diff --git a/.hgtags b/.hgtags
index 32c5e085d21..75cb27deebf 100644
--- a/.hgtags
+++ b/.hgtags
@@ -37,3 +37,4 @@ fe9cc55b8db7f56f7e68a246acba363743854979 UPDATE_PACKAGING_R8
 376b78fc72230aaf2ca4e279a8f4ef1efd4a1d9f GECKO_1_9_2_BASE
 138f593553b66c9f815e8f57870c19d6347f7702 UPDATE_PACKAGING_R9
 138f593553b66c9f815e8f57870c19d6347f7702 UPDATE_PACKAGING_R10
+138f593553b66c9f815e8f57870c19d6347f7702 UPDATE_PACKAGING_R11
diff --git a/browser/base/Makefile.in b/browser/base/Makefile.in
index d0ebbef942f..8cd20e6aa31 100644
--- a/browser/base/Makefile.in
+++ b/browser/base/Makefile.in
@@ -73,10 +73,6 @@ ifneq (,$(filter windows gtk2 cocoa, $(MOZ_WIDGET_TOOLKIT)))
 DEFINES += -DHAVE_SHELL_SERVICE=1
 endif
 
-ifdef MOZ_UPDATER
-DEFINES += -DMOZ_UPDATER=1
-endif
-
 ifneq (,$(filter windows cocoa gtk2, $(MOZ_WIDGET_TOOLKIT)))
 ifneq ($(OS_ARCH),WINCE)
 DEFINES += -DCONTEXT_COPY_IMAGE_CONTENTS=1
diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index 0cd483672d8..376225d9cd4 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -1403,6 +1403,8 @@ function delayedStartup(isLoadingBlank, mustLoadSidebar) {
     Win7Features.onOpenWindow();
 
   TabsOnTop.syncCommand();
+
+  Services.obs.notifyObservers(window, "browser-delayed-startup-finished", "");
 }
 
 function BrowserShutdown()
diff --git a/browser/components/places/content/controller.js b/browser/components/places/content/controller.js
index 8e6ba29edb8..afdd501447b 100644
--- a/browser/components/places/content/controller.js
+++ b/browser/components/places/content/controller.js
@@ -125,6 +125,26 @@ PlacesController.prototype = {
    */
   _view: null,
 
+  supportsCommand: function PC_supportsCommand(aCommand) {
+    //LOG("supportsCommand: " + command);
+    // Non-Places specific commands that we also support
+    switch (aCommand) {
+    case "cmd_undo":
+    case "cmd_redo":
+    case "cmd_cut":
+    case "cmd_copy":
+    case "cmd_paste":
+    case "cmd_delete":
+    case "cmd_selectAll":
+      return true;
+    }
+
+    // All other Places Commands are prefixed with "placesCmd_" ... this 
+    // filters out other commands that we do _not_ support (see 329587).
+    const CMD_PREFIX = "placesCmd_";
+    return (aCommand.substr(0, CMD_PREFIX.length) == CMD_PREFIX);
+  },
+
   isCommandEnabled: function PC_isCommandEnabled(aCommand) {
     switch (aCommand) {
     case "cmd_undo":
@@ -206,26 +226,6 @@ PlacesController.prototype = {
     }
   },
 
-  supportsCommand: function PC_supportsCommand(aCommand) {
-    //LOG("supportsCommand: " + command);
-    // Non-Places specific commands that we also support
-    switch (aCommand) {
-    case "cmd_undo":
-    case "cmd_redo":
-    case "cmd_cut":
-    case "cmd_copy":
-    case "cmd_paste":
-    case "cmd_delete":
-    case "cmd_selectAll":
-      return true;
-    }
-
-    // All other Places Commands are prefixed with "placesCmd_" ... this 
-    // filters out other commands that we do _not_ support (see 329587).
-    const CMD_PREFIX = "placesCmd_";
-    return (aCommand.substr(0, CMD_PREFIX.length) == CMD_PREFIX);
-  },
-
   doCommand: function PC_doCommand(aCommand) {
     switch (aCommand) {
     case "cmd_undo":
diff --git a/browser/components/places/src/Makefile.in b/browser/components/places/src/Makefile.in
index 9e5f53a467a..d2c2408010d 100644
--- a/browser/components/places/src/Makefile.in
+++ b/browser/components/places/src/Makefile.in
@@ -49,7 +49,7 @@ EXTRA_COMPONENTS = \
   PlacesProtocolHandler.js \
   $(NULL)
 
-EXTRA_PP_JS_MODULES = \
+EXTRA_JS_MODULES = \
   PlacesUIUtils.jsm \
   $(NULL)
 
diff --git a/browser/components/places/src/PlacesUIUtils.jsm b/browser/components/places/src/PlacesUIUtils.jsm
index 21851a5e265..2413724f404 100644
--- a/browser/components/places/src/PlacesUIUtils.jsm
+++ b/browser/components/places/src/PlacesUIUtils.jsm
@@ -48,11 +48,7 @@ var Cr = Components.results;
 var Cu = Components.utils;
 
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
-
-XPCOMUtils.defineLazyGetter(this, "Services", function() {
-  Cu.import("resource://gre/modules/Services.jsm");
-  return Services;
-});
+Cu.import("resource://gre/modules/Services.jsm");
 
 XPCOMUtils.defineLazyGetter(this, "PlacesUtils", function() {
   Cu.import("resource://gre/modules/PlacesUtils.jsm");
@@ -652,7 +648,7 @@ var PlacesUIUtils = {
 
     var features;
     if (aMinimalUI)
-      features = "centerscreen,chrome,dialog,resizable,modal";
+      features = "centerscreen,chrome,modal,resizable=yes";
     else
       features = "centerscreen,chrome,modal,resizable=no";
     this._getCurrentActiveWin().openDialog(dialogURL, "",  features, aInfo);
@@ -682,7 +678,6 @@ var PlacesUIUtils = {
         node.firstChild._placesView)
       return node.firstChild._placesView;
 
-    // XXXmano: somehow we reach the xul document here!
     while (node instanceof Ci.nsIDOMElement) {
       if (node._placesView)
         return node._placesView;
@@ -739,19 +734,20 @@ var PlacesUIUtils = {
    *
    */
   checkURLSecurity: function PUIU_checkURLSecurity(aURINode, aWindow) {
-    if (!PlacesUtils.nodeIsBookmark(aURINode)) {
-      var uri = PlacesUtils._uri(aURINode.uri);
-      if (uri.schemeIs("javascript") || uri.schemeIs("data")) {
-        const BRANDING_BUNDLE_URI = "chrome://branding/locale/brand.properties";
-        var brandShortName = Cc["@mozilla.org/intl/stringbundle;1"].
-                             getService(Ci.nsIStringBundleService).
-                             createBundle(BRANDING_BUNDLE_URI).
-                             GetStringFromName("brandShortName");
+    if (PlacesUtils.nodeIsBookmark(aURINode))
+      return true;
 
-        var errorStr = this.getString("load-js-data-url-error");
-        Services.prompt.alert(aWindow, brandShortName, errorStr);
-        return false;
-      }
+    var uri = PlacesUtils._uri(aURINode.uri);
+    if (uri.schemeIs("javascript") || uri.schemeIs("data")) {
+      const BRANDING_BUNDLE_URI = "chrome://branding/locale/brand.properties";
+      var brandShortName = Cc["@mozilla.org/intl/stringbundle;1"].
+                           getService(Ci.nsIStringBundleService).
+                           createBundle(BRANDING_BUNDLE_URI).
+                           GetStringFromName("brandShortName");
+
+      var errorStr = this.getString("load-js-data-url-error");
+      Services.prompt.alert(aWindow, brandShortName, errorStr);
+      return false;
     }
     return true;
   },
@@ -792,13 +788,11 @@ var PlacesUIUtils = {
    * Gives the user a chance to cancel loading lots of tabs at once
    */
   _confirmOpenInTabs: function PUIU__confirmOpenInTabs(numTabsToOpen) {
-    let pref = Services.prefs;
-    let prompt = Services.prompt;
     const WARN_ON_OPEN_PREF = "browser.tabs.warnOnOpen";
     var reallyOpen = true;
 
-    if (pref.getBoolPref(WARN_ON_OPEN_PREF)) {
-      if (numTabsToOpen >= pref.getIntPref("browser.tabs.maxOpenBeforeWarn")) {
+    if (Services.prefs.getBoolPref(WARN_ON_OPEN_PREF)) {
+      if (numTabsToOpen >= Services.prefs.getIntPref("browser.tabs.maxOpenBeforeWarn")) {
         // default to true: if it were false, we wouldn't get this far
         var warnOnOpen = { value: true };
 
@@ -810,12 +804,12 @@ var PlacesUIUtils = {
                              createBundle(BRANDING_BUNDLE_URI).
                              GetStringFromName("brandShortName");
 
-        var buttonPressed = prompt.confirmEx(
+        var buttonPressed = Services.prompt.confirmEx(
           this._getCurrentActiveWin(),
           this.getString("tabs.openWarningTitle"),
           this.getFormattedString(messageKey, [numTabsToOpen, brandShortName]),
-          (prompt.BUTTON_TITLE_IS_STRING * prompt.BUTTON_POS_0) +
-            (prompt.BUTTON_TITLE_CANCEL * prompt.BUTTON_POS_1),
+          (Services.prompt.BUTTON_TITLE_IS_STRING * Services.prompt.BUTTON_POS_0) +
+            (Services.prompt.BUTTON_TITLE_CANCEL * Services.prompt.BUTTON_POS_1),
           this.getString(openKey), null, null,
           this.getFormattedString("tabs.openWarningPromptMeBranded",
                                   [brandShortName]),
@@ -825,7 +819,7 @@ var PlacesUIUtils = {
         reallyOpen = (buttonPressed == 0);
         // don't set the pref unless they press OK and it's false
         if (reallyOpen && !warnOnOpen.value)
-          pref.setBoolPref(WARN_ON_OPEN_PREF, false);
+          Services.prefs.setBoolPref(WARN_ON_OPEN_PREF, false);
       }
     }
 
diff --git a/browser/components/places/tests/browser/Makefile.in b/browser/components/places/tests/browser/Makefile.in
index 09740d89d89..6b757ece288 100644
--- a/browser/components/places/tests/browser/Makefile.in
+++ b/browser/components/places/tests/browser/Makefile.in
@@ -54,6 +54,7 @@ _BROWSER_TEST_FILES = \
 	browser_sort_in_library.js \
 	browser_library_open_leak.js \
 	browser_library_panel_leak.js \
+	browser_library_search.js \
 	browser_history_sidebar_search.js \
 	browser_bookmarksProperties.js \
 	browser_forgetthissite_single.js \
@@ -66,8 +67,5 @@ _BROWSER_TEST_FILES = \
 	browser_library_infoBox.js \
 	$(NULL)
 
-# Test disabled because it's failing every time!  See bug 570720.
-#	browser_library_search.js \
-
 libs:: $(_BROWSER_TEST_FILES)
 	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/browser/$(relativesrcdir)
diff --git a/browser/components/places/tests/browser/browser_library_search.js b/browser/components/places/tests/browser/browser_library_search.js
index 96656b57601..855f8de9f21 100644
--- a/browser/components/places/tests/browser/browser_library_search.js
+++ b/browser/components/places/tests/browser/browser_library_search.js
@@ -59,7 +59,7 @@
  *   6. if folder scope was clicked, searches again and ensures folder scope
  *      remains selected.
  */
- 
+
 const TEST_URL = "http://dummy.mozilla.org/";
 
 // Add your tests here.  Each is a function that's called by testHelper().
@@ -224,11 +224,15 @@ function search(aFolderId, aSearchStr, aExpectedScopeButtonId) {
     if (getSelectedScopeButtonId() == "scopeBarHistory" ||
         getSelectedScopeButtonId() == "scopeBarAll" ||
         aFolderId == PlacesUtils.bookmarks.unfiledBookmarksFolder) {
-      // Check that search has returned a valid result.
-      contentTree.view.selection.select(0);
-      var foundNode = contentTree.selectedNode;
-      isnot(foundNode, null, "Found a valid node");
-      is(foundNode.uri, TEST_URL);
+      // Check that the target node exists in the tree's search results.
+      var node = null;
+      for (var i = 0; i < contentTree.view.rowCount; i++) {
+        node = contentTree.view.nodeForTreeIndex(i);
+        if (node.uri === TEST_URL)
+          break;
+      }
+      isnot(node, null, "At least the target node should be in the tree");
+      is(node.uri, TEST_URL, "URI of node should match target URL");
     }
   }
   else {
diff --git a/browser/components/preferences/Makefile.in b/browser/components/preferences/Makefile.in
index c34dfa1ccff..54e5e322803 100644
--- a/browser/components/preferences/Makefile.in
+++ b/browser/components/preferences/Makefile.in
@@ -57,7 +57,3 @@ DEFINES += \
 ifneq (,$(filter windows gtk2 cocoa, $(MOZ_WIDGET_TOOLKIT)))
 DEFINES += -DHAVE_SHELL_SERVICE=1
 endif
-
-ifdef MOZ_UPDATER
-DEFINES += -DMOZ_UPDATER=1
-endif
diff --git a/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_newwindow_stopcmd.js b/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_newwindow_stopcmd.js
index bb3843d7f86..c1c7b4e4447 100644
--- a/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_newwindow_stopcmd.js
+++ b/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_newwindow_stopcmd.js
@@ -47,17 +47,17 @@ function test() {
   pb.privateBrowsingEnabled = true;
 
   let win = OpenBrowserWindow();
-  win.addEventListener("load", function() {
-    executeSoon(function() {
-      executeSoon(function() {
-        let cmd = win.document.getElementById("Tools:PrivateBrowsing");
-        ok(!cmd.hasAttribute("disabled"),
-           "The Private Browsing command in a new window should be enabled");
+  Services.obs.addObserver(function(subject, topic, data) {
+    Services.obs.removeObserver(arguments.callee, "browser-delayed-startup-finished");
+    var notifiedWin = subject.QueryInterface(Ci.nsIDOMWindow);
+    is(win, notifiedWin, "sanity check");
 
-        win.close();
-        pb.privateBrowsingEnabled = false;
-        finish();
-      });
-    });
-  }, false);
+    let cmd = win.document.getElementById("Tools:PrivateBrowsing");
+    ok(!cmd.hasAttribute("disabled"),
+       "The Private Browsing command in a new window should be enabled");
+
+    win.close();
+    pb.privateBrowsingEnabled = false;
+    finish();
+  }, "browser-delayed-startup-finished", false);
 }
diff --git a/browser/components/sessionstore/content/aboutSessionRestore.js b/browser/components/sessionstore/content/aboutSessionRestore.js
index e8f2e2a7cff..aa02af0a715 100644
--- a/browser/components/sessionstore/content/aboutSessionRestore.js
+++ b/browser/components/sessionstore/content/aboutSessionRestore.js
@@ -59,8 +59,7 @@ window.onload = function() {
   event.initUIEvent("input", true, true, window, 0);
   sessionData.dispatchEvent(event);
   
-  var s = new Components.utils.Sandbox("about:blank");
-  gStateObject = Components.utils.evalInSandbox("(" + sessionData.value + ")", s);
+  gStateObject = JSON.parse(sessionData.value);
   
   initTreeView();
   
@@ -121,7 +120,7 @@ function restoreSession() {
       ix--;
     }
   }
-  var stateString = gStateObject.toSource();
+  var stateString = JSON.stringify(gStateObject);
   
   var ss = Cc["@mozilla.org/browser/sessionstore;1"].getService(Ci.nsISessionStore);
   var top = getBrowserWindow();
@@ -238,7 +237,7 @@ function restoreSingleTab(aIx, aShifted) {
   var ss = Cc["@mozilla.org/browser/sessionstore;1"].getService(Ci.nsISessionStore);
   var tabState = gStateObject.windows[item.parent.ix]
                              .tabs[aIx - gTreeData.indexOf(item.parent) - 1];
-  ss.setTabState(newTab, tabState.toSource());
+  ss.setTabState(newTab, JSON.stringify(tabState));
   
   // respect the preference as to whether to select the tab (the Shift key inverses)
   var prefBranch = Cc["@mozilla.org/preferences-service;1"].getService(Ci.nsIPrefBranch);
diff --git a/browser/components/sessionstore/nsISessionStore.idl b/browser/components/sessionstore/nsISessionStore.idl
index e9d2fe8484c..79a96319055 100644
--- a/browser/components/sessionstore/nsISessionStore.idl
+++ b/browser/components/sessionstore/nsISessionStore.idl
@@ -182,7 +182,7 @@ interface nsISessionStore : nsISupports
   /**
    * @param aWindow      is the browser window to set the value for.
    * @param aKey         is the value's name.
-   * @param aStringValue is the value itself (use toSource/eval before setting JS objects).
+   * @param aStringValue is the value itself (use JSON.stringify/parse before setting JS objects).
    */
   void setWindowValue(in nsIDOMWindow aWindow, in AString aKey, in AString aStringValue);
   
@@ -203,7 +203,7 @@ interface nsISessionStore : nsISupports
   /**
    * @param aTab         is the tabbrowser tab to set the value for.
    * @param aKey         is the value's name.
-   * @param aStringValue is the value itself (use toSource/eval before setting JS objects).
+   * @param aStringValue is the value itself (use JSON.stringify/parse before setting JS objects).
    */
   void setTabValue(in nsIDOMNode aTab, in AString aKey, in AString aStringValue);
 
diff --git a/browser/components/sessionstore/src/nsSessionStartup.js b/browser/components/sessionstore/src/nsSessionStartup.js
index b07896fa3c1..4760b068f9b 100644
--- a/browser/components/sessionstore/src/nsSessionStartup.js
+++ b/browser/components/sessionstore/src/nsSessionStartup.js
@@ -125,14 +125,24 @@ SessionStartup.prototype = {
     this._iniString = this._readStateFile(sessionFile);
     if (!this._iniString)
       return;
-    
+
+    // parse the session state into a JS object
+    let initialState;
     try {
-      // parse the session state into JS objects
-      var s = new Cu.Sandbox("about:blank");
-      var initialState = Cu.evalInSandbox("(" + this._iniString + ")", s);
+      // remove unneeded braces (added for compatibility with Firefox 2.0 and 3.0)
+      if (this._iniString.charAt(0) == '(')
+        this._iniString = this._iniString.slice(1, -1);
+      try {
+        initialState = JSON.parse(this._iniString);
+      }
+      catch (exJSON) {
+        var s = new Cu.Sandbox("about:blank");
+        initialState = Cu.evalInSandbox("(" + this._iniString + ")", s);
+        this._iniString = JSON.stringify(initialState);
+      }
     }
-    catch (ex) { debug("The session file is invalid: " + ex); } 
-    
+    catch (ex) { debug("The session file is invalid: " + ex); }
+
     let lastSessionCrashed =
       initialState && initialState.session && initialState.session.state &&
       initialState.session.state == STATE_RUNNING_STR;
diff --git a/browser/components/sessionstore/src/nsSessionStore.js b/browser/components/sessionstore/src/nsSessionStore.js
index e59fd7e9cd8..833ecccadd6 100644
--- a/browser/components/sessionstore/src/nsSessionStore.js
+++ b/browser/components/sessionstore/src/nsSessionStore.js
@@ -110,6 +110,10 @@ const CAPABILITIES = [
   "DNSPrefetch", "Auth"
 ];
 
+// These keys are for internal use only - they shouldn't be part of the JSON
+// that gets saved to disk nor part of the strings returned by the API.
+const INTERNAL_KEYS = ["_tabStillLoading", "_hosts", "_formDataSaved"];
+
 #ifndef XP_WIN
 #define BROKEN_WM_Z_ORDER
 #endif
@@ -261,7 +265,7 @@ SessionStoreService.prototype = {
     if (iniString) {
       try {
         // parse the session state into JS objects
-        this._initialState = this._safeEval("(" + iniString + ")");
+        this._initialState = JSON.parse(iniString);
         
         let lastSessionCrashed =
           this._initialState.session && this._initialState.session.state &&
@@ -519,7 +523,10 @@ SessionStoreService.prototype = {
     case "private-browsing-change-granted":
       if (aData == "enter") {
         this.saveState(true);
-        this._stateBackup = this._safeEval(this._getCurrentState(true).toSource());
+        // We stringify & parse the current state so that we have have an object
+        // that won't change. _getCurrentState returns an object with references
+        // to objects that can change (specifically this._windows[x]).
+        this._stateBackup = JSON.parse(this._toJSONString(this._getCurrentState(true)));
       }
       break;
     }
@@ -888,7 +895,7 @@ SessionStoreService.prototype = {
     this._handleClosedWindows();
 
     try {
-      var state = this._safeEval("(" + aState + ")");
+      var state = JSON.parse(aState);
     }
     catch (ex) { /* invalid state object - don't restore anything */ }
     if (!state || !state.windows)
@@ -934,7 +941,7 @@ SessionStoreService.prototype = {
     if (!aWindow.__SSi)
       throw (Components.returnCode = Cr.NS_ERROR_INVALID_ARG);
     
-    this.restoreWindow(aWindow, "(" + aState + ")", aOverwrite);
+    this.restoreWindow(aWindow, aState, aOverwrite);
   },
 
   getTabState: function sss_getTabState(aTab) {
@@ -950,7 +957,7 @@ SessionStoreService.prototype = {
   },
 
   setTabState: function sss_setTabState(aTab, aState) {
-    var tabState = this._safeEval("(" + aState + ")");
+    var tabState = JSON.parse(aState);
     if (!tabState.entries || !aTab.ownerDocument || !aTab.ownerDocument.defaultView.__SSi)
       throw (Components.returnCode = Cr.NS_ERROR_INVALID_ARG);
     
@@ -1870,7 +1877,7 @@ SessionStoreService.prototype = {
       this.onLoad(aWindow);
 
     try {
-      var root = typeof aState == "string" ? this._safeEval(aState) : aState;
+      var root = typeof aState == "string" ? JSON.parse(aState) : aState;
       if (!root.windows[0]) {
         this._sendRestoreCompletedNotifications();
         return; // nothing to restore
@@ -2585,8 +2592,7 @@ SessionStoreService.prototype = {
   _saveStateObject: function sss_saveStateObject(aStateObj) {
     var stateString = Cc["@mozilla.org/supports-string;1"].
                         createInstance(Ci.nsISupportsString);
-    // parentheses are for backwards compatibility with Firefox 2.0 and 3.0
-    stateString.data = "(" + this._toJSONString(aStateObj) + ")";
+    stateString.data = this._toJSONString(aStateObj);
 
     Services.obs.notifyObservers(stateString, "sessionstore-state-write", "");
 
@@ -2863,13 +2869,6 @@ SessionStoreService.prototype = {
             sessionAge && sessionAge >= SIX_HOURS_IN_MS);
   },
 
-  /**
-   * safe eval'ing
-   */
-  _safeEval: function sss_safeEval(aStr) {
-    return Cu.evalInSandbox(aStr, new Cu.Sandbox("about:blank"));
-  },
-
   /**
    * Converts a JavaScript object into a JSON string
    * (see http://www.json.org/ for more information).
@@ -2880,18 +2879,11 @@ SessionStoreService.prototype = {
    * @returns the object's JSON representation
    */
   _toJSONString: function sss_toJSONString(aJSObject) {
-    // XXXzeniko drop the following keys used only for internal bookkeeping:
-    //           _tabStillLoading, _hosts, _formDataSaved
-    let jsonString = JSON.stringify(aJSObject);
-    
-    if (/[\u2028\u2029]/.test(jsonString)) {
-      // work-around for bug 485563 until we can use JSON.parse
-      // instead of evalInSandbox everywhere
-      jsonString = jsonString.replace(/[\u2028\u2029]/g,
-                                      function($0) "\\u" + $0.charCodeAt(0).toString(16));
+    function exclude(key, value) {
+      // returning undefined results in the exclusion of that key
+      return INTERNAL_KEYS.indexOf(key) == -1 ? value : undefined;
     }
-    
-    return jsonString;
+    return JSON.stringify(aJSObject, exclude);
   },
 
   _sendRestoreCompletedNotifications: function sss_sendRestoreCompletedNotifications() {
diff --git a/browser/components/sessionstore/test/browser/browser_248970_b.js b/browser/components/sessionstore/test/browser/browser_248970_b.js
index 1246ad6f814..458d7104a6f 100644
--- a/browser/components/sessionstore/test/browser/browser_248970_b.js
+++ b/browser/components/sessionstore/test/browser/browser_248970_b.js
@@ -130,7 +130,7 @@ function test() {
 
   // public session, add new tab: (A)
   let tab_A = gBrowser.addTab(testURL);
-  ss.setTabState(tab_A, state.toSource());
+  ss.setTabState(tab_A, JSON.stringify(state));
   tab_A.linkedBrowser.addEventListener("load", function(aEvent) {
     this.removeEventListener("load", arguments.callee, true);
 
@@ -167,7 +167,7 @@ function test() {
 
       // private browsing session, new tab: (B)
       let tab_B = gBrowser.addTab(testURL2);
-      ss.setTabState(tab_B, state1.toSource());
+      ss.setTabState(tab_B, JSON.stringify(state1));
       tab_B.linkedBrowser.addEventListener("load", function(aEvent) {
         this.removeEventListener("load", arguments.callee, true);
 
diff --git a/browser/components/sessionstore/test/browser/browser_345898.js b/browser/components/sessionstore/test/browser/browser_345898.js
index 10b5b8343cb..9b4a6534dc4 100644
--- a/browser/components/sessionstore/test/browser/browser_345898.js
+++ b/browser/components/sessionstore/test/browser/browser_345898.js
@@ -58,7 +58,7 @@ function test() {
      "Invalid tab for getTabState throws");
   ok(test(function() ss.setTabState({}, "{}")),
      "Invalid tab state for setTabState throws");
-  ok(test(function() ss.setTabState({}, "{ entries: [] }")),
+  ok(test(function() ss.setTabState({}, JSON.stringify({ entries: [] }))),
      "Invalid tab for setTabState throws");
   ok(test(function() ss.duplicateTab({}, {})),
      "Invalid tab for duplicateTab throws");
diff --git a/browser/components/sessionstore/test/browser/browser_367052.js b/browser/components/sessionstore/test/browser/browser_367052.js
index 1bbffefcd61..d205fbf943c 100644
--- a/browser/components/sessionstore/test/browser/browser_367052.js
+++ b/browser/components/sessionstore/test/browser/browser_367052.js
@@ -55,7 +55,7 @@ function test() {
     let history = tab.linkedBrowser.webNavigation.sessionHistory;
     ok(history.count >= 1, "the new tab does have at least one history entry");
     
-    ss.setTabState(tab, "{ entries: [] }");
+    ss.setTabState(tab, JSON.stringify({ entries: [] }));
     tab.linkedBrowser.addEventListener("load", function(aEvent) {
       this.removeEventListener("load", arguments.callee, true);
       ok(history.count == 0, "the tab was restored without any history whatsoever");
diff --git a/browser/components/sessionstore/test/browser/browser_393716.js b/browser/components/sessionstore/test/browser/browser_393716.js
index 08758f34272..e00d5b48c71 100644
--- a/browser/components/sessionstore/test/browser/browser_393716.js
+++ b/browser/components/sessionstore/test/browser/browser_393716.js
@@ -27,7 +27,7 @@ function test() {
     ok(state, "get the tab's state");
     
     // verify the tab state's integrity
-    state = eval("(" + state + ")");
+    state = JSON.parse(state);
     ok(state instanceof Object && state.entries instanceof Array && state.entries.length > 0,
        "state object seems valid");
     ok(state.entries.length == 1 && state.entries[0].url == testURL,
@@ -50,7 +50,7 @@ function test() {
   // create a new tab
   let tab2 = tabbrowser.addTab();
   // set the tab's state
-  ss.setTabState(tab2, state.toSource());
+  ss.setTabState(tab2, JSON.stringify(state));
   tab2.linkedBrowser.addEventListener("load", function(aEvent) {
     this.removeEventListener("load", arguments.callee, true);
     // verify the correctness of the restored tab
diff --git a/browser/components/sessionstore/test/browser/browser_394759.js b/browser/components/sessionstore/test/browser/browser_394759.js
index 9c7ed76da23..ba28c195d3c 100644
--- a/browser/components/sessionstore/test/browser/browser_394759.js
+++ b/browser/components/sessionstore/test/browser/browser_394759.js
@@ -87,7 +87,7 @@ function test() {
             is(ss.getClosedWindowCount(), closedWindowCount + 1,
                "The closed window was added to Recently Closed Windows");
             let data = JSON.parse(ss.getClosedWindowData())[0];
-            ok(data.title == testURL && data.toSource().indexOf(uniqueText) > -1,
+            ok(data.title == testURL && JSON.stringify(data).indexOf(uniqueText) > -1,
                "The closed window data was stored correctly");
 
             // reopen the closed window and ensure its integrity
diff --git a/browser/components/sessionstore/test/browser/browser_394759_privatebrowsing.js b/browser/components/sessionstore/test/browser/browser_394759_privatebrowsing.js
index ef42f42c414..6ea99ed00b6 100644
--- a/browser/components/sessionstore/test/browser/browser_394759_privatebrowsing.js
+++ b/browser/components/sessionstore/test/browser/browser_394759_privatebrowsing.js
@@ -139,7 +139,7 @@ function continue_test() {
 
                   // Ensure we added window to undo list.
                   let data = JSON.parse(ss.getClosedWindowData())[0];
-                  ok(data.toSource().indexOf(TESTS[aTestIndex].value) > -1,
+                  ok(JSON.stringify(data).indexOf(TESTS[aTestIndex].value) > -1,
                      "The closed window data was stored correctly");
 
                   if (aRunNextTestInPBMode) {
@@ -164,7 +164,7 @@ function continue_test() {
                        "when exiting PB mode");
 
                     let data = JSON.parse(ss.getClosedWindowData())[0];
-                    ok(data.toSource().indexOf(TESTS[aTestIndex - 1].value) > -1,
+                    ok(JSON.stringify(data).indexOf(TESTS[aTestIndex - 1].value) > -1,
                        "The data associated with the recently closed window was " +
                        "restored when exiting PB mode");
                   }
diff --git a/browser/components/sessionstore/test/browser/browser_447951.js b/browser/components/sessionstore/test/browser/browser_447951.js
index 32b78dcff9c..255d9740f07 100644
--- a/browser/components/sessionstore/test/browser/browser_447951.js
+++ b/browser/components/sessionstore/test/browser/browser_447951.js
@@ -55,7 +55,7 @@ function test() {
     ss.setTabState(tab, JSON.stringify(tabState));
     tab.addEventListener("SSTabRestored", function(aEvent) {
       tab.removeEventListener("SSTabRestored", arguments.callee, false);
-      tabState = eval("(" + ss.getTabState(tab) + ")");
+      tabState = JSON.parse(ss.getTabState(tab));
       is(tabState.entries.length, max_entries, "session history filled to the limit");
       is(tabState.entries[0].url, baseURL + 0, "... but not more");
       
@@ -67,7 +67,7 @@ function test() {
       doc.querySelector("a").dispatchEvent(event);
       
       executeSoon(function() {
-        tabState = eval("(" + ss.getTabState(tab) + ")");
+        tabState = JSON.parse(ss.getTabState(tab));
         is(tab.linkedBrowser.currentURI.spec, baseURL + "end",
            "the new anchor was loaded");
         is(tabState.entries[tabState.entries.length - 1].url, baseURL + "end",
diff --git a/browser/components/sessionstore/test/browser/browser_448741.js b/browser/components/sessionstore/test/browser/browser_448741.js
index 5d254822275..b6c098e8f50 100644
--- a/browser/components/sessionstore/test/browser/browser_448741.js
+++ b/browser/components/sessionstore/test/browser/browser_448741.js
@@ -57,7 +57,7 @@ function test() {
     ok(aSubject.data.indexOf(uniqueValue) > -1, "data contains our value?");
 
     // find the data for the newly added tab and delete it
-    let state = eval(aSubject.data);
+    let state = JSON.parse(aSubject.data);
     state.windows.forEach(function (winData) {
       winData.tabs.forEach(function (tabData) {
         if (tabData.extData && uniqueName in tabData.extData &&
@@ -69,7 +69,7 @@ function test() {
     });
 
     ok(valueWasCleaned, "found and removed the specific tab value");
-    aSubject.data = uneval(state);
+    aSubject.data = JSON.stringify(state);
     Services.obs.removeObserver(cleaningObserver, aTopic, false);
   }
 
diff --git a/browser/components/sessionstore/test/browser/browser_456342.js b/browser/components/sessionstore/test/browser/browser_456342.js
index 4f1f4b429e9..8314af245e6 100644
--- a/browser/components/sessionstore/test/browser/browser_456342.js
+++ b/browser/components/sessionstore/test/browser/browser_456342.js
@@ -59,7 +59,7 @@ function test() {
     
     let ss = Cc["@mozilla.org/browser/sessionstore;1"]
                .getService(Ci.nsISessionStore);
-    let undoItems = eval("(" + ss.getClosedTabData(window) + ")");
+    let undoItems = JSON.parse(ss.getClosedTabData(window));
     let savedFormData = undoItems[0].state.entries[0].formdata;
     
     let countGood = 0, countBad = 0;
diff --git a/browser/components/sessionstore/test/browser/browser_461634.js b/browser/components/sessionstore/test/browser/browser_461634.js
index 0e2f15db818..946d8fb9ec4 100644
--- a/browser/components/sessionstore/test/browser/browser_461634.js
+++ b/browser/components/sessionstore/test/browser/browser_461634.js
@@ -82,7 +82,7 @@ function test() {
                             test_state.windows[0]._closedTabs.length);
     ss.setWindowState(newWin, JSON.stringify(test_state), true);
     
-    let closedTabs = eval("(" + ss.getClosedTabData(newWin) + ")");
+    let closedTabs = JSON.parse(ss.getClosedTabData(newWin));
     is(closedTabs.length, test_state.windows[0]._closedTabs.length,
        "Closed tab list has the expected length");
     is(countByTitle(closedTabs, FORGET),
@@ -103,7 +103,7 @@ function test() {
     ss.forgetClosedTab(newWin, 2);
     ss.forgetClosedTab(newWin, null);
     
-    closedTabs = eval("(" + ss.getClosedTabData(newWin) + ")");
+    closedTabs = JSON.parse(ss.getClosedTabData(newWin));
     is(closedTabs.length, remember_count,
        "The correct amout of tabs was removed");
     is(countByTitle(closedTabs, FORGET), 0,
diff --git a/browser/components/sessionstore/test/browser/browser_464199.js b/browser/components/sessionstore/test/browser/browser_464199.js
index 60575c448c2..f76ad7c464f 100644
--- a/browser/components/sessionstore/test/browser/browser_464199.js
+++ b/browser/components/sessionstore/test/browser/browser_464199.js
@@ -90,7 +90,7 @@ function test() {
                             test_state.windows[0]._closedTabs.length);
     ss.setWindowState(newWin, JSON.stringify(test_state), true);
     
-    let closedTabs = eval("(" + ss.getClosedTabData(newWin) + ")");
+    let closedTabs = JSON.parse(ss.getClosedTabData(newWin));
     is(closedTabs.length, test_state.windows[0]._closedTabs.length,
        "Closed tab list has the expected length");
     is(countByTitle(closedTabs, FORGET),
@@ -103,7 +103,7 @@ function test() {
              getService(Ci.nsIPrivateBrowsingService);
     pb.removeDataFromDomain("example.net");
     
-    closedTabs = eval("(" + ss.getClosedTabData(newWin) + ")");
+    closedTabs = JSON.parse(ss.getClosedTabData(newWin));
     is(closedTabs.length, remember_count,
        "The correct amout of tabs was removed");
     is(countByTitle(closedTabs, FORGET), 0,
diff --git a/browser/components/sessionstore/test/browser/browser_485563.js b/browser/components/sessionstore/test/browser/browser_485563.js
index 15c656e42c9..de19ee24efe 100644
--- a/browser/components/sessionstore/test/browser/browser_485563.js
+++ b/browser/components/sessionstore/test/browser/browser_485563.js
@@ -46,11 +46,11 @@ function test() {
   tab.linkedBrowser.addEventListener("load", function(aEvent) {
     tab.linkedBrowser.removeEventListener("load", arguments.callee, true);
     ss.setTabValue(tab, "bug485563", uniqueValue);
-    let tabState = eval("(" + ss.getTabState(tab) + ")");
+    let tabState = JSON.parse(ss.getTabState(tab));
     is(tabState.extData["bug485563"], uniqueValue,
        "unicode line separator wasn't over-encoded");
     ss.deleteTabValue(tab, "bug485563");
-    ss.setTabState(tab, tabState.toSource());
+    ss.setTabState(tab, JSON.stringify(tabState));
     is(ss.getTabValue(tab, "bug485563"), uniqueValue,
        "unicode line separator was correctly preserved");
     
diff --git a/browser/installer/Makefile.in b/browser/installer/Makefile.in
index 4e49ced3b2c..e36038691cb 100644
--- a/browser/installer/Makefile.in
+++ b/browser/installer/Makefile.in
@@ -82,10 +82,6 @@ ifdef NSS_DISABLE_DBM
 DEFINES += -DNSS_DISABLE_DBM=1
 endif
 
-ifdef MOZ_UPDATER
-DEFINES += -DMOZ_UPDATER=1
-endif
-
 ifdef _MSC_VER
 DEFINES += -D_MSC_VER=$(_MSC_VER)
 endif
diff --git a/config/autoconf.mk.in b/config/autoconf.mk.in
index 9f361aaf0bc..ee16b1b9b63 100644
--- a/config/autoconf.mk.in
+++ b/config/autoconf.mk.in
@@ -177,6 +177,8 @@ JAR="@JAR@"
 
 TAR=@TAR@
 
+MAKENSISU=@MAKENSISU@
+
 RM = rm -f
 
 # The MOZ_UI_LOCALE var is used to build a particular locale. Do *not*
diff --git a/configure.in b/configure.in
index 9dba3e82f0e..ef4b5aaf086 100644
--- a/configure.in
+++ b/configure.in
@@ -5742,14 +5742,16 @@ dnl = Disable plugin support
 dnl ========================================================
 MOZ_ARG_DISABLE_BOOL(plugins,
 [  --disable-plugins       Disable plugins support],
-    MOZ_PLUGINS=,)
+    MOZ_PLUGINS=,
+    MOZ_PLUGINS=1)
 
 dnl ========================================================
 dnl = Disable building dbm
 dnl ========================================================
 MOZ_ARG_DISABLE_BOOL(dbm,
 [  --disable-dbm       Disable building dbm],
-    NSS_DISABLE_DBM=1,)
+    NSS_DISABLE_DBM=1,
+    NSS_DISABLE_DBM=)
 
 dnl bi-directional support always on
 IBMBIDI=1
@@ -5799,7 +5801,8 @@ dnl Disable printing
 dnl ========================================================
 MOZ_ARG_DISABLE_BOOL(printing,
 [  --disable-printing      Disable printing support],
-    NS_PRINTING=,)
+    NS_PRINTING=,
+    NS_PRINTING=1)
 
 if test "$MOZ_WIDGET_TOOLKIT" = "qt"; then
     AC_MSG_WARN([Printing does not work with Qt at this time. Omitting printing support.])
@@ -5858,7 +5861,8 @@ dnl = Disable Ogg Codecs
 dnl ========================================================
 MOZ_ARG_DISABLE_BOOL(ogg,
 [  --disable-ogg           Disable support for OGG media (Theora video and Vorbis audio)],
-    MOZ_OGG=,)
+    MOZ_OGG=,
+    MOZ_OGG=1)
 
 if test -n "$MOZ_OGG"; then
     AC_DEFINE(MOZ_OGG)
@@ -5915,7 +5919,8 @@ if test -n "$MOZ_WEBM"; then
         fi
     else 
 
-      dnl For Darwin x86, Darwin x86_64, and Linux x86 we can use YASM.
+      dnl For Darwin x86, Darwin x86_64, Linux x86, and WINNT x86_64
+      dhl we can use YASM.
       AC_MSG_CHECKING([for YASM assembler])
       AC_CHECK_PROGS(VPX_AS, yasm, "")
       if test -n "$VPX_AS"; then
@@ -5933,9 +5938,13 @@ if test -n "$MOZ_WEBM"; then
           VPX_ASFLAGS="-f macho64 -rnasm -pnasm -DPIC"
           VPX_X86_ASM=1
         ;;
+        WINNT:x86_64)
+          VPX_ASFLAGS="-f x64 -rnasm -pnasm"
+          VPX_X86_ASM=1
+        ;;
         esac
       fi # end have YASM
-    fi # end !WINNT
+    fi # end !WINNT_x86_MSVC
 
     if test -n "$VPX_X86_ASM"; then
       AC_DEFINE(VPX_X86_ASM)
@@ -5949,7 +5958,8 @@ dnl = Disable Wave decoder support
 dnl ========================================================
 MOZ_ARG_DISABLE_BOOL(wave,
 [  --disable-wave          Disable Wave decoder support],
-    MOZ_WAVE=,)
+    MOZ_WAVE=,
+    MOZ_WAVE=1)
 
 if test -n "$MOZ_WAVE"; then
     AC_DEFINE(MOZ_WAVE)
@@ -6059,7 +6069,8 @@ esac
 MOZ_ARG_ENABLE_BOOL(javaxpcom,
 [  --enable-javaxpcom
                           Enable Java-XPCOM bridge],
-    MOZ_JAVAXPCOM=1,)
+    MOZ_JAVAXPCOM=1,
+    MOZ_JAVAXPCOM=)
 
 case "$host_os" in
   cygwin*|msvc*|mks*)
@@ -6136,7 +6147,8 @@ esac
 
 MOZ_ARG_DISABLE_BOOL(crashreporter,
 [  --disable-crashreporter Disable breakpad crash reporting],
-    MOZ_CRASHREPORTER=,)
+    MOZ_CRASHREPORTER=,
+    MOZ_CRASHREPORTER=1)
 
 if test -n "$MOZ_CRASHREPORTER"; then
    AC_DEFINE(MOZ_CRASHREPORTER)
@@ -6413,14 +6425,35 @@ esac
 
 MOZ_ARG_DISABLE_BOOL(installer,
 [  --disable-installer     Disable building of installer],
-    MOZ_INSTALLER=,)
+    MOZ_INSTALLER=,
+    MOZ_INSTALLER=1)
 if test -n "$MOZ_INSTALLER" -a "$OS_ARCH" = "WINNT"; then
-    # Disable installer for Windows builds that use the new toolkit if NSIS
-    # isn't in the path.
-    MOZ_PATH_PROGS(MAKENSIS, makensis)
-    if test -z "$MAKENSIS" || test "$MAKENSIS" = ":"; then
-        AC_MSG_ERROR([To build the installer makensis is required in your path. To build without the installer reconfigure using --disable-installer.])
+    # Disable installer for Windows builds that use the new toolkit if the
+    # required major version and minimum minor version of Unicode NSIS isn't in
+    # the path.
+    REQ_NSIS_MAJOR_VER=2
+    MIN_NSIS_MINOR_VER=33
+    MOZ_PATH_PROGS(MAKENSISU, $MAKENSISU makensisu-2.46 makensisu makensis)
+    if test -z "$MAKENSISU" || test "$MAKENSISU" = ":"; then
+        AC_MSG_ERROR([To build the installer you must have the latest MozillaBuild or Unicode NSIS with a major version of $REQ_NSIS_MAJOR_VER and a minimum minor version of $MIN_NSIS_MINOR_VER in your path. To build without the installer reconfigure using --disable-installer.])
     fi
+    changequote(,)
+    MAKENSISU_VER=`"$MAKENSISU" -version 2>/dev/null | sed -e '/-Unicode/!s/.*//g' -e 's/^v\([0-9]\+\.[0-9]\+\)\-Unicode$/\1/g'`
+    changequote([,])
+    if test ! "$MAKENSISU_VER" == ""; then
+        MAKENSISU_MAJOR_VER=`echo $MAKENSISU_VER | $AWK -F\. '{ print $1 }'`
+        MAKENSISU_MINOR_VER=`echo $MAKENSISU_VER | $AWK -F\. '{ print $2 }'`
+    fi
+    AC_MSG_CHECKING([for Unicode NSIS with major version == $REQ_NSIS_MAJOR_VER and minor version >= $MIN_NSIS_MINOR_VER])
+    if test "$MAKENSISU_VER" == "" ||
+       test ! "$MAKENSISU_MAJOR_VER" == "$REQ_NSIS_MAJOR_VER" ||
+       test ! "$MAKENSISU_MINOR_VER" -ge $MIN_NSIS_MINOR_VER; then
+        AC_MSG_RESULT([no])
+        AC_MSG_ERROR([To build the installer you must have the latest MozillaBuild or Unicode NSIS with a major version of $REQ_NSIS_MAJOR_VER and a minimum minor version of $MIN_NSIS_MINOR_VER in your path. To build without the installer reconfigure using --disable-installer.])
+    fi
+    AC_MSG_RESULT([yes])
+    MAKENSISU="${CYGWIN_WRAPPER} $MAKENSISU"
+
     # The Windows build for NSIS requires the iconv command line utility to
     # convert the charset of the locale files.
     MOZ_PATH_PROGS(HOST_ICONV, $HOST_ICONV "iconv", "")
@@ -6452,7 +6485,10 @@ MOZ_ARG_DISABLE_BOOL(updater,
 [  --disable-updater       Disable building of updater],
     MOZ_UPDATER=,
     MOZ_UPDATER=1 )
-AC_SUBST(MOZ_UPDATER)
+
+if test -n "$MOZ_UPDATER"; then
+    AC_DEFINE(MOZ_UPDATER)
+fi
 
 # app update channel is 'default' when not supplied.
 MOZ_ARG_ENABLE_STRING([update-channel],
@@ -8464,7 +8500,8 @@ dnl option to disable necko's wifi scanner
 dnl
 MOZ_ARG_DISABLE_BOOL(necko-wifi,
 [  --disable-necko-wifi    Disable necko wifi scanner],
-    NECKO_WIFI=,)
+    NECKO_WIFI=,
+    NECKO_WIFI=1)
 
 if test "$OS_ARCH" = "OS2"; then
   dnl OS/2 implementation of Necko-WiFi support will be added in bug 506566
@@ -8636,6 +8673,7 @@ AC_SUBST(MOZ_VIEW_SOURCE)
 AC_SUBST(MOZ_SPELLCHECK)
 AC_SUBST(MOZ_USER_DIR)
 AC_SUBST(MOZ_CRASHREPORTER)
+AC_SUBST(MOZ_UPDATER)
 
 AC_SUBST(ENABLE_STRIP)
 AC_SUBST(PKG_SKIP_STRIP)
@@ -8679,6 +8717,7 @@ AC_SUBST(CYGWIN_WRAPPER)
 AC_SUBST(AS_PERL)
 AC_SUBST(WIN32_REDIST_DIR)
 AC_SUBST(PYTHON)
+AC_SUBST(MAKENSISU)
 
 AC_SUBST(WINCE)
 AC_SUBST(WINCE_SDK_DIR)
diff --git a/content/base/src/CSPUtils.jsm b/content/base/src/CSPUtils.jsm
index 9cf09bcac1a..328f08c6d15 100644
--- a/content/base/src/CSPUtils.jsm
+++ b/content/base/src/CSPUtils.jsm
@@ -178,7 +178,7 @@ CSPRep.fromString = function(aStr, self) {
         try {
           var uri = gIoService.newURI(uriStrings[i],null,null);
           if (self) {
-            if (gETLDService.getBaseDomain(uri) === 
+            if (gETLDService.getBaseDomain(uri) ===
                 gETLDService.getBaseDomain(selfUri)) {
               okUriStrings.push(uriStrings[i]);
             } else {
@@ -187,7 +187,20 @@ CSPRep.fromString = function(aStr, self) {
             }
           }
         } catch(e) {
-          CSPWarning("couldn't parse report URI: " + dirvalue);
+          switch (e.result) {
+            case Components.results.NS_ERROR_INSUFFICIENT_DOMAIN_LEVELS:
+            case Components.results.NS_ERROR_HOST_IS_IP_ADDRESS:
+              if (uri.host === selfUri.host) {
+                okUriStrings.push(uriStrings[i]);
+              } else {
+                CSPWarning("page on " + selfUri.host + " cannot send reports to " + uri.host);
+              }
+              break;
+
+            default:
+              CSPWarning("couldn't parse report URI: " + uriStrings[i]);
+              break;
+          }
         }
       }
       aCSPR._directives[UD.REPORT_URI] = okUriStrings.join(' ');
@@ -403,8 +416,12 @@ CSPRep.prototype = {
       var dirv = SD[dir];
       if (dirv === SD.ALLOW) continue;
       if (!this._directives[dirv]) {
-        // implicit directive, make explicit
-        this._directives[dirv] = allowDir.clone();
+        // implicit directive, make explicit.
+        // All but frame-ancestors directive inherit from 'allow' (bug 555068)
+        if (dirv === SD.FRAME_ANCESTORS)
+          this._directives[dirv] = CSPSourceList.fromString("*");
+        else
+          this._directives[dirv] = allowDir.clone();
         this._directives[dirv]._isImplicit = true;
       }
     }
diff --git a/content/base/src/contentSecurityPolicy.js b/content/base/src/contentSecurityPolicy.js
index a8fc9d09d2c..3269847bba0 100644
--- a/content/base/src/contentSecurityPolicy.js
+++ b/content/base/src/contentSecurityPolicy.js
@@ -287,7 +287,7 @@ ContentSecurityPolicy.prototype = {
 
         try {
           req.open("POST", uris[i], true);
-          req.setRequestHeader('Content-Type', 'application/xml');
+          req.setRequestHeader('Content-Type', 'application/json');
           req.upload.addEventListener("error", failure, false);
           req.upload.addEventListener("abort", failure, false);
           //req.channel.loadFlags |= Ci.nsIRequest.LOAD_BYPASS_CACHE;
diff --git a/content/base/src/nsContentIterator.cpp b/content/base/src/nsContentIterator.cpp
index 2f2dd2e8f84..8d6d9a57a19 100644
--- a/content/base/src/nsContentIterator.cpp
+++ b/content/base/src/nsContentIterator.cpp
@@ -122,7 +122,7 @@ public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_CLASS(nsContentIterator)
 
-  nsContentIterator();
+  explicit nsContentIterator(PRBool aPre);
   virtual ~nsContentIterator();
 
   // nsIContentIterator interface methods ------------------------------
@@ -208,25 +208,13 @@ private:
 };
 
 
-/*
- *  A simple iterator class for traversing the content in "open tag" order
- */
-
-class nsPreContentIterator : public nsContentIterator
-{
-public:
-  nsPreContentIterator() { mPre = PR_TRUE; }
-};
-
-
-
 /******************************************************
  * repository cruft
  ******************************************************/
 
 nsresult NS_NewContentIterator(nsIContentIterator** aInstancePtrResult)
 {
-  nsContentIterator * iter = new nsContentIterator();
+  nsContentIterator * iter = new nsContentIterator(PR_FALSE);
   if (!iter) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
@@ -239,7 +227,7 @@ nsresult NS_NewContentIterator(nsIContentIterator** aInstancePtrResult)
 
 nsresult NS_NewPreContentIterator(nsIContentIterator** aInstancePtrResult)
 {
-  nsContentIterator * iter = new nsPreContentIterator();
+  nsContentIterator * iter = new nsContentIterator(PR_TRUE);
   if (!iter) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
@@ -273,9 +261,9 @@ NS_IMPL_CYCLE_COLLECTION_4(nsContentIterator,
  * constructor/destructor
  ******************************************************/
 
-nsContentIterator::nsContentIterator() :
+nsContentIterator::nsContentIterator(PRBool aPre) :
   // don't need to explicitly initialize |nsCOMPtr|s, they will automatically be NULL
-  mCachedIndex(0), mIsDone(PR_FALSE), mPre(PR_FALSE)
+  mCachedIndex(0), mIsDone(PR_FALSE), mPre(aPre)
 {
 }
 
@@ -1182,9 +1170,12 @@ nsContentIterator::GetCurrentNode()
 class nsContentSubtreeIterator : public nsContentIterator 
 {
 public:
-  nsContentSubtreeIterator() {}
+  nsContentSubtreeIterator() : nsContentIterator(PR_FALSE) {}
   virtual ~nsContentSubtreeIterator() {}
 
+  NS_DECL_ISUPPORTS_INHERITED
+  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsContentSubtreeIterator, nsContentIterator)
+
   // nsContentIterator overrides ------------------------------
 
   virtual nsresult Init(nsINode* aRoot);
@@ -1224,6 +1215,20 @@ protected:
   nsAutoTArray<PRInt32, 8>     mEndOffsets;
 };
 
+NS_IMPL_ADDREF_INHERITED(nsContentSubtreeIterator, nsContentIterator)
+NS_IMPL_RELEASE_INHERITED(nsContentSubtreeIterator, nsContentIterator)
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(nsContentSubtreeIterator)
+NS_INTERFACE_MAP_END_INHERITING(nsContentIterator)
+
+NS_IMPL_CYCLE_COLLECTION_CLASS(nsContentSubtreeIterator)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsContentSubtreeIterator, nsContentIterator)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mRange)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsContentSubtreeIterator, nsContentIterator)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mRange)
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
 nsresult NS_NewContentSubtreeIterator(nsIContentIterator** aInstancePtrResult);
 
 
diff --git a/content/base/test/unit/test_csputils.js b/content/base/test/unit/test_csputils.js
index 021c5b3611f..a238eecd3ae 100644
--- a/content/base/test/unit/test_csputils.js
+++ b/content/base/test/unit/test_csputils.js
@@ -350,8 +350,7 @@ test(
 
       var cspr;
       var SD = CSPRep.SRC_DIRECTIVES;
-      var DEFAULTS = [SD.STYLE_SRC, SD.MEDIA_SRC, SD.IMG_SRC,
-                      SD.FRAME_ANCESTORS, SD.FRAME_SRC];
+      var DEFAULTS = [SD.STYLE_SRC, SD.MEDIA_SRC, SD.IMG_SRC, SD.FRAME_SRC];
 
       // check one-directive policies
       cspr = CSPRep.fromString("allow bar.com; script-src https://foo.com", 
@@ -377,7 +376,7 @@ test(
     function test_CSPRep_fromString_twodir() {
       var cspr;
       var SD = CSPRep.SRC_DIRECTIVES;
-      var DEFAULTS = [SD.STYLE_SRC, SD.MEDIA_SRC, SD.FRAME_ANCESTORS, SD.FRAME_SRC];
+      var DEFAULTS = [SD.STYLE_SRC, SD.MEDIA_SRC, SD.FRAME_SRC];
 
       // check two-directive policies
       var polstr = "allow allow.com; "
@@ -448,6 +447,32 @@ test(function test_CSPRep_fromPolicyURI() {
                               cspr_static._directives[SD[i]]);
         }
     });
+
+//////////////// TEST FRAME ANCESTOR DEFAULTS /////////////////
+// (see bug 555068)
+test(function test_FrameAncestor_defaults() {
+      var cspr;
+      var SD = CSPRep.SRC_DIRECTIVES;
+      var self = "http://self.com:34";
+
+      cspr = CSPRep.fromString("allow 'none'", self);
+
+      //"frame-ancestors should default to * not 'allow' value"
+      do_check_true(cspr.permits("https://foo.com:400", SD.FRAME_ANCESTORS));
+      do_check_true(cspr.permits("http://self.com:34", SD.FRAME_ANCESTORS));
+      do_check_true(cspr.permits("https://self.com:34", SD.FRAME_ANCESTORS));
+      do_check_true(cspr.permits("http://self.com", SD.FRAME_ANCESTORS));
+      do_check_true(cspr.permits("http://subd.self.com:34", SD.FRAME_ANCESTORS));
+
+      cspr = CSPRep.fromString("allow 'none'; frame-ancestors 'self'", self);
+
+      //"frame-ancestors should only allow self"
+      do_check_true(cspr.permits("http://self.com:34", SD.FRAME_ANCESTORS));
+      do_check_false(cspr.permits("https://foo.com:400", SD.FRAME_ANCESTORS));
+      do_check_false(cspr.permits("https://self.com:34", SD.FRAME_ANCESTORS));
+      do_check_false(cspr.permits("http://self.com", SD.FRAME_ANCESTORS));
+      do_check_false(cspr.permits("http://subd.self.com:34", SD.FRAME_ANCESTORS));
+     });
 /*
 
 test(function test_CSPRep_fromPolicyURI_failswhenmixed() {
diff --git a/content/canvas/src/WebGLContext.cpp b/content/canvas/src/WebGLContext.cpp
index 076bb2250ef..663380f21a9 100644
--- a/content/canvas/src/WebGLContext.cpp
+++ b/content/canvas/src/WebGLContext.cpp
@@ -152,6 +152,22 @@ WebGLContext::SetDimensions(PRInt32 width, PRInt32 height)
     if (mWidth == width && mHeight == height)
         return NS_OK;
 
+    if (gl) {
+        // hey we already have something
+        if (gl->Resize(gfxIntSize(width, height))) {
+
+            mWidth = width;
+            mHeight = height;
+
+            gl->fViewport(0, 0, mWidth, mHeight);
+            gl->fClearColor(0, 0, 0, 0);
+            gl->fClear(LOCAL_GL_COLOR_BUFFER_BIT | LOCAL_GL_DEPTH_BUFFER_BIT | LOCAL_GL_STENCIL_BUFFER_BIT);
+
+            // great success!
+            return NS_OK;
+        }
+    }
+
     LogMessage("Canvas 3D: creating PBuffer...");
 
     GLContextProvider::ContextFormat format(GLContextProvider::ContextFormat::BasicRGBA32);
diff --git a/content/canvas/src/WebGLContextValidate.cpp b/content/canvas/src/WebGLContextValidate.cpp
index 5108a6e3c00..0b732ab06c4 100644
--- a/content/canvas/src/WebGLContextValidate.cpp
+++ b/content/canvas/src/WebGLContextValidate.cpp
@@ -63,8 +63,8 @@ WebGLContext::ValidateBuffers(PRUint32 count)
         return PR_FALSE;
     }
 
-    if (currentProgram != mCurrentProgram->GLName()) {
-        LogMessage("WebGL internal error: current program (%d) doesn't agree with GL current program (%d)", mCurrentProgram->GLName(), currentProgram);
+    if (WebGLuint(currentProgram) != mCurrentProgram->GLName()) {
+        LogMessage("WebGL internal error: current program (%u) doesn't agree with GL current program (%d)", mCurrentProgram->GLName(), currentProgram);
         return PR_FALSE;
     }
 
diff --git a/content/html/content/public/nsHTMLMediaElement.h b/content/html/content/public/nsHTMLMediaElement.h
index 506225a8fe0..a872652f651 100644
--- a/content/html/content/public/nsHTMLMediaElement.h
+++ b/content/html/content/public/nsHTMLMediaElement.h
@@ -67,7 +67,7 @@ public:
     CANPLAY_YES
   };
 
-  nsHTMLMediaElement(nsINodeInfo *aNodeInfo, PRBool aFromParser = 0);
+  nsHTMLMediaElement(nsINodeInfo *aNodeInfo, PRUint32 aFromParser = 0);
   virtual ~nsHTMLMediaElement();
 
   /**
diff --git a/content/smil/nsSMILCSSProperty.cpp b/content/smil/nsSMILCSSProperty.cpp
index 56818420386..b93a5ac9b40 100644
--- a/content/smil/nsSMILCSSProperty.cpp
+++ b/content/smil/nsSMILCSSProperty.cpp
@@ -145,8 +145,8 @@ nsSMILCSSProperty::GetBaseValue() const
 
   // (4) Populate our nsSMILValue from the computed style
   if (didGetComputedVal) {
-    nsSMILCSSValueType::ValueFromString(mPropID, mElement, computedStyleVal,
-                                        PR_FALSE, baseValue);
+    nsSMILCSSValueType::ValueFromString(mPropID, mElement,
+                                        computedStyleVal, baseValue);
   }
   return baseValue;
 }
@@ -159,8 +159,7 @@ nsSMILCSSProperty::ValueFromString(const nsAString& aStr,
 {
   NS_ENSURE_TRUE(IsPropertyAnimatable(mPropID), NS_ERROR_FAILURE);
 
-  nsSMILCSSValueType::ValueFromString(mPropID, mElement, aStr,
-                                      PR_FALSE, aValue);
+  nsSMILCSSValueType::ValueFromString(mPropID, mElement, aStr, aValue);
   if (aValue.IsNull()) {
     return NS_ERROR_FAILURE;
   }
diff --git a/content/smil/nsSMILCSSValueType.cpp b/content/smil/nsSMILCSSValueType.cpp
index bbc1667a2f8..ebbb3bbce86 100644
--- a/content/smil/nsSMILCSSValueType.cpp
+++ b/content/smil/nsSMILCSSValueType.cpp
@@ -337,7 +337,6 @@ ValueFromStringHelper(nsCSSProperty aPropID,
                       nsIContent* aTargetElement,
                       nsPresContext* aPresContext,
                       const nsAString& aString,
-                      PRBool aUseSVGMode,
                       nsStyleAnimation::Value& aStyleAnimValue)
 {
   // If value is negative, we'll strip off the "-" so the CSS parser won't
@@ -353,7 +352,7 @@ ValueFromStringHelper(nsCSSProperty aPropID,
   }
   nsDependentSubstring subString(aString, subStringBegin);
   if (!nsStyleAnimation::ComputeValue(aPropID, aTargetElement, subString,
-                                      aUseSVGMode, aStyleAnimValue)) {
+                                      PR_TRUE, aStyleAnimValue)) {
     return PR_FALSE;
   }
   if (isNegative) {
@@ -376,7 +375,6 @@ void
 nsSMILCSSValueType::ValueFromString(nsCSSProperty aPropID,
                                     nsIContent* aTargetElement,
                                     const nsAString& aString,
-                                    PRBool aUseSVGMode,
                                     nsSMILValue& aValue)
 {
   // XXXbz aTargetElement should be an Element
@@ -389,7 +387,7 @@ nsSMILCSSValueType::ValueFromString(nsCSSProperty aPropID,
 
   nsStyleAnimation::Value parsedValue;
   if (ValueFromStringHelper(aPropID, aTargetElement, presContext,
-                            aString, aUseSVGMode, parsedValue)) {
+                            aString, parsedValue)) {
     sSingleton.Init(aValue);
     aValue.mU.mPtr = new ValueWrapper(aPropID, parsedValue, presContext);
     if (!aValue.mU.mPtr) {
diff --git a/content/smil/nsSMILCSSValueType.h b/content/smil/nsSMILCSSValueType.h
index 5b83864a8e9..8a2037a5540 100644
--- a/content/smil/nsSMILCSSValueType.h
+++ b/content/smil/nsSMILCSSValueType.h
@@ -91,8 +91,6 @@ public:
    * @param       aTargetElement  The target element to whom the property/value
    *                              setting applies.
    * @param       aString         The string to be parsed as a CSS value.
-   * @param       aUseSVGMode     A flag to indicate whether we should parse
-   *                              |aString| in SVG mode.
    * @param [out] aValue          The nsSMILValue to be populated. Should
    *                              initially be null-typed.
    * @pre  aValue.IsNull()
@@ -101,7 +99,6 @@ public:
   static void ValueFromString(nsCSSProperty aPropID,
                               nsIContent* aTargetElement,
                               const nsAString& aString,
-                              PRBool aUseSVGMode,
                               nsSMILValue& aValue);
 
   /**
diff --git a/content/smil/nsSMILMappedAttribute.cpp b/content/smil/nsSMILMappedAttribute.cpp
index 03bb5094222..0e38e8accdf 100644
--- a/content/smil/nsSMILMappedAttribute.cpp
+++ b/content/smil/nsSMILMappedAttribute.cpp
@@ -66,8 +66,7 @@ nsSMILMappedAttribute::ValueFromString(const nsAString& aStr,
 {
   NS_ENSURE_TRUE(IsPropertyAnimatable(mPropID), NS_ERROR_FAILURE);
 
-  nsSMILCSSValueType::ValueFromString(mPropID, mElement, aStr,
-                                      PR_TRUE, aValue);
+  nsSMILCSSValueType::ValueFromString(mPropID, mElement, aStr, aValue);
   if (aValue.IsNull()) {
     return NS_ERROR_FAILURE;
   }
@@ -87,8 +86,8 @@ nsSMILMappedAttribute::GetBaseValue() const
                                      baseStringValue);
   nsSMILValue baseValue;
   if (success) {
-    nsSMILCSSValueType::ValueFromString(mPropID, mElement, baseStringValue,
-                                        PR_TRUE, baseValue);
+    nsSMILCSSValueType::ValueFromString(mPropID, mElement,
+                                        baseStringValue, baseValue);
   } else {
     // Attribute is unset -- use computed value.
     // FIRST: Temporarily clear animated value, to make sure it doesn't pollute
diff --git a/content/svg/content/src/SVGMotionSMILAnimationFunction.cpp b/content/svg/content/src/SVGMotionSMILAnimationFunction.cpp
index ee8ddb5e31b..6708fe66f03 100644
--- a/content/svg/content/src/SVGMotionSMILAnimationFunction.cpp
+++ b/content/svg/content/src/SVGMotionSMILAnimationFunction.cpp
@@ -253,9 +253,9 @@ SVGMotionSMILAnimationFunction::
   // Use the path that's the target of our chosen <mpath> child.
   nsSVGPathElement* pathElem = aMpathElem->GetReferencedPath();
   if (pathElem) {
-    if (pathElem->HasAttr(kNameSpaceID_None, nsGkAtoms::d)) {
-      const nsAString& pathSpec =
-        pathElem->GetParsedAttr(nsGkAtoms::d)->GetStringValue();
+    const nsAttrValue* value = pathElem->GetParsedAttr(nsGkAtoms::d);
+    if (value) {
+      const nsAString& pathSpec = value->GetStringValue();
       nsresult rv = SetPathVerticesFromPathString(pathSpec);
       if (NS_SUCCEEDED(rv)) {
         mPath = pathElem->GetFlattenedPath(
diff --git a/content/svg/content/src/nsSVGAElement.cpp b/content/svg/content/src/nsSVGAElement.cpp
index 6e2a77d9639..6611b9dfbfb 100644
--- a/content/svg/content/src/nsSVGAElement.cpp
+++ b/content/svg/content/src/nsSVGAElement.cpp
@@ -167,6 +167,24 @@ nsSVGAElement::GetHrefURI() const
 }
 
 
+NS_IMETHODIMP_(PRBool)
+nsSVGAElement::IsAttributeMapped(const nsIAtom* name) const
+{
+  static const MappedAttributeEntry* const map[] = {
+    sFEFloodMap,
+    sFiltersMap,
+    sFontSpecificationMap,
+    sGradientStopMap,
+    sLightingEffectsMap,
+    sMarkersMap,
+    sTextContentElementsMap,
+    sViewportsMap
+  };
+
+  return FindAttributeDependence(name, map, NS_ARRAY_LENGTH(map)) ||
+    nsSVGAElementBase::IsAttributeMapped(name);
+}
+
 PRBool
 nsSVGAElement::IsFocusable(PRInt32 *aTabIndex, PRBool aWithMouse)
 {
diff --git a/content/svg/content/src/nsSVGAElement.h b/content/svg/content/src/nsSVGAElement.h
index ba6c4460505..7d86ef261a0 100644
--- a/content/svg/content/src/nsSVGAElement.h
+++ b/content/svg/content/src/nsSVGAElement.h
@@ -86,6 +86,7 @@ public:
                               PRBool aCompileEventHandlers);
   virtual void UnbindFromTree(PRBool aDeep = PR_TRUE,
                               PRBool aNullParent = PR_TRUE);
+  NS_IMETHOD_(PRBool) IsAttributeMapped(const nsIAtom* aAttribute) const;
   virtual PRBool IsFocusable(PRInt32 *aTabIndex = nsnull, PRBool aWithMouse = PR_FALSE);
   virtual PRBool IsLink(nsIURI** aURI) const;
   virtual void GetLinkTarget(nsAString& aTarget);
diff --git a/content/xul/content/src/nsXULElement.h b/content/xul/content/src/nsXULElement.h
index dbbb4a21ae7..9eafcfd793f 100644
--- a/content/xul/content/src/nsXULElement.h
+++ b/content/xul/content/src/nsXULElement.h
@@ -353,6 +353,9 @@ public:
     void Set(void *aObject)
     {
         NS_ASSERTION(!mScriptObject.mObject, "Leaking script object.");
+        if (!aObject) {
+          return;
+        }
 
         nsresult rv = nsContentUtils::HoldScriptObject(mScriptObject.mLangID,
                                                        this,
diff --git a/docshell/base/crashtests/crashtests.list b/docshell/base/crashtests/crashtests.list
index adbaed33a99..c19d2d47196 100644
--- a/docshell/base/crashtests/crashtests.list
+++ b/docshell/base/crashtests/crashtests.list
@@ -4,7 +4,7 @@ load 403574-1.xhtml
 load 430124-1.html
 load 430628-1.html
 asserts(1-4) load 432114-1.html # bug 570215
-asserts(0-1) load 432114-2.html # bug 492165
+asserts(0-2) load 432114-2.html # bug 570215, bug 571020
 load 436900-1.html
 asserts(0-2) load 436900-2.html # bug 566159
 load 500328-1.html
diff --git a/docshell/resources/content/netError.xhtml b/docshell/resources/content/netError.xhtml
index 5a3d26a48e2..83a665ecb62 100644
--- a/docshell/resources/content/netError.xhtml
+++ b/docshell/resources/content/netError.xhtml
@@ -183,7 +183,13 @@
         if (className == "expertBadCert") {
           showSecuritySection();
         }
-        
+
+        if (err == "cspFrameAncestorBlocked") {
+          // Remove the "Try again" button for CSP frame ancestors violation, since it's
+          // almost certainly useless. (Bug 553180)
+          document.getElementById("errorTryAgain").style.display = "none";
+        }
+
         if (err == "nssBadCert") {
           // Remove the "Try again" button for security exceptions, since it's
           // almost certainly useless.
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index b477f6b7458..3c95097bef8 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -4103,7 +4103,7 @@ nsGlobalWindow::Dump(const nsAString& aStr)
 
 #if defined(XP_MAC) || defined(XP_MACOSX)
   // have to convert \r to \n so that printing to the console works
-  char *c = cstr, *cEnd = cstr + aStr.Length();
+  char *c = cstr, *cEnd = cstr + strlen(cstr);
   while (c < cEnd) {
     if (*c == '\r')
       *c = '\n';
diff --git a/editor/composer/src/crashtests/crashtests.list b/editor/composer/src/crashtests/crashtests.list
index df9396992da..23fc44c6ecc 100644
--- a/editor/composer/src/crashtests/crashtests.list
+++ b/editor/composer/src/crashtests/crashtests.list
@@ -2,4 +2,4 @@ load 351236-1.html
 load 407062-1.html
 skip-if(MOZ_WIDGET_TOOLKIT=="windows") load 428844-1.html # bug 471185
 load 461049-1.html
-asserts(1) asserts-if(MOZ_WIDGET_TOOLKIT=="windows",0-2) load removing-editable-xslt.html # bug 500847
+asserts(1) asserts-if(MOZ_WIDGET_TOOLKIT=="gtk2",0-1) asserts-if(MOZ_WIDGET_TOOLKIT=="windows",0-2) load removing-editable-xslt.html # bug 500847
diff --git a/gfx/cairo/cairo/src/cairo-d2d-surface.cpp b/gfx/cairo/cairo/src/cairo-d2d-surface.cpp
index 510be3e376c..a43fa41d58f 100644
--- a/gfx/cairo/cairo/src/cairo-d2d-surface.cpp
+++ b/gfx/cairo/cairo/src/cairo-d2d-surface.cpp
@@ -451,13 +451,17 @@ _cairo_d2d_surface_push_clip(cairo_d2d_surface_t *d2dsurf)
 	    }
 	    D2D1_RECT_F bounds;
 	    d2dsurf->clipMask->GetBounds(D2D1::IdentityMatrix(), &bounds);
+            D2D1_LAYER_OPTIONS options = D2D1_LAYER_OPTIONS_NONE;
+	    if (d2dsurf->base.content == CAIRO_CONTENT_COLOR) {
+		options = D2D1_LAYER_OPTIONS_INITIALIZE_FOR_CLEARTYPE;
+	    }
 	    d2dsurf->rt->PushLayer(D2D1::LayerParameters(bounds,
 							 d2dsurf->clipMask,
 							 D2D1_ANTIALIAS_MODE_ALIASED,
 							 D2D1::IdentityMatrix(),
 							 1.0,
 							 0,
-							 D2D1_LAYER_OPTIONS_INITIALIZE_FOR_CLEARTYPE),
+							 options),
 				   d2dsurf->clipLayer);
 	}
 	if (d2dsurf->clipRect) {
@@ -2132,7 +2136,8 @@ _cairo_d2d_getextents(void		       *surface,
 /** Helper functions. */
 
 cairo_surface_t*
-cairo_d2d_surface_create_for_hwnd(HWND wnd)
+cairo_d2d_surface_create_for_hwnd(HWND wnd,
+				  cairo_content_t content)
 {
     if (!D3D10Factory::Device() || !D2DSurfFactory::Instance()) {
 	/**
@@ -2145,7 +2150,7 @@ cairo_d2d_surface_create_for_hwnd(HWND wnd)
     cairo_d2d_surface_t *newSurf = static_cast<cairo_d2d_surface_t*>(malloc(sizeof(cairo_d2d_surface_t)));
     new (newSurf) cairo_d2d_surface_t();
 
-    _cairo_surface_init(&newSurf->base, &cairo_d2d_surface_backend, CAIRO_CONTENT_COLOR);
+    _cairo_surface_init(&newSurf->base, &cairo_d2d_surface_backend, content);
     _cairo_surface_clipper_init(&newSurf->clipper, _cairo_d2d_surface_clipper_intersect_clip_path);
 
     RECT rc;
@@ -2229,10 +2234,10 @@ cairo_d2d_surface_create_for_hwnd(HWND wnd)
     size.height = sizePixels.height * dpiY;
 
     props = D2D1::RenderTargetProperties(D2D1_RENDER_TARGET_TYPE_DEFAULT,
-								       D2D1::PixelFormat(DXGI_FORMAT_UNKNOWN, D2D1_ALPHA_MODE_PREMULTIPLIED),
-								       dpiX,
-								       dpiY,
-								       D2D1_RENDER_TARGET_USAGE_NONE);
+					 D2D1::PixelFormat(DXGI_FORMAT_UNKNOWN, D2D1_ALPHA_MODE_PREMULTIPLIED),
+					 dpiX,
+					 dpiY,
+					 D2D1_RENDER_TARGET_USAGE_NONE);
     hr = D2DSurfFactory::Instance()->CreateDxgiSurfaceRenderTarget(newSurf->backBuf,
 								   props,
 								   &newSurf->rt);
@@ -2241,7 +2246,7 @@ cairo_d2d_surface_create_for_hwnd(HWND wnd)
     }
 
     bitProps = D2D1::BitmapProperties(D2D1::PixelFormat(DXGI_FORMAT_UNKNOWN, 
-									       D2D1_ALPHA_MODE_PREMULTIPLIED));
+				      D2D1_ALPHA_MODE_PREMULTIPLIED));
     
     newSurf->rt->CreateSolidColorBrush(D2D1::ColorF(0, 1.0), &newSurf->solidColorBrush);
 
@@ -2321,7 +2326,7 @@ cairo_d2d_surface_create(cairo_format_t format,
     }
 
     props = D2D1::RenderTargetProperties(D2D1_RENDER_TARGET_TYPE_DEFAULT,
-								       D2D1::PixelFormat(DXGI_FORMAT_UNKNOWN, alpha));
+					 D2D1::PixelFormat(DXGI_FORMAT_UNKNOWN, alpha));
     hr = D2DSurfFactory::Instance()->CreateDxgiSurfaceRenderTarget(dxgiSurface,
 								   props,
 								   &newSurf->rt);
@@ -2331,7 +2336,7 @@ cairo_d2d_surface_create(cairo_format_t format,
     }
 
     bitProps = D2D1::BitmapProperties(D2D1::PixelFormat(DXGI_FORMAT_UNKNOWN, 
-									       alpha));
+				      alpha));
     hr = newSurf->rt->CreateSharedBitmap(IID_IDXGISurface,
 					 dxgiSurface,
 					 &bitProps,
diff --git a/gfx/cairo/cairo/src/cairo-win32.h b/gfx/cairo/cairo/src/cairo-win32.h
index c304f924344..5d6e4c4f045 100644
--- a/gfx/cairo/cairo/src/cairo-win32.h
+++ b/gfx/cairo/cairo/src/cairo-win32.h
@@ -128,10 +128,11 @@ cairo_dwrite_font_face_create_for_dwrite_fontface(void *dwrite_font, void *dwrit
  * Create a D2D surface for an HWND
  *
  * \param wnd Handle for the window
+ * \param content Content of the window, should be COLOR_ALPHA for transparent windows
  * \return New cairo surface
  */
 cairo_public cairo_surface_t *
-cairo_d2d_surface_create_for_hwnd(HWND wnd);
+cairo_d2d_surface_create_for_hwnd(HWND wnd, cairo_content_t content);
 
 /**
  * Create a D2D surface of a certain size.
diff --git a/gfx/layers/basic/BasicLayers.cpp b/gfx/layers/basic/BasicLayers.cpp
index 107010bf9da..f29e51e7386 100644
--- a/gfx/layers/basic/BasicLayers.cpp
+++ b/gfx/layers/basic/BasicLayers.cpp
@@ -461,9 +461,15 @@ BasicCanvasLayer::Updated(const nsIntRect& aRect)
     // For simplicity, we read the entire framebuffer for now -- in
     // the future we should use mUpdatedRect, though with WebGL we don't
     // have an easy way to generate one.
+#ifndef USE_GLES2
     mGLContext->fReadPixels(0, 0, mBounds.width, mBounds.height,
                             LOCAL_GL_BGRA, LOCAL_GL_UNSIGNED_INT_8_8_8_8_REV,
                             isurf->Data());
+#else
+    mGLContext->fReadPixels(0, 0, mBounds.width, mBounds.height,
+                            LOCAL_GL_RGBA, LOCAL_GL_UNSIGNED_BYTE,
+                            isurf->Data());
+#endif
 
     // If the underlying GLContext doesn't have a framebuffer into which
     // premultiplied values were written, we have to do this ourselves here.
diff --git a/gfx/thebes/public/GLContext.h b/gfx/thebes/public/GLContext.h
index f63f9a16c8c..6ff4d298148 100644
--- a/gfx/thebes/public/GLContext.h
+++ b/gfx/thebes/public/GLContext.h
@@ -1,3 +1,4 @@
+/* -*- Mode: c++; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40; -*- */
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
@@ -45,7 +46,7 @@
 #endif
 
 #include "GLDefs.h"
-#include "gfxTypes.h"
+#include "gfxRect.h"
 #include "nsISupportsImpl.h"
 #include "prlink.h"
 
@@ -61,6 +62,10 @@
 #define GLAPI
 #endif
 
+#if defined(MOZ_PLATFORM_MAEMO) || defined(ANDROID)
+#define USE_GLES2 1
+#endif
+
 typedef char realGLboolean;
 
 namespace mozilla {
@@ -84,19 +89,19 @@ public:
     } SymLoadStruct;
 
     PRBool LoadSymbols(SymLoadStruct *firstStruct,
-		       PRBool tryplatform = PR_FALSE,
-		       const char *prefix = nsnull);
+                       PRBool tryplatform = PR_FALSE,
+                       const char *prefix = nsnull);
 
     /*
      * Static version of the functions in this class
      */
     static PRFuncPtr LookupSymbol(PRLibrary *lib,
-				  const char *symname,
-				  PlatformLookupFunction lookupFunction = nsnull);
+                                  const char *symname,
+                                  PlatformLookupFunction lookupFunction = nsnull);
     static PRBool LoadSymbols(PRLibrary *lib,
-			      SymLoadStruct *firstStruct,
-			      PlatformLookupFunction lookupFunction = nsnull,
-			      const char *prefix = nsnull);
+                              SymLoadStruct *firstStruct,
+                              PlatformLookupFunction lookupFunction = nsnull,
+                              const char *prefix = nsnull);
 protected:
     LibrarySymbolLoader() {
         mLibrary = nsnull;
@@ -125,13 +130,13 @@ public:
     virtual PRBool SetupLookupFunction() = 0;
 
     void *GetUserData(void *aKey) {
-	void *result = nsnull;
-	mUserData.Get(aKey, &result);
-	return result;
+        void *result = nsnull;
+        mUserData.Get(aKey, &result);
+        return result;
     }
 
     void SetUserData(void *aKey, void *aValue) {
-	mUserData.Put(aKey, aValue);
+        mUserData.Put(aKey, aValue);
     }
 
     enum NativeDataType {
@@ -143,6 +148,16 @@ public:
     };
 
     virtual void *GetNativeData(NativeDataType aType) { return NULL; }
+
+    /* If this is a PBuffer context, resize the pbufer to the given dimensions,
+     * keping the same format and attributes.  If the resize succeeds, return
+     * PR_TRUE.  Otherwise, or if this is not a pbuffer, return PR_FALSE.
+     *
+     * On a successful resize, the previous contents of the pbuffer are cleared,
+     * and the new contents are undefined.
+     */
+    virtual PRBool Resize(const gfxIntSize& aNewSize) { return PR_FALSE; }
+
 protected:
 
     PRBool mInitialized;
diff --git a/gfx/thebes/public/gfxD2DSurface.h b/gfx/thebes/public/gfxD2DSurface.h
index 66d46d82292..cc34cf4e8ec 100644
--- a/gfx/thebes/public/gfxD2DSurface.h
+++ b/gfx/thebes/public/gfxD2DSurface.h
@@ -45,7 +45,8 @@
 class THEBES_API gfxD2DSurface : public gfxASurface {
 public:
 
-    gfxD2DSurface(HWND wnd);
+    gfxD2DSurface(HWND wnd,
+                  gfxContentType aContent);
 
     gfxD2DSurface(const gfxIntSize& size,
                   gfxImageFormat imageFormat = ImageFormatRGB24);
diff --git a/gfx/thebes/src/GLContext.cpp b/gfx/thebes/src/GLContext.cpp
index 957d23005d0..cbe57a6b7cb 100644
--- a/gfx/thebes/src/GLContext.cpp
+++ b/gfx/thebes/src/GLContext.cpp
@@ -194,12 +194,16 @@ GLContext::InitWithPrefix(const char *prefix, PRBool trygl)
         { (PRFuncPtr*) &fDepthRange, { "DepthRange", NULL } },
 #endif
         { (PRFuncPtr*) &fDisable, { "Disable", NULL } },
+#ifndef USE_GLES2
         { (PRFuncPtr*) &fDisableClientState, { "DisableClientState", NULL } },
+#endif
         { (PRFuncPtr*) &fDisableVertexAttribArray, { "DisableVertexAttribArray", "DisableVertexAttribArrayARB", NULL } },
         { (PRFuncPtr*) &fDrawArrays, { "DrawArrays", NULL } },
         { (PRFuncPtr*) &fDrawElements, { "DrawElements", NULL } },
         { (PRFuncPtr*) &fEnable, { "Enable", NULL } },
+#ifndef USE_GLES2
         { (PRFuncPtr*) &fEnableClientState, { "EnableClientState", NULL } },
+#endif
         { (PRFuncPtr*) &fEnableVertexAttribArray, { "EnableVertexAttribArray", "EnableVertexAttribArrayARB", NULL } },
         { (PRFuncPtr*) &fFinish, { "Finish", NULL } },
         { (PRFuncPtr*) &fFlush, { "Flush", NULL } },
@@ -217,7 +221,9 @@ GLContext::InitWithPrefix(const char *prefix, PRBool trygl)
         { (PRFuncPtr*) &fGetError, { "GetError", NULL } },
         { (PRFuncPtr*) &fGetProgramiv, { "GetProgramiv", "GetProgramivARB", NULL } },
         { (PRFuncPtr*) &fGetProgramInfoLog, { "GetProgramInfoLog", "GetProgramInfoLogARB", NULL } },
+#ifndef USE_GLES2
         { (PRFuncPtr*) &fTexCoordPointer, { "TexCoordPointer", NULL } },
+#endif
         { (PRFuncPtr*) &fTexParameteri, { "TexParameteri", NULL } },
         { (PRFuncPtr*) &fTexParameterf, { "TexParameterf", NULL } },
         { (PRFuncPtr*) &fGetString, { "GetString", NULL } },
@@ -238,7 +244,9 @@ GLContext::InitWithPrefix(const char *prefix, PRBool trygl)
         { (PRFuncPtr*) &fLinkProgram, { "LinkProgram", "LinkProgramARB", NULL } },
         { (PRFuncPtr*) &fPixelStorei, { "PixelStorei", NULL } },
         { (PRFuncPtr*) &fPolygonOffset, { "PolygonOffset", NULL } },
+#ifndef USE_GLES2
         { (PRFuncPtr*) &fReadBuffer,  { "ReadBuffer", NULL } },
+#endif
         { (PRFuncPtr*) &fReadPixels, { "ReadPixels", NULL } },
         { (PRFuncPtr*) &fSampleCoverage, { "SampleCoverage", NULL } },
         { (PRFuncPtr*) &fScissor, { "Scissor", NULL } },
@@ -248,7 +256,9 @@ GLContext::InitWithPrefix(const char *prefix, PRBool trygl)
         { (PRFuncPtr*) &fStencilMaskSeparate, { "StencilMaskSeparate", "StencilMaskSeparateEXT", NULL } },
         { (PRFuncPtr*) &fStencilOp, { "StencilOp", NULL } },
         { (PRFuncPtr*) &fStencilOpSeparate, { "StencilOpSeparate", "StencilOpSeparateEXT", NULL } },
+#ifndef USE_GLES2
         { (PRFuncPtr*) &fTexEnvf, { "TexEnvf",  NULL } },
+#endif
         { (PRFuncPtr*) &fTexImage2D, { "TexImage2D", NULL } },
         { (PRFuncPtr*) &fTexSubImage2D, { "TexSubImage2D", NULL } },
         { (PRFuncPtr*) &fUniform1f, { "Uniform1f", NULL } },
@@ -281,7 +291,9 @@ GLContext::InitWithPrefix(const char *prefix, PRBool trygl)
         { (PRFuncPtr*) &fVertexAttrib2fv, { "VertexAttrib2fv", NULL } },
         { (PRFuncPtr*) &fVertexAttrib3fv, { "VertexAttrib3fv", NULL } },
         { (PRFuncPtr*) &fVertexAttrib4fv, { "VertexAttrib4fv", NULL } },
+#ifndef USE_GLES2
         { (PRFuncPtr*) &fVertexPointer, { "VertexPointer", NULL } },
+#endif
         { (PRFuncPtr*) &fViewport, { "Viewport", NULL } },
         { (PRFuncPtr*) &fCompileShader, { "CompileShader", NULL } },
         { (PRFuncPtr*) &fCopyTexImage2D, { "CopyTexImage2D", NULL } },
diff --git a/gfx/thebes/src/GLContextProviderEGL.cpp b/gfx/thebes/src/GLContextProviderEGL.cpp
new file mode 100644
index 00000000000..e6ff1f268bd
--- /dev/null
+++ b/gfx/thebes/src/GLContextProviderEGL.cpp
@@ -0,0 +1,409 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ *   Mozilla Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Vladimir Vukicevic <vladimir@pobox.com>
+ *   Mark Steele <mwsteele@gmail.com>
+ *   Bas Schouten <bschouten@mozilla.com>
+ *   Frederic Plourde <frederic.plourde@collabora.co.uk>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#if defined(MOZ_X11)
+
+#ifdef MOZ_WIDGET_GTK2
+#include <gdk/gdkx.h>
+// we're using default display for now
+#define GET_NATIVE_WINDOW(aWidget) (EGLNativeWindowType)GDK_WINDOW_XID((GdkWindow *) aWidget->GetNativeData(NS_NATIVE_WINDOW))
+#elif defined(MOZ_WIDGET_QT)
+#include <QWidget>
+// we're using default display for now
+#define GET_NATIVE_WINDOW(aWidget) (EGLNativeWindowType)static_cast<QWidget*>(aWidget->GetNativeData(NS_NATIVE_SHELLWIDGET))->handle()
+#endif
+
+#include <X11/Xlib.h>
+#include <X11/Xutil.h>
+typedef Display *EGLNativeDisplayType;
+typedef Pixmap   EGLNativePixmapType;
+typedef Window   EGLNativeWindowType;
+
+#define EGL_LIB "/usr/lib/libEGL.so"
+#define GLES2_LIB "/usr/lib/libGLESv2.so"
+
+#elif defined(ANDROID)
+
+#define GET_NATIVE_WINDOW(aWidget)  (nsnull)
+
+typedef void *EGLNativeDisplayType;
+typedef void *EGLNativePixmapType;
+typedef void *EGLNativeWindowType;
+
+#define EGL_LIB "/system/lib/libEGL.so"
+#define GLES2_LIB "/system/lib/libGLESv2.so"
+
+#else
+
+#error "Platform not recognized"
+
+#endif
+
+#include "GLContextProvider.h"
+#include "nsDebug.h"
+
+#include "nsIWidget.h"
+
+namespace mozilla {
+namespace gl {
+
+typedef int EGLint;
+typedef unsigned int EGLBoolean;
+typedef unsigned int EGLenum;
+typedef void *EGLConfig;
+typedef void *EGLContext;
+typedef void *EGLDisplay;
+typedef void *EGLSurface;
+typedef void *EGLClientBuffer;
+typedef void *EGLCastToRelevantPtr;
+
+#define EGL_DEFAULT_DISPLAY  ((EGLNativeDisplayType)0)
+#define EGL_NO_CONTEXT       ((EGLContext)0)
+#define EGL_NO_DISPLAY       ((EGLDisplay)0)
+#define EGL_NO_SURFACE       ((EGLSurface)0)
+
+GLContextProvider sGLContextProvider;
+
+static class EGLLibrary
+{
+public:
+    EGLLibrary() : mInitialized(PR_FALSE) {}
+
+    typedef EGLDisplay (*pfnGetDisplay)(void *display_id);
+    pfnGetDisplay fGetDisplay;
+    typedef EGLContext (*pfnGetCurrentContext)(void);
+    pfnGetCurrentContext fGetCurrentContext;
+    typedef EGLBoolean (*pfnMakeCurrent)(EGLDisplay dpy, EGLSurface draw, EGLSurface read, EGLContext ctx);
+    pfnMakeCurrent fMakeCurrent;
+    typedef EGLBoolean (*pfnDestroyContext)(EGLDisplay dpy, EGLContext ctx);
+    pfnDestroyContext fDestroyContext;
+    typedef EGLContext (*pfnCreateContext)(EGLDisplay dpy, EGLConfig config, EGLContext share_context, const EGLint *attrib_list);
+    pfnCreateContext fCreateContext;
+    typedef EGLBoolean (*pfnDestroySurface)(EGLDisplay dpy, EGLSurface surface);
+    pfnDestroySurface fDestroySurface;
+    typedef EGLSurface (*pfnCreateWindowSurface)(EGLDisplay dpy, EGLConfig config, EGLNativeWindowType win, const EGLint *attrib_list);
+    pfnCreateWindowSurface fCreateWindowSurface;
+    typedef EGLSurface (*pfnCreatePbufferSurface)(EGLDisplay dpy, EGLConfig config, const EGLint *attrib_list);
+    pfnCreatePbufferSurface fCreatePbufferSurface;
+    typedef EGLSurface (*pfnCreatePixmapSurface)(EGLDisplay dpy, EGLConfig config, EGLNativePixmapType pixmap, const EGLint *attrib_list);
+    pfnCreatePixmapSurface fCreatePixmapSurface;
+    typedef EGLBoolean (*pfnBindAPI)(EGLenum api);
+    pfnBindAPI fBindAPI;
+    typedef EGLBoolean (*pfnInitialize)(EGLDisplay dpy, EGLint *major, EGLint *minor);
+    pfnInitialize fInitialize;
+    typedef EGLBoolean (*pfnChooseConfig)(EGLDisplay dpy, const EGLint *attrib_list, EGLConfig *configs, EGLint config_size, EGLint *num_config);
+    pfnChooseConfig fChooseConfig;
+    typedef EGLint (*pfnGetError)(void);
+    pfnGetError fGetError;
+    typedef EGLBoolean (*pfnGetConfigAttrib)(EGLDisplay dpy, EGLConfig config, EGLint attribute, EGLint *value);
+    pfnGetConfigAttrib fGetConfigAttrib;
+    typedef EGLBoolean (*pfnGetConfigs)(EGLDisplay dpy, EGLConfig *configs, EGLint config_size, EGLint *num_config);
+    pfnGetConfigs fGetConfigs;
+    typedef EGLBoolean (*pfnWaitNative)(EGLint engine);
+    pfnWaitNative fWaitNative;
+    typedef EGLCastToRelevantPtr (*pfnGetProcAddress)(const char *procname);
+    pfnGetProcAddress fGetProcAddress;
+
+    PRBool EnsureInitialized()
+    {
+        if (mInitialized) {
+            return PR_TRUE;
+        }
+
+        if (!mEGLLibrary) {
+            mEGLLibrary = PR_LoadLibrary(EGL_LIB);
+            if (!mEGLLibrary) {
+                NS_WARNING("Couldn't load EGL LIB.");
+                return PR_FALSE;
+            }
+        }
+#define SYMBOL(name) \
+	{ (PRFuncPtr*) &f##name, { "egl" #name, NULL } }
+
+	LibrarySymbolLoader::SymLoadStruct earlySymbols[] = {
+	    SYMBOL(GetDisplay),
+	    SYMBOL(GetCurrentContext),
+	    SYMBOL(MakeCurrent),
+	    SYMBOL(DestroyContext),
+	    SYMBOL(CreateContext),
+	    SYMBOL(DestroySurface),
+	    SYMBOL(CreateWindowSurface),
+	    SYMBOL(CreatePbufferSurface),
+	    SYMBOL(CreatePixmapSurface),
+	    SYMBOL(BindAPI),
+	    SYMBOL(Initialize),
+	    SYMBOL(ChooseConfig),
+	    SYMBOL(GetError),
+	    SYMBOL(GetConfigs),
+	    SYMBOL(GetConfigAttrib),
+	    SYMBOL(WaitNative),
+	    SYMBOL(GetProcAddress),
+	    { NULL, { NULL } }
+	};
+
+	if (!LibrarySymbolLoader::LoadSymbols(mEGLLibrary, &earlySymbols[0])) {
+	    NS_WARNING("Couldn't find required entry points in EGL library (early init)");
+	    return PR_FALSE;
+	}
+
+
+        mInitialized = PR_TRUE;
+        return PR_TRUE;
+    }
+
+private:
+    PRBool mInitialized;
+    PRLibrary *mEGLLibrary;
+} sEGLLibrary;
+
+class GLContextEGL : public GLContext
+{
+public:
+    GLContextEGL(EGLDisplay aDisplay, EGLConfig aConfig, 
+                 EGLSurface aSurface, EGLContext aContext)
+        : mDisplay(aDisplay), mConfig(aConfig), 
+          mSurface(aSurface), mContext(aContext){}
+
+    ~GLContextEGL()
+    {
+        sEGLLibrary.fDestroyContext(mDisplay, mContext);
+	sEGLLibrary.fDestroySurface(mDisplay, mSurface);
+    }
+
+    PRBool Init()
+    {
+        if (!OpenLibrary(GLES2_LIB)) {
+            NS_WARNING("Couldn't load EGL LIB.");
+            return PR_FALSE;
+        }
+
+        MakeCurrent();
+        return InitWithPrefix("gl", PR_TRUE);
+    }
+
+    PRBool MakeCurrent()
+    {
+	PRBool succeeded = PR_TRUE;
+
+	// Assume that EGL has the same problem as WGL does,
+	// where MakeCurrent with an already-current context is
+	// still expensive.
+	if (sEGLLibrary.fGetCurrentContext() != mContext) {
+	    succeeded = sEGLLibrary.fMakeCurrent(mDisplay, mSurface, mSurface, mContext);
+	    NS_ASSERTION(succeeded, "Failed to make GL context current!");
+	}
+
+        return succeeded;
+    }
+
+    PRBool SetupLookupFunction()
+    {
+        mLookupFunc = (PlatformLookupFunction)sEGLLibrary.fGetProcAddress;
+        return PR_TRUE;
+    }
+
+    void *GetNativeData(NativeDataType aType)
+    {
+        switch (aType) {
+        case NativeGLContext:
+            return mContext;
+
+        case NativePBuffer:
+	    return mSurface;
+
+        default:
+            return nsnull;
+        }
+    }
+
+private:
+    EGLDisplay mDisplay;
+    EGLConfig  mConfig;
+    EGLSurface mSurface;
+    EGLContext mContext;
+};
+
+already_AddRefed<GLContext>
+GLContextProvider::CreateForWindow(nsIWidget *aWidget)
+{
+    if (!sEGLLibrary.EnsureInitialized()) {
+        return nsnull;
+    }
+
+    EGLDisplay display;
+    EGLConfig  config;
+    EGLSurface surface;
+    EGLContext context;
+
+    display = sEGLLibrary.fGetDisplay(aWidget->GetNativeData(NS_NATIVE_DISPLAY));
+    if (!display) {
+        return nsnull;
+    }
+
+    if (!sEGLLibrary.fInitialize(display, NULL, NULL)) {
+        return nsnull;
+    }
+
+    if (!sEGLLibrary.fBindAPI(LOCAL_EGL_OPENGL_ES_API)) {
+        return nsnull;
+    }
+
+    EGLint attribs[] = {
+        LOCAL_EGL_SURFACE_TYPE,    LOCAL_EGL_WINDOW_BIT,
+        LOCAL_EGL_RENDERABLE_TYPE, LOCAL_EGL_OPENGL_ES2_BIT,
+        LOCAL_EGL_NONE
+    };
+
+    EGLint ncfg = 0;
+    if (!sEGLLibrary.fChooseConfig(display, attribs, &config, 1, &ncfg) ||
+        ncfg < 1)
+    {
+        return nsnull;
+    }
+
+    surface = sEGLLibrary.fCreateWindowSurface(display, config, GET_NATIVE_WINDOW(aWidget), 0);
+    if (!surface) {
+        return nsnull;
+    }
+
+    EGLint cxattribs[] = {
+        LOCAL_EGL_CONTEXT_CLIENT_VERSION, 2,
+        LOCAL_EGL_NONE
+    };
+
+    context = sEGLLibrary.fCreateContext(display, config, 0, cxattribs);
+    if (!context) {
+	sEGLLibrary.fDestroySurface(display, surface);
+        return nsnull;
+    }
+
+    nsRefPtr<GLContextEGL> glContext = new GLContextEGL(display, config, surface, context);
+
+    if (!glContext->Init())
+	return nsnull;
+
+    return glContext.forget().get();
+}
+
+already_AddRefed<GLContext>
+GLContextProvider::CreatePBuffer(const gfxIntSize &aSize, const ContextFormat &aFormat)
+{
+    if (!sEGLLibrary.EnsureInitialized()) {
+        return nsnull;
+    }
+
+    EGLDisplay display;
+    EGLConfig config;
+    EGLSurface surface;
+    EGLContext context;
+
+    display = sEGLLibrary.fGetDisplay(EGL_DEFAULT_DISPLAY);
+    if (!sEGLLibrary.fInitialize(display, NULL, NULL))
+	return nsnull;
+
+    nsTArray<int> attribs;
+
+#define A1_(_x)  do { attribs.AppendElement(_x); } while(0)
+#define A2_(_x,_y)  do {                                                \
+        attribs.AppendElement(_x);                                      \
+        attribs.AppendElement(_y);                                      \
+    } while(0)
+
+    A2_(LOCAL_EGL_RENDERABLE_TYPE, LOCAL_EGL_OPENGL_ES2_BIT);
+    A2_(LOCAL_EGL_SURFACE_TYPE, LOCAL_EGL_PBUFFER_BIT);
+    /* fix this for mobile */
+    A2_(LOCAL_EGL_BUFFER_SIZE, 15 /*aFormat.colorBits()*/);
+    A2_(LOCAL_EGL_RED_SIZE, 4 /*aFormat.red*/);
+    A2_(LOCAL_EGL_GREEN_SIZE, 4 /*aFormat.green*/);
+    A2_(LOCAL_EGL_BLUE_SIZE, 4 /*aFormat.blue*/);
+    A2_(LOCAL_EGL_ALPHA_SIZE, aFormat.alpha ? 4 : 0);
+    A2_(LOCAL_EGL_DEPTH_SIZE, aFormat.depth ? 16 : 0);
+    A2_(LOCAL_EGL_STENCIL_SIZE, aFormat.stencil);
+    A1_(LOCAL_EGL_NONE);
+
+    EGLConfig configs[32];
+    int numConfigs = 32;
+
+    if (!sEGLLibrary.fChooseConfig(display, attribs.Elements(),
+				   configs, numConfigs,
+				   &numConfigs))
+	return nsnull;
+
+    if (numConfigs == 0)
+	return nsnull;
+
+    // shrug
+    config = configs[0];
+
+    EGLint pbattrs[] = {
+        LOCAL_EGL_WIDTH, aSize.width,
+        LOCAL_EGL_HEIGHT, aSize.height,
+        LOCAL_EGL_NONE
+    };
+
+    surface = sEGLLibrary.fCreatePbufferSurface(display, config, pbattrs);
+    if (!surface)
+	return nsnull;
+
+    sEGLLibrary.fBindAPI(LOCAL_EGL_OPENGL_ES_API);
+
+    EGLint cxattrs[] = {
+        LOCAL_EGL_CONTEXT_CLIENT_VERSION, 2,
+        LOCAL_EGL_NONE
+    };
+
+    context = sEGLLibrary.fCreateContext(display, config, EGL_NO_CONTEXT, cxattrs);
+    if (!context) {
+	sEGLLibrary.fDestroySurface(display, surface);
+	return nsnull;
+    }
+
+    nsRefPtr<GLContextEGL> glContext = new GLContextEGL(display, config, surface, context);
+
+    if (!glContext->Init())
+	return nsnull;
+
+    return glContext.forget().get();
+}
+
+} /* namespace gl */
+} /* namespace mozilla */
+
diff --git a/gfx/thebes/src/GLContextProviderWGL.cpp b/gfx/thebes/src/GLContextProviderWGL.cpp
index 0010e679ec8..aacb79c7fbc 100644
--- a/gfx/thebes/src/GLContextProviderWGL.cpp
+++ b/gfx/thebes/src/GLContextProviderWGL.cpp
@@ -181,11 +181,12 @@ class GLContextWGL : public GLContext
 {
 public:
     GLContextWGL(HDC aDC, HGLRC aContext)
-        : mContext(aContext), mDC(aDC), mPBuffer(nsnull)
+        : mContext(aContext), mDC(aDC), mPBuffer(nsnull), mPixelFormat(-1)
     { }
 
-    GLContextWGL(HANDLE aPBuffer) {
+    GLContextWGL(HANDLE aPBuffer, int aPixelFormat) {
         mPBuffer = aPBuffer;
+        mPixelFormat = aPixelFormat;
         mDC = sWGLLibrary.fGetPbufferDC(mPBuffer);
         mContext = sWGLLibrary.fCreateContext(mDC);
     }
@@ -241,10 +242,52 @@ public:
         }
     }
 
+    PRBool Resize(const gfxIntSize& aNewSize) {
+        if (!mPBuffer)
+            return PR_FALSE;
+
+        nsTArray<int> pbattribs;
+        pbattribs.AppendElement(LOCAL_WGL_TEXTURE_FORMAT_ARB);
+        // XXX fixme after bug 571092 lands and we have the format available
+        if (true /*aFormat.alpha > 0*/) {
+            pbattribs.AppendElement(LOCAL_WGL_TEXTURE_RGBA_ARB);
+        } else {
+            pbattribs.AppendElement(LOCAL_WGL_TEXTURE_RGB_ARB);
+        }
+        pbattribs.AppendElement(LOCAL_WGL_TEXTURE_TARGET_ARB);
+        pbattribs.AppendElement(LOCAL_WGL_TEXTURE_2D_ARB);
+
+        pbattribs.AppendElement(0);
+
+        HANDLE newbuf = sWGLLibrary.fCreatePbuffer(gDummyWindowDC, mPixelFormat,
+                                                   aNewSize.width, aNewSize.height,
+                                                   pbattribs.Elements());
+        if (!newbuf)
+            return PR_FALSE;
+
+        bool isCurrent = false;
+        if (sWGLLibrary.fGetCurrentContext() == mContext) {
+            sWGLLibrary.fMakeCurrent(NULL, NULL);
+            isCurrent = true;
+        }
+
+        // hey, it worked!
+        sWGLLibrary.fDestroyPbuffer(mPBuffer);
+
+        mPBuffer = newbuf;
+        mDC = sWGLLibrary.fGetPbufferDC(mPBuffer);
+
+        if (isCurrent)
+            MakeCurrent();
+
+        return PR_TRUE;
+    }
+
 private:
     HGLRC mContext;
     HDC mDC;
     HANDLE mPBuffer;
+    int mPixelFormat;
 };
 
 already_AddRefed<GLContext>
@@ -362,7 +405,7 @@ GLContextProvider::CreatePBuffer(const gfxIntSize& aSize, const ContextFormat& a
         return nsnull;
     }
 
-    nsRefPtr<GLContextWGL> glContext = new GLContextWGL(pbuffer);
+    nsRefPtr<GLContextWGL> glContext = new GLContextWGL(pbuffer, chosenFormat);
     glContext->Init();
 
     return glContext.forget().get();
diff --git a/gfx/thebes/src/Makefile.in b/gfx/thebes/src/Makefile.in
index 0c9f793ab3a..01965e9e3e1 100644
--- a/gfx/thebes/src/Makefile.in
+++ b/gfx/thebes/src/Makefile.in
@@ -220,18 +220,38 @@ CSRCS += woff.c
 
 EXTRA_DSO_LDOPTS += $(TK_LIBS)
 
+GL_PROVIDER = Null
+
 ifeq ($(MOZ_WIDGET_TOOLKIT),windows)
 ifndef WINCE
-CPPSRCS += GLContextProviderWGL.cpp
-else
-CPPSRCS += GLContextProviderNull.cpp
+GL_PROVIDER = WGL
 endif
-else
+endif
+
+
 ifeq ($(MOZ_WIDGET_TOOLKIT),cocoa)
-CMMSRCS += GLContextProviderCGL.mm
-else
-CPPSRCS += GLContextProviderNull.cpp
+GL_PROVIDER = CGL
 endif
+
+ifeq ($(MOZ_WIDGET_TOOLKIT),gtk2)
+ifdef MOZ_PLATFORM_MAEMO
+GL_PROVIDER = EGL
+endif
+endif
+
+ifeq ($(MOZ_WIDGET_TOOLKIT),qt)
+GL_PROVIDER = EGL
+endif
+
+ifeq ($(MOZ_WIDGET_TOOLKIT),android)
+GL_PROVIDER = EGL
+endif
+
+# Mac is a special snowflake
+ifeq ($(GL_PROVIDER),CGL)
+CMMSRCS += GLContextProvider$(GL_PROVIDER).mm
+else
+CPPSRCS += GLContextProvider$(GL_PROVIDER).cpp
 endif
 
 DEFINES += -DIMPL_THEBES -DWOFF_MOZILLA_CLIENT
diff --git a/gfx/thebes/src/gfxD2DSurface.cpp b/gfx/thebes/src/gfxD2DSurface.cpp
index cd807b5b9fb..851c6bba4e8 100644
--- a/gfx/thebes/src/gfxD2DSurface.cpp
+++ b/gfx/thebes/src/gfxD2DSurface.cpp
@@ -37,9 +37,9 @@
 #include "cairo.h"
 #include "cairo-win32.h"
 
-gfxD2DSurface::gfxD2DSurface(HWND aWnd)
+gfxD2DSurface::gfxD2DSurface(HWND aWnd, gfxContentType aContent)
 {
-    Init(cairo_d2d_surface_create_for_hwnd(aWnd));
+    Init(cairo_d2d_surface_create_for_hwnd(aWnd, (cairo_content_t)aContent));
 }
 
 gfxD2DSurface::gfxD2DSurface(cairo_surface_t *csurf)
diff --git a/js/src/xpconnect/src/dom_quickstubs.qsconf b/js/src/xpconnect/src/dom_quickstubs.qsconf
index efdac2af73a..fa8e418d8d2 100644
--- a/js/src/xpconnect/src/dom_quickstubs.qsconf
+++ b/js/src/xpconnect/src/dom_quickstubs.qsconf
@@ -149,9 +149,7 @@ members = [
     'nsIDOM3Document.adoptNode',
     'nsIDOM3Document.renameNode',
     'nsIDOM3Node.*',
-    'nsIDOMDOMStringList.item',
-    'nsIDOMDOMStringList.length',
-    'nsIDOMDOMStringList.contains',
+    'nsIDOMDOMStringList.*',
     'nsIDOMDOMTokenList.*',
     'nsIDOMDOMSettableTokenList.*',
     'nsIDOMNameList.getName',
@@ -182,20 +180,17 @@ members = [
     'nsIDOMNSElement.mozMatchesSelector',
 
     # dom/interfaces/css
-    'nsIDOMElementCSSInlineStyle.style',
+    'nsIDOMElementCSSInlineStyle.*',
     'nsIDOMCSS2Properties.*',
     'nsIDOMNSCSS2Properties.*',
-    'nsIDOMRect.top',
-    'nsIDOMRect.right',
-    'nsIDOMRect.left',
-    'nsIDOMRect.bottom',
+    'nsIDOMRect.*',
     'nsIDOMViewCSS.getComputedStyle',
 
     # dom/interfaces/events
     'nsIDOMEventTarget.dispatchEvent',
     'nsIDOMEventTarget.removeEventListener',
     'nsIDOMNSEventTarget.addEventListener',
-    'nsIDOMDocumentEvent.createEvent',
+    'nsIDOMDocumentEvent.*',
 
     'nsIDOMEvent.*',
     'nsIDOMMouseEvent.*',
diff --git a/js/src/xpconnect/src/xpccomponents.cpp b/js/src/xpconnect/src/xpccomponents.cpp
index db0a2900e05..e3f1a9a6594 100644
--- a/js/src/xpconnect/src/xpccomponents.cpp
+++ b/js/src/xpconnect/src/xpccomponents.cpp
@@ -3031,11 +3031,28 @@ SandboxDump(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
     if (!str)
         return JS_FALSE;
 
-    char *bytes = JS_GetStringBytes(str);
-    if (!bytes)
+    jschar *chars = JS_GetStringChars(str);
+    if (!chars)
         return JS_FALSE;
 
-    fputs(bytes, stderr);
+    nsDependentString wstr(reinterpret_cast<PRUnichar *>(chars),
+                           JS_GetStringLength(str));
+    char *cstr = ToNewUTF8String(wstr);
+    if (!cstr)
+        return JS_FALSE;
+
+#if defined(XP_MAC) || defined(XP_MACOSX)
+    // Be nice and convert all \r to \n.
+    char *c = cstr, *cEnd = cstr + strlen(cstr);
+    while (c < cEnd) {
+        if (*c == '\r')
+            *c = '\n';
+        c++;
+    }
+#endif
+
+    fputs(cstr, stderr);
+    NS_Free(cstr);
     return JS_TRUE;
 }
 
diff --git a/layout/forms/crashtests/570624-1.html b/layout/forms/crashtests/570624-1.html
new file mode 100644
index 00000000000..47a2777282c
--- /dev/null
+++ b/layout/forms/crashtests/570624-1.html
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+  var xt = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", 'textbox');
+  document.body.appendChild(xt);
+  xt.setAttribute('disabled', "true");
+  xt.setAttribute('value', "foo");
+}
+</script>
+</head>
+<body onload="boom();">
+</body>
+</html>
diff --git a/layout/forms/crashtests/crashtests.list b/layout/forms/crashtests/crashtests.list
index d47a5e17133..df644c5817f 100644
--- a/layout/forms/crashtests/crashtests.list
+++ b/layout/forms/crashtests/crashtests.list
@@ -38,4 +38,5 @@ load 455451-1.html
 load 457537-1.html
 load 457537-2.html
 load 478219-1.xhtml
+load 570624-1.html
 load 498698-1.html
diff --git a/layout/forms/nsTextControlFrame.cpp b/layout/forms/nsTextControlFrame.cpp
index 13ab357c49d..0247e419634 100644
--- a/layout/forms/nsTextControlFrame.cpp
+++ b/layout/forms/nsTextControlFrame.cpp
@@ -822,9 +822,8 @@ nsTextControlFrame::GetRootNodeAndInitializeEditor(nsIDOMElement **aRootElement)
 {
   NS_ENSURE_ARG_POINTER(aRootElement);
 
-  nsCOMPtr<nsITextControlElement> txtCtrl = do_QueryInterface(GetContent());
-  NS_ASSERTION(txtCtrl, "Content not a text control element");
-  nsIEditor* editor = txtCtrl->GetTextEditor();
+  nsCOMPtr<nsIEditor> editor;
+  GetEditor(getter_AddRefs(editor));
   if (!editor)
     return NS_OK;
 
@@ -1216,9 +1215,9 @@ nsTextControlFrame::AttributeChanged(PRInt32         aNameSpaceID,
   const PRBool needEditor = nsGkAtoms::maxlength == aAttribute ||
                             nsGkAtoms::readonly == aAttribute ||
                             nsGkAtoms::disabled == aAttribute;
-  nsIEditor *editor = nsnull;
+  nsCOMPtr<nsIEditor> editor;
   if (needEditor) {
-    editor = txtCtrl->GetTextEditor();
+    GetEditor(getter_AddRefs(editor));
   }
   if ((needEditor && !editor) || !selCon)
     return nsBoxFrame::AttributeChanged(aNameSpaceID, aAttribute, aModType);;
diff --git a/layout/reftests/bugs/228856-2-style-1.css b/layout/reftests/bugs/228856-2-style-1.css
new file mode 100644
index 00000000000..a6d6acf36a1
Binary files /dev/null and b/layout/reftests/bugs/228856-2-style-1.css differ
diff --git a/layout/reftests/bugs/228856-2.html b/layout/reftests/bugs/228856-2.html
index 087a2a5e660..0bc8ebb5c52 100644
Binary files a/layout/reftests/bugs/228856-2.html and b/layout/reftests/bugs/228856-2.html differ
diff --git a/layout/reftests/reftest.list b/layout/reftests/reftest.list
index 4bb547ae608..500deefe7c4 100644
--- a/layout/reftests/reftest.list
+++ b/layout/reftests/reftest.list
@@ -147,6 +147,9 @@ include object/reftest.list
 # ogg-video/
 include ogg-video/reftest.list
 
+# parser/
+include ../../parser/htmlparser/tests/reftest/reftest.list
+
 # percent-overflow-sizing/
 include percent-overflow-sizing/reftest.list
 
diff --git a/layout/reftests/svg/dynamic-use-nested-01.svg b/layout/reftests/svg/dynamic-use-nested-01.svg
index 40fc7078425..2e145086640 100644
--- a/layout/reftests/svg/dynamic-use-nested-01.svg
+++ b/layout/reftests/svg/dynamic-use-nested-01.svg
@@ -1,7 +1,7 @@
 <svg xmlns="http://www.w3.org/2000/svg" version="1.1"
-     xmlns:xlink="http://www.w3.org/1999/xlink" 
+     xmlns:xlink="http://www.w3.org/1999/xlink"
      onload="boom();">
-     
+
 <script><![CDATA[
 
 // reftest for bug 467498
@@ -14,15 +14,12 @@ function boom()
 
 ]]></script>
 
-  <!-- change to lime for automated testing -->
-  <rect width="100%" height="100%" fill="white"/>  
-
   <g style="fill: blue;">
     <g id="g1">
       <rect id="rect" x="20%" width="4%" height="20%"/>
     </g>
   </g>
-  
+
   <g style="fill: green;">
     <g id="g2">
       <use x="20%" xlink:href="#g1"/>
diff --git a/layout/reftests/svg/reftest.list b/layout/reftests/svg/reftest.list
index b5b4e619ccf..08667fdbbb8 100644
--- a/layout/reftests/svg/reftest.list
+++ b/layout/reftests/svg/reftest.list
@@ -148,6 +148,7 @@ random-if(MOZ_WIDGET_TOOLKIT=="gtk2") == text-font-weight-01.svg text-font-weigh
 == text-gradient-01.svg text-gradient-01-ref.svg
 == text-in-link-01.svg text-in-link-01-ref.svg
 == text-in-link-02.svg text-in-link-02-ref.svg
+== text-in-link-03.svg text-in-link-03-ref.svg
 # Tests for bug 546813: sanity-check using HTML text, then test SVG behavior.
 != text-language-00.xhtml text-language-00-ref.xhtml
 random-if(MOZ_WIDGET_TOOLKIT=="gtk2") != text-language-01.xhtml text-language-01-ref.xhtml # Fails on Linux tryserver due to lack of CJK fonts.
diff --git a/layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-no-no.svg b/layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-no-no.svg
new file mode 100644
index 00000000000..2b4e18030e2
--- /dev/null
+++ b/layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-no-no.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     style="font-size: 2px"
+     class="reftest-wait"
+     onload="go()">
+  <script xlink:href="../smil-grid.js" type="text/javascript"/>
+  <script xlink:href="../smil-util.js" type="text/javascript"/>
+  <script>
+    function go() {
+      var animAttrHash = { "attributeName" : "font-size",
+                           "attributeType" : "CSS",
+                           "from"          : "10",
+                           "to"            : "30" };
+      testAnimatedTextGrid("animate", [animAttrHash]);
+    }
+  </script>
+</svg>
diff --git a/layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-no-px.svg b/layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-no-px.svg
new file mode 100644
index 00000000000..7ced25e9af9
--- /dev/null
+++ b/layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-no-px.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     style="font-size: 2px"
+     class="reftest-wait"
+     onload="go()">
+  <script xlink:href="../smil-grid.js" type="text/javascript"/>
+  <script xlink:href="../smil-util.js" type="text/javascript"/>
+  <script>
+    function go() {
+      var animAttrHash = { "attributeName" : "font-size",
+                           "attributeType" : "CSS",
+                           "from"          : "10",
+                           "to"            : "30px" };
+      testAnimatedTextGrid("animate", [animAttrHash]);
+    }
+  </script>
+</svg>
diff --git a/layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-px-no.svg b/layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-px-no.svg
new file mode 100644
index 00000000000..56e51eeab72
--- /dev/null
+++ b/layout/reftests/svg/smil/style/anim-css-fontsize-1-from-to-px-no.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     style="font-size: 2px"
+     class="reftest-wait"
+     onload="go()">
+  <script xlink:href="../smil-grid.js" type="text/javascript"/>
+  <script xlink:href="../smil-util.js" type="text/javascript"/>
+  <script>
+    function go() {
+      var animAttrHash = { "attributeName" : "font-size",
+                           "attributeType" : "CSS",
+                           "from"          : "10px",
+                           "to"            : "30" };
+      testAnimatedTextGrid("animate", [animAttrHash]);
+    }
+  </script>
+</svg>
diff --git a/layout/reftests/svg/smil/style/reftest.list b/layout/reftests/svg/smil/style/reftest.list
index 80db15d193b..fec6a68b193 100644
--- a/layout/reftests/svg/smil/style/reftest.list
+++ b/layout/reftests/svg/smil/style/reftest.list
@@ -72,6 +72,11 @@ fails == anim-css-fillopacity-3-clamp-big.svg     anim-css-fillopacity-3-ref.svg
 == anim-css-fontsize-1-from-by-px-px.svg    anim-css-fontsize-1-ref.svg
 == anim-css-fontsize-1-from-to-px-px.svg    anim-css-fontsize-1-ref.svg
 
+# 'font-size' property (accepts unitless values)
+== anim-css-fontsize-1-from-to-no-no.svg    anim-css-fontsize-1-ref.svg
+== anim-css-fontsize-1-from-to-no-px.svg    anim-css-fontsize-1-ref.svg
+== anim-css-fontsize-1-from-to-px-no.svg    anim-css-fontsize-1-ref.svg
+
 # 'font-size' mapped attribute (accepts unitless values)
 == anim-mapped-fontsize-1-from-to-no-no.svg anim-css-fontsize-1-ref.svg
 == anim-mapped-fontsize-1-from-to-no-px.svg anim-css-fontsize-1-ref.svg
diff --git a/layout/reftests/svg/text-in-link-03-ref.svg b/layout/reftests/svg/text-in-link-03-ref.svg
new file mode 100644
index 00000000000..6012674181c
--- /dev/null
+++ b/layout/reftests/svg/text-in-link-03-ref.svg
@@ -0,0 +1,11 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/licenses/publicdomain/
+-->
+<svg xmlns="http://www.w3.org/2000/svg" width="300" height="50">
+  <title>Reference to check that CSS works for links</title>
+
+  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=570354 -->
+
+  <text x="0" y="25"><tspan font-size="15">AAAAA</tspan></text>
+</svg>
diff --git a/layout/reftests/svg/text-in-link-03.svg b/layout/reftests/svg/text-in-link-03.svg
new file mode 100644
index 00000000000..4c56c7099ca
--- /dev/null
+++ b/layout/reftests/svg/text-in-link-03.svg
@@ -0,0 +1,11 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/licenses/publicdomain/
+-->
+<svg xmlns="http://www.w3.org/2000/svg" width="300" height="50">
+  <title>Testcase to check that CSS works for links</title>
+
+  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=570354 -->
+
+  <text x="0" y="25"><a font-size="15"><tspan>AAAAA</tspan></a></text>
+</svg>
diff --git a/media/libvpx/Makefile.in b/media/libvpx/Makefile.in
index f45a99f81c3..f73acfb2023 100644
--- a/media/libvpx/Makefile.in
+++ b/media/libvpx/Makefile.in
@@ -192,10 +192,12 @@ ASFILES += \
   $(NULL)
 
 ifeq ($(OS_ARCH),WINNT)
+ifneq ($(OS_TEST),x86_64)
 ASFILES += \
   safeseh.asm \
   $(NULL)
 endif
+endif
 
 endif
  
diff --git a/media/libvpx/vpx_config.asm b/media/libvpx/vpx_config.asm
index 6a9597ba977..53447025508 100644
--- a/media/libvpx/vpx_config.asm
+++ b/media/libvpx/vpx_config.asm
@@ -6,4 +6,6 @@
 %include "vpx_config_x86_64-darwin9-gcc.asm"
 %elifidn __OUTPUT_FORMAT__,win32
 %include "vpx_config_x86-win32-vs8.asm"
+%elifidn __OUTPUT_FORMAT__,x64
+%include "vpx_config_x86_64-win64-vs8.asm"
 %endif
diff --git a/media/libvpx/vpx_config.h b/media/libvpx/vpx_config.h
index 583486dce7b..25e9cdb930b 100644
--- a/media/libvpx/vpx_config.h
+++ b/media/libvpx/vpx_config.h
@@ -16,6 +16,10 @@
 /* 32 bit Linux. */
 #include "vpx_config_x86-linux-gcc.h"
 
+#elif defined(_MSC_VER) && defined(_M_X64)
+/* 64 bit Windows */
+#include "vpx_config_x86_64-win64-vs8.h"
+
 #else
 #error VPX_X86_ASM is defined, but assembly not supported on this platform!
 #endif
diff --git a/media/libvpx/vpx_config_c.c b/media/libvpx/vpx_config_c.c
index 3206380ce7d..9b023e87d47 100644
--- a/media/libvpx/vpx_config_c.c
+++ b/media/libvpx/vpx_config_c.c
@@ -16,6 +16,9 @@
 /* 32 bit Linux. */
 #include "vpx_config_x86-linux-gcc.c"
 
+#elif defined(_MSC_VER) && defined(_M_X64)
+#include "vpx_config_x86_64-win64-vs8.c"
+
 #else
 #error VPX_X86_ASM is defined, but assembly not supported on this platform!
 #endif
diff --git a/media/libvpx/vpx_config_x86_64-win64-vs8.asm b/media/libvpx/vpx_config_x86_64-win64-vs8.asm
new file mode 100644
index 00000000000..b1c381e0037
--- /dev/null
+++ b/media/libvpx/vpx_config_x86_64-win64-vs8.asm
@@ -0,0 +1,61 @@
+ARCH_ARM equ 0
+ARCH_MIPS equ 0
+ARCH_X86 equ 0
+ARCH_X86_64 equ 1
+ARCH_PPC32 equ 0
+ARCH_PPC64 equ 0
+HAVE_ARMV5TE equ 0
+HAVE_ARMV6 equ 0
+HAVE_ARMV7 equ 0
+HAVE_IWMMXT equ 0
+HAVE_IWMMXT2 equ 0
+HAVE_MIPS32 equ 0
+HAVE_MMX equ 1
+HAVE_SSE equ 1
+HAVE_SSE2 equ 1
+HAVE_SSE3 equ 1
+HAVE_SSSE3 equ 1
+HAVE_ALTIVEC equ 0
+HAVE_VPX_PORTS equ 1
+HAVE_STDINT_H equ 0
+HAVE_ALT_TREE_LAYOUT equ 0
+HAVE_PTHREAD_H equ 0
+HAVE_SYS_MMAN_H equ 0
+CONFIG_EXTERNAL_BUILD equ 1
+CONFIG_INSTALL_DOCS equ 0
+CONFIG_INSTALL_BINS equ 1
+CONFIG_INSTALL_LIBS equ 1
+CONFIG_INSTALL_SRCS equ 0
+CONFIG_DEBUG equ 0
+CONFIG_GPROF equ 0
+CONFIG_GCOV equ 0
+CONFIG_RVCT equ 0
+CONFIG_GCC equ 0
+CONFIG_MSVS equ 1
+CONFIG_PIC equ 0
+CONFIG_BIG_ENDIAN equ 0
+CONFIG_CODEC_SRCS equ 0
+CONFIG_DEBUG_LIBS equ 0
+CONFIG_FAST_UNALIGNED equ 1
+CONFIG_MEM_MANAGER equ 0
+CONFIG_MEM_TRACKER equ 0
+CONFIG_MEM_CHECKS equ 0
+CONFIG_MD5 equ 1
+CONFIG_DEQUANT_TOKENS equ 0
+CONFIG_DC_RECON equ 0
+CONFIG_NEW_TOKENS equ 0
+CONFIG_EVAL_LIMIT equ 0
+CONFIG_RUNTIME_CPU_DETECT equ 1
+CONFIG_POSTPROC equ 1
+CONFIG_POSTPROC_GENERIC equ 0
+CONFIG_MULTITHREAD equ 1
+CONFIG_PSNR equ 0
+CONFIG_VP8_ENCODER equ 0
+CONFIG_VP8_DECODER equ 1
+CONFIG_VP8 equ 1
+CONFIG_ENCODERS equ 0
+CONFIG_DECODERS equ 1
+CONFIG_STATIC_MSVCRT equ 0
+CONFIG_SPATIAL_RESAMPLING equ 1
+CONFIG_REALTIME_ONLY equ 0
+CONFIG_SHARED equ 0
diff --git a/media/libvpx/vpx_config_x86_64-win64-vs8.c b/media/libvpx/vpx_config_x86_64-win64-vs8.c
new file mode 100644
index 00000000000..a13c649a91c
--- /dev/null
+++ b/media/libvpx/vpx_config_x86_64-win64-vs8.c
@@ -0,0 +1,2 @@
+static const char* const cfg = "--target=x86_64-win64-vs8 --disable-vp8-encoder --disable-examples --disable-install-docs";
+const char *vpx_codec_build_config(void) {return cfg;}
diff --git a/media/libvpx/vpx_config_x86_64-win64-vs8.h b/media/libvpx/vpx_config_x86_64-win64-vs8.h
new file mode 100644
index 00000000000..06b32fb875f
--- /dev/null
+++ b/media/libvpx/vpx_config_x86_64-win64-vs8.h
@@ -0,0 +1,65 @@
+/* This file automatically generated by configure. Do not edit! */
+#define INLINE      __inline
+#define FORCEINLINE __forceinline
+#define RESTRICT    
+#define ARCH_ARM 0
+#define ARCH_MIPS 0
+#define ARCH_X86 0
+#define ARCH_X86_64 1
+#define ARCH_PPC32 0
+#define ARCH_PPC64 0
+#define HAVE_ARMV5TE 0
+#define HAVE_ARMV6 0
+#define HAVE_ARMV7 0
+#define HAVE_IWMMXT 0
+#define HAVE_IWMMXT2 0
+#define HAVE_MIPS32 0
+#define HAVE_MMX 1
+#define HAVE_SSE 1
+#define HAVE_SSE2 1
+#define HAVE_SSE3 1
+#define HAVE_SSSE3 1
+#define HAVE_ALTIVEC 0
+#define HAVE_VPX_PORTS 1
+#define HAVE_STDINT_H 0
+#define HAVE_ALT_TREE_LAYOUT 0
+#define HAVE_PTHREAD_H 0
+#define HAVE_SYS_MMAN_H 0
+#define CONFIG_EXTERNAL_BUILD 1
+#define CONFIG_INSTALL_DOCS 0
+#define CONFIG_INSTALL_BINS 1
+#define CONFIG_INSTALL_LIBS 1
+#define CONFIG_INSTALL_SRCS 0
+#define CONFIG_DEBUG 0
+#define CONFIG_GPROF 0
+#define CONFIG_GCOV 0
+#define CONFIG_RVCT 0
+#define CONFIG_GCC 0
+#define CONFIG_MSVS 1
+#define CONFIG_PIC 0
+#define CONFIG_BIG_ENDIAN 0
+#define CONFIG_CODEC_SRCS 0
+#define CONFIG_DEBUG_LIBS 0
+#define CONFIG_FAST_UNALIGNED 1
+#define CONFIG_MEM_MANAGER 0
+#define CONFIG_MEM_TRACKER 0
+#define CONFIG_MEM_CHECKS 0
+#define CONFIG_MD5 1
+#define CONFIG_DEQUANT_TOKENS 0
+#define CONFIG_DC_RECON 0
+#define CONFIG_NEW_TOKENS 0
+#define CONFIG_EVAL_LIMIT 0
+#define CONFIG_RUNTIME_CPU_DETECT 1
+#define CONFIG_POSTPROC 1
+#define CONFIG_POSTPROC_GENERIC 0
+#define CONFIG_MULTITHREAD 1
+#define CONFIG_PSNR 0
+#define CONFIG_VP8_ENCODER 0
+#define CONFIG_VP8_DECODER 1
+#define CONFIG_VP8 1
+#define CONFIG_ENCODERS 0
+#define CONFIG_DECODERS 1
+#define CONFIG_STATIC_MSVCRT 0
+#define CONFIG_SPATIAL_RESAMPLING 1
+#define CONFIG_REALTIME_ONLY 0
+#define CONFIG_SHARED 0
diff --git a/modules/plugin/test/crashtests/570884.html b/modules/plugin/test/crashtests/570884.html
new file mode 100644
index 00000000000..7af5cdba533
--- /dev/null
+++ b/modules/plugin/test/crashtests/570884.html
@@ -0,0 +1,8 @@
+<body>
+<embed type="application/x-test" width="20"></embed>
+<embed type="application/x-test" width="10"></embed>
+<embed type="application/x-test" width="0"></embed>
+<embed type="application/x-test" width="20" height="20"></embed>
+<embed type="application/x-test" width="10" height="10"></embed>
+<embed type="application/x-test" width="0" height="0"></embed>
+</body>
diff --git a/modules/plugin/test/crashtests/crashtests.list b/modules/plugin/test/crashtests/crashtests.list
index 4f528770c82..6e27139a181 100644
--- a/modules/plugin/test/crashtests/crashtests.list
+++ b/modules/plugin/test/crashtests/crashtests.list
@@ -4,3 +4,4 @@ load 48856-1.html
 load 110650-1.html
 skip-if(MOZ_WIDGET_TOOLKIT=="cocoa") script 539897-1.html
 script 540114-1.html
+load 570884.html
diff --git a/modules/plugin/test/testplugin/nptest_macosx.mm b/modules/plugin/test/testplugin/nptest_macosx.mm
index 60ed16fb6e8..448134f6bea 100644
--- a/modules/plugin/test/testplugin/nptest_macosx.mm
+++ b/modules/plugin/test/testplugin/nptest_macosx.mm
@@ -189,7 +189,8 @@ pluginDraw(InstanceData* instanceData, NPCocoaEvent* event)
 
     // Initialize a rectangular path.
     CGMutablePathRef path = CGPathCreateMutable();
-    CGRect bounds = CGRectMake(10.0, 10.0, windowWidth - 20.0, windowHeight - 20.0);
+    CGRect bounds = CGRectMake(10.0, 10.0, PR_MAX(0.0, windowWidth - 20.0),
+                               PR_MAX(0.0, windowHeight - 20.0));
     CGPathAddRect(path, NULL, bounds);
 
     // Initialize an attributed string.
@@ -210,8 +211,10 @@ pluginDraw(InstanceData* instanceData, NPCocoaEvent* event)
     // Create the frame and draw it into the graphics context
     CTFrameRef frame = CTFramesetterCreateFrame(framesetter, CFRangeMake(0, 0), path, NULL);
     CFRelease(framesetter);
-    CTFrameDraw(frame, cgContext);
-    CFRelease(frame);
+    if (frame) {
+      CTFrameDraw(frame, cgContext);
+      CFRelease(frame);
+    }
 
     // restore the cgcontext gstate
     CGContextRestoreGState(cgContext);
diff --git a/other-licenses/nsis/Plugins/AccessControl.dll b/other-licenses/nsis/Plugins/AccessControl.dll
new file mode 100644
index 00000000000..d9642d4e86c
Binary files /dev/null and b/other-licenses/nsis/Plugins/AccessControl.dll differ
diff --git a/toolkit/mozapps/installer/windows/nsis/AppAssocReg.dll b/other-licenses/nsis/Plugins/AppAssocReg.dll
similarity index 100%
rename from toolkit/mozapps/installer/windows/nsis/AppAssocReg.dll
rename to other-licenses/nsis/Plugins/AppAssocReg.dll
diff --git a/toolkit/mozapps/installer/windows/nsis/ApplicationID.dll b/other-licenses/nsis/Plugins/ApplicationID.dll
similarity index 100%
rename from toolkit/mozapps/installer/windows/nsis/ApplicationID.dll
rename to other-licenses/nsis/Plugins/ApplicationID.dll
diff --git a/toolkit/mozapps/installer/windows/nsis/ShellLink.dll b/other-licenses/nsis/Plugins/ShellLink.dll
similarity index 100%
rename from toolkit/mozapps/installer/windows/nsis/ShellLink.dll
rename to other-licenses/nsis/Plugins/ShellLink.dll
diff --git a/toolkit/mozapps/installer/windows/nsis/UAC.dll b/other-licenses/nsis/Plugins/UAC.dll
similarity index 100%
rename from toolkit/mozapps/installer/windows/nsis/UAC.dll
rename to other-licenses/nsis/Plugins/UAC.dll
diff --git a/toolkit/mozapps/installer/windows/nsis/nsProcess.dll b/other-licenses/nsis/Plugins/nsProcess.dll
similarity index 100%
rename from toolkit/mozapps/installer/windows/nsis/nsProcess.dll
rename to other-licenses/nsis/Plugins/nsProcess.dll
diff --git a/parser/html/javasrc/Tokenizer.java b/parser/html/javasrc/Tokenizer.java
index a6c2aa993dd..a8adb7d9986 100644
--- a/parser/html/javasrc/Tokenizer.java
+++ b/parser/html/javasrc/Tokenizer.java
@@ -1,7 +1,7 @@
 /*
  * Copyright (c) 2005-2007 Henri Sivonen
  * Copyright (c) 2007-2010 Mozilla Foundation
- * Portions of comments Copyright 2004-2008 Apple Computer, Inc., Mozilla 
+ * Portions of comments Copyright 2004-2010 Apple Computer, Inc., Mozilla 
  * Foundation, and Opera Software ASA.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a 
@@ -26,9 +26,9 @@
 /*
  * The comments following this one that use the same comment syntax as this 
  * comment are quotes from the WHATWG HTML 5 spec as of 2 June 2007 
- * amended as of June 18 2008.
+ * amended as of June 18 2008 and May 31 2010.
  * That document came with this statement:
- * "© Copyright 2004-2008 Apple Computer, Inc., Mozilla Foundation, and 
+ * "© Copyright 2004-2010 Apple Computer, Inc., Mozilla Foundation, and 
  * Opera Software ASA. You are granted a license to use, reproduce and 
  * create derivative works of this document."
  */
@@ -4516,11 +4516,12 @@ public class Tokenizer implements Locator {
                                     ch = strBuf[strBufMark];
                                     // }
                                 }
-                                if ((ch >= '0' && ch <= '9')
+                                if (ch == '=' || (ch >= '0' && ch <= '9')
                                         || (ch >= 'A' && ch <= 'Z')
                                         || (ch >= 'a' && ch <= 'z')) {
                                     /*
-                                     * and the next character is in the range
+                                     * and the next character is either a U+003D
+                                     * EQUALS SIGN character (=) or in the range
                                      * U+0030 DIGIT ZERO to U+0039 DIGIT NINE,
                                      * U+0041 LATIN CAPITAL LETTER A to U+005A
                                      * LATIN CAPITAL LETTER Z, or U+0061 LATIN
@@ -5858,10 +5859,9 @@ public class Tokenizer implements Locator {
 
     private void emitReplacementCharacter(@NoLength char[] buf, int pos)
             throws SAXException {
-        silentCarriageReturn();
         flushChars(buf, pos);
         tokenHandler.characters(Tokenizer.REPLACEMENT_CHARACTER, 0, 1);
-        cstart = Integer.MAX_VALUE;
+        cstart = pos + 1;
     }
 
     private void setAdditionalAndRememberAmpersandLocation(char add) {
diff --git a/parser/html/javasrc/TreeBuilder.java b/parser/html/javasrc/TreeBuilder.java
index 05cfd6253db..a272169c298 100644
--- a/parser/html/javasrc/TreeBuilder.java
+++ b/parser/html/javasrc/TreeBuilder.java
@@ -1793,8 +1793,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                         switch (group) {
                             case HTML:
                                 err("Stray \u201Chtml\u201D start tag.");
-                                addAttributesToHtml(attributes);
-                                attributes = null; // CPP
+                                if (!fragment) {
+                                    addAttributesToHtml(attributes);
+                                    attributes = null; // CPP
+                                }
                                 break starttagloop;
                             case BASE:
                             case LINK:
@@ -1807,8 +1809,9 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                                 break inbodyloop;
                             case BODY:
                                 err("\u201Cbody\u201D start tag found but the \u201Cbody\u201D element is already open.");
-                                addAttributesToBody(attributes);
-                                attributes = null; // CPP
+                                if (addAttributesToBody(attributes)) {
+                                    attributes = null; // CPP
+                                }
                                 break starttagloop;
                             case P:
                             case DIV_OR_BLOCKQUOTE_OR_CENTER_OR_MENU:
@@ -2302,8 +2305,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                         switch (group) {
                             case HTML:
                                 err("Stray \u201Chtml\u201D start tag.");
-                                addAttributesToHtml(attributes);
-                                attributes = null; // CPP
+                                if (!fragment) {
+                                    addAttributesToHtml(attributes);
+                                    attributes = null; // CPP
+                                }
                                 break starttagloop;
                             case BASE:
                             case COMMAND:
@@ -2386,8 +2391,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                             // XXX did Hixie really mean to omit "base"
                             // here?
                             err("Stray \u201Chtml\u201D start tag.");
-                            addAttributesToHtml(attributes);
-                            attributes = null; // CPP
+                            if (!fragment) {
+                                addAttributesToHtml(attributes);
+                                attributes = null; // CPP
+                            }
                             break starttagloop;
                         case LINK:
                             appendVoidElementToCurrentMayFoster(
@@ -2432,8 +2439,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                     switch (group) {
                         case HTML:
                             err("Stray \u201Chtml\u201D start tag.");
-                            addAttributesToHtml(attributes);
-                            attributes = null; // CPP
+                            if (!fragment) {
+                                addAttributesToHtml(attributes);
+                                attributes = null; // CPP
+                            }
                             break starttagloop;
                         case COL:
                             appendVoidElementToCurrentMayFoster(
@@ -2479,8 +2488,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                     switch (group) {
                         case HTML:
                             err("Stray \u201Chtml\u201D start tag.");
-                            addAttributesToHtml(attributes);
-                            attributes = null; // CPP
+                            if (!fragment) {
+                                addAttributesToHtml(attributes);
+                                attributes = null; // CPP
+                            }
                             break starttagloop;
                         case OPTION:
                             if (isCurrent("option")) {
@@ -2555,8 +2566,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                     switch (group) {
                         case HTML:
                             err("Stray \u201Chtml\u201D start tag.");
-                            addAttributesToHtml(attributes);
-                            attributes = null; // CPP
+                            if (!fragment) {
+                                addAttributesToHtml(attributes);
+                                attributes = null; // CPP
+                            }
                             break starttagloop;
                         default:
                             err("Stray \u201C" + name + "\u201D start tag.");
@@ -2585,8 +2598,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                     switch (group) {
                         case HTML:
                             err("Stray \u201Chtml\u201D start tag.");
-                            addAttributesToHtml(attributes);
-                            attributes = null; // CPP
+                            if (!fragment) {
+                                addAttributesToHtml(attributes);
+                                attributes = null; // CPP
+                            }
                             break starttagloop;
                         case NOFRAMES:
                             appendToCurrentNodeAndPushElement(
@@ -2675,8 +2690,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                     switch (group) {
                         case HTML:
                             err("Stray \u201Chtml\u201D start tag.");
-                            addAttributesToHtml(attributes);
-                            attributes = null; // CPP
+                            if (!fragment) {
+                                addAttributesToHtml(attributes);
+                                attributes = null; // CPP
+                            }
                             break starttagloop;
                         case HEAD:
                             /*
@@ -2719,8 +2736,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                     switch (group) {
                         case HTML:
                             err("Stray \u201Chtml\u201D start tag.");
-                            addAttributesToHtml(attributes);
-                            attributes = null; // CPP
+                            if (!fragment) {
+                                addAttributesToHtml(attributes);
+                                attributes = null; // CPP
+                            }
                             break starttagloop;
                         case BODY:
                             if (attributes.getLength() == 0) {
@@ -2825,8 +2844,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
                     switch (group) {
                         case HTML:
                             err("Stray \u201Chtml\u201D start tag.");
-                            addAttributesToHtml(attributes);
-                            attributes = null; // CPP
+                            if (!fragment) {
+                                addAttributesToHtml(attributes);
+                                attributes = null; // CPP
+                            }
                             break starttagloop;
                         default:
                             err("Stray \u201C" + name + "\u201D start tag.");
@@ -4542,7 +4563,13 @@ public abstract class TreeBuilder<T> implements TokenHandler,
         return 0;
     }
 
-    private void addAttributesToBody(HtmlAttributes attributes)
+    /**
+     * Attempt to add attribute to the body element.
+     * @param attributes the attributes
+     * @return <code>true</code> iff the attributes were added
+     * @throws SAXException
+     */
+    private boolean addAttributesToBody(HtmlAttributes attributes)
             throws SAXException {
         // [NOCPP[
         checkAttributes(attributes, "http://www.w3.org/1999/xhtml");
@@ -4551,8 +4578,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
             StackNode<T> body = stack[1];
             if (body.group == TreeBuilder.BODY) {
                 addAttributesToElement(body.node, attributes);
+                return true;
             }
         }
+        return false;
     }
 
     private void addAttributesToHtml(HtmlAttributes attributes)
diff --git a/parser/html/nsHtml5Tokenizer.cpp b/parser/html/nsHtml5Tokenizer.cpp
index 0bd846cc034..6acc66d16da 100644
--- a/parser/html/nsHtml5Tokenizer.cpp
+++ b/parser/html/nsHtml5Tokenizer.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (c) 2005-2007 Henri Sivonen
  * Copyright (c) 2007-2010 Mozilla Foundation
- * Portions of comments Copyright 2004-2008 Apple Computer, Inc., Mozilla 
+ * Portions of comments Copyright 2004-2010 Apple Computer, Inc., Mozilla 
  * Foundation, and Opera Software ASA.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a 
@@ -2397,7 +2397,7 @@ nsHtml5Tokenizer::stateLoop(PRInt32 state, PRUnichar c, PRInt32 pos, PRUnichar*
               } else {
                 ch = strBuf[strBufMark];
               }
-              if ((ch >= '0' && ch <= '9') || (ch >= 'A' && ch <= 'Z') || (ch >= 'a' && ch <= 'z')) {
+              if (ch == '=' || (ch >= '0' && ch <= '9') || (ch >= 'A' && ch <= 'Z') || (ch >= 'a' && ch <= 'z')) {
 
                 appendStrBufToLongStrBuf();
                 state = returnState;
@@ -3338,10 +3338,9 @@ nsHtml5Tokenizer::emitCarriageReturn(PRUnichar* buf, PRInt32 pos)
 void 
 nsHtml5Tokenizer::emitReplacementCharacter(PRUnichar* buf, PRInt32 pos)
 {
-  silentCarriageReturn();
   flushChars(buf, pos);
   tokenHandler->characters(nsHtml5Tokenizer::REPLACEMENT_CHARACTER, 0, 1);
-  cstart = PR_INT32_MAX;
+  cstart = pos + 1;
 }
 
 void 
diff --git a/parser/html/nsHtml5Tokenizer.h b/parser/html/nsHtml5Tokenizer.h
index d1ef7885a1e..6b17914c2c6 100644
--- a/parser/html/nsHtml5Tokenizer.h
+++ b/parser/html/nsHtml5Tokenizer.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (c) 2005-2007 Henri Sivonen
  * Copyright (c) 2007-2010 Mozilla Foundation
- * Portions of comments Copyright 2004-2008 Apple Computer, Inc., Mozilla 
+ * Portions of comments Copyright 2004-2010 Apple Computer, Inc., Mozilla 
  * Foundation, and Opera Software ASA.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a 
diff --git a/parser/html/nsHtml5TreeBuilder.cpp b/parser/html/nsHtml5TreeBuilder.cpp
index 8a3e5ba6ded..b0c96051311 100644
--- a/parser/html/nsHtml5TreeBuilder.cpp
+++ b/parser/html/nsHtml5TreeBuilder.cpp
@@ -888,8 +888,10 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
           switch(group) {
             case NS_HTML5TREE_BUILDER_HTML: {
 
-              addAttributesToHtml(attributes);
-              attributes = nsnull;
+              if (!fragment) {
+                addAttributesToHtml(attributes);
+                attributes = nsnull;
+              }
               NS_HTML5_BREAK(starttagloop);
             }
             case NS_HTML5TREE_BUILDER_BASE:
@@ -903,8 +905,9 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
             }
             case NS_HTML5TREE_BUILDER_BODY: {
 
-              addAttributesToBody(attributes);
-              attributes = nsnull;
+              if (addAttributesToBody(attributes)) {
+                attributes = nsnull;
+              }
               NS_HTML5_BREAK(starttagloop);
             }
             case NS_HTML5TREE_BUILDER_P:
@@ -1287,8 +1290,10 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
           switch(group) {
             case NS_HTML5TREE_BUILDER_HTML: {
 
-              addAttributesToHtml(attributes);
-              attributes = nsnull;
+              if (!fragment) {
+                addAttributesToHtml(attributes);
+                attributes = nsnull;
+              }
               NS_HTML5_BREAK(starttagloop);
             }
             case NS_HTML5TREE_BUILDER_BASE:
@@ -1357,8 +1362,10 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
         switch(group) {
           case NS_HTML5TREE_BUILDER_HTML: {
 
-            addAttributesToHtml(attributes);
-            attributes = nsnull;
+            if (!fragment) {
+              addAttributesToHtml(attributes);
+              attributes = nsnull;
+            }
             NS_HTML5_BREAK(starttagloop);
           }
           case NS_HTML5TREE_BUILDER_LINK: {
@@ -1403,8 +1410,10 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
         switch(group) {
           case NS_HTML5TREE_BUILDER_HTML: {
 
-            addAttributesToHtml(attributes);
-            attributes = nsnull;
+            if (!fragment) {
+              addAttributesToHtml(attributes);
+              attributes = nsnull;
+            }
             NS_HTML5_BREAK(starttagloop);
           }
           case NS_HTML5TREE_BUILDER_COL: {
@@ -1452,8 +1461,10 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
         switch(group) {
           case NS_HTML5TREE_BUILDER_HTML: {
 
-            addAttributesToHtml(attributes);
-            attributes = nsnull;
+            if (!fragment) {
+              addAttributesToHtml(attributes);
+              attributes = nsnull;
+            }
             NS_HTML5_BREAK(starttagloop);
           }
           case NS_HTML5TREE_BUILDER_OPTION: {
@@ -1523,8 +1534,10 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
         switch(group) {
           case NS_HTML5TREE_BUILDER_HTML: {
 
-            addAttributesToHtml(attributes);
-            attributes = nsnull;
+            if (!fragment) {
+              addAttributesToHtml(attributes);
+              attributes = nsnull;
+            }
             NS_HTML5_BREAK(starttagloop);
           }
           default: {
@@ -1555,8 +1568,10 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
         switch(group) {
           case NS_HTML5TREE_BUILDER_HTML: {
 
-            addAttributesToHtml(attributes);
-            attributes = nsnull;
+            if (!fragment) {
+              addAttributesToHtml(attributes);
+              attributes = nsnull;
+            }
             NS_HTML5_BREAK(starttagloop);
           }
           case NS_HTML5TREE_BUILDER_NOFRAMES: {
@@ -1601,8 +1616,10 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
         switch(group) {
           case NS_HTML5TREE_BUILDER_HTML: {
 
-            addAttributesToHtml(attributes);
-            attributes = nsnull;
+            if (!fragment) {
+              addAttributesToHtml(attributes);
+              attributes = nsnull;
+            }
             NS_HTML5_BREAK(starttagloop);
           }
           case NS_HTML5TREE_BUILDER_HEAD: {
@@ -1622,8 +1639,10 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
         switch(group) {
           case NS_HTML5TREE_BUILDER_HTML: {
 
-            addAttributesToHtml(attributes);
-            attributes = nsnull;
+            if (!fragment) {
+              addAttributesToHtml(attributes);
+              attributes = nsnull;
+            }
             NS_HTML5_BREAK(starttagloop);
           }
           case NS_HTML5TREE_BUILDER_BODY: {
@@ -1717,8 +1736,10 @@ nsHtml5TreeBuilder::startTag(nsHtml5ElementName* elementName, nsHtml5HtmlAttribu
         switch(group) {
           case NS_HTML5TREE_BUILDER_HTML: {
 
-            addAttributesToHtml(attributes);
-            attributes = nsnull;
+            if (!fragment) {
+              addAttributesToHtml(attributes);
+              attributes = nsnull;
+            }
             NS_HTML5_BREAK(starttagloop);
           }
           default: {
@@ -3305,15 +3326,17 @@ nsHtml5TreeBuilder::findLastOrRoot(PRInt32 group)
   return 0;
 }
 
-void 
+PRBool 
 nsHtml5TreeBuilder::addAttributesToBody(nsHtml5HtmlAttributes* attributes)
 {
   if (currentPtr >= 1) {
     nsHtml5StackNode* body = stack[1];
     if (body->group == NS_HTML5TREE_BUILDER_BODY) {
       addAttributesToElement(body->node, attributes);
+      return PR_TRUE;
     }
   }
+  return PR_FALSE;
 }
 
 void 
diff --git a/parser/html/nsHtml5TreeBuilder.h b/parser/html/nsHtml5TreeBuilder.h
index 69d5d262d2a..38eef183810 100644
--- a/parser/html/nsHtml5TreeBuilder.h
+++ b/parser/html/nsHtml5TreeBuilder.h
@@ -154,7 +154,7 @@ class nsHtml5TreeBuilder : public nsAHtml5TreeBuilderState
     PRInt32 findInListOfActiveFormattingElementsContainsBetweenEndAndLastMarker(nsIAtom* name);
     PRInt32 findLastOrRoot(nsIAtom* name);
     PRInt32 findLastOrRoot(PRInt32 group);
-    void addAttributesToBody(nsHtml5HtmlAttributes* attributes);
+    PRBool addAttributesToBody(nsHtml5HtmlAttributes* attributes);
     void addAttributesToHtml(nsHtml5HtmlAttributes* attributes);
     void pushHeadPointerOntoStack();
     void reconstructTheActiveFormattingElements();
diff --git a/parser/htmlparser/tests/crashtests/563514-1.html b/parser/htmlparser/tests/crashtests/563514-1.html
new file mode 100644
index 00000000000..b96ce14661d
--- /dev/null
+++ b/parser/htmlparser/tests/crashtests/563514-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<head>
+<script>
+function boom()
+{
+  document.createElement("span").innerHTML = "<body a='b'>";
+}
+</script>
+</head>
+<body onload="boom();"></body>
\ No newline at end of file
diff --git a/parser/htmlparser/tests/crashtests/crashtests.list b/parser/htmlparser/tests/crashtests/crashtests.list
index 7227232ad93..b0bde587e9c 100644
--- a/parser/htmlparser/tests/crashtests/crashtests.list
+++ b/parser/htmlparser/tests/crashtests/crashtests.list
@@ -41,3 +41,4 @@ load 515816-1.html
 load 525229-1.html
 load 522326-1.html
 load 536097-1.html
+load 563514-1.html
diff --git a/parser/htmlparser/tests/reftest/bug566280-1-ref.html b/parser/htmlparser/tests/reftest/bug566280-1-ref.html
new file mode 100644
index 00000000000..374fca014ab
--- /dev/null
+++ b/parser/htmlparser/tests/reftest/bug566280-1-ref.html
@@ -0,0 +1,2 @@
+<body>&#xFFFD;hello world
+
diff --git a/parser/htmlparser/tests/reftest/bug566280-1.html b/parser/htmlparser/tests/reftest/bug566280-1.html
new file mode 100644
index 00000000000..3aa60caf343
Binary files /dev/null and b/parser/htmlparser/tests/reftest/bug566280-1.html differ
diff --git a/parser/htmlparser/tests/reftest/reftest.list b/parser/htmlparser/tests/reftest/reftest.list
new file mode 100644
index 00000000000..ffced6239bb
--- /dev/null
+++ b/parser/htmlparser/tests/reftest/reftest.list
@@ -0,0 +1,2 @@
+== bug566280-1.html bug566280-1-ref.html
+
diff --git a/toolkit/components/passwordmgr/content/passwordManager.xul b/toolkit/components/passwordmgr/content/passwordManager.xul
index 0efd79122c0..f9e8177d44f 100644
--- a/toolkit/components/passwordmgr/content/passwordManager.xul
+++ b/toolkit/components/passwordmgr/content/passwordManager.xul
@@ -65,13 +65,13 @@
   </keyset>
 
   <popupset id="signonsTreeContextSet">
-    <popup id="signonsTreeContextMenu"
+    <menupopup id="signonsTreeContextMenu"
            onpopupshowing="UpdateCopyPassword()">
       <menuitem id="context-copypassword"
                 label="&copyPasswordCmd.label;"
                 accesskey="&copyPasswordCmd.accesskey;"
                 oncommand="CopyPassword()"/>
-    </popup>
+    </menupopup>
   </popupset>
 
   <!-- saved signons -->
diff --git a/toolkit/components/passwordmgr/test/browser/browser_passwordmgrcopypwd.js b/toolkit/components/passwordmgr/test/browser/browser_passwordmgrcopypwd.js
index 8bd1f6cff46..1fec129a7c2 100644
--- a/toolkit/components/passwordmgr/test/browser/browser_passwordmgrcopypwd.js
+++ b/toolkit/components/passwordmgr/test/browser/browser_passwordmgrcopypwd.js
@@ -71,14 +71,28 @@ function test() {
 
     // Test if "Copy Password" works
     function doTest() {
-        let clip = Cc["@mozilla.org/widget/clipboard;1"].getService(Ci.nsIClipboard);
-        let data = "";
-        let polls = 0;
+        let doc = pwmgrdlg.document;
+        let selection = doc.getElementById("signonsTree").view.selection;
+        let menuitem = doc.getElementById("context-copypassword");
 
         function copyPassword() {
-            let doc = pwmgrdlg.document;
-            doc.getElementById("signonsTree").currentIndex = 2;
-            doc.getElementById("context-copypassword").doCommand();
+            selection.selectAll();
+            is(isMenuitemEnabled(), false, "Copy Password should be disabled");
+
+            selection.select(0);
+            is(isMenuitemEnabled(), true, "Copy Password should be enabled");
+
+            selection.clearSelection();
+            is(isMenuitemEnabled(), false, "Copy Password should be disabled");
+
+            selection.select(2);
+            is(isMenuitemEnabled(), true, "Copy Password should be enabled");
+            menuitem.doCommand();
+        }
+
+        function isMenuitemEnabled() {
+            doc.defaultView.UpdateCopyPassword();
+            return !menuitem.getAttribute("disabled");
         }
 
         function cleanUp() {
diff --git a/toolkit/mozapps/installer/windows/nsis/makensis.mk b/toolkit/mozapps/installer/windows/nsis/makensis.mk
index 643696f6a41..07acedba7fa 100644
--- a/toolkit/mozapps/installer/windows/nsis/makensis.mk
+++ b/toolkit/mozapps/installer/windows/nsis/makensis.mk
@@ -53,12 +53,13 @@ TOOLKIT_NSIS_FILES_CONV = \
 	version.nsh \
 	$(NULL)
 
-TOOLKIT_NSIS_FILES = \
+CUSTOM_NSIS_PLUGINS = \
+	AccessControl.dll \
 	AppAssocReg.dll \
+	ApplicationID.dll \
 	nsProcess.dll \
 	ShellLink.dll \
 	UAC.dll \
-	ApplicationID.dll \
 	$(NULL)
 
 $(CONFIG_DIR)/setup.exe::
@@ -66,12 +67,12 @@ $(CONFIG_DIR)/setup.exe::
 	  iconv -f UTF-8 -t UTF-16LE $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/$$i | \
 	    cat $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/utf16-le-bom.bin - > $(CONFIG_DIR)/$$i; \
 	done
-	$(INSTALL) $(addprefix $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/,$(TOOLKIT_NSIS_FILES)) $(CONFIG_DIR)
+	$(INSTALL) $(addprefix $(MOZILLA_DIR)/other-licenses/nsis/Plugins/,$(CUSTOM_NSIS_PLUGINS)) $(CONFIG_DIR)
 	$(INSTALL) $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/setup.ico $(CONFIG_DIR)
-	cd $(CONFIG_DIR) && makensisu.exe installer.nsi
+	cd $(CONFIG_DIR) && $(MAKENSISU) installer.nsi
 # Support for building the uninstaller when repackaging locales
 ifeq ($(CONFIG_DIR),l10ngen)
-	cd $(CONFIG_DIR) && makensisu.exe uninstaller.nsi
+	cd $(CONFIG_DIR) && $(MAKENSISU) uninstaller.nsi
 endif
 
 $(CONFIG_DIR)/7zSD.sfx:
@@ -92,8 +93,8 @@ uninstaller::
 	  iconv -f UTF-8 -t UTF-16LE $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/$$i | \
 	    cat $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/utf16-le-bom.bin - > $(CONFIG_DIR)/$$i; \
 	done
-	$(INSTALL) $(addprefix $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/,$(TOOLKIT_NSIS_FILES)) $(CONFIG_DIR)
+	$(INSTALL) $(addprefix $(MOZILLA_DIR)/other-licenses/nsis/Plugins/,$(CUSTOM_NSIS_PLUGINS)) $(CONFIG_DIR)
 	$(INSTALL) $(MOZILLA_DIR)/toolkit/mozapps/installer/windows/nsis/setup.ico $(CONFIG_DIR)
-	cd $(CONFIG_DIR) && makensisu.exe uninstaller.nsi
+	cd $(CONFIG_DIR) && $(MAKENSISU) uninstaller.nsi
 	$(NSINSTALL) -D $(DIST)/bin/uninstall
 	cp $(CONFIG_DIR)/helper.exe $(DIST)/bin/uninstall
diff --git a/widget/src/windows/nsWindow.cpp b/widget/src/windows/nsWindow.cpp
index b30ee272952..ee4547ce894 100644
--- a/widget/src/windows/nsWindow.cpp
+++ b/widget/src/windows/nsWindow.cpp
@@ -2991,7 +2991,13 @@ gfxASurface *nsWindow::GetThebesSurface()
 #ifdef CAIRO_HAS_D2D_SURFACE
   if (gfxWindowsPlatform::GetPlatform()->GetRenderMode() ==
       gfxWindowsPlatform::RENDER_DIRECT2D) {
-    return (new gfxD2DSurface(mWnd));
+    gfxASurface::gfxContentType content = gfxASurface::CONTENT_COLOR;
+#if defined(MOZ_XUL)
+    if (mTransparencyMode != eTransparencyOpaque) {
+      content = gfxASurface::CONTENT_COLOR_ALPHA;
+    }
+#endif
+    return (new gfxD2DSurface(mWnd, content));
   } else {
 #endif
     return (new gfxWindowsSurface(mWnd));
diff --git a/widget/src/windows/nsWindowGfx.cpp b/widget/src/windows/nsWindowGfx.cpp
index 35467c5a641..9f605bfb303 100644
--- a/widget/src/windows/nsWindowGfx.cpp
+++ b/widget/src/windows/nsWindowGfx.cpp
@@ -435,7 +435,13 @@ PRBool nsWindow::OnPaint(HDC aDC)
               IsRenderMode(gfxWindowsPlatform::RENDER_DIRECT2D))
           {
             if (!mD2DWindowSurface) {
-              mD2DWindowSurface = new gfxD2DSurface(mWnd);
+              gfxASurface::gfxContentType content = gfxASurface::CONTENT_COLOR;
+#if defined(MOZ_XUL)
+              if (mTransparencyMode != eTransparencyOpaque) {
+                content = gfxASurface::CONTENT_COLOR_ALPHA;
+              }
+#endif
+              mD2DWindowSurface = new gfxD2DSurface(mWnd, content);
             }
             targetSurface = mD2DWindowSurface;
           }
@@ -506,6 +512,9 @@ DDRAW_FAILED:
               thebesContext->Rectangle(gfxRect(r->x, r->y, r->width, r->height), PR_TRUE);
             }
             thebesContext->Clip();
+            thebesContext->SetOperator(gfxContext::OPERATOR_CLEAR);
+            thebesContext->Paint();
+            thebesContext->SetOperator(gfxContext::OPERATOR_OVER);
           }
 #ifdef WINCE
           thebesContext->SetFlag(gfxContext::FLAG_SIMPLIFY_OPERATORS);
diff --git a/widget/src/xpwidgets/nsTransferable.cpp b/widget/src/xpwidgets/nsTransferable.cpp
index b2f07b0990f..15ff17d7a5d 100644
--- a/widget/src/xpwidgets/nsTransferable.cpp
+++ b/widget/src/xpwidgets/nsTransferable.cpp
@@ -310,6 +310,7 @@ nsTransferable::GetTransferData(const char *aFlavor, nsISupports **aData, PRUint
   NS_ENSURE_ARG_POINTER(aFlavor && aData && aDataLen);
 
   nsresult rv = NS_OK;
+  nsCOMPtr<nsISupports> savedData;
   
   // first look and see if the data is present in one of the intrinsic flavors
   PRUint32 i;
@@ -334,6 +335,7 @@ nsTransferable::GetTransferData(const char *aFlavor, nsISupports **aData, PRUint
         dataBytes.forget(aData);
         return NS_OK;
       }
+      savedData = dataBytes;  // return this if format converter fails
       break;
     }
   }
@@ -366,6 +368,13 @@ nsTransferable::GetTransferData(const char *aFlavor, nsISupports **aData, PRUint
       }
     }
   }
+
+  // for backward compatibility
+  if (!found) {
+    savedData.forget(aData);
+    *aDataLen = 0;
+  }
+
   return found ? NS_OK : NS_ERROR_FAILURE;
 }
 
diff --git a/widget/tests/Makefile.in b/widget/tests/Makefile.in
index 93c555288b7..3f774c8a7d2 100644
--- a/widget/tests/Makefile.in
+++ b/widget/tests/Makefile.in
@@ -97,6 +97,9 @@ _CHROME_FILES  += taskbar_previews.xul \
 		window_state_windows.xul \
 		taskbar_progress.xul \
 		$(NULL)
+
+_TEST_FILES +=	test_bug565392.html \
+		$(NULL)
 endif
 endif
 
diff --git a/widget/tests/test_bug565392.html b/widget/tests/test_bug565392.html
new file mode 100644
index 00000000000..8a303220cd6
--- /dev/null
+++ b/widget/tests/test_bug565392.html
@@ -0,0 +1,63 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=565392
+-->
+<head>
+  <title>Test for Bug 565392</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=565392">Mozilla Bug 565392</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 565392 **/
+
+  netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
+  const Cc = Components.classes;
+  const Ci = Components.interfaces;
+  var ds = Cc["@mozilla.org/file/directory_service;1"]
+             .getService(Ci.nsIProperties);
+  var dir1 = ds.get("ProfD", Ci.nsIFile);
+  var clipboard = Cc["@mozilla.org/widget/clipboard;1"]
+                    .getService(Ci.nsIClipboard);
+  
+  function getTransferableFile(file) {
+    var transferable = Cc['@mozilla.org/widget/transferable;1']
+                         .createInstance(Ci.nsITransferable);
+    transferable.setTransferData("application/x-moz-file", file, 0);
+    return transferable;
+  }
+
+  function setClipboardData(transferable) {
+    clipboard.setData(transferable, null, 1);
+  }
+  
+  function getClipboardData(mime) {
+    var transferable = Cc['@mozilla.org/widget/transferable;1']
+                         .createInstance(Ci.nsITransferable);
+    transferable.addDataFlavor(mime);
+    clipboard.getData(transferable, 1);
+    var data = {};
+    transferable.getTransferData(mime, data, {}) ;
+    return data;
+  }
+
+setClipboardData(getTransferableFile(dir1))
+is(clipboard.hasDataMatchingFlavors(["application/x-moz-file"], 1,1), true);
+var data = getClipboardData("application/x-moz-file");
+var file = data.value.QueryInterface(Ci.nsIFile);
+ok(file.isDirectory(), true);
+is(file.target, dir1.target, true);
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/xpcom/glue/nsCOMArray.cpp b/xpcom/glue/nsCOMArray.cpp
index 53fbec3f562..cbc1998513a 100644
--- a/xpcom/glue/nsCOMArray.cpp
+++ b/xpcom/glue/nsCOMArray.cpp
@@ -55,11 +55,7 @@ nsCOMArray_base::nsCOMArray_base(const nsCOMArray_base& aOther)
 
 nsCOMArray_base::~nsCOMArray_base()
 {
-    PRInt32 count = Count(), i;
-    for (i = 0; i < count; ++i) {
-        nsISupports* obj = ObjectAt(i);
-        NS_IF_RELEASE(obj);
-    }                        
+  Clear();
 }
 
 PRInt32
@@ -135,9 +131,10 @@ nsCOMArray_base::RemoveObjectAt(PRInt32 aIndex)
 {
     if (PRUint32(aIndex) < PRUint32(Count())) {
         nsISupports* element = ObjectAt(aIndex);
-        NS_IF_RELEASE(element);
 
-        return mArray.RemoveElementAt(aIndex);
+        PRBool result = mArray.RemoveElementAt(aIndex);
+        NS_IF_RELEASE(element);
+        return result;
     }
 
     return PR_FALSE;
@@ -155,8 +152,10 @@ ReleaseObjects(void* aElement, void*)
 void
 nsCOMArray_base::Clear()
 {
-    mArray.EnumerateForwards(ReleaseObjects, nsnull);
+    nsAutoVoidArray objects;
+    objects = mArray;
     mArray.Clear();
+    objects.EnumerateForwards(ReleaseObjects, nsnull);
 }
 
 PRBool
@@ -167,10 +166,15 @@ nsCOMArray_base::SetCount(PRInt32 aNewCount)
       return PR_FALSE;
 
     PRInt32 count = Count(), i;
-    for (i = aNewCount; i < count; ++i) {
-        nsISupports* obj = ObjectAt(i);
-        NS_IF_RELEASE(obj);
+    nsAutoVoidArray objects;
+    if (count > aNewCount) {
+        objects.SetCount(count - aNewCount);
+        for (i = aNewCount; i < count; ++i) {
+            objects.ReplaceElementAt(ObjectAt(i), i - aNewCount);
+        }
     }
-    return mArray.SetCount(aNewCount);
+    PRBool result = mArray.SetCount(aNewCount);
+    objects.EnumerateForwards(ReleaseObjects, nsnull);
+    return result;
 }
 
diff --git a/xpcom/glue/nsVoidArray.h b/xpcom/glue/nsVoidArray.h
index db90853a5b3..c54b3641f93 100644
--- a/xpcom/glue/nsVoidArray.h
+++ b/xpcom/glue/nsVoidArray.h
@@ -195,6 +195,12 @@ public:
     SetArray(reinterpret_cast<Impl*>(mAutoBuf), kAutoBufSize, 0, PR_FALSE,
              PR_TRUE);
   }
+
+  nsAutoVoidArray& operator=(const nsVoidArray& other)
+  {
+    nsVoidArray::operator=(other);
+    return *this;
+  }
   
 protected:
   // The internal storage
diff --git a/xpcom/tests/TestCOMArray.cpp b/xpcom/tests/TestCOMArray.cpp
index 77ea8a93f98..8df7c2411eb 100644
--- a/xpcom/tests/TestCOMArray.cpp
+++ b/xpcom/tests/TestCOMArray.cpp
@@ -91,6 +91,72 @@ NS_IMPL_ISUPPORTS1(Foo, IFoo)
 typedef nsCOMArray<IFoo> Array;
 
 
+// {0e70a320-be02-11d1-8031-006008159b5a}
+#define NS_IBAR_IID \
+  {0x0e70a320, 0xbe02, 0x11d1,    \
+    {0x80, 0x31, 0x00, 0x60, 0x08, 0x15, 0x9b, 0x5a}}
+
+class IBar : public nsISupports {
+public:
+
+  NS_DECLARE_STATIC_IID_ACCESSOR(NS_IBAR_IID)
+};
+
+NS_DEFINE_STATIC_IID_ACCESSOR(IBar, NS_IBAR_IID)
+
+class Bar : public IBar {
+public:
+
+  Bar(nsCOMArray<IBar>& aArray, PRInt32 aIndex);
+  ~Bar();
+
+  // nsISupports implementation
+  NS_DECL_ISUPPORTS
+
+  static PRInt32 sReleaseCalled;
+
+private:
+  nsCOMArray<IBar>& mArray;
+  PRInt32 mIndex;
+};
+
+PRInt32 Bar::sReleaseCalled = 0;
+
+typedef nsCOMArray<IBar> Array2;
+
+Bar::Bar(Array2& aArray, PRInt32 aIndex)
+  : mArray(aArray)
+  , mIndex(aIndex)
+{
+}
+
+Bar::~Bar()
+{
+  if (mArray.RemoveObjectAt(mIndex)) {
+    fail("We should never manage to remove the object here");
+  }
+}
+
+NS_IMPL_ADDREF(Bar)
+NS_IMPL_QUERY_INTERFACE1(Bar, IBar)
+
+NS_IMETHODIMP_(nsrefcnt)
+Bar::Release(void)
+{
+  ++Bar::sReleaseCalled;
+  NS_PRECONDITION(0 != mRefCnt, "dup release");
+  NS_ASSERT_OWNINGTHREAD(_class);
+  --mRefCnt;
+  NS_LOG_RELEASE(this, mRefCnt, "Bar");
+  if (mRefCnt == 0) {
+    mRefCnt = 1; /* stabilize */
+    NS_DELETEXPCOM(this);
+    return 0;
+  }
+  return mRefCnt;
+}
+
+
 int main(int argc, char **argv)
 {
   ScopedXPCOM xpcom("nsCOMArrayTests");
@@ -142,5 +208,59 @@ int main(int argc, char **argv)
     }
   }
 
+  PRInt32 base;
+  {
+    Array2 arr2;
+
+    IBar *ninthObject;
+    for (PRInt32 i = 0; i < 20; ++i) {
+      nsCOMPtr<IBar> bar = new Bar(arr2, i);
+      if (i == 8) {
+        ninthObject = bar;
+      }
+      arr2.AppendObject(bar);
+    }
+
+    base = Bar::sReleaseCalled;
+
+    arr2.SetCount(10);
+    if (Bar::sReleaseCalled != base + 10) {
+      fail("Release called multiple times for SetCount");
+    }
+
+    arr2.RemoveObjectAt(9);
+    if (Bar::sReleaseCalled != base + 11) {
+      fail("Release called multiple times for RemoveObjectAt");
+    }
+
+    arr2.RemoveObject(ninthObject);
+    if (Bar::sReleaseCalled != base + 12) {
+      fail("Release called multiple times for RemoveObject");
+    }
+
+    arr2.Clear();
+    if (Bar::sReleaseCalled != base + 20) {
+      fail("Release called multiple times for Clear");
+    }
+  }
+
+  Bar::sReleaseCalled = 0;
+
+  {
+    Array2 arr2;
+
+    for (PRInt32 i = 0; i < 20; ++i) {
+      nsCOMPtr<IBar> bar  = new Bar(arr2, i);
+      arr2.AppendObject(bar);
+    }
+
+    base = Bar::sReleaseCalled;
+
+    // Let arr2 be destroyed
+  }
+  if (Bar::sReleaseCalled != base + 20) {
+    fail("Release called multiple times for nsCOMArray::~nsCOMArray");
+  }
+
   return rv;
 }