeRepresentationSetBuilder();
+    TypeDescrSetBuilder();
 
-    bool insert(TypeRepresentation *typeRepr);
-    bool build(IonBuilder &builder, TypeRepresentationSet *out);
+    bool insert(TypeDescr *typeRepr);
+    bool build(IonBuilder &builder, TypeDescrSet *out);
 };
 
-class TypeRepresentationSet {
+class TypeDescrSet {
   private:
-    friend struct TypeRepresentationSetHasher;
-    friend class TypeRepresentationSetBuilder;
+    friend struct TypeDescrSetHasher;
+    friend class TypeDescrSetBuilder;
 
     size_t length_;
-    TypeRepresentation **entries_; // Allocated using temp policy
+    TypeDescr **entries_; // Allocated using temp policy
 
-    TypeRepresentationSet(size_t length, TypeRepresentation **entries);
+    TypeDescrSet(size_t length, TypeDescr **entries);
 
     size_t length() const {
         return length_;
     }
 
-    TypeRepresentation *get(uint32_t i) const {
+    TypeDescr *get(uint32_t i) const {
         return entries_[i];
     }
 
+    template<typename T>
+    bool genericType(typename T::Type *out);
+
   public:
     //////////////////////////////////////////////////////////////////////
     // Constructors
     //
     // For more flexible constructors, see
-    // TypeRepresentationSetBuilder above.
+    // TypeDescrSetBuilder above.
 
-    TypeRepresentationSet(const TypeRepresentationSet &c);
-    TypeRepresentationSet(); // empty set
+    TypeDescrSet(const TypeDescrSet &c);
+    TypeDescrSet(); // empty set
 
     //////////////////////////////////////////////////////////////////////
     // Query the set
 
     bool empty();
-    bool singleton();
-    bool allOfKind(TypeRepresentation::Kind kind);
+    bool allOfKind(TypeDescr::Kind kind);
 
     // Returns true only when non-empty and `kind()` is
-    // `TypeRepresentation::Array`
+    // `TypeDescr::Array`
     bool allOfArrayKind();
 
     // Returns true only if (1) non-empty, (2) for all types t in this
@@ -105,32 +105,54 @@ class TypeRepresentationSet {
     //////////////////////////////////////////////////////////////////////
     // The following operations are only valid on a non-empty set:
 
-    TypeRepresentation::Kind kind();
+    TypeDescr::Kind kind();
 
     //////////////////////////////////////////////////////////////////////
-    // The following operations are only valid on a singleton set:
+    // Scalar operations
+    //
+    // Only valid when `kind() == TypeDescr::Scalar`
 
-    TypeRepresentation *getTypeRepresentation();
+    // If all type descrs in this set have a single type, returns true
+    // and sets *out. Else returns false.
+    bool scalarType(ScalarTypeDescr::Type *out);
+
+    //////////////////////////////////////////////////////////////////////
+    // Reference operations
+    //
+    // Only valid when `kind() == TypeDescr::Reference`
+
+    // If all type descrs in this set have a single type, returns true
+    // and sets *out. Else returns false.
+    bool referenceType(ReferenceTypeDescr::Type *out);
+
+    //////////////////////////////////////////////////////////////////////
+    // Reference operations
+    //
+    // Only valid when `kind() == TypeDescr::X4`
+
+    // If all type descrs in this set have a single type, returns true
+    // and sets *out. Else returns false.
+    bool x4Type(X4TypeDescr::Type *out);
 
     //////////////////////////////////////////////////////////////////////
     // SizedArray operations
     //
-    // Only valid when `kind() == TypeRepresentation::SizedArray`
+    // Only valid when `kind() == TypeDescr::SizedArray`
 
     // Determines whether all arrays in this set have the same,
     // statically known, array length and return that length
     // (via `*length`) if so. Otherwise returns false.
     bool hasKnownArrayLength(size_t *length);
 
-    // Returns a `TypeRepresentationSet` representing the element
+    // Returns a `TypeDescrSet` representing the element
     // types of the various array types in this set. The returned set
     // may be the empty set.
-    bool arrayElementType(IonBuilder &builder, TypeRepresentationSet *out);
+    bool arrayElementType(IonBuilder &builder, TypeDescrSet *out);
 
     //////////////////////////////////////////////////////////////////////
     // Struct operations
     //
-    // Only valid when `kind() == TypeRepresentation::Struct`
+    // Only valid when `kind() == TypeDescr::Struct`
 
     // Searches the type in the set for a field named `id`. All
     // possible types must agree on the offset of the field within the
@@ -152,21 +174,21 @@ class TypeRepresentationSet {
     bool fieldNamed(IonBuilder &builder,
                     jsid id,
                     size_t *offset,
-                    TypeRepresentationSet *out,
+                    TypeDescrSet *out,
                     size_t *index);
 };
 
-struct TypeRepresentationSetHasher
+struct TypeDescrSetHasher
 {
-    typedef TypeRepresentationSet Lookup;
-    static HashNumber hash(TypeRepresentationSet key);
-    static bool match(TypeRepresentationSet key1,
-                      TypeRepresentationSet key2);
+    typedef TypeDescrSet Lookup;
+    static HashNumber hash(TypeDescrSet key);
+    static bool match(TypeDescrSet key1,
+                      TypeDescrSet key2);
 };
 
-typedef js::HashSet<TypeRepresentationSet,
-                    TypeRepresentationSetHasher,
-                    IonAllocPolicy> TypeRepresentationSetHash;
+typedef js::HashSet<TypeDescrSet,
+                    TypeDescrSetHasher,
+                    IonAllocPolicy> TypeDescrSetHash;
 
 } // namespace jit
 } // namespace js
diff --git a/js/src/jit/TypePolicy.cpp b/js/src/jit/TypePolicy.cpp
index 34d142c3bbb1..6b305c7a531b 100644
--- a/js/src/jit/TypePolicy.cpp
+++ b/js/src/jit/TypePolicy.cpp
@@ -733,22 +733,22 @@ StoreTypedArrayPolicy::adjustValueInput(TempAllocator &alloc, MInstruction *ins,
               value->type() == MIRType_Value);
 
     switch (arrayType) {
-      case ScalarTypeRepresentation::TYPE_INT8:
-      case ScalarTypeRepresentation::TYPE_UINT8:
-      case ScalarTypeRepresentation::TYPE_INT16:
-      case ScalarTypeRepresentation::TYPE_UINT16:
-      case ScalarTypeRepresentation::TYPE_INT32:
-      case ScalarTypeRepresentation::TYPE_UINT32:
+      case ScalarTypeDescr::TYPE_INT8:
+      case ScalarTypeDescr::TYPE_UINT8:
+      case ScalarTypeDescr::TYPE_INT16:
+      case ScalarTypeDescr::TYPE_UINT16:
+      case ScalarTypeDescr::TYPE_INT32:
+      case ScalarTypeDescr::TYPE_UINT32:
         if (value->type() != MIRType_Int32) {
             value = MTruncateToInt32::New(alloc, value);
             ins->block()->insertBefore(ins, value->toInstruction());
         }
         break;
-      case ScalarTypeRepresentation::TYPE_UINT8_CLAMPED:
+      case ScalarTypeDescr::TYPE_UINT8_CLAMPED:
         // IonBuilder should have inserted ClampToUint8.
         JS_ASSERT(value->type() == MIRType_Int32);
         break;
-      case ScalarTypeRepresentation::TYPE_FLOAT32:
+      case ScalarTypeDescr::TYPE_FLOAT32:
         if (LIRGenerator::allowFloat32Optimizations()) {
             if (value->type() != MIRType_Float32) {
                 value = MToFloat32::New(alloc, value);
@@ -758,7 +758,7 @@ StoreTypedArrayPolicy::adjustValueInput(TempAllocator &alloc, MInstruction *ins,
         }
         // Fallthrough: if the LIRGenerator cannot directly store Float32, it will expect the
         // stored value to be a double.
-      case ScalarTypeRepresentation::TYPE_FLOAT64:
+      case ScalarTypeDescr::TYPE_FLOAT64:
         if (value->type() != MIRType_Double) {
             value = MToDouble::New(alloc, value);
             ins->block()->insertBefore(ins, value->toInstruction());
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index a939a297706a..15a0667eb80f 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -1139,7 +1139,7 @@ JS_InitStandardClasses(JSContext *cx, HandleObject obj)
 
 #define CLASP(name)                 (&name##Class)
 #define OCLASP(name)                (&name##Object::class_)
-#define TYPED_ARRAY_CLASP(type)     (&TypedArrayObject::classes[ScalarTypeRepresentation::type])
+#define TYPED_ARRAY_CLASP(type)     (&TypedArrayObject::classes[ScalarTypeDescr::type])
 #define EAGER_ATOM(name)            NAME_OFFSET(name)
 #define EAGER_CLASS_ATOM(name)      NAME_OFFSET(name)
 
@@ -2354,7 +2354,8 @@ JS_SetPrototype(JSContext *cx, JS::Handle<JSObject*> obj, JS::Handle<JSObject*>
         return false;
 
     if (!succeeded) {
-        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_SETPROTOTYPEOF_FAIL);
+        RootedValue val(cx, ObjectValue(*obj));
+        js_ReportValueError(cx, JSMSG_SETPROTOTYPEOF_FAIL, JSDVG_IGNORE_STACK, val, js::NullPtr());
         return false;
     }
 
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index 2e548be84e81..085ad4751448 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -3165,15 +3165,17 @@ JS_StealArrayBufferContents(JSContext *cx, JS::HandleObject obj, void **contents
 
 /*
  * Allocate memory that may be eventually passed to
- * JS_NewArrayBufferWithContents. |nbytes| is the number of payload bytes
- * required. The pointer to pass to JS_NewArrayBufferWithContents is returned
- * in |contents|. The pointer to the |nbytes| of usable memory is returned in
- * |data|. (*|contents| will contain a header before |data|.) The only legal
- * operations on *|contents| is to free it, or pass it to
- * JS_NewArrayBufferWithContents or JS_ReallocateArrayBufferContents.
+ * JS_NewArrayBufferWithContents. |maybecx| is optional; if a non-nullptr cx is
+ * given, it will be used for memory accounting and OOM reporting. |nbytes| is
+ * the number of payload bytes required. The pointer to pass to
+ * JS_NewArrayBufferWithContents is returned in |contents|. The pointer to the
+ * |nbytes| of usable memory is returned in |data|. (*|contents| will contain a
+ * header before |data|.) The only legal operations on *|contents| is to free
+ * it, or pass it to JS_NewArrayBufferWithContents or
+ * JS_ReallocateArrayBufferContents.
  */
 extern JS_PUBLIC_API(bool)
-JS_AllocateArrayBufferContents(JSContext *cx, uint32_t nbytes, void **contents, uint8_t **data);
+JS_AllocateArrayBufferContents(JSContext *maybecx, uint32_t nbytes, void **contents, uint8_t **data);
 
 /*
  * Reallocate memory allocated by JS_AllocateArrayBufferContents, growing or
diff --git a/js/src/jscompartment.h b/js/src/jscompartment.h
index 117701dcfc09..5e363bab32d8 100644
--- a/js/src/jscompartment.h
+++ b/js/src/jscompartment.h
@@ -9,6 +9,7 @@
 
 #include "mozilla/MemoryReporting.h"
 
+#include "builtin/TypedObject.h"
 #include "builtin/TypeRepresentation.h"
 #include "gc/Zone.h"
 #include "vm/GlobalObject.h"
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index bca8792f62c9..4661247d556c 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -1712,7 +1712,7 @@ TemporaryTypeSet::getTypedArrayType()
 
     if (clasp && IsTypedArrayClass(clasp))
         return clasp - &TypedArrayObject::classes[0];
-    return ScalarTypeRepresentation::TYPE_MAX;
+    return ScalarTypeDescr::TYPE_MAX;
 }
 
 bool
@@ -4633,14 +4633,16 @@ TypeObject::setAddendum(TypeObjectAddendum *addendum)
 }
 
 bool
-TypeObject::addTypedObjectAddendum(JSContext *cx,
-                                   TypeTypedObject::Kind kind,
-                                   TypeRepresentation *repr)
+TypeObject::addTypedObjectAddendum(JSContext *cx, Handle<TypeDescr*> descr)
 {
     if (!cx->typeInferenceEnabled())
         return true;
 
-    JS_ASSERT(repr);
+    // Type descriptors are always pre-tenured. This is both because
+    // we expect them to live a long time and so that they can be
+    // safely accessed during ion compilation.
+    JS_ASSERT(!IsInsideNursery(cx->runtime(), descr));
+    JS_ASSERT(descr);
 
     if (flags() & OBJECT_FLAG_ADDENDUM_CLEARED)
         return true;
@@ -4649,11 +4651,11 @@ TypeObject::addTypedObjectAddendum(JSContext *cx,
 
     if (addendum) {
         JS_ASSERT(hasTypedObject());
-        JS_ASSERT(typedObject()->typeRepr == repr);
+        JS_ASSERT(&typedObject()->descr() == descr);
         return true;
     }
 
-    TypeTypedObject *typedObject = js_new<TypeTypedObject>(kind, repr);
+    TypeTypedObject *typedObject = js_new<TypeTypedObject>(descr);
     if (!typedObject)
         return false;
     addendum = typedObject;
@@ -4672,10 +4674,14 @@ TypeNewScript::TypeNewScript()
   : TypeObjectAddendum(NewScript)
 {}
 
-TypeTypedObject::TypeTypedObject(Kind kind,
-                                 TypeRepresentation *repr)
+TypeTypedObject::TypeTypedObject(Handle<TypeDescr*> descr)
   : TypeObjectAddendum(TypedObject),
-    kind(kind),
-    typeRepr(repr)
+    descr_(descr)
 {
 }
+
+TypeDescr &
+js::types::TypeTypedObject::descr() {
+    return descr_->as<TypeDescr>();
+}
+
diff --git a/js/src/jsinfer.h b/js/src/jsinfer.h
index 869342e816b9..df9951f16907 100644
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -25,13 +25,13 @@
 
 namespace js {
 
+class TypeDescr;
+
 #ifdef DEBUG
 bool CurrentThreadCanWriteCompilationData();
 bool CurrentThreadCanReadCompilationData();
 #endif
 
-class TypeRepresentation;
-
 class TaggedProto
 {
   public:
@@ -847,23 +847,17 @@ struct TypeNewScript : public TypeObjectAddendum
 
 struct TypeTypedObject : public TypeObjectAddendum
 {
-    enum Kind {
-        TypeDescriptor,
-        Datum,
-    };
+  private:
+    HeapPtrObject descr_;
 
-    TypeTypedObject(Kind kind, TypeRepresentation *repr);
+  public:
+    TypeTypedObject(Handle<TypeDescr*> descr);
 
-    const Kind kind;
-    TypeRepresentation *const typeRepr;
-
-    bool isTypeDescriptor() const {
-        return kind == TypeDescriptor;
+    HeapPtrObject &descrHeapPtr() {
+        return descr_;
     }
 
-    bool isDatum() const {
-        return kind == Datum;
-    }
+    TypeDescr &descr();
 };
 
 /*
@@ -1019,9 +1013,7 @@ struct TypeObject : gc::BarrieredCell<TypeObject>
      * this addendum must already be associated with the same TypeRepresentation,
      * and the method has no effect.
      */
-    bool addTypedObjectAddendum(JSContext *cx,
-                                TypeTypedObject::Kind kind ,
-                                TypeRepresentation *repr);
+    bool addTypedObjectAddendum(JSContext *cx, Handle<TypeDescr*> descr);
 
   private:
     /*
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index bc4f9ebfabc2..6ab8fb074831 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -511,8 +511,13 @@ JSObject::create(js::ExclusiveContext *cx, js::gc::AllocKind kind, js::gc::Initi
 
     obj->shape_.init(shape);
     obj->type_.init(type);
-    if (extantSlots)
+    if (extantSlots) {
+#ifdef JSGC_GENERATIONAL
+        if (cx->isJSContext())
+            cx->asJSContext()->runtime()->gcNursery.notifyInitialSlots(obj, extantSlots);
+#endif
         obj->slots = extantSlots;
+    }
     obj->elements = js::emptyObjectElements;
 
     if (clasp->hasPrivate())
diff --git a/js/src/jsprototypes.h b/js/src/jsprototypes.h
index f85f30782f08..b3dbe0eef30a 100644
--- a/js/src/jsprototypes.h
+++ b/js/src/jsprototypes.h
@@ -34,7 +34,7 @@
 
 #define CLASP(name)                 (&name##Class)
 #define OCLASP(name)                (&name##Object::class_)
-#define TYPED_ARRAY_CLASP(type)     (&TypedArrayObject::classes[ScalarTypeRepresentation::type])
+#define TYPED_ARRAY_CLASP(type)     (&TypedArrayObject::classes[ScalarTypeDescr::type])
 
 #ifdef ENABLE_PARALLEL_JS
 #define IF_PJS(real,imaginary) real
diff --git a/js/src/moz.build b/js/src/moz.build
index 65e1105131b9..9e6f3cbb3a22 100644
--- a/js/src/moz.build
+++ b/js/src/moz.build
@@ -280,8 +280,8 @@ if CONFIG['ENABLE_ION']:
         'jit/shared/Lowering-shared.cpp',
         'jit/Snapshots.cpp',
         'jit/StupidAllocator.cpp',
+        'jit/TypeDescrSet.cpp',
         'jit/TypePolicy.cpp',
-        'jit/TypeRepresentationSet.cpp',
         'jit/UnreachableCodeElimination.cpp',
         'jit/ValueNumbering.cpp',
         'jit/VMFunctions.cpp',
diff --git a/js/src/tests/ecma_6/TypedObject/shell.js b/js/src/tests/ecma_6/TypedObject/shell.js
index 5c0b59ca29e0..a0471778d6fd 100644
--- a/js/src/tests/ecma_6/TypedObject/shell.js
+++ b/js/src/tests/ecma_6/TypedObject/shell.js
@@ -17,14 +17,10 @@ function assertTypedEqual(type, a_orig, b_orig) {
       for (var i = 0; i < type.length; i++)
         recur(type.elementType, a[i], b[i]);
       } else if (type instanceof StructType) {
-        for (var idx in type.fieldNames) {
-          var fieldName = type.fieldNames[idx];
-          if (type.fieldTypes[fieldName] !== undefined) {
-            recur(type.fieldTypes[fieldName], a[fieldName], b[fieldName]);
-          } else {
-            throw new Error("assertTypedEqual no type for "+
-                            "fieldName: "+fieldName+" in type: "+type.toSource());
-          }
+        var fieldNames = Object.getOwnPropertyNames(type.fieldTypes);
+        for (var i = 0; i < fieldNames.length; i++) {
+          var fieldName = fieldNames[i];
+          recur(type.fieldTypes[fieldName], a[fieldName], b[fieldName]);
         }
       } else {
         assertEq(a, b);
diff --git a/js/src/tests/ecma_6/TypedObject/structtypereflection.js b/js/src/tests/ecma_6/TypedObject/structtypereflection.js
index 35dc27bfd473..44b450500cba 100644
--- a/js/src/tests/ecma_6/TypedObject/structtypereflection.js
+++ b/js/src/tests/ecma_6/TypedObject/structtypereflection.js
@@ -20,14 +20,15 @@ function runTests() {
     var S = new StructType({x: int32, y: uint8, z: float64});
     assertEq(S.__proto__, StructType.prototype);
     assertEq(S.prototype.__proto__, StructType.prototype.prototype);
-    assertEq(S.toSource(), "StructType({x: int32, y: uint8, z: float64})");
+    assertEq(S.toSource(), "new StructType({x: int32, y: uint8, z: float64})");
     assertEq(S.variable, false);
     assertEq(S.byteLength, 16);
     assertEq(S.byteAlignment, 8);
-    assertEq(S.fieldNames[0], "x");
-    assertEq(S.fieldNames[1], "y");
-    assertEq(S.fieldNames[2], "z");
-    assertEq(S.fieldNames.length, 3);
+    var fieldNames = Object.getOwnPropertyNames(S.fieldTypes);
+    assertEq(fieldNames[0], "x");
+    assertEq(fieldNames[1], "y");
+    assertEq(fieldNames[2], "z");
+    assertEq(fieldNames.length, 3);
     assertEq(S.fieldTypes.x, int32);
     assertEq(S.fieldTypes.y, uint8);
     assertEq(S.fieldTypes.z, float64);
@@ -35,6 +36,10 @@ function runTests() {
     assertEq(S.fieldOffsets.y, 4);
     assertEq(S.fieldOffsets.z, 8);
 
+    // fieldTypes and fieldOffsets should be frozen
+    assertEq(Object.isFrozen(S.fieldTypes), true);
+    assertEq(Object.isFrozen(S.fieldOffsets), true);
+
     if (typeof reportCompare === "function")
         reportCompare(true, true);
     print("Tests complete");
diff --git a/js/src/tests/ecma_6/TypedObject/unsizedarrays.js b/js/src/tests/ecma_6/TypedObject/unsizedarrays.js
index c2ccd1b0b296..37ed47d57efa 100644
--- a/js/src/tests/ecma_6/TypedObject/unsizedarrays.js
+++ b/js/src/tests/ecma_6/TypedObject/unsizedarrays.js
@@ -14,6 +14,7 @@ function runTests() {
   print(BUGNUMBER + ": " + summary);
 
   (function SimpleArrayOfTwoObjects() {
+    print("SimpleArrayOfTwoObjects");
     var Objects = new ArrayType(ObjectType);
     var objects2 = new Objects(2, [{f: "Hello"},
                                    {f: "World"}]);
@@ -23,12 +24,14 @@ function runTests() {
   })();
 
   (function EmbedUnsizedArraysBad() {
+    print("EmbedUnsizedArraysBad");
     var Objects = new ArrayType(ObjectType);
     assertThrows(() => new ArrayType(Objects));
     assertThrows(() => new StructType({f: Objects}));
   })();
 
   (function MultipleSizes() {
+    print("MultipleSizes");
     var Uints = new ArrayType(uint32);
     var Point = new StructType({values: new ArrayType(uint32).dimension(3)});
 
diff --git a/js/src/vm/CommonPropertyNames.h b/js/src/vm/CommonPropertyNames.h
index 01f5e6850a36..dedb37664e05 100644
--- a/js/src/vm/CommonPropertyNames.h
+++ b/js/src/vm/CommonPropertyNames.h
@@ -46,6 +46,7 @@
     macro(DateTimeFormatFormatGet, DateTimeFormatFormatGet, "Intl_DateTimeFormat_format_get") \
     macro(decodeURI, decodeURI, "decodeURI") \
     macro(decodeURIComponent, decodeURIComponent, "decodeURIComponent") \
+    macro(DescrToSource, DescrToSource, "DescrToSource") \
     macro(default_, default_, "default") \
     macro(defineProperty, defineProperty, "defineProperty") \
     macro(defineGetter, defineGetter, "__defineGetter__") \
@@ -64,7 +65,6 @@
     macro(escape, escape, "escape") \
     macro(eval, eval, "eval") \
     macro(false, false_, "false") \
-    macro(fieldNames, fieldNames, "fieldNames") \
     macro(fieldOffsets, fieldOffsets, "fieldOffsets") \
     macro(fieldTypes, fieldTypes, "fieldTypes") \
     macro(fileName, fileName, "fileName") \
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index 7072550097f9..014709504bf3 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -521,9 +521,11 @@ Debugger::slowPathOnEnterFrame(JSContext *cx, AbstractFramePtr frame, MutableHan
     if (GlobalObject::DebuggerVector *debuggers = global->getDebuggers()) {
         for (Debugger **p = debuggers->begin(); p != debuggers->end(); p++) {
             Debugger *dbg = *p;
-            JS_ASSERT(dbg->observesFrame(frame));
-            if (dbg->observesEnterFrame() && !triggered.append(ObjectValue(*dbg->toJSObject())))
+            if (dbg->observesFrame(frame) && dbg->observesEnterFrame() &&
+                !triggered.append(ObjectValue(*dbg->toJSObject())))
+            {
                 return JSTRAP_ERROR;
+            }
         }
     }
 
@@ -1097,13 +1099,14 @@ Debugger::dispatchHook(JSContext *cx, MutableHandleValue vp, Hook which)
 }
 
 static bool
-AddNewScriptRecipients(GlobalObject::DebuggerVector *src, AutoValueVector *dest)
+AddNewScriptRecipients(GlobalObject::DebuggerVector *src, HandleScript script,
+                       AutoValueVector *dest)
 {
     bool wasEmpty = dest->length() == 0;
     for (Debugger **p = src->begin(); p != src->end(); p++) {
         Debugger *dbg = *p;
         Value v = ObjectValue(*dbg->toJSObject());
-        if (dbg->observesNewScript() &&
+        if (dbg->observesScript(script) && dbg->observesNewScript() &&
             (wasEmpty || Find(dest->begin(), dest->end(), v) == dest->end()) &&
             !dest->append(v))
         {
@@ -1116,9 +1119,6 @@ AddNewScriptRecipients(GlobalObject::DebuggerVector *src, AutoValueVector *dest)
 void
 Debugger::slowPathOnNewScript(JSContext *cx, HandleScript script, GlobalObject *compileAndGoGlobal_)
 {
-    if (script->selfHosted())
-        return;
-
     Rooted<GlobalObject*> compileAndGoGlobal(cx, compileAndGoGlobal_);
 
     JS_ASSERT(script->compileAndGo() == !!compileAndGoGlobal);
@@ -1132,13 +1132,13 @@ Debugger::slowPathOnNewScript(JSContext *cx, HandleScript script, GlobalObject *
     AutoValueVector triggered(cx);
     if (script->compileAndGo()) {
         if (GlobalObject::DebuggerVector *debuggers = compileAndGoGlobal->getDebuggers()) {
-            if (!AddNewScriptRecipients(debuggers, &triggered))
+            if (!AddNewScriptRecipients(debuggers, script, &triggered))
                 return;
         }
     } else {
         GlobalObjectSet &debuggees = script->compartment()->getDebuggees();
         for (GlobalObjectSet::Range r = debuggees.all(); !r.empty(); r.popFront()) {
-            if (!AddNewScriptRecipients(r.front()->getDebuggers(), &triggered))
+            if (!AddNewScriptRecipients(r.front()->getDebuggers(), script, &triggered))
                 return;
         }
     }
@@ -3513,7 +3513,7 @@ DebuggerScript_getLineOffsets(JSContext *cx, unsigned argc, Value *vp)
 bool
 Debugger::observesFrame(AbstractFramePtr frame) const
 {
-    return observesGlobal(&frame.script()->global());
+    return observesScript(frame.script());
 }
 
 bool
@@ -3521,7 +3521,8 @@ Debugger::observesScript(JSScript *script) const
 {
     if (!enabled)
         return false;
-    return observesGlobal(&script->global()) && !script->selfHosted();
+    return observesGlobal(&script->global()) && (!script->selfHosted() ||
+                                                 SelfHostedFramesVisible());
 }
 
 /* static */ bool
diff --git a/js/src/vm/Stack.cpp b/js/src/vm/Stack.cpp
index 3871c9c400ba..7270db93c85a 100644
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -1222,10 +1222,17 @@ ScriptFrameIter::frameSlotValue(size_t index) const
 #endif
 
 #ifdef DEBUG
-/* static */
-bool NonBuiltinScriptFrameIter::includeSelfhostedFrames() {
-    static char* env = getenv("MOZ_SHOW_ALL_JS_FRAMES");
-    return (bool)env;
+bool
+js::SelfHostedFramesVisible()
+{
+    static bool checked = false;
+    static bool visible = false;
+    if (!checked) {
+        checked = true;
+        char *env = getenv("MOZ_SHOW_ALL_JS_FRAMES");
+        visible = !!env;
+    }
+    return visible;
 }
 #endif
 
diff --git a/js/src/vm/Stack.h b/js/src/vm/Stack.h
index 8bff39b19dad..aa2f6596c9d2 100644
--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@@ -1592,21 +1592,24 @@ class ScriptFrameIter
     inline void ionForEachCanonicalActualArg(JSContext *cx, Op op);
 };
 
+#ifdef DEBUG
+bool SelfHostedFramesVisible();
+#else
+static inline bool
+SelfHostedFramesVisible()
+{
+    return false;
+}
+#endif
+
 /* A filtering of the ScriptFrameIter to only stop at non-self-hosted scripts. */
 class NonBuiltinScriptFrameIter : public ScriptFrameIter
 {
-#ifdef DEBUG
-    static bool includeSelfhostedFrames();
-#else
-    static bool includeSelfhostedFrames() {
-        return false;
-    }
-#endif
-
     void settle() {
-        if (!includeSelfhostedFrames())
+        if (!SelfHostedFramesVisible()) {
             while (!done() && script()->selfHosted())
                 ScriptFrameIter::operator++();
+        }
     }
 
   public:
diff --git a/js/src/vm/StructuredClone.cpp b/js/src/vm/StructuredClone.cpp
index 09b957a786a3..8b7a627c1fcb 100644
--- a/js/src/vm/StructuredClone.cpp
+++ b/js/src/vm/StructuredClone.cpp
@@ -73,16 +73,16 @@ enum StructuredDataType {
     SCTAG_DO_NOT_USE_2,
     SCTAG_TYPED_ARRAY_OBJECT,
     SCTAG_TYPED_ARRAY_V1_MIN = 0xFFFF0100,
-    SCTAG_TYPED_ARRAY_V1_INT8 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeRepresentation::TYPE_INT8,
-    SCTAG_TYPED_ARRAY_V1_UINT8 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeRepresentation::TYPE_UINT8,
-    SCTAG_TYPED_ARRAY_V1_INT16 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeRepresentation::TYPE_INT16,
-    SCTAG_TYPED_ARRAY_V1_UINT16 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeRepresentation::TYPE_UINT16,
-    SCTAG_TYPED_ARRAY_V1_INT32 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeRepresentation::TYPE_INT32,
-    SCTAG_TYPED_ARRAY_V1_UINT32 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeRepresentation::TYPE_UINT32,
-    SCTAG_TYPED_ARRAY_V1_FLOAT32 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeRepresentation::TYPE_FLOAT32,
-    SCTAG_TYPED_ARRAY_V1_FLOAT64 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeRepresentation::TYPE_FLOAT64,
-    SCTAG_TYPED_ARRAY_V1_UINT8_CLAMPED = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeRepresentation::TYPE_UINT8_CLAMPED,
-    SCTAG_TYPED_ARRAY_V1_MAX = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeRepresentation::TYPE_MAX - 1,
+    SCTAG_TYPED_ARRAY_V1_INT8 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeDescr::TYPE_INT8,
+    SCTAG_TYPED_ARRAY_V1_UINT8 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeDescr::TYPE_UINT8,
+    SCTAG_TYPED_ARRAY_V1_INT16 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeDescr::TYPE_INT16,
+    SCTAG_TYPED_ARRAY_V1_UINT16 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeDescr::TYPE_UINT16,
+    SCTAG_TYPED_ARRAY_V1_INT32 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeDescr::TYPE_INT32,
+    SCTAG_TYPED_ARRAY_V1_UINT32 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeDescr::TYPE_UINT32,
+    SCTAG_TYPED_ARRAY_V1_FLOAT32 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeDescr::TYPE_FLOAT32,
+    SCTAG_TYPED_ARRAY_V1_FLOAT64 = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeDescr::TYPE_FLOAT64,
+    SCTAG_TYPED_ARRAY_V1_UINT8_CLAMPED = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeDescr::TYPE_UINT8_CLAMPED,
+    SCTAG_TYPED_ARRAY_V1_MAX = SCTAG_TYPED_ARRAY_V1_MIN + ScalarTypeDescr::TYPE_MAX - 1,
 
     /*
      * Define a separate range of numbers for Transferable-only tags, since
@@ -308,7 +308,7 @@ js_GetSCOffset(JSStructuredCloneWriter* writer)
 
 JS_STATIC_ASSERT(SCTAG_END_OF_BUILTIN_TYPES <= JS_SCTAG_USER_MIN);
 JS_STATIC_ASSERT(JS_SCTAG_USER_MIN <= JS_SCTAG_USER_MAX);
-JS_STATIC_ASSERT(ScalarTypeRepresentation::TYPE_INT8 == 0);
+JS_STATIC_ASSERT(ScalarTypeDescr::TYPE_INT8 == 0);
 
 namespace js {
 
@@ -1125,7 +1125,7 @@ bool
 JSStructuredCloneReader::readTypedArray(uint32_t arrayType, uint32_t nelems, Value *vp,
                                         bool v1Read)
 {
-    if (arrayType > ScalarTypeRepresentation::TYPE_UINT8_CLAMPED) {
+    if (arrayType > ScalarTypeDescr::TYPE_UINT8_CLAMPED) {
         JS_ReportErrorNumber(context(), js_GetErrorMessage, nullptr,
                              JSMSG_SC_BAD_SERIALIZED_DATA, "unhandled typed array element type");
         return false;
@@ -1156,31 +1156,31 @@ JSStructuredCloneReader::readTypedArray(uint32_t arrayType, uint32_t nelems, Val
     RootedObject obj(context(), nullptr);
 
     switch (arrayType) {
-      case ScalarTypeRepresentation::TYPE_INT8:
+      case ScalarTypeDescr::TYPE_INT8:
         obj = JS_NewInt8ArrayWithBuffer(context(), buffer, byteOffset, nelems);
         break;
-      case ScalarTypeRepresentation::TYPE_UINT8:
+      case ScalarTypeDescr::TYPE_UINT8:
         obj = JS_NewUint8ArrayWithBuffer(context(), buffer, byteOffset, nelems);
         break;
-      case ScalarTypeRepresentation::TYPE_INT16:
+      case ScalarTypeDescr::TYPE_INT16:
         obj = JS_NewInt16ArrayWithBuffer(context(), buffer, byteOffset, nelems);
         break;
-      case ScalarTypeRepresentation::TYPE_UINT16:
+      case ScalarTypeDescr::TYPE_UINT16:
         obj = JS_NewUint16ArrayWithBuffer(context(), buffer, byteOffset, nelems);
         break;
-      case ScalarTypeRepresentation::TYPE_INT32:
+      case ScalarTypeDescr::TYPE_INT32:
         obj = JS_NewInt32ArrayWithBuffer(context(), buffer, byteOffset, nelems);
         break;
-      case ScalarTypeRepresentation::TYPE_UINT32:
+      case ScalarTypeDescr::TYPE_UINT32:
         obj = JS_NewUint32ArrayWithBuffer(context(), buffer, byteOffset, nelems);
         break;
-      case ScalarTypeRepresentation::TYPE_FLOAT32:
+      case ScalarTypeDescr::TYPE_FLOAT32:
         obj = JS_NewFloat32ArrayWithBuffer(context(), buffer, byteOffset, nelems);
         break;
-      case ScalarTypeRepresentation::TYPE_FLOAT64:
+      case ScalarTypeDescr::TYPE_FLOAT64:
         obj = JS_NewFloat64ArrayWithBuffer(context(), buffer, byteOffset, nelems);
         break;
-      case ScalarTypeRepresentation::TYPE_UINT8_CLAMPED:
+      case ScalarTypeDescr::TYPE_UINT8_CLAMPED:
         obj = JS_NewUint8ClampedArrayWithBuffer(context(), buffer, byteOffset, nelems);
         break;
       default:
@@ -1212,18 +1212,18 @@ static size_t
 bytesPerTypedArrayElement(uint32_t arrayType)
 {
     switch (arrayType) {
-      case ScalarTypeRepresentation::TYPE_INT8:
-      case ScalarTypeRepresentation::TYPE_UINT8:
-      case ScalarTypeRepresentation::TYPE_UINT8_CLAMPED:
+      case ScalarTypeDescr::TYPE_INT8:
+      case ScalarTypeDescr::TYPE_UINT8:
+      case ScalarTypeDescr::TYPE_UINT8_CLAMPED:
         return sizeof(uint8_t);
-      case ScalarTypeRepresentation::TYPE_INT16:
-      case ScalarTypeRepresentation::TYPE_UINT16:
+      case ScalarTypeDescr::TYPE_INT16:
+      case ScalarTypeDescr::TYPE_UINT16:
         return sizeof(uint16_t);
-      case ScalarTypeRepresentation::TYPE_INT32:
-      case ScalarTypeRepresentation::TYPE_UINT32:
-      case ScalarTypeRepresentation::TYPE_FLOAT32:
+      case ScalarTypeDescr::TYPE_INT32:
+      case ScalarTypeDescr::TYPE_UINT32:
+      case ScalarTypeDescr::TYPE_FLOAT32:
         return sizeof(uint32_t);
-      case ScalarTypeRepresentation::TYPE_FLOAT64:
+      case ScalarTypeDescr::TYPE_FLOAT64:
         return sizeof(uint64_t);
       default:
         MOZ_ASSUME_UNREACHABLE("unknown TypedArrayObject type");
@@ -1237,7 +1237,7 @@ bytesPerTypedArrayElement(uint32_t arrayType)
 bool
 JSStructuredCloneReader::readV1ArrayBuffer(uint32_t arrayType, uint32_t nelems, Value *vp)
 {
-    JS_ASSERT(arrayType <= ScalarTypeRepresentation::TYPE_UINT8_CLAMPED);
+    JS_ASSERT(arrayType <= ScalarTypeDescr::TYPE_UINT8_CLAMPED);
 
     uint32_t nbytes = nelems * bytesPerTypedArrayElement(arrayType);
     JSObject *obj = ArrayBufferObject::create(context(), nbytes);
@@ -1248,18 +1248,18 @@ JSStructuredCloneReader::readV1ArrayBuffer(uint32_t arrayType, uint32_t nelems,
     JS_ASSERT(buffer.byteLength() == nbytes);
 
     switch (arrayType) {
-      case ScalarTypeRepresentation::TYPE_INT8:
-      case ScalarTypeRepresentation::TYPE_UINT8:
-      case ScalarTypeRepresentation::TYPE_UINT8_CLAMPED:
+      case ScalarTypeDescr::TYPE_INT8:
+      case ScalarTypeDescr::TYPE_UINT8:
+      case ScalarTypeDescr::TYPE_UINT8_CLAMPED:
         return in.readArray((uint8_t*) buffer.dataPointer(), nelems);
-      case ScalarTypeRepresentation::TYPE_INT16:
-      case ScalarTypeRepresentation::TYPE_UINT16:
+      case ScalarTypeDescr::TYPE_INT16:
+      case ScalarTypeDescr::TYPE_UINT16:
         return in.readArray((uint16_t*) buffer.dataPointer(), nelems);
-      case ScalarTypeRepresentation::TYPE_INT32:
-      case ScalarTypeRepresentation::TYPE_UINT32:
-      case ScalarTypeRepresentation::TYPE_FLOAT32:
+      case ScalarTypeDescr::TYPE_INT32:
+      case ScalarTypeDescr::TYPE_UINT32:
+      case ScalarTypeDescr::TYPE_FLOAT32:
         return in.readArray((uint32_t*) buffer.dataPointer(), nelems);
-      case ScalarTypeRepresentation::TYPE_FLOAT64:
+      case ScalarTypeDescr::TYPE_FLOAT64:
         return in.readArray((uint64_t*) buffer.dataPointer(), nelems);
       default:
         MOZ_ASSUME_UNREACHABLE("unknown TypedArrayObject type");
diff --git a/js/src/vm/TypedArrayObject.cpp b/js/src/vm/TypedArrayObject.cpp
index b0801315d458..ae36dc073c7e 100644
--- a/js/src/vm/TypedArrayObject.cpp
+++ b/js/src/vm/TypedArrayObject.cpp
@@ -1397,15 +1397,15 @@ ArrayBufferViewObject::trace(JSTracer *trc, JSObject *obj)
 }
 
 template<typename NativeType> static inline const int TypeIDOfType();
-template<> inline const int TypeIDOfType<int8_t>() { return ScalarTypeRepresentation::TYPE_INT8; }
-template<> inline const int TypeIDOfType<uint8_t>() { return ScalarTypeRepresentation::TYPE_UINT8; }
-template<> inline const int TypeIDOfType<int16_t>() { return ScalarTypeRepresentation::TYPE_INT16; }
-template<> inline const int TypeIDOfType<uint16_t>() { return ScalarTypeRepresentation::TYPE_UINT16; }
-template<> inline const int TypeIDOfType<int32_t>() { return ScalarTypeRepresentation::TYPE_INT32; }
-template<> inline const int TypeIDOfType<uint32_t>() { return ScalarTypeRepresentation::TYPE_UINT32; }
-template<> inline const int TypeIDOfType<float>() { return ScalarTypeRepresentation::TYPE_FLOAT32; }
-template<> inline const int TypeIDOfType<double>() { return ScalarTypeRepresentation::TYPE_FLOAT64; }
-template<> inline const int TypeIDOfType<uint8_clamped>() { return ScalarTypeRepresentation::TYPE_UINT8_CLAMPED; }
+template<> inline const int TypeIDOfType<int8_t>() { return ScalarTypeDescr::TYPE_INT8; }
+template<> inline const int TypeIDOfType<uint8_t>() { return ScalarTypeDescr::TYPE_UINT8; }
+template<> inline const int TypeIDOfType<int16_t>() { return ScalarTypeDescr::TYPE_INT16; }
+template<> inline const int TypeIDOfType<uint16_t>() { return ScalarTypeDescr::TYPE_UINT16; }
+template<> inline const int TypeIDOfType<int32_t>() { return ScalarTypeDescr::TYPE_INT32; }
+template<> inline const int TypeIDOfType<uint32_t>() { return ScalarTypeDescr::TYPE_UINT32; }
+template<> inline const int TypeIDOfType<float>() { return ScalarTypeDescr::TYPE_FLOAT32; }
+template<> inline const int TypeIDOfType<double>() { return ScalarTypeDescr::TYPE_FLOAT64; }
+template<> inline const int TypeIDOfType<uint8_clamped>() { return ScalarTypeDescr::TYPE_UINT8_CLAMPED; }
 
 template<typename ElementType>
 static inline JSObject *
@@ -1542,7 +1542,7 @@ class TypedArrayObjectTemplate : public TypedArrayObject
             JS_ASSERT(sizeof(NativeType) <= 4);
             uint32_t n = ToUint32(d);
             setIndex(tarray, index, NativeType(n));
-        } else if (ArrayTypeID() == ScalarTypeRepresentation::TYPE_UINT8_CLAMPED) {
+        } else if (ArrayTypeID() == ScalarTypeDescr::TYPE_UINT8_CLAMPED) {
             // The uint8_clamped type has a special rounding converter
             // for doubles.
             setIndex(tarray, index, NativeType(d));
@@ -2403,50 +2403,50 @@ class TypedArrayObjectTemplate : public TypedArrayObject
 
         unsigned srclen = tarray->length();
         switch (tarray->type()) {
-          case ScalarTypeRepresentation::TYPE_INT8: {
+          case ScalarTypeDescr::TYPE_INT8: {
             int8_t *src = static_cast<int8_t*>(tarray->viewData());
             for (unsigned i = 0; i < srclen; ++i)
                 *dest++ = NativeType(*src++);
             break;
           }
-          case ScalarTypeRepresentation::TYPE_UINT8:
-          case ScalarTypeRepresentation::TYPE_UINT8_CLAMPED: {
+          case ScalarTypeDescr::TYPE_UINT8:
+          case ScalarTypeDescr::TYPE_UINT8_CLAMPED: {
             uint8_t *src = static_cast<uint8_t*>(tarray->viewData());
             for (unsigned i = 0; i < srclen; ++i)
                 *dest++ = NativeType(*src++);
             break;
           }
-          case ScalarTypeRepresentation::TYPE_INT16: {
+          case ScalarTypeDescr::TYPE_INT16: {
             int16_t *src = static_cast<int16_t*>(tarray->viewData());
             for (unsigned i = 0; i < srclen; ++i)
                 *dest++ = NativeType(*src++);
             break;
           }
-          case ScalarTypeRepresentation::TYPE_UINT16: {
+          case ScalarTypeDescr::TYPE_UINT16: {
             uint16_t *src = static_cast<uint16_t*>(tarray->viewData());
             for (unsigned i = 0; i < srclen; ++i)
                 *dest++ = NativeType(*src++);
             break;
           }
-          case ScalarTypeRepresentation::TYPE_INT32: {
+          case ScalarTypeDescr::TYPE_INT32: {
             int32_t *src = static_cast<int32_t*>(tarray->viewData());
             for (unsigned i = 0; i < srclen; ++i)
                 *dest++ = NativeType(*src++);
             break;
           }
-          case ScalarTypeRepresentation::TYPE_UINT32: {
+          case ScalarTypeDescr::TYPE_UINT32: {
             uint32_t *src = static_cast<uint32_t*>(tarray->viewData());
             for (unsigned i = 0; i < srclen; ++i)
                 *dest++ = NativeType(*src++);
             break;
           }
-          case ScalarTypeRepresentation::TYPE_FLOAT32: {
+          case ScalarTypeDescr::TYPE_FLOAT32: {
             float *src = static_cast<float*>(tarray->viewData());
             for (unsigned i = 0; i < srclen; ++i)
                 *dest++ = NativeType(*src++);
             break;
           }
-          case ScalarTypeRepresentation::TYPE_FLOAT64: {
+          case ScalarTypeDescr::TYPE_FLOAT64: {
             double *src = static_cast<double*>(tarray->viewData());
             for (unsigned i = 0; i < srclen; ++i)
                 *dest++ = NativeType(*src++);
@@ -2483,50 +2483,50 @@ class TypedArrayObjectTemplate : public TypedArrayObject
         js_memcpy(srcbuf, tarray->viewData(), byteLength);
 
         switch (tarray->type()) {
-          case ScalarTypeRepresentation::TYPE_INT8: {
+          case ScalarTypeDescr::TYPE_INT8: {
             int8_t *src = (int8_t*) srcbuf;
             for (unsigned i = 0; i < tarray->length(); ++i)
                 *dest++ = NativeType(*src++);
             break;
           }
-          case ScalarTypeRepresentation::TYPE_UINT8:
-          case ScalarTypeRepresentation::TYPE_UINT8_CLAMPED: {
+          case ScalarTypeDescr::TYPE_UINT8:
+          case ScalarTypeDescr::TYPE_UINT8_CLAMPED: {
             uint8_t *src = (uint8_t*) srcbuf;
             for (unsigned i = 0; i < tarray->length(); ++i)
                 *dest++ = NativeType(*src++);
             break;
           }
-          case ScalarTypeRepresentation::TYPE_INT16: {
+          case ScalarTypeDescr::TYPE_INT16: {
             int16_t *src = (int16_t*) srcbuf;
             for (unsigned i = 0; i < tarray->length(); ++i)
                 *dest++ = NativeType(*src++);
             break;
           }
-          case ScalarTypeRepresentation::TYPE_UINT16: {
+          case ScalarTypeDescr::TYPE_UINT16: {
             uint16_t *src = (uint16_t*) srcbuf;
             for (unsigned i = 0; i < tarray->length(); ++i)
                 *dest++ = NativeType(*src++);
             break;
           }
-          case ScalarTypeRepresentation::TYPE_INT32: {
+          case ScalarTypeDescr::TYPE_INT32: {
             int32_t *src = (int32_t*) srcbuf;
             for (unsigned i = 0; i < tarray->length(); ++i)
                 *dest++ = NativeType(*src++);
             break;
           }
-          case ScalarTypeRepresentation::TYPE_UINT32: {
+          case ScalarTypeDescr::TYPE_UINT32: {
             uint32_t *src = (uint32_t*) srcbuf;
             for (unsigned i = 0; i < tarray->length(); ++i)
                 *dest++ = NativeType(*src++);
             break;
           }
-          case ScalarTypeRepresentation::TYPE_FLOAT32: {
+          case ScalarTypeDescr::TYPE_FLOAT32: {
             float *src = (float*) srcbuf;
             for (unsigned i = 0; i < tarray->length(); ++i)
                 *dest++ = NativeType(*src++);
             break;
           }
-          case ScalarTypeRepresentation::TYPE_FLOAT64: {
+          case ScalarTypeDescr::TYPE_FLOAT64: {
             double *src = (double*) srcbuf;
             for (unsigned i = 0; i < tarray->length(); ++i)
                 *dest++ = NativeType(*src++);
@@ -2557,55 +2557,55 @@ class TypedArrayObjectTemplate : public TypedArrayObject
 
 class Int8ArrayObject : public TypedArrayObjectTemplate<int8_t> {
   public:
-    enum { ACTUAL_TYPE = ScalarTypeRepresentation::TYPE_INT8 };
+    enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_INT8 };
     static const JSProtoKey key = JSProto_Int8Array;
     static const JSFunctionSpec jsfuncs[];
 };
 class Uint8ArrayObject : public TypedArrayObjectTemplate<uint8_t> {
   public:
-    enum { ACTUAL_TYPE = ScalarTypeRepresentation::TYPE_UINT8 };
+    enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_UINT8 };
     static const JSProtoKey key = JSProto_Uint8Array;
     static const JSFunctionSpec jsfuncs[];
 };
 class Int16ArrayObject : public TypedArrayObjectTemplate<int16_t> {
   public:
-    enum { ACTUAL_TYPE = ScalarTypeRepresentation::TYPE_INT16 };
+    enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_INT16 };
     static const JSProtoKey key = JSProto_Int16Array;
     static const JSFunctionSpec jsfuncs[];
 };
 class Uint16ArrayObject : public TypedArrayObjectTemplate<uint16_t> {
   public:
-    enum { ACTUAL_TYPE = ScalarTypeRepresentation::TYPE_UINT16 };
+    enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_UINT16 };
     static const JSProtoKey key = JSProto_Uint16Array;
     static const JSFunctionSpec jsfuncs[];
 };
 class Int32ArrayObject : public TypedArrayObjectTemplate<int32_t> {
   public:
-    enum { ACTUAL_TYPE = ScalarTypeRepresentation::TYPE_INT32 };
+    enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_INT32 };
     static const JSProtoKey key = JSProto_Int32Array;
     static const JSFunctionSpec jsfuncs[];
 };
 class Uint32ArrayObject : public TypedArrayObjectTemplate<uint32_t> {
   public:
-    enum { ACTUAL_TYPE = ScalarTypeRepresentation::TYPE_UINT32 };
+    enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_UINT32 };
     static const JSProtoKey key = JSProto_Uint32Array;
     static const JSFunctionSpec jsfuncs[];
 };
 class Float32ArrayObject : public TypedArrayObjectTemplate<float> {
   public:
-    enum { ACTUAL_TYPE = ScalarTypeRepresentation::TYPE_FLOAT32 };
+    enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_FLOAT32 };
     static const JSProtoKey key = JSProto_Float32Array;
     static const JSFunctionSpec jsfuncs[];
 };
 class Float64ArrayObject : public TypedArrayObjectTemplate<double> {
   public:
-    enum { ACTUAL_TYPE = ScalarTypeRepresentation::TYPE_FLOAT64 };
+    enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_FLOAT64 };
     static const JSProtoKey key = JSProto_Float64Array;
     static const JSFunctionSpec jsfuncs[];
 };
 class Uint8ClampedArrayObject : public TypedArrayObjectTemplate<uint8_clamped> {
   public:
-    enum { ACTUAL_TYPE = ScalarTypeRepresentation::TYPE_UINT8_CLAMPED };
+    enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_UINT8_CLAMPED };
     static const JSProtoKey key = JSProto_Uint8ClampedArray;
     static const JSFunctionSpec jsfuncs[];
 };
@@ -3391,31 +3391,31 @@ TypedArrayObject::copyTypedArrayElement(uint32_t index, MutableHandleValue vp)
     JS_ASSERT(index < length());
 
     switch (type()) {
-      case ScalarTypeRepresentation::TYPE_INT8:
+      case ScalarTypeDescr::TYPE_INT8:
         TypedArrayObjectTemplate<int8_t>::copyIndexToValue(this, index, vp);
         break;
-      case ScalarTypeRepresentation::TYPE_UINT8:
+      case ScalarTypeDescr::TYPE_UINT8:
         TypedArrayObjectTemplate<uint8_t>::copyIndexToValue(this, index, vp);
         break;
-      case ScalarTypeRepresentation::TYPE_UINT8_CLAMPED:
+      case ScalarTypeDescr::TYPE_UINT8_CLAMPED:
         TypedArrayObjectTemplate<uint8_clamped>::copyIndexToValue(this, index, vp);
         break;
-      case ScalarTypeRepresentation::TYPE_INT16:
+      case ScalarTypeDescr::TYPE_INT16:
         TypedArrayObjectTemplate<int16_t>::copyIndexToValue(this, index, vp);
         break;
-      case ScalarTypeRepresentation::TYPE_UINT16:
+      case ScalarTypeDescr::TYPE_UINT16:
         TypedArrayObjectTemplate<uint16_t>::copyIndexToValue(this, index, vp);
         break;
-      case ScalarTypeRepresentation::TYPE_INT32:
+      case ScalarTypeDescr::TYPE_INT32:
         TypedArrayObjectTemplate<int32_t>::copyIndexToValue(this, index, vp);
         break;
-      case ScalarTypeRepresentation::TYPE_UINT32:
+      case ScalarTypeDescr::TYPE_UINT32:
         TypedArrayObjectTemplate<uint32_t>::copyIndexToValue(this, index, vp);
         break;
-      case ScalarTypeRepresentation::TYPE_FLOAT32:
+      case ScalarTypeDescr::TYPE_FLOAT32:
         TypedArrayObjectTemplate<float>::copyIndexToValue(this, index, vp);
         break;
-      case ScalarTypeRepresentation::TYPE_FLOAT64:
+      case ScalarTypeDescr::TYPE_FLOAT64:
         TypedArrayObjectTemplate<double>::copyIndexToValue(this, index, vp);
         break;
       default:
@@ -3720,7 +3720,7 @@ IMPL_TYPED_ARRAY_STATICS(Float32Array);
 IMPL_TYPED_ARRAY_STATICS(Float64Array);
 IMPL_TYPED_ARRAY_STATICS(Uint8ClampedArray);
 
-const Class TypedArrayObject::classes[ScalarTypeRepresentation::TYPE_MAX] = {
+const Class TypedArrayObject::classes[ScalarTypeDescr::TYPE_MAX] = {
     IMPL_TYPED_ARRAY_FAST_CLASS(Int8Array),
     IMPL_TYPED_ARRAY_FAST_CLASS(Uint8Array),
     IMPL_TYPED_ARRAY_FAST_CLASS(Int16Array),
@@ -3732,7 +3732,7 @@ const Class TypedArrayObject::classes[ScalarTypeRepresentation::TYPE_MAX] = {
     IMPL_TYPED_ARRAY_FAST_CLASS(Uint8ClampedArray)
 };
 
-const Class TypedArrayObject::protoClasses[ScalarTypeRepresentation::TYPE_MAX] = {
+const Class TypedArrayObject::protoClasses[ScalarTypeDescr::TYPE_MAX] = {
     IMPL_TYPED_ARRAY_PROTO_CLASS(Int8Array),
     IMPL_TYPED_ARRAY_PROTO_CLASS(Uint8Array),
     IMPL_TYPED_ARRAY_PROTO_CLASS(Int16Array),
@@ -3978,23 +3978,23 @@ bool
 js::IsTypedArrayConstructor(HandleValue v, uint32_t type)
 {
     switch (type) {
-      case ScalarTypeRepresentation::TYPE_INT8:
+      case ScalarTypeDescr::TYPE_INT8:
         return IsNativeFunction(v, Int8ArrayObject::class_constructor);
-      case ScalarTypeRepresentation::TYPE_UINT8:
+      case ScalarTypeDescr::TYPE_UINT8:
         return IsNativeFunction(v, Uint8ArrayObject::class_constructor);
-      case ScalarTypeRepresentation::TYPE_INT16:
+      case ScalarTypeDescr::TYPE_INT16:
         return IsNativeFunction(v, Int16ArrayObject::class_constructor);
-      case ScalarTypeRepresentation::TYPE_UINT16:
+      case ScalarTypeDescr::TYPE_UINT16:
         return IsNativeFunction(v, Uint16ArrayObject::class_constructor);
-      case ScalarTypeRepresentation::TYPE_INT32:
+      case ScalarTypeDescr::TYPE_INT32:
         return IsNativeFunction(v, Int32ArrayObject::class_constructor);
-      case ScalarTypeRepresentation::TYPE_UINT32:
+      case ScalarTypeDescr::TYPE_UINT32:
         return IsNativeFunction(v, Uint32ArrayObject::class_constructor);
-      case ScalarTypeRepresentation::TYPE_FLOAT32:
+      case ScalarTypeDescr::TYPE_FLOAT32:
         return IsNativeFunction(v, Float32ArrayObject::class_constructor);
-      case ScalarTypeRepresentation::TYPE_FLOAT64:
+      case ScalarTypeDescr::TYPE_FLOAT64:
         return IsNativeFunction(v, Float64ArrayObject::class_constructor);
-      case ScalarTypeRepresentation::TYPE_UINT8_CLAMPED:
+      case ScalarTypeDescr::TYPE_UINT8_CLAMPED:
         return IsNativeFunction(v, Uint8ClampedArrayObject::class_constructor);
     }
     MOZ_ASSUME_UNREACHABLE("unexpected typed array type");
@@ -4088,9 +4088,10 @@ JS_NewArrayBufferWithContents(JSContext *cx, void *contents)
 }
 
 JS_PUBLIC_API(bool)
-JS_AllocateArrayBufferContents(JSContext *cx, uint32_t nbytes, void **contents, uint8_t **data)
+JS_AllocateArrayBufferContents(JSContext *maybecx, uint32_t nbytes,
+                               void **contents, uint8_t **data)
 {
-    js::ObjectElements *header = AllocateArrayBufferContents(cx, nbytes);
+    js::ObjectElements *header = AllocateArrayBufferContents(maybecx, nbytes);
     if (!header)
         return false;
 
diff --git a/js/src/vm/TypedArrayObject.h b/js/src/vm/TypedArrayObject.h
index 82909d1b5ae3..7ec12ce938b0 100644
--- a/js/src/vm/TypedArrayObject.h
+++ b/js/src/vm/TypedArrayObject.h
@@ -9,7 +9,7 @@
 
 #include "jsobj.h"
 
-#include "builtin/TypeRepresentation.h"
+#include "builtin/TypedObject.h"
 #include "gc/Barrier.h"
 #include "js/Class.h"
 
@@ -303,8 +303,8 @@ class TypedArrayObject : public ArrayBufferViewObject
     static const size_t DATA_SLOT      = 7; // private slot, based on alloc kind
 
   public:
-    static const Class classes[ScalarTypeRepresentation::TYPE_MAX];
-    static const Class protoClasses[ScalarTypeRepresentation::TYPE_MAX];
+    static const Class classes[ScalarTypeDescr::TYPE_MAX];
+    static const Class protoClasses[ScalarTypeDescr::TYPE_MAX];
 
     static bool obj_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id,
                                   MutableHandleObject objp, MutableHandleShape propp);
@@ -364,18 +364,18 @@ class TypedArrayObject : public ArrayBufferViewObject
 
     static uint32_t slotWidth(int atype) {
         switch (atype) {
-          case ScalarTypeRepresentation::TYPE_INT8:
-          case ScalarTypeRepresentation::TYPE_UINT8:
-          case ScalarTypeRepresentation::TYPE_UINT8_CLAMPED:
+          case ScalarTypeDescr::TYPE_INT8:
+          case ScalarTypeDescr::TYPE_UINT8:
+          case ScalarTypeDescr::TYPE_UINT8_CLAMPED:
             return 1;
-          case ScalarTypeRepresentation::TYPE_INT16:
-          case ScalarTypeRepresentation::TYPE_UINT16:
+          case ScalarTypeDescr::TYPE_INT16:
+          case ScalarTypeDescr::TYPE_UINT16:
             return 2;
-          case ScalarTypeRepresentation::TYPE_INT32:
-          case ScalarTypeRepresentation::TYPE_UINT32:
-          case ScalarTypeRepresentation::TYPE_FLOAT32:
+          case ScalarTypeDescr::TYPE_INT32:
+          case ScalarTypeDescr::TYPE_UINT32:
+          case ScalarTypeDescr::TYPE_FLOAT32:
             return 4;
-          case ScalarTypeRepresentation::TYPE_FLOAT64:
+          case ScalarTypeDescr::TYPE_FLOAT64:
             return 8;
           default:
             MOZ_ASSUME_UNREACHABLE("invalid typed array type");
@@ -400,14 +400,14 @@ inline bool
 IsTypedArrayClass(const Class *clasp)
 {
     return &TypedArrayObject::classes[0] <= clasp &&
-           clasp < &TypedArrayObject::classes[ScalarTypeRepresentation::TYPE_MAX];
+           clasp < &TypedArrayObject::classes[ScalarTypeDescr::TYPE_MAX];
 }
 
 inline bool
 IsTypedArrayProtoClass(const Class *clasp)
 {
     return &TypedArrayObject::protoClasses[0] <= clasp &&
-           clasp < &TypedArrayObject::protoClasses[ScalarTypeRepresentation::TYPE_MAX];
+           clasp < &TypedArrayObject::protoClasses[ScalarTypeDescr::TYPE_MAX];
 }
 
 bool
diff --git a/js/xpconnect/loader/mozJSComponentLoader.cpp b/js/xpconnect/loader/mozJSComponentLoader.cpp
index 5df8ad7f4f93..e954d4dbdc7d 100644
--- a/js/xpconnect/loader/mozJSComponentLoader.cpp
+++ b/js/xpconnect/loader/mozJSComponentLoader.cpp
@@ -13,12 +13,17 @@
 #include <cstdarg>
 
 #include "prlog.h"
+#ifdef ANDROID
+#include <android/log.h>
+#endif
+#ifdef XP_WIN
+#include <windows.h>
+#endif
 
 #include "jsapi.h"
 #include "nsCOMPtr.h"
 #include "nsAutoPtr.h"
 #include "nsIComponentManager.h"
-#include "mozilla/Debug.h"
 #include "mozilla/Module.h"
 #include "nsIFile.h"
 #include "mozJSComponentLoader.h"
@@ -113,9 +118,18 @@ Dump(JSContext *cx, unsigned argc, Value *vp)
     if (!chars)
         return false;
 
-    nsDependentSubstring ustr(reinterpret_cast<const char16_t*>(chars),
-                              length);
-    PrintToDebugger(ustr, stdout);
+    NS_ConvertUTF16toUTF8 utf8str(reinterpret_cast<const char16_t*>(chars),
+                                  length);
+#ifdef ANDROID
+    __android_log_print(ANDROID_LOG_INFO, "Gecko", "%s", utf8str.get());
+#endif
+#ifdef XP_WIN
+    if (IsDebuggerPresent()) {
+      OutputDebugStringW(reinterpret_cast<const wchar_t*>(chars));
+    }
+#endif
+    fputs(utf8str.get(), stdout);
+    fflush(stdout);
     return true;
 }
 
diff --git a/js/xpconnect/src/XPCShellImpl.cpp b/js/xpconnect/src/XPCShellImpl.cpp
index 839921b23920..285b424726a3 100644
--- a/js/xpconnect/src/XPCShellImpl.cpp
+++ b/js/xpconnect/src/XPCShellImpl.cpp
@@ -8,7 +8,6 @@
 #include "jsfriendapi.h"
 #include "jsprf.h"
 #include "js/OldDebugAPI.h"
-#include "mozilla/Debug.h"
 #include "nsServiceManagerUtils.h"
 #include "nsComponentManagerUtils.h"
 #include "nsIXPConnect.h"
@@ -33,6 +32,10 @@
 #include "nsIScriptSecurityManager.h"
 #include "nsIPrincipal.h"
 
+#ifdef ANDROID
+#include <android/log.h>
+#endif
+
 #ifdef XP_WIN
 #include <windows.h>
 #endif
@@ -297,9 +300,18 @@ Dump(JSContext *cx, unsigned argc, jsval *vp)
     if (!chars)
         return false;
 
-    nsDependentSubstring ustr(reinterpret_cast<const char16_t*>(chars),
-                              length);
-    PrintToDebugger(ustr, gOutFile);
+    NS_ConvertUTF16toUTF8 utf8str(reinterpret_cast<const char16_t*>(chars),
+                                  length);
+#ifdef ANDROID
+    __android_log_print(ANDROID_LOG_INFO, "Gecko", "%s", utf8str.get());
+#endif
+#ifdef XP_WIN
+    if (IsDebuggerPresent()) {
+      OutputDebugStringW(reinterpret_cast<const wchar_t*>(chars));
+    }
+#endif
+    fputs(utf8str.get(), gOutFile);
+    fflush(gOutFile);
     return true;
 }
 
diff --git a/js/xpconnect/src/XPCWrappedJS.cpp b/js/xpconnect/src/XPCWrappedJS.cpp
index 578c8928119d..898478cf3a62 100644
--- a/js/xpconnect/src/XPCWrappedJS.cpp
+++ b/js/xpconnect/src/XPCWrappedJS.cpp
@@ -334,8 +334,7 @@ nsXPCWrappedJS::GetNewOrUsed(JS::HandleObject jsObj,
         return NS_ERROR_FAILURE;
     }
 
-    nsRefPtr<nsXPCWrappedJSClass> clasp;
-    nsXPCWrappedJSClass::GetNewOrUsed(cx, aIID, getter_AddRefs(clasp));
+    nsRefPtr<nsXPCWrappedJSClass> clasp = nsXPCWrappedJSClass::GetNewOrUsed(cx, aIID);
     if (!clasp)
         return NS_ERROR_FAILURE;
 
@@ -355,9 +354,7 @@ nsXPCWrappedJS::GetNewOrUsed(JS::HandleObject jsObj,
         // Make a new root wrapper, because there is no existing
         // root wrapper, and the wrapper we are trying to make isn't
         // a root.
-        nsRefPtr<nsXPCWrappedJSClass> rootClasp;
-        nsXPCWrappedJSClass::GetNewOrUsed(cx, NS_GET_IID(nsISupports),
-                                          getter_AddRefs(rootClasp));
+        nsRefPtr<nsXPCWrappedJSClass> rootClasp = nsXPCWrappedJSClass::GetNewOrUsed(cx, NS_GET_IID(nsISupports));
         if (!rootClasp)
             return NS_ERROR_FAILURE;
 
diff --git a/js/xpconnect/src/XPCWrappedJSClass.cpp b/js/xpconnect/src/XPCWrappedJSClass.cpp
index 511050bde196..4677abd5f7e2 100644
--- a/js/xpconnect/src/XPCWrappedJSClass.cpp
+++ b/js/xpconnect/src/XPCWrappedJSClass.cpp
@@ -99,9 +99,8 @@ bool xpc_IsReportableErrorCode(nsresult code)
 }
 
 // static
-nsresult
-nsXPCWrappedJSClass::GetNewOrUsed(JSContext* cx, REFNSIID aIID,
-                                  nsXPCWrappedJSClass** resultClasp)
+already_AddRefed<nsXPCWrappedJSClass>
+nsXPCWrappedJSClass::GetNewOrUsed(JSContext* cx, REFNSIID aIID)
 {
     XPCJSRuntime* rt = nsXPConnect::GetRuntimeInstance();
     IID2WrappedJSClassMap* map = rt->GetWrappedJSClassMap();
@@ -122,8 +121,7 @@ nsXPCWrappedJSClass::GetNewOrUsed(JSContext* cx, REFNSIID aIID,
             }
         }
     }
-    clasp.forget(resultClasp);
-    return NS_OK;
+    return clasp.forget();
 }
 
 nsXPCWrappedJSClass::nsXPCWrappedJSClass(JSContext* cx, REFNSIID aIID,
diff --git a/js/xpconnect/src/XPCWrappedNative.cpp b/js/xpconnect/src/XPCWrappedNative.cpp
index 9d8eb27c173c..a4b79d927cf9 100644
--- a/js/xpconnect/src/XPCWrappedNative.cpp
+++ b/js/xpconnect/src/XPCWrappedNative.cpp
@@ -1525,17 +1525,16 @@ XPCWrappedNative::InitTearOff(XPCWrappedNativeTearOff* aTearOff,
         // when asked for nsIPropertyBag. It need not actually *implement*
         // nsIPropertyBag - xpconnect will do that work.
 
-        nsXPCWrappedJSClass* clazz;
-        if (iid->Equals(NS_GET_IID(nsIPropertyBag)) && jso &&
-            NS_SUCCEEDED(nsXPCWrappedJSClass::GetNewOrUsed(cx,*iid,&clazz))&&
-            clazz) {
-            RootedObject answer(cx,
-                                clazz->CallQueryInterfaceOnJSObject(cx, jso, *iid));
-            NS_RELEASE(clazz);
-            if (!answer) {
-                NS_RELEASE(obj);
-                aTearOff->SetInterface(nullptr);
-                return NS_ERROR_NO_INTERFACE;
+        if (iid->Equals(NS_GET_IID(nsIPropertyBag)) && jso) {
+            nsRefPtr<nsXPCWrappedJSClass> clasp = nsXPCWrappedJSClass::GetNewOrUsed(cx, *iid);
+            if (clasp) {
+                RootedObject answer(cx, clasp->CallQueryInterfaceOnJSObject(cx, jso, *iid));
+
+                if (!answer) {
+                    NS_RELEASE(obj);
+                    aTearOff->SetInterface(nullptr);
+                    return NS_ERROR_NO_INTERFACE;
+                }
             }
         }
     }
diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h
index 1159e5e6cf97..93486e06d14b 100644
--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -2300,10 +2300,9 @@ class nsXPCWrappedJSClass : public nsIXPCWrappedJSClass
     NS_IMETHOD DebugDump(int16_t depth);
 public:
 
-    static nsresult
+    static already_AddRefed<nsXPCWrappedJSClass>
     GetNewOrUsed(JSContext* cx,
-                 REFNSIID aIID,
-                 nsXPCWrappedJSClass** clazz);
+                 REFNSIID aIID);
 
     REFNSIID GetIID() const {return mIID;}
     XPCJSRuntime* GetRuntime() const {return mRuntime;}
diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index e5d88185f30d..cbb1ef5319e9 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -4971,7 +4971,7 @@ ComputeOutlineAndEffectsRect(nsIFrame* aFrame,
     // For SVG frames, we only need to account for filters.
     // TODO: We could also take account of clipPath and mask to reduce the
     // visual overflow, but that's not essential.
-    if (aFrame->StyleSVGReset()->SingleFilter()) {
+    if (aFrame->StyleSVGReset()->HasFilters()) {
       if (aStoreRectProperties) {
         aFrame->Properties().
           Set(nsIFrame::PreEffectsBBoxProperty(), new nsRect(r));
diff --git a/layout/generic/nsSelection.cpp b/layout/generic/nsSelection.cpp
index ceea64cdd8ee..0bed7a3b4b00 100644
--- a/layout/generic/nsSelection.cpp
+++ b/layout/generic/nsSelection.cpp
@@ -787,6 +787,7 @@ nsFrameSelection::MoveCaret(uint32_t          aKeycode,
         {
           const nsRange* anchorFocusRange = sel->GetAnchorFocusRange();
           if (anchorFocusRange) {
+            PostReason(nsISelectionListener::COLLAPSETOSTART_REASON);
             sel->Collapse(anchorFocusRange->GetStartParent(),
                           anchorFocusRange->StartOffset());
           }
@@ -802,6 +803,7 @@ nsFrameSelection::MoveCaret(uint32_t          aKeycode,
         {
           const nsRange* anchorFocusRange = sel->GetAnchorFocusRange();
           if (anchorFocusRange) {
+            PostReason(nsISelectionListener::COLLAPSETOEND_REASON);
             sel->Collapse(anchorFocusRange->GetEndParent(),
                           anchorFocusRange->EndOffset());
           }
diff --git a/layout/reftests/mathml/mo-accent-dynamic-ref.html b/layout/reftests/mathml/mo-accent-dynamic-ref.html
new file mode 100644
index 000000000000..2d3f5223af64
--- /dev/null
+++ b/layout/reftests/mathml/mo-accent-dynamic-ref.html
@@ -0,0 +1,12 @@
+<!doctype html>
+ <html>
+   <head>
+     <title>mo@accent</title>
+     <meta charset="utf-8"/>
+   </head>
+   <body>
+    <math>
+      <munderover><mtext>X</mtext><mo accent="true">O</mo><mo>O</mo></munderover>
+    </math>
+   </body>
+</html>
\ No newline at end of file
diff --git a/layout/reftests/mathml/mo-accent-dynamic.html b/layout/reftests/mathml/mo-accent-dynamic.html
new file mode 100644
index 000000000000..a0fee05b7662
--- /dev/null
+++ b/layout/reftests/mathml/mo-accent-dynamic.html
@@ -0,0 +1,18 @@
+<html class="reftest-wait">
+   <head>
+     <title>mo@accent</title>
+     <meta charset="utf-8"/>
+     <script type="text/javascript">
+       function doTest() {
+         document.getElementById('mathOperator').setAttribute('accent', 'true');
+         document.documentElement.removeAttribute("class");
+       }
+       window.addEventListener("MozReftestInvalidate",doTest, false);
+     </script>
+    </head>
+    <body>
+     <math>
+      <munderover><mtext>X</mtext><mo id="mathOperator">O</mo><mo>O</mo></munderover>
+     </math>
+    </body>
+</html>
\ No newline at end of file
diff --git a/layout/reftests/mathml/mo-movablelimits-dynamic-ref.html b/layout/reftests/mathml/mo-movablelimits-dynamic-ref.html
new file mode 100644
index 000000000000..15a341f52d3e
--- /dev/null
+++ b/layout/reftests/mathml/mo-movablelimits-dynamic-ref.html
@@ -0,0 +1,14 @@
+<html>
+   <head>
+     <title>mo@movablelimits</title>
+     <meta charset="utf-8"/>
+   </head>
+   <body>
+    <math>
+      <munder>
+          <mo>∑</mo>
+          <mi>x</mi>
+      </munder>
+    </math>
+   </body>
+ </html>
\ No newline at end of file
diff --git a/layout/reftests/mathml/mo-movablelimits-dynamic.html b/layout/reftests/mathml/mo-movablelimits-dynamic.html
new file mode 100644
index 000000000000..53e32a57888b
--- /dev/null
+++ b/layout/reftests/mathml/mo-movablelimits-dynamic.html
@@ -0,0 +1,21 @@
+<html class="reftest-wait">
+   <head>
+     <title>mo@movablelimits</title>
+     <meta charset="utf-8"/>
+     <script type="text/javascript">
+       function doTest() {
+         document.getElementById('a').removeAttribute('movablelimits');
+         document.documentElement.removeAttribute("class");
+       }
+       window.addEventListener("MozReftestInvalidate",doTest, false);
+     </script>
+    </head>
+    <body>
+    <math>
+      <munder>
+          <mo id="a" movablelimits="false">∑</mo>
+          <mi>x</mi>
+      </munder>
+    </math>
+    </body>
+</html>
\ No newline at end of file
diff --git a/layout/reftests/mathml/munderover-accent-dynamic-ref.html b/layout/reftests/mathml/munderover-accent-dynamic-ref.html
new file mode 100644
index 000000000000..67ae1b8b12c5
--- /dev/null
+++ b/layout/reftests/mathml/munderover-accent-dynamic-ref.html
@@ -0,0 +1,12 @@
+<!doctype html>
+ <html>
+   <head>
+     <title>munderover@accent</title>
+     <meta charset="utf-8"/>
+   </head>
+   <body>
+   	<math>
+      <munderover accent="true"><mtext>X</mtext><mo>O</mo><mo>O</mo></munderover>
+    </math>
+   </body>
+</html>
\ No newline at end of file
diff --git a/layout/reftests/mathml/munderover-accent-dynamic.html b/layout/reftests/mathml/munderover-accent-dynamic.html
new file mode 100644
index 000000000000..907eac8352d9
--- /dev/null
+++ b/layout/reftests/mathml/munderover-accent-dynamic.html
@@ -0,0 +1,18 @@
+<html class="reftest-wait">
+   <head>
+     <title>munderover@accent</title>
+     <meta charset="utf-8"/>
+     <script type="text/javascript">
+       function doTest() {
+         document.getElementById('mathOperator').setAttribute('accent', 'true');
+         document.documentElement.removeAttribute("class");
+       }
+       window.addEventListener("MozReftestInvalidate",doTest, false);
+     </script>
+    </head>
+    <body>
+     <math>
+      <munderover id="mathOperator"><mtext>X</mtext><mo>O</mo><mo>O</mo></munderover>
+     </math>
+    </body>
+</html>
\ No newline at end of file
diff --git a/layout/reftests/mathml/munderover-accentunder-dynamic-ref.html b/layout/reftests/mathml/munderover-accentunder-dynamic-ref.html
new file mode 100644
index 000000000000..4242b5560ebc
--- /dev/null
+++ b/layout/reftests/mathml/munderover-accentunder-dynamic-ref.html
@@ -0,0 +1,12 @@
+<!doctype html>
+ <html>
+   <head>
+     <title>munderover@accentunder</title>
+     <meta charset="utf-8"/>
+   </head>
+   <body>
+    <math>
+      <munderover accentunder="true"><mtext>X</mtext><mo>O</mo><mo>O</mo></munderover>
+    </math>
+   </body>
+</html>
\ No newline at end of file
diff --git a/layout/reftests/mathml/munderover-accentunder-dynamic.html b/layout/reftests/mathml/munderover-accentunder-dynamic.html
new file mode 100644
index 000000000000..c6890e2d6493
--- /dev/null
+++ b/layout/reftests/mathml/munderover-accentunder-dynamic.html
@@ -0,0 +1,18 @@
+<html class="reftest-wait">
+   <head>
+     <title>munderover@accentunder</title>
+     <meta charset="utf-8"/>
+     <script type="text/javascript">
+       function doTest() {
+         document.getElementById('mathOperator').setAttribute('accentunder', 'true');
+         document.documentElement.removeAttribute("class");
+       }
+       window.addEventListener("MozReftestInvalidate",doTest, false);
+     </script>
+    </head>
+    <body>
+     <math>
+      <munderover id="mathOperator"><mtext>X</mtext><mo>O</mo><mo>O</mo></munderover>
+     </math>
+    </body>
+</html>
\ No newline at end of file
diff --git a/layout/reftests/mathml/reftest.list b/layout/reftests/mathml/reftest.list
index 3aad5a88a9b1..d6f9ebe33ded 100644
--- a/layout/reftests/mathml/reftest.list
+++ b/layout/reftests/mathml/reftest.list
@@ -186,3 +186,7 @@ fails == whitespace-trim-4.html whitespace-trim-4-ref.html # Bug 787215
 == ssty-4.html ssty-4-ref.html
 == mathscript-1.html mathscript-1-ref.html
 == mathscript-2.html mathscript-2-ref.html
+== mo-accent-dynamic.html mo-accent-dynamic-ref.html
+== mo-movablelimits-dynamic.html mo-movablelimits-dynamic-ref.html
+== munderover-accent-dynamic.html munderover-accent-dynamic-ref.html
+== munderover-accentunder-dynamic.html munderover-accentunder-dynamic-ref.html
\ No newline at end of file
diff --git a/layout/style/nsStyleStruct.h b/layout/style/nsStyleStruct.h
index f72a66365579..c29360e51b4a 100644
--- a/layout/style/nsStyleStruct.h
+++ b/layout/style/nsStyleStruct.h
@@ -2626,13 +2626,8 @@ struct nsStyleSVGReset {
                           nsChangeHint_ClearAncestorIntrinsics);
   }
 
-  // The backend only supports one SVG reference right now.
-  // Eventually, it will support multiple chained SVG reference filters and CSS
-  // filter functions.
-  nsIURI* SingleFilter() const {
-    return (mFilters.Length() == 1 &&
-            mFilters[0].GetType() == NS_STYLE_FILTER_URL) ?
-            mFilters[0].GetURL() : nullptr;
+  bool HasFilters() const {
+    return mFilters.Length() > 0;
   }
 
   nsCOMPtr<nsIURI> mClipPath;         // [reset]
diff --git a/layout/svg/nsSVGEffects.cpp b/layout/svg/nsSVGEffects.cpp
index 011e44459f52..761532c98d98 100644
--- a/layout/svg/nsSVGEffects.cpp
+++ b/layout/svg/nsSVGEffects.cpp
@@ -214,12 +214,72 @@ nsSVGRenderingObserver::ContentRemoved(nsIDocument *aDocument,
   DoUpdate();
 }
 
-NS_IMPL_ISUPPORTS_INHERITED1(nsSVGFilterProperty,
-                             nsSVGIDRenderingObserver,
-                             nsISVGFilterProperty)
+NS_IMPL_ISUPPORTS1(nsSVGFilterProperty, nsISupports)
+
+nsSVGFilterProperty::nsSVGFilterProperty(const nsTArray<nsStyleFilter> &aFilters,
+                                         nsIFrame *aFilteredFrame) :
+  mFilters(aFilters)
+{
+  for (uint32_t i = 0; i < mFilters.Length(); i++) {
+    if (mFilters[i].GetType() != NS_STYLE_FILTER_URL)
+      continue;
+
+    nsSVGFilterReference *reference =
+      new nsSVGFilterReference(mFilters[i].GetURL(), aFilteredFrame);
+    NS_ADDREF(reference);
+    mReferences.AppendElement(reference);
+  }
+}
+
+nsSVGFilterProperty::~nsSVGFilterProperty()
+{
+  for (uint32_t i = 0; i < mReferences.Length(); i++) {
+    NS_RELEASE(mReferences[i]);
+  }
+}
+
+bool
+nsSVGFilterProperty::ReferencesValidResources()
+{
+  for (uint32_t i = 0; i < mReferences.Length(); i++) {
+    if (!mReferences[i]->ReferencesValidResource())
+      return false;
+  }
+  return true;
+}
+
+bool
+nsSVGFilterProperty::IsInObserverLists() const
+{
+  for (uint32_t i = 0; i < mReferences.Length(); i++) {
+    if (!mReferences[i]->IsInObserverList())
+      return false;
+  }
+  return true;
+}
+
+void
+nsSVGFilterProperty::Invalidate()
+{
+  for (uint32_t i = 0; i < mReferences.Length(); i++) {
+    mReferences[i]->Invalidate();
+  }
+}
 
 nsSVGFilterFrame *
 nsSVGFilterProperty::GetFilterFrame()
+{
+  // Eventually, callers will ask nsSVGFilterProperty for an nsStyleFilter
+  // chain, not a single nsSVGFilterFrame, and this function will go away.
+  return mReferences.Length() > 0 ? mReferences[0]->GetFilterFrame() : nullptr;
+}
+
+NS_IMPL_ISUPPORTS_INHERITED1(nsSVGFilterReference,
+                             nsSVGIDRenderingObserver,
+                             nsISVGFilterReference);
+
+nsSVGFilterFrame *
+nsSVGFilterReference::GetFilterFrame()
 {
   return static_cast<nsSVGFilterFrame *>
     (GetReferencedFrame(nsGkAtoms::svgFilterFrame, nullptr));
@@ -235,7 +295,7 @@ InvalidateAllContinuations(nsIFrame* aFrame)
 }
 
 void
-nsSVGFilterProperty::DoUpdate()
+nsSVGFilterReference::DoUpdate()
 {
   nsSVGIDRenderingObserver::DoUpdate();
   if (!mFrame)
@@ -334,10 +394,6 @@ nsSVGPaintingProperty::DoUpdate()
   }
 }
 
-static nsSVGRenderingObserver *
-CreateFilterProperty(nsIURI *aURI, nsIFrame *aFrame, bool aReferenceImage)
-{ return new nsSVGFilterProperty(aURI, aFrame, aReferenceImage); }
-
 static nsSVGRenderingObserver *
 CreateMarkerProperty(nsIURI *aURI, nsIFrame *aFrame, bool aReferenceImage)
 { return new nsSVGMarkerProperty(aURI, aFrame, aReferenceImage); }
@@ -371,6 +427,26 @@ GetEffectProperty(nsIURI *aURI, nsIFrame *aFrame,
   return prop;
 }
 
+static nsSVGFilterProperty*
+GetOrCreateFilterProperty(nsIFrame *aFrame)
+{
+  const nsStyleSVGReset* style = aFrame->StyleSVGReset();
+  if (!style->HasFilters())
+    return nullptr;
+
+  FrameProperties props = aFrame->Properties();
+  nsSVGFilterProperty *prop =
+    static_cast<nsSVGFilterProperty*>(props.Get(nsSVGEffects::FilterProperty()));
+  if (prop)
+    return prop;
+  prop = new nsSVGFilterProperty(style->mFilters, aFrame);
+  if (!prop)
+    return nullptr;
+  NS_ADDREF(prop);
+  props.Set(nsSVGEffects::FilterProperty(), static_cast<nsISupports*>(prop));
+  return prop;
+}
+
 nsSVGMarkerProperty *
 nsSVGEffects::GetMarkerProperty(nsIURI *aURI, nsIFrame *aFrame,
                                 const FramePropertyDescriptor *aProp)
@@ -438,9 +514,7 @@ nsSVGEffects::GetEffectProperties(nsIFrame *aFrame)
 
   EffectProperties result;
   const nsStyleSVGReset *style = aFrame->StyleSVGReset();
-  result.mFilter = static_cast<nsSVGFilterProperty*>
-    (GetEffectProperty(style->SingleFilter(), aFrame, FilterProperty(),
-                       CreateFilterProperty));
+  result.mFilter = GetOrCreateFilterProperty(aFrame);
   result.mClipPath =
     GetPaintingProperty(style->mClipPath, aFrame, ClipPathProperty());
   result.mMask =
@@ -515,8 +589,7 @@ nsSVGEffects::UpdateEffects(nsIFrame *aFrame)
 
   // Ensure that the filter is repainted correctly
   // We can't do that in DoUpdate as the referenced frame may not be valid
-  GetEffectProperty(aFrame->StyleSVGReset()->SingleFilter(),
-                    aFrame, FilterProperty(), CreateFilterProperty);
+  GetOrCreateFilterProperty(aFrame);
 
   if (aFrame->GetType() == nsGkAtoms::svgPathGeometryFrame &&
       static_cast<nsSVGPathGeometryElement*>(aFrame->GetContent())->IsMarkable()) {
@@ -536,7 +609,7 @@ nsSVGEffects::GetFilterProperty(nsIFrame *aFrame)
 {
   NS_ASSERTION(!aFrame->GetPrevContinuation(), "aFrame should be first continuation");
 
-  if (!aFrame->StyleSVGReset()->SingleFilter())
+  if (!aFrame->StyleSVGReset()->HasFilters())
     return nullptr;
 
   return static_cast<nsSVGFilterProperty *>
diff --git a/layout/svg/nsSVGEffects.h b/layout/svg/nsSVGEffects.h
index 2cd1bbc178a1..6d077c272987 100644
--- a/layout/svg/nsSVGEffects.h
+++ b/layout/svg/nsSVGEffects.h
@@ -150,12 +150,25 @@ protected:
   nsIPresShell *mFramePresShell;
 };
 
-class nsSVGFilterProperty :
-  public nsSVGIDRenderingObserver, public nsISVGFilterProperty {
+/**
+ * In a filter chain, there can be multiple SVG reference filters.
+ * e.g. filter: url(#svg-filter-1) blur(10px) url(#svg-filter-2);
+ *
+ * This class keeps track of one SVG reference filter in a filter chain.
+ * e.g. url(#svg-filter-1)
+ *
+ * It fires invalidations when the SVG filter element's id changes or when
+ * the SVG filter element's content changes.
+ *
+ * The nsSVGFilterProperty class manages a list of nsSVGFilterReferences.
+ */
+class nsSVGFilterReference :
+  public nsSVGIDRenderingObserver, public nsISVGFilterReference {
 public:
-  nsSVGFilterProperty(nsIURI *aURI, nsIFrame *aFilteredFrame,
-                      bool aReferenceImage)
-    : nsSVGIDRenderingObserver(aURI, aFilteredFrame, aReferenceImage) {}
+  nsSVGFilterReference(nsIURI *aURI, nsIFrame *aFilteredFrame)
+    : nsSVGIDRenderingObserver(aURI, aFilteredFrame, false) {}
+
+  bool ReferencesValidResource() { return GetFilterFrame(); }
 
   /**
    * @return the filter frame, or null if there is no filter frame
@@ -165,14 +178,48 @@ public:
   // nsISupports
   NS_DECL_ISUPPORTS
 
-  // nsISVGFilterProperty
-  virtual void Invalidate() MOZ_OVERRIDE { DoUpdate(); }
+  // nsISVGFilterReference
+  virtual void Invalidate() MOZ_OVERRIDE { DoUpdate(); };
 
 private:
-  // nsSVGRenderingObserver
+  // nsSVGIDRenderingObserver
   virtual void DoUpdate() MOZ_OVERRIDE;
 };
 
+/**
+ * This class manages a list of nsSVGFilterReferences, which represent SVG
+ * reference filters in a filter chain.
+ * e.g. filter: url(#svg-filter-1) blur(10px) url(#svg-filter-2);
+ *
+ * In the above example, the nsSVGFilterProperty will manage two
+ * nsSVGFilterReferences, one for each SVG reference filter. CSS filters like
+ * "blur(10px)" don't reference filter elements, so they don't need an
+ * nsSVGFilterReference. The style system invalidates changes to CSS filters.
+ */
+class nsSVGFilterProperty : public nsISupports {
+public:
+  nsSVGFilterProperty(const nsTArray<nsStyleFilter> &aFilters,
+                      nsIFrame *aFilteredFrame);
+  virtual ~nsSVGFilterProperty();
+
+  const nsTArray<nsStyleFilter>& GetFilters() { return mFilters; }
+  bool ReferencesValidResources();
+  bool IsInObserverLists() const;
+  void Invalidate();
+
+  /**
+   * @return the filter frame, or null if there is no filter frame
+   */
+  nsSVGFilterFrame *GetFilterFrame();
+
+  // nsISupports
+  NS_DECL_ISUPPORTS
+
+private:
+  nsTArray<nsSVGFilterReference*> mReferences;
+  nsTArray<nsStyleFilter> mFilters;
+};
+
 class nsSVGMarkerProperty : public nsSVGIDRenderingObserver {
 public:
   nsSVGMarkerProperty(nsIURI *aURI, nsIFrame *aFrame, bool aReferenceImage)
diff --git a/layout/svg/nsSVGIntegrationUtils.cpp b/layout/svg/nsSVGIntegrationUtils.cpp
index 8a185a1f300c..dd68f895131d 100644
--- a/layout/svg/nsSVGIntegrationUtils.cpp
+++ b/layout/svg/nsSVGIntegrationUtils.cpp
@@ -152,7 +152,7 @@ nsSVGIntegrationUtils::UsingEffectsForFrame(const nsIFrame* aFrame)
   // checking the SDL prefs here, since we don't know if we're being called for
   // painting or hit-testing anyway.
   const nsStyleSVGReset *style = aFrame->StyleSVGReset();
-  return (style->SingleFilter() || style->mClipPath || style->mMask);
+  return (style->HasFilters() || style->mClipPath || style->mMask);
 }
 
 /* static */ nsPoint
@@ -302,7 +302,7 @@ nsSVGIntegrationUtils::AdjustInvalidAreaForSVGEffects(nsIFrame* aFrame,
     return aInvalidRect;
 
   nsSVGFilterProperty *prop = nsSVGEffects::GetFilterProperty(firstFrame);
-  if (!prop || !prop->IsInObserverList()) {
+  if (!prop || !prop->IsInObserverLists()) {
     return aInvalidRect;
   }
 
diff --git a/layout/svg/nsSVGUtils.cpp b/layout/svg/nsSVGUtils.cpp
index 2276d95ca9af..b480a557d321 100644
--- a/layout/svg/nsSVGUtils.cpp
+++ b/layout/svg/nsSVGUtils.cpp
@@ -930,7 +930,7 @@ nsSVGUtils::CanOptimizeOpacity(nsIFrame *aFrame)
       type != nsGkAtoms::svgPathGeometryFrame) {
     return false;
   }
-  if (aFrame->StyleSVGReset()->SingleFilter()) {
+  if (aFrame->StyleSVGReset()->HasFilters()) {
     return false;
   }
   // XXX The SVG WG is intending to allow fill, stroke and markers on <image>
diff --git a/layout/svg/nsSVGUtils.h b/layout/svg/nsSVGUtils.h
index 5ca00c3bced7..c18adc47609c 100644
--- a/layout/svg/nsSVGUtils.h
+++ b/layout/svg/nsSVGUtils.h
@@ -161,18 +161,18 @@ private:
 };
 
 
-#define NS_ISVGFILTERPROPERTY_IID \
+#define NS_ISVGFILTERREFERENCE_IID \
 { 0x9744ee20, 0x1bcf, 0x4c62, \
  { 0x86, 0x7d, 0xd3, 0x7a, 0x91, 0x60, 0x3e, 0xef } }
 
-class nsISVGFilterProperty : public nsISupports
+class nsISVGFilterReference : public nsISupports
 {
 public:
-  NS_DECLARE_STATIC_IID_ACCESSOR(NS_ISVGFILTERPROPERTY_IID)
+  NS_DECLARE_STATIC_IID_ACCESSOR(NS_ISVGFILTERREFERENCE_IID)
   virtual void Invalidate() = 0;
 };
 
-NS_DEFINE_STATIC_IID_ACCESSOR(nsISVGFilterProperty, NS_ISVGFILTERPROPERTY_IID)
+NS_DEFINE_STATIC_IID_ACCESSOR(nsISVGFilterReference, NS_ISVGFILTERREFERENCE_IID)
 
 /**
  * General functions used by all of SVG layout and possibly content code.
diff --git a/layout/tools/reftest/reftest.js b/layout/tools/reftest/reftest.js
index f29d038b1e24..ae0571788990 100644
--- a/layout/tools/reftest/reftest.js
+++ b/layout/tools/reftest/reftest.js
@@ -239,7 +239,7 @@ this.OnRefTestLoad = function OnRefTestLoad(win)
     var prefs = Components.classes["@mozilla.org/preferences-service;1"].
                 getService(Components.interfaces.nsIPrefBranch);
     try {
-        gBrowserIsRemote = prefs.getBoolPref("browser.tabs.remote");
+        gBrowserIsRemote = prefs.getBoolPref("browser.tabs.remote.autostart");
     } catch (e) {
         gBrowserIsRemote = false;
     }
diff --git a/media/libcubeb/src/cubeb_wasapi.cpp b/media/libcubeb/src/cubeb_wasapi.cpp
index 18eab380e9c4..632b96af13c1 100644
--- a/media/libcubeb/src/cubeb_wasapi.cpp
+++ b/media/libcubeb/src/cubeb_wasapi.cpp
@@ -687,8 +687,9 @@ handle_channel_layout(cubeb_stream * stm,  WAVEFORMATEX ** mix_format, const cub
     CoTaskMemFree(*mix_format);
     *mix_format = closest;
   } else if (hr == AUDCLNT_E_UNSUPPORTED_FORMAT) {
-    /* Not supported, no suggestion, there is a bug somewhere. */
-    assert(false && "Format not supported, and no suggestion from WASAPI.");
+    /* Not supported, no suggestion. This should not happen, but it does in the
+     * field with some sound cards. We simply bail out and let the rest of the
+     * code figure out the right conversion path. */
   } else if (hr == S_OK) {
     LOG("Requested format accepted by WASAPI.");
   }
diff --git a/media/libpng/pngset.c b/media/libpng/pngset.c
index 90ebfaaedf31..7588c9ba0907 100644
--- a/media/libpng/pngset.c
+++ b/media/libpng/pngset.c
@@ -532,7 +532,7 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
 #        endif
       ))
    {
-      png_chunk_report(png_ptr, "Invalid palette", PNG_CHUNK_ERROR);
+      png_chunk_error(png_ptr, "Invalid palette");
       return;
    }
 
diff --git a/mfbt/ArrayUtils.h b/mfbt/ArrayUtils.h
index e2226bf59ded..3d5a5d4ec05a 100644
--- a/mfbt/ArrayUtils.h
+++ b/mfbt/ArrayUtils.h
@@ -82,6 +82,17 @@ ArrayEnd(const Array<T, N>& arr)
   return &arr[0] + ArrayLength(arr);
 }
 
+namespace detail {
+
+/*
+ * Helper for the MOZ_ARRAY_LENGTH() macro to make the length a typesafe
+ * compile-time constant even on compilers lacking constexpr support.
+ */
+template <typename T, size_t N>
+char (&ArrayLengthHelper(T (&array)[N]))[N];
+
+} /* namespace detail */
+
 } /* namespace mozilla */
 
 #endif /* __cplusplus */
@@ -91,8 +102,8 @@ ArrayEnd(const Array<T, N>& arr)
  * that can't use C++ template functions and for static_assert() calls that
  * can't call ArrayLength() when it is not a C++11 constexpr function.
  */
-#ifdef MOZ_HAVE_CXX11_CONSTEXPR
-#  define MOZ_ARRAY_LENGTH(array)   mozilla::ArrayLength(array)
+#ifdef __cplusplus
+#  define MOZ_ARRAY_LENGTH(array)   sizeof(mozilla::detail::ArrayLengthHelper(array))
 #else
 #  define MOZ_ARRAY_LENGTH(array)   (sizeof(array)/sizeof((array)[0]))
 #endif
diff --git a/mobile/android/app/mobile.js b/mobile/android/app/mobile.js
index 72440f89b931..17c317833427 100644
--- a/mobile/android/app/mobile.js
+++ b/mobile/android/app/mobile.js
@@ -817,7 +817,7 @@ pref("browser.snippets.geoUrl", "https://geo.mozilla.org/country.json");
 pref("browser.snippets.statsUrl", "https://snippets-stats.mozilla.org/mobile");
 
 // These prefs require a restart to take effect.
-pref("browser.snippets.enabled", true);
+pref("browser.snippets.enabled", false);
 pref("browser.snippets.syncPromo.enabled", false);
 
 #ifdef MOZ_ANDROID_SYNTHAPKS
diff --git a/mobile/android/base/Makefile.in b/mobile/android/base/Makefile.in
index 674d06eaf4e6..a9f84980a1d7 100644
--- a/mobile/android/base/Makefile.in
+++ b/mobile/android/base/Makefile.in
@@ -81,8 +81,8 @@ include $(topsrcdir)/config/config.mk
 # because Android resource classes must be compiled together in order to avoid overlapping resource
 # indices.
 
-classes.dex: proguard-jars
-	@echo 'DX classes.dex'
+classes.dex: .proguard.deps
+	$(REPORT_BUILD)
 	$(DX) --dex --output=classes.dex jars-proguarded $(ANDROID_COMPAT_LIB)
 
 ifdef MOZ_DISABLE_PROGUARD
@@ -95,8 +95,15 @@ else
   endif
 endif
 
-proguard-jars: $(ALL_JARS)
-	java -jar $(ANDROID_SDK_ROOT)/tools/proguard/lib/proguard.jar @$(topsrcdir)/mobile/android/config/proguard.cfg -optimizationpasses $(PROGUARD_PASSES) -injars $(subst ::,:,$(subst $(NULL) ,:,$(strip $(ALL_JARS)))) -outjars jars-proguarded -libraryjars $(ANDROID_SDK)/android.jar:$(ANDROID_COMPAT_LIB)
+.proguard.deps: $(ALL_JARS)
+	$(REPORT_BUILD)
+	java -jar $(ANDROID_SDK_ROOT)/tools/proguard/lib/proguard.jar \
+		@$(topsrcdir)/mobile/android/config/proguard.cfg \
+		-optimizationpasses $(PROGUARD_PASSES) \
+		-injars $(subst ::,:,$(subst $(NULL) ,:,$(strip $(ALL_JARS)))) \
+		-outjars jars-proguarded \
+		-libraryjars $(ANDROID_SDK)/android.jar:$(ANDROID_COMPAT_LIB)
+	@$(TOUCH) $@
 
 CLASSES_WITH_JNI= \
     org.mozilla.gecko.GeckoAppShell \
diff --git a/mobile/android/base/db/BrowserContract.java b/mobile/android/base/db/BrowserContract.java
index 4718a15955b6..6cd107d68689 100644
--- a/mobile/android/base/db/BrowserContract.java
+++ b/mobile/android/base/db/BrowserContract.java
@@ -101,6 +101,8 @@ public class BrowserContract {
     public static final class Favicons implements CommonColumns, DateSyncColumns {
         private Favicons() {}
 
+        public static final String TABLE_NAME = "favicons";
+
         public static final Uri CONTENT_URI = Uri.withAppendedPath(AUTHORITY_URI, "favicons");
 
         public static final String URL = "url";
@@ -112,6 +114,8 @@ public class BrowserContract {
     public static final class Thumbnails implements CommonColumns {
         private Thumbnails() {}
 
+        public static final String TABLE_NAME = "thumbnails";
+
         public static final Uri CONTENT_URI = Uri.withAppendedPath(AUTHORITY_URI, "thumbnails");
 
         public static final String URL = "url";
@@ -122,6 +126,10 @@ public class BrowserContract {
     public static final class Bookmarks implements CommonColumns, URLColumns, FaviconColumns, SyncColumns {
         private Bookmarks() {}
 
+        public static final String TABLE_NAME = "bookmarks";
+
+        public static final String VIEW_WITH_FAVICONS = "bookmarks_with_favicons";
+
         public static final int FIXED_ROOT_ID = 0;
         public static final int FAKE_DESKTOP_FOLDER_ID = -1;
         public static final int FIXED_READING_LIST_ID = -2;
@@ -162,6 +170,11 @@ public class BrowserContract {
     @RobocopTarget
     public static final class History implements CommonColumns, URLColumns, HistoryColumns, FaviconColumns, SyncColumns {
         private History() {}
+
+        public static final String TABLE_NAME = "history";
+
+        public static final String VIEW_WITH_FAVICONS = "history_with_favicons";
+
         public static final Uri CONTENT_URI = Uri.withAppendedPath(AUTHORITY_URI, "history");
         public static final Uri CONTENT_OLD_URI = Uri.withAppendedPath(AUTHORITY_URI, "history/old");
         public static final String CONTENT_TYPE = "vnd.android.cursor.dir/browser-history";
@@ -172,6 +185,11 @@ public class BrowserContract {
     @RobocopTarget
     public static final class Combined implements CommonColumns, URLColumns, HistoryColumns, FaviconColumns  {
         private Combined() {}
+
+        public static final String VIEW_NAME = "combined";
+
+        public static final String VIEW_WITH_FAVICONS = "combined_with_favicons";
+
         public static final Uri CONTENT_URI = Uri.withAppendedPath(AUTHORITY_URI, "combined");
 
         public static final int DISPLAY_NORMAL = 0;
@@ -305,4 +323,47 @@ public class BrowserContract {
         public static final String IMAGE_URL = "image_url";
         public static final String CREATED = "created";
     }
+
+    /*
+     * Contains names and schema definitions for tables and views
+     * no longer being used by current ContentProviders. These values are used
+     * to make incremental updates to the schema during a database upgrade. Will be
+     * removed with bug 947018.
+     */
+    static final class Obsolete {
+        public static final String TABLE_IMAGES = "images";
+        public static final String VIEW_BOOKMARKS_WITH_IMAGES = "bookmarks_with_images";
+        public static final String VIEW_HISTORY_WITH_IMAGES = "history_with_images";
+        public static final String VIEW_COMBINED_WITH_IMAGES = "combined_with_images";
+
+        public static final class Images implements CommonColumns, SyncColumns {
+            private Images() {}
+
+            public static final String URL = "url_key";
+            public static final String FAVICON_URL = "favicon_url";
+            public static final String FAVICON = "favicon";
+            public static final String THUMBNAIL = "thumbnail";
+            public static final String _ID = "_id";
+            public static final String GUID = "guid";
+            public static final String DATE_CREATED = "created";
+            public static final String DATE_MODIFIED = "modified";
+            public static final String IS_DELETED = "deleted";
+        }
+
+        public static final class Combined {
+            private Combined() {}
+
+            public static final String THUMBNAIL = "thumbnail";
+        }
+
+        static final String TABLE_BOOKMARKS_JOIN_IMAGES = Bookmarks.TABLE_NAME + " LEFT OUTER JOIN " +
+                Obsolete.TABLE_IMAGES + " ON " + DBUtils.qualifyColumn(Bookmarks.TABLE_NAME, Bookmarks.URL) + " = " +
+                DBUtils.qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.URL);
+
+        static final String TABLE_HISTORY_JOIN_IMAGES = History.TABLE_NAME + " LEFT OUTER JOIN " +
+                Obsolete.TABLE_IMAGES + " ON " + DBUtils.qualifyColumn(Bookmarks.TABLE_NAME, History.URL) + " = " +
+                DBUtils.qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.URL);
+
+        static final String FAVICON_DB = "favicon_urls.db";
+    }
 }
diff --git a/mobile/android/base/db/BrowserDatabaseHelper.java b/mobile/android/base/db/BrowserDatabaseHelper.java
new file mode 100644
index 000000000000..47de4c1d9295
--- /dev/null
+++ b/mobile/android/base/db/BrowserDatabaseHelper.java
@@ -0,0 +1,1748 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.db;
+
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.lang.reflect.Field;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import org.json.JSONArray;
+import org.json.JSONException;
+import org.json.JSONObject;
+import org.mozilla.gecko.AppConstants;
+import org.mozilla.gecko.Distribution;
+import org.mozilla.gecko.R;
+import org.mozilla.gecko.db.BrowserContract.Bookmarks;
+import org.mozilla.gecko.db.BrowserContract.Combined;
+import org.mozilla.gecko.db.BrowserContract.FaviconColumns;
+import org.mozilla.gecko.db.BrowserContract.Favicons;
+import org.mozilla.gecko.db.BrowserContract.History;
+import org.mozilla.gecko.db.BrowserContract.Obsolete;
+import org.mozilla.gecko.db.BrowserContract.Thumbnails;
+import org.mozilla.gecko.gfx.BitmapUtils;
+import org.mozilla.gecko.sync.Utils;
+import org.mozilla.gecko.util.GeckoJarReader;
+import org.mozilla.gecko.util.ThreadUtils;
+
+import android.content.ContentValues;
+import android.content.Context;
+import android.database.Cursor;
+import android.database.DatabaseUtils;
+import android.database.SQLException;
+import android.database.sqlite.SQLiteDatabase;
+import android.database.sqlite.SQLiteOpenHelper;
+import android.graphics.Bitmap;
+import android.net.Uri;
+import android.os.Build;
+import android.text.TextUtils;
+import android.util.Log;
+
+
+final class BrowserDatabaseHelper extends SQLiteOpenHelper {
+
+    private static final String LOGTAG = "GeckoBrowserDBHelper";
+    public static final int DATABASE_VERSION = 17;
+    public static final String DATABASE_NAME = "browser.db";
+
+    final protected Context mContext;
+
+    static final String TABLE_BOOKMARKS = Bookmarks.TABLE_NAME;
+    static final String TABLE_HISTORY = History.TABLE_NAME;
+    static final String TABLE_FAVICONS = Favicons.TABLE_NAME;
+    static final String TABLE_THUMBNAILS = Thumbnails.TABLE_NAME;
+
+    static final String VIEW_COMBINED = Combined.VIEW_NAME;
+    static final String VIEW_BOOKMARKS_WITH_FAVICONS = Bookmarks.VIEW_WITH_FAVICONS;
+    static final String VIEW_HISTORY_WITH_FAVICONS = History.VIEW_WITH_FAVICONS;
+    static final String VIEW_COMBINED_WITH_FAVICONS = Combined.VIEW_WITH_FAVICONS;
+
+    static final String TABLE_BOOKMARKS_JOIN_FAVICONS = TABLE_BOOKMARKS + " LEFT OUTER JOIN " +
+            TABLE_FAVICONS + " ON " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.FAVICON_ID) + " = " +
+            qualifyColumn(TABLE_FAVICONS, Favicons._ID);
+
+    static final String TABLE_HISTORY_JOIN_FAVICONS = TABLE_HISTORY + " LEFT OUTER JOIN " +
+            TABLE_FAVICONS + " ON " + qualifyColumn(TABLE_HISTORY, History.FAVICON_ID) + " = " +
+            qualifyColumn(TABLE_FAVICONS, Favicons._ID);
+
+    static final String TABLE_BOOKMARKS_TMP = TABLE_BOOKMARKS + "_tmp";
+    static final String TABLE_HISTORY_TMP = TABLE_HISTORY + "_tmp";
+    static final String TABLE_IMAGES_TMP = Obsolete.TABLE_IMAGES + "_tmp";
+
+    private static final String[] mobileIdColumns = new String[] { Bookmarks._ID };
+    private static final String[] mobileIdSelectionArgs = new String[] { Bookmarks.MOBILE_FOLDER_GUID };
+
+    public BrowserDatabaseHelper(Context context, String databasePath) {
+        super(context, databasePath, null, DATABASE_VERSION);
+        mContext = context;
+    }
+
+    private void createBookmarksTable(SQLiteDatabase db) {
+        debug("Creating " + TABLE_BOOKMARKS + " table");
+
+        // Android versions older than Froyo ship with an sqlite
+        // that doesn't support foreign keys.
+        String foreignKeyOnParent = null;
+        if (Build.VERSION.SDK_INT >= 8) {
+            foreignKeyOnParent = ", FOREIGN KEY (" + Bookmarks.PARENT +
+                ") REFERENCES " + TABLE_BOOKMARKS + "(" + Bookmarks._ID + ")";
+        }
+
+        db.execSQL("CREATE TABLE " + TABLE_BOOKMARKS + "(" +
+                Bookmarks._ID + " INTEGER PRIMARY KEY AUTOINCREMENT," +
+                Bookmarks.TITLE + " TEXT," +
+                Bookmarks.URL + " TEXT," +
+                Bookmarks.TYPE + " INTEGER NOT NULL DEFAULT " + Bookmarks.TYPE_BOOKMARK + "," +
+                Bookmarks.PARENT + " INTEGER," +
+                Bookmarks.POSITION + " INTEGER NOT NULL," +
+                Bookmarks.KEYWORD + " TEXT," +
+                Bookmarks.DESCRIPTION + " TEXT," +
+                Bookmarks.TAGS + " TEXT," +
+                Bookmarks.DATE_CREATED + " INTEGER," +
+                Bookmarks.DATE_MODIFIED + " INTEGER," +
+                Bookmarks.GUID + " TEXT NOT NULL," +
+                Bookmarks.IS_DELETED + " INTEGER NOT NULL DEFAULT 0" +
+                (foreignKeyOnParent != null ? foreignKeyOnParent : "") +
+                ");");
+
+        db.execSQL("CREATE INDEX bookmarks_url_index ON " + TABLE_BOOKMARKS + "("
+                + Bookmarks.URL + ")");
+        db.execSQL("CREATE INDEX bookmarks_type_deleted_index ON " + TABLE_BOOKMARKS + "("
+                + Bookmarks.TYPE + ", " + Bookmarks.IS_DELETED + ")");
+        db.execSQL("CREATE UNIQUE INDEX bookmarks_guid_index ON " + TABLE_BOOKMARKS + "("
+                + Bookmarks.GUID + ")");
+        db.execSQL("CREATE INDEX bookmarks_modified_index ON " + TABLE_BOOKMARKS + "("
+                + Bookmarks.DATE_MODIFIED + ")");
+    }
+
+    private void createBookmarksTableOn13(SQLiteDatabase db) {
+        debug("Creating " + TABLE_BOOKMARKS + " table");
+
+        // Android versions older than Froyo ship with an sqlite
+        // that doesn't support foreign keys.
+        String foreignKeyOnParent = null;
+        if (Build.VERSION.SDK_INT >= 8) {
+            foreignKeyOnParent = ", FOREIGN KEY (" + Bookmarks.PARENT +
+                ") REFERENCES " + TABLE_BOOKMARKS + "(" + Bookmarks._ID + ")";
+        }
+
+        db.execSQL("CREATE TABLE " + TABLE_BOOKMARKS + "(" +
+                Bookmarks._ID + " INTEGER PRIMARY KEY AUTOINCREMENT," +
+                Bookmarks.TITLE + " TEXT," +
+                Bookmarks.URL + " TEXT," +
+                Bookmarks.TYPE + " INTEGER NOT NULL DEFAULT " + Bookmarks.TYPE_BOOKMARK + "," +
+                Bookmarks.PARENT + " INTEGER," +
+                Bookmarks.POSITION + " INTEGER NOT NULL," +
+                Bookmarks.KEYWORD + " TEXT," +
+                Bookmarks.DESCRIPTION + " TEXT," +
+                Bookmarks.TAGS + " TEXT," +
+                Bookmarks.FAVICON_ID + " INTEGER," +
+                Bookmarks.DATE_CREATED + " INTEGER," +
+                Bookmarks.DATE_MODIFIED + " INTEGER," +
+                Bookmarks.GUID + " TEXT NOT NULL," +
+                Bookmarks.IS_DELETED + " INTEGER NOT NULL DEFAULT 0" +
+                (foreignKeyOnParent != null ? foreignKeyOnParent : "") +
+                ");");
+
+        db.execSQL("CREATE INDEX bookmarks_url_index ON " + TABLE_BOOKMARKS + "("
+                + Bookmarks.URL + ")");
+        db.execSQL("CREATE INDEX bookmarks_type_deleted_index ON " + TABLE_BOOKMARKS + "("
+                + Bookmarks.TYPE + ", " + Bookmarks.IS_DELETED + ")");
+        db.execSQL("CREATE UNIQUE INDEX bookmarks_guid_index ON " + TABLE_BOOKMARKS + "("
+                + Bookmarks.GUID + ")");
+        db.execSQL("CREATE INDEX bookmarks_modified_index ON " + TABLE_BOOKMARKS + "("
+                + Bookmarks.DATE_MODIFIED + ")");
+    }
+
+    private void createHistoryTable(SQLiteDatabase db) {
+        debug("Creating " + TABLE_HISTORY + " table");
+        db.execSQL("CREATE TABLE " + TABLE_HISTORY + "(" +
+                History._ID + " INTEGER PRIMARY KEY AUTOINCREMENT," +
+                History.TITLE + " TEXT," +
+                History.URL + " TEXT NOT NULL," +
+                History.VISITS + " INTEGER NOT NULL DEFAULT 0," +
+                History.DATE_LAST_VISITED + " INTEGER," +
+                History.DATE_CREATED + " INTEGER," +
+                History.DATE_MODIFIED + " INTEGER," +
+                History.GUID + " TEXT NOT NULL," +
+                History.IS_DELETED + " INTEGER NOT NULL DEFAULT 0" +
+                ");");
+
+        db.execSQL("CREATE INDEX history_url_index ON " + TABLE_HISTORY + "("
+                + History.URL + ")");
+        db.execSQL("CREATE UNIQUE INDEX history_guid_index ON " + TABLE_HISTORY + "("
+                + History.GUID + ")");
+        db.execSQL("CREATE INDEX history_modified_index ON " + TABLE_HISTORY + "("
+                + History.DATE_MODIFIED + ")");
+        db.execSQL("CREATE INDEX history_visited_index ON " + TABLE_HISTORY + "("
+                + History.DATE_LAST_VISITED + ")");
+    }
+
+    private void createHistoryTableOn13(SQLiteDatabase db) {
+        debug("Creating " + TABLE_HISTORY + " table");
+        db.execSQL("CREATE TABLE " + TABLE_HISTORY + "(" +
+                History._ID + " INTEGER PRIMARY KEY AUTOINCREMENT," +
+                History.TITLE + " TEXT," +
+                History.URL + " TEXT NOT NULL," +
+                History.VISITS + " INTEGER NOT NULL DEFAULT 0," +
+                History.FAVICON_ID + " INTEGER," +
+                History.DATE_LAST_VISITED + " INTEGER," +
+                History.DATE_CREATED + " INTEGER," +
+                History.DATE_MODIFIED + " INTEGER," +
+                History.GUID + " TEXT NOT NULL," +
+                History.IS_DELETED + " INTEGER NOT NULL DEFAULT 0" +
+                ");");
+
+        db.execSQL("CREATE INDEX history_url_index ON " + TABLE_HISTORY + "("
+                + History.URL + ")");
+        db.execSQL("CREATE UNIQUE INDEX history_guid_index ON " + TABLE_HISTORY + "("
+                + History.GUID + ")");
+        db.execSQL("CREATE INDEX history_modified_index ON " + TABLE_HISTORY + "("
+                + History.DATE_MODIFIED + ")");
+        db.execSQL("CREATE INDEX history_visited_index ON " + TABLE_HISTORY + "("
+                + History.DATE_LAST_VISITED + ")");
+    }
+
+    private void createImagesTable(SQLiteDatabase db) {
+        debug("Creating " + Obsolete.TABLE_IMAGES + " table");
+        db.execSQL("CREATE TABLE " + Obsolete.TABLE_IMAGES + " (" +
+                Obsolete.Images._ID + " INTEGER PRIMARY KEY AUTOINCREMENT," +
+                Obsolete.Images.URL + " TEXT UNIQUE NOT NULL," +
+                Obsolete.Images.FAVICON + " BLOB," +
+                Obsolete.Images.FAVICON_URL + " TEXT," +
+                Obsolete.Images.THUMBNAIL + " BLOB," +
+                Obsolete.Images.DATE_CREATED + " INTEGER," +
+                Obsolete.Images.DATE_MODIFIED + " INTEGER," +
+                Obsolete.Images.GUID + " TEXT NOT NULL," +
+                Obsolete.Images.IS_DELETED + " INTEGER NOT NULL DEFAULT 0" +
+                ");");
+
+        db.execSQL("CREATE INDEX images_url_index ON " + Obsolete.TABLE_IMAGES + "("
+                + Obsolete.Images.URL + ")");
+        db.execSQL("CREATE UNIQUE INDEX images_guid_index ON " + Obsolete.TABLE_IMAGES + "("
+                + Obsolete.Images.GUID + ")");
+        db.execSQL("CREATE INDEX images_modified_index ON " + Obsolete.TABLE_IMAGES + "("
+                + Obsolete.Images.DATE_MODIFIED + ")");
+    }
+
+    private void createFaviconsTable(SQLiteDatabase db) {
+        debug("Creating " + TABLE_FAVICONS + " table");
+        db.execSQL("CREATE TABLE " + TABLE_FAVICONS + " (" +
+                Favicons._ID + " INTEGER PRIMARY KEY AUTOINCREMENT," +
+                Favicons.URL + " TEXT UNIQUE," +
+                Favicons.DATA + " BLOB," +
+                Favicons.DATE_CREATED + " INTEGER," +
+                Favicons.DATE_MODIFIED + " INTEGER" +
+                ");");
+
+        db.execSQL("CREATE INDEX favicons_url_index ON " + TABLE_FAVICONS + "("
+                + Favicons.URL + ")");
+        db.execSQL("CREATE INDEX favicons_modified_index ON " + TABLE_FAVICONS + "("
+                + Favicons.DATE_MODIFIED + ")");
+    }
+
+    private void createThumbnailsTable(SQLiteDatabase db) {
+        debug("Creating " + TABLE_THUMBNAILS + " table");
+        db.execSQL("CREATE TABLE " + TABLE_THUMBNAILS + " (" +
+                Thumbnails._ID + " INTEGER PRIMARY KEY AUTOINCREMENT," +
+                Thumbnails.URL + " TEXT UNIQUE," +
+                Thumbnails.DATA + " BLOB" +
+                ");");
+
+        db.execSQL("CREATE INDEX thumbnails_url_index ON " + TABLE_THUMBNAILS + "("
+                + Thumbnails.URL + ")");
+    }
+
+    private void createBookmarksWithImagesView(SQLiteDatabase db) {
+        debug("Creating " + Obsolete.VIEW_BOOKMARKS_WITH_IMAGES + " view");
+
+        db.execSQL("CREATE VIEW IF NOT EXISTS " + Obsolete.VIEW_BOOKMARKS_WITH_IMAGES + " AS " +
+                "SELECT " + qualifyColumn(TABLE_BOOKMARKS, "*") +
+                ", " + Obsolete.Images.FAVICON + ", " + Obsolete.Images.THUMBNAIL + " FROM " +
+                Obsolete.TABLE_BOOKMARKS_JOIN_IMAGES);
+    }
+
+    private void createBookmarksWithFaviconsView(SQLiteDatabase db) {
+        debug("Creating " + VIEW_BOOKMARKS_WITH_FAVICONS + " view");
+
+        db.execSQL("CREATE VIEW IF NOT EXISTS " + VIEW_BOOKMARKS_WITH_FAVICONS + " AS " +
+                "SELECT " + qualifyColumn(TABLE_BOOKMARKS, "*") +
+                ", " + qualifyColumn(TABLE_FAVICONS, Favicons.DATA) + " AS " + Bookmarks.FAVICON +
+                ", " + qualifyColumn(TABLE_FAVICONS, Favicons.URL) + " AS " + Bookmarks.FAVICON_URL +
+                " FROM " + TABLE_BOOKMARKS_JOIN_FAVICONS);
+    }
+
+    private void createHistoryWithImagesView(SQLiteDatabase db) {
+        debug("Creating " + Obsolete.VIEW_HISTORY_WITH_IMAGES + " view");
+
+        db.execSQL("CREATE VIEW IF NOT EXISTS " + Obsolete.VIEW_HISTORY_WITH_IMAGES + " AS " +
+                "SELECT " + qualifyColumn(TABLE_HISTORY, "*") +
+                ", " + Obsolete.Images.FAVICON + ", " + Obsolete.Images.THUMBNAIL + " FROM " +
+                Obsolete.TABLE_HISTORY_JOIN_IMAGES);
+    }
+
+    private void createHistoryWithFaviconsView(SQLiteDatabase db) {
+        debug("Creating " + VIEW_HISTORY_WITH_FAVICONS + " view");
+
+        db.execSQL("CREATE VIEW IF NOT EXISTS " + VIEW_HISTORY_WITH_FAVICONS + " AS " +
+                "SELECT " + qualifyColumn(TABLE_HISTORY, "*") +
+                ", " + qualifyColumn(TABLE_FAVICONS, Favicons.DATA) + " AS " + History.FAVICON +
+                ", " + qualifyColumn(TABLE_FAVICONS, Favicons.URL) + " AS " + History.FAVICON_URL +
+                " FROM " + TABLE_HISTORY_JOIN_FAVICONS);
+    }
+
+    private void createCombinedWithImagesView(SQLiteDatabase db) {
+        debug("Creating " + Obsolete.VIEW_COMBINED_WITH_IMAGES + " view");
+
+        db.execSQL("CREATE VIEW IF NOT EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES + " AS" +
+                " SELECT " + Combined.BOOKMARK_ID + ", " +
+                             Combined.HISTORY_ID + ", " +
+                             // We need to return an _id column because CursorAdapter requires it for its
+                             // default implementation for the getItemId() method. However, since
+                             // we're not using this feature in the parts of the UI using this view,
+                             // we can just use 0 for all rows.
+                             "0 AS " + Combined._ID + ", " +
+                             Combined.URL + ", " +
+                             Combined.TITLE + ", " +
+                             Combined.VISITS + ", " +
+                             Combined.DATE_LAST_VISITED + ", " +
+                             qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.FAVICON) + " AS " + Combined.FAVICON + ", " +
+                             qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.THUMBNAIL) + " AS " + Obsolete.Combined.THUMBNAIL +
+                " FROM (" +
+                    // Bookmarks without history.
+                    " SELECT " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) + " AS " + Combined.BOOKMARK_ID + ", " +
+                                 qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " AS " + Combined.URL + ", " +
+                                 qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + " AS " + Combined.TITLE + ", " +
+                                 "-1 AS " + Combined.HISTORY_ID + ", " +
+                                 "-1 AS " + Combined.VISITS + ", " +
+                                 "-1 AS " + Combined.DATE_LAST_VISITED +
+                    " FROM " + TABLE_BOOKMARKS +
+                    " WHERE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + " AND " +
+                                qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED)  + " = 0 AND " +
+                                qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) +
+                                    " NOT IN (SELECT " + History.URL + " FROM " + TABLE_HISTORY + ")" +
+                    " UNION ALL" +
+                    // History with and without bookmark.
+                    " SELECT " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) + " AS " + Combined.BOOKMARK_ID + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.URL) + " AS " + Combined.URL + ", " +
+                                 // Prioritze bookmark titles over history titles, since the user may have
+                                 // customized the title for a bookmark.
+                                 "COALESCE(" + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + ", " +
+                                               qualifyColumn(TABLE_HISTORY, History.TITLE) +")" + " AS " + Combined.TITLE + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History._ID) + " AS " + Combined.HISTORY_ID + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.VISITS) + " AS " + Combined.VISITS + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.DATE_LAST_VISITED) + " AS " + Combined.DATE_LAST_VISITED +
+                    " FROM " + TABLE_HISTORY + " LEFT OUTER JOIN " + TABLE_BOOKMARKS +
+                        " ON " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " = " + qualifyColumn(TABLE_HISTORY, History.URL) +
+                    " WHERE " + qualifyColumn(TABLE_HISTORY, History.URL) + " IS NOT NULL AND " +
+                                qualifyColumn(TABLE_HISTORY, History.IS_DELETED)  + " = 0 AND (" +
+                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE) + " IS NULL OR " +
+                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + ")" +
+                ") LEFT OUTER JOIN " + Obsolete.TABLE_IMAGES +
+                    " ON " + Combined.URL + " = " + qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.URL));
+    }
+
+    private void createCombinedWithImagesViewOn9(SQLiteDatabase db) {
+        debug("Creating " + Obsolete.VIEW_COMBINED_WITH_IMAGES + " view");
+
+        db.execSQL("CREATE VIEW IF NOT EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES + " AS" +
+                " SELECT " + Combined.BOOKMARK_ID + ", " +
+                             Combined.HISTORY_ID + ", " +
+                             // We need to return an _id column because CursorAdapter requires it for its
+                             // default implementation for the getItemId() method. However, since
+                             // we're not using this feature in the parts of the UI using this view,
+                             // we can just use 0 for all rows.
+                             "0 AS " + Combined._ID + ", " +
+                             Combined.URL + ", " +
+                             Combined.TITLE + ", " +
+                             Combined.VISITS + ", " +
+                             Combined.DISPLAY + ", " +
+                             Combined.DATE_LAST_VISITED + ", " +
+                             qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.FAVICON) + " AS " + Combined.FAVICON + ", " +
+                             qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.THUMBNAIL) + " AS " + Obsolete.Combined.THUMBNAIL +
+                " FROM (" +
+                    // Bookmarks without history.
+                    " SELECT " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) + " AS " + Combined.BOOKMARK_ID + ", " +
+                                 qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " AS " + Combined.URL + ", " +
+                                 qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + " AS " + Combined.TITLE + ", " +
+                                 "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " +
+                                    Bookmarks.FIXED_READING_LIST_ID + " THEN " + Combined.DISPLAY_READER + " ELSE " +
+                                    Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
+                                 "-1 AS " + Combined.HISTORY_ID + ", " +
+                                 "-1 AS " + Combined.VISITS + ", " +
+                                 "-1 AS " + Combined.DATE_LAST_VISITED +
+                    " FROM " + TABLE_BOOKMARKS +
+                    " WHERE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + " AND " +
+                                qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED)  + " = 0 AND " +
+                                qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) +
+                                    " NOT IN (SELECT " + History.URL + " FROM " + TABLE_HISTORY + ")" +
+                    " UNION ALL" +
+                    // History with and without bookmark.
+                    " SELECT " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) + " AS " + Combined.BOOKMARK_ID + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.URL) + " AS " + Combined.URL + ", " +
+                                 // Prioritze bookmark titles over history titles, since the user may have
+                                 // customized the title for a bookmark.
+                                 "COALESCE(" + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + ", " +
+                                               qualifyColumn(TABLE_HISTORY, History.TITLE) +")" + " AS " + Combined.TITLE + ", " +
+                                 "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " +
+                                    Bookmarks.FIXED_READING_LIST_ID + " THEN " + Combined.DISPLAY_READER + " ELSE " +
+                                    Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History._ID) + " AS " + Combined.HISTORY_ID + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.VISITS) + " AS " + Combined.VISITS + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.DATE_LAST_VISITED) + " AS " + Combined.DATE_LAST_VISITED +
+                    " FROM " + TABLE_HISTORY + " LEFT OUTER JOIN " + TABLE_BOOKMARKS +
+                        " ON " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " = " + qualifyColumn(TABLE_HISTORY, History.URL) +
+                    " WHERE " + qualifyColumn(TABLE_HISTORY, History.URL) + " IS NOT NULL AND " +
+                                qualifyColumn(TABLE_HISTORY, History.IS_DELETED)  + " = 0 AND (" +
+                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE) + " IS NULL OR " +
+                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + ")" +
+                ") LEFT OUTER JOIN " + Obsolete.TABLE_IMAGES +
+                    " ON " + Combined.URL + " = " + qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.URL));
+    }
+
+    private void createCombinedWithImagesViewOn10(SQLiteDatabase db) {
+        debug("Creating " + Obsolete.VIEW_COMBINED_WITH_IMAGES + " view");
+
+        db.execSQL("CREATE VIEW IF NOT EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES + " AS" +
+                " SELECT " + Combined.BOOKMARK_ID + ", " +
+                             Combined.HISTORY_ID + ", " +
+                             // We need to return an _id column because CursorAdapter requires it for its
+                             // default implementation for the getItemId() method. However, since
+                             // we're not using this feature in the parts of the UI using this view,
+                             // we can just use 0 for all rows.
+                             "0 AS " + Combined._ID + ", " +
+                             Combined.URL + ", " +
+                             Combined.TITLE + ", " +
+                             Combined.VISITS + ", " +
+                             Combined.DISPLAY + ", " +
+                             Combined.DATE_LAST_VISITED + ", " +
+                             qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.FAVICON) + " AS " + Combined.FAVICON + ", " +
+                             qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.THUMBNAIL) + " AS " + Obsolete.Combined.THUMBNAIL +
+                " FROM (" +
+                    // Bookmarks without history.
+                    " SELECT " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) + " AS " + Combined.BOOKMARK_ID + ", " +
+                                 qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " AS " + Combined.URL + ", " +
+                                 qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + " AS " + Combined.TITLE + ", " +
+                                 "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " +
+                                    Bookmarks.FIXED_READING_LIST_ID + " THEN " + Combined.DISPLAY_READER + " ELSE " +
+                                    Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
+                                 "-1 AS " + Combined.HISTORY_ID + ", " +
+                                 "-1 AS " + Combined.VISITS + ", " +
+                                 "-1 AS " + Combined.DATE_LAST_VISITED +
+                    " FROM " + TABLE_BOOKMARKS +
+                    " WHERE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + " AND " +
+                                qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED)  + " = 0 AND " +
+                                qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) +
+                                    " NOT IN (SELECT " + History.URL + " FROM " + TABLE_HISTORY + ")" +
+                    " UNION ALL" +
+                    // History with and without bookmark.
+                    " SELECT " + "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED) + " WHEN 0 THEN " +
+                                 qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) +  " ELSE NULL END AS " + Combined.BOOKMARK_ID + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.URL) + " AS " + Combined.URL + ", " +
+                                 // Prioritze bookmark titles over history titles, since the user may have
+                                 // customized the title for a bookmark.
+                                 "COALESCE(" + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + ", " +
+                                               qualifyColumn(TABLE_HISTORY, History.TITLE) +")" + " AS " + Combined.TITLE + ", " +
+                                 "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " +
+                                    Bookmarks.FIXED_READING_LIST_ID + " THEN " + Combined.DISPLAY_READER + " ELSE " +
+                                    Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History._ID) + " AS " + Combined.HISTORY_ID + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.VISITS) + " AS " + Combined.VISITS + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.DATE_LAST_VISITED) + " AS " + Combined.DATE_LAST_VISITED +
+                    " FROM " + TABLE_HISTORY + " LEFT OUTER JOIN " + TABLE_BOOKMARKS +
+                        " ON " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " = " + qualifyColumn(TABLE_HISTORY, History.URL) +
+                    " WHERE " + qualifyColumn(TABLE_HISTORY, History.URL) + " IS NOT NULL AND " +
+                                qualifyColumn(TABLE_HISTORY, History.IS_DELETED)  + " = 0 AND (" +
+                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE) + " IS NULL OR " +
+                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + ")" +
+                ") LEFT OUTER JOIN " + Obsolete.TABLE_IMAGES +
+                    " ON " + Combined.URL + " = " + qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.URL));
+    }
+
+    private void createCombinedWithImagesViewOn11(SQLiteDatabase db) {
+        debug("Creating " + Obsolete.VIEW_COMBINED_WITH_IMAGES + " view");
+
+        db.execSQL("CREATE VIEW IF NOT EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES + " AS" +
+                " SELECT " + Combined.BOOKMARK_ID + ", " +
+                             Combined.HISTORY_ID + ", " +
+                             // We need to return an _id column because CursorAdapter requires it for its
+                             // default implementation for the getItemId() method. However, since
+                             // we're not using this feature in the parts of the UI using this view,
+                             // we can just use 0 for all rows.
+                             "0 AS " + Combined._ID + ", " +
+                             Combined.URL + ", " +
+                             Combined.TITLE + ", " +
+                             Combined.VISITS + ", " +
+                             Combined.DISPLAY + ", " +
+                             Combined.DATE_LAST_VISITED + ", " +
+                             qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.FAVICON) + " AS " + Combined.FAVICON + ", " +
+                             qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.THUMBNAIL) + " AS " + Obsolete.Combined.THUMBNAIL +
+                " FROM (" +
+                    // Bookmarks without history.
+                    " SELECT " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) + " AS " + Combined.BOOKMARK_ID + ", " +
+                                 qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " AS " + Combined.URL + ", " +
+                                 qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + " AS " + Combined.TITLE + ", " +
+                                 "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " +
+                                    Bookmarks.FIXED_READING_LIST_ID + " THEN " + Combined.DISPLAY_READER + " ELSE " +
+                                    Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
+                                 "-1 AS " + Combined.HISTORY_ID + ", " +
+                                 "-1 AS " + Combined.VISITS + ", " +
+                                 "-1 AS " + Combined.DATE_LAST_VISITED +
+                    " FROM " + TABLE_BOOKMARKS +
+                    " WHERE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + " AND " +
+                                qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED)  + " = 0 AND " +
+                                qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) +
+                                    " NOT IN (SELECT " + History.URL + " FROM " + TABLE_HISTORY + ")" +
+                    " UNION ALL" +
+                    // History with and without bookmark.
+                    " SELECT " + "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED) + " WHEN 0 THEN " +
+                                 qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) +  " ELSE NULL END AS " + Combined.BOOKMARK_ID + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.URL) + " AS " + Combined.URL + ", " +
+                                 // Prioritze bookmark titles over history titles, since the user may have
+                                 // customized the title for a bookmark.
+                                 "COALESCE(" + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + ", " +
+                                               qualifyColumn(TABLE_HISTORY, History.TITLE) +")" + " AS " + Combined.TITLE + ", " +
+                                 // Only use DISPLAY_READER if the matching bookmark entry inside reading
+                                 // list folder is not marked as deleted.
+                                 "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED) + " WHEN 0 THEN CASE " +
+                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " + Bookmarks.FIXED_READING_LIST_ID +
+                                    " THEN " + Combined.DISPLAY_READER + " ELSE " + Combined.DISPLAY_NORMAL + " END ELSE " +
+                                    Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History._ID) + " AS " + Combined.HISTORY_ID + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.VISITS) + " AS " + Combined.VISITS + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.DATE_LAST_VISITED) + " AS " + Combined.DATE_LAST_VISITED +
+                    " FROM " + TABLE_HISTORY + " LEFT OUTER JOIN " + TABLE_BOOKMARKS +
+                        " ON " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " = " + qualifyColumn(TABLE_HISTORY, History.URL) +
+                    " WHERE " + qualifyColumn(TABLE_HISTORY, History.URL) + " IS NOT NULL AND " +
+                                qualifyColumn(TABLE_HISTORY, History.IS_DELETED)  + " = 0 AND (" +
+                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE) + " IS NULL OR " +
+                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + ") " +
+                ") LEFT OUTER JOIN " + Obsolete.TABLE_IMAGES +
+                    " ON " + Combined.URL + " = " + qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.URL));
+    }
+
+    private void createCombinedViewOn12(SQLiteDatabase db) {
+        debug("Creating " + VIEW_COMBINED + " view");
+
+        db.execSQL("CREATE VIEW IF NOT EXISTS " + VIEW_COMBINED + " AS" +
+                " SELECT " + Combined.BOOKMARK_ID + ", " +
+                             Combined.HISTORY_ID + ", " +
+                             // We need to return an _id column because CursorAdapter requires it for its
+                             // default implementation for the getItemId() method. However, since
+                             // we're not using this feature in the parts of the UI using this view,
+                             // we can just use 0 for all rows.
+                             "0 AS " + Combined._ID + ", " +
+                             Combined.URL + ", " +
+                             Combined.TITLE + ", " +
+                             Combined.VISITS + ", " +
+                             Combined.DISPLAY + ", " +
+                             Combined.DATE_LAST_VISITED +
+                " FROM (" +
+                    // Bookmarks without history.
+                    " SELECT " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) + " AS " + Combined.BOOKMARK_ID + ", " +
+                                 qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " AS " + Combined.URL + ", " +
+                                 qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + " AS " + Combined.TITLE + ", " +
+                                 "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " +
+                                    Bookmarks.FIXED_READING_LIST_ID + " THEN " + Combined.DISPLAY_READER + " ELSE " +
+                                    Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
+                                 "-1 AS " + Combined.HISTORY_ID + ", " +
+                                 "-1 AS " + Combined.VISITS + ", " +
+                                 "-1 AS " + Combined.DATE_LAST_VISITED +
+                    " FROM " + TABLE_BOOKMARKS +
+                    " WHERE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + " AND " +
+                                qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED)  + " = 0 AND " +
+                                qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) +
+                                    " NOT IN (SELECT " + History.URL + " FROM " + TABLE_HISTORY + ")" +
+                    " UNION ALL" +
+                    // History with and without bookmark.
+                    " SELECT " + "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED) + " WHEN 0 THEN " +
+                                 qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) +  " ELSE NULL END AS " + Combined.BOOKMARK_ID + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.URL) + " AS " + Combined.URL + ", " +
+                                 // Prioritze bookmark titles over history titles, since the user may have
+                                 // customized the title for a bookmark.
+                                 "COALESCE(" + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + ", " +
+                                               qualifyColumn(TABLE_HISTORY, History.TITLE) +")" + " AS " + Combined.TITLE + ", " +
+                                 // Only use DISPLAY_READER if the matching bookmark entry inside reading
+                                 // list folder is not marked as deleted.
+                                 "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED) + " WHEN 0 THEN CASE " +
+                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " + Bookmarks.FIXED_READING_LIST_ID +
+                                    " THEN " + Combined.DISPLAY_READER + " ELSE " + Combined.DISPLAY_NORMAL + " END ELSE " +
+                                    Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History._ID) + " AS " + Combined.HISTORY_ID + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.VISITS) + " AS " + Combined.VISITS + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.DATE_LAST_VISITED) + " AS " + Combined.DATE_LAST_VISITED +
+                    " FROM " + TABLE_HISTORY + " LEFT OUTER JOIN " + TABLE_BOOKMARKS +
+                        " ON " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " = " + qualifyColumn(TABLE_HISTORY, History.URL) +
+                    " WHERE " + qualifyColumn(TABLE_HISTORY, History.URL) + " IS NOT NULL AND " +
+                                qualifyColumn(TABLE_HISTORY, History.IS_DELETED)  + " = 0 AND (" +
+                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE) + " IS NULL OR " +
+                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + ") " +
+                ")");
+
+        debug("Creating " + Obsolete.VIEW_COMBINED_WITH_IMAGES + " view");
+
+        db.execSQL("CREATE VIEW IF NOT EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES + " AS" +
+                " SELECT *, " +
+                    qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.FAVICON) + " AS " + Combined.FAVICON + ", " +
+                    qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.THUMBNAIL) + " AS " + Obsolete.Combined.THUMBNAIL +
+                " FROM " + VIEW_COMBINED + " LEFT OUTER JOIN " + Obsolete.TABLE_IMAGES +
+                    " ON " + Combined.URL + " = " + qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.URL));
+    }
+
+    private void createCombinedViewOn13(SQLiteDatabase db) {
+        debug("Creating " + VIEW_COMBINED + " view");
+
+        db.execSQL("CREATE VIEW IF NOT EXISTS " + VIEW_COMBINED + " AS" +
+                " SELECT " + Combined.BOOKMARK_ID + ", " +
+                             Combined.HISTORY_ID + ", " +
+                             // We need to return an _id column because CursorAdapter requires it for its
+                             // default implementation for the getItemId() method. However, since
+                             // we're not using this feature in the parts of the UI using this view,
+                             // we can just use 0 for all rows.
+                             "0 AS " + Combined._ID + ", " +
+                             Combined.URL + ", " +
+                             Combined.TITLE + ", " +
+                             Combined.VISITS + ", " +
+                             Combined.DISPLAY + ", " +
+                             Combined.DATE_LAST_VISITED + ", " +
+                             Combined.FAVICON_ID +
+                " FROM (" +
+                    // Bookmarks without history.
+                    " SELECT " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) + " AS " + Combined.BOOKMARK_ID + ", " +
+                                 qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " AS " + Combined.URL + ", " +
+                                 qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + " AS " + Combined.TITLE + ", " +
+                                 "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " +
+                                    Bookmarks.FIXED_READING_LIST_ID + " THEN " + Combined.DISPLAY_READER + " ELSE " +
+                                    Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
+                                 "-1 AS " + Combined.HISTORY_ID + ", " +
+                                 "-1 AS " + Combined.VISITS + ", " +
+                                 "-1 AS " + Combined.DATE_LAST_VISITED + ", " +
+                                 qualifyColumn(TABLE_BOOKMARKS, Bookmarks.FAVICON_ID) + " AS " + Combined.FAVICON_ID +
+                    " FROM " + TABLE_BOOKMARKS +
+                    " WHERE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + " AND " +
+                                qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED)  + " = 0 AND " +
+                                qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) +
+                                    " NOT IN (SELECT " + History.URL + " FROM " + TABLE_HISTORY + ")" +
+                    " UNION ALL" +
+                    // History with and without bookmark.
+                    " SELECT " + "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED) + " WHEN 0 THEN " +
+                                 qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) +  " ELSE NULL END AS " + Combined.BOOKMARK_ID + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.URL) + " AS " + Combined.URL + ", " +
+                                 // Prioritize bookmark titles over history titles, since the user may have
+                                 // customized the title for a bookmark.
+                                 "COALESCE(" + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + ", " +
+                                               qualifyColumn(TABLE_HISTORY, History.TITLE) +")" + " AS " + Combined.TITLE + ", " +
+                                 // Only use DISPLAY_READER if the matching bookmark entry inside reading
+                                 // list folder is not marked as deleted.
+                                 "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED) + " WHEN 0 THEN CASE " +
+                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " + Bookmarks.FIXED_READING_LIST_ID +
+                                    " THEN " + Combined.DISPLAY_READER + " ELSE " + Combined.DISPLAY_NORMAL + " END ELSE " +
+                                    Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History._ID) + " AS " + Combined.HISTORY_ID + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.VISITS) + " AS " + Combined.VISITS + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.DATE_LAST_VISITED) + " AS " + Combined.DATE_LAST_VISITED + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.FAVICON_ID) + " AS " + Combined.FAVICON_ID +
+                    " FROM " + TABLE_HISTORY + " LEFT OUTER JOIN " + TABLE_BOOKMARKS +
+                        " ON " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " = " + qualifyColumn(TABLE_HISTORY, History.URL) +
+                    " WHERE " + qualifyColumn(TABLE_HISTORY, History.URL) + " IS NOT NULL AND " +
+                                qualifyColumn(TABLE_HISTORY, History.IS_DELETED)  + " = 0 AND (" +
+                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE) + " IS NULL OR " +
+                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + ") " +
+                ")");
+
+        debug("Creating " + VIEW_COMBINED_WITH_FAVICONS + " view");
+
+        db.execSQL("CREATE VIEW IF NOT EXISTS " + VIEW_COMBINED_WITH_FAVICONS + " AS" +
+                " SELECT " + qualifyColumn(VIEW_COMBINED, "*") + ", " +
+                    qualifyColumn(TABLE_FAVICONS, Favicons.URL) + " AS " + Combined.FAVICON_URL + ", " +
+                    qualifyColumn(TABLE_FAVICONS, Favicons.DATA) + " AS " + Combined.FAVICON +
+                " FROM " + VIEW_COMBINED + " LEFT OUTER JOIN " + TABLE_FAVICONS +
+                    " ON " + Combined.FAVICON_ID + " = " + qualifyColumn(TABLE_FAVICONS, Favicons._ID));
+    }
+
+    private void createCombinedViewOn16(SQLiteDatabase db) {
+        debug("Creating " + VIEW_COMBINED + " view");
+
+        db.execSQL("CREATE VIEW IF NOT EXISTS " + VIEW_COMBINED + " AS" +
+                " SELECT " + Combined.BOOKMARK_ID + ", " +
+                             Combined.HISTORY_ID + ", " +
+                             // We need to return an _id column because CursorAdapter requires it for its
+                             // default implementation for the getItemId() method. However, since
+                             // we're not using this feature in the parts of the UI using this view,
+                             // we can just use 0 for all rows.
+                             "0 AS " + Combined._ID + ", " +
+                             Combined.URL + ", " +
+                             Combined.TITLE + ", " +
+                             Combined.VISITS + ", " +
+                             Combined.DISPLAY + ", " +
+                             Combined.DATE_LAST_VISITED + ", " +
+                             Combined.FAVICON_ID +
+                " FROM (" +
+                    // Bookmarks without history.
+                    " SELECT " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) + " AS " + Combined.BOOKMARK_ID + ", " +
+                                 qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " AS " + Combined.URL + ", " +
+                                 qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + " AS " + Combined.TITLE + ", " +
+                                 "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " +
+                                    Bookmarks.FIXED_READING_LIST_ID + " THEN " + Combined.DISPLAY_READER + " ELSE " +
+                                    Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
+                                 "-1 AS " + Combined.HISTORY_ID + ", " +
+                                 "-1 AS " + Combined.VISITS + ", " +
+                                 "-1 AS " + Combined.DATE_LAST_VISITED + ", " +
+                                 qualifyColumn(TABLE_BOOKMARKS, Bookmarks.FAVICON_ID) + " AS " + Combined.FAVICON_ID +
+                    " FROM " + TABLE_BOOKMARKS +
+                    " WHERE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + " AND " +
+                                // Ignore pinned bookmarks.
+                                qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT)  + " <> " + Bookmarks.FIXED_PINNED_LIST_ID + " AND " +
+                                qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED)  + " = 0 AND " +
+                                qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) +
+                                    " NOT IN (SELECT " + History.URL + " FROM " + TABLE_HISTORY + ")" +
+                    " UNION ALL" +
+                    // History with and without bookmark.
+                    " SELECT " + "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED) + " WHEN 0 THEN " +
+                                    // Give pinned bookmarks a NULL ID so that they're not treated as bookmarks. We can't
+                                    // completely ignore them here because they're joined with history entries we care about.
+                                    "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " +
+                                    Bookmarks.FIXED_PINNED_LIST_ID + " THEN NULL ELSE " +
+                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) + " END " +
+                                 "ELSE NULL END AS " + Combined.BOOKMARK_ID + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.URL) + " AS " + Combined.URL + ", " +
+                                 // Prioritize bookmark titles over history titles, since the user may have
+                                 // customized the title for a bookmark.
+                                 "COALESCE(" + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + ", " +
+                                               qualifyColumn(TABLE_HISTORY, History.TITLE) +")" + " AS " + Combined.TITLE + ", " +
+                                 // Only use DISPLAY_READER if the matching bookmark entry inside reading
+                                 // list folder is not marked as deleted.
+                                 "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED) + " WHEN 0 THEN CASE " +
+                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " + Bookmarks.FIXED_READING_LIST_ID +
+                                    " THEN " + Combined.DISPLAY_READER + " ELSE " + Combined.DISPLAY_NORMAL + " END ELSE " +
+                                    Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History._ID) + " AS " + Combined.HISTORY_ID + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.VISITS) + " AS " + Combined.VISITS + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.DATE_LAST_VISITED) + " AS " + Combined.DATE_LAST_VISITED + ", " +
+                                 qualifyColumn(TABLE_HISTORY, History.FAVICON_ID) + " AS " + Combined.FAVICON_ID +
+                    " FROM " + TABLE_HISTORY + " LEFT OUTER JOIN " + TABLE_BOOKMARKS +
+                        " ON " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " = " + qualifyColumn(TABLE_HISTORY, History.URL) +
+                    " WHERE " + qualifyColumn(TABLE_HISTORY, History.URL) + " IS NOT NULL AND " +
+                                qualifyColumn(TABLE_HISTORY, History.IS_DELETED)  + " = 0 AND (" +
+                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE) + " IS NULL OR " +
+                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + ") " +
+                ")");
+
+        debug("Creating " + VIEW_COMBINED_WITH_FAVICONS + " view");
+
+        db.execSQL("CREATE VIEW IF NOT EXISTS " + VIEW_COMBINED_WITH_FAVICONS + " AS" +
+                " SELECT " + qualifyColumn(VIEW_COMBINED, "*") + ", " +
+                    qualifyColumn(TABLE_FAVICONS, Favicons.URL) + " AS " + Combined.FAVICON_URL + ", " +
+                    qualifyColumn(TABLE_FAVICONS, Favicons.DATA) + " AS " + Combined.FAVICON +
+                " FROM " + VIEW_COMBINED + " LEFT OUTER JOIN " + TABLE_FAVICONS +
+                    " ON " + Combined.FAVICON_ID + " = " + qualifyColumn(TABLE_FAVICONS, Favicons._ID));
+    }
+
+    @Override
+    public void onCreate(SQLiteDatabase db) {
+        debug("Creating browser.db: " + db.getPath());
+
+        createBookmarksTableOn13(db);
+        createHistoryTableOn13(db);
+        createFaviconsTable(db);
+        createThumbnailsTable(db);
+
+        createBookmarksWithFaviconsView(db);
+        createHistoryWithFaviconsView(db);
+        createCombinedViewOn16(db);
+
+        createOrUpdateSpecialFolder(db, Bookmarks.PLACES_FOLDER_GUID,
+            R.string.bookmarks_folder_places, 0);
+
+        createOrUpdateAllSpecialFolders(db);
+
+        // Create distribution bookmarks before our own default bookmarks
+        int pos = createDistributionBookmarks(db);
+        createDefaultBookmarks(db, pos);
+    }
+
+    private String getLocalizedProperty(JSONObject bookmark, String property, Locale locale) throws JSONException {
+        // Try the full locale
+        String fullLocale = property + "." + locale.toString();
+        if (bookmark.has(fullLocale)) {
+            return bookmark.getString(fullLocale);
+        }
+        // Try without a variant
+        if (!TextUtils.isEmpty(locale.getVariant())) {
+            String noVariant = fullLocale.substring(0, fullLocale.lastIndexOf("_"));
+            if (bookmark.has(noVariant)) {
+                return bookmark.getString(noVariant);
+            }
+        }
+        // Try just the language
+        String lang = property + "." + locale.getLanguage();
+        if (bookmark.has(lang)) {
+            return bookmark.getString(lang);
+        }
+        // Default to the non-localized property name
+        return bookmark.getString(property);
+    }
+
+    // Returns the number of bookmarks inserted in the db
+    private int createDistributionBookmarks(SQLiteDatabase db) {
+        JSONArray bookmarks = Distribution.getBookmarks(mContext);
+        if (bookmarks == null) {
+            return 0;
+        }
+
+        Locale locale = Locale.getDefault();
+        int pos = 0;
+        Integer mobileFolderId = getMobileFolderId(db);
+        if (mobileFolderId == null) {
+            Log.e(LOGTAG, "Error creating distribution bookmarks: mobileFolderId is null");
+            return 0;
+        }
+
+        for (int i = 0; i < bookmarks.length(); i++) {
+            try {
+                final JSONObject bookmark = bookmarks.getJSONObject(i);
+
+                String title = getLocalizedProperty(bookmark, "title", locale);
+                final String url = getLocalizedProperty(bookmark, "url", locale);
+                createBookmark(db, title, url, pos, mobileFolderId);
+
+                if (bookmark.has("pinned")) {
+                    try {
+                        // Create a fake bookmark in the hidden pinned folder to pin bookmark
+                        // to about:home top sites. Pass pos as the pinned position to pin
+                        // sites in the order that bookmarks are specified in bookmarks.json.
+                        if (bookmark.getBoolean("pinned")) {
+                            createBookmark(db, title, url, pos, Bookmarks.FIXED_PINNED_LIST_ID);
+                        }
+                    } catch (JSONException e) {
+                        Log.e(LOGTAG, "Error pinning bookmark to top sites", e);
+                    }
+                }
+
+                pos++;
+
+                // return early if there is no icon for this bookmark
+                if (!bookmark.has("icon")) {
+                    continue;
+                }
+
+                // create icons in a separate thread to avoid blocking about:home on startup
+                ThreadUtils.postToBackgroundThread(new Runnable() {
+                    @Override
+                    public void run() {
+                        SQLiteDatabase db = getWritableDatabase();
+                        try {
+                            String iconData = bookmark.getString("icon");
+                            Bitmap icon = BitmapUtils.getBitmapFromDataURI(iconData);
+                            if (icon != null) {
+                                createFavicon(db, url, icon);
+                            }
+                        } catch (JSONException e) {
+                            Log.e(LOGTAG, "Error creating distribution bookmark icon", e);
+                        }
+                    }
+                });
+            } catch (JSONException e) {
+                Log.e(LOGTAG, "Error creating distribution bookmark", e);
+            }
+        }
+        return pos;
+    }
+
+    // Inserts default bookmarks, starting at a specified position
+    private void createDefaultBookmarks(SQLiteDatabase db, int pos) {
+        Class<?> stringsClass = R.string.class;
+        Field[] fields = stringsClass.getFields();
+        Pattern p = Pattern.compile("^bookmarkdefaults_title_");
+
+        Integer mobileFolderId = getMobileFolderId(db);
+        if (mobileFolderId == null) {
+            Log.e(LOGTAG, "Error creating default bookmarks: mobileFolderId is null");
+            return;
+        }
+
+        for (int i = 0; i < fields.length; i++) {
+            final String name = fields[i].getName();
+            Matcher m = p.matcher(name);
+            if (!m.find()) {
+                continue;
+            }
+            try {
+                int titleid = fields[i].getInt(null);
+                String title = mContext.getString(titleid);
+
+                Field urlField = stringsClass.getField(name.replace("_title_", "_url_"));
+                int urlId = urlField.getInt(null);
+                final String url = mContext.getString(urlId);
+                createBookmark(db, title, url, pos, mobileFolderId);
+
+                // create icons in a separate thread to avoid blocking about:home on startup
+                ThreadUtils.postToBackgroundThread(new Runnable() {
+                    @Override
+                    public void run() {
+                        SQLiteDatabase db = getWritableDatabase();
+                        Bitmap icon = getDefaultFaviconFromPath(name);
+                        if (icon == null) {
+                            icon = getDefaultFaviconFromDrawable(name);
+                        }
+                        if (icon != null) {
+                            createFavicon(db, url, icon);
+                        }
+                    }
+                });
+                pos++;
+            } catch (java.lang.IllegalAccessException ex) {
+                Log.e(LOGTAG, "Can't create bookmark " + name, ex);
+            } catch (java.lang.NoSuchFieldException ex) {
+                Log.e(LOGTAG, "Can't create bookmark " + name, ex);
+            }
+        }
+    }
+
+    private void createBookmark(SQLiteDatabase db, String title, String url, int pos, int parent) {
+        ContentValues bookmarkValues = new ContentValues();
+        bookmarkValues.put(Bookmarks.PARENT, parent);
+
+        long now = System.currentTimeMillis();
+        bookmarkValues.put(Bookmarks.DATE_CREATED, now);
+        bookmarkValues.put(Bookmarks.DATE_MODIFIED, now);
+
+        bookmarkValues.put(Bookmarks.TITLE, title);
+        bookmarkValues.put(Bookmarks.URL, url);
+        bookmarkValues.put(Bookmarks.GUID, Utils.generateGuid());
+        bookmarkValues.put(Bookmarks.POSITION, pos);
+        db.insertOrThrow(TABLE_BOOKMARKS, Bookmarks.TITLE, bookmarkValues);
+    }
+
+    private void createFavicon(SQLiteDatabase db, String url, Bitmap icon) {
+        ByteArrayOutputStream stream = new ByteArrayOutputStream();
+
+        ContentValues iconValues = new ContentValues();
+        iconValues.put(Favicons.PAGE_URL, url);
+
+        byte[] data = null;
+        if (icon.compress(Bitmap.CompressFormat.PNG, 100, stream)) {
+            data = stream.toByteArray();
+        } else {
+            Log.w(LOGTAG, "Favicon compression failed.");
+        }
+        iconValues.put(Favicons.DATA, data);
+
+        insertFavicon(db, iconValues);
+    }
+
+    private Bitmap getDefaultFaviconFromPath(String name) {
+        Class<?> stringClass = R.string.class;
+        try {
+            // Look for a drawable with the id R.drawable.bookmarkdefaults_favicon_*
+            Field faviconField = stringClass.getField(name.replace("_title_", "_favicon_"));
+            if (faviconField == null) {
+                return null;
+            }
+            int faviconId = faviconField.getInt(null);
+            String path = mContext.getString(faviconId);
+
+            String apkPath = mContext.getPackageResourcePath();
+            File apkFile = new File(apkPath);
+            String bitmapPath = "jar:jar:" + apkFile.toURI() + "!/" + AppConstants.OMNIJAR_NAME + "!/" + path;
+            return GeckoJarReader.getBitmap(mContext.getResources(), bitmapPath);
+        } catch (java.lang.IllegalAccessException ex) {
+            Log.e(LOGTAG, "[Path] Can't create favicon " + name, ex);
+        } catch (java.lang.NoSuchFieldException ex) {
+            // If the field does not exist, that means we intend to load via a drawable
+        }
+        return null;
+    }
+
+    private Bitmap getDefaultFaviconFromDrawable(String name) {
+        Class<?> drawablesClass = R.drawable.class;
+        try {
+            // Look for a drawable with the id R.drawable.bookmarkdefaults_favicon_*
+            Field faviconField = drawablesClass.getField(name.replace("_title_", "_favicon_"));
+            if (faviconField == null) {
+                return null;
+            }
+            int faviconId = faviconField.getInt(null);
+            return BitmapUtils.decodeResource(mContext, faviconId);
+        } catch (java.lang.IllegalAccessException ex) {
+            Log.e(LOGTAG, "[Drawable] Can't create favicon " + name, ex);
+        } catch (java.lang.NoSuchFieldException ex) {
+            // If the field does not exist, that means we intend to load via a file path
+        }
+        return null;
+    }
+
+    private void createOrUpdateAllSpecialFolders(SQLiteDatabase db) {
+        createOrUpdateSpecialFolder(db, Bookmarks.MOBILE_FOLDER_GUID,
+            R.string.bookmarks_folder_mobile, 0);
+        createOrUpdateSpecialFolder(db, Bookmarks.TOOLBAR_FOLDER_GUID,
+            R.string.bookmarks_folder_toolbar, 1);
+        createOrUpdateSpecialFolder(db, Bookmarks.MENU_FOLDER_GUID,
+            R.string.bookmarks_folder_menu, 2);
+        createOrUpdateSpecialFolder(db, Bookmarks.TAGS_FOLDER_GUID,
+            R.string.bookmarks_folder_tags, 3);
+        createOrUpdateSpecialFolder(db, Bookmarks.UNFILED_FOLDER_GUID,
+            R.string.bookmarks_folder_unfiled, 4);
+        createOrUpdateSpecialFolder(db, Bookmarks.READING_LIST_FOLDER_GUID,
+            R.string.bookmarks_folder_reading_list, 5);
+        createOrUpdateSpecialFolder(db, Bookmarks.PINNED_FOLDER_GUID,
+            R.string.bookmarks_folder_pinned, 6);
+    }
+
+    private void createOrUpdateSpecialFolder(SQLiteDatabase db,
+            String guid, int titleId, int position) {
+        ContentValues values = new ContentValues();
+        values.put(Bookmarks.GUID, guid);
+        values.put(Bookmarks.TYPE, Bookmarks.TYPE_FOLDER);
+        values.put(Bookmarks.POSITION, position);
+
+        if (guid.equals(Bookmarks.PLACES_FOLDER_GUID))
+            values.put(Bookmarks._ID, Bookmarks.FIXED_ROOT_ID);
+        else if (guid.equals(Bookmarks.READING_LIST_FOLDER_GUID))
+            values.put(Bookmarks._ID, Bookmarks.FIXED_READING_LIST_ID);
+        else if (guid.equals(Bookmarks.PINNED_FOLDER_GUID))
+            values.put(Bookmarks._ID, Bookmarks.FIXED_PINNED_LIST_ID);
+
+        // Set the parent to 0, which sync assumes is the root
+        values.put(Bookmarks.PARENT, Bookmarks.FIXED_ROOT_ID);
+
+        String title = mContext.getResources().getString(titleId);
+        values.put(Bookmarks.TITLE, title);
+
+        long now = System.currentTimeMillis();
+        values.put(Bookmarks.DATE_CREATED, now);
+        values.put(Bookmarks.DATE_MODIFIED, now);
+
+        int updated = db.update(TABLE_BOOKMARKS, values,
+                                Bookmarks.GUID + " = ?",
+                                new String[] { guid });
+
+        if (updated == 0) {
+            db.insert(TABLE_BOOKMARKS, Bookmarks.GUID, values);
+            debug("Inserted special folder: " + guid);
+        } else {
+            debug("Updated special folder: " + guid);
+        }
+    }
+
+    private boolean isSpecialFolder(ContentValues values) {
+        String guid = values.getAsString(Bookmarks.GUID);
+        if (guid == null)
+            return false;
+
+        return guid.equals(Bookmarks.MOBILE_FOLDER_GUID) ||
+               guid.equals(Bookmarks.MENU_FOLDER_GUID) ||
+               guid.equals(Bookmarks.TOOLBAR_FOLDER_GUID) ||
+               guid.equals(Bookmarks.UNFILED_FOLDER_GUID) ||
+               guid.equals(Bookmarks.TAGS_FOLDER_GUID);
+    }
+
+    private void migrateBookmarkFolder(SQLiteDatabase db, int folderId,
+            BookmarkMigrator migrator) {
+        Cursor c = null;
+
+        debug("Migrating bookmark folder with id = " + folderId);
+
+        String selection = Bookmarks.PARENT + " = " + folderId;
+        String[] selectionArgs = null;
+
+        boolean isRootFolder = (folderId == Bookmarks.FIXED_ROOT_ID);
+
+        // If we're loading the root folder, we have to account for
+        // any previously created special folder that was created without
+        // setting a parent id (e.g. mobile folder) and making sure we're
+        // not adding any infinite recursion as root's parent is root itself.
+        if (isRootFolder) {
+            selection = Bookmarks.GUID + " != ?" + " AND (" +
+                        selection + " OR " + Bookmarks.PARENT + " = NULL)";
+            selectionArgs = new String[] { Bookmarks.PLACES_FOLDER_GUID };
+        }
+
+        List<Integer> subFolders = new ArrayList<Integer>();
+        List<ContentValues> invalidSpecialEntries = new ArrayList<ContentValues>();
+
+        try {
+            c = db.query(TABLE_BOOKMARKS_TMP,
+                         null,
+                         selection,
+                         selectionArgs,
+                         null, null, null);
+
+            // The key point here is that bookmarks should be added in
+            // parent order to avoid any problems with the foreign key
+            // in Bookmarks.PARENT.
+            while (c.moveToNext()) {
+                ContentValues values = new ContentValues();
+
+                // We're using a null projection in the query which
+                // means we're getting all columns from the table.
+                // It's safe to simply transform the row into the
+                // values to be inserted on the new table.
+                DatabaseUtils.cursorRowToContentValues(c, values);
+
+                boolean isSpecialFolder = isSpecialFolder(values);
+
+                // The mobile folder used to be created with PARENT = NULL.
+                // We want fix that here.
+                if (values.getAsLong(Bookmarks.PARENT) == null && isSpecialFolder)
+                    values.put(Bookmarks.PARENT, Bookmarks.FIXED_ROOT_ID);
+
+                if (isRootFolder && !isSpecialFolder) {
+                    invalidSpecialEntries.add(values);
+                    continue;
+                }
+
+                if (migrator != null)
+                    migrator.updateForNewTable(values);
+
+                debug("Migrating bookmark: " + values.getAsString(Bookmarks.TITLE));
+                db.insert(TABLE_BOOKMARKS, Bookmarks.URL, values);
+
+                Integer type = values.getAsInteger(Bookmarks.TYPE);
+                if (type != null && type == Bookmarks.TYPE_FOLDER)
+                    subFolders.add(values.getAsInteger(Bookmarks._ID));
+            }
+        } finally {
+            if (c != null)
+                c.close();
+        }
+
+        // At this point is safe to assume that the mobile folder is
+        // in the new table given that we've always created it on
+        // database creation time.
+        final int nInvalidSpecialEntries = invalidSpecialEntries.size();
+        if (nInvalidSpecialEntries > 0) {
+            Integer mobileFolderId = getMobileFolderId(db);
+            if (mobileFolderId == null) {
+                Log.e(LOGTAG, "Error migrating invalid special folder entries: mobile folder id is null");
+                return;
+            }
+
+            debug("Found " + nInvalidSpecialEntries + " invalid special folder entries");
+            for (int i = 0; i < nInvalidSpecialEntries; i++) {
+                ContentValues values = invalidSpecialEntries.get(i);
+                values.put(Bookmarks.PARENT, mobileFolderId);
+
+                db.insert(TABLE_BOOKMARKS, Bookmarks.URL, values);
+            }
+        }
+
+        final int nSubFolders = subFolders.size();
+        for (int i = 0; i < nSubFolders; i++) {
+            int subFolderId = subFolders.get(i);
+            migrateBookmarkFolder(db, subFolderId, migrator);
+        }
+    }
+
+    private void migrateBookmarksTable(SQLiteDatabase db) {
+        migrateBookmarksTable(db, null);
+    }
+
+    private void migrateBookmarksTable(SQLiteDatabase db, BookmarkMigrator migrator) {
+        debug("Renaming bookmarks table to " + TABLE_BOOKMARKS_TMP);
+        db.execSQL("ALTER TABLE " + TABLE_BOOKMARKS +
+                   " RENAME TO " + TABLE_BOOKMARKS_TMP);
+
+        debug("Dropping views and indexes related to " + TABLE_BOOKMARKS);
+        db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_BOOKMARKS_WITH_IMAGES);
+
+        db.execSQL("DROP INDEX IF EXISTS bookmarks_url_index");
+        db.execSQL("DROP INDEX IF EXISTS bookmarks_type_deleted_index");
+        db.execSQL("DROP INDEX IF EXISTS bookmarks_guid_index");
+        db.execSQL("DROP INDEX IF EXISTS bookmarks_modified_index");
+
+        createBookmarksTable(db);
+        createBookmarksWithImagesView(db);
+
+        createOrUpdateSpecialFolder(db, Bookmarks.PLACES_FOLDER_GUID,
+            R.string.bookmarks_folder_places, 0);
+
+        migrateBookmarkFolder(db, Bookmarks.FIXED_ROOT_ID, migrator);
+
+        // Ensure all special folders exist and have the
+        // right folder hierarchy.
+        createOrUpdateAllSpecialFolders(db);
+
+        debug("Dropping bookmarks temporary table");
+        db.execSQL("DROP TABLE IF EXISTS " + TABLE_BOOKMARKS_TMP);
+    }
+
+
+    private void migrateHistoryTable(SQLiteDatabase db) {
+        debug("Renaming history table to " + TABLE_HISTORY_TMP);
+        db.execSQL("ALTER TABLE " + TABLE_HISTORY +
+                   " RENAME TO " + TABLE_HISTORY_TMP);
+
+        debug("Dropping views and indexes related to " + TABLE_HISTORY);
+        db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_HISTORY_WITH_IMAGES);
+        db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
+
+        db.execSQL("DROP INDEX IF EXISTS history_url_index");
+        db.execSQL("DROP INDEX IF EXISTS history_guid_index");
+        db.execSQL("DROP INDEX IF EXISTS history_modified_index");
+        db.execSQL("DROP INDEX IF EXISTS history_visited_index");
+
+        createHistoryTable(db);
+        createHistoryWithImagesView(db);
+        createCombinedWithImagesView(db);
+
+        db.execSQL("INSERT INTO " + TABLE_HISTORY + " SELECT * FROM " + TABLE_HISTORY_TMP);
+
+        debug("Dropping history temporary table");
+        db.execSQL("DROP TABLE IF EXISTS " + TABLE_HISTORY_TMP);
+    }
+
+    private void migrateImagesTable(SQLiteDatabase db) {
+        debug("Renaming images table to " + TABLE_IMAGES_TMP);
+        db.execSQL("ALTER TABLE " + Obsolete.TABLE_IMAGES +
+                   " RENAME TO " + TABLE_IMAGES_TMP);
+
+        debug("Dropping views and indexes related to " + Obsolete.TABLE_IMAGES);
+        db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_HISTORY_WITH_IMAGES);
+        db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
+
+        db.execSQL("DROP INDEX IF EXISTS images_url_index");
+        db.execSQL("DROP INDEX IF EXISTS images_guid_index");
+        db.execSQL("DROP INDEX IF EXISTS images_modified_index");
+
+        createImagesTable(db);
+        createHistoryWithImagesView(db);
+        createCombinedWithImagesView(db);
+
+        db.execSQL("INSERT INTO " + Obsolete.TABLE_IMAGES + " SELECT * FROM " + TABLE_IMAGES_TMP);
+
+        debug("Dropping images temporary table");
+        db.execSQL("DROP TABLE IF EXISTS " + TABLE_IMAGES_TMP);
+    }
+
+    private void upgradeDatabaseFrom1to2(SQLiteDatabase db) {
+        migrateBookmarksTable(db);
+    }
+
+    private void upgradeDatabaseFrom2to3(SQLiteDatabase db) {
+        debug("Dropping view: " + Obsolete.VIEW_BOOKMARKS_WITH_IMAGES);
+        db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_BOOKMARKS_WITH_IMAGES);
+
+        createBookmarksWithImagesView(db);
+
+        debug("Dropping view: " + Obsolete.VIEW_HISTORY_WITH_IMAGES);
+        db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_HISTORY_WITH_IMAGES);
+
+        createHistoryWithImagesView(db);
+    }
+
+    private void upgradeDatabaseFrom3to4(SQLiteDatabase db) {
+        migrateBookmarksTable(db, new BookmarkMigrator3to4());
+    }
+
+    private void upgradeDatabaseFrom4to5(SQLiteDatabase db) {
+        createCombinedWithImagesView(db);
+    }
+
+    private void upgradeDatabaseFrom5to6(SQLiteDatabase db) {
+        debug("Dropping view: " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
+        db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
+
+        createCombinedWithImagesView(db);
+    }
+
+    private void upgradeDatabaseFrom6to7(SQLiteDatabase db) {
+        debug("Removing history visits with NULL GUIDs");
+        db.execSQL("DELETE FROM " + TABLE_HISTORY + " WHERE " + History.GUID + " IS NULL");
+
+        debug("Update images with NULL GUIDs");
+        String[] columns = new String[] { Obsolete.Images._ID };
+        Cursor cursor = null;
+        try {
+          cursor = db.query(Obsolete.TABLE_IMAGES, columns, Obsolete.Images.GUID + " IS NULL", null, null ,null, null, null);
+          ContentValues values = new ContentValues();
+          if (cursor.moveToFirst()) {
+              do {
+                  values.put(Obsolete.Images.GUID, Utils.generateGuid());
+                  db.update(Obsolete.TABLE_IMAGES, values, Obsolete.Images._ID + " = ?", new String[] {
+                    cursor.getString(cursor.getColumnIndexOrThrow(Obsolete.Images._ID))
+                  });
+              } while (cursor.moveToNext());
+          }
+        } finally {
+          if (cursor != null)
+            cursor.close();
+        }
+
+        migrateBookmarksTable(db);
+        migrateHistoryTable(db);
+        migrateImagesTable(db);
+    }
+
+    private void upgradeDatabaseFrom7to8(SQLiteDatabase db) {
+        debug("Combining history entries with the same URL");
+
+        final String TABLE_DUPES = "duped_urls";
+        final String TOTAL = "total";
+        final String LATEST = "latest";
+        final String WINNER = "winner";
+
+        db.execSQL("CREATE TEMP TABLE " + TABLE_DUPES + " AS" +
+                  " SELECT " + History.URL + ", " +
+                              "SUM(" + History.VISITS + ") AS " + TOTAL + ", " +
+                              "MAX(" + History.DATE_MODIFIED + ") AS " + LATEST + ", " +
+                              "MAX(" + History._ID + ") AS " + WINNER +
+                  " FROM " + TABLE_HISTORY +
+                  " GROUP BY " + History.URL +
+                  " HAVING count(" + History.URL + ") > 1");
+
+        db.execSQL("CREATE UNIQUE INDEX " + TABLE_DUPES + "_url_index ON " +
+                   TABLE_DUPES + " (" + History.URL + ")");
+
+        final String fromClause = " FROM " + TABLE_DUPES + " WHERE " +
+                                  qualifyColumn(TABLE_DUPES, History.URL) + " = " +
+                                  qualifyColumn(TABLE_HISTORY, History.URL);
+
+        db.execSQL("UPDATE " + TABLE_HISTORY +
+                  " SET " + History.VISITS + " = (SELECT " + TOTAL + fromClause + "), " +
+                            History.DATE_MODIFIED + " = (SELECT " + LATEST + fromClause + "), " +
+                            History.IS_DELETED + " = " +
+                                "(" + History._ID + " <> (SELECT " + WINNER + fromClause + "))" +
+                  " WHERE " + History.URL + " IN (SELECT " + History.URL + " FROM " + TABLE_DUPES + ")");
+
+        db.execSQL("DROP TABLE " + TABLE_DUPES);
+    }
+
+    private void upgradeDatabaseFrom8to9(SQLiteDatabase db) {
+        createOrUpdateSpecialFolder(db, Bookmarks.READING_LIST_FOLDER_GUID,
+            R.string.bookmarks_folder_reading_list, 5);
+
+        debug("Dropping view: " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
+        db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
+
+        createCombinedWithImagesViewOn9(db);
+    }
+
+    private void upgradeDatabaseFrom9to10(SQLiteDatabase db) {
+        debug("Dropping view: " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
+        db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
+
+        createCombinedWithImagesViewOn10(db);
+    }
+
+    private void upgradeDatabaseFrom10to11(SQLiteDatabase db) {
+        debug("Dropping view: " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
+        db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
+
+        db.execSQL("CREATE INDEX bookmarks_type_deleted_index ON " + TABLE_BOOKMARKS + "("
+                + Bookmarks.TYPE + ", " + Bookmarks.IS_DELETED + ")");
+
+        createCombinedWithImagesViewOn11(db);
+    }
+
+    private void upgradeDatabaseFrom11to12(SQLiteDatabase db) {
+        debug("Dropping view: " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
+        db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
+
+        createCombinedViewOn12(db);
+    }
+
+    private void upgradeDatabaseFrom12to13(SQLiteDatabase db) {
+        // Update images table with favicon URLs
+        SQLiteDatabase faviconsDb = null;
+        Cursor c = null;
+        try {
+            final String FAVICON_TABLE = "favicon_urls";
+            final String FAVICON_URL = "favicon_url";
+            final String FAVICON_PAGE = "page_url";
+
+            String dbPath = mContext.getDatabasePath(Obsolete.FAVICON_DB).getPath();
+            faviconsDb = SQLiteDatabase.openDatabase(dbPath, null, SQLiteDatabase.OPEN_READONLY);
+            String[] columns = new String[] { FAVICON_URL, FAVICON_PAGE };
+            c = faviconsDb.query(FAVICON_TABLE, columns, null, null, null, null, null, null);
+            int faviconIndex = c.getColumnIndexOrThrow(FAVICON_URL);
+            int pageIndex = c.getColumnIndexOrThrow(FAVICON_PAGE);
+            while (c.moveToNext()) {
+                ContentValues values = new ContentValues(1);
+                String faviconUrl = c.getString(faviconIndex);
+                String pageUrl = c.getString(pageIndex);
+                values.put(FAVICON_URL, faviconUrl);
+                db.update(Obsolete.TABLE_IMAGES, values, Obsolete.Images.URL + " = ?", new String[] { pageUrl });
+            }
+        } catch (SQLException e) {
+            // If we can't read from the database for some reason, we won't
+            // be able to import the favicon URLs. This isn't a fatal
+            // error, so continue the upgrade.
+            Log.e(LOGTAG, "Exception importing from " + Obsolete.FAVICON_DB, e);
+        } finally {
+            if (c != null)
+                c.close();
+            if (faviconsDb != null)
+                faviconsDb.close();
+        }
+
+        createFaviconsTable(db);
+
+        // Import favicons into the favicons table
+        db.execSQL("ALTER TABLE " + TABLE_HISTORY
+                + " ADD COLUMN " + History.FAVICON_ID + " INTEGER");
+        db.execSQL("ALTER TABLE " + TABLE_BOOKMARKS
+                + " ADD COLUMN " + Bookmarks.FAVICON_ID + " INTEGER");
+
+        try {
+            c = db.query(Obsolete.TABLE_IMAGES,
+                    new String[] {
+                        Obsolete.Images.URL,
+                        Obsolete.Images.FAVICON_URL,
+                        Obsolete.Images.FAVICON,
+                        Obsolete.Images.DATE_MODIFIED,
+                        Obsolete.Images.DATE_CREATED
+                    },
+                    Obsolete.Images.FAVICON + " IS NOT NULL",
+                    null, null, null, null);
+
+            while (c.moveToNext()) {
+                long faviconId = -1;
+                int faviconUrlIndex = c.getColumnIndexOrThrow(Obsolete.Images.FAVICON_URL);
+                String faviconUrl = null;
+                if (!c.isNull(faviconUrlIndex)) {
+                    faviconUrl = c.getString(faviconUrlIndex);
+                    Cursor c2 = null;
+                    try {
+                        c2 = db.query(TABLE_FAVICONS,
+                                new String[] { Favicons._ID },
+                                Favicons.URL + " = ?",
+                                new String[] { faviconUrl },
+                                null, null, null);
+                        if (c2.moveToFirst()) {
+                            faviconId = c2.getLong(c2.getColumnIndexOrThrow(Favicons._ID));
+                        }
+                    } finally {
+                        if (c2 != null)
+                            c2.close();
+                    }
+                }
+
+                if (faviconId == -1) {
+                    ContentValues values = new ContentValues(4);
+                    values.put(Favicons.URL, faviconUrl);
+                    values.put(Favicons.DATA, c.getBlob(c.getColumnIndexOrThrow(Obsolete.Images.FAVICON)));
+                    values.put(Favicons.DATE_MODIFIED, c.getLong(c.getColumnIndexOrThrow(Obsolete.Images.DATE_MODIFIED)));
+                    values.put(Favicons.DATE_CREATED, c.getLong(c.getColumnIndexOrThrow(Obsolete.Images.DATE_CREATED)));
+                    faviconId = db.insert(TABLE_FAVICONS, null, values);
+                }
+
+                ContentValues values = new ContentValues(1);
+                values.put(FaviconColumns.FAVICON_ID, faviconId);
+                db.update(TABLE_HISTORY, values, History.URL + " = ?",
+                        new String[] { c.getString(c.getColumnIndexOrThrow(Obsolete.Images.URL)) });
+                db.update(TABLE_BOOKMARKS, values, Bookmarks.URL + " = ?",
+                        new String[] { c.getString(c.getColumnIndexOrThrow(Obsolete.Images.URL)) });
+            }
+        } finally {
+            if (c != null)
+                c.close();
+        }
+
+        createThumbnailsTable(db);
+
+        // Import thumbnails into the thumbnails table
+        db.execSQL("INSERT INTO " + TABLE_THUMBNAILS + " ("
+                + Thumbnails.URL + ", "
+                + Thumbnails.DATA + ") "
+                + "SELECT " + Obsolete.Images.URL + ", " + Obsolete.Images.THUMBNAIL
+                + " FROM " + Obsolete.TABLE_IMAGES
+                + " WHERE " + Obsolete.Images.THUMBNAIL + " IS NOT NULL");
+
+        db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_BOOKMARKS_WITH_IMAGES);
+        db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_HISTORY_WITH_IMAGES);
+        db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
+        db.execSQL("DROP VIEW IF EXISTS " + VIEW_COMBINED);
+
+        createBookmarksWithFaviconsView(db);
+        createHistoryWithFaviconsView(db);
+        createCombinedViewOn13(db);
+
+        db.execSQL("DROP TABLE IF EXISTS " + Obsolete.TABLE_IMAGES);
+    }
+
+    private void upgradeDatabaseFrom13to14(SQLiteDatabase db) {
+        createOrUpdateSpecialFolder(db, Bookmarks.PINNED_FOLDER_GUID,
+            R.string.bookmarks_folder_pinned, 6);
+    }
+
+    private void upgradeDatabaseFrom14to15(SQLiteDatabase db) {
+        Cursor c = null;
+        try {
+            // Get all the pinned bookmarks
+            c = db.query(TABLE_BOOKMARKS,
+                         new String[] { Bookmarks._ID, Bookmarks.URL },
+                         Bookmarks.PARENT + " = ?",
+                         new String[] { Integer.toString(Bookmarks.FIXED_PINNED_LIST_ID) },
+                         null, null, null);
+
+            while (c.moveToNext()) {
+                // Check if this URL can be parsed as a URI with a valid scheme.
+                String url = c.getString(c.getColumnIndexOrThrow(Bookmarks.URL));
+                if (Uri.parse(url).getScheme() != null) {
+                    continue;
+                }
+
+                // If it can't, update the URL to be an encoded "user-entered" value.
+                ContentValues values = new ContentValues(1);
+                String newUrl = Uri.fromParts("user-entered", url, null).toString();
+                values.put(Bookmarks.URL, newUrl);
+                db.update(TABLE_BOOKMARKS, values, Bookmarks._ID + " = ?",
+                          new String[] { Integer.toString(c.getInt(c.getColumnIndexOrThrow(Bookmarks._ID))) });
+            }
+        } finally {
+            if (c != null) {
+                c.close();
+            }
+        }
+    }
+
+    private void upgradeDatabaseFrom15to16(SQLiteDatabase db) {
+        db.execSQL("DROP VIEW IF EXISTS " + VIEW_COMBINED);
+        db.execSQL("DROP VIEW IF EXISTS " + VIEW_COMBINED_WITH_FAVICONS);
+
+        createCombinedViewOn16(db);
+    }
+
+    private void upgradeDatabaseFrom16to17(SQLiteDatabase db) {
+        // Purge any 0-byte favicons/thumbnails
+        try {
+            db.execSQL("DELETE FROM " + TABLE_FAVICONS +
+                    " WHERE length(" + Favicons.DATA + ") = 0");
+            db.execSQL("DELETE FROM " + TABLE_THUMBNAILS +
+                    " WHERE length(" + Thumbnails.DATA + ") = 0");
+        } catch (SQLException e) {
+            Log.e(LOGTAG, "Error purging invalid favicons or thumbnails", e);
+        }
+    }
+
+    @Override
+    public void onUpgrade(SQLiteDatabase db, int oldVersion, int newVersion) {
+        debug("Upgrading browser.db: " + db.getPath() + " from " +
+                oldVersion + " to " + newVersion);
+
+        // We have to do incremental upgrades until we reach the current
+        // database schema version.
+        for (int v = oldVersion + 1; v <= newVersion; v++) {
+            switch(v) {
+                case 2:
+                    upgradeDatabaseFrom1to2(db);
+                    break;
+
+                case 3:
+                    upgradeDatabaseFrom2to3(db);
+                    break;
+
+                case 4:
+                    upgradeDatabaseFrom3to4(db);
+                    break;
+
+                case 5:
+                    upgradeDatabaseFrom4to5(db);
+                    break;
+
+                case 6:
+                    upgradeDatabaseFrom5to6(db);
+                    break;
+
+                case 7:
+                    upgradeDatabaseFrom6to7(db);
+                    break;
+
+                case 8:
+                    upgradeDatabaseFrom7to8(db);
+                    break;
+
+                case 9:
+                    upgradeDatabaseFrom8to9(db);
+                    break;
+
+                case 10:
+                    upgradeDatabaseFrom9to10(db);
+                    break;
+
+                case 11:
+                    upgradeDatabaseFrom10to11(db);
+                    break;
+
+                case 12:
+                    upgradeDatabaseFrom11to12(db);
+                    break;
+
+                case 13:
+                    upgradeDatabaseFrom12to13(db);
+                    break;
+
+                case 14:
+                    upgradeDatabaseFrom13to14(db);
+                    break;
+
+                case 15:
+                    upgradeDatabaseFrom14to15(db);
+                    break;
+
+                case 16:
+                    upgradeDatabaseFrom15to16(db);
+                    break;
+
+                case 17:
+                    upgradeDatabaseFrom16to17(db);
+                    break;
+            }
+        }
+
+        // If an upgrade after 12->13 fails, the entire upgrade is rolled
+        // back, but we can't undo the deletion of favicon_urls.db if we
+        // delete this in step 13; therefore, we wait until all steps are
+        // complete before removing it.
+        if (oldVersion < 13 && newVersion >= 13
+                            && mContext.getDatabasePath(Obsolete.FAVICON_DB).exists()
+                            && !mContext.deleteDatabase(Obsolete.FAVICON_DB)) {
+            throw new SQLException("Could not delete " + Obsolete.FAVICON_DB);
+        }
+    }
+
+    @Override
+    public void onOpen(SQLiteDatabase db) {
+        debug("Opening browser.db: " + db.getPath());
+
+        Cursor cursor = null;
+        try {
+            cursor = db.rawQuery("PRAGMA foreign_keys=ON", null);
+        } finally {
+            if (cursor != null)
+                cursor.close();
+        }
+        cursor = null;
+        try {
+            cursor = db.rawQuery("PRAGMA synchronous=NORMAL", null);
+        } finally {
+            if (cursor != null)
+                cursor.close();
+        }
+
+        // From Honeycomb on, it's possible to run several db
+        // commands in parallel using multiple connections.
+        if (Build.VERSION.SDK_INT >= 11) {
+            db.enableWriteAheadLogging();
+            db.setLockingEnabled(false);
+        } else {
+            // Pre-Honeycomb, we can do some lesser optimizations.
+            cursor = null;
+            try {
+                cursor = db.rawQuery("PRAGMA journal_mode=PERSIST", null);
+            } finally {
+                if (cursor != null)
+                    cursor.close();
+            }
+        }
+    }
+
+    static final String qualifyColumn(String table, String column) {
+        return DBUtils.qualifyColumn(table, column);
+    }
+
+    // Calculate these once, at initialization. isLoggable is too expensive to
+    // have in-line in each log call.
+    private static boolean logDebug   = Log.isLoggable(LOGTAG, Log.DEBUG);
+    private static boolean logVerbose = Log.isLoggable(LOGTAG, Log.VERBOSE);
+    protected static void trace(String message) {
+        if (logVerbose) {
+            Log.v(LOGTAG, message);
+        }
+    }
+
+    protected static void debug(String message) {
+        if (logDebug) {
+            Log.d(LOGTAG, message);
+        }
+    }
+
+    private Integer getMobileFolderId(SQLiteDatabase db) {
+        Cursor c = null;
+
+        try {
+            c = db.query(TABLE_BOOKMARKS,
+                         mobileIdColumns,
+                         Bookmarks.GUID + " = ?",
+                         mobileIdSelectionArgs,
+                         null, null, null);
+
+            if (c == null || !c.moveToFirst())
+                return null;
+
+            return c.getInt(c.getColumnIndex(Bookmarks._ID));
+        } finally {
+            if (c != null)
+                c.close();
+        }
+    }
+
+    private long insertFavicon(SQLiteDatabase db, ContentValues values) {
+        // This method is a dupicate of BrowserProvider.insertFavicon.
+        // If changes are needed, please update both
+        String faviconUrl = values.getAsString(Favicons.URL);
+        String pageUrl = null;
+        long faviconId;
+
+        trace("Inserting favicon for URL: " + faviconUrl);
+
+        DBUtils.stripEmptyByteArray(values, Favicons.DATA);
+
+        // Extract the page URL from the ContentValues
+        if (values.containsKey(Favicons.PAGE_URL)) {
+            pageUrl = values.getAsString(Favicons.PAGE_URL);
+            values.remove(Favicons.PAGE_URL);
+        }
+
+        // If no URL is provided, insert using the default one.
+        if (TextUtils.isEmpty(faviconUrl) && !TextUtils.isEmpty(pageUrl)) {
+            values.put(Favicons.URL, org.mozilla.gecko.favicons.Favicons.guessDefaultFaviconURL(pageUrl));
+        }
+
+        long now = System.currentTimeMillis();
+        values.put(Favicons.DATE_CREATED, now);
+        values.put(Favicons.DATE_MODIFIED, now);
+        faviconId = db.insertOrThrow(TABLE_FAVICONS, null, values);
+
+        if (pageUrl != null) {
+            ContentValues updateValues = new ContentValues(1);
+            updateValues.put(FaviconColumns.FAVICON_ID, faviconId);
+            db.update(TABLE_HISTORY,
+                      updateValues,
+                      History.URL + " = ?",
+                      new String[] { pageUrl });
+            db.update(TABLE_BOOKMARKS,
+                      updateValues,
+                      Bookmarks.URL + " = ?",
+                      new String[] { pageUrl });
+        }
+
+        return faviconId;
+    }
+
+    private interface BookmarkMigrator {
+        public void updateForNewTable(ContentValues bookmark);
+    }
+
+    private class BookmarkMigrator3to4 implements BookmarkMigrator {
+        @Override
+        public void updateForNewTable(ContentValues bookmark) {
+            Integer isFolder = bookmark.getAsInteger("folder");
+            if (isFolder == null || isFolder != 1) {
+                bookmark.put(Bookmarks.TYPE, Bookmarks.TYPE_BOOKMARK);
+            } else {
+                bookmark.put(Bookmarks.TYPE, Bookmarks.TYPE_FOLDER);
+            }
+
+            bookmark.remove("folder");
+        }
+    }
+}
\ No newline at end of file
diff --git a/mobile/android/base/db/BrowserProvider.java b/mobile/android/base/db/BrowserProvider.java
index 1f8330faef0e..fc254f01ba95 100644
--- a/mobile/android/base/db/BrowserProvider.java
+++ b/mobile/android/base/db/BrowserProvider.java
@@ -5,10 +5,11 @@
 
 package org.mozilla.gecko.db;
 
-import org.mozilla.gecko.AppConstants;
-import org.mozilla.gecko.Distribution;
-import org.mozilla.gecko.GeckoProfile;
-import org.mozilla.gecko.R;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+
 import org.mozilla.gecko.db.BrowserContract.Bookmarks;
 import org.mozilla.gecko.db.BrowserContract.Combined;
 import org.mozilla.gecko.db.BrowserContract.CommonColumns;
@@ -19,18 +20,9 @@ import org.mozilla.gecko.db.BrowserContract.Schema;
 import org.mozilla.gecko.db.BrowserContract.SyncColumns;
 import org.mozilla.gecko.db.BrowserContract.Thumbnails;
 import org.mozilla.gecko.db.BrowserContract.URLColumns;
-import org.mozilla.gecko.db.PerProfileDatabases.DatabaseHelperFactory;
-import org.mozilla.gecko.gfx.BitmapUtils;
 import org.mozilla.gecko.sync.Utils;
-import org.mozilla.gecko.util.GeckoJarReader;
-import org.mozilla.gecko.util.ThreadUtils;
-
-import org.json.JSONArray;
-import org.json.JSONException;
-import org.json.JSONObject;
 
 import android.app.SearchManager;
-import android.content.ContentProvider;
 import android.content.ContentProviderOperation;
 import android.content.ContentProviderResult;
 import android.content.ContentUris;
@@ -43,35 +35,13 @@ import android.database.DatabaseUtils;
 import android.database.MatrixCursor;
 import android.database.SQLException;
 import android.database.sqlite.SQLiteDatabase;
-import android.database.sqlite.SQLiteOpenHelper;
 import android.database.sqlite.SQLiteQueryBuilder;
-import android.graphics.Bitmap;
 import android.net.Uri;
-import android.os.Build;
 import android.text.TextUtils;
 import android.util.Log;
 
-import java.io.ByteArrayOutputStream;
-import java.io.File;
-import java.lang.reflect.Field;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Locale;
-import java.util.Map;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-
-public class BrowserProvider extends ContentProvider {
+public class BrowserProvider extends TransactionalProvider<BrowserDatabaseHelper> {
     private static final String LOGTAG = "GeckoBrowserProvider";
-    private Context mContext;
-
-    private PerProfileDatabases<BrowserDatabaseHelper> mDatabases;
-
-    static final String DATABASE_NAME = "browser.db";
-
-    static final int DATABASE_VERSION = 17;
 
     // Maximum age of deleted records to be cleaned up (20 days in ms)
     static final long MAX_AGE_OF_DELETED_RECORDS = 86400000 * 20;
@@ -94,20 +64,15 @@ public class BrowserProvider extends ContentProvider {
     // Minimum number of thumbnails to keep around.
     static final int DEFAULT_EXPIRY_THUMBNAIL_COUNT = 15;
 
-    static final String TABLE_BOOKMARKS = "bookmarks";
-    static final String TABLE_HISTORY = "history";
-    static final String TABLE_FAVICONS = "favicons";
-    static final String TABLE_THUMBNAILS = "thumbnails";
+    static final String TABLE_BOOKMARKS = Bookmarks.TABLE_NAME;
+    static final String TABLE_HISTORY = History.TABLE_NAME;
+    static final String TABLE_FAVICONS = Favicons.TABLE_NAME;
+    static final String TABLE_THUMBNAILS = Thumbnails.TABLE_NAME;
 
-    static final String TABLE_BOOKMARKS_TMP = TABLE_BOOKMARKS + "_tmp";
-    static final String TABLE_HISTORY_TMP = TABLE_HISTORY + "_tmp";
-    static final String TABLE_IMAGES_TMP = Obsolete.TABLE_IMAGES + "_tmp";
-
-    static final String VIEW_COMBINED = "combined";
-
-    static final String VIEW_BOOKMARKS_WITH_FAVICONS = "bookmarks_with_favicons";
-    static final String VIEW_HISTORY_WITH_FAVICONS = "history_with_favicons";
-    static final String VIEW_COMBINED_WITH_FAVICONS = "combined_with_favicons";
+    static final String VIEW_COMBINED = Combined.VIEW_NAME;
+    static final String VIEW_BOOKMARKS_WITH_FAVICONS = Bookmarks.VIEW_WITH_FAVICONS;
+    static final String VIEW_HISTORY_WITH_FAVICONS = History.VIEW_WITH_FAVICONS;
+    static final String VIEW_COMBINED_WITH_FAVICONS = Combined.VIEW_WITH_FAVICONS;
 
     // Bookmark matches
     static final int BOOKMARKS = 100;
@@ -147,14 +112,6 @@ public class BrowserProvider extends ContentProvider {
 
     static final String DEFAULT_HISTORY_SORT_ORDER = History.DATE_LAST_VISITED + " DESC";
 
-    static final String TABLE_BOOKMARKS_JOIN_FAVICONS = TABLE_BOOKMARKS + " LEFT OUTER JOIN " +
-            TABLE_FAVICONS + " ON " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.FAVICON_ID) + " = " +
-            qualifyColumn(TABLE_FAVICONS, Favicons._ID);
-
-    static final String TABLE_HISTORY_JOIN_FAVICONS = TABLE_HISTORY + " LEFT OUTER JOIN " +
-            TABLE_FAVICONS + " ON " + qualifyColumn(TABLE_HISTORY, History.FAVICON_ID) + " = " +
-            qualifyColumn(TABLE_FAVICONS, Favicons._ID);
-
     static final UriMatcher URI_MATCHER = new UriMatcher(UriMatcher.NO_MATCH);
 
     static final Map<String, String> BOOKMARKS_PROJECTION_MAP;
@@ -165,43 +122,6 @@ public class BrowserProvider extends ContentProvider {
     static final Map<String, String> FAVICONS_PROJECTION_MAP;
     static final Map<String, String> THUMBNAILS_PROJECTION_MAP;
 
-    static final class Obsolete {
-        public static final String TABLE_IMAGES = "images";
-        public static final String VIEW_BOOKMARKS_WITH_IMAGES = "bookmarks_with_images";
-        public static final String VIEW_HISTORY_WITH_IMAGES = "history_with_images";
-        public static final String VIEW_COMBINED_WITH_IMAGES = "combined_with_images";
-
-        public static final class Images implements CommonColumns, SyncColumns {
-            private Images() {}
-
-            public static final String URL = "url_key";
-            public static final String FAVICON_URL = "favicon_url";
-            public static final String FAVICON = "favicon";
-            public static final String THUMBNAIL = "thumbnail";
-            public static final String _ID = "_id";
-            public static final String GUID = "guid";
-            public static final String DATE_CREATED = "created";
-            public static final String DATE_MODIFIED = "modified";
-            public static final String IS_DELETED = "deleted";
-        }
-
-        public static final class Combined {
-            private Combined() {}
-
-            public static final String THUMBNAIL = "thumbnail";
-        }
-
-        static final String TABLE_BOOKMARKS_JOIN_IMAGES = TABLE_BOOKMARKS + " LEFT OUTER JOIN " +
-                Obsolete.TABLE_IMAGES + " ON " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " = " +
-                qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.URL);
-
-        static final String TABLE_HISTORY_JOIN_IMAGES = TABLE_HISTORY + " LEFT OUTER JOIN " +
-                Obsolete.TABLE_IMAGES + " ON " + qualifyColumn(TABLE_HISTORY, History.URL) + " = " +
-                qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.URL);
-
-        static final String FAVICON_DB = "favicon_urls.db";
-    }
-
     static {
         // We will reuse this.
         HashMap<String, String> map;
@@ -315,24 +235,6 @@ public class BrowserProvider extends ContentProvider {
         SEARCH_SUGGEST_PROJECTION_MAP = Collections.unmodifiableMap(map);
     }
 
-    private interface BookmarkMigrator {
-        public void updateForNewTable(ContentValues bookmark);
-    }
-
-    private class BookmarkMigrator3to4 implements BookmarkMigrator {
-        @Override
-        public void updateForNewTable(ContentValues bookmark) {
-            Integer isFolder = bookmark.getAsInteger("folder");
-            if (isFolder == null || isFolder != 1) {
-                bookmark.put(Bookmarks.TYPE, Bookmarks.TYPE_BOOKMARK);
-            } else {
-                bookmark.put(Bookmarks.TYPE, Bookmarks.TYPE_FOLDER);
-            }
-
-            bookmark.remove("folder");
-        }
-    }
-
     static final String qualifyColumn(String table, String column) {
         return table + "." + column;
     }
@@ -364,1618 +266,6 @@ public class BrowserProvider extends ContentProvider {
         }
     }
 
-    final class BrowserDatabaseHelper extends SQLiteOpenHelper {
-        public BrowserDatabaseHelper(Context context, String databasePath) {
-            super(context, databasePath, null, DATABASE_VERSION);
-        }
-
-        private void createBookmarksTable(SQLiteDatabase db) {
-            debug("Creating " + TABLE_BOOKMARKS + " table");
-
-            // Android versions older than Froyo ship with an sqlite
-            // that doesn't support foreign keys.
-            String foreignKeyOnParent = null;
-            if (Build.VERSION.SDK_INT >= 8) {
-                foreignKeyOnParent = ", FOREIGN KEY (" + Bookmarks.PARENT +
-                    ") REFERENCES " + TABLE_BOOKMARKS + "(" + Bookmarks._ID + ")";
-            }
-
-            db.execSQL("CREATE TABLE " + TABLE_BOOKMARKS + "(" +
-                    Bookmarks._ID + " INTEGER PRIMARY KEY AUTOINCREMENT," +
-                    Bookmarks.TITLE + " TEXT," +
-                    Bookmarks.URL + " TEXT," +
-                    Bookmarks.TYPE + " INTEGER NOT NULL DEFAULT " + Bookmarks.TYPE_BOOKMARK + "," +
-                    Bookmarks.PARENT + " INTEGER," +
-                    Bookmarks.POSITION + " INTEGER NOT NULL," +
-                    Bookmarks.KEYWORD + " TEXT," +
-                    Bookmarks.DESCRIPTION + " TEXT," +
-                    Bookmarks.TAGS + " TEXT," +
-                    Bookmarks.DATE_CREATED + " INTEGER," +
-                    Bookmarks.DATE_MODIFIED + " INTEGER," +
-                    Bookmarks.GUID + " TEXT NOT NULL," +
-                    Bookmarks.IS_DELETED + " INTEGER NOT NULL DEFAULT 0" +
-                    (foreignKeyOnParent != null ? foreignKeyOnParent : "") +
-                    ");");
-
-            db.execSQL("CREATE INDEX bookmarks_url_index ON " + TABLE_BOOKMARKS + "("
-                    + Bookmarks.URL + ")");
-            db.execSQL("CREATE INDEX bookmarks_type_deleted_index ON " + TABLE_BOOKMARKS + "("
-                    + Bookmarks.TYPE + ", " + Bookmarks.IS_DELETED + ")");
-            db.execSQL("CREATE UNIQUE INDEX bookmarks_guid_index ON " + TABLE_BOOKMARKS + "("
-                    + Bookmarks.GUID + ")");
-            db.execSQL("CREATE INDEX bookmarks_modified_index ON " + TABLE_BOOKMARKS + "("
-                    + Bookmarks.DATE_MODIFIED + ")");
-        }
-
-        private void createBookmarksTableOn13(SQLiteDatabase db) {
-            debug("Creating " + TABLE_BOOKMARKS + " table");
-
-            // Android versions older than Froyo ship with an sqlite
-            // that doesn't support foreign keys.
-            String foreignKeyOnParent = null;
-            if (Build.VERSION.SDK_INT >= 8) {
-                foreignKeyOnParent = ", FOREIGN KEY (" + Bookmarks.PARENT +
-                    ") REFERENCES " + TABLE_BOOKMARKS + "(" + Bookmarks._ID + ")";
-            }
-
-            db.execSQL("CREATE TABLE " + TABLE_BOOKMARKS + "(" +
-                    Bookmarks._ID + " INTEGER PRIMARY KEY AUTOINCREMENT," +
-                    Bookmarks.TITLE + " TEXT," +
-                    Bookmarks.URL + " TEXT," +
-                    Bookmarks.TYPE + " INTEGER NOT NULL DEFAULT " + Bookmarks.TYPE_BOOKMARK + "," +
-                    Bookmarks.PARENT + " INTEGER," +
-                    Bookmarks.POSITION + " INTEGER NOT NULL," +
-                    Bookmarks.KEYWORD + " TEXT," +
-                    Bookmarks.DESCRIPTION + " TEXT," +
-                    Bookmarks.TAGS + " TEXT," +
-                    Bookmarks.FAVICON_ID + " INTEGER," +
-                    Bookmarks.DATE_CREATED + " INTEGER," +
-                    Bookmarks.DATE_MODIFIED + " INTEGER," +
-                    Bookmarks.GUID + " TEXT NOT NULL," +
-                    Bookmarks.IS_DELETED + " INTEGER NOT NULL DEFAULT 0" +
-                    (foreignKeyOnParent != null ? foreignKeyOnParent : "") +
-                    ");");
-
-            db.execSQL("CREATE INDEX bookmarks_url_index ON " + TABLE_BOOKMARKS + "("
-                    + Bookmarks.URL + ")");
-            db.execSQL("CREATE INDEX bookmarks_type_deleted_index ON " + TABLE_BOOKMARKS + "("
-                    + Bookmarks.TYPE + ", " + Bookmarks.IS_DELETED + ")");
-            db.execSQL("CREATE UNIQUE INDEX bookmarks_guid_index ON " + TABLE_BOOKMARKS + "("
-                    + Bookmarks.GUID + ")");
-            db.execSQL("CREATE INDEX bookmarks_modified_index ON " + TABLE_BOOKMARKS + "("
-                    + Bookmarks.DATE_MODIFIED + ")");
-        }
-
-        private void createHistoryTable(SQLiteDatabase db) {
-            debug("Creating " + TABLE_HISTORY + " table");
-            db.execSQL("CREATE TABLE " + TABLE_HISTORY + "(" +
-                    History._ID + " INTEGER PRIMARY KEY AUTOINCREMENT," +
-                    History.TITLE + " TEXT," +
-                    History.URL + " TEXT NOT NULL," +
-                    History.VISITS + " INTEGER NOT NULL DEFAULT 0," +
-                    History.DATE_LAST_VISITED + " INTEGER," +
-                    History.DATE_CREATED + " INTEGER," +
-                    History.DATE_MODIFIED + " INTEGER," +
-                    History.GUID + " TEXT NOT NULL," +
-                    History.IS_DELETED + " INTEGER NOT NULL DEFAULT 0" +
-                    ");");
-
-            db.execSQL("CREATE INDEX history_url_index ON " + TABLE_HISTORY + "("
-                    + History.URL + ")");
-            db.execSQL("CREATE UNIQUE INDEX history_guid_index ON " + TABLE_HISTORY + "("
-                    + History.GUID + ")");
-            db.execSQL("CREATE INDEX history_modified_index ON " + TABLE_HISTORY + "("
-                    + History.DATE_MODIFIED + ")");
-            db.execSQL("CREATE INDEX history_visited_index ON " + TABLE_HISTORY + "("
-                    + History.DATE_LAST_VISITED + ")");
-        }
-
-        private void createHistoryTableOn13(SQLiteDatabase db) {
-            debug("Creating " + TABLE_HISTORY + " table");
-            db.execSQL("CREATE TABLE " + TABLE_HISTORY + "(" +
-                    History._ID + " INTEGER PRIMARY KEY AUTOINCREMENT," +
-                    History.TITLE + " TEXT," +
-                    History.URL + " TEXT NOT NULL," +
-                    History.VISITS + " INTEGER NOT NULL DEFAULT 0," +
-                    History.FAVICON_ID + " INTEGER," +
-                    History.DATE_LAST_VISITED + " INTEGER," +
-                    History.DATE_CREATED + " INTEGER," +
-                    History.DATE_MODIFIED + " INTEGER," +
-                    History.GUID + " TEXT NOT NULL," +
-                    History.IS_DELETED + " INTEGER NOT NULL DEFAULT 0" +
-                    ");");
-
-            db.execSQL("CREATE INDEX history_url_index ON " + TABLE_HISTORY + "("
-                    + History.URL + ")");
-            db.execSQL("CREATE UNIQUE INDEX history_guid_index ON " + TABLE_HISTORY + "("
-                    + History.GUID + ")");
-            db.execSQL("CREATE INDEX history_modified_index ON " + TABLE_HISTORY + "("
-                    + History.DATE_MODIFIED + ")");
-            db.execSQL("CREATE INDEX history_visited_index ON " + TABLE_HISTORY + "("
-                    + History.DATE_LAST_VISITED + ")");
-        }
-
-        private void createImagesTable(SQLiteDatabase db) {
-            debug("Creating " + Obsolete.TABLE_IMAGES + " table");
-            db.execSQL("CREATE TABLE " + Obsolete.TABLE_IMAGES + " (" +
-                    Obsolete.Images._ID + " INTEGER PRIMARY KEY AUTOINCREMENT," +
-                    Obsolete.Images.URL + " TEXT UNIQUE NOT NULL," +
-                    Obsolete.Images.FAVICON + " BLOB," +
-                    Obsolete.Images.FAVICON_URL + " TEXT," +
-                    Obsolete.Images.THUMBNAIL + " BLOB," +
-                    Obsolete.Images.DATE_CREATED + " INTEGER," +
-                    Obsolete.Images.DATE_MODIFIED + " INTEGER," +
-                    Obsolete.Images.GUID + " TEXT NOT NULL," +
-                    Obsolete.Images.IS_DELETED + " INTEGER NOT NULL DEFAULT 0" +
-                    ");");
-
-            db.execSQL("CREATE INDEX images_url_index ON " + Obsolete.TABLE_IMAGES + "("
-                    + Obsolete.Images.URL + ")");
-            db.execSQL("CREATE UNIQUE INDEX images_guid_index ON " + Obsolete.TABLE_IMAGES + "("
-                    + Obsolete.Images.GUID + ")");
-            db.execSQL("CREATE INDEX images_modified_index ON " + Obsolete.TABLE_IMAGES + "("
-                    + Obsolete.Images.DATE_MODIFIED + ")");
-        }
-
-        private void createFaviconsTable(SQLiteDatabase db) {
-            debug("Creating " + TABLE_FAVICONS + " table");
-            db.execSQL("CREATE TABLE " + TABLE_FAVICONS + " (" +
-                    Favicons._ID + " INTEGER PRIMARY KEY AUTOINCREMENT," +
-                    Favicons.URL + " TEXT UNIQUE," +
-                    Favicons.DATA + " BLOB," +
-                    Favicons.DATE_CREATED + " INTEGER," +
-                    Favicons.DATE_MODIFIED + " INTEGER" +
-                    ");");
-
-            db.execSQL("CREATE INDEX favicons_url_index ON " + TABLE_FAVICONS + "("
-                    + Favicons.URL + ")");
-            db.execSQL("CREATE INDEX favicons_modified_index ON " + TABLE_FAVICONS + "("
-                    + Favicons.DATE_MODIFIED + ")");
-        }
-
-        private void createThumbnailsTable(SQLiteDatabase db) {
-            debug("Creating " + TABLE_THUMBNAILS + " table");
-            db.execSQL("CREATE TABLE " + TABLE_THUMBNAILS + " (" +
-                    Thumbnails._ID + " INTEGER PRIMARY KEY AUTOINCREMENT," +
-                    Thumbnails.URL + " TEXT UNIQUE," +
-                    Thumbnails.DATA + " BLOB" +
-                    ");");
-
-            db.execSQL("CREATE INDEX thumbnails_url_index ON " + TABLE_THUMBNAILS + "("
-                    + Thumbnails.URL + ")");
-        }
-
-        private void createBookmarksWithImagesView(SQLiteDatabase db) {
-            debug("Creating " + Obsolete.VIEW_BOOKMARKS_WITH_IMAGES + " view");
-
-            db.execSQL("CREATE VIEW IF NOT EXISTS " + Obsolete.VIEW_BOOKMARKS_WITH_IMAGES + " AS " +
-                    "SELECT " + qualifyColumn(TABLE_BOOKMARKS, "*") +
-                    ", " + Obsolete.Images.FAVICON + ", " + Obsolete.Images.THUMBNAIL + " FROM " +
-                    Obsolete.TABLE_BOOKMARKS_JOIN_IMAGES);
-        }
-
-        private void createBookmarksWithFaviconsView(SQLiteDatabase db) {
-            debug("Creating " + VIEW_BOOKMARKS_WITH_FAVICONS + " view");
-
-            db.execSQL("CREATE VIEW IF NOT EXISTS " + VIEW_BOOKMARKS_WITH_FAVICONS + " AS " +
-                    "SELECT " + qualifyColumn(TABLE_BOOKMARKS, "*") +
-                    ", " + qualifyColumn(TABLE_FAVICONS, Favicons.DATA) + " AS " + Bookmarks.FAVICON +
-                    ", " + qualifyColumn(TABLE_FAVICONS, Favicons.URL) + " AS " + Bookmarks.FAVICON_URL +
-                    " FROM " + TABLE_BOOKMARKS_JOIN_FAVICONS);
-        }
-
-        private void createHistoryWithImagesView(SQLiteDatabase db) {
-            debug("Creating " + Obsolete.VIEW_HISTORY_WITH_IMAGES + " view");
-
-            db.execSQL("CREATE VIEW IF NOT EXISTS " + Obsolete.VIEW_HISTORY_WITH_IMAGES + " AS " +
-                    "SELECT " + qualifyColumn(TABLE_HISTORY, "*") +
-                    ", " + Obsolete.Images.FAVICON + ", " + Obsolete.Images.THUMBNAIL + " FROM " +
-                    Obsolete.TABLE_HISTORY_JOIN_IMAGES);
-        }
-
-        private void createHistoryWithFaviconsView(SQLiteDatabase db) {
-            debug("Creating " + VIEW_HISTORY_WITH_FAVICONS + " view");
-
-            db.execSQL("CREATE VIEW IF NOT EXISTS " + VIEW_HISTORY_WITH_FAVICONS + " AS " +
-                    "SELECT " + qualifyColumn(TABLE_HISTORY, "*") +
-                    ", " + qualifyColumn(TABLE_FAVICONS, Favicons.DATA) + " AS " + History.FAVICON +
-                    ", " + qualifyColumn(TABLE_FAVICONS, Favicons.URL) + " AS " + History.FAVICON_URL +
-                    " FROM " + TABLE_HISTORY_JOIN_FAVICONS);
-        }
-
-        private void createCombinedWithImagesView(SQLiteDatabase db) {
-            debug("Creating " + Obsolete.VIEW_COMBINED_WITH_IMAGES + " view");
-
-            db.execSQL("CREATE VIEW IF NOT EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES + " AS" +
-                    " SELECT " + Combined.BOOKMARK_ID + ", " +
-                                 Combined.HISTORY_ID + ", " +
-                                 // We need to return an _id column because CursorAdapter requires it for its
-                                 // default implementation for the getItemId() method. However, since
-                                 // we're not using this feature in the parts of the UI using this view,
-                                 // we can just use 0 for all rows.
-                                 "0 AS " + Combined._ID + ", " +
-                                 Combined.URL + ", " +
-                                 Combined.TITLE + ", " +
-                                 Combined.VISITS + ", " +
-                                 Combined.DATE_LAST_VISITED + ", " +
-                                 qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.FAVICON) + " AS " + Combined.FAVICON + ", " +
-                                 qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.THUMBNAIL) + " AS " + Obsolete.Combined.THUMBNAIL +
-                    " FROM (" +
-                        // Bookmarks without history.
-                        " SELECT " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) + " AS " + Combined.BOOKMARK_ID + ", " +
-                                     qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " AS " + Combined.URL + ", " +
-                                     qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + " AS " + Combined.TITLE + ", " +
-                                     "-1 AS " + Combined.HISTORY_ID + ", " +
-                                     "-1 AS " + Combined.VISITS + ", " +
-                                     "-1 AS " + Combined.DATE_LAST_VISITED +
-                        " FROM " + TABLE_BOOKMARKS +
-                        " WHERE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + " AND " +
-                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED)  + " = 0 AND " +
-                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) +
-                                        " NOT IN (SELECT " + History.URL + " FROM " + TABLE_HISTORY + ")" +
-                        " UNION ALL" +
-                        // History with and without bookmark.
-                        " SELECT " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) + " AS " + Combined.BOOKMARK_ID + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.URL) + " AS " + Combined.URL + ", " +
-                                     // Prioritze bookmark titles over history titles, since the user may have
-                                     // customized the title for a bookmark.
-                                     "COALESCE(" + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + ", " +
-                                                   qualifyColumn(TABLE_HISTORY, History.TITLE) +")" + " AS " + Combined.TITLE + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History._ID) + " AS " + Combined.HISTORY_ID + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.VISITS) + " AS " + Combined.VISITS + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.DATE_LAST_VISITED) + " AS " + Combined.DATE_LAST_VISITED +
-                        " FROM " + TABLE_HISTORY + " LEFT OUTER JOIN " + TABLE_BOOKMARKS +
-                            " ON " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " = " + qualifyColumn(TABLE_HISTORY, History.URL) +
-                        " WHERE " + qualifyColumn(TABLE_HISTORY, History.URL) + " IS NOT NULL AND " +
-                                    qualifyColumn(TABLE_HISTORY, History.IS_DELETED)  + " = 0 AND (" +
-                                        qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE) + " IS NULL OR " +
-                                        qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + ")" +
-                    ") LEFT OUTER JOIN " + Obsolete.TABLE_IMAGES +
-                        " ON " + Combined.URL + " = " + qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.URL));
-        }
-
-        private void createCombinedWithImagesViewOn9(SQLiteDatabase db) {
-            debug("Creating " + Obsolete.VIEW_COMBINED_WITH_IMAGES + " view");
-
-            db.execSQL("CREATE VIEW IF NOT EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES + " AS" +
-                    " SELECT " + Combined.BOOKMARK_ID + ", " +
-                                 Combined.HISTORY_ID + ", " +
-                                 // We need to return an _id column because CursorAdapter requires it for its
-                                 // default implementation for the getItemId() method. However, since
-                                 // we're not using this feature in the parts of the UI using this view,
-                                 // we can just use 0 for all rows.
-                                 "0 AS " + Combined._ID + ", " +
-                                 Combined.URL + ", " +
-                                 Combined.TITLE + ", " +
-                                 Combined.VISITS + ", " +
-                                 Combined.DISPLAY + ", " +
-                                 Combined.DATE_LAST_VISITED + ", " +
-                                 qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.FAVICON) + " AS " + Combined.FAVICON + ", " +
-                                 qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.THUMBNAIL) + " AS " + Obsolete.Combined.THUMBNAIL +
-                    " FROM (" +
-                        // Bookmarks without history.
-                        " SELECT " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) + " AS " + Combined.BOOKMARK_ID + ", " +
-                                     qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " AS " + Combined.URL + ", " +
-                                     qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + " AS " + Combined.TITLE + ", " +
-                                     "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " +
-                                        Bookmarks.FIXED_READING_LIST_ID + " THEN " + Combined.DISPLAY_READER + " ELSE " +
-                                        Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
-                                     "-1 AS " + Combined.HISTORY_ID + ", " +
-                                     "-1 AS " + Combined.VISITS + ", " +
-                                     "-1 AS " + Combined.DATE_LAST_VISITED +
-                        " FROM " + TABLE_BOOKMARKS +
-                        " WHERE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + " AND " +
-                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED)  + " = 0 AND " +
-                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) +
-                                        " NOT IN (SELECT " + History.URL + " FROM " + TABLE_HISTORY + ")" +
-                        " UNION ALL" +
-                        // History with and without bookmark.
-                        " SELECT " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) + " AS " + Combined.BOOKMARK_ID + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.URL) + " AS " + Combined.URL + ", " +
-                                     // Prioritze bookmark titles over history titles, since the user may have
-                                     // customized the title for a bookmark.
-                                     "COALESCE(" + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + ", " +
-                                                   qualifyColumn(TABLE_HISTORY, History.TITLE) +")" + " AS " + Combined.TITLE + ", " +
-                                     "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " +
-                                        Bookmarks.FIXED_READING_LIST_ID + " THEN " + Combined.DISPLAY_READER + " ELSE " +
-                                        Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History._ID) + " AS " + Combined.HISTORY_ID + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.VISITS) + " AS " + Combined.VISITS + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.DATE_LAST_VISITED) + " AS " + Combined.DATE_LAST_VISITED +
-                        " FROM " + TABLE_HISTORY + " LEFT OUTER JOIN " + TABLE_BOOKMARKS +
-                            " ON " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " = " + qualifyColumn(TABLE_HISTORY, History.URL) +
-                        " WHERE " + qualifyColumn(TABLE_HISTORY, History.URL) + " IS NOT NULL AND " +
-                                    qualifyColumn(TABLE_HISTORY, History.IS_DELETED)  + " = 0 AND (" +
-                                        qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE) + " IS NULL OR " +
-                                        qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + ")" +
-                    ") LEFT OUTER JOIN " + Obsolete.TABLE_IMAGES +
-                        " ON " + Combined.URL + " = " + qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.URL));
-        }
-
-        private void createCombinedWithImagesViewOn10(SQLiteDatabase db) {
-            debug("Creating " + Obsolete.VIEW_COMBINED_WITH_IMAGES + " view");
-
-            db.execSQL("CREATE VIEW IF NOT EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES + " AS" +
-                    " SELECT " + Combined.BOOKMARK_ID + ", " +
-                                 Combined.HISTORY_ID + ", " +
-                                 // We need to return an _id column because CursorAdapter requires it for its
-                                 // default implementation for the getItemId() method. However, since
-                                 // we're not using this feature in the parts of the UI using this view,
-                                 // we can just use 0 for all rows.
-                                 "0 AS " + Combined._ID + ", " +
-                                 Combined.URL + ", " +
-                                 Combined.TITLE + ", " +
-                                 Combined.VISITS + ", " +
-                                 Combined.DISPLAY + ", " +
-                                 Combined.DATE_LAST_VISITED + ", " +
-                                 qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.FAVICON) + " AS " + Combined.FAVICON + ", " +
-                                 qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.THUMBNAIL) + " AS " + Obsolete.Combined.THUMBNAIL +
-                    " FROM (" +
-                        // Bookmarks without history.
-                        " SELECT " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) + " AS " + Combined.BOOKMARK_ID + ", " +
-                                     qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " AS " + Combined.URL + ", " +
-                                     qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + " AS " + Combined.TITLE + ", " +
-                                     "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " +
-                                        Bookmarks.FIXED_READING_LIST_ID + " THEN " + Combined.DISPLAY_READER + " ELSE " +
-                                        Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
-                                     "-1 AS " + Combined.HISTORY_ID + ", " +
-                                     "-1 AS " + Combined.VISITS + ", " +
-                                     "-1 AS " + Combined.DATE_LAST_VISITED +
-                        " FROM " + TABLE_BOOKMARKS +
-                        " WHERE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + " AND " +
-                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED)  + " = 0 AND " +
-                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) +
-                                        " NOT IN (SELECT " + History.URL + " FROM " + TABLE_HISTORY + ")" +
-                        " UNION ALL" +
-                        // History with and without bookmark.
-                        " SELECT " + "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED) + " WHEN 0 THEN " +
-                                     qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) +  " ELSE NULL END AS " + Combined.BOOKMARK_ID + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.URL) + " AS " + Combined.URL + ", " +
-                                     // Prioritze bookmark titles over history titles, since the user may have
-                                     // customized the title for a bookmark.
-                                     "COALESCE(" + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + ", " +
-                                                   qualifyColumn(TABLE_HISTORY, History.TITLE) +")" + " AS " + Combined.TITLE + ", " +
-                                     "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " +
-                                        Bookmarks.FIXED_READING_LIST_ID + " THEN " + Combined.DISPLAY_READER + " ELSE " +
-                                        Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History._ID) + " AS " + Combined.HISTORY_ID + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.VISITS) + " AS " + Combined.VISITS + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.DATE_LAST_VISITED) + " AS " + Combined.DATE_LAST_VISITED +
-                        " FROM " + TABLE_HISTORY + " LEFT OUTER JOIN " + TABLE_BOOKMARKS +
-                            " ON " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " = " + qualifyColumn(TABLE_HISTORY, History.URL) +
-                        " WHERE " + qualifyColumn(TABLE_HISTORY, History.URL) + " IS NOT NULL AND " +
-                                    qualifyColumn(TABLE_HISTORY, History.IS_DELETED)  + " = 0 AND (" +
-                                        qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE) + " IS NULL OR " +
-                                        qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + ")" +
-                    ") LEFT OUTER JOIN " + Obsolete.TABLE_IMAGES +
-                        " ON " + Combined.URL + " = " + qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.URL));
-        }
-
-        private void createCombinedWithImagesViewOn11(SQLiteDatabase db) {
-            debug("Creating " + Obsolete.VIEW_COMBINED_WITH_IMAGES + " view");
-
-            db.execSQL("CREATE VIEW IF NOT EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES + " AS" +
-                    " SELECT " + Combined.BOOKMARK_ID + ", " +
-                                 Combined.HISTORY_ID + ", " +
-                                 // We need to return an _id column because CursorAdapter requires it for its
-                                 // default implementation for the getItemId() method. However, since
-                                 // we're not using this feature in the parts of the UI using this view,
-                                 // we can just use 0 for all rows.
-                                 "0 AS " + Combined._ID + ", " +
-                                 Combined.URL + ", " +
-                                 Combined.TITLE + ", " +
-                                 Combined.VISITS + ", " +
-                                 Combined.DISPLAY + ", " +
-                                 Combined.DATE_LAST_VISITED + ", " +
-                                 qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.FAVICON) + " AS " + Combined.FAVICON + ", " +
-                                 qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.THUMBNAIL) + " AS " + Obsolete.Combined.THUMBNAIL +
-                    " FROM (" +
-                        // Bookmarks without history.
-                        " SELECT " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) + " AS " + Combined.BOOKMARK_ID + ", " +
-                                     qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " AS " + Combined.URL + ", " +
-                                     qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + " AS " + Combined.TITLE + ", " +
-                                     "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " +
-                                        Bookmarks.FIXED_READING_LIST_ID + " THEN " + Combined.DISPLAY_READER + " ELSE " +
-                                        Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
-                                     "-1 AS " + Combined.HISTORY_ID + ", " +
-                                     "-1 AS " + Combined.VISITS + ", " +
-                                     "-1 AS " + Combined.DATE_LAST_VISITED +
-                        " FROM " + TABLE_BOOKMARKS +
-                        " WHERE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + " AND " +
-                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED)  + " = 0 AND " +
-                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) +
-                                        " NOT IN (SELECT " + History.URL + " FROM " + TABLE_HISTORY + ")" +
-                        " UNION ALL" +
-                        // History with and without bookmark.
-                        " SELECT " + "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED) + " WHEN 0 THEN " +
-                                     qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) +  " ELSE NULL END AS " + Combined.BOOKMARK_ID + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.URL) + " AS " + Combined.URL + ", " +
-                                     // Prioritze bookmark titles over history titles, since the user may have
-                                     // customized the title for a bookmark.
-                                     "COALESCE(" + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + ", " +
-                                                   qualifyColumn(TABLE_HISTORY, History.TITLE) +")" + " AS " + Combined.TITLE + ", " +
-                                     // Only use DISPLAY_READER if the matching bookmark entry inside reading
-                                     // list folder is not marked as deleted.
-                                     "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED) + " WHEN 0 THEN CASE " +
-                                        qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " + Bookmarks.FIXED_READING_LIST_ID +
-                                        " THEN " + Combined.DISPLAY_READER + " ELSE " + Combined.DISPLAY_NORMAL + " END ELSE " +
-                                        Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History._ID) + " AS " + Combined.HISTORY_ID + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.VISITS) + " AS " + Combined.VISITS + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.DATE_LAST_VISITED) + " AS " + Combined.DATE_LAST_VISITED +
-                        " FROM " + TABLE_HISTORY + " LEFT OUTER JOIN " + TABLE_BOOKMARKS +
-                            " ON " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " = " + qualifyColumn(TABLE_HISTORY, History.URL) +
-                        " WHERE " + qualifyColumn(TABLE_HISTORY, History.URL) + " IS NOT NULL AND " +
-                                    qualifyColumn(TABLE_HISTORY, History.IS_DELETED)  + " = 0 AND (" +
-                                        qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE) + " IS NULL OR " +
-                                        qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + ") " +
-                    ") LEFT OUTER JOIN " + Obsolete.TABLE_IMAGES +
-                        " ON " + Combined.URL + " = " + qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.URL));
-        }
-
-        private void createCombinedViewOn12(SQLiteDatabase db) {
-            debug("Creating " + VIEW_COMBINED + " view");
-
-            db.execSQL("CREATE VIEW IF NOT EXISTS " + VIEW_COMBINED + " AS" +
-                    " SELECT " + Combined.BOOKMARK_ID + ", " +
-                                 Combined.HISTORY_ID + ", " +
-                                 // We need to return an _id column because CursorAdapter requires it for its
-                                 // default implementation for the getItemId() method. However, since
-                                 // we're not using this feature in the parts of the UI using this view,
-                                 // we can just use 0 for all rows.
-                                 "0 AS " + Combined._ID + ", " +
-                                 Combined.URL + ", " +
-                                 Combined.TITLE + ", " +
-                                 Combined.VISITS + ", " +
-                                 Combined.DISPLAY + ", " +
-                                 Combined.DATE_LAST_VISITED +
-                    " FROM (" +
-                        // Bookmarks without history.
-                        " SELECT " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) + " AS " + Combined.BOOKMARK_ID + ", " +
-                                     qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " AS " + Combined.URL + ", " +
-                                     qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + " AS " + Combined.TITLE + ", " +
-                                     "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " +
-                                        Bookmarks.FIXED_READING_LIST_ID + " THEN " + Combined.DISPLAY_READER + " ELSE " +
-                                        Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
-                                     "-1 AS " + Combined.HISTORY_ID + ", " +
-                                     "-1 AS " + Combined.VISITS + ", " +
-                                     "-1 AS " + Combined.DATE_LAST_VISITED +
-                        " FROM " + TABLE_BOOKMARKS +
-                        " WHERE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + " AND " +
-                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED)  + " = 0 AND " +
-                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) +
-                                        " NOT IN (SELECT " + History.URL + " FROM " + TABLE_HISTORY + ")" +
-                        " UNION ALL" +
-                        // History with and without bookmark.
-                        " SELECT " + "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED) + " WHEN 0 THEN " +
-                                     qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) +  " ELSE NULL END AS " + Combined.BOOKMARK_ID + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.URL) + " AS " + Combined.URL + ", " +
-                                     // Prioritze bookmark titles over history titles, since the user may have
-                                     // customized the title for a bookmark.
-                                     "COALESCE(" + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + ", " +
-                                                   qualifyColumn(TABLE_HISTORY, History.TITLE) +")" + " AS " + Combined.TITLE + ", " +
-                                     // Only use DISPLAY_READER if the matching bookmark entry inside reading
-                                     // list folder is not marked as deleted.
-                                     "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED) + " WHEN 0 THEN CASE " +
-                                        qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " + Bookmarks.FIXED_READING_LIST_ID +
-                                        " THEN " + Combined.DISPLAY_READER + " ELSE " + Combined.DISPLAY_NORMAL + " END ELSE " +
-                                        Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History._ID) + " AS " + Combined.HISTORY_ID + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.VISITS) + " AS " + Combined.VISITS + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.DATE_LAST_VISITED) + " AS " + Combined.DATE_LAST_VISITED +
-                        " FROM " + TABLE_HISTORY + " LEFT OUTER JOIN " + TABLE_BOOKMARKS +
-                            " ON " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " = " + qualifyColumn(TABLE_HISTORY, History.URL) +
-                        " WHERE " + qualifyColumn(TABLE_HISTORY, History.URL) + " IS NOT NULL AND " +
-                                    qualifyColumn(TABLE_HISTORY, History.IS_DELETED)  + " = 0 AND (" +
-                                        qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE) + " IS NULL OR " +
-                                        qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + ") " +
-                    ")");
-
-            debug("Creating " + Obsolete.VIEW_COMBINED_WITH_IMAGES + " view");
-
-            db.execSQL("CREATE VIEW IF NOT EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES + " AS" +
-                    " SELECT *, " +
-                        qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.FAVICON) + " AS " + Combined.FAVICON + ", " +
-                        qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.THUMBNAIL) + " AS " + Obsolete.Combined.THUMBNAIL +
-                    " FROM " + VIEW_COMBINED + " LEFT OUTER JOIN " + Obsolete.TABLE_IMAGES +
-                        " ON " + Combined.URL + " = " + qualifyColumn(Obsolete.TABLE_IMAGES, Obsolete.Images.URL));
-        }
-
-        private void createCombinedViewOn13(SQLiteDatabase db) {
-            debug("Creating " + VIEW_COMBINED + " view");
-
-            db.execSQL("CREATE VIEW IF NOT EXISTS " + VIEW_COMBINED + " AS" +
-                    " SELECT " + Combined.BOOKMARK_ID + ", " +
-                                 Combined.HISTORY_ID + ", " +
-                                 // We need to return an _id column because CursorAdapter requires it for its
-                                 // default implementation for the getItemId() method. However, since
-                                 // we're not using this feature in the parts of the UI using this view,
-                                 // we can just use 0 for all rows.
-                                 "0 AS " + Combined._ID + ", " +
-                                 Combined.URL + ", " +
-                                 Combined.TITLE + ", " +
-                                 Combined.VISITS + ", " +
-                                 Combined.DISPLAY + ", " +
-                                 Combined.DATE_LAST_VISITED + ", " +
-                                 Combined.FAVICON_ID +
-                    " FROM (" +
-                        // Bookmarks without history.
-                        " SELECT " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) + " AS " + Combined.BOOKMARK_ID + ", " +
-                                     qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " AS " + Combined.URL + ", " +
-                                     qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + " AS " + Combined.TITLE + ", " +
-                                     "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " +
-                                        Bookmarks.FIXED_READING_LIST_ID + " THEN " + Combined.DISPLAY_READER + " ELSE " +
-                                        Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
-                                     "-1 AS " + Combined.HISTORY_ID + ", " +
-                                     "-1 AS " + Combined.VISITS + ", " +
-                                     "-1 AS " + Combined.DATE_LAST_VISITED + ", " +
-                                     qualifyColumn(TABLE_BOOKMARKS, Bookmarks.FAVICON_ID) + " AS " + Combined.FAVICON_ID +
-                        " FROM " + TABLE_BOOKMARKS +
-                        " WHERE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + " AND " +
-                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED)  + " = 0 AND " +
-                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) +
-                                        " NOT IN (SELECT " + History.URL + " FROM " + TABLE_HISTORY + ")" +
-                        " UNION ALL" +
-                        // History with and without bookmark.
-                        " SELECT " + "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED) + " WHEN 0 THEN " +
-                                     qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) +  " ELSE NULL END AS " + Combined.BOOKMARK_ID + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.URL) + " AS " + Combined.URL + ", " +
-                                     // Prioritize bookmark titles over history titles, since the user may have
-                                     // customized the title for a bookmark.
-                                     "COALESCE(" + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + ", " +
-                                                   qualifyColumn(TABLE_HISTORY, History.TITLE) +")" + " AS " + Combined.TITLE + ", " +
-                                     // Only use DISPLAY_READER if the matching bookmark entry inside reading
-                                     // list folder is not marked as deleted.
-                                     "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED) + " WHEN 0 THEN CASE " +
-                                        qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " + Bookmarks.FIXED_READING_LIST_ID +
-                                        " THEN " + Combined.DISPLAY_READER + " ELSE " + Combined.DISPLAY_NORMAL + " END ELSE " +
-                                        Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History._ID) + " AS " + Combined.HISTORY_ID + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.VISITS) + " AS " + Combined.VISITS + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.DATE_LAST_VISITED) + " AS " + Combined.DATE_LAST_VISITED + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.FAVICON_ID) + " AS " + Combined.FAVICON_ID +
-                        " FROM " + TABLE_HISTORY + " LEFT OUTER JOIN " + TABLE_BOOKMARKS +
-                            " ON " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " = " + qualifyColumn(TABLE_HISTORY, History.URL) +
-                        " WHERE " + qualifyColumn(TABLE_HISTORY, History.URL) + " IS NOT NULL AND " +
-                                    qualifyColumn(TABLE_HISTORY, History.IS_DELETED)  + " = 0 AND (" +
-                                        qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE) + " IS NULL OR " +
-                                        qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + ") " +
-                    ")");
-
-            debug("Creating " + VIEW_COMBINED_WITH_FAVICONS + " view");
-
-            db.execSQL("CREATE VIEW IF NOT EXISTS " + VIEW_COMBINED_WITH_FAVICONS + " AS" +
-                    " SELECT " + qualifyColumn(VIEW_COMBINED, "*") + ", " +
-                        qualifyColumn(TABLE_FAVICONS, Favicons.URL) + " AS " + Combined.FAVICON_URL + ", " +
-                        qualifyColumn(TABLE_FAVICONS, Favicons.DATA) + " AS " + Combined.FAVICON +
-                    " FROM " + VIEW_COMBINED + " LEFT OUTER JOIN " + TABLE_FAVICONS +
-                        " ON " + Combined.FAVICON_ID + " = " + qualifyColumn(TABLE_FAVICONS, Favicons._ID));
-        }
-
-        private void createCombinedViewOn16(SQLiteDatabase db) {
-            debug("Creating " + VIEW_COMBINED + " view");
-
-            db.execSQL("CREATE VIEW IF NOT EXISTS " + VIEW_COMBINED + " AS" +
-                    " SELECT " + Combined.BOOKMARK_ID + ", " +
-                                 Combined.HISTORY_ID + ", " +
-                                 // We need to return an _id column because CursorAdapter requires it for its
-                                 // default implementation for the getItemId() method. However, since
-                                 // we're not using this feature in the parts of the UI using this view,
-                                 // we can just use 0 for all rows.
-                                 "0 AS " + Combined._ID + ", " +
-                                 Combined.URL + ", " +
-                                 Combined.TITLE + ", " +
-                                 Combined.VISITS + ", " +
-                                 Combined.DISPLAY + ", " +
-                                 Combined.DATE_LAST_VISITED + ", " +
-                                 Combined.FAVICON_ID +
-                    " FROM (" +
-                        // Bookmarks without history.
-                        " SELECT " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) + " AS " + Combined.BOOKMARK_ID + ", " +
-                                     qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " AS " + Combined.URL + ", " +
-                                     qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + " AS " + Combined.TITLE + ", " +
-                                     "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " +
-                                        Bookmarks.FIXED_READING_LIST_ID + " THEN " + Combined.DISPLAY_READER + " ELSE " +
-                                        Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
-                                     "-1 AS " + Combined.HISTORY_ID + ", " +
-                                     "-1 AS " + Combined.VISITS + ", " +
-                                     "-1 AS " + Combined.DATE_LAST_VISITED + ", " +
-                                     qualifyColumn(TABLE_BOOKMARKS, Bookmarks.FAVICON_ID) + " AS " + Combined.FAVICON_ID +
-                        " FROM " + TABLE_BOOKMARKS +
-                        " WHERE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + " AND " +
-                                    // Ignore pinned bookmarks.
-                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT)  + " <> " + Bookmarks.FIXED_PINNED_LIST_ID + " AND " +
-                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED)  + " = 0 AND " +
-                                    qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) +
-                                        " NOT IN (SELECT " + History.URL + " FROM " + TABLE_HISTORY + ")" +
-                        " UNION ALL" +
-                        // History with and without bookmark.
-                        " SELECT " + "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED) + " WHEN 0 THEN " +
-                                        // Give pinned bookmarks a NULL ID so that they're not treated as bookmarks. We can't
-                                        // completely ignore them here because they're joined with history entries we care about.
-                                        "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " +
-                                        Bookmarks.FIXED_PINNED_LIST_ID + " THEN NULL ELSE " +
-                                        qualifyColumn(TABLE_BOOKMARKS, Bookmarks._ID) + " END " +
-                                     "ELSE NULL END AS " + Combined.BOOKMARK_ID + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.URL) + " AS " + Combined.URL + ", " +
-                                     // Prioritize bookmark titles over history titles, since the user may have
-                                     // customized the title for a bookmark.
-                                     "COALESCE(" + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TITLE) + ", " +
-                                                   qualifyColumn(TABLE_HISTORY, History.TITLE) +")" + " AS " + Combined.TITLE + ", " +
-                                     // Only use DISPLAY_READER if the matching bookmark entry inside reading
-                                     // list folder is not marked as deleted.
-                                     "CASE " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.IS_DELETED) + " WHEN 0 THEN CASE " +
-                                        qualifyColumn(TABLE_BOOKMARKS, Bookmarks.PARENT) + " WHEN " + Bookmarks.FIXED_READING_LIST_ID +
-                                        " THEN " + Combined.DISPLAY_READER + " ELSE " + Combined.DISPLAY_NORMAL + " END ELSE " +
-                                        Combined.DISPLAY_NORMAL + " END AS " + Combined.DISPLAY + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History._ID) + " AS " + Combined.HISTORY_ID + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.VISITS) + " AS " + Combined.VISITS + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.DATE_LAST_VISITED) + " AS " + Combined.DATE_LAST_VISITED + ", " +
-                                     qualifyColumn(TABLE_HISTORY, History.FAVICON_ID) + " AS " + Combined.FAVICON_ID +
-                        " FROM " + TABLE_HISTORY + " LEFT OUTER JOIN " + TABLE_BOOKMARKS +
-                            " ON " + qualifyColumn(TABLE_BOOKMARKS, Bookmarks.URL) + " = " + qualifyColumn(TABLE_HISTORY, History.URL) +
-                        " WHERE " + qualifyColumn(TABLE_HISTORY, History.URL) + " IS NOT NULL AND " +
-                                    qualifyColumn(TABLE_HISTORY, History.IS_DELETED)  + " = 0 AND (" +
-                                        qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE) + " IS NULL OR " +
-                                        qualifyColumn(TABLE_BOOKMARKS, Bookmarks.TYPE)  + " = " + Bookmarks.TYPE_BOOKMARK + ") " +
-                    ")");
-
-            debug("Creating " + VIEW_COMBINED_WITH_FAVICONS + " view");
-
-            db.execSQL("CREATE VIEW IF NOT EXISTS " + VIEW_COMBINED_WITH_FAVICONS + " AS" +
-                    " SELECT " + qualifyColumn(VIEW_COMBINED, "*") + ", " +
-                        qualifyColumn(TABLE_FAVICONS, Favicons.URL) + " AS " + Combined.FAVICON_URL + ", " +
-                        qualifyColumn(TABLE_FAVICONS, Favicons.DATA) + " AS " + Combined.FAVICON +
-                    " FROM " + VIEW_COMBINED + " LEFT OUTER JOIN " + TABLE_FAVICONS +
-                        " ON " + Combined.FAVICON_ID + " = " + qualifyColumn(TABLE_FAVICONS, Favicons._ID));
-        }
-
-        @Override
-        public void onCreate(SQLiteDatabase db) {
-            debug("Creating browser.db: " + db.getPath());
-
-            createBookmarksTableOn13(db);
-            createHistoryTableOn13(db);
-            createFaviconsTable(db);
-            createThumbnailsTable(db);
-
-            createBookmarksWithFaviconsView(db);
-            createHistoryWithFaviconsView(db);
-            createCombinedViewOn16(db);
-
-            createOrUpdateSpecialFolder(db, Bookmarks.PLACES_FOLDER_GUID,
-                R.string.bookmarks_folder_places, 0);
-
-            createOrUpdateAllSpecialFolders(db);
-
-            // Create distribution bookmarks before our own default bookmarks
-            int pos = createDistributionBookmarks(db);
-            createDefaultBookmarks(db, pos);
-        }
-
-        private String getLocalizedProperty(JSONObject bookmark, String property, Locale locale) throws JSONException {
-            // Try the full locale
-            String fullLocale = property + "." + locale.toString();
-            if (bookmark.has(fullLocale)) {
-                return bookmark.getString(fullLocale);
-            }
-            // Try without a variant
-            if (!TextUtils.isEmpty(locale.getVariant())) {
-                String noVariant = fullLocale.substring(0, fullLocale.lastIndexOf("_"));
-                if (bookmark.has(noVariant)) {
-                    return bookmark.getString(noVariant);
-                }
-            }
-            // Try just the language
-            String lang = property + "." + locale.getLanguage();
-            if (bookmark.has(lang)) {
-                return bookmark.getString(lang);
-            }
-            // Default to the non-localized property name
-            return bookmark.getString(property);
-        }
-
-        // Returns the number of bookmarks inserted in the db
-        private int createDistributionBookmarks(SQLiteDatabase db) {
-            JSONArray bookmarks = Distribution.getBookmarks(mContext);
-            if (bookmarks == null) {
-                return 0;
-            }
-
-            Locale locale = Locale.getDefault();
-            int pos = 0;
-            Integer mobileFolderId = getMobileFolderId(db);
-            if (mobileFolderId == null) {
-                Log.e(LOGTAG, "Error creating distribution bookmarks: mobileFolderId is null");
-                return 0;
-            }
-
-            for (int i = 0; i < bookmarks.length(); i++) {
-                try {
-                    final JSONObject bookmark = bookmarks.getJSONObject(i);
-
-                    String title = getLocalizedProperty(bookmark, "title", locale);
-                    final String url = getLocalizedProperty(bookmark, "url", locale);
-                    createBookmark(db, title, url, pos, mobileFolderId);
-
-                    if (bookmark.has("pinned")) {
-                        try {
-                            // Create a fake bookmark in the hidden pinned folder to pin bookmark
-                            // to about:home top sites. Pass pos as the pinned position to pin
-                            // sites in the order that bookmarks are specified in bookmarks.json.
-                            if (bookmark.getBoolean("pinned")) {
-                                createBookmark(db, title, url, pos, Bookmarks.FIXED_PINNED_LIST_ID);
-                            }
-                        } catch (JSONException e) {
-                            Log.e(LOGTAG, "Error pinning bookmark to top sites", e);
-                        }
-                    }
-
-                    pos++;
-
-                    // return early if there is no icon for this bookmark
-                    if (!bookmark.has("icon")) {
-                        continue;
-                    }
-
-                    // create icons in a separate thread to avoid blocking about:home on startup
-                    ThreadUtils.postToBackgroundThread(new Runnable() {
-                        @Override
-                        public void run() {
-                            SQLiteDatabase db = getWritableDatabase();
-                            try {
-                                String iconData = bookmark.getString("icon");
-                                Bitmap icon = BitmapUtils.getBitmapFromDataURI(iconData);
-                                if (icon != null) {
-                                    createFavicon(db, url, icon);
-                                }
-                            } catch (JSONException e) {
-                                Log.e(LOGTAG, "Error creating distribution bookmark icon", e);
-                            }
-                        }
-                    });
-                } catch (JSONException e) {
-                    Log.e(LOGTAG, "Error creating distribution bookmark", e);
-                }
-            }
-            return pos;
-        }
-
-        // Inserts default bookmarks, starting at a specified position
-        private void createDefaultBookmarks(SQLiteDatabase db, int pos) {
-            Class<?> stringsClass = R.string.class;
-            Field[] fields = stringsClass.getFields();
-            Pattern p = Pattern.compile("^bookmarkdefaults_title_");
-
-            Integer mobileFolderId = getMobileFolderId(db);
-            if (mobileFolderId == null) {
-                Log.e(LOGTAG, "Error creating default bookmarks: mobileFolderId is null");
-                return;
-            }
-
-            for (int i = 0; i < fields.length; i++) {
-                final String name = fields[i].getName();
-                Matcher m = p.matcher(name);
-                if (!m.find()) {
-                    continue;
-                }
-                try {
-                    int titleid = fields[i].getInt(null);
-                    String title = mContext.getString(titleid);
-
-                    Field urlField = stringsClass.getField(name.replace("_title_", "_url_"));
-                    int urlId = urlField.getInt(null);
-                    final String url = mContext.getString(urlId);
-                    createBookmark(db, title, url, pos, mobileFolderId);
-
-                    // create icons in a separate thread to avoid blocking about:home on startup
-                    ThreadUtils.postToBackgroundThread(new Runnable() {
-                        @Override
-                        public void run() {
-                            SQLiteDatabase db = getWritableDatabase();
-                            Bitmap icon = getDefaultFaviconFromPath(name);
-                            if (icon == null) {
-                                icon = getDefaultFaviconFromDrawable(name);
-                            }
-                            if (icon != null) {
-                                createFavicon(db, url, icon);
-                            }
-                        }
-                    });
-                    pos++;
-                } catch (java.lang.IllegalAccessException ex) {
-                    Log.e(LOGTAG, "Can't create bookmark " + name, ex);
-                } catch (java.lang.NoSuchFieldException ex) {
-                    Log.e(LOGTAG, "Can't create bookmark " + name, ex);
-                }
-            }
-        }
-
-        private void createBookmark(SQLiteDatabase db, String title, String url, int pos, int parent) {
-            ContentValues bookmarkValues = new ContentValues();
-            bookmarkValues.put(Bookmarks.PARENT, parent);
-
-            long now = System.currentTimeMillis();
-            bookmarkValues.put(Bookmarks.DATE_CREATED, now);
-            bookmarkValues.put(Bookmarks.DATE_MODIFIED, now);
-
-            bookmarkValues.put(Bookmarks.TITLE, title);
-            bookmarkValues.put(Bookmarks.URL, url);
-            bookmarkValues.put(Bookmarks.GUID, Utils.generateGuid());
-            bookmarkValues.put(Bookmarks.POSITION, pos);
-            db.insertOrThrow(TABLE_BOOKMARKS, Bookmarks.TITLE, bookmarkValues);
-        }
-
-        private void createFavicon(SQLiteDatabase db, String url, Bitmap icon) {
-            ByteArrayOutputStream stream = new ByteArrayOutputStream();
-
-            ContentValues iconValues = new ContentValues();
-            iconValues.put(Favicons.PAGE_URL, url);
-
-            byte[] data = null;
-            if (icon.compress(Bitmap.CompressFormat.PNG, 100, stream)) {
-                data = stream.toByteArray();
-            } else {
-                Log.w(LOGTAG, "Favicon compression failed.");
-            }
-            iconValues.put(Favicons.DATA, data);
-
-            insertFavicon(db, iconValues);
-        }
-
-        private Bitmap getDefaultFaviconFromPath(String name) {
-            Class<?> stringClass = R.string.class;
-            try {
-                // Look for a drawable with the id R.drawable.bookmarkdefaults_favicon_*
-                Field faviconField = stringClass.getField(name.replace("_title_", "_favicon_"));
-                if (faviconField == null) {
-                    return null;
-                }
-                int faviconId = faviconField.getInt(null);
-                String path = mContext.getString(faviconId);
-
-                String apkPath = mContext.getPackageResourcePath();
-                File apkFile = new File(apkPath);
-                String bitmapPath = "jar:jar:" + apkFile.toURI() + "!/" + AppConstants.OMNIJAR_NAME + "!/" + path;
-                return GeckoJarReader.getBitmap(mContext.getResources(), bitmapPath);
-            } catch (java.lang.IllegalAccessException ex) {
-                Log.e(LOGTAG, "[Path] Can't create favicon " + name, ex);
-            } catch (java.lang.NoSuchFieldException ex) {
-                // If the field does not exist, that means we intend to load via a drawable
-            }
-            return null;
-        }
-
-        private Bitmap getDefaultFaviconFromDrawable(String name) {
-            Class<?> drawablesClass = R.drawable.class;
-            try {
-                // Look for a drawable with the id R.drawable.bookmarkdefaults_favicon_*
-                Field faviconField = drawablesClass.getField(name.replace("_title_", "_favicon_"));
-                if (faviconField == null) {
-                    return null;
-                }
-                int faviconId = faviconField.getInt(null);
-                return BitmapUtils.decodeResource(mContext, faviconId);
-            } catch (java.lang.IllegalAccessException ex) {
-                Log.e(LOGTAG, "[Drawable] Can't create favicon " + name, ex);
-            } catch (java.lang.NoSuchFieldException ex) {
-                // If the field does not exist, that means we intend to load via a file path
-            }
-            return null;
-        }
-
-        private void createOrUpdateAllSpecialFolders(SQLiteDatabase db) {
-            createOrUpdateSpecialFolder(db, Bookmarks.MOBILE_FOLDER_GUID,
-                R.string.bookmarks_folder_mobile, 0);
-            createOrUpdateSpecialFolder(db, Bookmarks.TOOLBAR_FOLDER_GUID,
-                R.string.bookmarks_folder_toolbar, 1);
-            createOrUpdateSpecialFolder(db, Bookmarks.MENU_FOLDER_GUID,
-                R.string.bookmarks_folder_menu, 2);
-            createOrUpdateSpecialFolder(db, Bookmarks.TAGS_FOLDER_GUID,
-                R.string.bookmarks_folder_tags, 3);
-            createOrUpdateSpecialFolder(db, Bookmarks.UNFILED_FOLDER_GUID,
-                R.string.bookmarks_folder_unfiled, 4);
-            createOrUpdateSpecialFolder(db, Bookmarks.READING_LIST_FOLDER_GUID,
-                R.string.bookmarks_folder_reading_list, 5);
-            createOrUpdateSpecialFolder(db, Bookmarks.PINNED_FOLDER_GUID,
-                R.string.bookmarks_folder_pinned, 6);
-        }
-
-        private void createOrUpdateSpecialFolder(SQLiteDatabase db,
-                String guid, int titleId, int position) {
-            ContentValues values = new ContentValues();
-            values.put(Bookmarks.GUID, guid);
-            values.put(Bookmarks.TYPE, Bookmarks.TYPE_FOLDER);
-            values.put(Bookmarks.POSITION, position);
-
-            if (guid.equals(Bookmarks.PLACES_FOLDER_GUID))
-                values.put(Bookmarks._ID, Bookmarks.FIXED_ROOT_ID);
-            else if (guid.equals(Bookmarks.READING_LIST_FOLDER_GUID))
-                values.put(Bookmarks._ID, Bookmarks.FIXED_READING_LIST_ID);
-            else if (guid.equals(Bookmarks.PINNED_FOLDER_GUID))
-                values.put(Bookmarks._ID, Bookmarks.FIXED_PINNED_LIST_ID);
-
-            // Set the parent to 0, which sync assumes is the root
-            values.put(Bookmarks.PARENT, Bookmarks.FIXED_ROOT_ID);
-
-            String title = mContext.getResources().getString(titleId);
-            values.put(Bookmarks.TITLE, title);
-
-            long now = System.currentTimeMillis();
-            values.put(Bookmarks.DATE_CREATED, now);
-            values.put(Bookmarks.DATE_MODIFIED, now);
-
-            int updated = db.update(TABLE_BOOKMARKS, values,
-                                    Bookmarks.GUID + " = ?",
-                                    new String[] { guid });
-
-            if (updated == 0) {
-                db.insert(TABLE_BOOKMARKS, Bookmarks.GUID, values);
-                debug("Inserted special folder: " + guid);
-            } else {
-                debug("Updated special folder: " + guid);
-            }
-        }
-
-        private boolean isSpecialFolder(ContentValues values) {
-            String guid = values.getAsString(Bookmarks.GUID);
-            if (guid == null)
-                return false;
-
-            return guid.equals(Bookmarks.MOBILE_FOLDER_GUID) ||
-                   guid.equals(Bookmarks.MENU_FOLDER_GUID) ||
-                   guid.equals(Bookmarks.TOOLBAR_FOLDER_GUID) ||
-                   guid.equals(Bookmarks.UNFILED_FOLDER_GUID) ||
-                   guid.equals(Bookmarks.TAGS_FOLDER_GUID);
-        }
-
-        private void migrateBookmarkFolder(SQLiteDatabase db, int folderId,
-                BookmarkMigrator migrator) {
-            Cursor c = null;
-
-            debug("Migrating bookmark folder with id = " + folderId);
-
-            String selection = Bookmarks.PARENT + " = " + folderId;
-            String[] selectionArgs = null;
-
-            boolean isRootFolder = (folderId == Bookmarks.FIXED_ROOT_ID);
-
-            // If we're loading the root folder, we have to account for
-            // any previously created special folder that was created without
-            // setting a parent id (e.g. mobile folder) and making sure we're
-            // not adding any infinite recursion as root's parent is root itself.
-            if (isRootFolder) {
-                selection = Bookmarks.GUID + " != ?" + " AND (" +
-                            selection + " OR " + Bookmarks.PARENT + " = NULL)";
-                selectionArgs = new String[] { Bookmarks.PLACES_FOLDER_GUID };
-            }
-
-            List<Integer> subFolders = new ArrayList<Integer>();
-            List<ContentValues> invalidSpecialEntries = new ArrayList<ContentValues>();
-
-            try {
-                c = db.query(TABLE_BOOKMARKS_TMP,
-                             null,
-                             selection,
-                             selectionArgs,
-                             null, null, null);
-
-                // The key point here is that bookmarks should be added in
-                // parent order to avoid any problems with the foreign key
-                // in Bookmarks.PARENT.
-                while (c.moveToNext()) {
-                    ContentValues values = new ContentValues();
-
-                    // We're using a null projection in the query which
-                    // means we're getting all columns from the table.
-                    // It's safe to simply transform the row into the
-                    // values to be inserted on the new table.
-                    DatabaseUtils.cursorRowToContentValues(c, values);
-
-                    boolean isSpecialFolder = isSpecialFolder(values);
-
-                    // The mobile folder used to be created with PARENT = NULL.
-                    // We want fix that here.
-                    if (values.getAsLong(Bookmarks.PARENT) == null && isSpecialFolder)
-                        values.put(Bookmarks.PARENT, Bookmarks.FIXED_ROOT_ID);
-
-                    if (isRootFolder && !isSpecialFolder) {
-                        invalidSpecialEntries.add(values);
-                        continue;
-                    }
-
-                    if (migrator != null)
-                        migrator.updateForNewTable(values);
-
-                    debug("Migrating bookmark: " + values.getAsString(Bookmarks.TITLE));
-                    db.insert(TABLE_BOOKMARKS, Bookmarks.URL, values);
-
-                    Integer type = values.getAsInteger(Bookmarks.TYPE);
-                    if (type != null && type == Bookmarks.TYPE_FOLDER)
-                        subFolders.add(values.getAsInteger(Bookmarks._ID));
-                }
-            } finally {
-                if (c != null)
-                    c.close();
-            }
-
-            // At this point is safe to assume that the mobile folder is
-            // in the new table given that we've always created it on
-            // database creation time.
-            final int nInvalidSpecialEntries = invalidSpecialEntries.size();
-            if (nInvalidSpecialEntries > 0) {
-                Integer mobileFolderId = getMobileFolderId(db);
-                if (mobileFolderId == null) {
-                    Log.e(LOGTAG, "Error migrating invalid special folder entries: mobile folder id is null");
-                    return;
-                }
-
-                debug("Found " + nInvalidSpecialEntries + " invalid special folder entries");
-                for (int i = 0; i < nInvalidSpecialEntries; i++) {
-                    ContentValues values = invalidSpecialEntries.get(i);
-                    values.put(Bookmarks.PARENT, mobileFolderId);
-
-                    db.insert(TABLE_BOOKMARKS, Bookmarks.URL, values);
-                }
-            }
-
-            final int nSubFolders = subFolders.size();
-            for (int i = 0; i < nSubFolders; i++) {
-                int subFolderId = subFolders.get(i);
-                migrateBookmarkFolder(db, subFolderId, migrator);
-            }
-        }
-
-        private void migrateBookmarksTable(SQLiteDatabase db) {
-            migrateBookmarksTable(db, null);
-        }
-
-        private void migrateBookmarksTable(SQLiteDatabase db, BookmarkMigrator migrator) {
-            debug("Renaming bookmarks table to " + TABLE_BOOKMARKS_TMP);
-            db.execSQL("ALTER TABLE " + TABLE_BOOKMARKS +
-                       " RENAME TO " + TABLE_BOOKMARKS_TMP);
-
-            debug("Dropping views and indexes related to " + TABLE_BOOKMARKS);
-            db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_BOOKMARKS_WITH_IMAGES);
-
-            db.execSQL("DROP INDEX IF EXISTS bookmarks_url_index");
-            db.execSQL("DROP INDEX IF EXISTS bookmarks_type_deleted_index");
-            db.execSQL("DROP INDEX IF EXISTS bookmarks_guid_index");
-            db.execSQL("DROP INDEX IF EXISTS bookmarks_modified_index");
-
-            createBookmarksTable(db);
-            createBookmarksWithImagesView(db);
-
-            createOrUpdateSpecialFolder(db, Bookmarks.PLACES_FOLDER_GUID,
-                R.string.bookmarks_folder_places, 0);
-
-            migrateBookmarkFolder(db, Bookmarks.FIXED_ROOT_ID, migrator);
-
-            // Ensure all special folders exist and have the
-            // right folder hierarchy.
-            createOrUpdateAllSpecialFolders(db);
-
-            debug("Dropping bookmarks temporary table");
-            db.execSQL("DROP TABLE IF EXISTS " + TABLE_BOOKMARKS_TMP);
-        }
-
-
-        private void migrateHistoryTable(SQLiteDatabase db) {
-            debug("Renaming history table to " + TABLE_HISTORY_TMP);
-            db.execSQL("ALTER TABLE " + TABLE_HISTORY +
-                       " RENAME TO " + TABLE_HISTORY_TMP);
-
-            debug("Dropping views and indexes related to " + TABLE_HISTORY);
-            db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_HISTORY_WITH_IMAGES);
-            db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
-
-            db.execSQL("DROP INDEX IF EXISTS history_url_index");
-            db.execSQL("DROP INDEX IF EXISTS history_guid_index");
-            db.execSQL("DROP INDEX IF EXISTS history_modified_index");
-            db.execSQL("DROP INDEX IF EXISTS history_visited_index");
-
-            createHistoryTable(db);
-            createHistoryWithImagesView(db);
-            createCombinedWithImagesView(db);
-
-            db.execSQL("INSERT INTO " + TABLE_HISTORY + " SELECT * FROM " + TABLE_HISTORY_TMP);
-
-            debug("Dropping history temporary table");
-            db.execSQL("DROP TABLE IF EXISTS " + TABLE_HISTORY_TMP);
-        }
-
-        private void migrateImagesTable(SQLiteDatabase db) {
-            debug("Renaming images table to " + TABLE_IMAGES_TMP);
-            db.execSQL("ALTER TABLE " + Obsolete.TABLE_IMAGES +
-                       " RENAME TO " + TABLE_IMAGES_TMP);
-
-            debug("Dropping views and indexes related to " + Obsolete.TABLE_IMAGES);
-            db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_HISTORY_WITH_IMAGES);
-            db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
-
-            db.execSQL("DROP INDEX IF EXISTS images_url_index");
-            db.execSQL("DROP INDEX IF EXISTS images_guid_index");
-            db.execSQL("DROP INDEX IF EXISTS images_modified_index");
-
-            createImagesTable(db);
-            createHistoryWithImagesView(db);
-            createCombinedWithImagesView(db);
-
-            db.execSQL("INSERT INTO " + Obsolete.TABLE_IMAGES + " SELECT * FROM " + TABLE_IMAGES_TMP);
-
-            debug("Dropping images temporary table");
-            db.execSQL("DROP TABLE IF EXISTS " + TABLE_IMAGES_TMP);
-        }
-
-        private void upgradeDatabaseFrom1to2(SQLiteDatabase db) {
-            migrateBookmarksTable(db);
-        }
-
-        private void upgradeDatabaseFrom2to3(SQLiteDatabase db) {
-            debug("Dropping view: " + Obsolete.VIEW_BOOKMARKS_WITH_IMAGES);
-            db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_BOOKMARKS_WITH_IMAGES);
-
-            createBookmarksWithImagesView(db);
-
-            debug("Dropping view: " + Obsolete.VIEW_HISTORY_WITH_IMAGES);
-            db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_HISTORY_WITH_IMAGES);
-
-            createHistoryWithImagesView(db);
-        }
-
-        private void upgradeDatabaseFrom3to4(SQLiteDatabase db) {
-            migrateBookmarksTable(db, new BookmarkMigrator3to4());
-        }
-
-        private void upgradeDatabaseFrom4to5(SQLiteDatabase db) {
-            createCombinedWithImagesView(db);
-        }
-
-        private void upgradeDatabaseFrom5to6(SQLiteDatabase db) {
-            debug("Dropping view: " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
-            db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
-
-            createCombinedWithImagesView(db);
-        }
-
-        private void upgradeDatabaseFrom6to7(SQLiteDatabase db) {
-            debug("Removing history visits with NULL GUIDs");
-            db.execSQL("DELETE FROM " + TABLE_HISTORY + " WHERE " + History.GUID + " IS NULL");
-
-            debug("Update images with NULL GUIDs");
-            String[] columns = new String[] { Obsolete.Images._ID };
-            Cursor cursor = null;
-            try {
-              cursor = db.query(Obsolete.TABLE_IMAGES, columns, Obsolete.Images.GUID + " IS NULL", null, null ,null, null, null);
-              ContentValues values = new ContentValues();
-              if (cursor.moveToFirst()) {
-                  do {
-                      values.put(Obsolete.Images.GUID, Utils.generateGuid());
-                      db.update(Obsolete.TABLE_IMAGES, values, Obsolete.Images._ID + " = ?", new String[] {
-                        cursor.getString(cursor.getColumnIndexOrThrow(Obsolete.Images._ID))
-                      });
-                  } while (cursor.moveToNext());
-              }
-            } finally {
-              if (cursor != null)
-                cursor.close();
-            }
-
-            migrateBookmarksTable(db);
-            migrateHistoryTable(db);
-            migrateImagesTable(db);
-        }
-
-        private void upgradeDatabaseFrom7to8(SQLiteDatabase db) {
-            debug("Combining history entries with the same URL");
-
-            final String TABLE_DUPES = "duped_urls";
-            final String TOTAL = "total";
-            final String LATEST = "latest";
-            final String WINNER = "winner";
-
-            db.execSQL("CREATE TEMP TABLE " + TABLE_DUPES + " AS" +
-                      " SELECT " + History.URL + ", " +
-                                  "SUM(" + History.VISITS + ") AS " + TOTAL + ", " +
-                                  "MAX(" + History.DATE_MODIFIED + ") AS " + LATEST + ", " +
-                                  "MAX(" + History._ID + ") AS " + WINNER +
-                      " FROM " + TABLE_HISTORY +
-                      " GROUP BY " + History.URL +
-                      " HAVING count(" + History.URL + ") > 1");
-
-            db.execSQL("CREATE UNIQUE INDEX " + TABLE_DUPES + "_url_index ON " +
-                       TABLE_DUPES + " (" + History.URL + ")");
-
-            final String fromClause = " FROM " + TABLE_DUPES + " WHERE " +
-                                      qualifyColumn(TABLE_DUPES, History.URL) + " = " +
-                                      qualifyColumn(TABLE_HISTORY, History.URL);
-
-            db.execSQL("UPDATE " + TABLE_HISTORY +
-                      " SET " + History.VISITS + " = (SELECT " + TOTAL + fromClause + "), " +
-                                History.DATE_MODIFIED + " = (SELECT " + LATEST + fromClause + "), " +
-                                History.IS_DELETED + " = " +
-                                    "(" + History._ID + " <> (SELECT " + WINNER + fromClause + "))" +
-                      " WHERE " + History.URL + " IN (SELECT " + History.URL + " FROM " + TABLE_DUPES + ")");
-
-            db.execSQL("DROP TABLE " + TABLE_DUPES);
-        }
-
-        private void upgradeDatabaseFrom8to9(SQLiteDatabase db) {
-            createOrUpdateSpecialFolder(db, Bookmarks.READING_LIST_FOLDER_GUID,
-                R.string.bookmarks_folder_reading_list, 5);
-
-            debug("Dropping view: " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
-            db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
-
-            createCombinedWithImagesViewOn9(db);
-        }
-
-        private void upgradeDatabaseFrom9to10(SQLiteDatabase db) {
-            debug("Dropping view: " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
-            db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
-
-            createCombinedWithImagesViewOn10(db);
-        }
-
-        private void upgradeDatabaseFrom10to11(SQLiteDatabase db) {
-            debug("Dropping view: " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
-            db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
-
-            db.execSQL("CREATE INDEX bookmarks_type_deleted_index ON " + TABLE_BOOKMARKS + "("
-                    + Bookmarks.TYPE + ", " + Bookmarks.IS_DELETED + ")");
-
-            createCombinedWithImagesViewOn11(db);
-        }
-
-        private void upgradeDatabaseFrom11to12(SQLiteDatabase db) {
-            debug("Dropping view: " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
-            db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
-
-            createCombinedViewOn12(db);
-        }
-
-        private void upgradeDatabaseFrom12to13(SQLiteDatabase db) {
-            // Update images table with favicon URLs
-            SQLiteDatabase faviconsDb = null;
-            Cursor c = null;
-            try {
-                final String FAVICON_TABLE = "favicon_urls";
-                final String FAVICON_URL = "favicon_url";
-                final String FAVICON_PAGE = "page_url";
-
-                String dbPath = mContext.getDatabasePath(Obsolete.FAVICON_DB).getPath();
-                faviconsDb = SQLiteDatabase.openDatabase(dbPath, null, SQLiteDatabase.OPEN_READONLY);
-                String[] columns = new String[] { FAVICON_URL, FAVICON_PAGE };
-                c = faviconsDb.query(FAVICON_TABLE, columns, null, null, null, null, null, null);
-                int faviconIndex = c.getColumnIndexOrThrow(FAVICON_URL);
-                int pageIndex = c.getColumnIndexOrThrow(FAVICON_PAGE);
-                while (c.moveToNext()) {
-                    ContentValues values = new ContentValues(1);
-                    String faviconUrl = c.getString(faviconIndex);
-                    String pageUrl = c.getString(pageIndex);
-                    values.put(FAVICON_URL, faviconUrl);
-                    db.update(Obsolete.TABLE_IMAGES, values, Obsolete.Images.URL + " = ?", new String[] { pageUrl });
-                }
-            } catch (SQLException e) {
-                // If we can't read from the database for some reason, we won't
-                // be able to import the favicon URLs. This isn't a fatal
-                // error, so continue the upgrade.
-                Log.e(LOGTAG, "Exception importing from " + Obsolete.FAVICON_DB, e);
-            } finally {
-                if (c != null)
-                    c.close();
-                if (faviconsDb != null)
-                    faviconsDb.close();
-            }
-
-            createFaviconsTable(db);
-
-            // Import favicons into the favicons table
-            db.execSQL("ALTER TABLE " + TABLE_HISTORY
-                    + " ADD COLUMN " + History.FAVICON_ID + " INTEGER");
-            db.execSQL("ALTER TABLE " + TABLE_BOOKMARKS
-                    + " ADD COLUMN " + Bookmarks.FAVICON_ID + " INTEGER");
-
-            try {
-                c = db.query(Obsolete.TABLE_IMAGES,
-                        new String[] {
-                            Obsolete.Images.URL,
-                            Obsolete.Images.FAVICON_URL,
-                            Obsolete.Images.FAVICON,
-                            Obsolete.Images.DATE_MODIFIED,
-                            Obsolete.Images.DATE_CREATED
-                        },
-                        Obsolete.Images.FAVICON + " IS NOT NULL",
-                        null, null, null, null);
-
-                while (c.moveToNext()) {
-                    long faviconId = -1;
-                    int faviconUrlIndex = c.getColumnIndexOrThrow(Obsolete.Images.FAVICON_URL);
-                    String faviconUrl = null;
-                    if (!c.isNull(faviconUrlIndex)) {
-                        faviconUrl = c.getString(faviconUrlIndex);
-                        Cursor c2 = null;
-                        try {
-                            c2 = db.query(TABLE_FAVICONS,
-                                    new String[] { Favicons._ID },
-                                    Favicons.URL + " = ?",
-                                    new String[] { faviconUrl },
-                                    null, null, null);
-                            if (c2.moveToFirst()) {
-                                faviconId = c2.getLong(c2.getColumnIndexOrThrow(Favicons._ID));
-                            }
-                        } finally {
-                            if (c2 != null)
-                                c2.close();
-                        }
-                    }
-
-                    if (faviconId == -1) {
-                        ContentValues values = new ContentValues(4);
-                        values.put(Favicons.URL, faviconUrl);
-                        values.put(Favicons.DATA, c.getBlob(c.getColumnIndexOrThrow(Obsolete.Images.FAVICON)));
-                        values.put(Favicons.DATE_MODIFIED, c.getLong(c.getColumnIndexOrThrow(Obsolete.Images.DATE_MODIFIED)));
-                        values.put(Favicons.DATE_CREATED, c.getLong(c.getColumnIndexOrThrow(Obsolete.Images.DATE_CREATED)));
-                        faviconId = db.insert(TABLE_FAVICONS, null, values);
-                    }
-
-                    ContentValues values = new ContentValues(1);
-                    values.put(FaviconColumns.FAVICON_ID, faviconId);
-                    db.update(TABLE_HISTORY, values, History.URL + " = ?",
-                            new String[] { c.getString(c.getColumnIndexOrThrow(Obsolete.Images.URL)) });
-                    db.update(TABLE_BOOKMARKS, values, Bookmarks.URL + " = ?",
-                            new String[] { c.getString(c.getColumnIndexOrThrow(Obsolete.Images.URL)) });
-                }
-            } finally {
-                if (c != null)
-                    c.close();
-            }
-
-            createThumbnailsTable(db);
-
-            // Import thumbnails into the thumbnails table
-            db.execSQL("INSERT INTO " + TABLE_THUMBNAILS + " ("
-                    + Thumbnails.URL + ", "
-                    + Thumbnails.DATA + ") "
-                    + "SELECT " + Obsolete.Images.URL + ", " + Obsolete.Images.THUMBNAIL
-                    + " FROM " + Obsolete.TABLE_IMAGES
-                    + " WHERE " + Obsolete.Images.THUMBNAIL + " IS NOT NULL");
-
-            db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_BOOKMARKS_WITH_IMAGES);
-            db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_HISTORY_WITH_IMAGES);
-            db.execSQL("DROP VIEW IF EXISTS " + Obsolete.VIEW_COMBINED_WITH_IMAGES);
-            db.execSQL("DROP VIEW IF EXISTS " + VIEW_COMBINED);
-
-            createBookmarksWithFaviconsView(db);
-            createHistoryWithFaviconsView(db);
-            createCombinedViewOn13(db);
-
-            db.execSQL("DROP TABLE IF EXISTS " + Obsolete.TABLE_IMAGES);
-        }
-
-        private void upgradeDatabaseFrom13to14(SQLiteDatabase db) {
-            createOrUpdateSpecialFolder(db, Bookmarks.PINNED_FOLDER_GUID,
-                R.string.bookmarks_folder_pinned, 6);
-        }
-
-        private void upgradeDatabaseFrom14to15(SQLiteDatabase db) {
-            Cursor c = null;
-            try {
-                // Get all the pinned bookmarks
-                c = db.query(TABLE_BOOKMARKS,
-                             new String[] { Bookmarks._ID, Bookmarks.URL },
-                             Bookmarks.PARENT + " = ?",
-                             new String[] { Integer.toString(Bookmarks.FIXED_PINNED_LIST_ID) },
-                             null, null, null);
-
-                while (c.moveToNext()) {
-                    // Check if this URL can be parsed as a URI with a valid scheme.
-                    String url = c.getString(c.getColumnIndexOrThrow(Bookmarks.URL));
-                    if (Uri.parse(url).getScheme() != null) {
-                        continue;
-                    }
-
-                    // If it can't, update the URL to be an encoded "user-entered" value.
-                    ContentValues values = new ContentValues(1);
-                    String newUrl = Uri.fromParts("user-entered", url, null).toString();
-                    values.put(Bookmarks.URL, newUrl);
-                    db.update(TABLE_BOOKMARKS, values, Bookmarks._ID + " = ?",
-                              new String[] { Integer.toString(c.getInt(c.getColumnIndexOrThrow(Bookmarks._ID))) });
-                }
-            } finally {
-                if (c != null) {
-                    c.close();
-                }
-            }
-        }
-
-        private void upgradeDatabaseFrom15to16(SQLiteDatabase db) {
-            db.execSQL("DROP VIEW IF EXISTS " + VIEW_COMBINED);
-            db.execSQL("DROP VIEW IF EXISTS " + VIEW_COMBINED_WITH_FAVICONS);
-
-            createCombinedViewOn16(db);
-        }
-
-        private void upgradeDatabaseFrom16to17(SQLiteDatabase db) {
-            // Purge any 0-byte favicons/thumbnails
-            try {
-                db.execSQL("DELETE FROM " + TABLE_FAVICONS +
-                        " WHERE length(" + Favicons.DATA + ") = 0");
-                db.execSQL("DELETE FROM " + TABLE_THUMBNAILS +
-                        " WHERE length(" + Thumbnails.DATA + ") = 0");
-            } catch (SQLException e) {
-                Log.e(LOGTAG, "Error purging invalid favicons or thumbnails", e);
-            }
-        }
-
-        @Override
-        public void onUpgrade(SQLiteDatabase db, int oldVersion, int newVersion) {
-            debug("Upgrading browser.db: " + db.getPath() + " from " +
-                    oldVersion + " to " + newVersion);
-
-            // We have to do incremental upgrades until we reach the current
-            // database schema version.
-            for (int v = oldVersion + 1; v <= newVersion; v++) {
-                switch(v) {
-                    case 2:
-                        upgradeDatabaseFrom1to2(db);
-                        break;
-
-                    case 3:
-                        upgradeDatabaseFrom2to3(db);
-                        break;
-
-                    case 4:
-                        upgradeDatabaseFrom3to4(db);
-                        break;
-
-                    case 5:
-                        upgradeDatabaseFrom4to5(db);
-                        break;
-
-                    case 6:
-                        upgradeDatabaseFrom5to6(db);
-                        break;
-
-                    case 7:
-                        upgradeDatabaseFrom6to7(db);
-                        break;
-
-                    case 8:
-                        upgradeDatabaseFrom7to8(db);
-                        break;
-
-                    case 9:
-                        upgradeDatabaseFrom8to9(db);
-                        break;
-
-                    case 10:
-                        upgradeDatabaseFrom9to10(db);
-                        break;
-
-                    case 11:
-                        upgradeDatabaseFrom10to11(db);
-                        break;
-
-                    case 12:
-                        upgradeDatabaseFrom11to12(db);
-                        break;
-
-                    case 13:
-                        upgradeDatabaseFrom12to13(db);
-                        break;
-
-                    case 14:
-                        upgradeDatabaseFrom13to14(db);
-                        break;
-
-                    case 15:
-                        upgradeDatabaseFrom14to15(db);
-                        break;
-
-                    case 16:
-                        upgradeDatabaseFrom15to16(db);
-                        break;
-
-                    case 17:
-                        upgradeDatabaseFrom16to17(db);
-                        break;
-                }
-            }
-
-            // If an upgrade after 12->13 fails, the entire upgrade is rolled
-            // back, but we can't undo the deletion of favicon_urls.db if we
-            // delete this in step 13; therefore, we wait until all steps are
-            // complete before removing it.
-            if (oldVersion < 13 && newVersion >= 13
-                                && mContext.getDatabasePath(Obsolete.FAVICON_DB).exists()
-                                && !mContext.deleteDatabase(Obsolete.FAVICON_DB)) {
-                throw new SQLException("Could not delete " + Obsolete.FAVICON_DB);
-            }
-        }
-
-        @Override
-        public void onOpen(SQLiteDatabase db) {
-            debug("Opening browser.db: " + db.getPath());
-
-            Cursor cursor = null;
-            try {
-                cursor = db.rawQuery("PRAGMA foreign_keys=ON", null);
-            } finally {
-                if (cursor != null)
-                    cursor.close();
-            }
-            cursor = null;
-            try {
-                cursor = db.rawQuery("PRAGMA synchronous=NORMAL", null);
-            } finally {
-                if (cursor != null)
-                    cursor.close();
-            }
-
-            // From Honeycomb on, it's possible to run several db
-            // commands in parallel using multiple connections.
-            if (Build.VERSION.SDK_INT >= 11) {
-                db.enableWriteAheadLogging();
-                db.setLockingEnabled(false);
-            } else {
-                // Pre-Honeycomb, we can do some lesser optimizations.
-                cursor = null;
-                try {
-                    cursor = db.rawQuery("PRAGMA journal_mode=PERSIST", null);
-                } finally {
-                    if (cursor != null)
-                        cursor.close();
-                }
-            }
-        }
-    }
-
-    private static final String[] mobileIdColumns = new String[] { Bookmarks._ID };
-    private static final String[] mobileIdSelectionArgs = new String[] { Bookmarks.MOBILE_FOLDER_GUID };
-
-    private Integer getMobileFolderId(SQLiteDatabase db) {
-        Cursor c = null;
-
-        try {
-            c = db.query(TABLE_BOOKMARKS,
-                         mobileIdColumns,
-                         Bookmarks.GUID + " = ?",
-                         mobileIdSelectionArgs,
-                         null, null, null);
-
-            if (c == null || !c.moveToFirst())
-                return null;
-
-            return c.getInt(c.getColumnIndex(Bookmarks._ID));
-        } finally {
-            if (c != null)
-                c.close();
-        }
-    }
-
-    private SQLiteDatabase getReadableDatabase(Uri uri) {
-        trace("Getting readable database for URI: " + uri);
-
-        String profile = null;
-
-        if (uri != null)
-            profile = uri.getQueryParameter(BrowserContract.PARAM_PROFILE);
-
-        return mDatabases.getDatabaseHelperForProfile(profile, isTest(uri)).getReadableDatabase();
-    }
-
-    private SQLiteDatabase getWritableDatabase(Uri uri) {
-        trace("Getting writable database for URI: " + uri);
-
-        String profile = null;
-
-        if (uri != null)
-            profile = uri.getQueryParameter(BrowserContract.PARAM_PROFILE);
-
-        return mDatabases.getDatabaseHelperForProfile(profile, isTest(uri)).getWritableDatabase();
-    }
-
     private void cleanupSomeDeletedRecords(Uri fromUri, Uri targetUri, String tableName) {
         Log.d(LOGTAG, "Cleaning up deleted records from " + tableName);
 
@@ -2077,7 +367,7 @@ public class BrowserProvider extends ContentProvider {
         final String sql = "DELETE FROM " + TABLE_THUMBNAILS +
                            " WHERE " + Thumbnails.URL + " NOT IN ( " +
                              " SELECT " + Combined.URL +
-                             " FROM " + VIEW_COMBINED +
+                             " FROM " + Combined.VIEW_NAME +
                              " ORDER BY " + sortOrder +
                              " LIMIT " + DEFAULT_EXPIRY_THUMBNAIL_COUNT +
                            ") AND " + Thumbnails.URL + " NOT IN ( " +
@@ -2094,11 +384,6 @@ public class BrowserProvider extends ContentProvider {
         return !TextUtils.isEmpty(isSync);
     }
 
-    private boolean isTest(Uri uri) {
-        String isTest = uri.getQueryParameter(BrowserContract.PARAM_IS_TEST);
-        return !TextUtils.isEmpty(isTest);
-    }
-
     private boolean shouldShowDeleted(Uri uri) {
         String showDeleted = uri.getQueryParameter(BrowserContract.PARAM_SHOW_DELETED);
         return !TextUtils.isEmpty(showDeleted);
@@ -2114,24 +399,6 @@ public class BrowserProvider extends ContentProvider {
         return Boolean.parseBoolean(incrementVisits);
     }
 
-    @Override
-    public boolean onCreate() {
-        debug("Creating BrowserProvider");
-
-        synchronized (this) {
-            mContext = getContext();
-            mDatabases = new PerProfileDatabases<BrowserDatabaseHelper>(
-                getContext(), DATABASE_NAME, new DatabaseHelperFactory<BrowserDatabaseHelper>() {
-                    @Override
-                    public BrowserDatabaseHelper makeDatabaseHelper(Context context, String databasePath) {
-                        return new BrowserDatabaseHelper(context, databasePath);
-                    }
-                });
-        }
-
-        return true;
-    }
-
     @Override
     public String getType(Uri uri) {
         final int match = URI_MATCHER.match(uri);
@@ -2161,37 +428,11 @@ public class BrowserProvider extends ContentProvider {
         return null;
     }
 
-    @Override
-    public int delete(Uri uri, String selection, String[] selectionArgs) {
-        trace("Calling delete on URI: " + uri);
-
-        final SQLiteDatabase db = getWritableDatabase(uri);
-        int deleted = 0;
-
-        if (Build.VERSION.SDK_INT >= 11) {
-            trace("Beginning delete transaction: " + uri);
-            db.beginTransaction();
-            try {
-                deleted = deleteInTransaction(db, uri, selection, selectionArgs);
-                db.setTransactionSuccessful();
-                trace("Successful delete transaction: " + uri);
-            } finally {
-                db.endTransaction();
-            }
-        } else {
-            deleted = deleteInTransaction(db, uri, selection, selectionArgs);
-        }
-
-        if (deleted > 0)
-            getContext().getContentResolver().notifyChange(uri, null);
-
-        return deleted;
-    }
-
     @SuppressWarnings("fallthrough")
-    public int deleteInTransaction(SQLiteDatabase db, Uri uri, String selection, String[] selectionArgs) {
+    @Override
+    public int deleteInTransaction(Uri uri, String selection, String[] selectionArgs) {
         trace("Calling delete in transaction on URI: " + uri);
-
+        final SQLiteDatabase db = getWritableDatabase(uri);
         final int match = URI_MATCHER.match(uri);
         int deleted = 0;
 
@@ -2275,37 +516,6 @@ public class BrowserProvider extends ContentProvider {
     }
 
     @Override
-    public Uri insert(Uri uri, ContentValues values) {
-        trace("Calling insert on URI: " + uri);
-
-        final SQLiteDatabase db = getWritableDatabase(uri);
-        Uri result = null;
-        try {
-            if (Build.VERSION.SDK_INT >= 11) {
-                trace("Beginning insert transaction: " + uri);
-                db.beginTransaction();
-                try {
-                    result = insertInTransaction(uri, values);
-                    db.setTransactionSuccessful();
-                    trace("Successful insert transaction: " + uri);
-                } finally {
-                    db.endTransaction();
-                }
-            } else {
-                result = insertInTransaction(uri, values);
-            }
-        } catch (SQLException sqle) {
-            Log.e(LOGTAG, "exception in DB operation", sqle);
-        } catch (UnsupportedOperationException uoe) {
-            Log.e(LOGTAG, "don't know how to perform that insert", uoe);
-        }
-
-        if (result != null)
-            getContext().getContentResolver().notifyChange(uri, null);
-
-        return result;
-    }
-
     public Uri insertInTransaction(Uri uri, ContentValues values) {
         trace("Calling insert in transaction on URI: " + uri);
 
@@ -2349,35 +559,8 @@ public class BrowserProvider extends ContentProvider {
         return null;
     }
 
-    @Override
-    public int update(Uri uri, ContentValues values, String selection,
-            String[] selectionArgs) {
-        trace("Calling update on URI: " + uri);
-
-        final SQLiteDatabase db = getWritableDatabase(uri);
-        int updated = 0;
-
-        if (Build.VERSION.SDK_INT >= 11) {
-            trace("Beginning update transaction: " + uri);
-            db.beginTransaction();
-            try {
-                updated = updateInTransaction(uri, values, selection, selectionArgs);
-                db.setTransactionSuccessful();
-                trace("Successful update transaction: " + uri);
-            } finally {
-                db.endTransaction();
-            }
-        } else {
-            updated = updateInTransaction(uri, values, selection, selectionArgs);
-        }
-
-        if (updated > 0)
-            getContext().getContentResolver().notifyChange(uri, null);
-
-        return updated;
-    }
-
     @SuppressWarnings("fallthrough")
+    @Override
     public int updateInTransaction(Uri uri, ContentValues values, String selection,
             String[] selectionArgs) {
         trace("Calling update in transaction on URI: " + uri);
@@ -2586,7 +769,7 @@ public class BrowserProvider extends ContentProvider {
             case SCHEMA: {
                 debug("Query is on schema.");
                 MatrixCursor schemaCursor = new MatrixCursor(new String[] { Schema.VERSION });
-                schemaCursor.newRow().add(DATABASE_VERSION);
+                schemaCursor.newRow().add(BrowserDatabaseHelper.DATABASE_VERSION);
 
                 return schemaCursor;
             }
@@ -2606,7 +789,7 @@ public class BrowserProvider extends ContentProvider {
                 if (hasFaviconsInProjection(projection))
                     qb.setTables(VIEW_COMBINED_WITH_FAVICONS);
                 else
-                    qb.setTables(VIEW_COMBINED);
+                    qb.setTables(Combined.VIEW_NAME);
 
                 break;
             }
@@ -2959,13 +1142,15 @@ public class BrowserProvider extends ContentProvider {
     }
 
     long insertFavicon(SQLiteDatabase db, ContentValues values) {
+        // This method is a dupicate of BrowserDatabaseHelper.insertFavicon.
+        // If changes are needed, please update both
         String faviconUrl = values.getAsString(Favicons.URL);
         String pageUrl = null;
         long faviconId;
 
         trace("Inserting favicon for URL: " + faviconUrl);
 
-        stripEmptyByteArray(values, Favicons.DATA);
+        DBUtils.stripEmptyByteArray(values, Favicons.DATA);
 
         // Extract the page URL from the ContentValues
         if (values.containsKey(Favicons.PAGE_URL)) {
@@ -3014,7 +1199,7 @@ public class BrowserProvider extends ContentProvider {
 
         trace("Updating favicon for URL: " + faviconUrl);
 
-        stripEmptyByteArray(values, Favicons.DATA);
+        DBUtils.stripEmptyByteArray(values, Favicons.DATA);
 
         // Extract the page URL from the ContentValues
         if (values.containsKey(Favicons.PAGE_URL)) {
@@ -3068,7 +1253,7 @@ public class BrowserProvider extends ContentProvider {
 
         trace("Inserting thumbnail for URL: " + url);
 
-        stripEmptyByteArray(values, Thumbnails.DATA);
+        DBUtils.stripEmptyByteArray(values, Thumbnails.DATA);
 
         return db.insertOrThrow(TABLE_THUMBNAILS, null, values);
     }
@@ -3091,7 +1276,7 @@ public class BrowserProvider extends ContentProvider {
         int updated = 0;
         final SQLiteDatabase db = getWritableDatabase(uri);
 
-        stripEmptyByteArray(values, Thumbnails.DATA);
+        DBUtils.stripEmptyByteArray(values, Thumbnails.DATA);
 
         trace("Updating thumbnail for URL: " + url);
 
@@ -3106,21 +1291,6 @@ public class BrowserProvider extends ContentProvider {
         return updated;
     }
 
-    /**
-     * Verifies that 0-byte arrays aren't added as favicon or thumbnail data.
-     * @param values        ContentValues of query
-     * @param columnName    Name of data column to verify
-     */
-    private void stripEmptyByteArray(ContentValues values, String columnName) {
-        if (values.containsKey(columnName)) {
-            byte[] data = values.getAsByteArray(columnName);
-            if (data == null || data.length == 0) {
-                Log.w(LOGTAG, "Tried to insert an empty or non-byte-array image. Ignoring.");
-                values.putNull(columnName);
-            }
-        }
-    }
-
     int deleteHistory(Uri uri, String selection, String[] selectionArgs) {
         debug("Deleting history entry for URI: " + uri);
 
@@ -3279,31 +1449,13 @@ public class BrowserProvider extends ContentProvider {
     }
 
     @Override
-    public int bulkInsert(Uri uri, ContentValues[] values) {
-        if (values == null)
-            return 0;
+    protected BrowserDatabaseHelper createDatabaseHelper(
+            Context context, String databasePath) {
+         return new BrowserDatabaseHelper(context, databasePath);
+    }
 
-        int numValues = values.length;
-        int successes = 0;
-
-        final SQLiteDatabase db = getWritableDatabase(uri);
-
-        db.beginTransaction();
-
-        try {
-            for (int i = 0; i < numValues; i++) {
-                insertInTransaction(uri, values[i]);
-                successes++;
-            }
-            trace("Flushing DB bulkinsert...");
-            db.setTransactionSuccessful();
-        } finally {
-            db.endTransaction();
-        }
-
-        if (successes > 0)
-            mContext.getContentResolver().notifyChange(uri, null);
-
-        return successes;
+    @Override
+    protected String getDatabaseName() {
+        return BrowserDatabaseHelper.DATABASE_NAME;
     }
 }
diff --git a/mobile/android/base/db/DBUtils.java b/mobile/android/base/db/DBUtils.java
index 71689c4a6b2f..658171513405 100644
--- a/mobile/android/base/db/DBUtils.java
+++ b/mobile/android/base/db/DBUtils.java
@@ -81,4 +81,19 @@ public class DBUtils {
         Log.d(LOGTAG, "Failed to unlock database");
         GeckoAppShell.listOfOpenFiles();
     }
+
+    /**
+     * Verifies that 0-byte arrays aren't added as favicon or thumbnail data.
+     * @param values        ContentValues of query
+     * @param columnName    Name of data column to verify
+     */
+    public static void stripEmptyByteArray(ContentValues values, String columnName) {
+        if (values.containsKey(columnName)) {
+            byte[] data = values.getAsByteArray(columnName);
+            if (data == null || data.length == 0) {
+                Log.w(LOGTAG, "Tried to insert an empty or non-byte-array image. Ignoring.");
+                values.putNull(columnName);
+            }
+        }
+    }
 }
diff --git a/mobile/android/base/db/TransactionalProvider.java b/mobile/android/base/db/TransactionalProvider.java
new file mode 100644
index 000000000000..0234c25227a3
--- /dev/null
+++ b/mobile/android/base/db/TransactionalProvider.java
@@ -0,0 +1,277 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.db;
+
+import org.mozilla.gecko.db.PerProfileDatabases.DatabaseHelperFactory;
+
+import android.content.ContentProvider;
+import android.content.ContentValues;
+import android.content.Context;
+import android.database.SQLException;
+import android.database.sqlite.SQLiteDatabase;
+import android.database.sqlite.SQLiteOpenHelper;
+import android.net.Uri;
+import android.os.Build;
+import android.text.TextUtils;
+import android.util.Log;
+
+/*
+ * Abstract class containing methods needed to make a SQLite-based content provider with a
+ * database helper of type T. Abstract methods insertInTransaction, deleteInTransaction and
+ * updateInTransaction all called within a DB transaction so failed modifications can be rolled-back.
+ */
+public abstract class TransactionalProvider<T extends SQLiteOpenHelper> extends ContentProvider {
+    private static final String LOGTAG = "GeckoTransProvider";
+    protected Context mContext;
+    protected PerProfileDatabases<T> mDatabases;
+
+    /*
+     * Returns the name of the database file. Used to get a path
+     * to the DB file.
+     *
+     * @return name of the database file
+     */
+    abstract protected String getDatabaseName();
+
+    /*
+     * Creates and returns an instance of a DB helper. Given a
+     * context and a path to the DB file
+     *
+     * @param  context       to use to create the database helper
+     * @param  databasePath  path to the DB file
+     * @return               instance of the database helper
+     */
+    abstract protected T createDatabaseHelper(Context context, String databasePath);
+
+    /*
+     * Inserts an item into the database within a DB transaction.
+     *
+     * @param uri    query URI
+     * @param values column values to be inserted
+     * @return       a URI for the newly inserted item
+     */
+    abstract protected Uri insertInTransaction(Uri uri, ContentValues values);
+
+    /*
+     * Deletes items from the database within a DB transaction.
+     *
+     * @param uri            query URI
+     * @param selection      An optional filter to match rows to update.
+     * @param selectionArgs  arguments for the selection
+     * @return               number of rows impacted by the deletion
+     */
+    abstract protected int deleteInTransaction(Uri uri, String selection, String[] selectionArgs);
+
+    /*
+     * Updates the database within a DB transaction.
+     *
+     * @param uri            Query URI
+     * @param values         A set of column_name/value pairs to add to the database.
+     * @param selection      An optional filter to match rows to update.
+     * @param selectionArgs  Arguments for the selection
+     * @return               number of rows impacted by the update
+     */
+    abstract protected int updateInTransaction(Uri uri, ContentValues values, String selection, String[] selectionArgs);
+
+    /*
+     * Fetches a readable database based on the profile indicated in the
+     * passed URI. If the URI does not contain a profile param, the default profile
+     * is used.
+     *
+     * @param uri content URI optionally indicating the profile of the user
+     * @return    instance of a readable SQLiteDatabase
+     */
+    protected SQLiteDatabase getReadableDatabase(Uri uri) {
+        String profile = null;
+        if (uri != null) {
+            profile = uri.getQueryParameter(BrowserContract.PARAM_PROFILE);
+        }
+
+        return mDatabases.getDatabaseHelperForProfile(profile, isTest(uri)).getReadableDatabase();
+    }
+
+    /*
+     * Fetches a writeable database based on the profile indicated in the
+     * passed URI. If the URI does not contain a profile param, the default profile
+     * is used
+     *
+     * @param uri content URI optionally indicating the profile of the user
+     * @return    instance of a writeable SQLiteDatabase
+     */
+    protected SQLiteDatabase getWritableDatabase(Uri uri) {
+        String profile = null;
+        if (uri != null) {
+            profile = uri.getQueryParameter(BrowserContract.PARAM_PROFILE);
+        }
+
+        return mDatabases.getDatabaseHelperForProfile(profile, isTest(uri)).getWritableDatabase();
+    }
+
+    @Override
+    public boolean onCreate() {
+        synchronized (this) {
+            mContext = getContext();
+            mDatabases = new PerProfileDatabases<T>(
+                getContext(), getDatabaseName(), new DatabaseHelperFactory<T>() {
+                    @Override
+                    public T makeDatabaseHelper(Context context, String databasePath) {
+                        return createDatabaseHelper(context, databasePath);
+                    }
+                });
+        }
+
+        return true;
+    }
+
+    @Override
+    public int delete(Uri uri, String selection, String[] selectionArgs) {
+        trace("Calling delete on URI: " + uri);
+
+        final SQLiteDatabase db = getWritableDatabase(uri);
+        int deleted = 0;
+
+        if (Build.VERSION.SDK_INT >= 11) {
+            trace("Beginning delete transaction: " + uri);
+            db.beginTransaction();
+            try {
+                deleted = deleteInTransaction(uri, selection, selectionArgs);
+                db.setTransactionSuccessful();
+                trace("Successful delete transaction: " + uri);
+            } finally {
+                db.endTransaction();
+            }
+        } else {
+            deleted = deleteInTransaction(uri, selection, selectionArgs);
+        }
+
+        if (deleted > 0) {
+            getContext().getContentResolver().notifyChange(uri, null);
+        }
+
+        return deleted;
+    }
+
+    @Override
+    public Uri insert(Uri uri, ContentValues values) {
+        trace("Calling insert on URI: " + uri);
+
+        final SQLiteDatabase db = getWritableDatabase(uri);
+        Uri result = null;
+        try {
+            if (Build.VERSION.SDK_INT >= 11) {
+                trace("Beginning insert transaction: " + uri);
+                db.beginTransaction();
+                try {
+                    result = insertInTransaction(uri, values);
+                    db.setTransactionSuccessful();
+                    trace("Successful insert transaction: " + uri);
+                } finally {
+                    db.endTransaction();
+                }
+            } else {
+                result = insertInTransaction(uri, values);
+            }
+        } catch (SQLException sqle) {
+            Log.e(LOGTAG, "exception in DB operation", sqle);
+        } catch (UnsupportedOperationException uoe) {
+            Log.e(LOGTAG, "don't know how to perform that insert", uoe);
+        }
+
+        if (result != null) {
+            getContext().getContentResolver().notifyChange(uri, null);
+        }
+
+        return result;
+    }
+
+
+    @Override
+    public int update(Uri uri, ContentValues values, String selection,
+            String[] selectionArgs) {
+        trace("Calling update on URI: " + uri);
+
+        final SQLiteDatabase db = getWritableDatabase(uri);
+        int updated = 0;
+
+        if (Build.VERSION.SDK_INT >= 11) {
+            trace("Beginning update transaction: " + uri);
+            db.beginTransaction();
+            try {
+                updated = updateInTransaction(uri, values, selection, selectionArgs);
+                db.setTransactionSuccessful();
+                trace("Successful update transaction: " + uri);
+            } finally {
+                db.endTransaction();
+            }
+        } else {
+            updated = updateInTransaction(uri, values, selection, selectionArgs);
+        }
+
+        if (updated > 0) {
+            getContext().getContentResolver().notifyChange(uri, null);
+        }
+
+        return updated;
+    }
+
+    @Override
+    public int bulkInsert(Uri uri, ContentValues[] values) {
+        if (values == null) {
+            return 0;
+        }
+
+        int numValues = values.length;
+        int successes = 0;
+
+        final boolean hasTransactions = Build.VERSION.SDK_INT >= 11;
+        final SQLiteDatabase db = getWritableDatabase(uri);
+
+        if (hasTransactions) {
+            db.beginTransaction();
+        }
+
+        try {
+            for (int i = 0; i < numValues; i++) {
+                insertInTransaction(uri, values[i]);
+                successes++;
+            }
+            if (hasTransactions) {
+                trace("Flushing DB bulkinsert...");
+                db.setTransactionSuccessful();
+            }
+        } finally {
+            if (hasTransactions) {
+                db.endTransaction();
+            }
+        }
+
+        if (successes > 0) {
+            mContext.getContentResolver().notifyChange(uri, null);
+        }
+
+        return successes;
+    }
+
+    protected boolean isTest(Uri uri) {
+        String isTest = uri.getQueryParameter(BrowserContract.PARAM_IS_TEST);
+        return !TextUtils.isEmpty(isTest);
+    }
+
+    // Calculate these once, at initialization. isLoggable is too expensive to
+    // have in-line in each log call.
+    private static boolean logDebug   = Log.isLoggable(LOGTAG, Log.DEBUG);
+    private static boolean logVerbose = Log.isLoggable(LOGTAG, Log.VERBOSE);
+    protected static void trace(String message) {
+        if (logVerbose) {
+            Log.v(LOGTAG, message);
+        }
+    }
+
+    protected static void debug(String message) {
+        if (logDebug) {
+            Log.d(LOGTAG, message);
+        }
+    }
+}
diff --git a/mobile/android/base/fxa/sync/FxAccountSyncAdapter.java b/mobile/android/base/fxa/sync/FxAccountSyncAdapter.java
index 01a5be4b5106..bbf85f14409c 100644
--- a/mobile/android/base/fxa/sync/FxAccountSyncAdapter.java
+++ b/mobile/android/base/fxa/sync/FxAccountSyncAdapter.java
@@ -265,6 +265,10 @@ public class FxAccountSyncAdapter extends AbstractThreadedSyncAdapter {
         Logger.error(LOG_TAG, "Failed to get token.", e);
         callback.handleError(null, e);
       }
+
+      @Override
+      public void handleBackoff(int backoffSeconds) {
+      }
     });
   }
 
diff --git a/mobile/android/base/moz.build b/mobile/android/base/moz.build
index 1133aa6d425c..404a849de84e 100644
--- a/mobile/android/base/moz.build
+++ b/mobile/android/base/moz.build
@@ -112,6 +112,7 @@ gbjar.sources += [
     'CustomEditText.java',
     'DataReportingNotification.java',
     'db/BrowserContract.java',
+    'db/BrowserDatabaseHelper.java',
     'db/BrowserDB.java',
     'db/BrowserProvider.java',
     'db/DBUtils.java',
@@ -122,6 +123,7 @@ gbjar.sources += [
     'db/PerProfileDatabases.java',
     'db/SQLiteBridgeContentProvider.java',
     'db/TabsProvider.java',
+    'db/TransactionalProvider.java',
     'Distribution.java',
     'DoorHangerPopup.java',
     'EditBookmarkDialog.java',
diff --git a/mobile/android/base/resources/drawable-hdpi/fxaccount_checkbox.png b/mobile/android/base/resources/drawable-hdpi/fxaccount_checkbox.png
index 11e89d34aba2..f6ef37ba9405 100755
Binary files a/mobile/android/base/resources/drawable-hdpi/fxaccount_checkbox.png and b/mobile/android/base/resources/drawable-hdpi/fxaccount_checkbox.png differ
diff --git a/mobile/android/base/resources/drawable-hdpi/fxaccount_ddarrow_active.png b/mobile/android/base/resources/drawable-hdpi/fxaccount_ddarrow_active.png
index 4abb71ee3cdb..a8782e2d6656 100644
Binary files a/mobile/android/base/resources/drawable-hdpi/fxaccount_ddarrow_active.png and b/mobile/android/base/resources/drawable-hdpi/fxaccount_ddarrow_active.png differ
diff --git a/mobile/android/base/resources/drawable-hdpi/fxaccount_ddarrow_inactive.png b/mobile/android/base/resources/drawable-hdpi/fxaccount_ddarrow_inactive.png
index 204562d39f09..8314fc45b04f 100644
Binary files a/mobile/android/base/resources/drawable-hdpi/fxaccount_ddarrow_inactive.png and b/mobile/android/base/resources/drawable-hdpi/fxaccount_ddarrow_inactive.png differ
diff --git a/mobile/android/base/resources/drawable-hdpi/fxaccount_icon.png b/mobile/android/base/resources/drawable-hdpi/fxaccount_icon.png
index 131f05dd288a..03a16d427eae 100755
Binary files a/mobile/android/base/resources/drawable-hdpi/fxaccount_icon.png and b/mobile/android/base/resources/drawable-hdpi/fxaccount_icon.png differ
diff --git a/mobile/android/base/resources/drawable-hdpi/fxaccount_mail.png b/mobile/android/base/resources/drawable-hdpi/fxaccount_mail.png
index 3a2e33adfcc3..23ebe23741ed 100755
Binary files a/mobile/android/base/resources/drawable-hdpi/fxaccount_mail.png and b/mobile/android/base/resources/drawable-hdpi/fxaccount_mail.png differ
diff --git a/mobile/android/base/resources/drawable-hdpi/fxaccount_sync_icon.png b/mobile/android/base/resources/drawable-hdpi/fxaccount_sync_icon.png
index 1b6e67572fb2..fe2e174886c9 100644
Binary files a/mobile/android/base/resources/drawable-hdpi/fxaccount_sync_icon.png and b/mobile/android/base/resources/drawable-hdpi/fxaccount_sync_icon.png differ
diff --git a/mobile/android/base/resources/drawable-mdpi/fxaccount_checkbox.png b/mobile/android/base/resources/drawable-mdpi/fxaccount_checkbox.png
index 1a50daf6de8d..1c1d14c0c9fe 100644
Binary files a/mobile/android/base/resources/drawable-mdpi/fxaccount_checkbox.png and b/mobile/android/base/resources/drawable-mdpi/fxaccount_checkbox.png differ
diff --git a/mobile/android/base/resources/drawable-mdpi/fxaccount_ddarrow_active.png b/mobile/android/base/resources/drawable-mdpi/fxaccount_ddarrow_active.png
index bb978372f0ea..d1fd254cd5f2 100644
Binary files a/mobile/android/base/resources/drawable-mdpi/fxaccount_ddarrow_active.png and b/mobile/android/base/resources/drawable-mdpi/fxaccount_ddarrow_active.png differ
diff --git a/mobile/android/base/resources/drawable-mdpi/fxaccount_ddarrow_inactive.png b/mobile/android/base/resources/drawable-mdpi/fxaccount_ddarrow_inactive.png
index 7d82a89cb183..82304783977b 100644
Binary files a/mobile/android/base/resources/drawable-mdpi/fxaccount_ddarrow_inactive.png and b/mobile/android/base/resources/drawable-mdpi/fxaccount_ddarrow_inactive.png differ
diff --git a/mobile/android/base/resources/drawable-mdpi/fxaccount_icon.png b/mobile/android/base/resources/drawable-mdpi/fxaccount_icon.png
index b6e7595e0bf7..b328c7b44144 100644
Binary files a/mobile/android/base/resources/drawable-mdpi/fxaccount_icon.png and b/mobile/android/base/resources/drawable-mdpi/fxaccount_icon.png differ
diff --git a/mobile/android/base/resources/drawable-mdpi/fxaccount_mail.png b/mobile/android/base/resources/drawable-mdpi/fxaccount_mail.png
index bcb5f1596358..2f7d92b706c5 100644
Binary files a/mobile/android/base/resources/drawable-mdpi/fxaccount_mail.png and b/mobile/android/base/resources/drawable-mdpi/fxaccount_mail.png differ
diff --git a/mobile/android/base/resources/drawable-mdpi/fxaccount_sync_error.png b/mobile/android/base/resources/drawable-mdpi/fxaccount_sync_error.png
index 71f60fb224ee..5b084016df13 100644
Binary files a/mobile/android/base/resources/drawable-mdpi/fxaccount_sync_error.png and b/mobile/android/base/resources/drawable-mdpi/fxaccount_sync_error.png differ
diff --git a/mobile/android/base/resources/drawable-mdpi/sync_desktop.png b/mobile/android/base/resources/drawable-mdpi/sync_desktop.png
index 83f98d3c0b11..e470ebc6d671 100644
Binary files a/mobile/android/base/resources/drawable-mdpi/sync_desktop.png and b/mobile/android/base/resources/drawable-mdpi/sync_desktop.png differ
diff --git a/mobile/android/base/resources/drawable-mdpi/sync_mobile.png b/mobile/android/base/resources/drawable-mdpi/sync_mobile.png
index c237c29559c2..51efb99a2175 100644
Binary files a/mobile/android/base/resources/drawable-mdpi/sync_mobile.png and b/mobile/android/base/resources/drawable-mdpi/sync_mobile.png differ
diff --git a/mobile/android/base/sync/net/SyncResponse.java b/mobile/android/base/sync/net/SyncResponse.java
index 2409f7c72585..b0e676a7e8fe 100644
--- a/mobile/android/base/sync/net/SyncResponse.java
+++ b/mobile/android/base/sync/net/SyncResponse.java
@@ -49,6 +49,20 @@ public class SyncResponse {
     return this.getStatusCode() == 200;
   }
 
+  /**
+   * Fetch the content type of the HTTP response body.
+   *
+   * @return a <code>Header</code> instance, or <code>null</code> if there was
+   *         no body or no valid Content-Type.
+   */
+  public Header getContentType() {
+    HttpEntity entity = this.response.getEntity();
+    if (entity == null) {
+      return null;
+    }
+    return entity.getContentType();
+  }
+
   private String body = null;
   public String body() throws IllegalStateException, IOException {
     if (body != null) {
@@ -145,6 +159,14 @@ public class SyncResponse {
     }
   }
 
+  /**
+   * @return A number of seconds, or -1 if the 'X-Backoff' header was not
+   *         present.
+   */
+  public int backoffInSeconds() throws NumberFormatException {
+    return this.getIntegerHeader("x-backoff");
+  }
+
   /**
    * @return A number of seconds, or -1 if the 'X-Weave-Backoff' header was not
    *         present.
@@ -154,14 +176,21 @@ public class SyncResponse {
   }
 
   /**
-   * @return A number of milliseconds, or -1 if neither the 'Retry-After' or
-   *         'X-Weave-Backoff' header was present.
+   * Extract a number of seconds, or -1 if none of the specified headers were present.
+   *
+   * @param includeRetryAfter
+   *          if <code>true</code>, the Retry-After header is excluded. This is
+   *          useful for processing non-error responses where a Retry-After
+   *          header would be unexpected.
+   * @return the maximum of the three possible backoff headers, in seconds.
    */
-  public long totalBackoffInMilliseconds() {
+  public int totalBackoffInSeconds(boolean includeRetryAfter) {
     int retryAfterInSeconds = -1;
-    try {
-      retryAfterInSeconds = retryAfterInSeconds();
-    } catch (NumberFormatException e) {
+    if (includeRetryAfter) {
+      try {
+        retryAfterInSeconds = retryAfterInSeconds();
+      } catch (NumberFormatException e) {
+      }
     }
 
     int weaveBackoffInSeconds = -1;
@@ -170,7 +199,26 @@ public class SyncResponse {
     } catch (NumberFormatException e) {
     }
 
-    long totalBackoff = (long) Math.max(retryAfterInSeconds, weaveBackoffInSeconds);
+    int backoffInSeconds = -1;
+    try {
+      backoffInSeconds = backoffInSeconds();
+    } catch (NumberFormatException e) {
+    }
+
+    int totalBackoff = Math.max(retryAfterInSeconds, Math.max(backoffInSeconds, weaveBackoffInSeconds));
+    if (totalBackoff < 0) {
+      return -1;
+    } else {
+      return totalBackoff;
+    }
+  }
+
+  /**
+   * @return A number of milliseconds, or -1 if neither the 'Retry-After',
+   *         'X-Backoff', or 'X-Weave-Backoff' header were present.
+   */
+  public long totalBackoffInMilliseconds() {
+    long totalBackoff = totalBackoffInSeconds(true);
     if (totalBackoff < 0) {
       return -1;
     } else {
diff --git a/mobile/android/base/sync/net/SyncStorageRecordRequest.java b/mobile/android/base/sync/net/SyncStorageRecordRequest.java
index 88bf81ab73ab..5e87ce8c8ef9 100644
--- a/mobile/android/base/sync/net/SyncStorageRecordRequest.java
+++ b/mobile/android/base/sync/net/SyncStorageRecordRequest.java
@@ -25,6 +25,7 @@ import org.mozilla.gecko.sync.ThreadPool;
  * * Headers:
  *   * Retry-After
  *   * X-Weave-Backoff
+ *   * X-Backoff
  *   * X-Weave-Records?
  *   * ...
  * * Timeouts
diff --git a/mobile/android/base/tests/BaseTest.java b/mobile/android/base/tests/BaseTest.java
index 4df04e21948c..8d5f57c6d138 100644
--- a/mobile/android/base/tests/BaseTest.java
+++ b/mobile/android/base/tests/BaseTest.java
@@ -59,11 +59,6 @@ abstract class BaseTest extends ActivityInstrumentationTestCase2<Activity> {
     public static final int MAX_WAIT_MS = 4500;
     public static final int LONG_PRESS_TIME = 6000;
 
-    // IDs for UI views
-    private static final String BROWSER_TOOLBAR_ID = "browser_toolbar";
-    protected static final String URL_EDIT_TEXT_ID = "url_edit_text";
-    protected static final String URL_BAR_TITLE_ID = "url_bar_title";
-
     private static Class<Activity> mLauncherActivityClass;
     private Activity mActivity;
     protected Solo mSolo;
@@ -185,7 +180,7 @@ abstract class BaseTest extends ActivityInstrumentationTestCase2<Activity> {
      */
     protected final void focusUrlBar() {
         // Click on the browser toolbar to enter editing mode
-        final View toolbarView = mSolo.getView(BROWSER_TOOLBAR_ID);
+        final View toolbarView = mSolo.getView(R.id.browser_toolbar);
         mSolo.clickOnView(toolbarView);
 
         // Wait for highlighed text to gain focus
@@ -206,7 +201,7 @@ abstract class BaseTest extends ActivityInstrumentationTestCase2<Activity> {
     }
 
     protected final void enterUrl(String url) {
-        final EditText urlEditView = (EditText) mSolo.getView(URL_EDIT_TEXT_ID);
+        final EditText urlEditView = (EditText) mSolo.getView(R.id.url_edit_text);
 
         focusUrlBar();
 
@@ -260,7 +255,7 @@ abstract class BaseTest extends ActivityInstrumentationTestCase2<Activity> {
     }
 
     public final void verifyUrl(String url) {
-        final EditText urlEditText = (EditText) mSolo.getView(URL_EDIT_TEXT_ID);
+        final EditText urlEditText = (EditText) mSolo.getView(R.id.url_edit_text);
         String urlBarText = null;
         if (urlEditText != null) {
             // wait for a short time for the expected text, in case there is a delay
@@ -488,7 +483,7 @@ abstract class BaseTest extends ActivityInstrumentationTestCase2<Activity> {
     }
 
     public final void verifyHomePagerHidden() {
-        final View homePagerView = mSolo.getView("home_pager");
+        final View homePagerView = mSolo.getView(R.id.home_pager);
 
         boolean rc = waitForCondition(new Condition() {
             @Override
@@ -503,7 +498,7 @@ abstract class BaseTest extends ActivityInstrumentationTestCase2<Activity> {
     }
 
     public final void verifyPageTitle(String title) {
-        final TextView urlBarTitle = (TextView) mSolo.getView(URL_BAR_TITLE_ID);
+        final TextView urlBarTitle = (TextView) mSolo.getView(R.id.url_bar_title);
         String pageTitle = null;
         if (urlBarTitle != null) {
             // Wait for the title to make sure it has been displayed in case the view
@@ -515,8 +510,7 @@ abstract class BaseTest extends ActivityInstrumentationTestCase2<Activity> {
     }
 
     public final void verifyTabCount(int expectedTabCount) {
-        Activity activity = getActivity();
-        Element tabCount = mDriver.findElement(activity, "tabs_counter");
+        Element tabCount = mDriver.findElement(getActivity(), R.id.tabs_counter);
         String tabCountText = tabCount.getText();
         int tabCountInt = Integer.parseInt(tabCountText);
         mAsserter.is(tabCountInt, expectedTabCount, "The correct number of tabs are opened");
@@ -544,12 +538,12 @@ abstract class BaseTest extends ActivityInstrumentationTestCase2<Activity> {
     }
 
     public void addTab() {
-        mSolo.clickOnView(mSolo.getView("tabs"));
+        mSolo.clickOnView(mSolo.getView(R.id.tabs));
         // wait for addTab to appear (this is usually immediate)
         boolean success = waitForCondition(new Condition() {
             @Override
             public boolean isSatisfied() {
-                View addTabView = mSolo.getView("add_tab");
+                View addTabView = mSolo.getView(R.id.add_tab);
                 if (addTabView == null) {
                     return false;
                 }
@@ -557,8 +551,7 @@ abstract class BaseTest extends ActivityInstrumentationTestCase2<Activity> {
             }
         }, MAX_WAIT_MS);
         mAsserter.ok(success, "waiting for add tab view", "add tab view available");
-        final View addTabView = mSolo.getView("add_tab");
-        mSolo.clickOnView(mSolo.getView("add_tab"));
+        mSolo.clickOnView(mSolo.getView(R.id.add_tab));
     }
 
     public void addTab(String url) {
@@ -574,11 +567,9 @@ abstract class BaseTest extends ActivityInstrumentationTestCase2<Activity> {
      * @return List view in the tabs tray
      */
     private final AdapterView<ListAdapter> getTabsList() {
-        Element tabs = mDriver.findElement(getActivity(), "tabs");
+        Element tabs = mDriver.findElement(getActivity(), R.id.tabs);
         tabs.click();
-        Element listElem = mDriver.findElement(getActivity(), "normal_tabs");
-        int listId = listElem.getId();
-        return (AdapterView<ListAdapter>) getActivity().findViewById(listId);
+        return (AdapterView<ListAdapter>) getActivity().findViewById(R.id.normal_tabs);
     }
 
     /**
@@ -639,8 +630,7 @@ abstract class BaseTest extends ActivityInstrumentationTestCase2<Activity> {
      * @param index Index of tab to close
      */
     public void closeTabAt(final int index) {
-        Element close = mDriver.findElement(getActivity(), "close");
-        View closeButton = getTabViewAt(index).findViewById(close.getId());
+        View closeButton = getTabViewAt(index).findViewById(R.id.close);
 
         mSolo.clickOnView(closeButton);
     }
@@ -749,7 +739,7 @@ abstract class BaseTest extends ActivityInstrumentationTestCase2<Activity> {
             Actions.EventExpecter pageShowExpecter = mActions.expectGeckoEvent("Content:PageShow");
 
             if (devType.equals("tablet")) {
-                Element backBtn = mDriver.findElement(getActivity(), "back");
+                Element backBtn = mDriver.findElement(getActivity(), R.id.back);
                 backBtn.click();
             } else {
                 mActions.sendSpecialKey(Actions.SpecialKey.BACK);
@@ -763,13 +753,13 @@ abstract class BaseTest extends ActivityInstrumentationTestCase2<Activity> {
             Actions.EventExpecter pageShowExpecter = mActions.expectGeckoEvent("Content:PageShow");
 
             if (devType.equals("tablet")) {
-                Element fwdBtn = mDriver.findElement(getActivity(), "forward");
+                Element fwdBtn = mDriver.findElement(getActivity(), R.id.forward);
                 fwdBtn.click();
             } else {
                 mActions.sendSpecialKey(Actions.SpecialKey.MENU);
                 waitForText("^New Tab$");
                 if (!osVersion.equals("2.x")) {
-                    Element fwdBtn = mDriver.findElement(getActivity(), "forward");
+                    Element fwdBtn = mDriver.findElement(getActivity(), R.id.forward);
                     fwdBtn.click();
                 } else {
                     mSolo.clickOnText("^Forward$");
@@ -783,13 +773,13 @@ abstract class BaseTest extends ActivityInstrumentationTestCase2<Activity> {
 
         public void reload() {
             if (devType.equals("tablet")) {
-                Element reloadBtn = mDriver.findElement(getActivity(), "reload");
+                Element reloadBtn = mDriver.findElement(getActivity(), R.id.reload);
                 reloadBtn.click();
             } else {
                 mActions.sendSpecialKey(Actions.SpecialKey.MENU);
                 waitForText("^New Tab$");
                 if (!osVersion.equals("2.x")) {
-                    Element reloadBtn = mDriver.findElement(getActivity(), "reload");
+                    Element reloadBtn = mDriver.findElement(getActivity(), R.id.reload);
                     reloadBtn.click();
                 } else {
                     mSolo.clickOnText("^Reload$");
@@ -807,7 +797,7 @@ abstract class BaseTest extends ActivityInstrumentationTestCase2<Activity> {
                 // This is the Android 2.x so the button has text
                 mSolo.clickOnText("^Bookmark$");
             } else {
-                Element bookmarkBtn = mDriver.findElement(getActivity(), "bookmark");
+                Element bookmarkBtn = mDriver.findElement(getActivity(), R.id.bookmark);
                 if (bookmarkBtn != null) {
                     // We are on Android 4.x so the button is an image button
                     bookmarkBtn.click();
diff --git a/mobile/android/base/tests/ContentProviderTest.java b/mobile/android/base/tests/ContentProviderTest.java
index 28caf4be41ba..8c98c0b2be1d 100644
--- a/mobile/android/base/tests/ContentProviderTest.java
+++ b/mobile/android/base/tests/ContentProviderTest.java
@@ -18,10 +18,14 @@ import android.test.IsolatedContext;
 import android.test.RenamingDelegatingContext;
 import android.test.mock.MockContentResolver;
 import android.test.mock.MockContext;
+
 import java.io.File;
-import java.lang.reflect.Method;
 import java.util.ArrayList;
 import java.util.LinkedList;
+import java.util.concurrent.Callable;
+
+import org.mozilla.gecko.db.BrowserContract;
+import org.mozilla.gecko.db.BrowserProvider;
 
 /*
  * ContentProviderTest provides the infrastructure to run content provider
@@ -45,11 +49,8 @@ import java.util.LinkedList;
 abstract class ContentProviderTest extends BaseTest {
     protected ContentProvider mProvider;
     protected ChangeRecordingMockContentResolver mResolver;
-    protected ClassLoader mClassLoader;
     protected ArrayList<Runnable> mTests;
     protected String mDatabaseName;
-    protected Class mProviderClass;
-    protected Class mProviderContract;
     protected String mProviderAuthority;
     protected IsolatedContext mProviderContext;
 
@@ -102,7 +103,7 @@ abstract class ContentProviderTest extends BaseTest {
 
         private Uri appendTestParam(Uri uri) {
             try {
-                return appendUriParam(uri, "PARAM_IS_TEST", "1");
+                return appendUriParam(uri, BrowserContract.PARAM_IS_TEST, "1");
             } catch (Exception e) {}
 
             return null;
@@ -170,14 +171,20 @@ abstract class ContentProviderTest extends BaseTest {
         }
     }
 
-    private void setUpProviderClassAndAuthority(String providerClassName,
-            String authorityField) throws Exception {
-        mProviderContract = mClassLoader.loadClass("org.mozilla.gecko.db.BrowserContract");
-        mProviderAuthority = (String) mProviderContract.getField(authorityField).get(null);
-        mProviderClass = mClassLoader.loadClass(providerClassName);
-    }
+    /**
+     * Factory function that makes new ContentProvider instances.
+     * <p>
+     * We want a fresh provider each test, so this should be invoked in
+     * <code>setUp</code> before each individual test.
+     */
+    protected static Callable<ContentProvider> sBrowserProviderCallable = new Callable<ContentProvider>() {
+        @Override
+        public ContentProvider call() {
+            return new BrowserProvider();
+        }
+    };
 
-    private void setUpContentProvider() throws Exception {
+    private void setUpContentProvider(ContentProvider targetProvider) throws Exception {
         mResolver = new ChangeRecordingMockContentResolver();
 
         final String filenamePrefix = this.getClass().getSimpleName() + ".";
@@ -189,7 +196,6 @@ abstract class ContentProviderTest extends BaseTest {
 
         mProviderContext = new IsolatedContext(mResolver, targetContextWrapper);
 
-        ContentProvider targetProvider = (ContentProvider) mProviderClass.newInstance();
         targetProvider.attachInfo(mProviderContext, null);
 
         mProvider = new DelegatingTestContentProvider(targetProvider);
@@ -198,28 +204,7 @@ abstract class ContentProviderTest extends BaseTest {
         mResolver.addProvider(mProviderAuthority, mProvider);
     }
 
-    public Uri getContentUri(String className) throws Exception {
-        return getUriColumn(className, "CONTENT_URI");
-    }
-
-    public Uri getUriColumn(String className, String columnId) throws Exception {
-        Class aClass = mClassLoader.loadClass("org.mozilla.gecko.db.BrowserContract$" + className);
-        return (Uri) aClass.getField(columnId).get(null);
-    }
-
-    public String getStringColumn(String className, String columnId) throws Exception {
-        Class aClass = mClassLoader.loadClass("org.mozilla.gecko.db.BrowserContract$" + className);
-        return (String) aClass.getField(columnId).get(null);
-    }
-
-    public int getIntColumn(String className, String columnId) throws Exception {
-        Class aClass = mClassLoader.loadClass("org.mozilla.gecko.db.BrowserContract$" + className);
-        Integer intColumn = (Integer) aClass.getField(columnId).get(null);
-        return intColumn.intValue();
-    }
-
-    public Uri appendUriParam(Uri uri, String paramName, String value) throws Exception {
-        String param = (String) mProviderContract.getField(paramName).get(null);
+    public Uri appendUriParam(Uri uri, String param, String value) throws Exception {
         return uri.buildUpon().appendQueryParameter(param, value).build();
     }
 
@@ -229,19 +214,18 @@ abstract class ContentProviderTest extends BaseTest {
 
     @Override
     public void setUp() throws Exception {
-        throw new Exception("You should call setUp(providerClassName, authorityUriField, databaseName) instead");
+        throw new UnsupportedOperationException("You should call setUp(authority, databaseName) instead");
     }
 
-    // TODO: Take the actual class as an arg.
-    public void setUp(String providerClassName, String authorityUriField, String databaseName) throws Exception {
+    public void setUp(Callable<ContentProvider> contentProviderFactory, String authority, String databaseName) throws Exception {
         super.setUp();
 
-        mClassLoader = getInstrumentation().getContext().getClassLoader();
         mTests = new ArrayList<Runnable>();
         mDatabaseName = databaseName;
 
-        setUpProviderClassAndAuthority(providerClassName, authorityUriField);
-        setUpContentProvider();
+        mProviderAuthority = authority;
+
+        setUpContentProvider(contentProviderFactory.call());
     }
 
     @Override
diff --git a/mobile/android/base/tests/SessionTest.java b/mobile/android/base/tests/SessionTest.java
index 970c8471073f..4d2203058f63 100644
--- a/mobile/android/base/tests/SessionTest.java
+++ b/mobile/android/base/tests/SessionTest.java
@@ -6,15 +6,12 @@ import java.io.IOException;
 import java.io.File;
 import java.io.FileReader;
 import java.io.FileWriter;
-import java.lang.reflect.Field;
-import java.lang.reflect.Method;
 
 import org.json.JSONArray;
 import org.json.JSONException;
 import org.json.JSONObject;
 
 public abstract class SessionTest extends BaseTest {
-    private File mSessionDir;
     protected Navigation mNavigation;
 
     @Override
diff --git a/mobile/android/base/tests/testAboutPage.java b/mobile/android/base/tests/testAboutPage.java
index a7a5f126971b..f8bab0a1b48f 100644
--- a/mobile/android/base/tests/testAboutPage.java
+++ b/mobile/android/base/tests/testAboutPage.java
@@ -13,7 +13,7 @@ public class testAboutPage extends PixelTest {
     }
 
     private void ensureTitleMatches(final String regex) {
-        Element urlBarTitle = mDriver.findElement(getActivity(), URL_BAR_TITLE_ID);
+        Element urlBarTitle = mDriver.findElement(getActivity(), R.id.url_bar_title);
         mAsserter.isnot(urlBarTitle, null, "Got the URL bar title");
         assertMatches(urlBarTitle.getText(), regex, "page title match");
     }
diff --git a/mobile/android/base/tests/testBookmarksPanel.java b/mobile/android/base/tests/testBookmarksPanel.java
index 85dbcfa1ed28..be6dd38f2a8b 100644
--- a/mobile/android/base/tests/testBookmarksPanel.java
+++ b/mobile/android/base/tests/testBookmarksPanel.java
@@ -30,7 +30,7 @@ public class testBookmarksPanel extends AboutHomeTest {
         }
 
         // Test that "Open in New Tab" works
-        final Element tabCount = mDriver.findElement(getActivity(), "tabs_counter");
+        final Element tabCount = mDriver.findElement(getActivity(), R.id.tabs_counter);
         final int tabCountInt = Integer.parseInt(tabCount.getText());
         Actions.EventExpecter tabEventExpecter = mActions.expectGeckoEvent("Tab:Added");
         mSolo.clickOnText(StringHelper.BOOKMARK_CONTEXT_MENU_ITEMS[0]);
diff --git a/mobile/android/base/tests/testBrowserProvider.java b/mobile/android/base/tests/testBrowserProvider.java
index 41528906b614..f622ee732833 100644
--- a/mobile/android/base/tests/testBrowserProvider.java
+++ b/mobile/android/base/tests/testBrowserProvider.java
@@ -13,6 +13,8 @@ import android.util.Log;
 import java.util.ArrayList;
 import java.util.Random;
 
+import org.mozilla.gecko.db.BrowserContract;
+
 /*
  * This test is meant to exercise all operations exposed by Fennec's
  * history and bookmarks content provider. It does so in an isolated
@@ -20,156 +22,33 @@ import java.util.Random;
  * code.
  */
 public class testBrowserProvider extends ContentProviderTest {
-    private String PLACES_FOLDER_GUID;
-    private String MOBILE_FOLDER_GUID;
-    private String MENU_FOLDER_GUID;
-    private String TAGS_FOLDER_GUID;
-    private String TOOLBAR_FOLDER_GUID;
-    private String UNFILED_FOLDER_GUID;
-    private String READING_LIST_FOLDER_GUID;
-
-    private Uri mBookmarksUri;
-    private Uri mBookmarksPositionUri;
-    private Uri mHistoryUri;
-    private Uri mHistoryOldUri;
-    private Uri mCombinedUri;
-    private Uri mFaviconsUri;
-    private Uri mThumbnailsUri;
-
-    private String mBookmarksIdCol;
-    private String mBookmarksTitleCol;
-    private String mBookmarksUrlCol;
-    private String mBookmarksFaviconCol;
-    private String mBookmarksParentCol;
-    private String mBookmarksTypeCol;
-    private String mBookmarksPositionCol;
-    private String mBookmarksTagsCol;
-    private String mBookmarksDescriptionCol;
-    private String mBookmarksKeywordCol;
-    private String mBookmarksGuidCol;
-    private String mBookmarksIsDeletedCol;
-    private String mBookmarksDateCreatedCol;
-    private String mBookmarksDateModifiedCol;
-    private int mBookmarksTypeFolder;
-    private int mBookmarksTypeBookmark;
     private long mMobileFolderId;
 
-    private String mHistoryIdCol;
-    private String mHistoryTitleCol;
-    private String mHistoryUrlCol;
-    private String mHistoryVisitsCol;
-    private String mHistoryFaviconCol;
-    private String mHistoryLastVisitedCol;
-    private String mHistoryGuidCol;
-    private String mHistoryIsDeletedCol;
-    private String mHistoryDateCreatedCol;
-    private String mHistoryDateModifiedCol;
-
-    private String mCombinedIdCol;
-    private String mCombinedBookmarkIdCol;
-    private String mCombinedHistoryIdCol;
-    private String mCombinedDisplayCol;
-    private String mCombinedUrlCol;
-    private String mCombinedTitleCol;
-    private String mCombinedVisitsCol;
-    private String mCombinedLastVisitedCol;
-    private String mCombinedFaviconCol;
-    private int mCombinedDisplayNormal;
-    private int mCombinedDisplayReader;
-
-    private String mFaviconsUrlCol;
-    private String mFaviconsPageUrlCol;
-    private String mFaviconsDataCol;
-
-    private String mThumbnailsUrlCol;
-    private String mThumbnailsDataCol;
-
     @Override
     protected int getTestType() {
         return TEST_MOCHITEST;
     }
 
-    private void loadContractInfo() throws Exception {
-        mBookmarksUri = getContentUri("Bookmarks");
-        mHistoryUri = getContentUri("History");
-        mHistoryOldUri = getUriColumn("History", "CONTENT_OLD_URI");
-        mCombinedUri = getContentUri("Combined");
-        mFaviconsUri = getContentUri("Favicons");
-        mThumbnailsUri = getContentUri("Thumbnails");
-
-        mBookmarksPositionUri = getUriColumn("Bookmarks", "POSITIONS_CONTENT_URI");
-
-        PLACES_FOLDER_GUID = getStringColumn("Bookmarks", "PLACES_FOLDER_GUID");
-        MOBILE_FOLDER_GUID = getStringColumn("Bookmarks", "MOBILE_FOLDER_GUID");
-        MENU_FOLDER_GUID = getStringColumn("Bookmarks", "MENU_FOLDER_GUID");
-        TAGS_FOLDER_GUID = getStringColumn("Bookmarks", "TAGS_FOLDER_GUID");
-        TOOLBAR_FOLDER_GUID = getStringColumn("Bookmarks", "TOOLBAR_FOLDER_GUID");
-        UNFILED_FOLDER_GUID = getStringColumn("Bookmarks", "UNFILED_FOLDER_GUID");
-        READING_LIST_FOLDER_GUID = getStringColumn("Bookmarks", "READING_LIST_FOLDER_GUID");
-
-        mBookmarksIdCol = getStringColumn("Bookmarks", "_ID");
-        mBookmarksTitleCol = getStringColumn("Bookmarks", "TITLE");
-        mBookmarksUrlCol = getStringColumn("Bookmarks", "URL");
-        mBookmarksFaviconCol = getStringColumn("Bookmarks", "FAVICON");
-        mBookmarksParentCol = getStringColumn("Bookmarks", "PARENT");
-        mBookmarksTypeCol = getStringColumn("Bookmarks", "TYPE");
-        mBookmarksPositionCol = getStringColumn("Bookmarks", "POSITION");
-        mBookmarksTagsCol = getStringColumn("Bookmarks", "TAGS");
-        mBookmarksDescriptionCol = getStringColumn("Bookmarks", "DESCRIPTION");
-        mBookmarksKeywordCol= getStringColumn("Bookmarks", "KEYWORD");
-        mBookmarksGuidCol = getStringColumn("Bookmarks", "GUID");
-        mBookmarksIsDeletedCol = getStringColumn("Bookmarks", "IS_DELETED");
-        mBookmarksDateCreatedCol = getStringColumn("Bookmarks", "DATE_CREATED");
-        mBookmarksDateModifiedCol = getStringColumn("Bookmarks", "DATE_MODIFIED");
-
-        mBookmarksTypeFolder = getIntColumn("Bookmarks", "TYPE_FOLDER");
-        mBookmarksTypeBookmark = getIntColumn("Bookmarks", "TYPE_BOOKMARK");
-
-        mHistoryIdCol = getStringColumn("History", "_ID");
-        mHistoryTitleCol = getStringColumn("History", "TITLE");
-        mHistoryUrlCol = getStringColumn("History", "URL");
-        mHistoryVisitsCol = getStringColumn("History", "VISITS");
-        mHistoryLastVisitedCol = getStringColumn("History", "DATE_LAST_VISITED");
-        mHistoryFaviconCol = getStringColumn("History", "FAVICON");
-        mHistoryGuidCol = getStringColumn("History", "GUID");
-        mHistoryIsDeletedCol = getStringColumn("History", "IS_DELETED");
-        mHistoryDateCreatedCol = getStringColumn("History", "DATE_CREATED");
-        mHistoryDateModifiedCol = getStringColumn("History", "DATE_MODIFIED");
-
-        mCombinedIdCol = getStringColumn("Combined", "_ID");
-        mCombinedBookmarkIdCol = getStringColumn("Combined", "BOOKMARK_ID");
-        mCombinedHistoryIdCol = getStringColumn("Combined", "HISTORY_ID");
-        mCombinedDisplayCol = getStringColumn("Combined", "DISPLAY");
-        mCombinedUrlCol = getStringColumn("Combined", "URL");
-        mCombinedTitleCol = getStringColumn("Combined", "TITLE");
-        mCombinedVisitsCol = getStringColumn("Combined", "VISITS");
-        mCombinedLastVisitedCol = getStringColumn("Combined", "DATE_LAST_VISITED");
-        mCombinedFaviconCol = getStringColumn("Combined", "FAVICON");
-
-        mCombinedDisplayNormal = getIntColumn("Combined", "DISPLAY_NORMAL");
-        mCombinedDisplayReader = getIntColumn("Combined", "DISPLAY_READER");
-
-        mFaviconsUrlCol = getStringColumn("Favicons", "URL");
-        mFaviconsPageUrlCol = getStringColumn("Favicons", "PAGE_URL");
-        mFaviconsDataCol = getStringColumn("Favicons", "DATA");
-
-        mThumbnailsUrlCol = getStringColumn("Thumbnails", "URL");
-        mThumbnailsDataCol = getStringColumn("Thumbnails", "DATA");
-    }
-
     private void loadMobileFolderId() throws Exception {
-        Cursor c = getBookmarkByGuid(MOBILE_FOLDER_GUID);
-        mAsserter.is(c.moveToFirst(), true, "Mobile bookmarks folder is present");
+        Cursor c = null;
+        try {
+            c = getBookmarkByGuid(BrowserContract.Bookmarks.MOBILE_FOLDER_GUID);
+            mAsserter.is(c.moveToFirst(), true, "Mobile bookmarks folder is present");
 
-        mMobileFolderId = c.getLong(c.getColumnIndex(mBookmarksIdCol));
+            mMobileFolderId = c.getLong(c.getColumnIndex(BrowserContract.Bookmarks._ID));
+        } finally {
+            if (c != null) {
+                c.close();
+            }
+        }
     }
 
     private void ensureEmptyDatabase() throws Exception {
         Cursor c = null;
 
-        String guid = getStringColumn("Bookmarks", "GUID");
+        String guid = BrowserContract.Bookmarks.GUID;
 
-        mProvider.delete(appendUriParam(mBookmarksUri, "PARAM_IS_SYNC", "1"),
+        mProvider.delete(appendUriParam(BrowserContract.Bookmarks.CONTENT_URI, BrowserContract.PARAM_IS_SYNC, "1"),
                          guid + " != ? AND " +
                          guid + " != ? AND " +
                          guid + " != ? AND " +
@@ -177,25 +56,25 @@ public class testBrowserProvider extends ContentProviderTest {
                          guid + " != ? AND " +
                          guid + " != ? AND " +
                          guid + " != ?",
-                         new String[] { PLACES_FOLDER_GUID,
-                                        MOBILE_FOLDER_GUID,
-                                        MENU_FOLDER_GUID,
-                                        TAGS_FOLDER_GUID,
-                                        TOOLBAR_FOLDER_GUID,
-                                        UNFILED_FOLDER_GUID,
-                                        READING_LIST_FOLDER_GUID });
+                         new String[] { BrowserContract.Bookmarks.PLACES_FOLDER_GUID,
+                                        BrowserContract.Bookmarks.MOBILE_FOLDER_GUID,
+                                        BrowserContract.Bookmarks.MENU_FOLDER_GUID,
+                                        BrowserContract.Bookmarks.TAGS_FOLDER_GUID,
+                                        BrowserContract.Bookmarks.TOOLBAR_FOLDER_GUID,
+                                        BrowserContract.Bookmarks.UNFILED_FOLDER_GUID,
+                                        BrowserContract.Bookmarks.READING_LIST_FOLDER_GUID });
 
-        c = mProvider.query(appendUriParam(mBookmarksUri, "PARAM_SHOW_DELETED", "1"), null, null, null, null);
+        c = mProvider.query(appendUriParam(BrowserContract.Bookmarks.CONTENT_URI, BrowserContract.PARAM_SHOW_DELETED, "1"), null, null, null, null);
         mAsserter.is(c.getCount(), 7, "All non-special bookmarks and folders were deleted");
 
-        mProvider.delete(appendUriParam(mHistoryUri, "PARAM_IS_SYNC", "1"), null, null);
-        c = mProvider.query(appendUriParam(mHistoryUri, "PARAM_SHOW_DELETED", "1"), null, null, null, null);
+        mProvider.delete(appendUriParam(BrowserContract.History.CONTENT_URI, BrowserContract.PARAM_IS_SYNC, "1"), null, null);
+        c = mProvider.query(appendUriParam(BrowserContract.History.CONTENT_URI, BrowserContract.PARAM_SHOW_DELETED, "1"), null, null, null, null);
         mAsserter.is(c.getCount(), 0, "All history entries were deleted");
 
-        mProvider.delete(mFaviconsUri, null, null);
+        mProvider.delete(BrowserContract.Favicons.CONTENT_URI, null, null);
         mAsserter.is(c.getCount(), 0, "All favicons were deleted");
 
-        mProvider.delete(mThumbnailsUri, null, null);
+        mProvider.delete(BrowserContract.Thumbnails.CONTENT_URI, null, null);
         mAsserter.is(c.getCount(), 0, "All thumbnails were deleted");
     }
 
@@ -203,44 +82,44 @@ public class testBrowserProvider extends ContentProviderTest {
             int type, int position, String tags, String description, String keyword) throws Exception {
         ContentValues bookmark = new ContentValues();
 
-        bookmark.put(mBookmarksTitleCol, title);
-        bookmark.put(mBookmarksUrlCol, url);
-        bookmark.put(mBookmarksParentCol, parentId);
-        bookmark.put(mBookmarksTypeCol, type);
-        bookmark.put(mBookmarksPositionCol, position);
-        bookmark.put(mBookmarksTagsCol, tags);
-        bookmark.put(mBookmarksDescriptionCol, description);
-        bookmark.put(mBookmarksKeywordCol, keyword);
+        bookmark.put(BrowserContract.Bookmarks.TITLE, title);
+        bookmark.put(BrowserContract.Bookmarks.URL, url);
+        bookmark.put(BrowserContract.Bookmarks.PARENT, parentId);
+        bookmark.put(BrowserContract.Bookmarks.TYPE, type);
+        bookmark.put(BrowserContract.Bookmarks.POSITION, position);
+        bookmark.put(BrowserContract.Bookmarks.TAGS, tags);
+        bookmark.put(BrowserContract.Bookmarks.DESCRIPTION, description);
+        bookmark.put(BrowserContract.Bookmarks.KEYWORD, keyword);
 
         return bookmark;
     }
 
     private ContentValues createOneBookmark() throws Exception {
         return createBookmark("Example", "http://example.com", mMobileFolderId,
-                mBookmarksTypeBookmark, 0, "tags", "description", "keyword");
+                BrowserContract.Bookmarks.TYPE_BOOKMARK, 0, "tags", "description", "keyword");
     }
 
     private Cursor getBookmarksByParent(long parent) throws Exception {
         // Order by position.
-        return mProvider.query(mBookmarksUri, null,
-                               mBookmarksParentCol + " = ?",
+        return mProvider.query(BrowserContract.Bookmarks.CONTENT_URI, null,
+                               BrowserContract.Bookmarks.PARENT + " = ?",
                                new String[] { String.valueOf(parent) },
-                               mBookmarksPositionCol);
+                               BrowserContract.Bookmarks.POSITION);
     }
 
     private Cursor getBookmarkByGuid(String guid) throws Exception {
-        return mProvider.query(mBookmarksUri, null,
-                               mBookmarksGuidCol + " = ?",
+        return mProvider.query(BrowserContract.Bookmarks.CONTENT_URI, null,
+                               BrowserContract.Bookmarks.GUID + " = ?",
                                new String[] { guid },
                                null);
     }
 
     private Cursor getBookmarkById(long id) throws Exception {
-        return getBookmarkById(mBookmarksUri, id, null);
+        return getBookmarkById(BrowserContract.Bookmarks.CONTENT_URI, id, null);
     }
 
     private Cursor getBookmarkById(long id, String[] projection) throws Exception {
-        return getBookmarkById(mBookmarksUri, id, projection);
+        return getBookmarkById(BrowserContract.Bookmarks.CONTENT_URI, id, projection);
     }
 
     private Cursor getBookmarkById(Uri bookmarksUri, long id) throws Exception {
@@ -249,7 +128,7 @@ public class testBrowserProvider extends ContentProviderTest {
 
     private Cursor getBookmarkById(Uri bookmarksUri, long id, String[] projection) throws Exception {
         return mProvider.query(bookmarksUri, projection,
-                               mBookmarksIdCol + " = ?",
+                               BrowserContract.Bookmarks._ID + " = ?",
                                new String[] { String.valueOf(id) },
                                null);
     }
@@ -257,10 +136,10 @@ public class testBrowserProvider extends ContentProviderTest {
     private ContentValues createHistoryEntry(String title, String url, int visits, long lastVisited) throws Exception {
         ContentValues historyEntry = new ContentValues();
 
-        historyEntry.put(mHistoryTitleCol, title);
-        historyEntry.put(mHistoryUrlCol, url);
-        historyEntry.put(mHistoryVisitsCol, visits);
-        historyEntry.put(mHistoryLastVisitedCol, lastVisited);
+        historyEntry.put(BrowserContract.History.TITLE, title);
+        historyEntry.put(BrowserContract.History.URL, url);
+        historyEntry.put(BrowserContract.History.VISITS, visits);
+        historyEntry.put(BrowserContract.History.DATE_LAST_VISITED, lastVisited);
 
         return historyEntry;
     }
@@ -268,9 +147,9 @@ public class testBrowserProvider extends ContentProviderTest {
     private ContentValues createFaviconEntry(String pageUrl, String data) throws Exception {
         ContentValues faviconEntry = new ContentValues();
 
-        faviconEntry.put(mFaviconsPageUrlCol, pageUrl);
-        faviconEntry.put(mFaviconsUrlCol, pageUrl + "/favicon.ico");
-        faviconEntry.put(mFaviconsDataCol, data.getBytes("UTF8"));
+        faviconEntry.put(BrowserContract.Favicons.PAGE_URL, pageUrl);
+        faviconEntry.put(BrowserContract.Favicons.URL, pageUrl + "/favicon.ico");
+        faviconEntry.put(BrowserContract.Favicons.DATA, data.getBytes("UTF8"));
 
         return faviconEntry;
     }
@@ -278,8 +157,8 @@ public class testBrowserProvider extends ContentProviderTest {
     private ContentValues createThumbnailEntry(String pageUrl, String data) throws Exception {
         ContentValues thumbnailEntry = new ContentValues();
 
-        thumbnailEntry.put(mThumbnailsUrlCol, pageUrl);
-        thumbnailEntry.put(mThumbnailsDataCol, data.getBytes("UTF8"));
+        thumbnailEntry.put(BrowserContract.Thumbnails.URL, pageUrl);
+        thumbnailEntry.put(BrowserContract.Thumbnails.DATA, data.getBytes("UTF8"));
 
         return thumbnailEntry;
     }
@@ -289,11 +168,11 @@ public class testBrowserProvider extends ContentProviderTest {
     }
 
     private Cursor getHistoryEntryById(long id) throws Exception {
-        return getHistoryEntryById(mHistoryUri, id, null);
+        return getHistoryEntryById(BrowserContract.History.CONTENT_URI, id, null);
     }
 
     private Cursor getHistoryEntryById(long id, String[] projection) throws Exception {
-        return getHistoryEntryById(mHistoryUri, id, projection);
+        return getHistoryEntryById(BrowserContract.History.CONTENT_URI, id, projection);
     }
 
     private Cursor getHistoryEntryById(Uri historyUri, long id) throws Exception {
@@ -302,29 +181,28 @@ public class testBrowserProvider extends ContentProviderTest {
 
     private Cursor getHistoryEntryById(Uri historyUri, long id, String[] projection) throws Exception {
         return mProvider.query(historyUri, projection,
-                               mHistoryIdCol + " = ?",
+                               BrowserContract.History._ID + " = ?",
                                new String[] { String.valueOf(id) },
                                null);
     }
 
     private Cursor getFaviconsByUrl(String url) throws Exception {
-        return mProvider.query(mCombinedUri, null,
-                               mCombinedUrlCol + " = ?",
+        return mProvider.query(BrowserContract.Combined.CONTENT_URI, null,
+                               BrowserContract.Combined.URL + " = ?",
                                new String[] { url },
                                null);
     }
 
     private Cursor getThumbnailByUrl(String url) throws Exception {
-        return mProvider.query(mThumbnailsUri, null,
-                               mThumbnailsUrlCol + " = ?",
+        return mProvider.query(BrowserContract.Thumbnails.CONTENT_URI, null,
+                               BrowserContract.Thumbnails.URL + " = ?",
                                new String[] { url },
                                null);
     }
 
     @Override
     public void setUp() throws Exception {
-        super.setUp("org.mozilla.gecko.db.BrowserProvider", "AUTHORITY", "browser.db");
-        loadContractInfo();
+        super.setUp(sBrowserProviderCallable, BrowserContract.AUTHORITY, "browser.db");
 
         mTests.add(new TestSpecialFolders());
 
@@ -397,12 +275,12 @@ public class testBrowserProvider extends ContentProviderTest {
 
             for (int i = 0; i < TESTCOUNT; i++) {
                 values.clear();
-                values.put(mHistoryVisitsCol, i);
-                values.put(mHistoryTitleCol, "Test" + i);
-                values.put(mHistoryUrlCol, "http://www.test.org/" + i);
+                values.put(BrowserContract.History.VISITS, i);
+                values.put(BrowserContract.History.TITLE, "Test" + i);
+                values.put(BrowserContract.History.URL, "http://www.test.org/" + i);
 
                 // Insert
-                builder = ContentProviderOperation.newInsert(mHistoryUri);
+                builder = ContentProviderOperation.newInsert(BrowserContract.History.CONTENT_URI);
                 builder.withValues(values);
                 // Queue the operation
                 mOperations.add(builder.build());
@@ -413,9 +291,9 @@ public class testBrowserProvider extends ContentProviderTest {
 
             boolean allFound = true;
             for (int i = 0; i < TESTCOUNT; i++) {
-                Cursor cursor = mProvider.query(mHistoryUri,
+                Cursor cursor = mProvider.query(BrowserContract.History.CONTENT_URI,
                                                 null,
-                                                mHistoryUrlCol + " = ?",
+                                                BrowserContract.History.URL + " = ?",
                                                 new String[] { "http://www.test.org/" + i },
                                                 null);
 
@@ -428,10 +306,10 @@ public class testBrowserProvider extends ContentProviderTest {
 
             // Update all visits to 1
             values.clear();
-            values.put(mHistoryVisitsCol, 1);
+            values.put(BrowserContract.History.VISITS, 1);
             for (int i = 0; i < TESTCOUNT; i++) {
-                builder = ContentProviderOperation.newUpdate(mHistoryUri);
-                builder.withSelection(mHistoryUrlCol  + " = ?",
+                builder = ContentProviderOperation.newUpdate(BrowserContract.History.CONTENT_URI);
+                builder.withSelection(BrowserContract.History.URL  + " = ?",
                                       new String[] {"http://www.test.org/" + i});
                 builder.withValues(values);
                 builder.withExpectedCount(1);
@@ -450,8 +328,8 @@ public class testBrowserProvider extends ContentProviderTest {
 
             // Delte all visits
             for (int i = 0; i < TESTCOUNT; i++) {
-                builder = ContentProviderOperation.newDelete(mHistoryUri);
-                builder.withSelection(mHistoryUrlCol  + " = ?",
+                builder = ContentProviderOperation.newDelete(BrowserContract.History.CONTENT_URI);
+                builder.withSelection(BrowserContract.History.URL  + " = ?",
                                       new String[] {"http://www.test.org/" + i});
                 builder.withExpectedCount(1);
                 // Queue the operation
@@ -473,18 +351,18 @@ public class testBrowserProvider extends ContentProviderTest {
             // Test a bunch of inserts with applyBatch
             ContentProviderOperation.Builder builder = null;
             ContentValues values = createFaviconEntry("http://www.test.org", "FAVICON");
-            builder = ContentProviderOperation.newInsert(mFaviconsUri);
+            builder = ContentProviderOperation.newInsert(BrowserContract.Favicons.CONTENT_URI);
             builder.withValues(values);
             mOperations.add(builder.build());
 
             // Make a duplicate, this will fail because of a UNIQUE constraint
-            builder = ContentProviderOperation.newInsert(mFaviconsUri);
+            builder = ContentProviderOperation.newInsert(BrowserContract.Favicons.CONTENT_URI);
             builder.withValues(values);
             mOperations.add(builder.build());
 
             // This is valid and should be in the table afterwards
-            values.put(mFaviconsUrlCol, "http://www.test.org/valid.ico");
-            builder = ContentProviderOperation.newInsert(mFaviconsUri);
+            values.put(BrowserContract.Favicons.URL, "http://www.test.org/valid.ico");
+            builder = ContentProviderOperation.newInsert(BrowserContract.Favicons.CONTENT_URI);
             builder.withValues(values);
             mOperations.add(builder.build());
 
@@ -501,9 +379,9 @@ public class testBrowserProvider extends ContentProviderTest {
             mAsserter.is(seenException, true, "Expected failure in favicons table");
 
             boolean allFound = true;
-            Cursor cursor = mProvider.query(mFaviconsUri,
+            Cursor cursor = mProvider.query(BrowserContract.Favicons.CONTENT_URI,
                                             null,
-                                            mFaviconsUrlCol + " = ?",
+                                            BrowserContract.Favicons.URL + " = ?",
                                             new String[] { "http://www.test.org/valid.ico" },
                                             null);
 
@@ -519,19 +397,19 @@ public class testBrowserProvider extends ContentProviderTest {
             ContentValues allVals[] = new ContentValues[TESTCOUNT];
             for (int i = 0; i < TESTCOUNT; i++) {
                 allVals[i] = new ContentValues();
-                allVals[i].put(mHistoryUrlCol, i);
-                allVals[i].put(mHistoryTitleCol, "Test" + i);
-                allVals[i].put(mHistoryUrlCol, "http://www.test.org/" + i);
+                allVals[i].put(BrowserContract.History.URL, i);
+                allVals[i].put(BrowserContract.History.TITLE, "Test" + i);
+                allVals[i].put(BrowserContract.History.URL, "http://www.test.org/" + i);
             }
 
-            int inserts = mProvider.bulkInsert(mHistoryUri, allVals);
+            int inserts = mProvider.bulkInsert(BrowserContract.History.CONTENT_URI, allVals);
             mAsserter.is(inserts, TESTCOUNT, "Excepted number of inserts matches");
 
             boolean allFound = true;
             for (int i = 0; i < TESTCOUNT; i++) {
-                Cursor cursor = mProvider.query(mHistoryUri,
+                Cursor cursor = mProvider.query(BrowserContract.History.CONTENT_URI,
                                                 null,
-                                                mHistoryUrlCol + " = ?",
+                                                BrowserContract.History.URL + " = ?",
                                                 new String[] { "http://www.test.org/" + i },
                                                 null);
 
@@ -558,39 +436,39 @@ public class testBrowserProvider extends ContentProviderTest {
     class TestSpecialFolders extends Test {
         @Override
         public void test() throws Exception {
-            Cursor c = mProvider.query(mBookmarksUri,
-                                       new String[] { mBookmarksIdCol,
-                                                      mBookmarksGuidCol,
-                                                      mBookmarksParentCol },
-                                       mBookmarksGuidCol + " = ? OR " +
-                                       mBookmarksGuidCol + " = ? OR " +
-                                       mBookmarksGuidCol + " = ? OR " +
-                                       mBookmarksGuidCol + " = ? OR " +
-                                       mBookmarksGuidCol + " = ? OR " +
-                                       mBookmarksGuidCol + " = ? OR " +
-                                       mBookmarksGuidCol + " = ?",
-                                       new String[] { PLACES_FOLDER_GUID,
-                                                      MOBILE_FOLDER_GUID,
-                                                      MENU_FOLDER_GUID,
-                                                      TAGS_FOLDER_GUID,
-                                                      TOOLBAR_FOLDER_GUID,
-                                                      UNFILED_FOLDER_GUID,
-                                                      READING_LIST_FOLDER_GUID },
+            Cursor c = mProvider.query(BrowserContract.Bookmarks.CONTENT_URI,
+                                       new String[] { BrowserContract.Bookmarks._ID,
+                                                      BrowserContract.Bookmarks.GUID,
+                                                      BrowserContract.Bookmarks.PARENT },
+                                       BrowserContract.Bookmarks.GUID + " = ? OR " +
+                                       BrowserContract.Bookmarks.GUID + " = ? OR " +
+                                       BrowserContract.Bookmarks.GUID + " = ? OR " +
+                                       BrowserContract.Bookmarks.GUID + " = ? OR " +
+                                       BrowserContract.Bookmarks.GUID + " = ? OR " +
+                                       BrowserContract.Bookmarks.GUID + " = ? OR " +
+                                       BrowserContract.Bookmarks.GUID + " = ?",
+                                       new String[] { BrowserContract.Bookmarks.PLACES_FOLDER_GUID,
+                                                      BrowserContract.Bookmarks.MOBILE_FOLDER_GUID,
+                                                      BrowserContract.Bookmarks.MENU_FOLDER_GUID,
+                                                      BrowserContract.Bookmarks.TAGS_FOLDER_GUID,
+                                                      BrowserContract.Bookmarks.TOOLBAR_FOLDER_GUID,
+                                                      BrowserContract.Bookmarks.UNFILED_FOLDER_GUID,
+                                                      BrowserContract.Bookmarks.READING_LIST_FOLDER_GUID },
                                        null);
 
             mAsserter.is(c.getCount(), 7, "Right number of special folders");
 
-            int rootId = getIntColumn("Bookmarks", "FIXED_ROOT_ID");
-            int readingListId = getIntColumn("Bookmarks", "FIXED_READING_LIST_ID");
+            int rootId = BrowserContract.Bookmarks.FIXED_ROOT_ID;
+            int readingListId = BrowserContract.Bookmarks.FIXED_READING_LIST_ID;
 
             while (c.moveToNext()) {
-                int id = c.getInt(c.getColumnIndex(mBookmarksIdCol));
-                String guid = c.getString(c.getColumnIndex(mBookmarksGuidCol));
-                int parentId = c.getInt(c.getColumnIndex(mBookmarksParentCol));
+                int id = c.getInt(c.getColumnIndex(BrowserContract.Bookmarks._ID));
+                String guid = c.getString(c.getColumnIndex(BrowserContract.Bookmarks.GUID));
+                int parentId = c.getInt(c.getColumnIndex(BrowserContract.Bookmarks.PARENT));
 
-                if (guid.equals(PLACES_FOLDER_GUID)) {
+                if (guid.equals(BrowserContract.Bookmarks.PLACES_FOLDER_GUID)) {
                     mAsserter.is(new Integer(id), new Integer(rootId), "The id of places folder is correct");
-                } else if (guid.equals(READING_LIST_FOLDER_GUID)) {
+                } else if (guid.equals(BrowserContract.Bookmarks.READING_LIST_FOLDER_GUID)) {
                     mAsserter.is(new Integer(id), new Integer(readingListId), "The id of reading list folder is correct");
                 }
 
@@ -607,7 +485,7 @@ public class testBrowserProvider extends ContentProviderTest {
             long id = -1;
 
             try {
-                id = ContentUris.parseId(mProvider.insert(mBookmarksUri, b));
+                id = ContentUris.parseId(mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, b));
             } catch (Exception e) {}
 
             return id;
@@ -616,46 +494,46 @@ public class testBrowserProvider extends ContentProviderTest {
         @Override
         public void test() throws Exception {
             ContentValues b = createOneBookmark();
-            long id = ContentUris.parseId(mProvider.insert(mBookmarksUri, b));
+            long id = ContentUris.parseId(mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, b));
             Cursor c = getBookmarkById(id);
 
             mAsserter.is(c.moveToFirst(), true, "Inserted bookmark found");
 
-            mAsserter.is(c.getString(c.getColumnIndex(mBookmarksTitleCol)), b.getAsString(mBookmarksTitleCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Bookmarks.TITLE)), b.getAsString(BrowserContract.Bookmarks.TITLE),
                          "Inserted bookmark has correct title");
-            mAsserter.is(c.getString(c.getColumnIndex(mBookmarksUrlCol)), b.getAsString(mBookmarksUrlCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Bookmarks.URL)), b.getAsString(BrowserContract.Bookmarks.URL),
                          "Inserted bookmark has correct URL");
-            mAsserter.is(c.getString(c.getColumnIndex(mBookmarksTagsCol)), b.getAsString(mBookmarksTagsCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Bookmarks.TAGS)), b.getAsString(BrowserContract.Bookmarks.TAGS),
                          "Inserted bookmark has correct tags");
-            mAsserter.is(c.getString(c.getColumnIndex(mBookmarksKeywordCol)), b.getAsString(mBookmarksKeywordCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Bookmarks.KEYWORD)), b.getAsString(BrowserContract.Bookmarks.KEYWORD),
                          "Inserted bookmark has correct keyword");
-            mAsserter.is(c.getString(c.getColumnIndex(mBookmarksDescriptionCol)), b.getAsString(mBookmarksDescriptionCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Bookmarks.DESCRIPTION)), b.getAsString(BrowserContract.Bookmarks.DESCRIPTION),
                          "Inserted bookmark has correct description");
-            mAsserter.is(c.getString(c.getColumnIndex(mBookmarksPositionCol)), b.getAsString(mBookmarksPositionCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Bookmarks.POSITION)), b.getAsString(BrowserContract.Bookmarks.POSITION),
                          "Inserted bookmark has correct position");
-            mAsserter.is(c.getString(c.getColumnIndex(mBookmarksTypeCol)), b.getAsString(mBookmarksTypeCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Bookmarks.TYPE)), b.getAsString(BrowserContract.Bookmarks.TYPE),
                          "Inserted bookmark has correct type");
-            mAsserter.is(c.getString(c.getColumnIndex(mBookmarksParentCol)), b.getAsString(mBookmarksParentCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Bookmarks.PARENT)), b.getAsString(BrowserContract.Bookmarks.PARENT),
                          "Inserted bookmark has correct parent ID");
-            mAsserter.is(c.getString(c.getColumnIndex(mBookmarksIsDeletedCol)), String.valueOf(0),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Bookmarks.IS_DELETED)), String.valueOf(0),
                          "Inserted bookmark has correct is-deleted state");
 
-            id = insertWithNullCol(mBookmarksPositionCol);
+            id = insertWithNullCol(BrowserContract.Bookmarks.POSITION);
             mAsserter.is(new Long(id), new Long(-1),
                          "Should not be able to insert bookmark with null position");
 
-            id = insertWithNullCol(mBookmarksTypeCol);
+            id = insertWithNullCol(BrowserContract.Bookmarks.TYPE);
             mAsserter.is(new Long(id), new Long(-1),
                          "Should not be able to insert bookmark with null type");
 
             if (Build.VERSION.SDK_INT >= 8 &&
                 Build.VERSION.SDK_INT < 16) {
                 b = createOneBookmark();
-                b.put(mBookmarksParentCol, -1);
+                b.put(BrowserContract.Bookmarks.PARENT, -1);
                 id = -1;
 
                 try {
-                    id = ContentUris.parseId(mProvider.insert(mBookmarksUri, b));
+                    id = ContentUris.parseId(mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, b));
                 } catch (Exception e) {}
 
                 mAsserter.is(new Long(id), new Long(-1),
@@ -663,13 +541,13 @@ public class testBrowserProvider extends ContentProviderTest {
             }
 
             b = createOneBookmark();
-            b.remove(mBookmarksTypeCol);
-            id = ContentUris.parseId(mProvider.insert(mBookmarksUri, b));
+            b.remove(BrowserContract.Bookmarks.TYPE);
+            id = ContentUris.parseId(mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, b));
             c = getBookmarkById(id);
 
             mAsserter.is(c.moveToFirst(), true, "Inserted bookmark found");
 
-            mAsserter.is(c.getString(c.getColumnIndex(mBookmarksTypeCol)), String.valueOf(mBookmarksTypeBookmark),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Bookmarks.TYPE)), String.valueOf(BrowserContract.Bookmarks.TYPE_BOOKMARK),
                          "Inserted bookmark has correct default type");
         }
     }
@@ -680,24 +558,24 @@ public class testBrowserProvider extends ContentProviderTest {
             ContentValues b = createOneBookmark();
 
             final String favicon = "FAVICON";
-            final String pageUrl = b.getAsString(mBookmarksUrlCol);
+            final String pageUrl = b.getAsString(BrowserContract.Bookmarks.URL);
 
-            long id = ContentUris.parseId(mProvider.insert(mBookmarksUri, b));
+            long id = ContentUris.parseId(mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, b));
 
             // Insert the favicon into the favicons table
-            mProvider.insert(mFaviconsUri, createFaviconEntry(pageUrl, favicon));
+            mProvider.insert(BrowserContract.Favicons.CONTENT_URI, createFaviconEntry(pageUrl, favicon));
 
-            Cursor c = getBookmarkById(id, new String[] { mBookmarksFaviconCol });
+            Cursor c = getBookmarkById(id, new String[] { BrowserContract.Bookmarks.FAVICON });
 
             mAsserter.is(c.moveToFirst(), true, "Inserted bookmark found");
 
-            mAsserter.is(new String(c.getBlob(c.getColumnIndex(mBookmarksFaviconCol)), "UTF8"),
+            mAsserter.is(new String(c.getBlob(c.getColumnIndex(BrowserContract.Bookmarks.FAVICON)), "UTF8"),
                          favicon, "Inserted bookmark has corresponding favicon image");
 
             c = getFaviconsByUrl(pageUrl);
             mAsserter.is(c.moveToFirst(), true, "Inserted favicon found");
 
-            mAsserter.is(new String(c.getBlob(c.getColumnIndex(mCombinedFaviconCol)), "UTF8"),
+            mAsserter.is(new String(c.getBlob(c.getColumnIndex(BrowserContract.Combined.FAVICON)), "UTF8"),
                          favicon, "Inserted favicon has corresponding favicon image");
         }
     }
@@ -705,7 +583,7 @@ public class testBrowserProvider extends ContentProviderTest {
     class TestDeleteBookmarks extends Test {
         private long insertOneBookmark() throws Exception {
             ContentValues b = createOneBookmark();
-            long id = ContentUris.parseId(mProvider.insert(mBookmarksUri, b));
+            long id = ContentUris.parseId(mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, b));
 
             Cursor c = getBookmarkById(id);
             mAsserter.is(c.moveToFirst(), true, "Inserted bookmark found");
@@ -717,27 +595,27 @@ public class testBrowserProvider extends ContentProviderTest {
         public void test() throws Exception {
             long id = insertOneBookmark();
 
-            int deleted = mProvider.delete(mBookmarksUri,
-                                           mBookmarksIdCol + " = ?",
+            int deleted = mProvider.delete(BrowserContract.Bookmarks.CONTENT_URI,
+                                           BrowserContract.Bookmarks._ID + " = ?",
                                            new String[] { String.valueOf(id) });
 
             mAsserter.is((deleted == 1), true, "Inserted bookmark was deleted");
 
-            Cursor c = getBookmarkById(appendUriParam(mBookmarksUri, "PARAM_SHOW_DELETED", "1"), id);
+            Cursor c = getBookmarkById(appendUriParam(BrowserContract.Bookmarks.CONTENT_URI, BrowserContract.PARAM_SHOW_DELETED, "1"), id);
             mAsserter.is(c.moveToFirst(), true, "Deleted bookmark was only marked as deleted");
 
-            deleted = mProvider.delete(appendUriParam(mBookmarksUri, "PARAM_IS_SYNC", "1"),
-                                       mBookmarksIdCol + " = ?",
+            deleted = mProvider.delete(appendUriParam(BrowserContract.Bookmarks.CONTENT_URI, BrowserContract.PARAM_IS_SYNC, "1"),
+                                       BrowserContract.Bookmarks._ID + " = ?",
                                        new String[] { String.valueOf(id) });
 
             mAsserter.is((deleted == 1), true, "Inserted bookmark was deleted");
 
-            c = getBookmarkById(appendUriParam(mBookmarksUri, "PARAM_SHOW_DELETED", "1"), id);
+            c = getBookmarkById(appendUriParam(BrowserContract.Bookmarks.CONTENT_URI, BrowserContract.PARAM_SHOW_DELETED, "1"), id);
             mAsserter.is(c.moveToFirst(), false, "Inserted bookmark is now actually deleted");
 
             id = insertOneBookmark();
 
-            deleted = mProvider.delete(ContentUris.withAppendedId(mBookmarksUri, id), null, null);
+            deleted = mProvider.delete(ContentUris.withAppendedId(BrowserContract.Bookmarks.CONTENT_URI, id), null, null);
             mAsserter.is((deleted == 1), true,
                          "Inserted bookmark was deleted using URI with id");
 
@@ -748,23 +626,23 @@ public class testBrowserProvider extends ContentProviderTest {
             if (Build.VERSION.SDK_INT >= 8 &&
                 Build.VERSION.SDK_INT < 16) {
                 ContentValues b = createBookmark("Folder", null, mMobileFolderId,
-                        mBookmarksTypeFolder, 0, "folderTags", "folderDescription", "folderKeyword");
+                        BrowserContract.Bookmarks.TYPE_FOLDER, 0, "folderTags", "folderDescription", "folderKeyword");
 
-                long parentId = ContentUris.parseId(mProvider.insert(mBookmarksUri, b));
+                long parentId = ContentUris.parseId(mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, b));
                 c = getBookmarkById(parentId);
                 mAsserter.is(c.moveToFirst(), true, "Inserted bookmarks folder found");
 
                 b = createBookmark("Example", "http://example.com", parentId,
-                        mBookmarksTypeBookmark, 0, "tags", "description", "keyword");
+                        BrowserContract.Bookmarks.TYPE_BOOKMARK, 0, "tags", "description", "keyword");
 
-                id = ContentUris.parseId(mProvider.insert(mBookmarksUri, b));
+                id = ContentUris.parseId(mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, b));
                 c = getBookmarkById(id);
                 mAsserter.is(c.moveToFirst(), true, "Inserted bookmark found");
 
                 deleted = 0;
                 try {
-                    Uri uri = ContentUris.withAppendedId(mBookmarksUri, parentId);
-                    deleted = mProvider.delete(appendUriParam(uri, "PARAM_IS_SYNC", "1"), null, null);
+                    Uri uri = ContentUris.withAppendedId(BrowserContract.Bookmarks.CONTENT_URI, parentId);
+                    deleted = mProvider.delete(appendUriParam(uri, BrowserContract.PARAM_IS_SYNC, "1"), null, null);
                 } catch(Exception e) {}
 
                 mAsserter.is((deleted == 0), true,
@@ -778,16 +656,16 @@ public class testBrowserProvider extends ContentProviderTest {
         public void test() throws Exception {
             ContentValues b = createOneBookmark();
 
-            final String pageUrl = b.getAsString(mBookmarksUrlCol);
-            long id = ContentUris.parseId(mProvider.insert(mBookmarksUri, b));
+            final String pageUrl = b.getAsString(BrowserContract.Bookmarks.URL);
+            long id = ContentUris.parseId(mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, b));
 
             // Insert the favicon into the favicons table
-            mProvider.insert(mFaviconsUri, createFaviconEntry(pageUrl, "FAVICON"));
+            mProvider.insert(BrowserContract.Favicons.CONTENT_URI, createFaviconEntry(pageUrl, "FAVICON"));
 
             Cursor c = getFaviconsByUrl(pageUrl);
             mAsserter.is(c.moveToFirst(), true, "Inserted favicon found");
 
-            mProvider.delete(ContentUris.withAppendedId(mBookmarksUri, id), null, null);
+            mProvider.delete(ContentUris.withAppendedId(BrowserContract.Bookmarks.CONTENT_URI, id), null, null);
 
             c = getFaviconsByUrl(pageUrl);
             mAsserter.is(c.moveToFirst(), false, "Favicon is deleted with last reference to it");
@@ -802,8 +680,8 @@ public class testBrowserProvider extends ContentProviderTest {
             int updated = 0;
 
             try {
-                updated = mProvider.update(mBookmarksUri, u,
-                                           mBookmarksIdCol + " = ?",
+                updated = mProvider.update(BrowserContract.Bookmarks.CONTENT_URI, u,
+                                           BrowserContract.Bookmarks._ID + " = ?",
                                            new String[] { String.valueOf(id) });
             } catch (Exception e) {}
 
@@ -813,25 +691,25 @@ public class testBrowserProvider extends ContentProviderTest {
         @Override
         public void test() throws Exception {
             ContentValues b = createOneBookmark();
-            long id = ContentUris.parseId(mProvider.insert(mBookmarksUri, b));
+            long id = ContentUris.parseId(mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, b));
 
             Cursor c = getBookmarkById(id);
             mAsserter.is(c.moveToFirst(), true, "Inserted bookmark found");
 
-            long dateCreated = c.getLong(c.getColumnIndex(mBookmarksDateCreatedCol));
-            long dateModified = c.getLong(c.getColumnIndex(mBookmarksDateModifiedCol));
+            long dateCreated = c.getLong(c.getColumnIndex(BrowserContract.Bookmarks.DATE_CREATED));
+            long dateModified = c.getLong(c.getColumnIndex(BrowserContract.Bookmarks.DATE_MODIFIED));
 
             ContentValues u = new ContentValues();
-            u.put(mBookmarksTitleCol, b.getAsString(mBookmarksTitleCol) + "CHANGED");
-            u.put(mBookmarksUrlCol, b.getAsString(mBookmarksUrlCol) + "/more/stuff");
-            u.put(mBookmarksTagsCol, b.getAsString(mBookmarksTagsCol) + "CHANGED");
-            u.put(mBookmarksDescriptionCol, b.getAsString(mBookmarksDescriptionCol) + "CHANGED");
-            u.put(mBookmarksKeywordCol, b.getAsString(mBookmarksKeywordCol) + "CHANGED");
-            u.put(mBookmarksTypeCol, mBookmarksTypeFolder);
-            u.put(mBookmarksPositionCol, 10);
+            u.put(BrowserContract.Bookmarks.TITLE, b.getAsString(BrowserContract.Bookmarks.TITLE) + "CHANGED");
+            u.put(BrowserContract.Bookmarks.URL, b.getAsString(BrowserContract.Bookmarks.URL) + "/more/stuff");
+            u.put(BrowserContract.Bookmarks.TAGS, b.getAsString(BrowserContract.Bookmarks.TAGS) + "CHANGED");
+            u.put(BrowserContract.Bookmarks.DESCRIPTION, b.getAsString(BrowserContract.Bookmarks.DESCRIPTION) + "CHANGED");
+            u.put(BrowserContract.Bookmarks.KEYWORD, b.getAsString(BrowserContract.Bookmarks.KEYWORD) + "CHANGED");
+            u.put(BrowserContract.Bookmarks.TYPE, BrowserContract.Bookmarks.TYPE_FOLDER);
+            u.put(BrowserContract.Bookmarks.POSITION, 10);
 
-            int updated = mProvider.update(mBookmarksUri, u,
-                                           mBookmarksIdCol + " = ?",
+            int updated = mProvider.update(BrowserContract.Bookmarks.CONTENT_URI, u,
+                                           BrowserContract.Bookmarks._ID + " = ?",
                                            new String[] { String.valueOf(id) });
 
             mAsserter.is((updated == 1), true, "Inserted bookmark was updated");
@@ -839,46 +717,46 @@ public class testBrowserProvider extends ContentProviderTest {
             c = getBookmarkById(id);
             mAsserter.is(c.moveToFirst(), true, "Updated bookmark found");
 
-            mAsserter.is(c.getString(c.getColumnIndex(mBookmarksTitleCol)), u.getAsString(mBookmarksTitleCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Bookmarks.TITLE)), u.getAsString(BrowserContract.Bookmarks.TITLE),
                          "Inserted bookmark has correct title");
-            mAsserter.is(c.getString(c.getColumnIndex(mBookmarksUrlCol)), u.getAsString(mBookmarksUrlCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Bookmarks.URL)), u.getAsString(BrowserContract.Bookmarks.URL),
                          "Inserted bookmark has correct URL");
-            mAsserter.is(c.getString(c.getColumnIndex(mBookmarksTagsCol)), u.getAsString(mBookmarksTagsCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Bookmarks.TAGS)), u.getAsString(BrowserContract.Bookmarks.TAGS),
                          "Inserted bookmark has correct tags");
-            mAsserter.is(c.getString(c.getColumnIndex(mBookmarksKeywordCol)), u.getAsString(mBookmarksKeywordCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Bookmarks.KEYWORD)), u.getAsString(BrowserContract.Bookmarks.KEYWORD),
                          "Inserted bookmark has correct keyword");
-            mAsserter.is(c.getString(c.getColumnIndex(mBookmarksDescriptionCol)), u.getAsString(mBookmarksDescriptionCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Bookmarks.DESCRIPTION)), u.getAsString(BrowserContract.Bookmarks.DESCRIPTION),
                          "Inserted bookmark has correct description");
-            mAsserter.is(c.getString(c.getColumnIndex(mBookmarksPositionCol)), u.getAsString(mBookmarksPositionCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Bookmarks.POSITION)), u.getAsString(BrowserContract.Bookmarks.POSITION),
                          "Inserted bookmark has correct position");
-            mAsserter.is(c.getString(c.getColumnIndex(mBookmarksTypeCol)), u.getAsString(mBookmarksTypeCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Bookmarks.TYPE)), u.getAsString(BrowserContract.Bookmarks.TYPE),
                          "Inserted bookmark has correct type");
 
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mBookmarksDateCreatedCol))),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.Bookmarks.DATE_CREATED))),
                          new Long(dateCreated),
                          "Updated bookmark has same creation date");
 
-            mAsserter.isnot(new Long(c.getLong(c.getColumnIndex(mBookmarksDateModifiedCol))),
+            mAsserter.isnot(new Long(c.getLong(c.getColumnIndex(BrowserContract.Bookmarks.DATE_MODIFIED))),
                             new Long(dateModified),
                             "Updated bookmark has new modification date");
 
-            updated = updateWithNullCol(id, mBookmarksPositionCol);
+            updated = updateWithNullCol(id, BrowserContract.Bookmarks.POSITION);
             mAsserter.is((updated > 0), false,
                          "Should not be able to update bookmark with null position");
 
-            updated = updateWithNullCol(id, mBookmarksTypeCol);
+            updated = updateWithNullCol(id, BrowserContract.Bookmarks.TYPE);
             mAsserter.is((updated > 0), false,
                          "Should not be able to update bookmark with null type");
 
             u = new ContentValues();
-            u.put(mBookmarksUrlCol, "http://examples2.com");
+            u.put(BrowserContract.Bookmarks.URL, "http://examples2.com");
 
-            updated = mProvider.update(ContentUris.withAppendedId(mBookmarksUri, id), u, null, null);
+            updated = mProvider.update(ContentUris.withAppendedId(BrowserContract.Bookmarks.CONTENT_URI, id), u, null, null);
 
             c = getBookmarkById(id);
             mAsserter.is(c.moveToFirst(), true, "Updated bookmark found");
 
-            mAsserter.is(c.getString(c.getColumnIndex(mBookmarksUrlCol)), u.getAsString(mBookmarksUrlCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Bookmarks.URL)), u.getAsString(BrowserContract.Bookmarks.URL),
                          "Updated bookmark has correct URL using URI with id");
         }
     }
@@ -890,27 +768,27 @@ public class testBrowserProvider extends ContentProviderTest {
 
             final String favicon = "FAVICON";
             final String newFavicon = "NEW_FAVICON";
-            final String pageUrl = b.getAsString(mBookmarksUrlCol);
+            final String pageUrl = b.getAsString(BrowserContract.Bookmarks.URL);
 
-            mProvider.insert(mBookmarksUri, b);
+            mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, b);
 
             // Insert the favicon into the favicons table
             ContentValues f = createFaviconEntry(pageUrl, favicon);
-            long faviconId = ContentUris.parseId(mProvider.insert(mFaviconsUri, f));
+            long faviconId = ContentUris.parseId(mProvider.insert(BrowserContract.Favicons.CONTENT_URI, f));
 
             Cursor c = getFaviconsByUrl(pageUrl);
             mAsserter.is(c.moveToFirst(), true, "Inserted favicon found");
 
-            mAsserter.is(new String(c.getBlob(c.getColumnIndex(mCombinedFaviconCol)), "UTF8"),
+            mAsserter.is(new String(c.getBlob(c.getColumnIndex(BrowserContract.Combined.FAVICON)), "UTF8"),
                          favicon, "Inserted favicon has corresponding favicon image");
 
             ContentValues u = createFaviconEntry(pageUrl, newFavicon);
-            mProvider.update(mFaviconsUri, u, null, null);
+            mProvider.update(BrowserContract.Favicons.CONTENT_URI, u, null, null);
 
             c = getFaviconsByUrl(pageUrl);
             mAsserter.is(c.moveToFirst(), true, "Updated favicon found");
 
-            mAsserter.is(new String(c.getBlob(c.getColumnIndex(mCombinedFaviconCol)), "UTF8"),
+            mAsserter.is(new String(c.getBlob(c.getColumnIndex(BrowserContract.Combined.FAVICON)), "UTF8"),
                          newFavicon, "Updated favicon has corresponding favicon image");
         }
     }
@@ -931,8 +809,8 @@ public class testBrowserProvider extends ContentProviderTest {
         public void compareCursorToItems(final Cursor c, final String[] items, final int count) {
             mAsserter.is(c.moveToFirst(), true, "Folder has children.");
 
-            int posColumn = c.getColumnIndex(mBookmarksPositionCol);
-            int guidColumn = c.getColumnIndex(mBookmarksGuidCol);
+            int posColumn = c.getColumnIndex(BrowserContract.Bookmarks.POSITION);
+            int guidColumn = c.getColumnIndex(BrowserContract.Bookmarks.GUID);
             int i = 0;
 
             while (!c.isAfterLast()) {
@@ -954,27 +832,27 @@ public class testBrowserProvider extends ContentProviderTest {
         public void test() throws Exception {
             // Create the containing folder.
             ContentValues folder = createBookmark("FolderFolder", "", mMobileFolderId,
-                                                  mBookmarksTypeFolder, 0, "",
+                                                  BrowserContract.Bookmarks.TYPE_FOLDER, 0, "",
                                                   "description", "keyword");
-            folder.put(mBookmarksGuidCol, "folderfolder");
-            long folderId = ContentUris.parseId(mProvider.insert(mBookmarksUri, folder));
+            folder.put(BrowserContract.Bookmarks.GUID, "folderfolder");
+            long folderId = ContentUris.parseId(mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, folder));
 
             // Create the children.
             String[] items = new String[NUMBER_OF_CHILDREN];
 
             // Reuse the same ContentValues.
             ContentValues item = createBookmark("Test Bookmark", "http://example.com", folderId,
-                                                mBookmarksTypeFolder, 0, "",
+                                                BrowserContract.Bookmarks.TYPE_FOLDER, 0, "",
                                                 "description", "keyword");
 
             for (int i = 0; i < NUMBER_OF_CHILDREN; ++i) {
                 String guid = makeGUID(i);
                 items[i] = guid;
-                item.put(mBookmarksGuidCol, guid);
-                item.put(mBookmarksPositionCol, i);
-                item.put(mBookmarksUrlCol, "http://example.com/" + guid);
-                item.put(mBookmarksTitleCol, "Test Bookmark " + guid);
-                mProvider.insert(mBookmarksUri, item);
+                item.put(BrowserContract.Bookmarks.GUID, guid);
+                item.put(BrowserContract.Bookmarks.POSITION, i);
+                item.put(BrowserContract.Bookmarks.URL, "http://example.com/" + guid);
+                item.put(BrowserContract.Bookmarks.TITLE, "Test Bookmark " + guid);
+                mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, item);
             }
 
             Cursor c;
@@ -994,7 +872,7 @@ public class testBrowserProvider extends ContentProviderTest {
             }
 
             // Impose the positions.
-            long updated = mProvider.update(mBookmarksPositionUri, null, null, items);
+            long updated = mProvider.update(BrowserContract.Bookmarks.POSITIONS_CONTENT_URI, null, null, items);
             mAsserter.is(updated, (long) NUMBER_OF_CHILDREN, "Updated " + NUMBER_OF_CHILDREN + " positions.");
 
             // Verify that the database was updated.
@@ -1011,7 +889,7 @@ public class testBrowserProvider extends ContentProviderTest {
             long id = -1;
 
             try {
-                id = ContentUris.parseId(mProvider.insert(mHistoryUri, h));
+                id = ContentUris.parseId(mProvider.insert(BrowserContract.History.CONTENT_URI, h));
             } catch (Exception e) {}
 
             return id;
@@ -1020,27 +898,27 @@ public class testBrowserProvider extends ContentProviderTest {
         @Override
         public void test() throws Exception {
             ContentValues h = createOneHistoryEntry();
-            long id = ContentUris.parseId(mProvider.insert(mHistoryUri, h));
+            long id = ContentUris.parseId(mProvider.insert(BrowserContract.History.CONTENT_URI, h));
             Cursor c = getHistoryEntryById(id);
 
             mAsserter.is(c.moveToFirst(), true, "Inserted history entry found");
 
-            mAsserter.is(c.getString(c.getColumnIndex(mHistoryTitleCol)), h.getAsString(mHistoryTitleCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.History.TITLE)), h.getAsString(BrowserContract.History.TITLE),
                          "Inserted history entry has correct title");
-            mAsserter.is(c.getString(c.getColumnIndex(mHistoryUrlCol)), h.getAsString(mHistoryUrlCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.History.URL)), h.getAsString(BrowserContract.History.URL),
                          "Inserted history entry has correct URL");
-            mAsserter.is(c.getString(c.getColumnIndex(mHistoryVisitsCol)), h.getAsString(mHistoryVisitsCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.History.VISITS)), h.getAsString(BrowserContract.History.VISITS),
                          "Inserted history entry has correct number of visits");
-            mAsserter.is(c.getString(c.getColumnIndex(mHistoryLastVisitedCol)), h.getAsString(mHistoryLastVisitedCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.History.DATE_LAST_VISITED)), h.getAsString(BrowserContract.History.DATE_LAST_VISITED),
                          "Inserted history entry has correct last visited date");
-            mAsserter.is(c.getString(c.getColumnIndex(mHistoryIsDeletedCol)), String.valueOf(0),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.History.IS_DELETED)), String.valueOf(0),
                          "Inserted history entry has correct is-deleted state");
 
-            id = insertWithNullCol(mHistoryUrlCol);
+            id = insertWithNullCol(BrowserContract.History.URL);
             mAsserter.is(new Long(id), new Long(-1),
                          "Should not be able to insert history with null URL");
 
-            id = insertWithNullCol(mHistoryVisitsCol);
+            id = insertWithNullCol(BrowserContract.History.VISITS);
             mAsserter.is(new Long(id), new Long(-1),
                          "Should not be able to insert history with null number of visits");
         }
@@ -1052,24 +930,24 @@ public class testBrowserProvider extends ContentProviderTest {
             ContentValues h = createOneHistoryEntry();
 
             final String favicon = "FAVICON";
-            final String pageUrl = h.getAsString(mHistoryUrlCol);
+            final String pageUrl = h.getAsString(BrowserContract.History.URL);
 
-            long id = ContentUris.parseId(mProvider.insert(mHistoryUri, h));
+            long id = ContentUris.parseId(mProvider.insert(BrowserContract.History.CONTENT_URI, h));
 
             // Insert the favicon into the favicons table
-            mProvider.insert(mFaviconsUri, createFaviconEntry(pageUrl, favicon));
+            mProvider.insert(BrowserContract.Favicons.CONTENT_URI, createFaviconEntry(pageUrl, favicon));
 
-            Cursor c = getHistoryEntryById(id, new String[] { mHistoryFaviconCol });
+            Cursor c = getHistoryEntryById(id, new String[] { BrowserContract.History.FAVICON });
 
             mAsserter.is(c.moveToFirst(), true, "Inserted history entry found");
 
-            mAsserter.is(new String(c.getBlob(c.getColumnIndex(mHistoryFaviconCol)), "UTF8"),
+            mAsserter.is(new String(c.getBlob(c.getColumnIndex(BrowserContract.History.FAVICON)), "UTF8"),
                          favicon, "Inserted history entry has corresponding favicon image");
 
             c = getFaviconsByUrl(pageUrl);
             mAsserter.is(c.moveToFirst(), true, "Inserted favicon found");
 
-            mAsserter.is(new String(c.getBlob(c.getColumnIndex(mCombinedFaviconCol)), "UTF8"),
+            mAsserter.is(new String(c.getBlob(c.getColumnIndex(BrowserContract.Combined.FAVICON)), "UTF8"),
                          favicon, "Inserted favicon has corresponding favicon image");
         }
     }
@@ -1077,7 +955,7 @@ public class testBrowserProvider extends ContentProviderTest {
     class TestDeleteHistory extends Test {
         private long insertOneHistoryEntry() throws Exception {
             ContentValues h = createOneHistoryEntry();
-            long id = ContentUris.parseId(mProvider.insert(mHistoryUri, h));
+            long id = ContentUris.parseId(mProvider.insert(BrowserContract.History.CONTENT_URI, h));
 
             Cursor c = getHistoryEntryById(id);
             mAsserter.is(c.moveToFirst(), true, "Inserted history entry found");
@@ -1089,27 +967,27 @@ public class testBrowserProvider extends ContentProviderTest {
         public void test() throws Exception {
             long id = insertOneHistoryEntry();
 
-            int deleted = mProvider.delete(mHistoryUri,
-                                           mHistoryIdCol + " = ?",
+            int deleted = mProvider.delete(BrowserContract.History.CONTENT_URI,
+                                           BrowserContract.History._ID + " = ?",
                                            new String[] { String.valueOf(id) });
 
             mAsserter.is((deleted == 1), true, "Inserted history entry was deleted");
 
-            Cursor c = getHistoryEntryById(appendUriParam(mHistoryUri, "PARAM_SHOW_DELETED", "1"), id);
+            Cursor c = getHistoryEntryById(appendUriParam(BrowserContract.History.CONTENT_URI, BrowserContract.PARAM_SHOW_DELETED, "1"), id);
             mAsserter.is(c.moveToFirst(), true, "Deleted history entry was only marked as deleted");
 
-            deleted = mProvider.delete(appendUriParam(mHistoryUri, "PARAM_IS_SYNC", "1"),
-                                       mHistoryIdCol + " = ?",
+            deleted = mProvider.delete(appendUriParam(BrowserContract.History.CONTENT_URI, BrowserContract.PARAM_IS_SYNC, "1"),
+                                       BrowserContract.History._ID + " = ?",
                                        new String[] { String.valueOf(id) });
 
             mAsserter.is((deleted == 1), true, "Inserted history entry was deleted");
 
-            c = getHistoryEntryById(appendUriParam(mHistoryUri, "PARAM_SHOW_DELETED", "1"), id);
+            c = getHistoryEntryById(appendUriParam(BrowserContract.History.CONTENT_URI, BrowserContract.PARAM_SHOW_DELETED, "1"), id);
             mAsserter.is(c.moveToFirst(), false, "Inserted history is now actually deleted");
 
             id = insertOneHistoryEntry();
 
-            deleted = mProvider.delete(ContentUris.withAppendedId(mHistoryUri, id), null, null);
+            deleted = mProvider.delete(ContentUris.withAppendedId(BrowserContract.History.CONTENT_URI, id), null, null);
             mAsserter.is((deleted == 1), true,
                          "Inserted history entry was deleted using URI with id");
 
@@ -1124,16 +1002,16 @@ public class testBrowserProvider extends ContentProviderTest {
         public void test() throws Exception {
             ContentValues h = createOneHistoryEntry();
 
-            long id = ContentUris.parseId(mProvider.insert(mHistoryUri, h));
-            final String pageUrl = h.getAsString(mHistoryUrlCol);
+            long id = ContentUris.parseId(mProvider.insert(BrowserContract.History.CONTENT_URI, h));
+            final String pageUrl = h.getAsString(BrowserContract.History.URL);
 
             // Insert the favicon into the favicons table
-            mProvider.insert(mFaviconsUri, createFaviconEntry(pageUrl, "FAVICON"));
+            mProvider.insert(BrowserContract.Favicons.CONTENT_URI, createFaviconEntry(pageUrl, "FAVICON"));
 
             Cursor c = getFaviconsByUrl(pageUrl);
             mAsserter.is(c.moveToFirst(), true, "Inserted favicon found");
 
-            mProvider.delete(ContentUris.withAppendedId(mHistoryUri, id), null, null);
+            mProvider.delete(ContentUris.withAppendedId(BrowserContract.History.CONTENT_URI, id), null, null);
 
             c = getFaviconsByUrl(pageUrl);
             mAsserter.is(c.moveToFirst(), false, "Favicon is deleted with last reference to it");
@@ -1148,8 +1026,8 @@ public class testBrowserProvider extends ContentProviderTest {
             int updated = 0;
 
             try {
-                updated = mProvider.update(mHistoryUri, u,
-                                           mHistoryIdCol + " = ?",
+                updated = mProvider.update(BrowserContract.History.CONTENT_URI, u,
+                                           BrowserContract.History._ID + " = ?",
                                            new String[] { String.valueOf(id) });
             } catch (Exception e) {}
 
@@ -1159,22 +1037,22 @@ public class testBrowserProvider extends ContentProviderTest {
         @Override
         public void test() throws Exception {
             ContentValues h = createOneHistoryEntry();
-            long id = ContentUris.parseId(mProvider.insert(mHistoryUri, h));
+            long id = ContentUris.parseId(mProvider.insert(BrowserContract.History.CONTENT_URI, h));
 
             Cursor c = getHistoryEntryById(id);
             mAsserter.is(c.moveToFirst(), true, "Inserted history entry found");
 
-            long dateCreated = c.getLong(c.getColumnIndex(mHistoryDateCreatedCol));
-            long dateModified = c.getLong(c.getColumnIndex(mHistoryDateModifiedCol));
+            long dateCreated = c.getLong(c.getColumnIndex(BrowserContract.History.DATE_CREATED));
+            long dateModified = c.getLong(c.getColumnIndex(BrowserContract.History.DATE_MODIFIED));
 
             ContentValues u = new ContentValues();
-            u.put(mHistoryVisitsCol, h.getAsInteger(mHistoryVisitsCol) + 1);
-            u.put(mHistoryLastVisitedCol, System.currentTimeMillis());
-            u.put(mHistoryTitleCol, h.getAsString(mHistoryTitleCol) + "CHANGED");
-            u.put(mHistoryUrlCol, h.getAsString(mHistoryUrlCol) + "/more/stuff");
+            u.put(BrowserContract.History.VISITS, h.getAsInteger(BrowserContract.History.VISITS) + 1);
+            u.put(BrowserContract.History.DATE_LAST_VISITED, System.currentTimeMillis());
+            u.put(BrowserContract.History.TITLE, h.getAsString(BrowserContract.History.TITLE) + "CHANGED");
+            u.put(BrowserContract.History.URL, h.getAsString(BrowserContract.History.URL) + "/more/stuff");
 
-            int updated = mProvider.update(mHistoryUri, u,
-                                           mHistoryIdCol + " = ?",
+            int updated = mProvider.update(BrowserContract.History.CONTENT_URI, u,
+                                           BrowserContract.History._ID + " = ?",
                                            new String[] { String.valueOf(id) });
 
             mAsserter.is((updated == 1), true, "Inserted history entry was updated");
@@ -1182,40 +1060,40 @@ public class testBrowserProvider extends ContentProviderTest {
             c = getHistoryEntryById(id);
             mAsserter.is(c.moveToFirst(), true, "Updated history entry found");
 
-            mAsserter.is(c.getString(c.getColumnIndex(mHistoryTitleCol)), u.getAsString(mHistoryTitleCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.History.TITLE)), u.getAsString(BrowserContract.History.TITLE),
                          "Updated history entry has correct title");
-            mAsserter.is(c.getString(c.getColumnIndex(mHistoryUrlCol)), u.getAsString(mHistoryUrlCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.History.URL)), u.getAsString(BrowserContract.History.URL),
                          "Updated history entry has correct URL");
-            mAsserter.is(c.getString(c.getColumnIndex(mHistoryVisitsCol)), u.getAsString(mHistoryVisitsCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.History.VISITS)), u.getAsString(BrowserContract.History.VISITS),
                          "Updated history entry has correct number of visits");
-            mAsserter.is(c.getString(c.getColumnIndex(mHistoryLastVisitedCol)), u.getAsString(mHistoryLastVisitedCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.History.DATE_LAST_VISITED)), u.getAsString(BrowserContract.History.DATE_LAST_VISITED),
                          "Updated history entry has correct last visited date");
 
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mHistoryDateCreatedCol))),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.History.DATE_CREATED))),
                          new Long(dateCreated),
                          "Updated history entry has same creation date");
 
-            mAsserter.isnot(new Long(c.getLong(c.getColumnIndex(mHistoryDateModifiedCol))),
+            mAsserter.isnot(new Long(c.getLong(c.getColumnIndex(BrowserContract.History.DATE_MODIFIED))),
                             new Long(dateModified),
                             "Updated history entry has new modification date");
 
-            updated = updateWithNullCol(id, mHistoryUrlCol);
+            updated = updateWithNullCol(id, BrowserContract.History.URL);
             mAsserter.is((updated > 0), false,
                          "Should not be able to update history with null URL");
 
-            updated = updateWithNullCol(id, mHistoryVisitsCol);
+            updated = updateWithNullCol(id, BrowserContract.History.VISITS);
             mAsserter.is((updated > 0), false,
                          "Should not be able to update history with null number of visits");
 
             u = new ContentValues();
-            u.put(mHistoryUrlCol, "http://examples2.com");
+            u.put(BrowserContract.History.URL, "http://examples2.com");
 
-            updated = mProvider.update(ContentUris.withAppendedId(mHistoryUri, id), u, null, null);
+            updated = mProvider.update(ContentUris.withAppendedId(BrowserContract.History.CONTENT_URI, id), u, null, null);
 
             c = getHistoryEntryById(id);
             mAsserter.is(c.moveToFirst(), true, "Updated history entry found");
 
-            mAsserter.is(c.getString(c.getColumnIndex(mHistoryUrlCol)), u.getAsString(mHistoryUrlCol),
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.History.URL)), u.getAsString(BrowserContract.History.URL),
                          "Updated history entry has correct URL using URI with id");
         }
     }
@@ -1227,27 +1105,27 @@ public class testBrowserProvider extends ContentProviderTest {
 
             final String favicon = "FAVICON";
             final String newFavicon = "NEW_FAVICON";
-            final String pageUrl = h.getAsString(mHistoryUrlCol);
+            final String pageUrl = h.getAsString(BrowserContract.History.URL);
 
-            mProvider.insert(mHistoryUri, h);
+            mProvider.insert(BrowserContract.History.CONTENT_URI, h);
 
             // Insert the favicon into the favicons table
-            mProvider.insert(mFaviconsUri, createFaviconEntry(pageUrl, favicon));
+            mProvider.insert(BrowserContract.Favicons.CONTENT_URI, createFaviconEntry(pageUrl, favicon));
 
             Cursor c = getFaviconsByUrl(pageUrl);
             mAsserter.is(c.moveToFirst(), true, "Inserted favicon found");
 
-            mAsserter.is(new String(c.getBlob(c.getColumnIndex(mCombinedFaviconCol)), "UTF8"),
+            mAsserter.is(new String(c.getBlob(c.getColumnIndex(BrowserContract.Combined.FAVICON)), "UTF8"),
                          favicon, "Inserted favicon has corresponding favicon image");
 
             ContentValues u = createFaviconEntry(pageUrl, newFavicon);
 
-            mProvider.update(mFaviconsUri, u, null, null);
+            mProvider.update(BrowserContract.Favicons.CONTENT_URI, u, null, null);
 
             c = getFaviconsByUrl(pageUrl);
             mAsserter.is(c.moveToFirst(), true, "Updated favicon found");
 
-            mAsserter.is(new String(c.getBlob(c.getColumnIndex(mCombinedFaviconCol)), "UTF8"),
+            mAsserter.is(new String(c.getBlob(c.getColumnIndex(BrowserContract.Combined.FAVICON)), "UTF8"),
                          newFavicon, "Updated favicon has corresponding favicon image");
         }
     }
@@ -1258,9 +1136,9 @@ public class testBrowserProvider extends ContentProviderTest {
         private final String TEST_TITLE = "Example";
 
         private long getHistoryEntryIdByUrl(String url) {
-            Cursor c = mProvider.query(mHistoryUri,
-                                       new String[] { mHistoryIdCol },
-                                       mHistoryUrlCol + " = ?",
+            Cursor c = mProvider.query(BrowserContract.History.CONTENT_URI,
+                                       new String[] { BrowserContract.History._ID },
+                                       BrowserContract.History.URL + " = ?",
                                        new String[] { url },
                                        null);
             c.moveToFirst();
@@ -1272,27 +1150,27 @@ public class testBrowserProvider extends ContentProviderTest {
 
         @Override
         public void test() throws Exception {
-            Uri updateHistoryUri = mHistoryUri.buildUpon().
+            Uri updateHistoryUri = BrowserContract.History.CONTENT_URI.buildUpon().
                 appendQueryParameter("increment_visits", "true").build();
-            Uri updateOrInsertHistoryUri = mHistoryUri.buildUpon().
+            Uri updateOrInsertHistoryUri = BrowserContract.History.CONTENT_URI.buildUpon().
                 appendQueryParameter("insert_if_needed", "true").
                 appendQueryParameter("increment_visits", "true").build();
 
             // Update a non-existent history entry, without specifying visits or title
             ContentValues values = new ContentValues();
-            values.put(mHistoryUrlCol, TEST_URL_1);
+            values.put(BrowserContract.History.URL, TEST_URL_1);
 
             int updated = mProvider.update(updateHistoryUri, values,
-                                           mHistoryUrlCol + " = ?",
+                                           BrowserContract.History.URL + " = ?",
                                            new String[] { TEST_URL_1 });
             mAsserter.is((updated == 0), true, "History entry was not updated");
-            Cursor c = mProvider.query(mHistoryUri, null, null, null, null);
+            Cursor c = mProvider.query(BrowserContract.History.CONTENT_URI, null, null, null, null);
             mAsserter.is(c.moveToFirst(), false, "History entry was not inserted");
             c.close();
 
             // Now let's try with update-or-insert.
             updated = mProvider.update(updateOrInsertHistoryUri, values,
-                                           mHistoryUrlCol + " = ?",
+                                           BrowserContract.History.URL + " = ?",
                                            new String[] { TEST_URL_1 });
             mAsserter.is((updated == 1), true, "History entry was inserted");
 
@@ -1300,80 +1178,80 @@ public class testBrowserProvider extends ContentProviderTest {
             c = getHistoryEntryById(id);
             mAsserter.is(c.moveToFirst(), true, "History entry was inserted");
 
-            long dateCreated = c.getLong(c.getColumnIndex(mHistoryDateCreatedCol));
-            long dateModified = c.getLong(c.getColumnIndex(mHistoryDateModifiedCol));
+            long dateCreated = c.getLong(c.getColumnIndex(BrowserContract.History.DATE_CREATED));
+            long dateModified = c.getLong(c.getColumnIndex(BrowserContract.History.DATE_MODIFIED));
 
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mHistoryVisitsCol))), new Long(1),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.History.VISITS))), new Long(1),
                          "Inserted history entry has correct default number of visits");
-            mAsserter.is(c.getString(c.getColumnIndex(mHistoryTitleCol)), TEST_URL_1,
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.History.TITLE)), TEST_URL_1,
                          "Inserted history entry has correct default title");
 
             // Update the history entry, without specifying an additional visit count
             values = new ContentValues();
-            values.put(mHistoryLastVisitedCol, System.currentTimeMillis());
-            values.put(mHistoryTitleCol, TEST_TITLE);
+            values.put(BrowserContract.History.DATE_LAST_VISITED, System.currentTimeMillis());
+            values.put(BrowserContract.History.TITLE, TEST_TITLE);
 
             updated = mProvider.update(updateOrInsertHistoryUri, values,
-                                       mHistoryIdCol + " = ?",
+                                       BrowserContract.History._ID + " = ?",
                                        new String[] { String.valueOf(id) });
             mAsserter.is((updated == 1), true, "Inserted history entry was updated");
 
             c = getHistoryEntryById(id);
             mAsserter.is(c.moveToFirst(), true, "Updated history entry found");
 
-            mAsserter.is(c.getString(c.getColumnIndex(mHistoryTitleCol)), TEST_TITLE,
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.History.TITLE)), TEST_TITLE,
                          "Updated history entry has correct title");
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mHistoryVisitsCol))), new Long(2),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.History.VISITS))), new Long(2),
                          "Updated history entry has correct number of visits");
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mHistoryDateCreatedCol))), new Long(dateCreated),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.History.DATE_CREATED))), new Long(dateCreated),
                          "Updated history entry has same creation date");
-            mAsserter.isnot(new Long(c.getLong(c.getColumnIndex(mHistoryDateModifiedCol))), new Long(dateModified),
+            mAsserter.isnot(new Long(c.getLong(c.getColumnIndex(BrowserContract.History.DATE_MODIFIED))), new Long(dateModified),
                             "Updated history entry has new modification date");
 
             // Create a new history entry, specifying visits and history
             values = new ContentValues();
-            values.put(mHistoryUrlCol, TEST_URL_2);
-            values.put(mHistoryTitleCol, TEST_TITLE);
-            values.put(mHistoryVisitsCol, 10);
+            values.put(BrowserContract.History.URL, TEST_URL_2);
+            values.put(BrowserContract.History.TITLE, TEST_TITLE);
+            values.put(BrowserContract.History.VISITS, 10);
 
             updated = mProvider.update(updateOrInsertHistoryUri, values,
-                                           mHistoryUrlCol + " = ?",
-                                           new String[] { values.getAsString(mHistoryUrlCol) });
+                                           BrowserContract.History.URL + " = ?",
+                                           new String[] { values.getAsString(BrowserContract.History.URL) });
             mAsserter.is((updated == 1), true, "History entry was inserted");
 
             id = getHistoryEntryIdByUrl(TEST_URL_2);
             c = getHistoryEntryById(id);
             mAsserter.is(c.moveToFirst(), true, "History entry was inserted");
 
-            dateCreated = c.getLong(c.getColumnIndex(mHistoryDateCreatedCol));
-            dateModified = c.getLong(c.getColumnIndex(mHistoryDateModifiedCol));
+            dateCreated = c.getLong(c.getColumnIndex(BrowserContract.History.DATE_CREATED));
+            dateModified = c.getLong(c.getColumnIndex(BrowserContract.History.DATE_MODIFIED));
 
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mHistoryVisitsCol))), new Long(10),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.History.VISITS))), new Long(10),
                          "Inserted history entry has correct specified number of visits");
-            mAsserter.is(c.getString(c.getColumnIndex(mHistoryTitleCol)), TEST_TITLE,
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.History.TITLE)), TEST_TITLE,
                          "Inserted history entry has correct specified title");
 
             // Update the history entry, specifying additional visit count
             values = new ContentValues();
-            values.put(mHistoryVisitsCol, 10);
+            values.put(BrowserContract.History.VISITS, 10);
 
             updated = mProvider.update(updateOrInsertHistoryUri, values,
-                                       mHistoryIdCol + " = ?",
+                                       BrowserContract.History._ID + " = ?",
                                        new String[] { String.valueOf(id) });
             mAsserter.is((updated == 1), true, "Inserted history entry was updated");
 
             c = getHistoryEntryById(id);
             mAsserter.is(c.moveToFirst(), true, "Updated history entry found");
 
-            mAsserter.is(c.getString(c.getColumnIndex(mHistoryTitleCol)), TEST_TITLE,
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.History.TITLE)), TEST_TITLE,
                          "Updated history entry has correct unchanged title");
-            mAsserter.is(c.getString(c.getColumnIndex(mHistoryUrlCol)), TEST_URL_2,
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.History.URL)), TEST_URL_2,
                          "Updated history entry has correct unchanged URL");
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mHistoryVisitsCol))), new Long(20),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.History.VISITS))), new Long(20),
                          "Updated history entry has correct number of visits");
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mHistoryDateCreatedCol))), new Long(dateCreated),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.History.DATE_CREATED))), new Long(dateCreated),
                          "Updated history entry has same creation date");
-            mAsserter.isnot(new Long(c.getLong(c.getColumnIndex(mHistoryDateModifiedCol))), new Long(dateModified),
+            mAsserter.isnot(new Long(c.getLong(c.getColumnIndex(BrowserContract.History.DATE_MODIFIED))), new Long(dateModified),
                             "Updated history entry has new modification date");
 
         }
@@ -1385,17 +1263,17 @@ public class testBrowserProvider extends ContentProviderTest {
             ContentValues h = createOneHistoryEntry();
 
             final String thumbnail = "THUMBNAIL";
-            final String pageUrl = h.getAsString(mHistoryUrlCol);
+            final String pageUrl = h.getAsString(BrowserContract.History.URL);
 
-            long id = ContentUris.parseId(mProvider.insert(mHistoryUri, h));
+            long id = ContentUris.parseId(mProvider.insert(BrowserContract.History.CONTENT_URI, h));
 
             // Insert the thumbnail into the thumbnails table
-            mProvider.insert(mThumbnailsUri, createThumbnailEntry(pageUrl, thumbnail));
+            mProvider.insert(BrowserContract.Thumbnails.CONTENT_URI, createThumbnailEntry(pageUrl, thumbnail));
 
             Cursor c = getThumbnailByUrl(pageUrl);
             mAsserter.is(c.moveToFirst(), true, "Inserted thumbnail found");
 
-            mAsserter.is(new String(c.getBlob(c.getColumnIndex(mThumbnailsDataCol)), "UTF8"),
+            mAsserter.is(new String(c.getBlob(c.getColumnIndex(BrowserContract.Thumbnails.DATA)), "UTF8"),
                          thumbnail, "Inserted thumbnail has corresponding thumbnail image");
         }
     }
@@ -1407,27 +1285,27 @@ public class testBrowserProvider extends ContentProviderTest {
 
             final String thumbnail = "THUMBNAIL";
             final String newThumbnail = "NEW_THUMBNAIL";
-            final String pageUrl = h.getAsString(mHistoryUrlCol);
+            final String pageUrl = h.getAsString(BrowserContract.History.URL);
 
-            mProvider.insert(mHistoryUri, h);
+            mProvider.insert(BrowserContract.History.CONTENT_URI, h);
 
             // Insert the thumbnail into the thumbnails table
-            mProvider.insert(mThumbnailsUri, createThumbnailEntry(pageUrl, thumbnail));
+            mProvider.insert(BrowserContract.Thumbnails.CONTENT_URI, createThumbnailEntry(pageUrl, thumbnail));
 
             Cursor c = getThumbnailByUrl(pageUrl);
             mAsserter.is(c.moveToFirst(), true, "Inserted thumbnail found");
 
-            mAsserter.is(new String(c.getBlob(c.getColumnIndex(mThumbnailsDataCol)), "UTF8"),
+            mAsserter.is(new String(c.getBlob(c.getColumnIndex(BrowserContract.Thumbnails.DATA)), "UTF8"),
                          thumbnail, "Inserted thumbnail has corresponding thumbnail image");
 
             ContentValues u = createThumbnailEntry(pageUrl, newThumbnail);
 
-            mProvider.update(mThumbnailsUri, u, null, null);
+            mProvider.update(BrowserContract.Thumbnails.CONTENT_URI, u, null, null);
 
             c = getThumbnailByUrl(pageUrl);
             mAsserter.is(c.moveToFirst(), true, "Updated thumbnail found");
 
-            mAsserter.is(new String(c.getBlob(c.getColumnIndex(mThumbnailsDataCol)), "UTF8"),
+            mAsserter.is(new String(c.getBlob(c.getColumnIndex(BrowserContract.Thumbnails.DATA)), "UTF8"),
                          newThumbnail, "Updated thumbnail has corresponding thumbnail image");
         }
     }
@@ -1437,16 +1315,16 @@ public class testBrowserProvider extends ContentProviderTest {
         public void test() throws Exception {
             ContentValues h = createOneHistoryEntry();
 
-            long id = ContentUris.parseId(mProvider.insert(mHistoryUri, h));
-            final String pageUrl = h.getAsString(mHistoryUrlCol);
+            long id = ContentUris.parseId(mProvider.insert(BrowserContract.History.CONTENT_URI, h));
+            final String pageUrl = h.getAsString(BrowserContract.History.URL);
 
             // Insert the thumbnail into the thumbnails table
-            mProvider.insert(mThumbnailsUri, createThumbnailEntry(pageUrl, "THUMBNAIL"));
+            mProvider.insert(BrowserContract.Thumbnails.CONTENT_URI, createThumbnailEntry(pageUrl, "THUMBNAIL"));
 
             Cursor c = getThumbnailByUrl(pageUrl);
             mAsserter.is(c.moveToFirst(), true, "Inserted thumbnail found");
 
-            mProvider.delete(ContentUris.withAppendedId(mHistoryUri, id), null, null);
+            mProvider.delete(ContentUris.withAppendedId(BrowserContract.History.CONTENT_URI, id), null, null);
 
             c = getThumbnailByUrl(pageUrl);
             mAsserter.is(c.moveToFirst(), false, "Thumbnail is deleted with last reference to it");
@@ -1471,91 +1349,91 @@ public class testBrowserProvider extends ContentProviderTest {
 
             // Create a basic history entry
             ContentValues basicHistory = createHistoryEntry(TITLE_1, URL_1, VISITS, LAST_VISITED);
-            long basicHistoryId = ContentUris.parseId(mProvider.insert(mHistoryUri, basicHistory));
+            long basicHistoryId = ContentUris.parseId(mProvider.insert(BrowserContract.History.CONTENT_URI, basicHistory));
 
             // Create a basic bookmark entry
             ContentValues basicBookmark = createBookmark(TITLE_2, URL_2, mMobileFolderId,
-                mBookmarksTypeBookmark, 0, "tags", "description", "keyword");
-            long basicBookmarkId = ContentUris.parseId(mProvider.insert(mBookmarksUri, basicBookmark));
+                BrowserContract.Bookmarks.TYPE_BOOKMARK, 0, "tags", "description", "keyword");
+            long basicBookmarkId = ContentUris.parseId(mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, basicBookmark));
 
             // Create a history entry and bookmark entry with the same URL to
             // represent a visited bookmark
             ContentValues combinedHistory = createHistoryEntry(TITLE_3_HISTORY, URL_3, VISITS, LAST_VISITED);
-            long combinedHistoryId = ContentUris.parseId(mProvider.insert(mHistoryUri, combinedHistory));
+            long combinedHistoryId = ContentUris.parseId(mProvider.insert(BrowserContract.History.CONTENT_URI, combinedHistory));
 
 
             ContentValues combinedBookmark = createBookmark(TITLE_3_BOOKMARK, URL_3, mMobileFolderId,
-                mBookmarksTypeBookmark, 0, "tags", "description", "keyword");
-            long combinedBookmarkId = ContentUris.parseId(mProvider.insert(mBookmarksUri, combinedBookmark));
+                BrowserContract.Bookmarks.TYPE_BOOKMARK, 0, "tags", "description", "keyword");
+            long combinedBookmarkId = ContentUris.parseId(mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, combinedBookmark));
 
             ContentValues combinedBookmark2 = createBookmark(TITLE_3_BOOKMARK2, URL_3, mMobileFolderId,
-                mBookmarksTypeBookmark, 0, "tags", "description", "keyword");
-            long combinedBookmarkId2 = ContentUris.parseId(mProvider.insert(mBookmarksUri, combinedBookmark2));
+                BrowserContract.Bookmarks.TYPE_BOOKMARK, 0, "tags", "description", "keyword");
+            long combinedBookmarkId2 = ContentUris.parseId(mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, combinedBookmark2));
 
             // Create a bookmark folder to make sure it _doesn't_ show up in the results
             ContentValues folderBookmark = createBookmark("", "", mMobileFolderId,
-                mBookmarksTypeFolder, 0, "tags", "description", "keyword");
-            mProvider.insert(mBookmarksUri, folderBookmark);
+                BrowserContract.Bookmarks.TYPE_FOLDER, 0, "tags", "description", "keyword");
+            mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, folderBookmark);
 
             // Sort entries by url so we can check them individually
-            Cursor c = mProvider.query(mCombinedUri, null, "", null, mCombinedUrlCol);
+            Cursor c = mProvider.query(BrowserContract.Combined.CONTENT_URI, null, "", null, BrowserContract.Combined.URL);
 
             mAsserter.is(c.getCount(), 3, "3 combined entries found");
 
             // First combined entry is basic history entry
             mAsserter.is(c.moveToFirst(), true, "Found basic history entry");
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mCombinedIdCol))), new Long(0),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.Combined._ID))), new Long(0),
                          "Combined _id column should always be 0");
             // TODO: Should we change BrowserProvider to make this return -1, not 0?
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mCombinedBookmarkIdCol))), new Long(0),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.Combined.BOOKMARK_ID))), new Long(0),
                          "Bookmark id should be 0 for basic history entry");
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mCombinedHistoryIdCol))), new Long(basicHistoryId),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.Combined.HISTORY_ID))), new Long(basicHistoryId),
                          "Basic history entry has correct history id");
-            mAsserter.is(c.getString(c.getColumnIndex(mCombinedTitleCol)), TITLE_1,
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Combined.TITLE)), TITLE_1,
                          "Basic history entry has correct title");
-            mAsserter.is(c.getString(c.getColumnIndex(mCombinedUrlCol)), URL_1,
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Combined.URL)), URL_1,
                          "Basic history entry has correct url");
-            mAsserter.is(c.getInt(c.getColumnIndex(mCombinedVisitsCol)), VISITS,
+            mAsserter.is(c.getInt(c.getColumnIndex(BrowserContract.Combined.VISITS)), VISITS,
                          "Basic history entry has correct number of visits");
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mCombinedLastVisitedCol))), new Long(LAST_VISITED),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.Combined.DATE_LAST_VISITED))), new Long(LAST_VISITED),
                          "Basic history entry has correct last visit time");
 
             // Second combined entry is basic bookmark entry
             mAsserter.is(c.moveToNext(), true, "Found basic bookmark entry");
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mCombinedIdCol))), new Long(0),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.Combined._ID))), new Long(0),
                          "Combined _id column should always be 0");
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mCombinedBookmarkIdCol))), new Long(basicBookmarkId),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.Combined.BOOKMARK_ID))), new Long(basicBookmarkId),
                          "Basic bookmark entry has correct bookmark id");
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mCombinedHistoryIdCol))), new Long(-1),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.Combined.HISTORY_ID))), new Long(-1),
                          "History id should be -1 for basic bookmark entry");
-            mAsserter.is(c.getString(c.getColumnIndex(mCombinedTitleCol)), TITLE_2,
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Combined.TITLE)), TITLE_2,
                          "Basic bookmark entry has correct title");
-            mAsserter.is(c.getString(c.getColumnIndex(mCombinedUrlCol)), URL_2,
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Combined.URL)), URL_2,
                          "Basic bookmark entry has correct url");
-            mAsserter.is(c.getInt(c.getColumnIndex(mCombinedVisitsCol)), -1,
+            mAsserter.is(c.getInt(c.getColumnIndex(BrowserContract.Combined.VISITS)), -1,
                          "Visits should be -1 for basic bookmark entry");
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mCombinedLastVisitedCol))), new Long(-1),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.Combined.DATE_LAST_VISITED))), new Long(-1),
                          "Basic entry has correct last visit time");
 
             // Third combined entry is a combined history/bookmark entry
             mAsserter.is(c.moveToNext(), true, "Found third combined entry");
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mCombinedIdCol))), new Long(0),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.Combined._ID))), new Long(0),
                          "Combined _id column should always be 0");
             // The bookmark data (bookmark_id and title) associated with the combined entry is non-deterministic,
             // it might end up with data coming from any of the matching bookmark entries.
-            mAsserter.is(c.getLong(c.getColumnIndex(mCombinedBookmarkIdCol)) == combinedBookmarkId ||
-                         c.getLong(c.getColumnIndex(mCombinedBookmarkIdCol)) == combinedBookmarkId2, true,
+            mAsserter.is(c.getLong(c.getColumnIndex(BrowserContract.Combined.BOOKMARK_ID)) == combinedBookmarkId ||
+                         c.getLong(c.getColumnIndex(BrowserContract.Combined.BOOKMARK_ID)) == combinedBookmarkId2, true,
                          "Combined entry has correct bookmark id");
-            mAsserter.is(c.getString(c.getColumnIndex(mCombinedTitleCol)).equals(TITLE_3_BOOKMARK) ||
-                         c.getString(c.getColumnIndex(mCombinedTitleCol)).equals(TITLE_3_BOOKMARK2), true,
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Combined.TITLE)).equals(TITLE_3_BOOKMARK) ||
+                         c.getString(c.getColumnIndex(BrowserContract.Combined.TITLE)).equals(TITLE_3_BOOKMARK2), true,
                          "Combined entry has title corresponding to bookmark entry");
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mCombinedHistoryIdCol))), new Long(combinedHistoryId),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.Combined.HISTORY_ID))), new Long(combinedHistoryId),
                          "Combined entry has correct history id");
-            mAsserter.is(c.getString(c.getColumnIndex(mCombinedUrlCol)), URL_3,
+            mAsserter.is(c.getString(c.getColumnIndex(BrowserContract.Combined.URL)), URL_3,
                          "Combined entry has correct url");
-            mAsserter.is(c.getInt(c.getColumnIndex(mCombinedVisitsCol)), VISITS,
+            mAsserter.is(c.getInt(c.getColumnIndex(BrowserContract.Combined.VISITS)), VISITS,
                          "Combined entry has correct number of visits");
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mCombinedLastVisitedCol))), new Long(LAST_VISITED),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.Combined.DATE_LAST_VISITED))), new Long(LAST_VISITED),
                          "Combined entry has correct last visit time");
         }
     }
@@ -1579,40 +1457,40 @@ public class testBrowserProvider extends ContentProviderTest {
 
             // Create a basic history entry
             ContentValues basicHistory = createHistoryEntry(TITLE_1, URL_1, VISITS, LAST_VISITED);
-            ContentUris.parseId(mProvider.insert(mHistoryUri, basicHistory));
+            ContentUris.parseId(mProvider.insert(BrowserContract.History.CONTENT_URI, basicHistory));
 
             // Create a basic bookmark entry
             ContentValues basicBookmark = createBookmark(TITLE_2, URL_2, mMobileFolderId,
-                mBookmarksTypeBookmark, 0, "tags", "description", "keyword");
-            mProvider.insert(mBookmarksUri, basicBookmark);
+                BrowserContract.Bookmarks.TYPE_BOOKMARK, 0, "tags", "description", "keyword");
+            mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, basicBookmark);
 
             // Create a history entry and bookmark entry with the same URL to
             // represent a visited bookmark
             ContentValues combinedHistory = createHistoryEntry(TITLE_3_HISTORY, URL_3, VISITS, LAST_VISITED);
-            mProvider.insert(mHistoryUri, combinedHistory);
+            mProvider.insert(BrowserContract.History.CONTENT_URI, combinedHistory);
 
             ContentValues combinedBookmark = createBookmark(TITLE_3_BOOKMARK, URL_3, mMobileFolderId,
-                mBookmarksTypeBookmark, 0, "tags", "description", "keyword");
-            mProvider.insert(mBookmarksUri, combinedBookmark);
+                BrowserContract.Bookmarks.TYPE_BOOKMARK, 0, "tags", "description", "keyword");
+            mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, combinedBookmark);
 
             // Create a reading list entries
-            int readingListId = getIntColumn("Bookmarks", "FIXED_READING_LIST_ID");
+            int readingListId = BrowserContract.Bookmarks.FIXED_READING_LIST_ID;
             ContentValues readingListItem = createBookmark(TITLE_3_BOOKMARK, URL_3, readingListId,
-                mBookmarksTypeBookmark, 0, "tags", "description", "keyword");
-            long readingListItemId = ContentUris.parseId(mProvider.insert(mBookmarksUri, readingListItem));
+                BrowserContract.Bookmarks.TYPE_BOOKMARK, 0, "tags", "description", "keyword");
+            long readingListItemId = ContentUris.parseId(mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, readingListItem));
 
             ContentValues readingListItem2 = createBookmark(TITLE_4, URL_4, readingListId,
-                mBookmarksTypeBookmark, 0, "tags", "description", "keyword");
-            long readingListItemId2 = ContentUris.parseId(mProvider.insert(mBookmarksUri, readingListItem2));
+                BrowserContract.Bookmarks.TYPE_BOOKMARK, 0, "tags", "description", "keyword");
+            long readingListItemId2 = ContentUris.parseId(mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, readingListItem2));
 
-            Cursor c = mProvider.query(mCombinedUri, null, "", null, null);
+            Cursor c = mProvider.query(BrowserContract.Combined.CONTENT_URI, null, "", null, null);
             mAsserter.is(c.getCount(), 4, "4 combined entries found");
 
             while (c.moveToNext()) {
-                long id = c.getLong(c.getColumnIndex(mCombinedBookmarkIdCol));
+                long id = c.getLong(c.getColumnIndex(BrowserContract.Combined.BOOKMARK_ID));
 
-                int display = c.getInt(c.getColumnIndex(mCombinedDisplayCol));
-                int expectedDisplay = (id == readingListItemId || id == readingListItemId2 ? mCombinedDisplayReader : mCombinedDisplayNormal);
+                int display = c.getInt(c.getColumnIndex(BrowserContract.Combined.DISPLAY));
+                int expectedDisplay = (id == readingListItemId || id == readingListItemId2 ? BrowserContract.Combined.DISPLAY_READER : BrowserContract.Combined.DISPLAY_NORMAL);
 
                 mAsserter.is(new Integer(display), new Integer(expectedDisplay),
                                  "Combined display column should always be DISPLAY_READER for the reading list item");
@@ -1630,31 +1508,31 @@ public class testBrowserProvider extends ContentProviderTest {
 
             // Create a combined history entry
             ContentValues combinedHistory = createHistoryEntry(TITLE, URL, VISITS, LAST_VISITED);
-            mProvider.insert(mHistoryUri, combinedHistory);
+            mProvider.insert(BrowserContract.History.CONTENT_URI, combinedHistory);
 
             // Create a combined bookmark entry
             ContentValues combinedBookmark = createBookmark(TITLE, URL, mMobileFolderId,
-                mBookmarksTypeBookmark, 0, "tags", "description", "keyword");
-            long combinedBookmarkId = ContentUris.parseId(mProvider.insert(mBookmarksUri, combinedBookmark));
+                BrowserContract.Bookmarks.TYPE_BOOKMARK, 0, "tags", "description", "keyword");
+            long combinedBookmarkId = ContentUris.parseId(mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, combinedBookmark));
 
-            Cursor c = mProvider.query(mCombinedUri, null, "", null, null);
+            Cursor c = mProvider.query(BrowserContract.Combined.CONTENT_URI, null, "", null, null);
             mAsserter.is(c.getCount(), 1, "1 combined entry found");
 
             mAsserter.is(c.moveToFirst(), true, "Found combined entry with bookmark id");
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mCombinedBookmarkIdCol))), new Long(combinedBookmarkId),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.Combined.BOOKMARK_ID))), new Long(combinedBookmarkId),
                          "Bookmark id should be set correctly on combined entry");
 
-            int deleted = mProvider.delete(mBookmarksUri,
-                                           mBookmarksIdCol + " = ?",
+            int deleted = mProvider.delete(BrowserContract.Bookmarks.CONTENT_URI,
+                                           BrowserContract.Bookmarks._ID + " = ?",
                                            new String[] { String.valueOf(combinedBookmarkId) });
 
             mAsserter.is((deleted == 1), true, "Inserted combined bookmark was deleted");
 
-            c = mProvider.query(mCombinedUri, null, "", null, null);
+            c = mProvider.query(BrowserContract.Combined.CONTENT_URI, null, "", null, null);
             mAsserter.is(c.getCount(), 1, "1 combined entry found");
 
             mAsserter.is(c.moveToFirst(), true, "Found combined entry without bookmark id");
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mCombinedBookmarkIdCol))), new Long(0),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.Combined.BOOKMARK_ID))), new Long(0),
                          "Bookmark id should not be set to removed bookmark id");
         }
     }
@@ -1669,36 +1547,36 @@ public class testBrowserProvider extends ContentProviderTest {
 
             // Create a combined history entry
             ContentValues combinedHistory = createHistoryEntry(TITLE, URL, VISITS, LAST_VISITED);
-            mProvider.insert(mHistoryUri, combinedHistory);
+            mProvider.insert(BrowserContract.History.CONTENT_URI, combinedHistory);
 
             // Create a combined bookmark entry
-            int readingListId = getIntColumn("Bookmarks", "FIXED_READING_LIST_ID");
+            int readingListId = BrowserContract.Bookmarks.FIXED_READING_LIST_ID;
             ContentValues combinedReadingListItem = createBookmark(TITLE, URL, readingListId,
-                mBookmarksTypeBookmark, 0, "tags", "description", "keyword");
-            long combinedReadingListItemId = ContentUris.parseId(mProvider.insert(mBookmarksUri, combinedReadingListItem));
+                BrowserContract.Bookmarks.TYPE_BOOKMARK, 0, "tags", "description", "keyword");
+            long combinedReadingListItemId = ContentUris.parseId(mProvider.insert(BrowserContract.Bookmarks.CONTENT_URI, combinedReadingListItem));
 
-            Cursor c = mProvider.query(mCombinedUri, null, "", null, null);
+            Cursor c = mProvider.query(BrowserContract.Combined.CONTENT_URI, null, "", null, null);
             mAsserter.is(c.getCount(), 1, "1 combined entry found");
 
             mAsserter.is(c.moveToFirst(), true, "Found combined entry with bookmark id");
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mCombinedBookmarkIdCol))), new Long(combinedReadingListItemId),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.Combined.BOOKMARK_ID))), new Long(combinedReadingListItemId),
                          "Bookmark id should be set correctly on combined entry");
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mCombinedDisplayCol))), new Long(mCombinedDisplayReader),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.Combined.DISPLAY))), new Long(BrowserContract.Combined.DISPLAY_READER),
                          "Combined entry should have reader display type");
 
-            int deleted = mProvider.delete(mBookmarksUri,
-                                           mBookmarksIdCol + " = ?",
+            int deleted = mProvider.delete(BrowserContract.Bookmarks.CONTENT_URI,
+                                           BrowserContract.Bookmarks._ID + " = ?",
                                            new String[] { String.valueOf(combinedReadingListItemId) });
 
             mAsserter.is((deleted == 1), true, "Inserted combined reading list item was deleted");
 
-            c = mProvider.query(mCombinedUri, null, "", null, null);
+            c = mProvider.query(BrowserContract.Combined.CONTENT_URI, null, "", null, null);
             mAsserter.is(c.getCount(), 1, "1 combined entry found");
 
             mAsserter.is(c.moveToFirst(), true, "Found combined entry without bookmark id");
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mCombinedBookmarkIdCol))), new Long(0),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.Combined.BOOKMARK_ID))), new Long(0),
                          "Bookmark id should not be set to removed bookmark id");
-            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mCombinedDisplayCol))), new Long(mCombinedDisplayNormal),
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(BrowserContract.Combined.DISPLAY))), new Long(BrowserContract.Combined.DISPLAY_NORMAL),
                          "Combined entry should have reader display type");
         }
     }
@@ -1710,40 +1588,40 @@ public class testBrowserProvider extends ContentProviderTest {
             long time = System.currentTimeMillis() - timeShift;
             for (int i = 0; i < count; i++) {
                 allVals[i] = new ContentValues();
-                allVals[i].put(mHistoryTitleCol, "Test " + i);
-                allVals[i].put(mHistoryUrlCol, "http://www.test.org/" + i);
-                allVals[i].put(mHistoryVisitsCol, i);
-                allVals[i].put(mHistoryLastVisitedCol, time);
+                allVals[i].put(BrowserContract.History.TITLE, "Test " + i);
+                allVals[i].put(BrowserContract.History.URL, "http://www.test.org/" + i);
+                allVals[i].put(BrowserContract.History.VISITS, i);
+                allVals[i].put(BrowserContract.History.DATE_LAST_VISITED, time);
             }
 
-            int inserts = mProvider.bulkInsert(mHistoryUri, allVals);
+            int inserts = mProvider.bulkInsert(BrowserContract.History.CONTENT_URI, allVals);
             mAsserter.is(inserts, count, "Expected number of inserts matches");
 
             // inserting a new entry sets the date created and modified automatically
             // reset all of them
             for (int i = 0; i < count; i++) {
                 ContentValues cv = new ContentValues();
-                cv.put(mHistoryDateCreatedCol, time);
-                cv.put(mHistoryDateModifiedCol, time);
-                mProvider.update(mHistoryUri, cv, mHistoryUrlCol + " = ?",
+                cv.put(BrowserContract.History.DATE_CREATED, time);
+                cv.put(BrowserContract.History.DATE_MODIFIED, time);
+                mProvider.update(BrowserContract.History.CONTENT_URI, cv, BrowserContract.History.URL + " = ?",
                                  new String[] { "http://www.test.org/" + i });
             }
 
-            Cursor c = mProvider.query(mHistoryUri, null, "", null, null);
+            Cursor c = mProvider.query(BrowserContract.History.CONTENT_URI, null, "", null, null);
             mAsserter.is(c.getCount(), count, count + " history entries found");
 
             // add thumbnails for each entry
             allVals = new ContentValues[count];
             for (int i = 0; i < count; i++) {
                 allVals[i] = new ContentValues();
-                allVals[i].put(mThumbnailsDataCol, i);
-                allVals[i].put(mThumbnailsUrlCol, "http://www.test.org/" + i);
+                allVals[i].put(BrowserContract.Thumbnails.DATA, i);
+                allVals[i].put(BrowserContract.Thumbnails.URL, "http://www.test.org/" + i);
             }
 
-            inserts = mProvider.bulkInsert(mThumbnailsUri, allVals);
+            inserts = mProvider.bulkInsert(BrowserContract.Thumbnails.CONTENT_URI, allVals);
             mAsserter.is(inserts, count, "Expected number of inserts matches");
 
-            c = mProvider.query(mThumbnailsUri, null, null, null, null);
+            c = mProvider.query(BrowserContract.Thumbnails.CONTENT_URI, null, null, null, null);
             mAsserter.is(c.getCount(), count, count + " thumbnails entries found");
         }
 
@@ -1756,13 +1634,13 @@ public class testBrowserProvider extends ContentProviderTest {
             createFakeHistory(0, count);
 
             // expiring with a normal priority should not delete new entries
-            Uri url = appendUriParam(mHistoryOldUri, "PARAM_EXPIRE_PRIORITY", "NORMAL");
+            Uri url = appendUriParam(BrowserContract.History.CONTENT_OLD_URI, BrowserContract.PARAM_EXPIRE_PRIORITY, "NORMAL");
             mProvider.delete(url, null, null);
-            Cursor c = mProvider.query(mHistoryUri, null, "", null, null);
+            Cursor c = mProvider.query(BrowserContract.History.CONTENT_URI, null, "", null, null);
             mAsserter.is(c.getCount(), count, count + " history entries found");
 
             // expiring with a normal priority should delete all but 10 thumbnails
-            c = mProvider.query(mThumbnailsUri, null, null, null, null);
+            c = mProvider.query(BrowserContract.Thumbnails.CONTENT_URI, null, null, null, null);
             mAsserter.is(c.getCount(), thumbCount, thumbCount + " thumbnails found");
 
             ensureEmptyDatabase();
@@ -1770,13 +1648,13 @@ public class testBrowserProvider extends ContentProviderTest {
             createFakeHistory(0, count);
 
             // expiring with a aggressive priority should leave 500 entries
-            url = appendUriParam(mHistoryOldUri, "PARAM_EXPIRE_PRIORITY", "AGGRESSIVE");
+            url = appendUriParam(BrowserContract.History.CONTENT_OLD_URI, BrowserContract.PARAM_EXPIRE_PRIORITY, "AGGRESSIVE");
             mProvider.delete(url, null, null);
-            c = mProvider.query(mHistoryUri, null, "", null, null);
+            c = mProvider.query(BrowserContract.History.CONTENT_URI, null, "", null, null);
             mAsserter.is(c.getCount(), 500, "500 history entries found");
 
             // expiring with a aggressive priority should delete all but 10 thumbnails
-            c = mProvider.query(mThumbnailsUri, null, null, null, null);
+            c = mProvider.query(BrowserContract.Thumbnails.CONTENT_URI, null, null, null, null);
             mAsserter.is(c.getCount(), thumbCount, thumbCount + " thumbnails found");
 
             ensureEmptyDatabase();
@@ -1786,13 +1664,13 @@ public class testBrowserProvider extends ContentProviderTest {
 
             // expiring with an normal priority should remove at most 1000 entries
             // entries leaving at least 2000
-            url = appendUriParam(mHistoryOldUri, "PARAM_EXPIRE_PRIORITY", "NORMAL");
+            url = appendUriParam(BrowserContract.History.CONTENT_OLD_URI, BrowserContract.PARAM_EXPIRE_PRIORITY, "NORMAL");
             mProvider.delete(url, null, null);
-            c = mProvider.query(mHistoryUri, null, "", null, null);
+            c = mProvider.query(BrowserContract.History.CONTENT_URI, null, "", null, null);
             mAsserter.is(c.getCount(), 2000, "2000 history entries found");
 
             // expiring with a normal priority should delete all but 10 thumbnails
-            c = mProvider.query(mThumbnailsUri, null, null, null, null);
+            c = mProvider.query(BrowserContract.Thumbnails.CONTENT_URI, null, null, null, null);
             mAsserter.is(c.getCount(), thumbCount, thumbCount + " thumbnails found");
 
             ensureEmptyDatabase();
@@ -1802,13 +1680,13 @@ public class testBrowserProvider extends ContentProviderTest {
 
             // expiring with an agressive priority should remove old
             // entries leaving at least 500
-            url = appendUriParam(mHistoryOldUri, "PARAM_EXPIRE_PRIORITY", "AGGRESSIVE");
+            url = appendUriParam(BrowserContract.History.CONTENT_OLD_URI, BrowserContract.PARAM_EXPIRE_PRIORITY, "AGGRESSIVE");
             mProvider.delete(url, null, null);
-            c = mProvider.query(mHistoryUri, null, "", null, null);
+            c = mProvider.query(BrowserContract.History.CONTENT_URI, null, "", null, null);
             mAsserter.is(c.getCount(), 500, "500 history entries found");
 
             // expiring with an aggressive priority should delete all but 10 thumbnails
-            c = mProvider.query(mThumbnailsUri, null, null, null, null);
+            c = mProvider.query(BrowserContract.Thumbnails.CONTENT_URI, null, null, null, null);
             mAsserter.is(c.getCount(), thumbCount, thumbCount + " thumbnails found");
         }
     }
@@ -1853,49 +1731,49 @@ public class testBrowserProvider extends ContentProviderTest {
             final ContentValues h = createOneHistoryEntry();
 
             mResolver.notifyChangeList.clear();
-            long id = ContentUris.parseId(mProvider.insert(mHistoryUri, h));
+            long id = ContentUris.parseId(mProvider.insert(BrowserContract.History.CONTENT_URI, h));
 
             mAsserter.isnot(Long.valueOf(id),
                             Long.valueOf(-1),
                             "Inserted item has valid id");
 
-            ensureOnlyChangeNotifiedStartsWith(mHistoryUri, "insert");
+            ensureOnlyChangeNotifiedStartsWith(BrowserContract.History.CONTENT_URI, "insert");
 
             // Update
             mResolver.notifyChangeList.clear();
-            h.put(mHistoryTitleCol, "http://newexample.com");
+            h.put(BrowserContract.History.TITLE, "http://newexample.com");
 
-            long numUpdated = mProvider.update(mHistoryUri, h,
-                                               mHistoryIdCol + " = ?",
+            long numUpdated = mProvider.update(BrowserContract.History.CONTENT_URI, h,
+                                               BrowserContract.History._ID + " = ?",
                                                new String[] { String.valueOf(id) });
 
             mAsserter.is(Long.valueOf(numUpdated),
                          Long.valueOf(1),
                          "Correct number of items are updated");
 
-            ensureOnlyChangeNotifiedStartsWith(mHistoryUri, "update");
+            ensureOnlyChangeNotifiedStartsWith(BrowserContract.History.CONTENT_URI, "update");
 
             // Delete
             mResolver.notifyChangeList.clear();
-            long numDeleted = mProvider.delete(mHistoryUri, null, null);
+            long numDeleted = mProvider.delete(BrowserContract.History.CONTENT_URI, null, null);
 
             mAsserter.is(Long.valueOf(numDeleted),
                          Long.valueOf(1),
                          "Correct number of items are deleted");
 
-            ensureOnlyChangeNotifiedStartsWith(mHistoryUri, "delete");
+            ensureOnlyChangeNotifiedStartsWith(BrowserContract.History.CONTENT_URI, "delete");
 
             // Bulk insert
             final ContentValues[] hs = new ContentValues[] { createOneHistoryEntry() };
 
             mResolver.notifyChangeList.clear();
-            long numBulkInserted = mProvider.bulkInsert(mHistoryUri, hs);
+            long numBulkInserted = mProvider.bulkInsert(BrowserContract.History.CONTENT_URI, hs);
 
             mAsserter.is(Long.valueOf(numBulkInserted),
                          Long.valueOf(1),
                          "Correct number of items are bulkInserted");
 
-            ensureOnlyChangeNotifiedStartsWith(mHistoryUri, "bulkInsert");
+            ensureOnlyChangeNotifiedStartsWith(BrowserContract.History.CONTENT_URI, "bulkInsert");
         }
     }
 }
diff --git a/mobile/android/base/tests/testBrowserProviderPerf.java b/mobile/android/base/tests/testBrowserProviderPerf.java
index 0fb6d9d6a854..660805b2a69a 100644
--- a/mobile/android/base/tests/testBrowserProviderPerf.java
+++ b/mobile/android/base/tests/testBrowserProviderPerf.java
@@ -1,15 +1,16 @@
 package org.mozilla.gecko.tests;
 
-import android.content.ContentResolver;
 import android.content.ContentValues;
 import android.database.Cursor;
-import android.net.Uri;
 import android.os.SystemClock;
+
 import java.util.UUID;
 import java.util.Random;
 
 import org.mozilla.gecko.GeckoProfile;
+import org.mozilla.gecko.db.BrowserContract;
 import org.mozilla.gecko.db.BrowserDB;
+import org.mozilla.gecko.db.BrowserProvider;
 
 /*
  * This test is meant to exercise the performance of Fennec's
@@ -32,70 +33,18 @@ public class testBrowserProviderPerf extends ContentProviderTest {
     private final String MOBILE_FOLDER_GUID = "mobile";
     private long mMobileFolderId;
 
-    private Uri mBookmarksUri;
-    private Uri mHistoryUri;
-    private Uri mFaviconsUri;
-
-    private String mBookmarksIdCol;
-    private String mBookmarksTitleCol;
-    private String mBookmarksUrlCol;
-    private String mBookmarksParentCol;
-    private String mBookmarksTypeCol;
-    private String mBookmarksPositionCol;
-    private String mBookmarksTagsCol;
-    private String mBookmarksDescriptionCol;
-    private String mBookmarksKeywordCol;
-    private String mBookmarksGuidCol;
-    private int mBookmarksTypeBookmark;
-
-    private String mHistoryTitleCol;
-    private String mHistoryUrlCol;
-    private String mHistoryVisitsCol;
-    private String mHistoryLastVisitedCol;
-
-    private String mFaviconsUrlCol;
-    private String mFaviconsPageUrlCol;
-    private String mFaviconsDataCol;
-
     @Override
     protected int getTestType() {
         return TEST_TALOS;
     }
 
-    private void loadContractInfo() throws Exception {
-        mBookmarksUri = getContentUri("Bookmarks");
-        mHistoryUri = getContentUri("History");
-        mFaviconsUri = getContentUri("Favicons");
-
-        mBookmarksIdCol = getStringColumn("Bookmarks", "_ID");
-        mBookmarksTitleCol = getStringColumn("Bookmarks", "TITLE");
-        mBookmarksUrlCol = getStringColumn("Bookmarks", "URL");
-        mBookmarksParentCol = getStringColumn("Bookmarks", "PARENT");
-        mBookmarksTypeCol = getStringColumn("Bookmarks", "TYPE");
-        mBookmarksPositionCol = getStringColumn("Bookmarks", "POSITION");
-        mBookmarksTagsCol = getStringColumn("Bookmarks", "TAGS");
-        mBookmarksDescriptionCol = getStringColumn("Bookmarks", "DESCRIPTION");
-        mBookmarksKeywordCol= getStringColumn("Bookmarks", "KEYWORD");
-        mBookmarksGuidCol= getStringColumn("Bookmarks", "GUID");
-        mBookmarksTypeBookmark = getIntColumn("Bookmarks", "TYPE_BOOKMARK");
-
-        mHistoryTitleCol = getStringColumn("History", "TITLE");
-        mHistoryUrlCol = getStringColumn("History", "URL");
-        mHistoryVisitsCol = getStringColumn("History", "VISITS");
-        mHistoryLastVisitedCol = getStringColumn("History", "DATE_LAST_VISITED");
-
-        mFaviconsUrlCol = getStringColumn("Favicons", "URL");
-        mFaviconsPageUrlCol = getStringColumn("Favicons", "PAGE_URL");
-        mFaviconsDataCol = getStringColumn("Favicons", "DATA");
-    }
-
     private void loadMobileFolderId() throws Exception {
-        Cursor c = mProvider.query(mBookmarksUri, null,
-                                   mBookmarksGuidCol + " = ?",
+        Cursor c = mProvider.query(BrowserContract.Bookmarks.CONTENT_URI, null,
+                                   BrowserContract.Bookmarks.GUID + " = ?",
                                    new String[] { MOBILE_FOLDER_GUID },
                                    null);
         c.moveToFirst();
-        mMobileFolderId = c.getLong(c.getColumnIndex(mBookmarksIdCol));
+        mMobileFolderId = c.getLong(c.getColumnIndex(BrowserContract.Bookmarks._ID));
 
         c.close();
     }
@@ -104,21 +53,21 @@ public class testBrowserProviderPerf extends ContentProviderTest {
             int type, int position, String tags, String description, String keyword) throws Exception {
         ContentValues bookmark = new ContentValues();
 
-        bookmark.put(mBookmarksTitleCol, title);
-        bookmark.put(mBookmarksUrlCol, url);
-        bookmark.put(mBookmarksParentCol, parentId);
-        bookmark.put(mBookmarksTypeCol, type);
-        bookmark.put(mBookmarksPositionCol, position);
-        bookmark.put(mBookmarksTagsCol, tags);
-        bookmark.put(mBookmarksDescriptionCol, description);
-        bookmark.put(mBookmarksKeywordCol, keyword);
+        bookmark.put(BrowserContract.Bookmarks.TITLE, title);
+        bookmark.put(BrowserContract.Bookmarks.URL, url);
+        bookmark.put(BrowserContract.Bookmarks.PARENT, parentId);
+        bookmark.put(BrowserContract.Bookmarks.TYPE, type);
+        bookmark.put(BrowserContract.Bookmarks.POSITION, position);
+        bookmark.put(BrowserContract.Bookmarks.TAGS, tags);
+        bookmark.put(BrowserContract.Bookmarks.DESCRIPTION, description);
+        bookmark.put(BrowserContract.Bookmarks.KEYWORD, keyword);
 
         return bookmark;
     }
 
     private ContentValues createBookmarkEntryWithUrl(String url) throws Exception {
         return createBookmarkEntry(url, url, mMobileFolderId,
-            mBookmarksTypeBookmark, 0, "tags", "description", "keyword");
+            BrowserContract.Bookmarks.TYPE_BOOKMARK, 0, "tags", "description", "keyword");
     }
 
     private ContentValues createRandomBookmarkEntry() throws Exception {
@@ -134,10 +83,10 @@ public class testBrowserProviderPerf extends ContentProviderTest {
             long lastVisited) throws Exception {
         ContentValues historyEntry = new ContentValues();
 
-        historyEntry.put(mHistoryTitleCol, title);
-        historyEntry.put(mHistoryUrlCol, url);
-        historyEntry.put(mHistoryVisitsCol, visits);
-        historyEntry.put(mHistoryLastVisitedCol, lastVisited);
+        historyEntry.put(BrowserContract.History.TITLE, title);
+        historyEntry.put(BrowserContract.History.URL, url);
+        historyEntry.put(BrowserContract.History.VISITS, visits);
+        historyEntry.put(BrowserContract.History.DATE_LAST_VISITED, lastVisited);
 
         return historyEntry;
     }
@@ -160,9 +109,9 @@ public class testBrowserProviderPerf extends ContentProviderTest {
     private ContentValues createFaviconEntryWithUrl(String url) throws Exception {
         ContentValues faviconEntry = new ContentValues();
 
-        faviconEntry.put(mFaviconsUrlCol, url + "/favicon.ico");
-        faviconEntry.put(mFaviconsPageUrlCol, url);
-        faviconEntry.put(mFaviconsDataCol, url.getBytes("UTF8"));
+        faviconEntry.put(BrowserContract.Favicons.URL, url + "/favicon.ico");
+        faviconEntry.put(BrowserContract.Favicons.PAGE_URL, url);
+        faviconEntry.put(BrowserContract.Favicons.DATA, url.getBytes("UTF8"));
 
         return faviconEntry;
     }
@@ -182,7 +131,7 @@ public class testBrowserProviderPerf extends ContentProviderTest {
                 bookmarkEntries[j] = createRandomBookmarkEntry();
             }
 
-            mProvider.bulkInsert(mBookmarksUri, bookmarkEntries);
+            mProvider.bulkInsert(BrowserContract.Bookmarks.CONTENT_URI, bookmarkEntries);
         }
 
         // Create some random history entries
@@ -195,11 +144,11 @@ public class testBrowserProviderPerf extends ContentProviderTest {
 
             for (int j = 0; j < BATCH_SIZE; j++) {
                 historyEntries[j] = createRandomHistoryEntry();
-                faviconEntries[j] = createFaviconEntryWithUrl(historyEntries[j].getAsString(mHistoryUrlCol));
+                faviconEntries[j] = createFaviconEntryWithUrl(historyEntries[j].getAsString(BrowserContract.History.URL));
             }
 
-            mProvider.bulkInsert(mHistoryUri, historyEntries);
-            mProvider.bulkInsert(mFaviconsUri, faviconEntries);
+            mProvider.bulkInsert(BrowserContract.History.CONTENT_URI, historyEntries);
+            mProvider.bulkInsert(BrowserContract.Favicons.CONTENT_URI, faviconEntries);
         }
 
 
@@ -215,9 +164,9 @@ public class testBrowserProviderPerf extends ContentProviderTest {
                 faviconEntries[j] = createFaviconEntryWithUrl(url);
             }
 
-            mProvider.bulkInsert(mBookmarksUri, bookmarkEntries);
-            mProvider.bulkInsert(mHistoryUri, historyEntries);
-            mProvider.bulkInsert(mFaviconsUri, faviconEntries);
+            mProvider.bulkInsert(BrowserContract.Bookmarks.CONTENT_URI, bookmarkEntries);
+            mProvider.bulkInsert(BrowserContract.History.CONTENT_URI, historyEntries);
+            mProvider.bulkInsert(BrowserContract.Favicons.CONTENT_URI, faviconEntries);
         }
 
         // Create some history entries with a known prefix
@@ -225,20 +174,18 @@ public class testBrowserProviderPerf extends ContentProviderTest {
         faviconEntries = new ContentValues[NUMBER_OF_KNOWN_URLS];
         for (int i = 0; i < NUMBER_OF_KNOWN_URLS; i++) {
             historyEntries[i] = createRandomHistoryEntry(KNOWN_PREFIX);
-            faviconEntries[i] = createFaviconEntryWithUrl(historyEntries[i].getAsString(mHistoryUrlCol));
+            faviconEntries[i] = createFaviconEntryWithUrl(historyEntries[i].getAsString(BrowserContract.History.URL));
         }
 
-        mProvider.bulkInsert(mHistoryUri, historyEntries);
-        mProvider.bulkInsert(mFaviconsUri, faviconEntries);
+        mProvider.bulkInsert(BrowserContract.History.CONTENT_URI, historyEntries);
+        mProvider.bulkInsert(BrowserContract.Favicons.CONTENT_URI, faviconEntries);
     }
 
     @Override
     public void setUp() throws Exception {
-        super.setUp("org.mozilla.gecko.db.BrowserProvider", "AUTHORITY", "browser.db");
+        super.setUp(sBrowserProviderCallable, BrowserContract.AUTHORITY, "browser.db");
 
         mGenerator = new Random(19580427);
-
-        loadContractInfo();
     }
 
     public void testBrowserProviderPerf() throws Exception {
diff --git a/mobile/android/base/tests/testClearPrivateData.java b/mobile/android/base/tests/testClearPrivateData.java
index 6111c8b62f9f..c91eaaab6fe8 100644
--- a/mobile/android/base/tests/testClearPrivateData.java
+++ b/mobile/android/base/tests/testClearPrivateData.java
@@ -109,7 +109,7 @@ public class testClearPrivateData extends PixelTest {
     public void checkOption(String option, String button) {
         if (mDevice.version.equals("2.x")) {
             // Use the context menu in pre-11
-            final View toolbarView = mSolo.getView("browser_toolbar");
+            final View toolbarView = mSolo.getView(R.id.browser_toolbar);
             mSolo.clickLongOnView(toolbarView);
             mAsserter.ok(waitForText(StringHelper.CONTEXT_MENU_ITEMS_IN_URL_BAR[2]), "Waiting for the pop-up to open", "Pop up was opened");
         } else {
diff --git a/mobile/android/base/tests/testDistribution.java b/mobile/android/base/tests/testDistribution.java
index 4b739a08aa79..6a216e7daa97 100644
--- a/mobile/android/base/tests/testDistribution.java
+++ b/mobile/android/base/tests/testDistribution.java
@@ -1,11 +1,13 @@
 package org.mozilla.gecko.tests;
 
 import org.mozilla.gecko.*;
+import org.mozilla.gecko.db.BrowserContract;
+import org.mozilla.gecko.db.BrowserProvider;
 import org.mozilla.gecko.util.ThreadUtils;
 
 import android.app.Activity;
-import android.content.Context;
 import android.content.SharedPreferences;
+
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.InputStream;
@@ -303,7 +305,7 @@ public class testDistribution extends ContentProviderTest {
     @Override
     public void setUp() throws Exception {
         // TODO: Set up the content provider after setting the distribution.
-        super.setUp("org.mozilla.gecko.db.BrowserProvider", "AUTHORITY", "browser.db");
+        super.setUp(sBrowserProviderCallable, BrowserContract.AUTHORITY, "browser.db");
     }
 
     private void delete(File file) throws Exception {
diff --git a/mobile/android/base/tests/testFindInPage.java b/mobile/android/base/tests/testFindInPage.java
index 1c35f54d1fc1..864a896d863a 100644
--- a/mobile/android/base/tests/testFindInPage.java
+++ b/mobile/android/base/tests/testFindInPage.java
@@ -46,10 +46,10 @@ public class testFindInPage extends PixelTest {
 
     public void findText(String text, int nrOfMatches){
         selectMenuItem("Find in Page");
-        close = mDriver.findElement(getActivity(), "find_close");
+        close = mDriver.findElement(getActivity(), R.id.find_close);
         boolean success = waitForTest ( new BooleanTest() {
             public boolean test() {
-                next = mDriver.findElement(getActivity(), "find_next");
+                next = mDriver.findElement(getActivity(), R.id.find_next);
                 if (next != null) {
                     return true;
                 } else {
diff --git a/mobile/android/base/tests/testHomeListsProvider.java b/mobile/android/base/tests/testHomeListsProvider.java
index d44ad5142937..73554d3e9229 100644
--- a/mobile/android/base/tests/testHomeListsProvider.java
+++ b/mobile/android/base/tests/testHomeListsProvider.java
@@ -6,43 +6,38 @@ import android.database.Cursor;
 import android.net.Uri;
 
 public class testHomeListsProvider extends ContentProviderTest {
+    // This test does not run, so it just needs to compile. The test was
+    // disabled at the time the real Contract was removed; to leave a skeleton
+    // for a future re-implementor, we include this dummy Contract class.
+    private static class Contract {
+        public static final Uri CONTENT_URI = null;
+        public static final Uri CONTENT_FAKE_URI = null;
 
-    private Uri mItemsFakeUri;
-    private Uri mItemsUri;
-
-    private String mItemsIdCol;
-    private String mItemsProviderIdCol;
-    private String mItemsTitleCol;
-    private String mItemsUrlCol;
+        public static final String _ID = null;
+        public static final String PROVIDER_ID = null;
+        public static final String TITLE = null;
+        public static final String URL = null;
+    }
 
     @Override
     protected int getTestType() {
         return TEST_MOCHITEST;
     }
 
-    private void loadContractInfo() throws Exception {
-        mItemsFakeUri = getUriColumn("HomeListItems", "CONTENT_FAKE_URI");
-        mItemsUri = getContentUri("HomeListItems");
-
-        mItemsIdCol = getStringColumn("HomeListItems", "_ID");
-        mItemsProviderIdCol = getStringColumn("HomeListItems", "PROVIDER_ID");
-        mItemsTitleCol = getStringColumn("HomeListItems", "TITLE");
-        mItemsUrlCol = getStringColumn("HomeListItems", "URL");
-    }
-
-    private void ensureEmptyDatabase() throws Exception {
+    @SuppressWarnings("unused")
+  private void ensureEmptyDatabase() throws Exception {
         // Delete all the list entries.
-        mProvider.delete(mItemsUri, null, null);
+        mProvider.delete(Contract.CONTENT_URI, null, null);
 
-        final Cursor c = mProvider.query(mItemsUri, null, null, null, null);
+        final Cursor c = mProvider.query(Contract.CONTENT_URI, null, null, null, null);
         mAsserter.is(c.getCount(), 0, "All list entries were deleted");
         c.close();
     }
 
     @Override
     public void setUp() throws Exception {
-        super.setUp("org.mozilla.gecko.db.HomeListsProvider", "AUTHORITY", "homelists.db");
-        loadContractInfo();
+        // This test is disabled, so this just needs to compile.
+        super.setUp(null, null, "homelists.db");
 
         mTests.add(new TestFakeItems());
 
@@ -83,13 +78,13 @@ public class testHomeListsProvider extends ContentProviderTest {
             final String title = "Example";
             final String url = "http://example.com";
 
-            final Cursor c = mProvider.query(mItemsFakeUri, null, null, null, null);
+            final Cursor c = mProvider.query(Contract.CONTENT_FAKE_URI, null, null, null, null);
             mAsserter.is(c.moveToFirst(), true, "Fake list item found");
 
-            mAsserter.is(c.getLong(c.getColumnIndex(mItemsIdCol)), id, "Fake list item has correct ID");
-            mAsserter.is(c.getString(c.getColumnIndex(mItemsProviderIdCol)), providerId, "Fake list item has correct provider ID");
-            mAsserter.is(c.getString(c.getColumnIndex(mItemsTitleCol)), title, "Fake list item has correct title");
-            mAsserter.is(c.getString(c.getColumnIndex(mItemsUrlCol)), url, "Fake list item has correct URL");
+            mAsserter.is(c.getLong(c.getColumnIndex(Contract._ID)), id, "Fake list item has correct ID");
+            mAsserter.is(c.getString(c.getColumnIndex(Contract.PROVIDER_ID)), providerId, "Fake list item has correct provider ID");
+            mAsserter.is(c.getString(c.getColumnIndex(Contract.TITLE)), title, "Fake list item has correct title");
+            mAsserter.is(c.getString(c.getColumnIndex(Contract.URL)), url, "Fake list item has correct URL");
 
             c.close();
         }
@@ -104,19 +99,19 @@ public class testHomeListsProvider extends ContentProviderTest {
 
             // Insert a new list item with test values.
             final ContentValues cv = new ContentValues();
-            cv.put(mItemsProviderIdCol, providerId);
-            cv.put(mItemsTitleCol, title);
-            cv.put(mItemsUrlCol, url);
+            cv.put(Contract.PROVIDER_ID, providerId);
+            cv.put(Contract.TITLE, title);
+            cv.put(Contract.URL, url);
 
-            final long id = ContentUris.parseId(mProvider.insert(mItemsUri, cv));
+            final long id = ContentUris.parseId(mProvider.insert(Contract.CONTENT_URI, cv));
 
             // Check that the item was inserted correctly.
-            final Cursor c = mProvider.query(mItemsUri, null, mItemsIdCol + " = ?", new String[] { String.valueOf(id) }, null);
+            final Cursor c = mProvider.query(Contract.CONTENT_URI, null, Contract._ID + " = ?", new String[] { String.valueOf(id) }, null);
             mAsserter.is(c.moveToFirst(), true, "Inserted list item found");
 
-            mAsserter.is(c.getString(c.getColumnIndex(mItemsProviderIdCol)), providerId, "Inserted list item has correct provider ID");
-            mAsserter.is(c.getString(c.getColumnIndex(mItemsTitleCol)), title, "Inserted list item has correct title");
-            mAsserter.is(c.getString(c.getColumnIndex(mItemsUrlCol)), url, "Inserted list item has correct URL");
+            mAsserter.is(c.getString(c.getColumnIndex(Contract.PROVIDER_ID)), providerId, "Inserted list item has correct provider ID");
+            mAsserter.is(c.getString(c.getColumnIndex(Contract.TITLE)), title, "Inserted list item has correct title");
+            mAsserter.is(c.getString(c.getColumnIndex(Contract.URL)), url, "Inserted list item has correct URL");
 
             c.close();
         }
diff --git a/mobile/android/base/tests/testInputUrlBar.java b/mobile/android/base/tests/testInputUrlBar.java
index 0943727cf5cf..5b3d72d403d5 100644
--- a/mobile/android/base/tests/testInputUrlBar.java
+++ b/mobile/android/base/tests/testInputUrlBar.java
@@ -113,7 +113,7 @@ public final class testInputUrlBar extends BaseTest {
     private void startEditingMode() {
         focusUrlBar();
 
-        mUrlBarEditElement = mDriver.findElement(getActivity(), URL_EDIT_TEXT_ID);
+        mUrlBarEditElement = mDriver.findElement(getActivity(), R.id.url_edit_text);
         final int id = mUrlBarEditElement.getId();
         mUrlBarEditView = (EditText) getActivity().findViewById(id);
     }
diff --git a/mobile/android/base/tests/testNewTab.java b/mobile/android/base/tests/testNewTab.java
index c9ef30eee622..73350f4b1b37 100644
--- a/mobile/android/base/tests/testNewTab.java
+++ b/mobile/android/base/tests/testNewTab.java
@@ -24,9 +24,9 @@ public class testNewTab extends BaseTest {
         blockForGeckoReady();
 
         Activity activity = getActivity();
-        tabCount = mDriver.findElement(activity, "tabs_counter");
-        tabs = mDriver.findElement(activity, "tabs");
-        addTab = mDriver.findElement(activity, "add_tab");
+        tabCount = mDriver.findElement(activity, R.id.tabs_counter);
+        tabs = mDriver.findElement(activity, R.id.tabs);
+        addTab = mDriver.findElement(activity, R.id.add_tab);
         mAsserter.ok(tabCount != null &&
                      tabs != null &&
                      addTab != null, 
diff --git a/mobile/android/base/tests/testReaderMode.java b/mobile/android/base/tests/testReaderMode.java
index e52273d0475d..f2a0fac7b495 100644
--- a/mobile/android/base/tests/testReaderMode.java
+++ b/mobile/android/base/tests/testReaderMode.java
@@ -1,15 +1,16 @@
 package org.mozilla.gecko.tests;
 
-import org.mozilla.gecko.*;
-import com.jayway.android.robotium.solo.Condition;
-import com.jayway.android.robotium.solo.Solo;
-import android.graphics.Rect;
+import org.json.JSONException;
+import org.json.JSONObject;
+import org.mozilla.gecko.Actions;
+import org.mozilla.gecko.R;
+
 import android.view.View;
 import android.view.ViewGroup;
 import android.widget.ListView;
-import java.util.ArrayList;
-import org.json.JSONException;
-import org.json.JSONObject;
+
+import com.jayway.android.robotium.solo.Condition;
+import com.jayway.android.robotium.solo.Solo;
 
 /**
  * This patch tests the Reader Mode feature by adding and removing items in reading list
@@ -21,9 +22,6 @@ public class testReaderMode extends AboutHomeTest {
     static final int EVENT_CLEAR_DELAY_MS = 3000;
     static final int READER_ICON_MAX_WAIT_MS = 15000;
 
-    // IDs for UI views.
-    private static final String PAGE_ACTION_LAYOUT_ID = "page_action_layout";
-
     @Override
     protected int getTestType() {
         return TEST_MOCHITEST;
@@ -156,7 +154,7 @@ public class testReaderMode extends AboutHomeTest {
 
     // Get the reader icon method
     protected View getReaderIcon() {
-        View pageActionLayout = mSolo.getView(PAGE_ACTION_LAYOUT_ID);
+        View pageActionLayout = mSolo.getView(R.id.page_action_layout);
         final ViewGroup actionLayoutEntry = (ViewGroup)pageActionLayout;
         View icon = actionLayoutEntry.getChildAt(1);
         if (icon == null || icon.getVisibility() != View.VISIBLE) {
diff --git a/mobile/android/base/tests/testSearchSuggestions.java b/mobile/android/base/tests/testSearchSuggestions.java
index def01fc7e917..69258fa02f18 100644
--- a/mobile/android/base/tests/testSearchSuggestions.java
+++ b/mobile/android/base/tests/testSearchSuggestions.java
@@ -37,9 +37,6 @@ public class testSearchSuggestions extends BaseTest {
         final HashMap<String, ArrayList<String>> suggestMap = new HashMap<String, ArrayList<String>>();
         buildSuggestMap(suggestMap);
 
-        final int suggestionLayoutId = mDriver.findElement(getActivity(), "suggestion_layout").getId();
-        final int suggestionTextId = mDriver.findElement(getActivity(), "suggestion_text").getId();
-
         focusUrlBar();
 
         for (int i = 0; i < TEST_QUERY.length(); i++) {
@@ -65,7 +62,7 @@ public class testSearchSuggestions extends BaseTest {
                 @Override
                 public boolean test() {
                     // get the first suggestion row
-                    ViewGroup suggestionGroup = (ViewGroup) getActivity().findViewById(suggestionLayoutId);
+                    ViewGroup suggestionGroup = (ViewGroup) getActivity().findViewById(R.id.suggestion_layout);
                     if (suggestionGroup == null)
                         return false;
 
@@ -75,7 +72,7 @@ public class testSearchSuggestions extends BaseTest {
                         if (queryChild == null || queryChild.getVisibility() == View.GONE)
                             return false;
 
-                        String suggestion = ((TextView) queryChild.findViewById(suggestionTextId)).getText().toString();
+                        String suggestion = ((TextView) queryChild.findViewById(R.id.suggestion_text)).getText().toString();
                         if (!suggestion.equals(expected.get(i)))
                             return false;
                     }
diff --git a/mobile/android/base/tests/testThumbnails.java b/mobile/android/base/tests/testThumbnails.java
index 130caac1b666..830b4ac483af 100644
--- a/mobile/android/base/tests/testThumbnails.java
+++ b/mobile/android/base/tests/testThumbnails.java
@@ -3,13 +3,7 @@ package org.mozilla.gecko.tests;
 import org.mozilla.gecko.db.BrowserDB;
 
 import android.content.ContentResolver;
-import android.graphics.Bitmap;
 import android.graphics.Color;
-import android.graphics.drawable.BitmapDrawable;
-import android.view.View;
-import android.view.ViewGroup;
-import android.widget.ImageView;
-import android.widget.TextView;
 
 /**
  * Test for thumbnail updates.
@@ -20,20 +14,12 @@ import android.widget.TextView;
  * - finally, test that BrowserDB.removeThumbnails drops the thumbnails
  */
 public class testThumbnails extends BaseTest {
-    private int mTopSitesId;
-    private int mThumbnailId;
-    private int mTitleId;
-
     @Override
     protected int getTestType() {
         return TEST_MOCHITEST;
     }
 
     public void testThumbnails() {
-        mTopSitesId = mDriver.findElement(getActivity(), "top_sites_grid").getId();
-        mThumbnailId = mDriver.findElement(getActivity(), "thumbnail").getId();
-        mTitleId = mDriver.findElement(getActivity(), "title").getId();
-
         final String site1Url = getAbsoluteUrl("/robocop/robocop_404.sjs?type=changeColor");
         final String site2Url = getAbsoluteUrl("/robocop/robocop_404.sjs?type=do404");
         final String site1Title = "changeColor";
@@ -96,33 +82,35 @@ public class testThumbnails extends BaseTest {
     }
 
     private int getTopSiteThumbnailColor(String title) {
-        ViewGroup topSites = (ViewGroup) getActivity().findViewById(mTopSitesId);
-        if (topSites != null) {
-            final int childCount = topSites.getChildCount();
-            for (int i = 0; i < childCount; i++) {
-                View child = topSites.getChildAt(i);
-                if (child != null) {
-                    TextView titleView = (TextView) child.findViewById(mTitleId);
-                    if (titleView != null) {
-                        if (titleView.getText().equals(title)) {
-                            ImageView thumbnailView = (ImageView) child.findViewById(mThumbnailId);
-                            if (thumbnailView != null) {
-                                Bitmap thumbnail = ((BitmapDrawable) thumbnailView.getDrawable()).getBitmap();
-                                return thumbnail.getPixel(0, 0);
-                            } else {
-                                mAsserter.dumpLog("getTopSiteThumbnailColor: unable to find mThumbnailId: "+mThumbnailId);
-                            }
-                        }
-                    } else {
-                        mAsserter.dumpLog("getTopSiteThumbnailColor: unable to find mTitleId: "+mTitleId);
-                    }
-                } else {
-                    mAsserter.dumpLog("getTopSiteThumbnailColor: skipped null child at index "+i);
-                }
-            }
-        } else {
-            mAsserter.dumpLog("getTopSiteThumbnailColor: unable to find mTopSitesId: "+mTopSitesId);
-        }
+        // This test is not currently run, so this just needs to compile.
         return -1;
+//        ViewGroup topSites = (ViewGroup) getActivity().findViewById(mTopSitesId);
+//        if (topSites != null) {
+//            final int childCount = topSites.getChildCount();
+//            for (int i = 0; i < childCount; i++) {
+//                View child = topSites.getChildAt(i);
+//                if (child != null) {
+//                    TextView titleView = (TextView) child.findViewById(R.id.title);
+//                    if (titleView != null) {
+//                        if (titleView.getText().equals(title)) {
+//                            ImageView thumbnailView = (ImageView) child.findViewById(R.id.thumbnail);
+//                            if (thumbnailView != null) {
+//                                Bitmap thumbnail = ((BitmapDrawable) thumbnailView.getDrawable()).getBitmap();
+//                                return thumbnail.getPixel(0, 0);
+//                            } else {
+//                                mAsserter.dumpLog("getTopSiteThumbnailColor: unable to find mThumbnailId: "+R.id.thumbnail);
+//                            }
+//                        }
+//                    } else {
+//                        mAsserter.dumpLog("getTopSiteThumbnailColor: unable to find R.id.title: "+R.id.title);
+//                    }
+//                } else {
+//                    mAsserter.dumpLog("getTopSiteThumbnailColor: skipped null child at index "+i);
+//                }
+//            }
+//        } else {
+//            mAsserter.dumpLog("getTopSiteThumbnailColor: unable to find mTopSitesId: " + mTopSitesId);
+//        }
+//        return -1;
     }
 }
diff --git a/mobile/android/base/tests/testUITelemetry.java b/mobile/android/base/tests/testUITelemetry.java
index a6f180df6ef7..488c00139aaa 100644
--- a/mobile/android/base/tests/testUITelemetry.java
+++ b/mobile/android/base/tests/testUITelemetry.java
@@ -1,5 +1,7 @@
 package org.mozilla.gecko.tests;
 
+import org.mozilla.gecko.AppConstants;
+import org.mozilla.gecko.PrefsHelper;
 import org.mozilla.gecko.Telemetry;
 
 import android.util.Log;
@@ -12,8 +14,13 @@ public class testUITelemetry extends JavascriptTest {
     @Override
     public void testJavascript() throws Exception {
         blockForGeckoReady();
-        Log.i("GeckoTest", "Adding telemetry events.");
 
+        // We can't run these tests unless telemetry is turned on --
+        // the events will be dropped on the floor.
+        Log.i("GeckoTest", "Enabling telemetry.");
+        PrefsHelper.setPref(AppConstants.TELEMETRY_PREF_NAME, true);
+
+        Log.i("GeckoTest", "Adding telemetry events.");
         try {
             Telemetry.sendUIEvent("enone", "method0");
             Telemetry.startUISession("foo");
diff --git a/mobile/android/base/tests/testUITelemetry.js b/mobile/android/base/tests/testUITelemetry.js
index 0407314bb2da..9b9eb3ab6a36 100644
--- a/mobile/android/base/tests/testUITelemetry.js
+++ b/mobile/android/base/tests/testUITelemetry.js
@@ -3,7 +3,11 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-Components.utils.import("resource://gre/modules/Services.jsm");
+const Cc = Components.classes;
+const Ci = Components.interfaces;
+const Cu = Components.utils;
+
+Cu.import("resource://gre/modules/Services.jsm");
 
 function do_check_array_eq(a1, a2) {
   do_check_eq(a1.length, a2.length);
@@ -12,15 +16,27 @@ function do_check_array_eq(a1, a2) {
   }
 }
 
-add_test(function test_telemetry_events() {
-  let bridge = Components.classes["@mozilla.org/android/bridge;1"]
-                         .getService(Components.interfaces.nsIAndroidBridge);
+function getObserver() {
+  let bridge = Cc["@mozilla.org/android/bridge;1"]
+                 .getService(Ci.nsIAndroidBridge);
   let obsXPCOM = bridge.browserApp.getUITelemetryObserver();
   do_check_true(!!obsXPCOM);
+  return obsXPCOM.wrappedJSObject;
+}
 
-  let obs = obsXPCOM.wrappedJSObject;
+/**
+ * The following event test will fail if telemetry isn't enabled. The Java-side
+ * part of this test should have turned it on; fail if it didn't work.
+ */
+add_test(function test_enabled() {
+  let obs = getObserver();
   do_check_true(!!obs);
+  do_check_true(obs.enabled);
+  run_next_test();
+});
 
+add_test(function test_telemetry_events() {
+  let obs = getObserver();
   let measurements = obs.getUIMeasurements();
 
   let expected = [
diff --git a/mobile/android/base/tokenserver/TokenServerClient.java b/mobile/android/base/tokenserver/TokenServerClient.java
index e13d0fe3c31d..dd8229fa1d79 100644
--- a/mobile/android/base/tokenserver/TokenServerClient.java
+++ b/mobile/android/base/tokenserver/TokenServerClient.java
@@ -29,6 +29,7 @@ import org.mozilla.gecko.tokenserver.TokenServerException.TokenServerMalformedRe
 import org.mozilla.gecko.tokenserver.TokenServerException.TokenServerMalformedResponseException;
 import org.mozilla.gecko.tokenserver.TokenServerException.TokenServerUnknownServiceException;
 
+import ch.boye.httpclientandroidlib.Header;
 import ch.boye.httpclientandroidlib.HttpHeaders;
 import ch.boye.httpclientandroidlib.HttpResponse;
 import ch.boye.httpclientandroidlib.client.ClientProtocolException;
@@ -93,6 +94,28 @@ public class TokenServerClient {
     });
   }
 
+  /**
+   * Notify the delegate that some kind of backoff header (X-Backoff,
+   * X-Weave-Backoff, Retry-After) was received and should be acted upon.
+   *
+   * This method is non-terminal, and will be followed by a separate
+   * <code>invoke*</code> call.
+   *
+   * @param delegate
+   *          the delegate to inform.
+   * @param backoffSeconds
+   *          the number of seconds for which the system should wait before
+   *          making another token server request to this server.
+   */
+  protected void notifyBackoff(final TokenServerClientDelegate delegate, final int backoffSeconds) {
+    executor.execute(new Runnable() {
+      @Override
+      public void run() {
+        delegate.handleBackoff(backoffSeconds);
+      }
+    });
+  }
+
   protected void invokeHandleError(final TokenServerClientDelegate delegate, final Exception e) {
     executor.execute(new Runnable() {
       @Override
@@ -102,17 +125,21 @@ public class TokenServerClient {
     });
   }
 
-  public TokenServerToken processResponse(HttpResponse response)
-      throws TokenServerException {
-    SyncResponse res = new SyncResponse(response);
+  public TokenServerToken processResponse(SyncResponse res) throws TokenServerException {
     int statusCode = res.getStatusCode();
 
     Logger.debug(LOG_TAG, "Got token response with status code " + statusCode + ".");
 
     // Responses should *always* be JSON, even in the case of 4xx and 5xx
     // errors. If we don't see JSON, the server is likely very unhappy.
-    String contentType = response.getEntity().getContentType().getValue();
-    if (!contentType.equals("application/json") && !contentType.startsWith("application/json;")) {
+    final Header contentType = res.getContentType();
+    if (contentType == null) {
+      throw new TokenServerMalformedResponseException(null, "Non-JSON response Content-Type.");
+    }
+
+    final String type = contentType.getValue();
+    if (!type.equals("application/json") &&
+        !type.startsWith("application/json;")) {
       Logger.warn(LOG_TAG, "Got non-JSON response with Content-Type " +
           contentType + ". Misconfigured server?");
       throw new TokenServerMalformedResponseException(null, "Non-JSON response Content-Type.");
@@ -230,10 +257,21 @@ public class TokenServerClient {
 
     @Override
     public void handleHttpResponse(HttpResponse response) {
+      // Skew.
       SkewHandler skewHandler = SkewHandler.getSkewHandlerForResource(resource);
       skewHandler.updateSkew(response, System.currentTimeMillis());
+
+      // Extract backoff regardless of whether this was an error response, and
+      // Retry-After for 503 responses. The error will be handled elsewhere.)
+      SyncResponse res = new SyncResponse(response);
+      final boolean includeRetryAfter = res.getStatusCode() == 503;
+      int backoffInSeconds = res.totalBackoffInSeconds(includeRetryAfter);
+      if (backoffInSeconds > -1) {
+        client.notifyBackoff(delegate, backoffInSeconds);
+      }
+
       try {
-        TokenServerToken token = client.processResponse(response);
+        TokenServerToken token = client.processResponse(res);
         client.invokeHandleSuccess(delegate, token);
       } catch (TokenServerException e) {
         client.invokeHandleFailure(delegate, e);
diff --git a/mobile/android/base/tokenserver/TokenServerClientDelegate.java b/mobile/android/base/tokenserver/TokenServerClientDelegate.java
index 2fc48b08ef99..d34d04c73ffa 100644
--- a/mobile/android/base/tokenserver/TokenServerClientDelegate.java
+++ b/mobile/android/base/tokenserver/TokenServerClientDelegate.java
@@ -4,9 +4,13 @@
 
 package org.mozilla.gecko.tokenserver;
 
-
 public interface TokenServerClientDelegate {
   void handleSuccess(TokenServerToken token);
   void handleFailure(TokenServerException e);
   void handleError(Exception e);
+
+  /**
+   * Might be called multiple times, in addition to the other terminating handler methods.
+   */
+  void handleBackoff(int backoffSeconds);
 }
\ No newline at end of file
diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index bda1d9ab9ad9..cff7a0724f25 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -1804,11 +1804,7 @@ pref("layout.css.scope-pseudo.enabled", true);
 #endif
 
 // Is support for background-blend-mode enabled?
-#ifdef RELEASE_BUILD
-pref("layout.css.background-blend-mode.enabled", false);
-#else
 pref("layout.css.background-blend-mode.enabled", true);
-#endif
 
 // Is support for CSS vertical text enabled?
 pref("layout.css.vertical-text.enabled", false);
@@ -3858,6 +3854,7 @@ pref("webgl.lose-context-on-heap-minimize", false);
 pref("webgl.can-lose-context-in-foreground", true);
 pref("webgl.max-warnings-per-context", 32);
 pref("webgl.enable-draft-extensions", false);
+pref("webgl.enable-privileged-extensions", false);
 #ifdef MOZ_WIDGET_GONK
 pref("gfx.gralloc.fence-with-readpixels", false);
 #endif
diff --git a/netwerk/protocol/http/nsHttpTransaction.cpp b/netwerk/protocol/http/nsHttpTransaction.cpp
index 39515adc2059..b538a2da2430 100644
--- a/netwerk/protocol/http/nsHttpTransaction.cpp
+++ b/netwerk/protocol/http/nsHttpTransaction.cpp
@@ -676,28 +676,6 @@ nsHttpTransaction::WritePipeSegment(nsIOutputStream *stream,
     //
     // OK, now let the caller fill this segment with data.
     //
-    if (!trans->mHaveAllHeaders) {
-        // Reading too far ahead on a chunked encoding is expensive (see below)
-        // so limit header reads to 1KB to minimize any potential damage while
-        // we figure out the message delimiter.
-        count = std::min(count, 1024U);
-    } else if (trans->mChunkedDecoder) {
-        // The API in use requires us to return entity data in 1 contiguous
-        // buffer supplied by the caller. That means
-        // all entity data needs to be moved up to cover gaps created by
-        // stripping the chunk length. We can mitigate this problem by
-        // doing short reads when we are parsing chunk lengths and limiting
-        // reads in the middle of chunks to the remaining chunk size to
-        // increase the frequency of chunk markers naturally aligning
-        // at the start.
-        if (!trans->mChunkedDecoder->GetChunkRemaining()) {
-            count = std::min(count, 6U); // 6 is 4 hex chars + CRLF
-        } else {
-            // extra 2 bytes is for CRLF that terminates the chunk
-            count = std::min(count,
-                             trans->mChunkedDecoder->GetChunkRemaining() + 2);
-        }
-    }
     rv = trans->mWriter->OnWriteSegment(buf, count, countWritten);
     if (NS_FAILED(rv)) return rv; // caller didn't want to write anything
 
diff --git a/security/certverifier/CertVerifier.cpp b/security/certverifier/CertVerifier.cpp
index 40e3ca0bf263..202bcd731b1f 100644
--- a/security/certverifier/CertVerifier.cpp
+++ b/security/certverifier/CertVerifier.cpp
@@ -8,7 +8,7 @@
 
 #include <stdint.h>
 
-#include "insanity/pkixtypes.h"
+#include "insanity/pkix.h"
 #include "ExtendedValidation.h"
 #include "NSSCertDBTrustDomain.h"
 #include "cert.h"
@@ -32,14 +32,18 @@ const CertVerifier::Flags CertVerifier::FLAG_LOCAL_ONLY = 1;
 const CertVerifier::Flags CertVerifier::FLAG_MUST_BE_EV = 2;
 
 CertVerifier::CertVerifier(implementation_config ic,
+#ifndef NSS_NO_LIBPKIX
                            missing_cert_download_config mcdc,
                            crl_download_config cdc,
+#endif
                            ocsp_download_config odc,
                            ocsp_strict_config osc,
                            ocsp_get_config ogc)
   : mImplementation(ic)
+#ifndef NSS_NO_LIBPKIX
   , mMissingCertDownloadEnabled(mcdc == missing_cert_download_on)
   , mCRLDownloadEnabled(cdc == crl_download_allowed)
+#endif
   , mOCSPDownloadEnabled(odc == ocsp_on)
   , mOCSPStrict(osc == ocsp_strict)
   , mOCSPGETEnabled(ogc == ocsp_get_enabled)
@@ -129,9 +133,6 @@ ClassicVerifyCert(CERTCertificate* cert,
       case  certificateUsageSSLServer:
         enumUsage = certUsageSSLServer;
         break;
-      case certificateUsageSSLServerWithStepUp:
-        enumUsage = certUsageSSLServerWithStepUp;
-        break;
       case certificateUsageSSLCA:
         enumUsage = certUsageSSLCA;
         break;
@@ -144,22 +145,12 @@ ClassicVerifyCert(CERTCertificate* cert,
       case certificateUsageObjectSigner:
         enumUsage = certUsageObjectSigner;
         break;
-      case certificateUsageUserCertImport:
-        enumUsage = certUsageUserCertImport;
-        break;
-      case certificateUsageVerifyCA:
-        enumUsage = certUsageVerifyCA;
-        break;
-      case certificateUsageProtectedObjectSigner:
-        enumUsage = certUsageProtectedObjectSigner;
-        break;
       case certificateUsageStatusResponder:
         enumUsage = certUsageStatusResponder;
         break;
-      case certificateUsageAnyCA:
-        enumUsage = certUsageAnyCA;
-        break;
-       default:
+      default:
+        PR_NOT_REACHED("unexpected usage");
+        PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }
   }
@@ -199,6 +190,181 @@ destroyCertListThatShouldNotExist(CERTCertList** certChain)
 }
 #endif
 
+static SECStatus
+BuildCertChainForOneKeyUsage(TrustDomain& trustDomain, CERTCertificate* cert,
+                             PRTime time, KeyUsages ku1, KeyUsages ku2,
+                             KeyUsages ku3, SECOidTag eku,
+                             ScopedCERTCertList& builtChain)
+{
+  PR_ASSERT(ku1);
+  PR_ASSERT(ku2);
+
+  SECStatus rv = BuildCertChain(trustDomain, cert, time, MustBeEndEntity,
+                                ku1, eku, builtChain);
+  if (rv != SECSuccess && ku2 &&
+      PR_GetError() == SEC_ERROR_INADEQUATE_KEY_USAGE) {
+    rv = BuildCertChain(trustDomain, cert, time, MustBeEndEntity,
+                        ku2, eku, builtChain);
+    if (rv != SECSuccess && ku3 &&
+        PR_GetError() == SEC_ERROR_INADEQUATE_KEY_USAGE) {
+      rv = BuildCertChain(trustDomain, cert, time, MustBeEndEntity,
+                          ku3, eku, builtChain);
+      if (rv != SECSuccess) {
+        PR_SetError(SEC_ERROR_INADEQUATE_KEY_USAGE, 0);
+      }
+    }
+  }
+  return rv;
+}
+
+SECStatus
+CertVerifier::InsanityVerifyCert(
+                   CERTCertificate* cert,
+      /*optional*/ const SECItem* /*TODO: stapledOCSPResponse*/,
+                   const SECCertificateUsage usage,
+                   const PRTime time,
+                   void* pinArg,
+                   const Flags flags,
+  /*optional out*/ insanity::pkix::ScopedCERTCertList* validationChain)
+{
+  PR_LOG(gCertVerifierLog, PR_LOG_DEBUG, ("Top of InsanityVerifyCert\n"));
+  SECStatus rv;
+
+  // TODO(bug 970750): anyExtendedKeyUsage
+  // TODO: encipherOnly/decipherOnly
+  // S/MIME Key Usage: http://tools.ietf.org/html/rfc3850#section-4.4.2
+  // S/MIME EKU:       http://tools.ietf.org/html/rfc3850#section-4.4.4
+
+  // TODO(bug 915931): Pass in stapled OCSP response in all calls to
+  //                   BuildCertChain.
+
+  insanity::pkix::ScopedCERTCertList builtChain;
+  switch (usage) {
+    case certificateUsageSSLClient: {
+      // XXX: We don't really have a trust bit for SSL client authentication so
+      // just use trustEmail as it is the closest alternative.
+      NSSCertDBTrustDomain trustDomain(trustEmail, mOCSPDownloadEnabled,
+                                       mOCSPStrict, pinArg);
+      rv = BuildCertChain(trustDomain, cert, time, MustBeEndEntity,
+                          KU_DIGITAL_SIGNATURE,
+                          SEC_OID_EXT_KEY_USAGE_CLIENT_AUTH,
+                          builtChain);
+      break;
+    }
+
+    case certificateUsageSSLServer: {
+      // TODO: When verifying a certificate in an SSL handshake, we should
+      // restrict the acceptable key usage based on the key exchange method
+      // chosen by the server.
+      NSSCertDBTrustDomain trustDomain(trustSSL, mOCSPDownloadEnabled,
+                                       mOCSPStrict, pinArg);
+      rv = BuildCertChainForOneKeyUsage(trustDomain, cert, time,
+                                        KU_DIGITAL_SIGNATURE, // ECDHE/DHE
+                                        KU_KEY_ENCIPHERMENT, // RSA
+                                        KU_KEY_AGREEMENT, // ECDH/DH
+                                        SEC_OID_EXT_KEY_USAGE_SERVER_AUTH,
+                                        builtChain);
+      break;
+    }
+
+    case certificateUsageSSLCA: {
+      NSSCertDBTrustDomain trustDomain(trustSSL, mOCSPDownloadEnabled,
+                                       mOCSPStrict, pinArg);
+      rv = BuildCertChain(trustDomain, cert, time, MustBeCA,
+                          KU_KEY_CERT_SIGN,
+                          SEC_OID_EXT_KEY_USAGE_SERVER_AUTH,
+                          builtChain);
+      break;
+    }
+
+    case certificateUsageEmailSigner: {
+      NSSCertDBTrustDomain trustDomain(trustEmail, mOCSPDownloadEnabled,
+                                       mOCSPStrict, pinArg);
+      rv = BuildCertChain(trustDomain, cert, time, MustBeEndEntity,
+                          KU_DIGITAL_SIGNATURE,
+                          SEC_OID_EXT_KEY_USAGE_EMAIL_PROTECT,
+                          builtChain);
+      break;
+    }
+
+    case certificateUsageEmailRecipient: {
+      // TODO: The higher level S/MIME processing should pass in which key
+      // usage it is trying to verify for, and base its algorithm choices
+      // based on the result of the verification(s).
+      NSSCertDBTrustDomain trustDomain(trustEmail, mOCSPDownloadEnabled,
+                                       mOCSPStrict, pinArg);
+      rv = BuildCertChainForOneKeyUsage(trustDomain, cert, time,
+                                        KU_KEY_ENCIPHERMENT, // RSA
+                                        KU_KEY_AGREEMENT, // ECDH/DH
+                                        0,
+                                        SEC_OID_EXT_KEY_USAGE_EMAIL_PROTECT,
+                                        builtChain);
+      break;
+    }
+
+    case certificateUsageObjectSigner: {
+      NSSCertDBTrustDomain trustDomain(trustObjectSigning,
+                                       mOCSPDownloadEnabled, mOCSPStrict,
+                                       pinArg);
+      rv = BuildCertChain(trustDomain, cert, time, MustBeEndEntity,
+                          KU_DIGITAL_SIGNATURE,
+                          SEC_OID_EXT_KEY_USAGE_CODE_SIGN,
+                          builtChain);
+      break;
+    }
+
+    case certificateUsageVerifyCA:
+    case certificateUsageStatusResponder: {
+      // XXX This is a pretty useless way to verify a certificate. It is used
+      // by the implementation of window.crypto.importCertificates and in the
+      // certificate viewer UI. Because we don't know what trust bit is
+      // interesting, we just try them all.
+      insanity::pkix::EndEntityOrCA endEntityOrCA;
+      insanity::pkix::KeyUsages keyUsage;
+      SECOidTag eku;
+      if (usage == certificateUsageVerifyCA) {
+        endEntityOrCA = MustBeCA;
+        keyUsage = KU_KEY_CERT_SIGN;
+        eku = SEC_OID_UNKNOWN;
+      } else {
+        endEntityOrCA = MustBeEndEntity;
+        keyUsage = KU_DIGITAL_SIGNATURE;
+        eku = SEC_OID_OCSP_RESPONDER;
+      }
+
+      NSSCertDBTrustDomain sslTrust(trustSSL,
+                                    mOCSPDownloadEnabled, mOCSPStrict, pinArg);
+      rv = BuildCertChain(sslTrust, cert, time, endEntityOrCA,
+                          keyUsage, eku, builtChain);
+      if (rv == SECFailure && PR_GetError() == SEC_ERROR_UNKNOWN_ISSUER) {
+        NSSCertDBTrustDomain emailTrust(trustEmail, mOCSPDownloadEnabled,
+                                        mOCSPStrict, pinArg);
+        rv = BuildCertChain(emailTrust, cert, time, endEntityOrCA, keyUsage,
+                            eku, builtChain);
+        if (rv == SECFailure && SEC_ERROR_UNKNOWN_ISSUER) {
+          NSSCertDBTrustDomain objectSigningTrust(trustObjectSigning,
+                                                  mOCSPDownloadEnabled,
+                                                  mOCSPStrict, pinArg);
+          rv = BuildCertChain(objectSigningTrust, cert, time, endEntityOrCA,
+                              keyUsage, eku, builtChain);
+        }
+      }
+
+      break;
+    }
+
+    default:
+      PR_SetError(SEC_ERROR_INVALID_ARGS, 0);
+      return SECFailure;
+  }
+
+  if (validationChain && rv == SECSuccess) {
+    *validationChain = builtChain.release();
+  }
+
+  return rv;
+}
+
 SECStatus
 CertVerifier::VerifyCert(CERTCertificate* cert,
             /*optional*/ const SECItem* stapledOCSPResponse,
@@ -433,6 +599,11 @@ CertVerifier::VerifyCert(CERTCertificate* cert,
     return SECFailure;
   }
 
+  if (mImplementation == insanity) {
+    return InsanityVerifyCert(cert, stapledOCSPResponse, usage, time,
+                              pinArg, flags, validationChain);
+  }
+
   if (mImplementation == classic) {
     // XXX: we do not care about the localOnly flag (currently) as the
     // caller that wants localOnly should disable and reenable the fetching.
diff --git a/security/certverifier/CertVerifier.h b/security/certverifier/CertVerifier.h
index d4a175872146..702e9a558832 100644
--- a/security/certverifier/CertVerifier.h
+++ b/security/certverifier/CertVerifier.h
@@ -7,7 +7,6 @@
 #ifndef mozilla_psm__CertVerifier_h
 #define mozilla_psm__CertVerifier_h
 
-#include "certt.h"
 #include "insanity/pkixtypes.h"
 
 namespace mozilla { namespace psm {
@@ -49,6 +48,7 @@ public:
 #ifndef NSS_NO_LIBPKIX
     libpkix = 1,
 #endif
+    insanity = 2
   };
 
   enum missing_cert_download_config { missing_cert_download_off = 0, missing_cert_download_on };
@@ -59,18 +59,31 @@ public:
 
   bool IsOCSPDownloadEnabled() const { return mOCSPDownloadEnabled; }
 
-  CertVerifier(implementation_config ic, missing_cert_download_config ac,
-               crl_download_config cdc, ocsp_download_config odc,
-               ocsp_strict_config osc, ocsp_get_config ogc);
+  CertVerifier(implementation_config ic,
+#ifndef NSS_NO_LIBPKIX
+               missing_cert_download_config ac, crl_download_config cdc,
+#endif
+               ocsp_download_config odc, ocsp_strict_config osc,
+               ocsp_get_config ogc);
   ~CertVerifier();
 
-public:
   const implementation_config mImplementation;
+#ifndef NSS_NO_LIBPKIX
   const bool mMissingCertDownloadEnabled;
   const bool mCRLDownloadEnabled;
+#endif
   const bool mOCSPDownloadEnabled;
   const bool mOCSPStrict;
   const bool mOCSPGETEnabled;
+
+private:
+  SECStatus InsanityVerifyCert(CERTCertificate* cert,
+      /*optional*/ const SECItem* stapledOCSPResponse,
+      const SECCertificateUsage usage,
+      const PRTime time,
+      void* pinArg,
+      const Flags flags,
+      /*optional out*/ insanity::pkix::ScopedCERTCertList* validationChain);
 };
 
 void InitCertVerifierLog();
diff --git a/security/certverifier/NSSCertDBTrustDomain.cpp b/security/certverifier/NSSCertDBTrustDomain.cpp
index ea1a29574938..87fbd775ecbe 100644
--- a/security/certverifier/NSSCertDBTrustDomain.cpp
+++ b/security/certverifier/NSSCertDBTrustDomain.cpp
@@ -8,7 +8,7 @@
 
 #include <stdint.h>
 
-#include "insanity/ScopedPtr.h"
+#include "insanity/pkix.h"
 #include "certdb.h"
 #include "nss.h"
 #include "ocsp.h"
@@ -21,6 +21,10 @@
 
 using namespace insanity::pkix;
 
+#ifdef PR_LOGGING
+extern PRLogModuleInfo* gCertVerifierLog;
+#endif
+
 namespace mozilla { namespace psm {
 
 const char BUILTIN_ROOTS_MODULE_DEFAULT_NAME[] = "Builtin Roots Module";
@@ -31,6 +35,92 @@ inline void PORT_Free_string(char* str) { PORT_Free(str); }
 
 typedef ScopedPtr<SECMODModule, SECMOD_DestroyModule> ScopedSECMODModule;
 
+} // unnamed namespace
+
+NSSCertDBTrustDomain::NSSCertDBTrustDomain(SECTrustType certDBTrustType,
+                                           bool /*ocspDownloadEnabled*/,
+                                           bool /*ocspStrict*/,
+                                           void* pinArg)
+  : mCertDBTrustType(certDBTrustType)
+//  , mOCSPDownloadEnabled(ocspDownloadEnabled)
+//  , mOCSPStrict(ocspStrict)
+  , mPinArg(pinArg)
+{
+}
+
+SECStatus
+NSSCertDBTrustDomain::FindPotentialIssuers(
+  const SECItem* encodedIssuerName, PRTime time,
+  /*out*/ insanity::pkix::ScopedCERTCertList& results)
+{
+  // TODO: normalize encodedIssuerName
+  // TODO: NSS seems to be ambiguous between "no potential issuers found" and
+  // "there was an error trying to retrieve the potential issuers."
+  results = CERT_CreateSubjectCertList(nullptr, CERT_GetDefaultCertDB(),
+                                       encodedIssuerName, time, true);
+  if (!results) {
+    return SECFailure;
+  }
+
+  return SECSuccess;
+}
+
+SECStatus
+NSSCertDBTrustDomain::GetCertTrust(EndEntityOrCA endEntityOrCA,
+                                   const CERTCertificate* candidateCert,
+                                   /*out*/ TrustLevel* trustLevel)
+{
+  PORT_Assert(candidateCert);
+  PORT_Assert(trustLevel);
+  if (!candidateCert || !trustLevel) {
+    PORT_SetError(SEC_ERROR_INVALID_ARGS);
+    return SECFailure;
+  }
+
+  // XXX: CERT_GetCertTrust seems to be abusing SECStatus as a boolean, where
+  // SECSuccess means that there is a trust record and SECFailure means there
+  // is not a trust record. I looked at NSS's internal uses of
+  // CERT_GetCertTrust, and all that code uses the result as a boolean meaning
+  // "We have a trust record."
+  CERTCertTrust trust;
+  if (CERT_GetCertTrust(candidateCert, &trust) == SECSuccess) {
+    PRUint32 flags = SEC_GET_TRUST_FLAGS(&trust, mCertDBTrustType);
+
+    // For DISTRUST, we use the CERTDB_TRUSTED or CERTDB_TRUSTED_CA bit,
+    // because we can have active distrust for either type of cert. Note that
+    // CERTDB_TERMINAL_RECORD means "stop trying to inherit trust" so if the
+    // relevant trust bit isn't set then that means the cert must be considered
+    // distrusted.
+    PRUint32 relevantTrustBit = endEntityOrCA == MustBeCA ? CERTDB_TRUSTED_CA
+                                                          : CERTDB_TRUSTED;
+    if (((flags & (relevantTrustBit|CERTDB_TERMINAL_RECORD)))
+            == CERTDB_TERMINAL_RECORD) {
+      *trustLevel = ActivelyDistrusted;
+      return SECSuccess;
+    }
+
+    // For TRUST, we only use the CERTDB_TRUSTED_CA bit, because Gecko hasn't
+    // needed to consider end-entity certs to be their own trust anchors since
+    // Gecko implemented nsICertOverrideService.
+    if (flags & CERTDB_TRUSTED_CA) {
+      *trustLevel = TrustAnchor;
+      return SECSuccess;
+    }
+  }
+
+  *trustLevel = InheritsTrust;
+  return SECSuccess;
+}
+
+SECStatus
+NSSCertDBTrustDomain::VerifySignedData(const CERTSignedData* signedData,
+                                       const CERTCertificate* cert)
+{
+  return ::insanity::pkix::VerifySignedData(signedData, cert, mPinArg);
+}
+
+namespace {
+
 static char*
 nss_addEscape(const char* string, char quote)
 {
diff --git a/security/certverifier/NSSCertDBTrustDomain.h b/security/certverifier/NSSCertDBTrustDomain.h
index f6d9adf8803e..abe647a73d44 100644
--- a/security/certverifier/NSSCertDBTrustDomain.h
+++ b/security/certverifier/NSSCertDBTrustDomain.h
@@ -43,6 +43,33 @@ char* DefaultServerNicknameForCert(CERTCertificate* cert);
 
 void SaveIntermediateCerts(const insanity::pkix::ScopedCERTCertList& certList);
 
+class NSSCertDBTrustDomain : public insanity::pkix::TrustDomain
+{
+
+public:
+  NSSCertDBTrustDomain(SECTrustType certDBTrustType,
+                       bool ocspDownloadEnabled, bool ocspStrict,
+                       void* pinArg);
+
+  virtual SECStatus FindPotentialIssuers(
+                        const SECItem* encodedIssuerName,
+                        PRTime time,
+                /*out*/ insanity::pkix::ScopedCERTCertList& results);
+
+  virtual SECStatus GetCertTrust(insanity::pkix::EndEntityOrCA endEntityOrCA,
+                                 const CERTCertificate* candidateCert,
+                         /*out*/ TrustLevel* trustLevel);
+
+  virtual SECStatus VerifySignedData(const CERTSignedData* signedData,
+                                     const CERTCertificate* cert);
+
+private:
+  const SECTrustType mCertDBTrustType;
+//  const bool mOCSPDownloadEnabled;
+//  const bool mOCSPStrict;
+  void* mPinArg; // non-owning!
+};
+
 } } // namespace mozilla::psm
 
 #endif // mozilla_psm__NSSCertDBTrustDomain_h
diff --git a/security/insanity/include/insanity/pkix.h b/security/insanity/include/insanity/pkix.h
index 0b485ac66f67..95089e5096a1 100644
--- a/security/insanity/include/insanity/pkix.h
+++ b/security/insanity/include/insanity/pkix.h
@@ -26,7 +26,9 @@ namespace insanity { namespace pkix {
 SECStatus BuildCertChain(TrustDomain& trustDomain,
                          CERTCertificate* cert,
                          PRTime time,
+                         EndEntityOrCA endEntityOrCA,
             /*optional*/ KeyUsages requiredKeyUsagesIfPresent,
+            /*optional*/ SECOidTag requiredEKUIfPresent,
                  /*out*/ ScopedCERTCertList& results);
 
 // Verify the given signed data using the public key of the given certificate.
diff --git a/security/insanity/lib/pkixbuild.cpp b/security/insanity/lib/pkixbuild.cpp
index 7e5dbe6ae14b..4f3ee255e261 100644
--- a/security/insanity/lib/pkixbuild.cpp
+++ b/security/insanity/lib/pkixbuild.cpp
@@ -41,6 +41,7 @@ BackCert::Init()
   const SECItem* dummyEncodedSubjectKeyIdentifier = nullptr;
   const SECItem* dummyEncodedAuthorityKeyIdentifier = nullptr;
   const SECItem* dummyEncodedAuthorityInfoAccess = nullptr;
+  const SECItem* dummyEncodedSubjectAltName = nullptr;
 
   for (const CERTCertExtension* ext = *exts; ext; ext = *++exts) {
     const SECItem** out = nullptr;
@@ -51,8 +52,11 @@ BackCert::Init()
       switch (ext->id.data[2]) {
         case 14: out = &dummyEncodedSubjectKeyIdentifier; break; // bug 965136
         case 15: out = &encodedKeyUsage; break;
+        case 17: out = &dummyEncodedSubjectAltName; break; // bug 970542
         case 19: out = &encodedBasicConstraints; break;
+        case 30: out = &encodedNameConstraints; break;
         case 35: out = &dummyEncodedAuthorityKeyIdentifier; break; // bug 965136
+        case 37: out = &encodedExtendedKeyUsage; break;
       }
     } else if (ext->id.len == 9 &&
                ext->id.data[0] == 0x2b && ext->id.data[1] == 0x06 &&
@@ -91,6 +95,7 @@ static Result BuildForward(TrustDomain& trustDomain,
                            PRTime time,
                            EndEntityOrCA endEntityOrCA,
                            KeyUsages requiredKeyUsagesIfPresent,
+                           SECOidTag requiredEKUIfPresent,
                            unsigned int subCACount,
                            /*out*/ ScopedCERTCertList& results);
 
@@ -100,13 +105,15 @@ BuildForwardInner(TrustDomain& trustDomain,
                   BackCert& subject,
                   PRTime time,
                   EndEntityOrCA endEntityOrCA,
+                  SECOidTag requiredEKUIfPresent,
                   CERTCertificate* potentialIssuerCertToDup,
                   unsigned int subCACount,
                   ScopedCERTCertList& results)
 {
   PORT_Assert(potentialIssuerCertToDup);
 
-  BackCert potentialIssuer(potentialIssuerCertToDup, &subject);
+  BackCert potentialIssuer(potentialIssuerCertToDup, &subject,
+                           BackCert::ExcludeCN);
   Result rv = potentialIssuer.Init();
   if (rv != Success) {
     return rv;
@@ -134,6 +141,11 @@ BuildForwardInner(TrustDomain& trustDomain,
     return rv;
   }
 
+  rv = CheckNameConstraints(potentialIssuer);
+  if (rv != Success) {
+    return rv;
+  }
+
   unsigned int newSubCACount = subCACount;
   if (endEntityOrCA == MustBeCA) {
     newSubCACount = subCACount + 1;
@@ -142,7 +154,7 @@ BuildForwardInner(TrustDomain& trustDomain,
   }
 
   rv = BuildForward(trustDomain, potentialIssuer, time, MustBeCA,
-                    KU_KEY_CERT_SIGN,
+                    KU_KEY_CERT_SIGN, requiredEKUIfPresent,
                     newSubCACount, results);
   if (rv != Success) {
     return rv;
@@ -163,6 +175,7 @@ BuildForward(TrustDomain& trustDomain,
              PRTime time,
              EndEntityOrCA endEntityOrCA,
              KeyUsages requiredKeyUsagesIfPresent,
+             SECOidTag requiredEKUIfPresent,
              unsigned int subCACount,
              /*out*/ ScopedCERTCertList& results)
 {
@@ -191,7 +204,7 @@ BuildForward(TrustDomain& trustDomain,
 
   rv = CheckExtensions(subject, endEntityOrCA,
                        trustLevel == TrustDomain::TrustAnchor,
-                       requiredKeyUsagesIfPresent,
+                       requiredKeyUsagesIfPresent, requiredEKUIfPresent,
                        subCACount);
   if (rv != Success) {
     return rv;
@@ -223,6 +236,7 @@ BuildForward(TrustDomain& trustDomain,
   for (CERTCertListNode* n = CERT_LIST_HEAD(candidates);
        !CERT_LIST_END(n, candidates); n = CERT_LIST_NEXT(n)) {
     rv = BuildForwardInner(trustDomain, subject, time, endEntityOrCA,
+                           requiredEKUIfPresent,
                            n->cert, subCACount, results);
     if (rv == Success) {
       // We found a trusted issuer. At this point, we know the cert is valid
@@ -240,7 +254,9 @@ SECStatus
 BuildCertChain(TrustDomain& trustDomain,
                CERTCertificate* certToDup,
                PRTime time,
+               EndEntityOrCA endEntityOrCA,
                /*optional*/ KeyUsages requiredKeyUsagesIfPresent,
+               /*optional*/ SECOidTag requiredEKUIfPresent,
                /*out*/ ScopedCERTCertList& results)
 {
   PORT_Assert(certToDup);
@@ -253,14 +269,22 @@ BuildCertChain(TrustDomain& trustDomain,
   // The only non-const operation on the cert we are allowed to do is
   // CERT_DupCertificate.
 
-  BackCert ee(certToDup, nullptr);
-  Result rv = ee.Init();
+  // XXX: Support the legacy use of the subject CN field for indicating the
+  // domain name the certificate is valid for.
+  BackCert::ConstrainedNameOptions cnOptions
+    = endEntityOrCA == MustBeEndEntity &&
+      requiredEKUIfPresent == SEC_OID_EXT_KEY_USAGE_SERVER_AUTH
+    ? BackCert::IncludeCN
+    : BackCert::ExcludeCN;
+
+  BackCert cert(certToDup, nullptr, cnOptions);
+  Result rv = cert.Init();
   if (rv != Success) {
     return SECFailure;
   }
 
-  rv = BuildForward(trustDomain, ee, time, MustBeEndEntity,
-                    requiredKeyUsagesIfPresent,
+  rv = BuildForward(trustDomain, cert, time, endEntityOrCA,
+                    requiredKeyUsagesIfPresent, requiredEKUIfPresent,
                     0, results);
   if (rv != Success) {
     results = nullptr;
@@ -269,7 +293,7 @@ BuildCertChain(TrustDomain& trustDomain,
 
   // Build the cert chain even if the cert is expired, because we would
   // rather report the untrusted issuer error than the expired error.
-  if (CheckTimes(ee.GetNSSCert(), time) != Success) {
+  if (CheckTimes(cert.GetNSSCert(), time) != Success) {
     PR_SetError(SEC_ERROR_EXPIRED_CERTIFICATE, 0);
     return SECFailure;
   }
diff --git a/security/insanity/lib/pkixcheck.cpp b/security/insanity/lib/pkixcheck.cpp
index 1d63e1a508fe..3e1830767290 100644
--- a/security/insanity/lib/pkixcheck.cpp
+++ b/security/insanity/lib/pkixcheck.cpp
@@ -149,12 +149,17 @@ CheckBasicConstraints(const BackCert& cert,
     // CA certificates are not trusted as EE certs.
 
     if (basicConstraints.isCA) {
-      // XXX: We use SEC_ERROR_INADEQUATE_CERT_TYPE here so we can distinguish
+      // XXX: We use SEC_ERROR_CA_CERT_INVALID here so we can distinguish
       // this error from other errors, given that NSS does not have a "CA cert
       // used as end-entity" error code since it doesn't have such a
       // prohibition. We should add such an error code and stop abusing
-      // SEC_ERROR_INADEQUATE_CERT_TYPE this way.
-      return Fail(RecoverableError, SEC_ERROR_INADEQUATE_CERT_TYPE);
+      // SEC_ERROR_CA_CERT_INVALID this way.
+      //
+      // Note, in particular, that this check prevents a delegated OCSP
+      // response signing certificate with the CA bit from successfully
+      // validating when we check it from pkixocsp.cpp, which is a good thing.
+      //
+      return Fail(RecoverableError, SEC_ERROR_CA_CERT_INVALID);
     }
 
     return Success;
@@ -177,6 +182,142 @@ CheckBasicConstraints(const BackCert& cert,
   return Success;
 }
 
+Result
+BackCert::GetConstrainedNames(/*out*/ const CERTGeneralName** result)
+{
+  if (!constrainedNames) {
+    if (!GetArena()) {
+      return FatalError;
+    }
+
+    constrainedNames =
+      CERT_GetConstrainedCertificateNames(nssCert, arena.get(),
+                                          cnOptions == IncludeCN);
+    if (!constrainedNames) {
+      return MapSECStatus(SECFailure);
+    }
+  }
+
+  *result = constrainedNames;
+  return Success;
+}
+
+// 4.2.1.10. Name Constraints
+Result
+CheckNameConstraints(BackCert& cert)
+{
+  if (!cert.encodedNameConstraints) {
+    return Success;
+  }
+
+  PLArenaPool* arena = cert.GetArena();
+  if (!arena) {
+    return FatalError;
+  }
+
+  // Owned by arena
+  const CERTNameConstraints* constraints =
+    CERT_DecodeNameConstraintsExtension(arena, cert.encodedNameConstraints);
+  if (!constraints) {
+    return MapSECStatus(SECFailure);
+  }
+
+  for (BackCert* prev = cert.childCert; prev; prev = prev->childCert) {
+    const CERTGeneralName* names = nullptr;
+    Result rv = prev->GetConstrainedNames(&names);
+    if (rv != Success) {
+      return rv;
+    }
+    PORT_Assert(names);
+    CERTGeneralName* currentName = const_cast<CERTGeneralName*>(names);
+    do {
+      rv = MapSECStatus(CERT_CheckNameSpace(arena, constraints, currentName));
+      if (rv != Success) {
+        return rv;
+      }
+      currentName = CERT_GetNextGeneralName(currentName);
+    } while (currentName != names);
+  }
+
+  return Success;
+}
+
+// 4.2.1.12. Extended Key Usage (id-ce-extKeyUsage)
+// 4.2.1.12. Extended Key Usage (id-ce-extKeyUsage)
+Result
+CheckExtendedKeyUsage(EndEntityOrCA endEntityOrCA, const SECItem* encodedEKUs,
+                      SECOidTag requiredEKU)
+{
+  // TODO: Either do not allow anyExtendedKeyUsage to be passed as requiredEKU,
+  // or require that callers pass anyExtendedKeyUsage instead of
+  // SEC_OID_UNKNWON and disallow SEC_OID_UNKNWON.
+
+  // XXX: We're using SEC_ERROR_INADEQUATE_CERT_TYPE here so that callers can
+  // distinguish EKU mismatch from KU mismatch from basic constraints mismatch.
+  // We should probably add a new error code that is more clear for this type
+  // of problem.
+
+  bool foundOCSPSigning = false;
+
+  if (encodedEKUs) {
+    ScopedPtr<CERTOidSequence, CERT_DestroyOidSequence>
+      seq(CERT_DecodeOidSequence(encodedEKUs));
+    if (!seq) {
+      PR_SetError(SEC_ERROR_INADEQUATE_CERT_TYPE, 0);
+      return RecoverableError;
+    }
+
+    bool found = false;
+
+    // XXX: We allow duplicate entries.
+    for (const SECItem* const* oids = seq->oids; oids && *oids; ++oids) {
+      SECOidTag oidTag = SECOID_FindOIDTag(*oids);
+      if (requiredEKU != SEC_OID_UNKNOWN && oidTag == requiredEKU) {
+        found = true;
+      }
+      if (oidTag == SEC_OID_OCSP_RESPONDER) {
+        foundOCSPSigning = true;
+      }
+    }
+
+    // If the EKU extension was included, then the required EKU must be in the
+    // list.
+    if (!found) {
+      PR_SetError(SEC_ERROR_INADEQUATE_CERT_TYPE, 0);
+      return RecoverableError;
+    }
+  }
+
+  // pkixocsp.cpp depends on the following additional checks.
+
+  if (foundOCSPSigning) {
+    // When validating anything other than an delegated OCSP signing cert,
+    // reject any cert that also claims to be an OCSP responder, because such
+    // a cert does not make sense. For example, if an SSL certificate were to
+    // assert id-kp-OCSPSigning then it could sign OCSP responses for itself,
+    // if not for this check.
+    if (requiredEKU != SEC_OID_OCSP_RESPONDER) {
+      PR_SetError(SEC_ERROR_INADEQUATE_CERT_TYPE, 0);
+      return RecoverableError;
+    }
+  } else if (requiredEKU == SEC_OID_OCSP_RESPONDER &&
+             endEntityOrCA == MustBeEndEntity) {
+    // http://tools.ietf.org/html/rfc6960#section-4.2.2.2:
+    // "OCSP signing delegation SHALL be designated by the inclusion of
+    // id-kp-OCSPSigning in an extended key usage certificate extension
+    // included in the OCSP response signer's certificate."
+    //
+    // id-kp-OCSPSigning is the only EKU that isn't implicitly assumed when the
+    // EKU extension is missing from an end-entity certificate. However, any CA
+    // certificate can issue a delegated OCSP response signing certificate, so
+    // we can't require the EKU be explicitly included for CA certificates.
+    PR_SetError(SEC_ERROR_INADEQUATE_CERT_TYPE, 0);
+    return RecoverableError;
+  }
+
+  return Success;
+}
+
 // Checks extensions that apply to both EE and intermediate certs,
 // except for AIA, CRL, and AKI/SKI, which are handled elsewhere.
 Result
@@ -184,6 +325,7 @@ CheckExtensions(BackCert& cert,
                 EndEntityOrCA endEntityOrCA,
                 bool isTrustAnchor,
                 KeyUsages requiredKeyUsagesIfPresent,
+                SECOidTag requiredEKUIfPresent,
                 unsigned int subCACount)
 {
   // 4.2.1.1. Authority Key Identifier dealt with as part of path building
@@ -220,7 +362,14 @@ CheckExtensions(BackCert& cert,
 
   // 4.2.1.10. Name Constraints
   // 4.2.1.11. Policy Constraints
+
   // 4.2.1.12. Extended Key Usage
+  rv = CheckExtendedKeyUsage(endEntityOrCA, cert.encodedExtendedKeyUsage,
+                             requiredEKUIfPresent);
+  if (rv != Success) {
+    return rv;
+  }
+
   // 4.2.1.13. CRL Distribution Points will be dealt with elsewhere
   // 4.2.1.14. Inhibit anyPolicy
 
diff --git a/security/insanity/lib/pkixcheck.h b/security/insanity/lib/pkixcheck.h
index ad6aa34c828b..b21c0bb8c6c1 100644
--- a/security/insanity/lib/pkixcheck.h
+++ b/security/insanity/lib/pkixcheck.h
@@ -29,8 +29,11 @@ Result CheckExtensions(BackCert& certExt,
                        EndEntityOrCA endEntityOrCA,
                        bool isTrustAnchor,
                        KeyUsages requiredKeyUsagesIfPresent,
+                       SECOidTag requiredEKUIfPresent,
                        unsigned int depth);
 
+Result CheckNameConstraints(BackCert& cert);
+
 } } // namespace insanity::pkix
 
 #endif // insanity__pkixcheck_h
diff --git a/security/insanity/lib/pkixutil.h b/security/insanity/lib/pkixutil.h
index 1b2e1372e189..4a55f3223eb5 100644
--- a/security/insanity/lib/pkixutil.h
+++ b/security/insanity/lib/pkixutil.h
@@ -81,24 +81,42 @@ MapSECStatus(SECStatus srv)
 class BackCert
 {
 public:
+  // ExcludeCN means that GetConstrainedNames won't include the subject CN in
+  // its results. IncludeCN means that GetConstrainedNames will include the
+  // subject CN in its results.
+  enum ConstrainedNameOptions { ExcludeCN = 0, IncludeCN = 1 };
+
   // nssCert and childCert must be valid for the lifetime of BackCert
-  BackCert(CERTCertificate* nssCert, BackCert* childCert)
+  BackCert(CERTCertificate* nssCert, BackCert* childCert,
+           ConstrainedNameOptions cnOptions)
     : encodedBasicConstraints(nullptr)
+    , encodedExtendedKeyUsage(nullptr)
     , encodedKeyUsage(nullptr)
+    , encodedNameConstraints(nullptr)
     , childCert(childCert)
     , nssCert(nssCert)
+    , constrainedNames(nullptr)
+    , cnOptions(cnOptions)
   {
   }
 
   Result Init();
 
   const SECItem* encodedBasicConstraints;
+  const SECItem* encodedExtendedKeyUsage;
   const SECItem* encodedKeyUsage;
+  const SECItem* encodedNameConstraints;
 
   BackCert* const childCert;
 
   const CERTCertificate* GetNSSCert() const { return nssCert; }
 
+  // Returns the names that should be considered when evaluating name
+  // constraints. The list is constructed lazily and cached. The result is a
+  // weak reference; do not try to free it, and do not hold long-lived
+  // references to it.
+  Result GetConstrainedNames(/*out*/ const CERTGeneralName** result);
+
   // This is the only place where we should be dealing with non-const
   // CERTCertificates.
   Result PrependNSSCertToList(CERTCertList* results);
@@ -109,6 +127,8 @@ private:
   CERTCertificate* nssCert;
 
   ScopedPLArenaPool arena;
+  CERTGeneralName* constrainedNames;
+  ConstrainedNameOptions cnOptions;
 
   BackCert(const BackCert&) /* = delete */;
   void operator=(const BackCert&); /* = delete */;
diff --git a/security/manager/boot/src/nsSiteSecurityService.cpp b/security/manager/boot/src/nsSiteSecurityService.cpp
index e5734b4e7e01..409a30bb02c9 100644
--- a/security/manager/boot/src/nsSiteSecurityService.cpp
+++ b/security/manager/boot/src/nsSiteSecurityService.cpp
@@ -460,6 +460,12 @@ nsSiteSecurityService::IsSecureURI(uint32_t aType, nsIURI* aURI,
     return NS_OK;
   }
 
+  // Holepunch chart.apis.google.com and subdomains.
+  if (host.Equals(NS_LITERAL_CSTRING("chart.apis.google.com")) ||
+      StringEndsWith(host, NS_LITERAL_CSTRING(".chart.apis.google.com"))) {
+    return NS_OK;
+  }
+
   const nsSTSPreload *preload = nullptr;
   nsSSSHostEntry *pbEntry = nullptr;
 
diff --git a/security/manager/ssl/src/SSLServerCertVerification.cpp b/security/manager/ssl/src/SSLServerCertVerification.cpp
index 908d9dd1fed4..f215813635be 100644
--- a/security/manager/ssl/src/SSLServerCertVerification.cpp
+++ b/security/manager/ssl/src/SSLServerCertVerification.cpp
@@ -744,6 +744,8 @@ AuthCertificate(CertVerifier& certVerifier, TransportSecurityInfo* infoObject,
 
   SECStatus rv;
 
+  // TODO: Remove this after we switch to insanity::pkix as the
+  // only option
   if (stapledOCSPResponse) {
     CERTCertDBHandle* handle = CERT_GetDefaultCertDB();
     rv = CERT_CacheOCSPResponseFromSideChannel(handle, cert, PR_Now(),
@@ -921,6 +923,12 @@ SSLServerCertVerificationJob::Run()
         failureTelemetry
           = Telemetry::SSL_INITIAL_FAILED_CERT_VALIDATION_TIME_CLASSIC;
         break;
+      case CertVerifier::insanity:
+        successTelemetry
+          = Telemetry::SSL_SUCCESFUL_CERT_VALIDATION_TIME_INSANITY;
+        failureTelemetry
+          = Telemetry::SSL_INITIAL_FAILED_CERT_VALIDATION_TIME_INSANITY;
+        break;
 #ifndef NSS_NO_LIBPKIX
       case CertVerifier::libpkix:
         successTelemetry
diff --git a/security/manager/ssl/src/SharedCertVerifier.h b/security/manager/ssl/src/SharedCertVerifier.h
index 04576752d35b..c9b108f58f04 100644
--- a/security/manager/ssl/src/SharedCertVerifier.h
+++ b/security/manager/ssl/src/SharedCertVerifier.h
@@ -15,10 +15,17 @@ class SharedCertVerifier : public mozilla::psm::CertVerifier,
                            public mozilla::AtomicRefCounted<SharedCertVerifier>
 {
 public:
-  SharedCertVerifier(implementation_config ic, missing_cert_download_config ac,
-                     crl_download_config cdc, ocsp_download_config odc,
-                     ocsp_strict_config osc, ocsp_get_config ogc)
-    : mozilla::psm::CertVerifier(ic, ac, cdc, odc, osc, ogc)
+  SharedCertVerifier(implementation_config ic,
+#ifndef NSS_NO_LIBPKIX
+                     missing_cert_download_config ac, crl_download_config cdc,
+#endif
+                     ocsp_download_config odc, ocsp_strict_config osc,
+                     ocsp_get_config ogc)
+    : mozilla::psm::CertVerifier(ic,
+#ifndef NSS_NO_LIBPKIX
+                                 ac, cdc,
+#endif
+                                 odc, osc, ogc)
   {
   }
   ~SharedCertVerifier();
diff --git a/security/manager/ssl/src/nsNSSCertificateDB.cpp b/security/manager/ssl/src/nsNSSCertificateDB.cpp
index 3323b7f9de66..d7a3c92e6ce8 100644
--- a/security/manager/ssl/src/nsNSSCertificateDB.cpp
+++ b/security/manager/ssl/src/nsNSSCertificateDB.cpp
@@ -1738,8 +1738,7 @@ nsNSSCertificateDB::VerifyCertNow(nsIX509Cert* aCert,
                                  nullptr, // Assume no context
                                  aFlags,
                                  &resultChain,
-                                 &evOidPolicy,
-                                 nullptr);
+                                 &evOidPolicy);
 
   PRErrorCode error = PR_GetError();
 
diff --git a/security/manager/ssl/src/nsNSSComponent.cpp b/security/manager/ssl/src/nsNSSComponent.cpp
index 18694d0a824d..a982591ef3a6 100644
--- a/security/manager/ssl/src/nsNSSComponent.cpp
+++ b/security/manager/ssl/src/nsNSSComponent.cpp
@@ -940,9 +940,6 @@ CipherSuiteChangeObserver::Observe(nsISupports* aSubject,
 void nsNSSComponent::setValidationOptions(bool isInitialSetting,
                                           const MutexAutoLock& lock)
 {
-  bool crlDownloading = Preferences::GetBool("security.CRL_download.enabled",
-                                             false);
-
   // This preference controls whether we do OCSP fetching and does not affect
   // OCSP stapling.
   // 0 = disabled, 1 = enabled
@@ -959,9 +956,13 @@ void nsNSSComponent::setValidationOptions(bool isInitialSetting,
     Telemetry::Accumulate(Telemetry::CERT_OCSP_REQUIRED, ocspRequired);
   }
 
-  bool aiaDownloadEnabled = Preferences::GetBool("security.missing_cert_download.enabled",
-                                                 false);
+#ifndef NSS_NO_LIBPKIX
+  bool crlDownloading = Preferences::GetBool("security.CRL_download.enabled",
+                                             false);
+  bool aiaDownloadEnabled =
+    Preferences::GetBool("security.missing_cert_download.enabled", false);
 
+#endif
   bool ocspStaplingEnabled = Preferences::GetBool("security.ssl.enable_ocsp_stapling",
                                                   true);
   PublicSSLState()->SetOCSPStaplingEnabled(ocspStaplingEnabled);
@@ -970,11 +971,16 @@ void nsNSSComponent::setValidationOptions(bool isInitialSetting,
   CertVerifier::implementation_config certVerifierImplementation
     = CertVerifier::classic;
 
+  // The insanity::pkix pref overrides the libpkix pref
+  if (Preferences::GetBool("security.use_insanity_verification", false)) {
+    certVerifierImplementation = CertVerifier::insanity;
+  } else {
 #ifndef NSS_NO_LIBPKIX
   if (Preferences::GetBool("security.use_libpkix_verification", false)) {
     certVerifierImplementation = CertVerifier::libpkix;
   }
 #endif
+  }
 
   CertVerifier::ocsp_download_config odc;
   CertVerifier::ocsp_strict_config osc;
@@ -983,11 +989,15 @@ void nsNSSComponent::setValidationOptions(bool isInitialSetting,
   SetClassicOCSPBehaviorFromPrefs(&odc, &osc, &ogc, lock);
   mDefaultCertVerifier = new SharedCertVerifier(
       certVerifierImplementation,
+#ifndef NSS_NO_LIBPKIX
       aiaDownloadEnabled ?
         CertVerifier::missing_cert_download_on : CertVerifier::missing_cert_download_off,
       crlDownloading ?
         CertVerifier::crl_download_allowed : CertVerifier::crl_local_only,
+#endif
       odc, osc, ogc);
+
+  CERT_ClearOCSPCache();
 }
 
 // Enable the TLS versions given in the prefs, defaulting to SSL 3.0 (min
@@ -1594,7 +1604,9 @@ nsNSSComponent::Observe(nsISupports* aSubject, const char* aTopic,
                || prefName.Equals("security.missing_cert_download.enabled")
                || prefName.Equals("security.OCSP.require")
                || prefName.Equals("security.OCSP.GET.enabled")
-               || prefName.Equals("security.ssl.enable_ocsp_stapling")) {
+               || prefName.Equals("security.ssl.enable_ocsp_stapling")
+               || prefName.Equals("security.use_insanity_verification")
+               || prefName.Equals("security.use_libpkix_verification")) {
       MutexAutoLock lock(mutex);
       setValidationOptions(false, lock);
     } else if (prefName.Equals("network.ntlm.send-lm-response")) {
diff --git a/security/manager/ssl/src/nsUsageArrayHelper.cpp b/security/manager/ssl/src/nsUsageArrayHelper.cpp
index 5fdd02e92201..7f7249f7543b 100644
--- a/security/manager/ssl/src/nsUsageArrayHelper.cpp
+++ b/security/manager/ssl/src/nsUsageArrayHelper.cpp
@@ -83,9 +83,6 @@ nsUsageArrayHelper::check(uint32_t previousCheckResult,
   case certificateUsageSSLServer:
     typestr = "VerifySSLServer";
     break;
-  case certificateUsageSSLServerWithStepUp:
-    typestr = "VerifySSLStepUp";
-    break;
   case certificateUsageEmailSigner:
     typestr = "VerifyEmailSigner";
     break;
@@ -95,12 +92,6 @@ nsUsageArrayHelper::check(uint32_t previousCheckResult,
   case certificateUsageObjectSigner:
     typestr = "VerifyObjSign";
     break;
-  case certificateUsageProtectedObjectSigner:
-    typestr = "VerifyProtectObjSign";
-    break;
-  case certificateUsageUserCertImport:
-    typestr = "VerifyUserImport";
-    break;
   case certificateUsageSSLCA:
     typestr = "VerifySSLCA";
     break;
@@ -110,9 +101,6 @@ nsUsageArrayHelper::check(uint32_t previousCheckResult,
   case certificateUsageStatusResponder:
     typestr = "VerifyStatusResponder";
     break;
-  case certificateUsageAnyCA:
-    typestr = "VerifyAnyCA";
-    break;
   default:
     MOZ_CRASH("unknown cert usage passed to check()");
   }
@@ -159,6 +147,7 @@ nsUsageArrayHelper::verifyFailed(uint32_t *_verified, int err)
   /* For these cases, verify only failed for the particular usage */
   case SEC_ERROR_INADEQUATE_KEY_USAGE:
   case SEC_ERROR_INADEQUATE_CERT_TYPE:
+  case SEC_ERROR_CA_CERT_INVALID:
     *_verified = nsNSSCertificate::USAGE_NOT_ALLOWED; break;
   /* These are the cases that have individual error messages */
   case SEC_ERROR_REVOKED_CERTIFICATE:
@@ -220,25 +209,10 @@ nsUsageArrayHelper::GetUsagesArray(const char *suffix,
                  certificateUsageEmailRecipient, now, flags, count, outUsages);
   result = check(result, suffix, certVerifier,
                  certificateUsageObjectSigner, now, flags, count, outUsages);
-#if 0
-  result = check(result, suffix, certVerifier,
-                 certificateUsageProtectedObjectSigner, now, flags, count,
-                 outUsages);
-  result = check(result, suffix, certVerifier,
-                 certificateUsageUserCertImport, now, flags, count, outUsages);
-#endif
   result = check(result, suffix, certVerifier,
                  certificateUsageSSLCA, now, flags, count, outUsages);
-#if 0
-  result = check(result, suffix, certVerifier,
-                 certificateUsageVerifyCA, now, flags, count, outUsages);
-#endif
   result = check(result, suffix, certVerifier,
                  certificateUsageStatusResponder, now, flags, count, outUsages);
-#if 0
-  result = check(result, suffix, certVerifier,
-                 certificateUsageAnyCA, now, flags, count, outUsages);
-#endif
 
   if (isFatalError(result) || count == 0) {
     MOZ_ASSERT(result != nsIX509Cert::VERIFIED_OK);
diff --git a/security/manager/ssl/tests/unit/head_psm.js b/security/manager/ssl/tests/unit/head_psm.js
index af4aeaf25dd1..ff4c49e070cc 100644
--- a/security/manager/ssl/tests/unit/head_psm.js
+++ b/security/manager/ssl/tests/unit/head_psm.js
@@ -36,19 +36,15 @@ const SEC_ERROR_OCSP_UNAUTHORIZED_RESPONSE              = SEC_ERROR_BASE + 130;
 const SEC_ERROR_OCSP_OLD_RESPONSE                       = SEC_ERROR_BASE + 132;
 const SEC_ERROR_OCSP_INVALID_SIGNING_CERT               = SEC_ERROR_BASE + 144;
 
-// Certificate Usages
+// Supported Certificate Usages
 const certificateUsageSSLClient              = 0x0001;
 const certificateUsageSSLServer              = 0x0002;
-const certificateUsageSSLServerWithStepUp    = 0x0004;
 const certificateUsageSSLCA                  = 0x0008;
 const certificateUsageEmailSigner            = 0x0010;
 const certificateUsageEmailRecipient         = 0x0020;
 const certificateUsageObjectSigner           = 0x0040;
-const certificateUsageUserCertImport         = 0x0080;
 const certificateUsageVerifyCA               = 0x0100;
-const certificateUsageProtectedObjectSigner  = 0x0200;
 const certificateUsageStatusResponder        = 0x0400;
-const certificateUsageAnyCA                  = 0x0800;
 
 const NO_FLAGS = 0;
 
diff --git a/security/manager/ssl/tests/unit/test_ev_certs/cert8.db b/security/manager/ssl/tests/unit/test_ev_certs/cert8.db
index 4ed96b98208c..226f654774ea 100644
Binary files a/security/manager/ssl/tests/unit/test_ev_certs/cert8.db and b/security/manager/ssl/tests/unit/test_ev_certs/cert8.db differ
diff --git a/security/manager/ssl/tests/unit/test_ev_certs/ev-valid.der b/security/manager/ssl/tests/unit/test_ev_certs/ev-valid.der
index 02d7aa80b101..a046525fc039 100644
Binary files a/security/manager/ssl/tests/unit/test_ev_certs/ev-valid.der and b/security/manager/ssl/tests/unit/test_ev_certs/ev-valid.der differ
diff --git a/security/manager/ssl/tests/unit/test_ev_certs/generate.py b/security/manager/ssl/tests/unit/test_ev_certs/generate.py
index d640b7803b1a..f09b854c7ae8 100755
--- a/security/manager/ssl/tests/unit/test_ev_certs/generate.py
+++ b/security/manager/ssl/tests/unit/test_ev_certs/generate.py
@@ -21,8 +21,7 @@ EE_basic_constraints = "basicConstraints = CA:FALSE\n"
 EE_full_ku = ("keyUsage = digitalSignature, nonRepudiation, keyEncipherment, " +
               " dataEncipherment, keyAgreement, keyCertSign, cRLSign\n")
 
-CA_eku = ("extendedKeyUsage = critical, serverAuth, clientAuth, " +
-          "1.3.6.1.5.5.7.3.9\n")
+CA_eku = ("extendedKeyUsage = critical, serverAuth, clientAuth\n")
 Server_eku = "extendedKeyUsage = critical, serverAuth, clientAuth\n"
 
 authority_key_ident = "authorityKeyIdentifier = keyid, issuer\n"
diff --git a/security/manager/ssl/tests/unit/test_ev_certs/int-ev-valid.der b/security/manager/ssl/tests/unit/test_ev_certs/int-ev-valid.der
index b2bd73d86a94..c7c60fa406cd 100644
Binary files a/security/manager/ssl/tests/unit/test_ev_certs/int-ev-valid.der and b/security/manager/ssl/tests/unit/test_ev_certs/int-ev-valid.der differ
diff --git a/security/manager/ssl/tests/unit/test_ev_certs/int-ev-valid.p12 b/security/manager/ssl/tests/unit/test_ev_certs/int-ev-valid.p12
index b7ed643442f3..e0d5e73f8f14 100644
Binary files a/security/manager/ssl/tests/unit/test_ev_certs/int-ev-valid.p12 and b/security/manager/ssl/tests/unit/test_ev_certs/int-ev-valid.p12 differ
diff --git a/security/manager/ssl/tests/unit/test_ev_certs/int-non-ev-root.der b/security/manager/ssl/tests/unit/test_ev_certs/int-non-ev-root.der
index d03e2a56b86b..ad245b2e0453 100644
Binary files a/security/manager/ssl/tests/unit/test_ev_certs/int-non-ev-root.der and b/security/manager/ssl/tests/unit/test_ev_certs/int-non-ev-root.der differ
diff --git a/security/manager/ssl/tests/unit/test_ev_certs/int-non-ev-root.p12 b/security/manager/ssl/tests/unit/test_ev_certs/int-non-ev-root.p12
index 801d2841ae7c..7377f689a24b 100644
Binary files a/security/manager/ssl/tests/unit/test_ev_certs/int-non-ev-root.p12 and b/security/manager/ssl/tests/unit/test_ev_certs/int-non-ev-root.p12 differ
diff --git a/security/manager/ssl/tests/unit/test_ev_certs/key3.db b/security/manager/ssl/tests/unit/test_ev_certs/key3.db
index 48e7fc98d47a..974fc126ac56 100644
Binary files a/security/manager/ssl/tests/unit/test_ev_certs/key3.db and b/security/manager/ssl/tests/unit/test_ev_certs/key3.db differ
diff --git a/security/manager/ssl/tests/unit/test_ev_certs/no-ocsp-url-cert.der b/security/manager/ssl/tests/unit/test_ev_certs/no-ocsp-url-cert.der
index e0a507cff5a6..eb6b1ccb84cc 100644
Binary files a/security/manager/ssl/tests/unit/test_ev_certs/no-ocsp-url-cert.der and b/security/manager/ssl/tests/unit/test_ev_certs/no-ocsp-url-cert.der differ
diff --git a/security/manager/ssl/tests/unit/test_ev_certs/non-ev-root.der b/security/manager/ssl/tests/unit/test_ev_certs/non-ev-root.der
index c0680882c567..6907db91afdd 100644
Binary files a/security/manager/ssl/tests/unit/test_ev_certs/non-ev-root.der and b/security/manager/ssl/tests/unit/test_ev_certs/non-ev-root.der differ
diff --git a/security/manager/ssl/tests/unit/test_ev_certs/non-evroot-ca.der b/security/manager/ssl/tests/unit/test_ev_certs/non-evroot-ca.der
index b6d7b3147b13..32257c7f656f 100644
Binary files a/security/manager/ssl/tests/unit/test_ev_certs/non-evroot-ca.der and b/security/manager/ssl/tests/unit/test_ev_certs/non-evroot-ca.der differ
diff --git a/security/manager/ssl/tests/unit/test_ev_certs/non-evroot-ca.p12 b/security/manager/ssl/tests/unit/test_ev_certs/non-evroot-ca.p12
index 70f46e346b4f..09920a30db25 100644
Binary files a/security/manager/ssl/tests/unit/test_ev_certs/non-evroot-ca.p12 and b/security/manager/ssl/tests/unit/test_ev_certs/non-evroot-ca.p12 differ
diff --git a/security/manager/ssl/tests/unit/test_getchain/ca-1.der b/security/manager/ssl/tests/unit/test_getchain/ca-1.der
index 3c8ad402598e..f3a60fe5f328 100644
Binary files a/security/manager/ssl/tests/unit/test_getchain/ca-1.der and b/security/manager/ssl/tests/unit/test_getchain/ca-1.der differ
diff --git a/security/manager/ssl/tests/unit/test_getchain/ca-2.der b/security/manager/ssl/tests/unit/test_getchain/ca-2.der
index f9f6ed8d240a..3e1b64df39c0 100644
Binary files a/security/manager/ssl/tests/unit/test_getchain/ca-2.der and b/security/manager/ssl/tests/unit/test_getchain/ca-2.der differ
diff --git a/security/manager/ssl/tests/unit/test_getchain/ee.der b/security/manager/ssl/tests/unit/test_getchain/ee.der
index 87977ef1c294..47a0f28bece2 100644
Binary files a/security/manager/ssl/tests/unit/test_getchain/ee.der and b/security/manager/ssl/tests/unit/test_getchain/ee.der differ
diff --git a/security/manager/ssl/tests/unit/test_getchain/generate.py b/security/manager/ssl/tests/unit/test_getchain/generate.py
index b681855848be..5feaf6621e73 100755
--- a/security/manager/ssl/tests/unit/test_getchain/generate.py
+++ b/security/manager/ssl/tests/unit/test_getchain/generate.py
@@ -26,7 +26,7 @@ CA_full_ku = ("keyUsage = digitalSignature, nonRepudiation, keyEncipherment, " +
               "dataEncipherment, keyAgreement, keyCertSign, cRLSign\n")
 
 CA_eku = ("extendedKeyUsage = critical, serverAuth, clientAuth, " +
-          "emailProtection, codeSigning, 1.3.6.1.5.5.7.3.9\n")
+          "emailProtection, codeSigning\n")
 
 authority_key_ident = "authorityKeyIdentifier = keyid, issuer\n"
 subject_key_ident = "subjectKeyIdentifier = hash\n"
diff --git a/security/manager/ssl/tests/unit/test_sts_holepunch.js b/security/manager/ssl/tests/unit/test_sts_holepunch.js
new file mode 100644
index 000000000000..951662fb4616
--- /dev/null
+++ b/security/manager/ssl/tests/unit/test_sts_holepunch.js
@@ -0,0 +1,36 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+"use strict";
+
+// bug 961528: chart.apis.google.com doesn't handle https. Check that
+// it isn't considered HSTS (other example.apis.google.com hosts should be
+// HSTS as long as they're on the preload list, however).
+function run_test() {
+  let SSService = Cc["@mozilla.org/ssservice;1"]
+                    .getService(Ci.nsISiteSecurityService);
+  do_check_false(SSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "chart.apis.google.com", 0));
+  do_check_false(SSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "CHART.APIS.GOOGLE.COM", 0));
+  do_check_false(SSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "sub.chart.apis.google.com", 0));
+  do_check_false(SSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "SUB.CHART.APIS.GOOGLE.COM", 0));
+  do_check_true(SSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                       "example.apis.google.com", 0));
+  do_check_true(SSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                       "EXAMPLE.APIS.GOOGLE.COM", 0));
+  do_check_true(SSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                       "sub.example.apis.google.com", 0));
+  do_check_true(SSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                       "SUB.EXAMPLE.APIS.GOOGLE.COM", 0));
+  // also check isSecureURI
+  let chartURI = Services.io.newURI("http://chart.apis.google.com", null, null);
+  do_check_false(SSService.isSecureURI(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                       chartURI, 0));
+  let otherURI = Services.io.newURI("http://other.apis.google.com", null, null);
+  do_check_true(SSService.isSecureURI(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                      otherURI, 0));
+}
diff --git a/security/manager/ssl/tests/unit/xpcshell.ini b/security/manager/ssl/tests/unit/xpcshell.ini
index 6103a469cea8..41f08c9aa79a 100644
--- a/security/manager/ssl/tests/unit/xpcshell.ini
+++ b/security/manager/ssl/tests/unit/xpcshell.ini
@@ -29,6 +29,7 @@ skip-if = os == "android"
 skip-if = os == "android"
 [test_sts_preloadlist_perwindowpb.js]
 [test_sts_preloadlist_selfdestruct.js]
+[test_sts_holepunch.js]
 [test_ocsp_stapling.js]
 run-sequentially = hardcoded ports
 # Bug 676972: test fails consistently on Android
diff --git a/services/common/tests/unit/head_helpers.js b/services/common/tests/unit/head_helpers.js
index 3f9f5e11e34f..bfd56fc2dcae 100644
--- a/services/common/tests/unit/head_helpers.js
+++ b/services/common/tests/unit/head_helpers.js
@@ -173,11 +173,16 @@ function uninstallFakePAC() {
   Cm.nsIComponentRegistrar.unregisterFactory(CID, PACSystemSettings);
 }
 
-// We want to ensure the legacy provider is used for most of these tests; the
-// tests that know how to deal with the Firefox Accounts identity hack things
-// to ensure that still works.
+// We want to ensure the legacy provider is used for most of these tests,
+// including after a service.startOver.  The tests that know how to deal with
+// the Firefox Accounts identity hack things to ensure that still works.
 function setDefaultIdentityConfig() {
   Cu.import("resource://gre/modules/Services.jsm");
   Services.prefs.setBoolPref("services.sync.fxaccounts.enabled", false);
+  Services.prefs.setBoolPref("services.sync-testing.startOverKeepIdentity", true);
+  do_register_cleanup(function() {
+    Services.prefs.clearUserPref("services.sync.fxaccounts.enabled");
+    Services.prefs.clearUserPref("services.sync-testing.startOverKeepIdentity");
+  });
 }
 setDefaultIdentityConfig();
diff --git a/services/sync/Weave.js b/services/sync/Weave.js
index 271865da9bda..6626d5d0cfbe 100644
--- a/services/sync/Weave.js
+++ b/services/sync/Weave.js
@@ -106,10 +106,10 @@ WeaveService.prototype = {
       fxAccountsEnabled = !prefs.prefHasUserValue("username");
       Services.prefs.setBoolPref("services.sync.fxaccounts.enabled", fxAccountsEnabled);
     }
-    // Currently we don't support toggling this pref after initialization, so
-    // inject the pref value as a regular boolean.
-    delete this.fxAccountsEnabled;
-    return this.fxAccountsEnabled = fxAccountsEnabled;
+    // Currently we don't support toggling this pref after initialization -
+    // except when sync is reset - but this 1 exception is enough that we can't
+    // cache the value.
+    return fxAccountsEnabled;
   },
 
   observe: function (subject, topic, data) {
diff --git a/services/sync/modules/browserid_identity.js b/services/sync/modules/browserid_identity.js
index 8116317fe5c7..7d8f6e38ffcd 100644
--- a/services/sync/modules/browserid_identity.js
+++ b/services/sync/modules/browserid_identity.js
@@ -237,8 +237,7 @@ this.BrowserIDManager.prototype = {
    * username is derived from account.
    *
    * Changing the account name has the side-effect of wiping out stored
-   * credentials. Keep in mind that persistCredentials() will need to be called
-   * to flush the changes to disk.
+   * credentials.
    *
    * Set this value to null to clear out identity information.
    */
diff --git a/services/sync/modules/engines/passwords.js b/services/sync/modules/engines/passwords.js
index 42b6e9cc29e1..f195b3132d8b 100644
--- a/services/sync/modules/engines/passwords.js
+++ b/services/sync/modules/engines/passwords.js
@@ -40,18 +40,30 @@ PasswordEngine.prototype = {
     SyncEngine.prototype._syncFinish.call(this);
 
     // Delete the weave credentials from the server once
-    if (!Svc.Prefs.get("deletePwd", false)) {
+    if (!Svc.Prefs.get("deletePwdFxA", false)) {
       try {
-        let ids = Services.logins.findLogins({}, PWDMGR_HOST, "", "")
-                          .map(function(info) {
-          return info.QueryInterface(Components.interfaces.nsILoginMetaInfo).guid;
-        });
-        let coll = new Collection(this.engineURL, null, this.service);
-        coll.ids = ids;
-        let ret = coll.delete();
-        this._log.debug("Delete result: " + ret);
-
-        Svc.Prefs.set("deletePwd", true);
+        let ids = [];
+        for (let host of Utils.getSyncCredentialsHosts()) {
+          for (let info of Services.logins.findLogins({}, host, "", "")) {
+            ids.push(info.QueryInterface(Components.interfaces.nsILoginMetaInfo).guid);
+          }
+        }
+        if (ids.length) {
+          let coll = new Collection(this.engineURL, null, this.service);
+          coll.ids = ids;
+          let ret = coll.delete();
+          this._log.debug("Delete result: " + ret);
+          if (!ret.success && ret.status != 400) {
+            // A non-400 failure means try again next time.
+            return;
+          }
+        } else {
+          this._log.debug("Didn't find any passwords to delete");
+        }
+        // If there were no ids to delete, or we succeeded, or got a 400,
+        // record success.
+        Svc.Prefs.set("deletePwdFxA", true);
+        Svc.Prefs.reset("deletePwd"); // The old prefname we previously used.
       }
       catch(ex) {
         this._log.debug("Password deletes failed: " + Utils.exceptionStr(ex));
@@ -150,8 +162,9 @@ PasswordStore.prototype = {
     for (let i = 0; i < logins.length; i++) {
       // Skip over Weave password/passphrase entries
       let metaInfo = logins[i].QueryInterface(Ci.nsILoginMetaInfo);
-      if (metaInfo.hostname == PWDMGR_HOST)
+      if (Utils.getSyncCredentialsHosts().has(metaInfo.hostname)) {
         continue;
+      }
 
       items[metaInfo.guid] = metaInfo;
     }
@@ -288,7 +301,7 @@ PasswordTracker.prototype = {
       case "removeLogin":
         // Skip over Weave password/passphrase changes.
         subject.QueryInterface(Ci.nsILoginMetaInfo).QueryInterface(Ci.nsILoginInfo);
-        if (subject.hostname == PWDMGR_HOST) {
+        if (Utils.getSyncCredentialsHosts().has(subject.hostname)) {
           break;
         }
 
diff --git a/services/sync/modules/identity.js b/services/sync/modules/identity.js
index ee51d6ac432c..f1ffbf1a867e 100644
--- a/services/sync/modules/identity.js
+++ b/services/sync/modules/identity.js
@@ -448,9 +448,11 @@ IdentityManager.prototype = {
    * Deletes Sync credentials from the password manager.
    */
   deleteSyncCredentials: function deleteSyncCredentials() {
-    let logins = Services.logins.findLogins({}, PWDMGR_HOST, "", "");
-    for each (let login in logins) {
-      Services.logins.removeLogin(login);
+    for (let host of Utils.getSyncCredentialsHosts()) {
+      let logins = Services.logins.findLogins({}, host, "", "");
+      for each (let login in logins) {
+        Services.logins.removeLogin(login);
+      }
     }
 
     // Wait until after store is updated in case it fails.
diff --git a/services/sync/modules/service.js b/services/sync/modules/service.js
index 9e4c490664f2..54b1f1f3d21e 100644
--- a/services/sync/modules/service.js
+++ b/services/sync/modules/service.js
@@ -889,7 +889,32 @@ Sync11Service.prototype = {
 
     this.identity.deleteSyncCredentials();
 
-    Svc.Obs.notify("weave:service:start-over:finish");
+    // If necessary, reset the identity manager, then re-initialize it so the
+    // FxA manager is used.  This is configurable via a pref - mainly for tests.
+    let keepIdentity = false;
+    try {
+      keepIdentity = Services.prefs.getBoolPref("services.sync-testing.startOverKeepIdentity");
+    } catch (_) { /* no such pref */ }
+    if (keepIdentity) {
+      Svc.Obs.notify("weave:service:start-over:finish");
+      return;
+    }
+
+    this.identity.username = "";
+    Services.prefs.clearUserPref("services.sync.fxaccounts.enabled");
+    this.status.__authManager = null;
+    this.identity = Status._authManager;
+    this._clusterManager = this.identity.createClusterManager(this);
+
+    // Tell the new identity manager to initialize itself
+    this.identity.initialize().then(() => {
+      Svc.Obs.notify("weave:service:start-over:finish");
+    }).then(null, err => {
+      this._log.error("startOver failed to re-initialize the identity manager: " + err);
+      // Still send the observer notification so the current state is
+      // reflected in the UI.
+      Svc.Obs.notify("weave:service:start-over:finish");
+    });
   },
 
   persistLogin: function persistLogin() {
diff --git a/services/sync/modules/util.js b/services/sync/modules/util.js
index 52fbd38f5d10..c857863452c4 100644
--- a/services/sync/modules/util.js
+++ b/services/sync/modules/util.js
@@ -601,6 +601,38 @@ this.Utils = {
     return Math.max(Math.min(backoffInterval, MAXIMUM_BACKOFF_INTERVAL),
                     statusInterval);
   },
+
+  /**
+   * Return a set of hostnames (including the protocol) which may have
+   * credentials for sync itself stored in the login manager.
+   *
+   * In general, these hosts will not have their passwords synced, will be
+   * reset when we drop sync credentials, etc.
+   */
+  getSyncCredentialsHosts: function() {
+    // This is somewhat expensive and the result static, so we cache the result.
+    if (this._syncCredentialsHosts) {
+      return this._syncCredentialsHosts;
+    }
+    let result = new Set();
+    // the legacy sync host.
+    result.add(PWDMGR_HOST);
+    // The FxA hosts - these almost certainly all have the same hostname, but
+    // better safe than sorry...
+    for (let prefName of ["identity.fxaccounts.remote.force_auth.uri",
+                          "identity.fxaccounts.remote.uri",
+                          "identity.fxaccounts.settings.uri"]) {
+      let prefVal;
+      try {
+        prefVal = Services.prefs.getCharPref(prefName);
+      } catch (_) {
+        continue;
+      }
+      let uri = Services.io.newURI(prefVal, null, null);
+      result.add(uri.prePath);
+    }
+    return this._syncCredentialsHosts = result;
+  },
 };
 
 XPCOMUtils.defineLazyGetter(Utils, "_utf8Converter", function() {
diff --git a/services/sync/tests/unit/test_fxa_startOver.js b/services/sync/tests/unit/test_fxa_startOver.js
new file mode 100644
index 000000000000..8d27cd4a7601
--- /dev/null
+++ b/services/sync/tests/unit/test_fxa_startOver.js
@@ -0,0 +1,61 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+Cu.import("resource://testing-common/services/sync/utils.js");
+Cu.import("resource://services-sync/identity.js");
+Cu.import("resource://services-sync/browserid_identity.js");
+Cu.import("resource://services-sync/service.js");
+
+function run_test() {
+  initTestLogging("Trace");
+  run_next_test();
+}
+
+add_task(function* test_startover() {
+  let oldValue = Services.prefs.getBoolPref("services.sync-testing.startOverKeepIdentity", true);
+  Services.prefs.setBoolPref("services.sync-testing.startOverKeepIdentity", false);
+
+  yield configureIdentity({username: "johndoe"});
+  // The pref that forces FxA identities should not be set.
+  do_check_false(Services.prefs.getBoolPref("services.sync.fxaccounts.enabled"));
+  // And the boolean flag on the xpcom service should reflect this.
+  let xps = Cc["@mozilla.org/weave/service;1"]
+            .getService(Components.interfaces.nsISupports)
+            .wrappedJSObject;
+  do_check_false(xps.fxAccountsEnabled);
+
+  // we expect the "legacy" provider (but can't instanceof that, as BrowserIDManager
+  // extends it)
+  do_check_false(Service.identity instanceof BrowserIDManager);
+  Service.login();
+  // We should have a cluster URL
+  do_check_true(Service.clusterURL.length > 0);
+
+  // remember some stuff so we can reset it after.
+  let oldIdentidy = Service.identity;
+  let oldClusterManager = Service._clusterManager;
+  let deferred = Promise.defer();
+  Services.obs.addObserver(function observeStartOverFinished() {
+    Services.obs.removeObserver(observeStartOverFinished, "weave:service:start-over:finish");
+    deferred.resolve();
+  }, "weave:service:start-over:finish", false);
+
+  Service.startOver();
+  yield deferred; // wait for the observer to fire.
+
+  // should have reset the pref that indicates if FxA is enabled.
+  do_check_true(Services.prefs.getBoolPref("services.sync.fxaccounts.enabled"));
+  // the xpcom service should agree FxA is enabled.
+  do_check_true(xps.fxAccountsEnabled);
+  // should have swapped identities.
+  do_check_true(Service.identity instanceof BrowserIDManager);
+  // should have clobbered the cluster URL
+  do_check_eq(Service.clusterURL, "");
+
+  // reset the world.
+  Service.identity = oldIdentity = Service.identity;
+  Service._clusterManager = Service._clusterManager;
+  Services.prefs.setBoolPref("services.sync.fxaccounts.enabled", false);
+
+  Services.prefs.setBoolPref("services.sync-testing.startOverKeepIdentity", oldValue);
+});
diff --git a/services/sync/tests/unit/xpcshell.ini b/services/sync/tests/unit/xpcshell.ini
index c72095a37aed..01a69b907be0 100644
--- a/services/sync/tests/unit/xpcshell.ini
+++ b/services/sync/tests/unit/xpcshell.ini
@@ -121,6 +121,9 @@ skip-if = os == "android"
 [test_syncscheduler.js]
 [test_upgrade_old_sync_key.js]
 
+# Firefox Accounts specific tests
+[test_fxa_startOver.js]
+
 # Finally, we test each engine.
 [test_addons_engine.js]
 run-sequentially = Hardcoded port in static files.
diff --git a/testing/mochitest/b2g-desktop.json b/testing/mochitest/b2g-desktop.json
index 8db2311873dd..3b4530acf0d5 100644
--- a/testing/mochitest/b2g-desktop.json
+++ b/testing/mochitest/b2g-desktop.json
@@ -651,6 +651,7 @@
     "dom/plugins/test/mochitest/test_bug813906.html": "Bug 931116, b2g desktop specific, initial triage",
     "dom/plugins/test/mochitest/test_bug854082.html": "Bug 931116, b2g desktop specific, initial triage",
     "dom/plugins/test/mochitest/test_bug863792.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_bug967694.html": "Bug 967694, b2g desktop doesn't allow plugins",
     "dom/plugins/test/mochitest/test_cookies.html": "Bug 931116, b2g desktop specific, initial triage",
     "dom/plugins/test/mochitest/test_copyText.html": "Bug 931116, b2g desktop specific, initial triage",
     "dom/plugins/test/mochitest/test_crash_nested_loop.html": "Bug 931116, b2g desktop specific, initial triage",
diff --git a/testing/mochitest/runtests.py b/testing/mochitest/runtests.py
index bbe861a41297..f52abd645f94 100644
--- a/testing/mochitest/runtests.py
+++ b/testing/mochitest/runtests.py
@@ -582,6 +582,7 @@ class Mochitest(MochitestUtilsMixin):
     if options.browserChrome and options.timeout:
       options.extraPrefs.append("testing.browserTestHarness.timeout=%d" % options.timeout)
     options.extraPrefs.append("browser.tabs.remote=%s" % ('true' if options.e10s else 'false'))
+    options.extraPrefs.append("browser.tabs.remote.autostart=%s" % ('true' if options.e10s else 'false'))
 
     # get extensions to install
     extensions = self.getExtensionsToInstall(options)
diff --git a/testing/testsuite-targets.mk b/testing/testsuite-targets.mk
index f4d743422d76..ece800ed9325 100644
--- a/testing/testsuite-targets.mk
+++ b/testing/testsuite-targets.mk
@@ -203,10 +203,10 @@ RUN_REFTEST_B2G = rm -f ./$@.log && $(PYTHON) _tests/reftest/runreftestb2g.py \
 
 ifeq ($(OS_ARCH),WINNT) #{
 # GPU-rendered shadow layers are unsupported here
-OOP_CONTENT = --setpref=browser.tabs.remote=true --setpref=layers.acceleration.disabled=true
+OOP_CONTENT = --setpref=browser.tabs.remote=true --setpref=browser.tabs.remote.autostart=true --setpref=layers.acceleration.disabled=true
 GPU_RENDERING =
 else
-OOP_CONTENT = --setpref=browser.tabs.remote=true
+OOP_CONTENT = --setpref=browser.tabs.remote=true --setpref=browser.tabs.remote.autostart=true
 GPU_RENDERING = --setpref=layers.acceleration.force-enabled=true
 endif #}
 
diff --git a/toolkit/components/osfile/modules/osfile_async_front.jsm b/toolkit/components/osfile/modules/osfile_async_front.jsm
index 2534c7d73c87..212ba43b8ecb 100644
--- a/toolkit/components/osfile/modules/osfile_async_front.jsm
+++ b/toolkit/components/osfile/modules/osfile_async_front.jsm
@@ -784,6 +784,21 @@ File.move = function move(sourcePath, destPath, options) {
     Type.path.toMsg(destPath), options], [sourcePath, destPath]);
 };
 
+/**
+ * Gets the number of bytes available on disk to the current user.
+ *
+ * @param {string} Platform-specific path to a directory on the disk to 
+ * query for free available bytes.
+ *
+ * @return {number} The number of bytes available for the current user.
+ * @throws {OS.File.Error} In case of any error.
+ */
+File.getAvailableFreeSpace = function getAvailableFreeSpace(sourcePath) {
+  return Scheduler.post("getAvailableFreeSpace",
+    [Type.path.toMsg(sourcePath)], sourcePath
+  ).then(Type.uint64_t.fromMsg);
+};
+
 /**
  * Remove an empty directory.
  *
diff --git a/toolkit/components/osfile/modules/osfile_async_worker.js b/toolkit/components/osfile/modules/osfile_async_worker.js
index ca3cb67fba26..4d4ff5cf62ae 100644
--- a/toolkit/components/osfile/modules/osfile_async_worker.js
+++ b/toolkit/components/osfile/modules/osfile_async_worker.js
@@ -324,6 +324,10 @@ const EXCEPTION_NAMES = {
      return File.move(Type.path.fromMsg(sourcePath),
        Type.path.fromMsg(destPath), options);
    },
+   getAvailableFreeSpace: function getAvailableFreeSpace(sourcePath) {
+     return Type.uint64_t.toMsg(
+       File.getAvailableFreeSpace(Type.path.fromMsg(sourcePath)));
+   },
    makeDir: function makeDir(path, options) {
      return File.makeDir(Type.path.fromMsg(path), options);
    },
diff --git a/toolkit/components/osfile/modules/osfile_unix_back.jsm b/toolkit/components/osfile/modules/osfile_unix_back.jsm
index edcbf3e50d97..b59fca46e653 100644
--- a/toolkit/components/osfile/modules/osfile_unix_back.jsm
+++ b/toolkit/components/osfile/modules/osfile_unix_back.jsm
@@ -218,6 +218,24 @@
            ctypes.ArrayType(Type.timeval.implementation, 2));
        }
 
+       // Types fsblkcnt_t and fsfilcnt_t, used by structure |statvfs|
+       Type.fsblkcnt_t =
+         Type.uintn_t(Const.OSFILE_SIZEOF_FSBLKCNT_T).withName("fsblkcnt_t");
+
+       // Structure |statvfs|
+       // Use an hollow structure
+       {
+         let statvfs = new SharedAll.HollowStructure("statvfs",
+           Const.OSFILE_SIZEOF_STATVFS);
+
+         statvfs.add_field_at(Const.OSFILE_OFFSETOF_STATVFS_F_BSIZE,
+                        "f_bsize", Type.unsigned_long.implementation);
+         statvfs.add_field_at(Const.OSFILE_OFFSETOF_STATVFS_F_BAVAIL,
+                        "f_bavail", Type.fsblkcnt_t.implementation);
+
+         Type.statvfs = statvfs.getType();
+       }
+
        // Declare libc functions as functions of |OS.Unix.File|
 
        // Finalizer-related functions
@@ -506,6 +524,12 @@
                     /*len*/    Type.size_t,
                     /*flags*/  Type.unsigned_int); // Linux/Android-specific
 
+       libc.declareLazyFFI(SysFile,  "statvfs",
+                               "statvfs", ctypes.default_abi,
+                    /*return*/ Type.negativeone_or_nothing,
+                    /*path*/   Type.path,
+                    /*buf*/    Type.statvfs.out_ptr);
+
        libc.declareLazyFFI(SysFile,  "symlink",
                                "symlink", ctypes.default_abi,
                     /*return*/ Type.negativeone_or_nothing,
diff --git a/toolkit/components/osfile/modules/osfile_unix_front.jsm b/toolkit/components/osfile/modules/osfile_unix_front.jsm
index 1049e108e81b..f1ccfe11e424 100644
--- a/toolkit/components/osfile/modules/osfile_unix_front.jsm
+++ b/toolkit/components/osfile/modules/osfile_unix_front.jsm
@@ -351,6 +351,27 @@
        }
      };
 
+     /**
+      * Gets the number of bytes available on disk to the current user.
+      *
+      * @param {string} sourcePath Platform-specific path to a directory on 
+      * the disk to query for free available bytes.
+      *
+      * @return {number} The number of bytes available for the current user.
+      * @throws {OS.File.Error} In case of any error.
+      */
+     File.getAvailableFreeSpace = function Unix_getAvailableFreeSpace(sourcePath) {
+       let fileSystemInfo = new Type.statvfs.implementation();
+       let fileSystemInfoPtr = fileSystemInfo.address();
+
+       throw_on_negative("statvfs",  UnixFile.statvfs(sourcePath, fileSystemInfoPtr));
+
+       let bytes = new Type.uint64_t.implementation(
+                        fileSystemInfo.f_bsize * fileSystemInfo.f_bavail);
+
+       return bytes.value;
+     };
+
      /**
       * Default mode for opening directories.
       */
diff --git a/toolkit/components/osfile/modules/osfile_win_back.jsm b/toolkit/components/osfile/modules/osfile_win_back.jsm
index d440f0bffdc6..a2630816c520 100644
--- a/toolkit/components/osfile/modules/osfile_win_back.jsm
+++ b/toolkit/components/osfile/modules/osfile_win_back.jsm
@@ -296,6 +296,14 @@
                     /*buf*/    Type.out_path
                    );
 
+       libc.declareLazyFFI(SysFile, "GetDiskFreeSpaceEx",
+         "GetDiskFreeSpaceExW", ctypes.winapi_abi,
+                    /*return*/ Type.zero_or_nothing,
+                    /*directoryName*/ Type.path,
+                    /*freeBytesForUser*/ Type.uint64_t.out_ptr,
+                    /*totalBytesForUser*/ Type.uint64_t.out_ptr,
+                    /*freeTotalBytesOnDrive*/ Type.uint64_t.out_ptr);
+
        libc.declareLazyFFI(SysFile, "GetFileInformationByHandle",
          "GetFileInformationByHandle", ctypes.winapi_abi,
                     /*return*/ Type.zero_or_nothing,
diff --git a/toolkit/components/osfile/modules/osfile_win_front.jsm b/toolkit/components/osfile/modules/osfile_win_front.jsm
index 1b8535723435..7fd71248ab0d 100644
--- a/toolkit/components/osfile/modules/osfile_win_front.jsm
+++ b/toolkit/components/osfile/modules/osfile_win_front.jsm
@@ -571,6 +571,26 @@
        }
      };
 
+     /**
+      * Gets the number of bytes available on disk to the current user.
+      *
+      * @param {string} sourcePath Platform-specific path to a directory on 
+      * the disk to query for free available bytes.
+      *
+      * @return {number} The number of bytes available for the current user.
+      * @throws {OS.File.Error} In case of any error.
+      */
+     File.getAvailableFreeSpace = function Win_getAvailableFreeSpace(sourcePath) {
+       let freeBytesAvailableToUser = new Type.uint64_t.implementation(0);
+       let freeBytesAvailableToUserPtr = freeBytesAvailableToUser.address();
+
+       throw_on_zero("getAvailableFreeSpace",
+         WinFile.GetDiskFreeSpaceEx(sourcePath, freeBytesAvailableToUserPtr, null, null)
+       );
+
+       return freeBytesAvailableToUser.value;
+     };
+
      /**
       * A global value used to receive data during time conversions.
       */
diff --git a/toolkit/components/osfile/tests/xpcshell/test_available_free_space.js b/toolkit/components/osfile/tests/xpcshell/test_available_free_space.js
new file mode 100644
index 000000000000..08e67763b5f4
--- /dev/null
+++ b/toolkit/components/osfile/tests/xpcshell/test_available_free_space.js
@@ -0,0 +1,38 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+Components.utils.import("resource://gre/modules/osfile.jsm");
+Components.utils.import("resource://gre/modules/Services.jsm");
+
+do_register_cleanup(function() {
+  Services.prefs.setBoolPref("toolkit.osfile.log", false);
+});
+
+function run_test() {
+  Services.prefs.setBoolPref("toolkit.osfile.log", true);
+
+  run_next_test();
+}
+
+/**
+ * Test OS.File.getAvailableFreeSpace
+ */
+add_task(function() {
+  // Set up profile. We will use profile path to query for available free
+  // space.
+  do_get_profile();
+
+  let dir = OS.Constants.Path.profileDir;
+
+  // Sanity checking for the test
+  do_check_true((yield OS.File.exists(dir)));
+
+  // Query for available bytes for user
+  let availableBytes = yield OS.File.getAvailableFreeSpace(dir);
+
+  do_check_true(!!availableBytes);
+  do_check_true(availableBytes > 0);
+});
diff --git a/toolkit/components/osfile/tests/xpcshell/xpcshell.ini b/toolkit/components/osfile/tests/xpcshell/xpcshell.ini
index 99b6b72b578e..645a66df9775 100644
--- a/toolkit/components/osfile/tests/xpcshell/xpcshell.ini
+++ b/toolkit/components/osfile/tests/xpcshell/xpcshell.ini
@@ -2,6 +2,7 @@
 head =
 tail =
 
+[test_available_free_space.js]
 [test_osfile_closed.js]
 [test_path.js]
 [test_osfile_async.js]
diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json
index 98e98b0c5f4c..0354eb2cc01e 100644
--- a/toolkit/components/telemetry/Histograms.json
+++ b/toolkit/components/telemetry/Histograms.json
@@ -4242,7 +4242,15 @@
     "extended_statistics_ok": true,
     "description": "Time spent on a successful cert  verification in classic mode (ms)"
   },
-  "SSL_INITIAL_FAILED_CERT_VALIDATION_TIME_LIBPKIX": {
+  "SSL_SUCCESFUL_CERT_VALIDATION_TIME_INSANITY" : {
+    "expires_in_version": "never",
+    "kind": "exponential",
+    "high": "60000",
+    "n_buckets": 50,
+    "extended_statistics_ok": true,
+    "description": "Time spent on a successful cert verification in insanity mode (ms)"
+  },
+  "SSL_INITIAL_FAILED_CERT_VALIDATION_TIME_LIBPKIX" : {
     "expires_in_version": "never",
     "kind": "exponential",
     "high": "60000",
@@ -4258,6 +4266,14 @@
     "extended_statistics_ok": true,
     "description": "Time spent on an initially failed cert  verification in classic mode (ms)"
   },
+  "SSL_INITIAL_FAILED_CERT_VALIDATION_TIME_INSANITY" : {
+    "expires_in_version": "never",
+    "kind": "exponential",
+    "high": "60000",
+    "n_buckets": 50,
+    "extended_statistics_ok": true,
+    "description": "Time spent on an initially failed cert verification in insanity mode (ms)"
+  },
   "HEALTHREPORT_DB_OPEN_FIRSTRUN_MS": {
     "expires_in_version": "never",
     "kind": "exponential",
diff --git a/toolkit/components/telemetry/Telemetry.cpp b/toolkit/components/telemetry/Telemetry.cpp
index 29d7defa4a51..40247d5fb1c7 100644
--- a/toolkit/components/telemetry/Telemetry.cpp
+++ b/toolkit/components/telemetry/Telemetry.cpp
@@ -288,6 +288,20 @@ class TelemetryIOInterposeObserver : public IOInterposeObserver
     double    totalTime;    /** Accumulated duration of all operations */
   };
   typedef nsBaseHashtableET<nsStringHashKey, FileStats> FileIOEntryType;
+
+  struct SafeDir {
+    SafeDir(const nsAString& aPath, const nsAString& aSubstName)
+      : mPath(aPath)
+      , mSubstName(aSubstName)
+    {}
+    size_t SizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf) const {
+      return mPath.SizeOfExcludingThisIfUnshared(aMallocSizeOf) +
+             mSubstName.SizeOfExcludingThisIfUnshared(aMallocSizeOf);
+    }
+    nsString  mPath;        /** Path to the directory */
+    nsString  mSubstName;   /** Name to substitute with */
+  };
+
 public:
   TelemetryIOInterposeObserver(nsIFile* aXreDir);
 
@@ -302,7 +316,12 @@ public:
    */
   bool ReflectIntoJS(JSContext *cx, JS::Handle<JSObject*> rootObj);
 
-  void AddPath(const nsAString& aPath);
+  /**
+   * Adds a path for inclusion in main thread I/O report.
+   * @param aPath Directory path
+   * @param aSubstName Name to substitute for aPath for privacy reasons
+   */
+  void AddPath(const nsAString& aPath, const nsAString& aSubstName);
 
   /**
    * Get size of hash table with file stats
@@ -318,7 +337,7 @@ public:
            mSafeDirs.SizeOfExcludingThis(aMallocSizeOf);
     uint32_t safeDirsLen = mSafeDirs.Length();
     for (uint32_t i = 0; i < safeDirsLen; ++i) {
-      size += mSafeDirs[i].SizeOfExcludingThisIfUnshared(aMallocSizeOf);
+      size += mSafeDirs[i].SizeOfExcludingThis(aMallocSizeOf);
     }
     return size;
   }
@@ -327,7 +346,7 @@ private:
   // Statistics for each filename
   AutoHashtable<FileIOEntryType> mFileStats;
   // Container for whitelisted directories
-  nsTArray<nsString> mSafeDirs;
+  nsTArray<SafeDir> mSafeDirs;
 
   /**
    * Reflect a FileIOEntryType object to a Javascript property on obj with
@@ -350,13 +369,14 @@ TelemetryIOInterposeObserver::TelemetryIOInterposeObserver(nsIFile* aXreDir)
   nsAutoString xreDirPath;
   nsresult rv = aXreDir->GetPath(xreDirPath);
   if (NS_SUCCEEDED(rv)) {
-    AddPath(xreDirPath);
+    AddPath(xreDirPath, NS_LITERAL_STRING("{xre}"));
   }
 }
 
-void TelemetryIOInterposeObserver::AddPath(const nsAString& aPath)
+void TelemetryIOInterposeObserver::AddPath(const nsAString& aPath,
+                                           const nsAString& aSubstName)
 {
-  mSafeDirs.AppendElement(aPath);
+  mSafeDirs.AppendElement(SafeDir(aPath, aSubstName));
 }
  
 void TelemetryIOInterposeObserver::Observe(Observation& aOb)
@@ -374,40 +394,33 @@ void TelemetryIOInterposeObserver::Observe(Observation& aOb)
     return;
   }
 
-  bool report = false;
+  nsAutoString      processedName;
   nsDependentString filenameStr(filename);
   uint32_t filenameStrLen = filenameStr.Length();
   uint32_t safeDirsLen = mSafeDirs.Length();
   for (uint32_t i = 0; i < safeDirsLen; ++i) {
-    uint32_t curSafeDirLen = mSafeDirs[i].Length();
+    uint32_t curSafeDirLen = mSafeDirs[i].mPath.Length();
     if (curSafeDirLen <= filenameStrLen) {
 #if defined(_MSC_VER)
-      if (!_wcsnicmp(filename, mSafeDirs[i].get(), curSafeDirLen)) {
+      if (!_wcsnicmp(filename, mSafeDirs[i].mPath.get(), curSafeDirLen)) {
 #else
-      if (!std::char_traits<char16_t>::compare(filename, mSafeDirs[i].get(),
+      if (!std::char_traits<char16_t>::compare(filename,
+                                               mSafeDirs[i].mPath.get(),
                                                curSafeDirLen)) {
 #endif
-        report = true;
+        processedName = mSafeDirs[i].mSubstName;
+        processedName += Substring(filenameStr, curSafeDirLen);
         break;
       }
     }
   }
 
-  if (!report) {
+  if (processedName.IsEmpty()) {
     return;
   }
 
-  const char16_t* leaf = filename + filenameStrLen;
-  while (filename < leaf) {
-    char16_t c = *(leaf - 1);
-    if (c == MOZ_UTF16('\\') || c == MOZ_UTF16('/')) {
-      break;
-    }
-    --leaf;
-  }
-
   // Create a new entry or retrieve the existing one
-  FileIOEntryType* entry = mFileStats.PutEntry(nsDependentString(leaf));
+  FileIOEntryType* entry = mFileStats.PutEntry(processedName);
   if (entry) {
     // Update the statistics
     entry->mData.totalTime += (double) aOb.Duration().ToMilliseconds();
@@ -2962,7 +2975,7 @@ SetProfileDir(nsIFile* aProfD)
   if (NS_FAILED(rv)) {
     return;
   }
-  sTelemetryIOObserver->AddPath(profDirPath);
+  sTelemetryIOObserver->AddPath(profDirPath, NS_LITERAL_STRING("{profile}"));
 }
 
 void
diff --git a/toolkit/devtools/apps/tests/debugger-protocol-helper.js b/toolkit/devtools/apps/tests/debugger-protocol-helper.js
index 6351e08a24d0..0434ee86b0ee 100644
--- a/toolkit/devtools/apps/tests/debugger-protocol-helper.js
+++ b/toolkit/devtools/apps/tests/debugger-protocol-helper.js
@@ -59,6 +59,12 @@ function startClient(transport, onDone) {
   gClient.addListener("appUninstall", function (aState, aType, aPacket) {
     sendAsyncMessage("uninstalled-event", { manifestURL: aType.manifestURL });
   });
+
+  addMessageListener("appActorRequest", request => {
+    webappActorRequest(request, response => {
+      sendAsyncMessage("appActorResponse", response);
+    });
+  });
 }
 
 function webappActorRequest(request, onResponse) {
diff --git a/toolkit/devtools/apps/tests/test_webapps_actor.html b/toolkit/devtools/apps/tests/test_webapps_actor.html
index 0b35d0f0363d..eff15c9ea695 100644
--- a/toolkit/devtools/apps/tests/test_webapps_actor.html
+++ b/toolkit/devtools/apps/tests/test_webapps_actor.html
@@ -62,9 +62,16 @@ SimpleTest.waitForExplicitFinish();
 
 var installTestApp, mm;
 
+const PACKAGED_APP_ID = "test-app-id";
+const PACKAGED_APP_ORIGIN = "app://" + PACKAGED_APP_ID;
+const PACKAGED_APP_MANIFEST = PACKAGED_APP_ORIGIN + "/manifest.webapp";
+const CERTIFIED_APP_ID = "test-certified-id";
+const CERTIFIED_APP_ORIGIN = "app://" + CERTIFIED_APP_ID;
+const CERTIFIED_APP_MANIFEST = CERTIFIED_APP_ORIGIN + "/manifest.webapp";
+
 var steps = [
   function() {
-    ok(true, "Start setting up");
+    info("== SETUP ==");
     // Set up
     launchableValue = SpecialPowers.setAllAppsLaunchable(true);
     SpecialPowers.addPermission("webapps-manage", true, document);
@@ -117,13 +124,12 @@ var steps = [
     SpecialPowers.autoConfirmAppInstall(next);
   },
   function() {
-    ok(true, "== TEST == Install packaged app");
-    let appId = "test-app-id";
+    info("== TEST == Install packaged app");
     let url = SimpleTest.getTestFileURL("data/app.zip");
-    installTestApp(url, appId,
+    installTestApp(url, PACKAGED_APP_ID,
       function (aResponse, aApp) {
         ok(true, "Installed");
-        is(aResponse.appId, appId, "Got same app id");
+        is(aResponse.appId, PACKAGED_APP_ID, "Got same app id");
         if ("error" in aResponse) {
           ok(false, "Error: " + aResponse.error);
         }
@@ -137,13 +143,12 @@ var steps = [
     );
   },
   function () {
-    ok(true, "== TEST == Reinstall packaged app");
-    let appId = "test-app-id";
+    info("== TEST == Reinstall packaged app");
     let url = SimpleTest.getTestFileURL("data/app-updated.zip");
-    installTestApp(url, appId,
+    installTestApp(url, PACKAGED_APP_ID,
       function (aResponse, aApp) {
         ok(true, "Reinstalled");
-        is(aResponse.appId, appId, "Got same app id");
+        is(aResponse.appId, PACKAGED_APP_ID, "Got same app id");
         if ("error" in aResponse) {
           ok(false, "Error: " + aResponse.error);
         }
@@ -157,13 +162,12 @@ var steps = [
     );
   },
   function() {
-    ok(true, "== TEST == Install certified app");
-    let appId = "test-certified-id";
+    info("== TEST == Install certified app");
     let url = SimpleTest.getTestFileURL("data/app-certified.zip");
-    installTestApp(url, appId,
+    installTestApp(url, CERTIFIED_APP_ID,
       function (aResponse, aApp) {
         ok(true, "Installed");
-        is(aResponse.appId, appId, "Got same app id");
+        is(aResponse.appId, CERTIFIED_APP_ID, "Got same app id");
         if ("error" in aResponse) {
           ok(false, "Error: " + aResponse.error);
         }
@@ -176,15 +180,137 @@ var steps = [
       }
     );
   },
+  function() {
+    info("== TEST == Get all apps");
+    getAll(false);
+  },
+  function() {
+    info("== TEST == Get packaged app");
+    getApp({
+      id: PACKAGED_APP_ID,
+      manifestURL: PACKAGED_APP_MANIFEST
+    }, true);
+  },
+  function() {
+    info("== TEST == Get certified app");
+    getApp({
+      id: CERTIFIED_APP_ID,
+      manifestURL: CERTIFIED_APP_MANIFEST
+    }, false);
+  },
+  function() {
+    info("== SETUP == Enable certified app access");
+    SpecialPowers.pushPrefEnv({
+      "set": [["devtools.debugger.forbid-certified-apps", false]]
+    }, next);
+  },
+  function() {
+    info("== TEST == Get all apps (CERTIFIED ENABLED)");
+    getAll(true);
+  },
+  function() {
+    info("== TEST == Get packaged app (CERTIFIED ENABLED)");
+    getApp({
+      id: PACKAGED_APP_ID,
+      manifestURL: PACKAGED_APP_MANIFEST
+    }, true);
+  },
+  function() {
+    info("== TEST == Get certified app (CERTIFIED ENABLED)");
+    getApp({
+      id: CERTIFIED_APP_ID,
+      manifestURL: CERTIFIED_APP_MANIFEST
+    }, true);
+  },
+  function() {
+    info("== SETUP == Disable certified app access");
+    SpecialPowers.popPrefEnv(next);
+  },
+  function() {
+    info("== TEST == Uninstall packaged app");
+    uninstall(PACKAGED_APP_MANIFEST);
+  },
+  function() {
+    info("== TEST == Uninstall certified app");
+    uninstall(CERTIFIED_APP_MANIFEST);
+  },
   function() {
     ok(true, "all done!\n");
     mm.sendAsyncMessage("cleanup");
-    SpecialPowers.popPrefEnv(finish);
+    SpecialPowers.flushPrefEnv(finish);
   }
 ];
 
 addLoadEvent(start);
 
+function getAll(expectCertified) {
+  mm.addMessageListener("appActorResponse", function onResponse(response) {
+    mm.removeMessageListener("appActorResponse", onResponse);
+
+    ok("apps" in response, "Apps found in getAll reply");
+    let apps = response.apps;
+    let packagedApp, certifiedApp;
+    for (let app of apps) {
+      switch (app.id) {
+        case PACKAGED_APP_ID:
+          packagedApp = app;
+          break;
+        case CERTIFIED_APP_ID:
+          certifiedApp = app;
+          break;
+      }
+    }
+
+    ok(packagedApp, "Packaged app found via getAll");
+    is(!!certifiedApp, expectCertified, "Certified app matches expectation");
+
+    next();
+  });
+
+  mm.sendAsyncMessage("appActorRequest", {
+    type: "getAll"
+  });
+}
+
+function getApp(appInfo, expected) {
+  mm.addMessageListener("appActorResponse", function onResponse(response) {
+    mm.removeMessageListener("appActorResponse", onResponse);
+
+    is("app" in response, expected, "App existence matches expectation");
+    is("error" in response, !expected, "Error existence matches expectation");
+    if (!expected) {
+      is(response.error, "forbidden", "Error message is correct");
+      next();
+      return;
+    }
+
+    let app = response.app;
+    for (let key in appInfo) {
+      is(app[key], appInfo[key], "Value for " + key + " matches");
+    }
+
+    next();
+  });
+
+  mm.sendAsyncMessage("appActorRequest", {
+    type: "getApp",
+    manifestURL: appInfo.manifestURL
+  });
+}
+
+function uninstall(manifestURL) {
+  mm.addMessageListener("appActorResponse", function onResponse(response) {
+    mm.removeMessageListener("appActorResponse", onResponse);
+    ok(!("error" in response), "App uninstalled successfully");
+    next();
+  });
+
+  mm.sendAsyncMessage("appActorRequest", {
+    type: "uninstall",
+    manifestURL: manifestURL
+  });
+}
+
 </script>
 </pre>
 </body>
diff --git a/toolkit/devtools/server/actors/script.js b/toolkit/devtools/server/actors/script.js
index 62ad77dc7719..945684ff0649 100644
--- a/toolkit/devtools/server/actors/script.js
+++ b/toolkit/devtools/server/actors/script.js
@@ -2460,7 +2460,14 @@ SourceActor.prototype = {
     // XXX bug 865252: Don't load from the cache if this is a source mapped
     // source because we can't guarantee that the cache has the most up to date
     // content for this source like we can if it isn't source mapped.
-    return fetch(this._url, { loadFromCache: !this._sourceMap });
+    let sourceFetched = fetch(this._url, { loadFromCache: !this._sourceMap });
+
+    // Record the contentType we just learned during fetching
+    sourceFetched.then(({ contentType }) => {
+      this._contentType = contentType;
+    });
+
+    return sourceFetched;
   },
 
   /**
diff --git a/toolkit/mozapps/update/common/pathhash.cpp b/toolkit/mozapps/update/common/pathhash.cpp
index 5892e9b3074e..89a004cdef82 100644
--- a/toolkit/mozapps/update/common/pathhash.cpp
+++ b/toolkit/mozapps/update/common/pathhash.cpp
@@ -42,14 +42,15 @@ CalculateMD5(const char *data, DWORD dataSize,
   HCRYPTPROV hProv = 0;
   HCRYPTHASH hHash = 0;
 
-  if (!CryptAcquireContext(&hProv, nullptr, nullptr, PROV_RSA_FULL, 0)) {
+  if (!CryptAcquireContext(&hProv, nullptr, nullptr, PROV_RSA_FULL,
+                           CRYPT_VERIFYCONTEXT)) {
     if (NTE_BAD_KEYSET != GetLastError()) {
       return FALSE;
     }
  
     // Maybe it doesn't exist, try to create it.
     if (!CryptAcquireContext(&hProv, nullptr, nullptr, PROV_RSA_FULL, 
-                            CRYPT_NEWKEYSET)) {
+                             CRYPT_VERIFYCONTEXT | CRYPT_NEWKEYSET)) {
       return FALSE;
     }
   }
diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp
index dd16597dece1..79904ad9dbbf 100644
--- a/toolkit/xre/nsAppRunner.cpp
+++ b/toolkit/xre/nsAppRunner.cpp
@@ -3846,11 +3846,6 @@ XREMain::XRE_mainRun()
   mDirProvider.DoStartup();
 
 #ifdef MOZ_CRASHREPORTER
-  if (BrowserTabsRemote()) {
-    CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("DOMIPCEnabled"),
-                                       NS_LITERAL_CSTRING("1"));
-  }
-
   nsCString userAgentLocale;
   if (NS_SUCCEEDED(Preferences::GetCString("general.useragent.locale", &userAgentLocale))) {
     CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("useragent_locale"), userAgentLocale);
diff --git a/uriloader/prefetch/OfflineCacheUpdateParent.cpp b/uriloader/prefetch/OfflineCacheUpdateParent.cpp
index 86b4e3ea73fa..6dd062d9fb9b 100644
--- a/uriloader/prefetch/OfflineCacheUpdateParent.cpp
+++ b/uriloader/prefetch/OfflineCacheUpdateParent.cpp
@@ -233,6 +233,18 @@ OfflineCacheUpdateParent::SetPrivateBrowsing(bool aUsePrivateBrowsing)
     return NS_ERROR_NOT_IMPLEMENTED;
 }
 
+NS_IMETHODIMP
+OfflineCacheUpdateParent::GetUseRemoteTabs(bool *aUseRemoteTabs)
+{
+    return NS_ERROR_NOT_IMPLEMENTED;
+}
+
+NS_IMETHODIMP
+OfflineCacheUpdateParent::SetRemoteTabs(bool aUseRemoteTabs)
+{
+    return NS_ERROR_NOT_IMPLEMENTED;
+}
+
 NS_IMETHODIMP
 OfflineCacheUpdateParent::GetIsInBrowserElement(bool *aIsInBrowserElement)
 {
diff --git a/widget/tests/test_plugin_scroll_consistency.html b/widget/tests/test_plugin_scroll_consistency.html
index a026bf3352f7..6feab9e53421 100644
--- a/widget/tests/test_plugin_scroll_consistency.html
+++ b/widget/tests/test_plugin_scroll_consistency.html
@@ -25,7 +25,7 @@ for (var tag of pluginTags) {
   </div>
 </p>
 <div id="content" style="display: none">
-  
+
 </div>
 <pre id="test">
 </pre>
@@ -40,10 +40,10 @@ function consistencyCheck(state) {
   ok(s == "", "Consistency check: " + state + ": " + s);
 }
 
-consistencyCheck("Initial state");
-
 function runTests()
 {
+  consistencyCheck("Initial state");
+
   var scroll = document.getElementById("scroll");
   scroll.scrollTop = 10;
   consistencyCheck("Scrolled down a bit");
@@ -52,7 +52,7 @@ function runTests()
     consistencyCheck("Before scrolling back to top");
     scroll.scrollTop = 0;
     consistencyCheck("Scrolled to top");
-  
+
     setTimeout(function() {
       consistencyCheck("After scrolling to top");
 
diff --git a/widget/windows/nsWindow.cpp b/widget/windows/nsWindow.cpp
index 1544492f2490..f29699fdddaf 100644
--- a/widget/windows/nsWindow.cpp
+++ b/widget/windows/nsWindow.cpp
@@ -3351,26 +3351,11 @@ gfxASurface *nsWindow::GetThebesSurface()
   if (mPaintDC)
     return (new gfxWindowsSurface(mPaintDC));
 
-#ifdef CAIRO_HAS_D2D_SURFACE
-  if (gfxWindowsPlatform::GetPlatform()->GetRenderMode() ==
-      gfxWindowsPlatform::RENDER_DIRECT2D) {
-    gfxContentType content = gfxContentType::COLOR;
-#if defined(MOZ_XUL)
-    if (mTransparencyMode != eTransparencyOpaque) {
-      content = gfxContentType::COLOR_ALPHA;
-    }
-#endif
-    return (new gfxD2DSurface(mWnd, content));
-  } else {
-#endif
-    uint32_t flags = gfxWindowsSurface::FLAG_TAKE_DC;
-    if (mTransparencyMode != eTransparencyOpaque) {
-        flags |= gfxWindowsSurface::FLAG_IS_TRANSPARENT;
-    }
-    return (new gfxWindowsSurface(mWnd, flags));
-#ifdef CAIRO_HAS_D2D_SURFACE
+  uint32_t flags = gfxWindowsSurface::FLAG_TAKE_DC;
+  if (mTransparencyMode != eTransparencyOpaque) {
+      flags |= gfxWindowsSurface::FLAG_IS_TRANSPARENT;
   }
-#endif
+  return (new gfxWindowsSurface(mWnd, flags));
 }
 
 /**************************************************************
@@ -6751,21 +6736,10 @@ void nsWindow::ResizeTranslucentWindow(int32_t aNewWidth, int32_t aNewHeight, bo
   if (!force && aNewWidth == mBounds.width && aNewHeight == mBounds.height)
     return;
 
-#ifdef CAIRO_HAS_D2D_SURFACE
-  if (gfxWindowsPlatform::GetPlatform()->GetRenderMode() ==
-      gfxWindowsPlatform::RENDER_DIRECT2D) {
-    nsRefPtr<gfxD2DSurface> newSurface =
-      new gfxD2DSurface(gfxIntSize(aNewWidth, aNewHeight), gfxImageFormat::ARGB32);
-    mTransparentSurface = newSurface;
-    mMemoryDC = nullptr;
-  } else
-#endif
-  {
-    nsRefPtr<gfxWindowsSurface> newSurface =
-      new gfxWindowsSurface(gfxIntSize(aNewWidth, aNewHeight), gfxImageFormat::ARGB32);
-    mTransparentSurface = newSurface;
-    mMemoryDC = newSurface->GetDC();
-  }
+  nsRefPtr<gfxWindowsSurface> newSurface =
+    new gfxWindowsSurface(gfxIntSize(aNewWidth, aNewHeight), gfxImageFormat::ARGB32);
+  mTransparentSurface = newSurface;
+  mMemoryDC = newSurface->GetDC();
 }
 
 void nsWindow::SetWindowTranslucencyInner(nsTransparencyMode aMode)
@@ -6857,13 +6831,6 @@ nsresult nsWindow::UpdateTranslucentWindow()
   RECT winRect;
   ::GetWindowRect(hWnd, &winRect);
 
-#ifdef CAIRO_HAS_D2D_SURFACE
-  if (gfxWindowsPlatform::GetPlatform()->GetRenderMode() ==
-      gfxWindowsPlatform::RENDER_DIRECT2D) {
-    mMemoryDC = static_cast<gfxD2DSurface*>(mTransparentSurface.get())->
-      GetDC(true);
-  }
-#endif
   // perform the alpha blend
   bool updateSuccesful = 
     ::UpdateLayeredWindow(hWnd, nullptr, (POINT*)&winRect, &winSize, mMemoryDC,
diff --git a/xpcom/base/Debug.cpp b/xpcom/base/Debug.cpp
index 4e2dd42f4356..19065ab39ee6 100644
--- a/xpcom/base/Debug.cpp
+++ b/xpcom/base/Debug.cpp
@@ -6,61 +6,16 @@
 #include "mozilla/Debug.h"
 
 #ifdef XP_WIN
-#include <io.h>
 #include <windows.h>
 #endif
 
-#ifdef ANDROID
-#include <android/log.h>
-#endif
-
-void mozilla::PrintToDebugger(const nsAString& aStr, FILE* aStream,
-                              LogOptions aOptions)
-{
-  nsString msg(aStr);
-  if (aOptions & kPrintNewLine) {
-    msg.AppendLiteral("\n");
-  }
-
 #ifdef XP_WIN
-  if ((aOptions & kPrintToDebugger) && ::IsDebuggerPresent()) {
-    ::OutputDebugStringW(msg.get());
-  }
 
-  if (!(aOptions & kPrintToStream)) {
-    return;
+void mozilla::PrintToDebugger(const char* aStr)
+{
+  if (::IsDebuggerPresent()) {
+    ::OutputDebugStringA(aStr);
   }
-
-  int fd = _fileno(aStream);
-  if (_isatty(fd)) {
-    fflush(aStream);
-    DWORD writtenCount;
-    WriteConsoleW(reinterpret_cast<HANDLE>(_get_osfhandle(fd)),
-                  msg.BeginReading(), msg.Length(),
-                  &writtenCount, nullptr);
-    return;
-  }
-#endif
-  NS_ConvertUTF16toUTF8 cstr(msg);
-#ifdef ANDROID
-  if (aOptions & (kPrintInfoLog | kPrintErrorLog)) {
-    __android_log_write(aOptions & kPrintErrorLog ? ANDROID_LOG_ERROR
-                                                  : ANDROID_LOG_INFO,
-                        "GeckoDump", cstr.get());
-  }
-#endif
-
-#ifndef XP_WIN
-  if (!(aOptions & kPrintToStream)) {
-    return;
-  }
-#endif
-
-#if defined(XP_MACOSX)
-  // have to convert \r to \n so that printing to the console works
-  cstr.ReplaceChar('\r', '\n');
-#endif
-
-  fputs(cstr.get(), aStream);
-  fflush(aStream);
 }
+
+#endif
diff --git a/xpcom/base/Debug.h b/xpcom/base/Debug.h
index 356cf4a84991..a70c384aaccc 100644
--- a/xpcom/base/Debug.h
+++ b/xpcom/base/Debug.h
@@ -3,40 +3,18 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef mozilla_Debug_h
-#define mozilla_Debug_h
-
-#include "nsString.h"
-#include <stdio.h>
+#ifndef mozilla_Debug_h__
+#define mozilla_Debug_h__
 
 namespace mozilla {
 
-typedef uint32_t LogOptions;
-
-// Print a message to the specified stream.
-const LogOptions kPrintToStream   = 1 << 0;
-
-// Print a message to a debugger if the debugger is attached.
-// At the moment, only meaningful on Windows.
-const LogOptions kPrintToDebugger = 1 << 1;
-
-// Print an info-level message to the log.
-// At the moment, only meaningful on Andriod.
-const LogOptions kPrintInfoLog    = 1 << 2;
-
-// Print an error-level message to the log.
-// At the moment, only meaningful on Andriod.
-const LogOptions kPrintErrorLog   = 1 << 3;
-
-// Print a new line after the message.
-const LogOptions kPrintNewLine    = 1 << 4;
+#ifdef XP_WIN
 
 // Print aStr to a debugger if the debugger is attached.
-void PrintToDebugger(const nsAString& aStr, FILE* aStream,
-                     LogOptions aOptions = kPrintToStream
-                                         | kPrintToDebugger
-                                         | kPrintInfoLog);
+void PrintToDebugger(const char* aStr);
+
+#endif
 
 } // namespace mozilla
 
-#endif // mozilla_Debug_h
+#endif // mozilla_Debug_h__
diff --git a/xpcom/base/WindowsVersion.h b/xpcom/base/WindowsVersion.h
index 0186f592d964..0d860be0b259 100644
--- a/xpcom/base/WindowsVersion.h
+++ b/xpcom/base/WindowsVersion.h
@@ -11,10 +11,10 @@
 namespace mozilla
 {
   inline bool
-  IsWindowsVersionOrLater(uint64_t aVersion)
+  IsWindowsVersionOrLater(uint32_t aVersion)
   {
-    static uint64_t minVersion = 0;
-    static uint64_t maxVersion = UINT64_MAX;
+    static uint32_t minVersion = 0;
+    static uint32_t maxVersion = UINT32_MAX;
 
     if (minVersion >= aVersion) {
       return true;
@@ -27,10 +27,10 @@ namespace mozilla
     OSVERSIONINFOEX info;
     ZeroMemory(&info, sizeof(OSVERSIONINFOEX));
     info.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX);
-    info.dwMajorVersion = aVersion >> 48;
-    info.dwMinorVersion = (aVersion >> 32) & 0xFFFF;
-    info.wServicePackMajor = (aVersion >> 16) & 0xFFFF;
-    info.wServicePackMinor = aVersion & 0xFFFF;
+    info.dwMajorVersion = aVersion >> 24;
+    info.dwMinorVersion = (aVersion >> 16) & 0xFF;
+    info.wServicePackMajor = (aVersion >> 8) & 0xFF;
+    info.wServicePackMinor = aVersion & 0xFF;
 
     DWORDLONG conditionMask = 0;
     VER_SET_CONDITION(conditionMask, VER_MAJORVERSION, VER_GREATER_EQUAL);
@@ -50,37 +50,75 @@ namespace mozilla
     return false;
   }
 
+  inline bool
+  IsWindowsBuildOrLater(uint32_t aBuild)
+  {
+    static uint32_t minBuild = 0;
+    static uint32_t maxBuild = UINT32_MAX;
+
+    if (minBuild >= aBuild) {
+      return true;
+    }
+
+    if (aBuild >= maxBuild) {
+      return false;
+    }
+
+    OSVERSIONINFOEX info;
+    ZeroMemory(&info, sizeof(OSVERSIONINFOEX));
+    info.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX);
+    info.dwBuildNumber = aBuild;
+
+    DWORDLONG conditionMask = 0;
+    VER_SET_CONDITION(conditionMask, VER_BUILDNUMBER, VER_GREATER_EQUAL);
+
+    if (VerifyVersionInfo(&info, VER_BUILDNUMBER, conditionMask)) {
+      minBuild = aBuild;
+      return true;
+    }
+
+    maxBuild = aBuild;
+    return false;
+  }
+
   MOZ_ALWAYS_INLINE bool
   IsXPSP3OrLater()
-  { return IsWindowsVersionOrLater(0x0005000100030000ull); }
+  { return IsWindowsVersionOrLater(0x05010300ul); }
 
   MOZ_ALWAYS_INLINE bool
   IsWin2003OrLater()
-  { return IsWindowsVersionOrLater(0x0005000200000000ull); }
+  { return IsWindowsVersionOrLater(0x05020000ul); }
 
   MOZ_ALWAYS_INLINE bool
   IsWin2003SP2OrLater()
-  { return IsWindowsVersionOrLater(0x0005000200020000ull); }
+  { return IsWindowsVersionOrLater(0x05020200ul); }
 
   MOZ_ALWAYS_INLINE bool
   IsVistaOrLater()
-  { return IsWindowsVersionOrLater(0x0006000000000000ull); }
+  { return IsWindowsVersionOrLater(0x06000000ul); }
 
   MOZ_ALWAYS_INLINE bool
   IsVistaSP1OrLater()
-  { return IsWindowsVersionOrLater(0x0006000000010000ull); }
+  { return IsWindowsVersionOrLater(0x06000100ul); }
 
   MOZ_ALWAYS_INLINE bool
   IsWin7OrLater()
-  { return IsWindowsVersionOrLater(0x0006000100000000ull); }
+  { return IsWindowsVersionOrLater(0x06010000ul); }
 
   MOZ_ALWAYS_INLINE bool
   IsWin7SP1OrLater()
-  { return IsWindowsVersionOrLater(0x0006000100010000ull); }
+  { return IsWindowsVersionOrLater(0x06010100ul); }
 
   MOZ_ALWAYS_INLINE bool
   IsWin8OrLater()
-  { return IsWindowsVersionOrLater(0x0006000200000000ull); }
+  { return IsWindowsVersionOrLater(0x06020000ul); }
+
+  MOZ_ALWAYS_INLINE bool
+  IsWin7RTMOrLater()
+  {
+    return IsWin7SP1OrLater() ||
+           (IsWin7OrLater() && IsWindowsBuildOrLater(7600));
+  }
 }
 
 #endif /* mozilla_WindowsVersion_h */
diff --git a/xpcom/base/nsConsoleService.cpp b/xpcom/base/nsConsoleService.cpp
index 3f092bad9f0c..d3394f86df3e 100644
--- a/xpcom/base/nsConsoleService.cpp
+++ b/xpcom/base/nsConsoleService.cpp
@@ -20,9 +20,15 @@
 #include "nsIConsoleListener.h"
 #include "nsPrintfCString.h"
 
-#include "mozilla/Debug.h"
 #include "mozilla/Preferences.h"
 
+#if defined(ANDROID)
+#include <android/log.h>
+#endif
+#ifdef XP_WIN
+#include <windows.h>
+#endif
+
 using namespace mozilla;
 
 NS_IMPL_ADDREF(nsConsoleService)
@@ -185,13 +191,24 @@ nsConsoleService::LogMessageWithMode(nsIConsoleMessage *message, nsConsoleServic
     {
         MutexAutoLock lock(mLock);
 
-        nsString msg;
-        message->GetMessageMoz(getter_Copies(msg));
-        LogOptions options = kPrintToDebugger | kPrintNewLine;
-        if (outputMode == OutputToLog) {
-            options |= kPrintErrorLog;
+#if defined(ANDROID)
+        if (outputMode == OutputToLog)
+        {
+            nsXPIDLString msg;
+            message->GetMessageMoz(getter_Copies(msg));
+            __android_log_print(ANDROID_LOG_ERROR, "GeckoConsole",
+                        "%s",
+                        NS_LossyConvertUTF16toASCII(msg).get());
         }
-        PrintToDebugger(msg, nullptr, options);
+#endif
+#ifdef XP_WIN
+        if (IsDebuggerPresent()) {
+            nsString msg;
+            message->GetMessageMoz(getter_Copies(msg));
+            msg.AppendLiteral("\n");
+            OutputDebugStringW(msg.get());
+        }
+#endif
 
         /*
          * If there's already a message in the slot we're about to replace,
diff --git a/xpcom/base/nsCycleCollector.cpp b/xpcom/base/nsCycleCollector.cpp
index aa39e31dd9e5..9367d62c98db 100644
--- a/xpcom/base/nsCycleCollector.cpp
+++ b/xpcom/base/nsCycleCollector.cpp
@@ -1103,6 +1103,7 @@ class nsCycleCollector : public nsIMemoryReporter
     NS_DECL_NSIMEMORYREPORTER
 
     bool mActivelyCollecting;
+    bool mFreeingSnowWhite;
     // mScanInProgress should be false when we're collecting white objects.
     bool mScanInProgress;
     CycleCollectorResults mResults;
@@ -2464,6 +2465,13 @@ nsCycleCollector::FreeSnowWhite(bool aUntilNoSWInPurpleBuffer)
 {
     CheckThreadSafety();
 
+    if (mFreeingSnowWhite) {
+        return false;
+    }
+
+    AutoRestore<bool> ar(mFreeingSnowWhite);
+    mFreeingSnowWhite = true;
+
     bool hadSnowWhiteObjects = false;
     do {
         SnowWhiteKiller visitor(this, mPurpleBuf.Count());
@@ -2982,6 +2990,7 @@ nsCycleCollector::CollectReports(nsIHandleReportCallback* aHandleReport,
 
 nsCycleCollector::nsCycleCollector() :
     mActivelyCollecting(false),
+    mFreeingSnowWhite(false),
     mScanInProgress(false),
     mJSRuntime(nullptr),
     mIncrementalPhase(IdlePhase),
@@ -3159,9 +3168,10 @@ nsCycleCollector::Collect(ccType aCCType,
     CheckThreadSafety();
 
     // This can legitimately happen in a few cases. See bug 383651.
-    if (mActivelyCollecting) {
+    if (mActivelyCollecting || mFreeingSnowWhite) {
         return false;
     }
+    AutoRestore<bool> ar(mActivelyCollecting);
     mActivelyCollecting = true;
 
     bool startedIdle = (mIncrementalPhase == IdlePhase);
@@ -3202,8 +3212,6 @@ nsCycleCollector::Collect(ccType aCCType,
         }
     } while (!aBudget.checkOverBudget() && !finished);
 
-    mActivelyCollecting = false;
-
     if (aCCType != SliceCC && !startedIdle) {
         // We were in the middle of an incremental CC (using its own listener).
         // Somebody has forced a CC, so after having finished out the current CC,
diff --git a/xpcom/ds/nsHashtable.h b/xpcom/ds/nsHashtable.h
index 318d0afdc727..5e31b1d98b31 100644
--- a/xpcom/ds/nsHashtable.h
+++ b/xpcom/ds/nsHashtable.h
@@ -258,43 +258,6 @@ public:
     uint32_t GetValue() { return mKey; }
 };
 
-////////////////////////////////////////////////////////////////////////////////
-// nsVoidKey: Where keys are void* objects that don't get refcounted.
-
-class nsVoidKey : public nsHashKey {
-  protected:
-    void* mKey;
-
-  public:
-    nsVoidKey(const nsVoidKey& aKey) : mKey(aKey.mKey) {
-#ifdef DEBUG
-        mKeyType = aKey.mKeyType;
-#endif
-    }
-
-    nsVoidKey(void* key) {
-#ifdef DEBUG
-        mKeyType = VoidKey;
-#endif
-        mKey = key;
-    }
-
-    uint32_t HashCode(void) const {
-        return NS_PTR_TO_INT32(mKey);
-    }
-
-    bool Equals(const nsHashKey *aKey) const {
-        NS_ASSERTION(aKey->GetKeyType() == VoidKey, "mismatched key types");
-        return (mKey == ((const nsVoidKey *) aKey)->mKey);
-    }
-
-    nsHashKey *Clone() const {
-        return new nsVoidKey(mKey);
-    }
-
-    void* GetValue() { return mKey; }
-};
-
 // for null-terminated c-strings
 class nsCStringKey : public nsHashKey {
   public:
diff --git a/xpcom/glue/pldhash.h b/xpcom/glue/pldhash.h
index 311a78d17e05..67949e922b9e 100644
--- a/xpcom/glue/pldhash.h
+++ b/xpcom/glue/pldhash.h
@@ -12,10 +12,6 @@
 #include "mozilla/Types.h"
 #include "nscore.h"
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 #if defined(__GNUC__) && defined(__i386__)
 #define PL_DHASH_FASTCALL __attribute__ ((regparm (3),stdcall))
 #elif defined(XP_WIN)
@@ -575,8 +571,4 @@ NS_COM_GLUE void
 PL_DHashTableDumpMeter(PLDHashTable *table, PLDHashEnumerator dump, FILE *fp);
 #endif
 
-#ifdef __cplusplus
-}
-#endif
-
 #endif /* pldhash_h___ */
diff --git a/xpfe/components/windowds/nsWindowDataSource.cpp b/xpfe/components/windowds/nsWindowDataSource.cpp
index dd62664b8647..55a7abf70924 100644
--- a/xpfe/components/windowds/nsWindowDataSource.cpp
+++ b/xpfe/components/windowds/nsWindowDataSource.cpp
@@ -126,22 +126,17 @@ nsWindowDataSource::OnWindowTitleChange(nsIXULWindow *window,
                                         const char16_t *newTitle)
 {
     nsresult rv;
-    
-    nsVoidKey key(window);
 
-    nsCOMPtr<nsISupports> sup =
-        dont_AddRef(mWindowResources.Get(&key));
+    nsCOMPtr<nsIRDFResource> windowResource;
+    mWindowResources.Get(window, getter_AddRefs(windowResource));
 
     // oops, make sure this window is in the hashtable!
-    if (!sup) {
+    if (!windowResource) {
         OnOpenWindow(window);
-        sup = dont_AddRef(mWindowResources.Get(&key));
+        mWindowResources.Get(window, getter_AddRefs(windowResource));
     }
-    
-    NS_ENSURE_TRUE(sup, NS_ERROR_UNEXPECTED);
 
-    nsCOMPtr<nsIRDFResource> windowResource =
-        do_QueryInterface(sup);
+    NS_ENSURE_TRUE(windowResource, NS_ERROR_UNEXPECTED);
 
     nsCOMPtr<nsIRDFLiteral> newTitleLiteral;
     rv = gRDFService->GetLiteral(newTitle, getter_AddRefs(newTitleLiteral));
@@ -151,7 +146,7 @@ nsWindowDataSource::OnWindowTitleChange(nsIXULWindow *window,
     nsCOMPtr<nsIRDFNode> oldTitleNode;
     rv = GetTarget(windowResource, kNC_Name, true,
                    getter_AddRefs(oldTitleNode));
-    
+
     // assert the change
     if (NS_SUCCEEDED(rv) && oldTitleNode)
         // has an existing window title, update it
@@ -164,7 +159,7 @@ nsWindowDataSource::OnWindowTitleChange(nsIXULWindow *window,
     {
       NS_ERROR("unable to set window name");
     }
-    
+
     return NS_OK;
 }
 
@@ -178,8 +173,7 @@ nsWindowDataSource::OnOpenWindow(nsIXULWindow *window)
     nsCOMPtr<nsIRDFResource> windowResource;
     gRDFService->GetResource(windowId, getter_AddRefs(windowResource));
 
-    nsVoidKey key(window);
-    mWindowResources.Put(&key, windowResource);
+    mWindowResources.Put(window, windowResource);
 
     // assert the new window
     if (mContainer)
@@ -192,38 +186,39 @@ nsWindowDataSource::OnOpenWindow(nsIXULWindow *window)
 NS_IMETHODIMP
 nsWindowDataSource::OnCloseWindow(nsIXULWindow *window)
 {
-    nsVoidKey key(window);
-    nsCOMPtr<nsIRDFResource> resource;
-
     nsresult rv;
-
-    if (!mWindowResources.Remove(&key, getter_AddRefs(resource)))
+    nsCOMPtr<nsIRDFResource> resource;
+    mWindowResources.Get(window, getter_AddRefs(resource));
+    if (!resource) {
         return NS_ERROR_UNEXPECTED;
+    }
+
+    mWindowResources.Remove(window);
 
     // make sure we're not shutting down
     if (!mContainer) return NS_OK;
-    
+
     nsCOMPtr<nsIRDFNode> oldKeyNode;
     nsCOMPtr<nsIRDFInt> oldKeyInt;
-    
+
     // get the old keyIndex, if any
     rv = GetTarget(resource, kNC_KeyIndex, true,
                    getter_AddRefs(oldKeyNode));
     if (NS_SUCCEEDED(rv) && (rv != NS_RDF_NO_VALUE))
         oldKeyInt = do_QueryInterface(oldKeyNode);
 
-    
+
     // update RDF and keyindex - from this point forward we'll ignore
     // errors, because they just indicate some kind of RDF inconsistency
     int32_t winIndex = -1;
     rv = mContainer->IndexOf(resource, &winIndex);
-        
+
     if (NS_FAILED(rv))
         return NS_OK;
-            
+
     // unassert the old window, ignore any error
     mContainer->RemoveElement(resource, true);
-    
+
     nsCOMPtr<nsISimpleEnumerator> children;
     rv = mContainer->GetElements(getter_AddRefs(children));
     if (NS_FAILED(rv))
@@ -264,12 +259,12 @@ nsWindowDataSource::OnCloseWindow(nsIXULWindow *window)
         // from (none) to "9"
         else if (newKeyInt)
             Assert(windowResource, kNC_KeyIndex, newKeyInt, true);
-        
+
         // somehow inserting a window above this one,
         // "9" to (none)
         else if (oldKeyInt)
             Unassert(windowResource, kNC_KeyIndex, oldKeyInt);
-        
+
     }
     return NS_OK;
 }
@@ -279,24 +274,16 @@ struct findWindowClosure {
     nsIXULWindow *resultWindow;
 };
 
-static bool
-findWindow(nsHashKey* aKey, void *aData, void* aClosure)
+static PLDHashOperator
+findWindow(nsIXULWindow* aWindow, nsIRDFResource* aResource, void* aClosure)
 {
-    nsVoidKey *thisKey = static_cast<nsVoidKey*>(aKey);
+    findWindowClosure* closure = static_cast<findWindowClosure*>(aClosure);
 
-    nsIRDFResource *resource =
-        static_cast<nsIRDFResource*>(aData);
-    
-    findWindowClosure* closure =
-        static_cast<findWindowClosure*>(aClosure);
-
-    if (resource == closure->targetResource) {
-        closure->resultWindow =
-            static_cast<nsIXULWindow*>
-                       (thisKey->GetValue());
-        return false;         // stop enumerating
+    if (aResource == closure->targetResource) {
+        closure->resultWindow = aWindow;
+        return PL_DHASH_STOP;
     }
-    return true;
+    return PL_DHASH_NEXT;
 }
 
 // nsIWindowDataSource implementation
@@ -311,7 +298,7 @@ nsWindowDataSource::GetWindowForResource(const char *aResourceString,
 
     // now reverse-lookup in the hashtable
     findWindowClosure closure = { windowResource.get(), nullptr };
-    mWindowResources.Enumerate(findWindow, (void*)&closure);
+    mWindowResources.EnumerateRead(findWindow, &closure);
     if (closure.resultWindow) {
 
         // this sucks, we have to jump through docshell to go from
@@ -321,7 +308,7 @@ nsWindowDataSource::GetWindowForResource(const char *aResourceString,
 
         if (docShell) {
             nsCOMPtr<nsIDOMWindow> result = do_GetInterface(docShell);
-        
+
             *aResult = result;
             NS_IF_ADDREF(*aResult);
         }
@@ -341,12 +328,12 @@ nsWindowDataSource::GetWindowForResource(const char *aResourceString,
 NS_IMETHODIMP nsWindowDataSource::GetURI(char * *aURI)
 {
     NS_ENSURE_ARG_POINTER(aURI);
-    
+
     *aURI = ToNewCString(NS_LITERAL_CSTRING("rdf:window-mediator"));
 
     if (!*aURI)
         return NS_ERROR_OUT_OF_MEMORY;
-    
+
     return NS_OK;
 }
 
@@ -373,11 +360,10 @@ NS_IMETHODIMP nsWindowDataSource::GetTarget(nsIRDFResource *aSource, nsIRDFResou
         rv = gRDFService->GetIntLiteral(theIndex, getter_AddRefs(indexInt));
         if (NS_FAILED(rv)) return(rv);
         if (!indexInt) return(NS_ERROR_FAILURE);
-        
+
         return CallQueryInterface(indexInt, _retval);
     }
 
-    
     return mInner->GetTarget(aSource, aProperty, aTruthValue, _retval);
 }
 
@@ -532,7 +518,7 @@ NS_IMETHODIMP nsWindowDataSource::BeginUpdateBatch()
         return mInner->BeginUpdateBatch();
     return NS_OK;
 }
-                                                                                
+
 /* void endUpdateBatch (); */
 NS_IMETHODIMP nsWindowDataSource::EndUpdateBatch()
 {
@@ -561,7 +547,7 @@ static const mozilla::Module::CategoryEntry kWindowDSCategories[] = {
     { "app-startup", "Window Data Source", "service," NS_RDF_DATASOURCE_CONTRACTID_PREFIX "window-mediator" },
     { nullptr }
 };
-        
+
 static const mozilla::Module kWindowDSModule = {
     mozilla::Module::kVersion,
     kWindowDSCIDs,
diff --git a/xpfe/components/windowds/nsWindowDataSource.h b/xpfe/components/windowds/nsWindowDataSource.h
index 9aca0fd9461b..d27f09f949bf 100644
--- a/xpfe/components/windowds/nsWindowDataSource.h
+++ b/xpfe/components/windowds/nsWindowDataSource.h
@@ -8,9 +8,10 @@
 #include "nsIWindowDataSource.h"
 #include "nsIObserver.h"
 
+#include "nsHashKeys.h"
 #include "nsIRDFService.h"
 #include "nsIRDFContainer.h"
-#include "nsHashtable.h"
+#include "nsInterfaceHashtable.h"
 #include "nsCycleCollectionParticipant.h"
 
 // {C744CA3D-840B-460a-8D70-7CE63C51C958}
@@ -29,7 +30,7 @@ class nsWindowDataSource : public nsIRDFDataSource,
     virtual ~nsWindowDataSource();
 
     nsresult Init();
-    
+
     NS_DECL_CYCLE_COLLECTING_ISUPPORTS
     NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsWindowDataSource,
                                              nsIRDFDataSource)
@@ -41,11 +42,11 @@ class nsWindowDataSource : public nsIRDFDataSource,
  private:
 
     // mapping of window -> RDF resource
-    nsSupportsHashtable mWindowResources;
+    nsInterfaceHashtable<nsPtrHashKey<nsIXULWindow>, nsIRDFResource> mWindowResources;
 
     static uint32_t windowCount;
     static uint32_t gRefCnt;
-    
+
     nsCOMPtr<nsIRDFDataSource> mInner;
     nsCOMPtr<nsIRDFContainer> mContainer;
 
@@ -54,5 +55,3 @@ class nsWindowDataSource : public nsIRDFDataSource,
     static nsIRDFResource* kNC_WindowRoot;
     static nsIRDFService* gRDFService;
 };
-
-