diff --git a/content/base/src/nsGenericElement.cpp b/content/base/src/nsGenericElement.cpp
index 95cb1ba28d7..61066a7ad13 100644
--- a/content/base/src/nsGenericElement.cpp
+++ b/content/base/src/nsGenericElement.cpp
@@ -26,12 +26,12 @@
 #include "nsIAtom.h"
 #include "nsINodeInfo.h"
 #include "nsIDocument.h"
-#include "nsIDOMEventReceiver.h"
 #include "nsIDOMNodeList.h"
 #include "nsIDOMDocument.h"
 #include "nsIDOMDocumentFragment.h"
 #include "nsIDOMRange.h"
 #include "nsIDOMText.h"
+#include "nsIDOMEventReceiver.h"
 #include "nsRange.h"
 #include "nsIEventListenerManager.h"
 #include "nsILinkHandler.h"
@@ -71,7 +71,7 @@
 #include "nsLayoutAtoms.h"
 #include "nsHTMLAtoms.h"
 #include "nsLayoutUtils.h"
-
+#include "nsIJSContextStack.h"
 
 #include "nsIServiceManager.h"
 #include "nsIPref.h" // Used by the temp pref, should be removed!
@@ -81,8 +81,8 @@ static PRBool kStrictDOMLevel2 = PR_FALSE;
 NS_DEFINE_IID(kIDOMNodeIID, NS_IDOMNODE_IID);
 NS_DEFINE_IID(kIDOMElementIID, NS_IDOMELEMENT_IID);
 NS_DEFINE_IID(kIDOMTextIID, NS_IDOMTEXT_IID);
-NS_DEFINE_IID(kIDOMEventReceiverIID, NS_IDOMEVENTRECEIVER_IID);
 NS_DEFINE_IID(kIDOMEventTargetIID, NS_IDOMEVENTTARGET_IID);
+NS_DEFINE_IID(kIDOMEventReceiverIID, NS_IDOMEVENTRECEIVER_IID);
 NS_DEFINE_IID(kIScriptObjectOwnerIID, NS_ISCRIPTOBJECTOWNER_IID);
 NS_DEFINE_IID(kIJSScriptObjectIID, NS_IJSSCRIPTOBJECT_IID);
 NS_DEFINE_IID(kISupportsIID, NS_ISUPPORTS_IID);
@@ -2358,44 +2358,56 @@ nsGenericElement::AddScriptEventListener(nsIAtom* aAttribute,
                                          REFNSIID aIID)
 {
   nsresult ret = NS_OK;
-  nsIScriptContext* context;
+  nsCOMPtr<nsIScriptContext> context = nsnull;
+  nsCOMPtr<nsIScriptGlobalObject> global = nsnull;
+  JSContext* cx = nsnull;
 
-  if (nsnull != mDocument) {
-    nsCOMPtr<nsIScriptGlobalObject> global;
-    mDocument->GetScriptGlobalObject(getter_AddRefs(global));
-    if (global) {
-      if (NS_OK == global->GetContext(&context)) {
-        if (mNodeInfo->Equals(nsHTMLAtoms::body) ||
-            mNodeInfo->Equals(nsHTMLAtoms::frameset)) {
-          nsIDOMEventReceiver *receiver;
+  //Try to get context from doc
+  if (mDocument) {
+    if (NS_SUCCEEDED(mDocument->GetScriptGlobalObject(getter_AddRefs(global))) && global) {
+      NS_ENSURE_SUCCESS(global->GetContext(getter_AddRefs(context)), NS_ERROR_FAILURE);
+    }
+  }
 
-          if (nsnull != global && NS_OK == global->QueryInterface(kIDOMEventReceiverIID, (void**)&receiver)) {
-            nsIEventListenerManager *manager;
-            if (NS_OK == receiver->GetListenerManager(&manager)) {
-              nsIScriptObjectOwner *mObjectOwner;
-              if (NS_OK == global->QueryInterface(kIScriptObjectOwnerIID, (void**)&mObjectOwner)) {
-                ret = manager->AddScriptEventListener(context, mObjectOwner, aAttribute, aValue, aIID, PR_FALSE);
-                NS_RELEASE(mObjectOwner);
-              }
-              NS_RELEASE(manager);
-            }
-            NS_RELEASE(receiver);
-          }
-        }
-        else {
-          nsIEventListenerManager *manager;
-          if (NS_OK == GetListenerManager(&manager)) {
-            nsIScriptObjectOwner* cowner;
-            if (NS_OK == mContent->QueryInterface(kIScriptObjectOwnerIID,
-                                                  (void**) &cowner)) {
-              ret = manager->AddScriptEventListener(context, cowner,
-                                                    aAttribute, aValue, aIID, PR_TRUE);
-              NS_RELEASE(cowner);
-            }
-            NS_RELEASE(manager);
-          }
-        }
-        NS_RELEASE(context);
+  if (!context) {
+    // Get JSContext from stack.
+    nsCOMPtr<nsIThreadJSContextStack> stack(do_GetService("nsThreadJSContextStack"));
+    NS_ENSURE_TRUE(stack, NS_ERROR_FAILURE);
+    NS_ENSURE_SUCCESS(stack->Peek(&cx), NS_ERROR_FAILURE);
+
+    if(!cx) {
+      stack->GetSafeJSContext(&cx);
+      NS_ENSURE_TRUE(cx, NS_ERROR_FAILURE);
+    }
+    
+    nsLayoutUtils::GetDynamicScriptContext(cx, getter_AddRefs(context));
+    NS_ENSURE_TRUE(context, NS_ERROR_FAILURE);
+  }
+    
+  //Attributes on the body and frameset tags get set on the global object
+  if (mNodeInfo->Equals(nsHTMLAtoms::body) ||
+      mNodeInfo->Equals(nsHTMLAtoms::frameset)) {
+    if (!global) {
+      if (cx) {
+        nsLayoutUtils::GetDynamicScriptGlobal(cx, getter_AddRefs(global));
+      }
+      NS_ENSURE_TRUE(global, NS_ERROR_FAILURE);
+    }
+    nsCOMPtr<nsIDOMEventReceiver> receiver(do_QueryInterface(global));
+    nsCOMPtr<nsIEventListenerManager> manager;
+    if (receiver && NS_SUCCEEDED(receiver->GetListenerManager(getter_AddRefs(manager)))) {
+      nsCOMPtr<nsIScriptObjectOwner> objOwner(do_QueryInterface(global));
+      if (objOwner) {
+        ret = manager->AddScriptEventListener(context, objOwner, aAttribute, aValue, aIID, PR_FALSE);
+      }
+    }
+  }
+  else {
+    nsCOMPtr<nsIEventListenerManager> manager;
+    if (NS_SUCCEEDED(GetListenerManager(getter_AddRefs(manager)))) {
+      nsCOMPtr<nsIScriptObjectOwner> objOwner(do_QueryInterface(mContent));
+      if (objOwner) {
+        ret = manager->AddScriptEventListener(context, objOwner, aAttribute, aValue, aIID, PR_TRUE);
       }
     }
   }
diff --git a/content/base/src/nsRange.cpp b/content/base/src/nsRange.cpp
index 1c75b2dc6ff..7c7ec19457b 100644
--- a/content/base/src/nsRange.cpp
+++ b/content/base/src/nsRange.cpp
@@ -425,7 +425,7 @@ nsRange::IntersectsNode(nsIDOMNode* aNode, PRBool* aReturn)
 
 // HOW does the node intersect the range?
 NS_IMETHODIMP
-nsRange::CompareNode(nsIDOMNode* aNode, PRInt16* aReturn)
+nsRange::CompareNode(nsIDOMNode* aNode, PRUint16* aReturn)
 {
   if (!aReturn)
     return NS_ERROR_NULL_POINTER;
diff --git a/content/base/src/nsRange.h b/content/base/src/nsRange.h
index e118bf16044..709bd1187b2 100644
--- a/content/base/src/nsRange.h
+++ b/content/base/src/nsRange.h
@@ -100,7 +100,7 @@ public:
   NS_IMETHOD    ComparePoint(nsIDOMNode* aParent, PRInt32 aOffset,
                              PRInt16* aResult);
   NS_IMETHOD    IntersectsNode(nsIDOMNode* aNode, PRBool* aReturn);
-  NS_IMETHOD    CompareNode(nsIDOMNode* aNode, PRInt16* aReturn);
+  NS_IMETHOD    CompareNode(nsIDOMNode* aNode, PRUint16* aReturn);
 /*END nsIDOMNSRange interface implementations*/
   
   NS_IMETHOD    GetHasGeneratedBefore(PRBool *aBool);
diff --git a/content/events/public/nsIPrivateDOMEvent.h b/content/events/public/nsIPrivateDOMEvent.h
index a0fb3a03144..de3bf0e8838 100644
--- a/content/events/public/nsIPrivateDOMEvent.h
+++ b/content/events/public/nsIPrivateDOMEvent.h
@@ -49,6 +49,7 @@ public:
   NS_IMETHOD SetCurrentTarget(nsIDOMEventTarget* aTarget) = 0;
   NS_IMETHOD IsDispatchStopped(PRBool* aIsDispatchPrevented) = 0;
   NS_IMETHOD GetInternalNSEvent(nsEvent** aNSEvent) = 0;
+  NS_IMETHOD GetRealTarget(nsIDOMEventTarget** aRealTarget) = 0;
 };
 
 extern nsresult NS_NewDOMEvent(nsIDOMEvent** aInstancePtrResult, nsIPresContext* aPresContext, nsEvent *aEvent);
diff --git a/content/events/src/nsDOMEvent.cpp b/content/events/src/nsDOMEvent.cpp
index 8776982f0cb..c8a2881f1a5 100644
--- a/content/events/src/nsDOMEvent.cpp
+++ b/content/events/src/nsDOMEvent.cpp
@@ -85,7 +85,7 @@ nsDOMEvent::nsDOMEvent(nsIPresContext* aPresContext, nsEvent* aEvent, const nsSt
   mText = nsnull;
   mTextRange = nsnull;
 
-  if (aEvent->eventStructType == NS_TEXT_EVENT) {
+  if (aEvent && aEvent->eventStructType == NS_TEXT_EVENT) {
 	  //
 	  // extract the IME composition string
 	  //
@@ -164,6 +164,8 @@ NS_METHOD nsDOMEvent::GetTarget(nsIDOMEventTarget** aTarget)
     return NS_OK;
   }
   
+	*aTarget = nsnull;
+
   nsIEventStateManager *manager;
   nsIContent *targetContent;  
 
@@ -181,19 +183,15 @@ NS_METHOD nsDOMEvent::GetTarget(nsIDOMEventTarget** aTarget)
   }
   else {
     //Always want a target.  Use document if nothing else.
-    nsIPresShell* presShell;
-    nsIDocument* doc;
-    if (NS_SUCCEEDED(mPresContext->GetShell(&presShell))) {
-      presShell->GetDocument(&doc);
-      NS_RELEASE(presShell);
-    }
-
-    if (doc) {
-      if (NS_OK == doc->QueryInterface(NS_GET_IID(nsIDOMEventTarget), (void**)&mTarget)) {
-        *aTarget = mTarget;
-        NS_ADDREF(mTarget);
-      }      
-      NS_RELEASE(doc);
+    nsCOMPtr<nsIDocument> doc;
+		nsCOMPtr<nsIPresShell> presShell;
+		if (NS_SUCCEEDED(mPresContext->GetShell(getter_AddRefs(presShell))) && presShell) {
+      if (NS_SUCCEEDED(presShell->GetDocument(getter_AddRefs(doc))) && doc) {
+				if (NS_SUCCEEDED(doc->QueryInterface(NS_GET_IID(nsIDOMEventTarget), (void**)&mTarget))) {
+					*aTarget = mTarget;
+					NS_ADDREF(mTarget);
+				}      
+			}
     }
   }
 
@@ -456,18 +454,13 @@ NS_METHOD nsDOMEvent::GetClientX(PRInt32* aClientX)
   }
 
   //My god, man, there *must* be a better way to do this.
-  nsIPresShell* shell;
+  nsCOMPtr<nsIPresShell> presShell;
   nsIWidget* rootWidget = nsnull;
-  mPresContext->GetShell(&shell);
-
-  if (shell) {
-    nsIViewManager* vm;
-    shell->GetViewManager(&vm);
-    if (vm) {
+  if (NS_SUCCEEDED(mPresContext->GetShell(getter_AddRefs(presShell))) && presShell) {
+    nsCOMPtr<nsIViewManager> vm;
+		if (NS_SUCCEEDED(presShell->GetViewManager(getter_AddRefs(vm))) && vm) {
       vm->GetWidget(&rootWidget);
-      NS_RELEASE(vm);
     }
-    NS_RELEASE(shell);
   }
 
 
@@ -501,18 +494,13 @@ NS_METHOD nsDOMEvent::GetClientY(PRInt32* aClientY)
   }
 
   //My god, man, there *must* be a better way to do this.
-  nsIPresShell* shell;
+  nsCOMPtr<nsIPresShell> presShell;
   nsIWidget* rootWidget = nsnull;
-  mPresContext->GetShell(&shell);
-
-  if (shell) {
-    nsIViewManager* vm;
-    shell->GetViewManager(&vm);
-    if (vm) {
+  if (NS_SUCCEEDED(mPresContext->GetShell(getter_AddRefs(presShell))) && presShell) {
+    nsCOMPtr<nsIViewManager> vm;
+		if (NS_SUCCEEDED(presShell->GetViewManager(getter_AddRefs(vm))) && vm) {
       vm->GetWidget(&rootWidget);
-      NS_RELEASE(vm);
     }
-    NS_RELEASE(shell);
   }
 
 
@@ -696,8 +684,7 @@ nsresult nsDOMEvent::GetScrollInfo(nsIScrollableView** aScrollableView,
   mPresContext->GetTwipsToPixels(aT2P);
 
   nsCOMPtr<nsIPresShell> presShell;
-  mPresContext->GetShell(getter_AddRefs(presShell));
-  if(presShell) {
+  if (NS_SUCCEEDED(mPresContext->GetShell(getter_AddRefs(presShell))) && presShell) {
      nsCOMPtr<nsIViewManager> vm;
      presShell->GetViewManager(getter_AddRefs(vm));
      if(vm) {
@@ -761,7 +748,15 @@ NS_METHOD nsDOMEvent::GetWhich(PRUint32* aWhich)
 {
   switch (mEvent->eventStructType) {
   case NS_KEY_EVENT:
-    return GetKeyCode(aWhich);
+	  switch (mEvent->message) {
+			case NS_KEY_UP:
+			case NS_KEY_DOWN:
+				return GetKeyCode(aWhich);
+			case NS_KEY_PRESS:
+				return GetCharCode(aWhich);
+			default:
+				break;
+		}
   case NS_MOUSE_EVENT:
     {
     PRUint16 button;
@@ -1037,6 +1032,12 @@ nsDOMEvent::IsDispatchStopped(PRBool* aIsDispatchStopped)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsDOMEvent::GetRealTarget(nsIDOMEventTarget** aRealTarget)
+{
+  return NS_OK;
+}  
+
 NS_IMETHODIMP
 nsDOMEvent::IsHandled(PRBool* aIsHandled)
 {
diff --git a/content/events/src/nsDOMEvent.h b/content/events/src/nsDOMEvent.h
index 18361a20638..2a81f574be5 100644
--- a/content/events/src/nsDOMEvent.h
+++ b/content/events/src/nsDOMEvent.h
@@ -149,6 +149,7 @@ public:
   NS_IMETHOD    SetCurrentTarget(nsIDOMEventTarget* aCurrentTarget);
   NS_IMETHOD    IsDispatchStopped(PRBool* aIsDispatchStopped);
   NS_IMETHOD    GetInternalNSEvent(nsEvent** aNSEvent);
+  NS_IMETHOD    GetRealTarget(nsIDOMEventTarget** aTarget);
   NS_IMETHOD    IsHandled(PRBool* aHandled);
   NS_IMETHOD    SetHandled(PRBool aHandled);
 
diff --git a/content/events/src/nsEventListenerManager.cpp b/content/events/src/nsEventListenerManager.cpp
index 362085205b9..4d58a57a5ba 100644
--- a/content/events/src/nsEventListenerManager.cpp
+++ b/content/events/src/nsEventListenerManager.cpp
@@ -247,9 +247,8 @@ nsresult nsEventListenerManager::AddEventListener(nsIDOMEventListener *aListener
 
   PRBool found = PR_FALSE;
   nsListenerStruct* ls;
-  nsIScriptEventListener* sel = nsnull;
-
-  aListener->QueryInterface(kIScriptEventListenerIID, (void**)&sel);
+  nsresult rv;
+  nsCOMPtr<nsIScriptEventListener> sel = do_QueryInterface(aListener, &rv);
 
   for (int i=0; i<(*listeners)->Count(); i++) {
     ls = (nsListenerStruct*)(*listeners)->ElementAt(i);
@@ -259,10 +258,12 @@ nsresult nsEventListenerManager::AddEventListener(nsIDOMEventListener *aListener
       break;
     }
     else if (sel) {
-      nsresult rv;
+      //Listener is an nsIScriptEventListener so we need to use its CheckIfEqual
+      //method to verify equality.
       nsCOMPtr<nsIScriptEventListener> regSel = do_QueryInterface(ls->mListener, &rv);
       if (NS_SUCCEEDED(rv) && regSel) {
-        if (NS_OK == regSel->CheckIfEqual(sel)) {
+        PRBool equal;
+        if (NS_SUCCEEDED(regSel->CheckIfEqual(sel, &equal)) && equal) {
           if (ls->mFlags & aFlags && ls->mSubType & aSubType) {
             found = PR_TRUE;
             break;
@@ -272,8 +273,6 @@ nsresult nsEventListenerManager::AddEventListener(nsIDOMEventListener *aListener
     }
   }
 
-  NS_IF_RELEASE(sel);
-
   if (!found) {
     ls = PR_NEW(nsListenerStruct);
     if (ls) {
@@ -302,6 +301,8 @@ nsresult nsEventListenerManager::RemoveEventListener(nsIDOMEventListener *aListe
   }
 
   nsListenerStruct* ls;
+  nsresult rv;
+  nsCOMPtr<nsIScriptEventListener> sel = do_QueryInterface(aListener, &rv);
 
   for (int i=0; i<(*listeners)->Count(); i++) {
     ls = (nsListenerStruct*)(*listeners)->ElementAt(i);
@@ -315,6 +316,21 @@ nsresult nsEventListenerManager::RemoveEventListener(nsIDOMEventListener *aListe
       }
       break;
     }
+    else if (sel) {
+      //Listener is an nsIScriptEventListener so we need to use its CheckIfEqual
+      //method to verify equality.
+      nsCOMPtr<nsIScriptEventListener> regSel = do_QueryInterface(ls->mListener, &rv);
+      if (NS_SUCCEEDED(rv) && regSel) {
+        PRBool equal;
+        if (NS_SUCCEEDED(regSel->CheckIfEqual(sel, &equal)) && equal) {
+          if (ls->mFlags & aFlags && ls->mSubType & aSubType) {
+            NS_RELEASE(ls->mListener);
+            (*listeners)->RemoveElement((void*)ls);
+            PR_DELETE(ls);
+          }
+        }
+      }
+    }
   }
 
   return NS_OK;
diff --git a/content/events/src/nsEventStateManager.cpp b/content/events/src/nsEventStateManager.cpp
index e375a05482f..5b834fdd64f 100644
--- a/content/events/src/nsEventStateManager.cpp
+++ b/content/events/src/nsEventStateManager.cpp
@@ -40,6 +40,9 @@
 #include "nsIDOMHTMLAreaElement.h"
 #include "nsIDOMHTMLButtonElement.h"
 #include "nsIDOMHTMLObjectElement.h"
+#include "nsIDOMHTMLImageElement.h"
+#include "nsIDOMHTMLMapElement.h"
+#include "nsIHTMLDocument.h"
 #include "nsINameSpaceManager.h"  // for kNameSpaceID_HTML
 #include "nsIWebShell.h"
 #include "nsIBaseWindow.h"
@@ -590,7 +593,10 @@ nsEventStateManager::PreHandleEvent(nsIPresContext* aPresContext,
         //Alt key is down, we may need to do an accesskey
         if (mAccessKeys) {
           //Someone registered an accesskey.  Find and activate it.
-          nsVoidKey key((void*)keyEvent->charCode);
+          nsAutoString accKey((char)keyEvent->charCode);
+          accKey.ToLowerCase();
+
+          nsVoidKey key((void*)accKey.First());
           if (mAccessKeys->Exists(&key)) {
             nsCOMPtr<nsIContent> content = getter_AddRefs(NS_STATIC_CAST(nsIContent*, mAccessKeys->Get(&key)));
 
@@ -1467,9 +1473,8 @@ nsEventStateManager::GenerateMouseEnterExit(nsIPresContext* aPresContext, nsGUIE
             targetContent->HandleDOMEvent(aPresContext, &event, nsnull, NS_EVENT_FLAG_INIT, &status); 
           }
         
-          if (nsEventStatus_eConsumeNoDefault != status) {
+          if ( status != nsEventStatus_eConsumeNoDefault )
             SetContentState(targetContent, NS_EVENT_STATE_HOVER);
-          }
 
           //Now dispatch to the frame
           if (mCurrentTarget) {
@@ -1519,9 +1524,8 @@ nsEventStateManager::GenerateMouseEnterExit(nsIPresContext* aPresContext, nsGUIE
           if (mLastMouseOverContent) {
             mLastMouseOverContent->HandleDOMEvent(aPresContext, &event, nsnull, NS_EVENT_FLAG_INIT, &status); 
 
-            if (nsEventStatus_eConsumeNoDefault != status) {
-              SetContentState(nsnull, NS_EVENT_STATE_HOVER);
-            }
+          if ( status != nsEventStatus_eConsumeNoDefault )
+            SetContentState(nsnull, NS_EVENT_STATE_HOVER);
           }
 
 
@@ -1872,20 +1876,28 @@ nsEventStateManager::ShiftFocus(PRBool forward)
   if (mPresContext) {
     nsresult rv = mPresContext->GetShell(getter_AddRefs(shell));
     if (NS_SUCCEEDED(rv) && shell){
-      shell->GetPrimaryFrameFor(mCurrentFocus, &primaryFrame);
+      if (topOfDoc) {
+          primaryFrame = nsnull;
+      }
+      else {
+        shell->GetPrimaryFrameFor(mCurrentFocus, &primaryFrame);
+      }
     }
   }
 
   nsCOMPtr<nsIContent> rootContent = getter_AddRefs(mDocument->GetRootContent());
 
   nsCOMPtr<nsIContent> next;
+  //Get the next tab item.  This takes tabIndex into account
   GetNextTabbableContent(rootContent, primaryFrame, forward, getter_AddRefs(next));
 
+  //Either no tabbable items or the end of the document
   if (!next) {
     PRBool focusTaken = PR_FALSE;
 
     SetContentState(nsnull, NS_EVENT_STATE_FOCUS);
 
+    //Offer focus upwards to allow shifting focus to UI controls
     nsCOMPtr<nsISupports> container;
     mPresContext->GetContainer(getter_AddRefs(container));
     nsCOMPtr<nsIBaseWindow> docShellAsWin(do_QueryInterface(container));
@@ -1893,9 +1905,12 @@ nsEventStateManager::ShiftFocus(PRBool forward)
       docShellAsWin->FocusAvailable(docShellAsWin, &focusTaken);
     }
       
+    //No one took focus and we're not already at the top of the doc
+    //so calling ShiftFocus will start at the top of the doc again.
     if (!focusTaken && !topOfDoc) {
       ShiftFocus(forward);
     }
+
     return;
   }
 
@@ -1913,26 +1928,66 @@ nsEventStateManager::ShiftFocus(PRBool forward)
   NS_IF_ADDREF(mCurrentFocus);
 }
 
-/*
- * At some point this will need to be linked into HTML 4.0 tabindex
- */
-
 NS_IMETHODIMP
 nsEventStateManager::GetNextTabbableContent(nsIContent* aRootContent, nsIFrame* aFrame, PRBool forward,
                                             nsIContent** aResult)
 {
   *aResult = nsnull;
+  PRBool keepFirstFrame = PR_FALSE;
 
   nsCOMPtr<nsIBidirectionalEnumerator> frameTraversal;
+
+  if (!aFrame) {
+    //No frame means we need to start with the root content again.
+    nsCOMPtr<nsIPresShell> presShell;
+    if (mPresContext) {
+      nsIFrame* result = nsnull;
+      if (NS_SUCCEEDED(mPresContext->GetShell(getter_AddRefs(presShell))) && presShell) {
+        presShell->GetPrimaryFrameFor(aRootContent, &result);
+      }
+      if (result) {
+        while(NS_SUCCEEDED(result->FirstChild(mPresContext, nsnull, &result)) && result) {
+          aFrame = result;
+        }
+      }
+    }
+    if (!aFrame) {
+      return NS_ERROR_FAILURE;
+    }
+    keepFirstFrame = PR_TRUE;
+  }
+
+  //Need to do special check in case we're in an imagemap which has multiple content per frame
+  if (mCurrentFocus) {
+    nsCOMPtr<nsIAtom> tag;
+    mCurrentFocus->GetTag(*getter_AddRefs(tag));
+    if(nsHTMLAtoms::area==tag.get()) {
+      //Focus is in an imagemap area
+      nsCOMPtr<nsIPresShell> presShell;
+      if (mPresContext) {
+        nsIFrame* result = nsnull;
+        if (NS_SUCCEEDED(mPresContext->GetShell(getter_AddRefs(presShell))) && presShell) {
+          presShell->GetPrimaryFrameFor(mCurrentFocus, &result);
+        }
+        if (result == aFrame) {
+          //The current focus map area is in the current frame, don't skip over it.
+          keepFirstFrame = PR_TRUE;
+        }
+      }
+    }
+  }
+
   nsresult result = NS_NewFrameTraversal(getter_AddRefs(frameTraversal), EXTENSIVE,
                                          mPresContext, aFrame);
 
   if (NS_FAILED(result))
     return NS_OK;
 
-  if (forward)
-    frameTraversal->Next();
-  else frameTraversal->Prev();
+  if (!keepFirstFrame) {
+    if (forward)
+      frameTraversal->Next();
+    else frameTraversal->Prev();
+  }
 
   nsISupports* currentItem;
   frameTraversal->CurrentItem(&currentItem);
@@ -2009,11 +2064,69 @@ nsEventStateManager::GetNextTabbableContent(nsIContent* aRootContent, nsIFrame*
             nextButton->GetDisabled(&disabled);
           }
         }
-        else if(nsHTMLAtoms::area==tag.get()) {
-          nsCOMPtr<nsIDOMHTMLAreaElement> nextArea(do_QueryInterface(child));
-          if (nextArea)
-            nextArea->GetTabIndex(&tabIndex);
-          disabled = PR_FALSE;
+        else if(nsHTMLAtoms::img==tag.get()) {
+          nsCOMPtr<nsIDOMHTMLImageElement> nextImage(do_QueryInterface(child));
+          nsAutoString usemap;
+          if (nextImage) {
+            nextImage->GetAttribute(NS_ConvertASCIItoUCS2("usemap"), usemap);
+            if (usemap.Length()) {
+              //Image is an imagemap.  We need to get its maps and walk its children.
+              usemap.StripWhitespace();
+
+              nsCOMPtr<nsIDocument> doc;
+              if (NS_SUCCEEDED(child->GetDocument(*getter_AddRefs(doc))) && doc) {
+                if (usemap.First() == '#') {
+                  usemap.Cut(0, 1);
+                }
+
+                nsCOMPtr<nsIHTMLDocument> hdoc(do_QueryInterface(doc));
+                if (hdoc) {
+                  nsCOMPtr<nsIDOMHTMLMapElement> hmap;
+                  if (NS_SUCCEEDED(hdoc->GetImageMap(usemap, getter_AddRefs(hmap))) && hmap) {
+                    nsCOMPtr<nsIContent> map(do_QueryInterface(hmap));
+                    if (map) {
+                      nsCOMPtr<nsIContent> childArea;
+                      PRInt32 count, index;
+                      map->ChildCount(count);
+                      //First see if mCurrentFocus is in this map
+                      for (index = 0; index < count; index++) {
+                        map->ChildAt(index, *getter_AddRefs(childArea));
+                        if (childArea.get() == mCurrentFocus) {
+                          nsAutoString tabIndexStr;
+                          childArea->GetAttribute(kNameSpaceID_HTML, nsHTMLAtoms::tabindex, tabIndexStr);
+                          PRInt32 ec, val = tabIndexStr.ToInteger(&ec);
+                          if (NS_OK == ec && mCurrentTabIndex == val) {
+                            //mCurrentFocus is in this map so we must start iterating past it.
+                            //We skip the case where mCurrentFocus has the same tab index
+                            //as mCurrentTabIndex since the next tab ordered element might
+                            //be before it (or after for backwards) in the child list.
+                            break;
+                          }
+                        }
+                      }
+                      PRInt32 increment = forward ? 1 : - 1;
+                      PRInt32 start = index < count ? index + increment : (forward ? 0 : count - 1);
+                      for (index = start; index < count && index >= 0; index += increment) {
+                        //Iterate over the children.
+                        map->ChildAt(index, *getter_AddRefs(childArea));
+
+                        //Got the map area, check its tabindex.
+                        nsAutoString tabIndexStr;
+                        childArea->GetAttribute(kNameSpaceID_HTML, nsHTMLAtoms::tabindex, tabIndexStr);
+                        PRInt32 ec, val = tabIndexStr.ToInteger(&ec);
+                        if (NS_OK == ec && mCurrentTabIndex == val) {
+                          //tabindex == the current one, use it.
+                          *aResult = childArea;
+                          NS_IF_ADDREF(*aResult);
+                          return NS_OK;
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
         }
         else if(nsHTMLAtoms::object==tag.get()) {
           nsCOMPtr<nsIDOMHTMLObjectElement> nextObject(do_QueryInterface(child));
@@ -2061,7 +2174,7 @@ nsEventStateManager::GetNextTabbableContent(nsIContent* aRootContent, nsIFrame*
   }
   //else continue looking for next highest priority tab
   mCurrentTabIndex = GetNextTabIndex(aRootContent, forward);
-  return GetNextTabbableContent(aRootContent, aFrame, forward, aResult);
+  return GetNextTabbableContent(aRootContent, nsnull, forward, aResult);
 }
 
 PRInt32
@@ -2566,7 +2679,10 @@ nsEventStateManager::RegisterAccessKey(nsIFrame * aFrame, nsIContent* aContent,
   }
 
   if (content) {
-    nsVoidKey key((void*)aKey);
+    nsAutoString accKey((char)aKey);
+    accKey.ToLowerCase();
+
+    nsVoidKey key((void*)accKey.First());
 
     mAccessKeys->Put(&key, content);
   }
@@ -2589,7 +2705,10 @@ nsEventStateManager::UnregisterAccessKey(nsIFrame * aFrame, nsIContent* aContent
     content = aContent;
   }
   if (content) {
-    nsVoidKey key((void*)aKey);
+    nsAutoString accKey((char)aKey);
+    accKey.ToLowerCase();
+
+    nsVoidKey key((void*)accKey.First());
 
     nsCOMPtr<nsIContent> oldContent = getter_AddRefs(NS_STATIC_CAST(nsIContent*, mAccessKeys->Get(&key)));
     if (oldContent != content) {
diff --git a/content/html/content/src/nsGenericHTMLElement.cpp b/content/html/content/src/nsGenericHTMLElement.cpp
index 904a0026ab7..ae6d2adcad2 100644
--- a/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/content/html/content/src/nsGenericHTMLElement.cpp
@@ -1178,7 +1178,10 @@ nsGenericHTMLElement::HandleDOMEventForAnchors(nsIContent* aOuter,
           stateManager->SetContentState(mContent, NS_EVENT_STATE_HOVER);
           NS_RELEASE(stateManager);
         }
-
+      }
+      // Set the status bar the same for focus and mouseover
+      case NS_FOCUS_CONTENT:
+      {
         nsAutoString target;
         nsIURI* baseURL = nsnull;
         GetBaseURL(baseURL);
diff --git a/content/html/content/src/nsHTMLAreaElement.cpp b/content/html/content/src/nsHTMLAreaElement.cpp
index 5bf9b314b47..22b4903fddc 100644
--- a/content/html/content/src/nsHTMLAreaElement.cpp
+++ b/content/html/content/src/nsHTMLAreaElement.cpp
@@ -263,15 +263,17 @@ nsHTMLAreaElement::SetFocus(nsIPresContext* aPresContext)
     esm->SetContentState(this, NS_EVENT_STATE_FOCUS);
     NS_RELEASE(esm);
   }
-
-  // XXX write me
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsHTMLAreaElement::RemoveFocus(nsIPresContext* aPresContext)
 {
-  // XXX write me
+  nsIEventStateManager* esm;
+  if (NS_OK == aPresContext->GetEventStateManager(&esm)) {
+    esm->SetContentState(nsnull, NS_EVENT_STATE_FOCUS);
+    NS_RELEASE(esm);
+  }
   return NS_OK;
 }
 
diff --git a/content/html/content/src/nsHTMLImageElement.cpp b/content/html/content/src/nsHTMLImageElement.cpp
index 1a87ddcdc3b..43b233c8a95 100644
--- a/content/html/content/src/nsHTMLImageElement.cpp
+++ b/content/html/content/src/nsHTMLImageElement.cpp
@@ -723,12 +723,19 @@ nsHTMLImageElement::SetProperty(JSContext *aContext, JSObject *aObj, jsval aID,
         }
       }
     }
+    else {
+      result = mInner.SetProperty(aContext, aObj, aID, aVp);
+    }
   }
   else {
     result = mInner.SetProperty(aContext, aObj, aID, aVp);
   }
   
-  return (result == NS_OK);
+  if (NS_FAILED(result)) {
+    return PR_FALSE;
+  }
+
+  return PR_TRUE;
 }
 
 PRBool    
diff --git a/content/html/document/src/nsHTMLDocument.cpp b/content/html/document/src/nsHTMLDocument.cpp
index 9c3ffa81847..a6abc13e0a4 100644
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -1938,6 +1938,15 @@ nsHTMLDocument::OpenCommon(nsIURI* aSourceURL)
 
     result = NS_OpenURI(getter_AddRefs(channel), aSourceURL, nsnull, group);
     if (NS_FAILED(result)) return result;
+
+    //Before we reset the doc notify the globalwindow of the change.
+    if (mScriptGlobalObject) {
+      //Hold onto ourselves on the offchance that we're down to one ref
+      nsCOMPtr<nsIDOMDocument> kungFuDeathGrip (do_QueryInterface((nsIHTMLDocument*)this));
+      result = mScriptGlobalObject->SetNewDocument(kungFuDeathGrip);
+      if (NS_FAILED(result)) return result;
+    }
+
     result = Reset(channel, group);
     if (NS_FAILED(result)) return result;
     if (NS_OK == result) {
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index f1c7fa44575..fd9eb327200 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -1833,8 +1833,18 @@ NS_IMETHODIMP nsDocShell::FocusAvailable(nsIBaseWindow* aCurrentFocus,
    if(aCurrentFocus == NS_STATIC_CAST(nsIBaseWindow*, this))
       {
       if(nextCallWin)
-         return nextCallWin->FocusAvailable(aCurrentFocus, aTookFocus);
-      return NS_OK;
+        { 
+        nsresult ret = nextCallWin->FocusAvailable(aCurrentFocus, aTookFocus);
+        if (NS_SUCCEEDED(ret) && *aTookFocus)
+          return NS_OK;
+        }
+
+        if (!mChildren.Count())
+           {
+           //If we don't have children and our parent didn't want 
+           //the focus then we should just stop now.
+           return NS_OK;
+           }
       }
 
    //Otherwise, check the chilren and offer it to the next sibling.
@@ -1844,7 +1854,22 @@ NS_IMETHODIMP nsDocShell::FocusAvailable(nsIBaseWindow* aCurrentFocus,
       {
       nsCOMPtr<nsIBaseWindow> 
          child(do_QueryInterface((nsISupports*)mChildren.ElementAt(i)));
-      if(child.get() == aCurrentFocus)
+      //If we have focus we offer it to our first child.
+      if(aCurrentFocus == NS_STATIC_CAST(nsIBaseWindow*, this))
+        {
+        if(NS_SUCCEEDED(child->SetFocus()))
+           {
+           *aTookFocus = PR_TRUE;
+           return NS_OK;
+           }
+        else 
+           {
+           return NS_ERROR_FAILURE;
+           } 
+        }
+      //If we don't have focus, find the child that does then
+      //offer focus to the next one.
+      if (child.get() == aCurrentFocus)
          {
          while(++i < n)
             {
@@ -1854,12 +1879,18 @@ NS_IMETHODIMP nsDocShell::FocusAvailable(nsIBaseWindow* aCurrentFocus,
                *aTookFocus = PR_TRUE;
                return NS_OK;
                }
+            else 
+               {
+               return NS_ERROR_FAILURE;
+               } 
             }
          }
       }
-   if(nextCallWin)
-      return nextCallWin->FocusAvailable(aCurrentFocus, aTookFocus);
-   return NS_OK;
+
+   //Reached the end of our child list.  Call again to offer focus
+   //upwards and to start at the beginning of our child list if
+   //no one above us wants focus.
+   return FocusAvailable(this, aTookFocus);
 }
 
 NS_IMETHODIMP nsDocShell::GetTitle(PRUnichar** aTitle)
diff --git a/editor/ui/composer/content/sb-bookmarks.js b/editor/ui/composer/content/sb-bookmarks.js
index f4121e430a9..afe45deab1b 100644
--- a/editor/ui/composer/content/sb-bookmarks.js
+++ b/editor/ui/composer/content/sb-bookmarks.js
@@ -303,12 +303,12 @@ function CloseEditNode(saveChangeFlag)
 
 function EditNodeKeyPress(event)
 {
-    if (event.which == 27)
+    if (event.keyCode == 27)
     {
         CloseEditNode(false);
         return(false);
     }
-    else if (event.which == 13 || event.which == 10)
+    else if (event.keyCode == 13 || event.keyCode == 10)
     {
         CloseEditNode(true);
         return(false);
diff --git a/editor/ui/composer/content/sb-file-panel.js b/editor/ui/composer/content/sb-file-panel.js
index dd614b9bd51..0ddc4918fd7 100644
--- a/editor/ui/composer/content/sb-file-panel.js
+++ b/editor/ui/composer/content/sb-file-panel.js
@@ -331,12 +331,12 @@ function CloseEditNode(saveChangeFlag)
 
 function EditNodeKeyPress(event)
 {
-    if (event.which == 27)
+    if (event.keyCode == 27)
     {
         CloseEditNode(false);
         return(false);
     }
-    else if (event.which == 13 || event.which == 10)
+    else if (event.keyCode == 13 || event.keyCode == 10)
     {
         CloseEditNode(true);
         return(false);
diff --git a/editor/ui/dialogs/content/EdAdvancedEdit.xul b/editor/ui/dialogs/content/EdAdvancedEdit.xul
index c8a79874521..e99745f608e 100644
--- a/editor/ui/dialogs/content/EdAdvancedEdit.xul
+++ b/editor/ui/dialogs/content/EdAdvancedEdit.xul
@@ -105,9 +105,9 @@
               <title><text value="&AddHTMLAttributeLabel.label;"/></title>
               <box autostretch="never">
                 <text class="label" for="AddHTMLAttributeNameInput" value="&AttName.label;"/>
-                <textfield flex="1" id="AddHTMLAttributeNameInput" onkeyup="doHTMLEnabling(event.which)" onmouseup="doHTMLEnabling(event.which)"/>
+                <textfield flex="1" id="AddHTMLAttributeNameInput" onkeyup="doHTMLEnabling(event.keyCode)" onmouseup="doHTMLEnabling(event.which)"/>
                 <text class="label" for="AddHTMLAttributeValueInput" value="&AttValue.label;"/>
-          	    <textfield flex="1" id="AddHTMLAttributeValueInput" onkeyup="doHTMLEnabling(event.which)"/>
+          	    <textfield flex="1" id="AddHTMLAttributeValueInput" onkeyup="doHTMLEnabling(event.keyCode)"/>
                 <button class="dialog" id="AddHTMLAttribute" oncommand="onAddHTMLAttribute(this)" value="&AddAttributeButton.label;" disabled="true"/>
               </box>
             </titledbox>
@@ -136,9 +136,9 @@
               <title><text value="&AddCSSAttributeLabel.label;"/></title>
               <box autostretch="never">
                 <text class="label" for="AddCSSAttributeNameInput" value="&AttName.label;"/>
-                <textfield flex="1" id="AddCSSAttributeNameInput" onkeyup="doCSSEnabling(event.which)" onmouseup="doHTMLEnabling(event.which)"/>
+                <textfield flex="1" id="AddCSSAttributeNameInput" onkeyup="doCSSEnabling(event.keyCode)" onmouseup="doHTMLEnabling(event.which)"/>
                 <text class="label" for="AddCSSAttributeValueInput" value="&AttValue.label;"/>
-          	    <textfield flex="1" id="AddCSSAttributeValueInput" onkeyup="doCSSEnabling(event.which)"/>
+          	    <textfield flex="1" id="AddCSSAttributeValueInput" onkeyup="doCSSEnabling(event.keyCode)"/>
                 <button class="dialog" id="AddCSSAttribute" oncommand="onAddCSSAttribute(this)" value="&AddAttributeButton.label;" disabled="true"/>
               </box>
             </titledbox>
@@ -167,9 +167,9 @@
               <title><text value="&AddJSEAttributeLabel.label;"/></title>
               <box autostretch="never">
                 <text class="label" for="AddJSEAttributeNameInput" value="&AttName.label;"/>
-                <textfield type="text" flex="1" id="AddJSEAttributeNameInput" onkeyup="doJSEEnabling(event.which)" onmouseup="doHTMLEnabling(event.which)"/>
+                <textfield type="text" flex="1" id="AddJSEAttributeNameInput" onkeyup="doJSEEnabling(event.keyCode)" onmouseup="doHTMLEnabling(event.which)"/>
                 <text class="label" for="AddJSEAttributeValueInput" value="&AttValue.label;"/>
-          	    <textfield flex="1" id="AddJSEAttributeValueInput" onkeyup="doJSEEnabling(event.which)"/>
+          	    <textfield flex="1" id="AddJSEAttributeValueInput" onkeyup="doJSEEnabling(event.keyCode)"/>
                 <button class="dialog" id="AddJSEAttribute" oncommand="onAddJSEAttribute(this)" value="&AddAttributeButton.label;" disabled="true"/>
               </box>
             </titledbox>
diff --git a/extensions/irc/xul/content/handlers.js b/extensions/irc/xul/content/handlers.js
index f7a66b09d10..ec0eca8462c 100644
--- a/extensions/irc/xul/content/handlers.js
+++ b/extensions/irc/xul/content/handlers.js
@@ -305,7 +305,7 @@ function onToggleMunger()
 function onInputKeyUp (e)
 {
     
-    switch (e.which)
+    switch (e.keyCode)
     {        
         case 13: /* CR */
             e.line = e.target.value;
diff --git a/extensions/irc/xul/tests/test3-handlers.js b/extensions/irc/xul/tests/test3-handlers.js
index 0f6939ca6b0..9cbed257fc4 100644
--- a/extensions/irc/xul/tests/test3-handlers.js
+++ b/extensions/irc/xul/tests/test3-handlers.js
@@ -137,7 +137,7 @@ function onToggleMunger()
 function onInputKeyUp (e)
 {
     
-    switch (e.which)
+    switch (e.keyCode)
     {        
         case 13: /* CR */
             if (e.target.id != "input")
diff --git a/extensions/wallet/cookieviewer/CookieViewer.js b/extensions/wallet/cookieviewer/CookieViewer.js
index 0a955a16db6..f01c0154b15 100644
--- a/extensions/wallet/cookieviewer/CookieViewer.js
+++ b/extensions/wallet/cookieviewer/CookieViewer.js
@@ -266,7 +266,7 @@ function DeleteAllCookies() {
 // keypress pass-thru
 function HandleKeyPress( e )
 {
-  switch ( e.which )
+  switch ( e.keyCode )
   {
   case 13:  // enter
   case 32:  // spacebar
diff --git a/extensions/wallet/signonviewer/SignonViewer.js b/extensions/wallet/signonviewer/SignonViewer.js
index 5e7e9be6356..84232b71f9c 100644
--- a/extensions/wallet/signonviewer/SignonViewer.js
+++ b/extensions/wallet/signonviewer/SignonViewer.js
@@ -408,7 +408,7 @@ function HandleEvent( event, page )
   }
   
   // keypress event
-  if( event.type == "keypress" && event.which == 46 ) {
+  if( event.type == "keypress" && event.keyCode == 46 ) {
     switch( page ) {
     case 0:
       DeleteSignon();
diff --git a/intl/strres/tests/strres-test.xul b/intl/strres/tests/strres-test.xul
index 18b49b59cc3..a44d1c5dab0 100644
--- a/intl/strres/tests/strres-test.xul
+++ b/intl/strres/tests/strres-test.xul
@@ -32,7 +32,7 @@
 			</html:div>
            
         	<box align="horizontal">
-        		<html:input id="dialog.input" flex="100%" onkeyup="onTyping(event.which)"/>
+        		<html:input id="dialog.input" flex="100%" onkeyup="onTyping(event.keyCode)"/>
         		<titledbutton onclick="choose()" value="Choose File..." align="left"/>
        		 </box>
                               
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index 482cc40cac1..195782b02d6 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -710,6 +710,7 @@ public:
   NS_IMETHOD HandleEvent(nsIView*        aView,
                          nsGUIEvent*     aEvent,
                          nsEventStatus*  aEventStatus,
+  											 PRBool          aForceHandle,
                          PRBool&         aHandled);
   NS_IMETHOD HandleDOMEventWithTarget(nsIContent* aTargetContent,
                             nsEvent* aEvent,
@@ -3845,6 +3846,7 @@ NS_IMETHODIMP
 PresShell::HandleEvent(nsIView         *aView,
                        nsGUIEvent*     aEvent,
                        nsEventStatus*  aEventStatus,
+											 PRBool          aForceHandle,
                        PRBool&         aHandled)
 {
   void*     clientData;
@@ -3853,7 +3855,7 @@ PresShell::HandleEvent(nsIView         *aView,
   
   NS_ASSERTION(!(nsnull == aView), "null view");
 
-  aHandled = PR_TRUE;  // XXX Is this right?
+  aHandled = PR_TRUE;
 
   if (mIsDestroying || mIsReflowing) {
     return NS_OK;
@@ -3903,7 +3905,6 @@ PresShell::HandleEvent(nsIView         *aView,
             if (rv != NS_OK) {
               rv = frame->GetFrameForPoint(mPresContext, eventPoint, NS_FRAME_PAINT_LAYER_BACKGROUND, &mCurrentEventFrame);
               if (rv != NS_OK) {
-                // XXX Is this the right thing to do?
 #ifdef XP_MAC
                 // On the Mac it is possible to be running with no windows open, only the native menu bar.
                 // In this situation, we need to handle key board events but there are no frames, so
@@ -3911,7 +3912,12 @@ PresShell::HandleEvent(nsIView         *aView,
                 mCurrentEventContent = mDocument->GetRootContent();
                 mCurrentEventFrame = nsnull;
 #else
-                mCurrentEventFrame = frame;
+								if (aForceHandle) {
+									mCurrentEventFrame = frame;
+								}
+								else {
+									mCurrentEventFrame = nsnull;
+								}
                 aHandled = PR_FALSE;
 #endif
                 rv = NS_OK;
@@ -3934,9 +3940,12 @@ PresShell::HandleEvent(nsIView         *aView,
           if (rv != NS_OK) {
             rv = frame->GetFrameForPoint(mPresContext, eventPoint, NS_FRAME_PAINT_LAYER_BACKGROUND, &mCurrentEventFrame);
             if (rv != NS_OK) {
-              // XXX Is this the right thing to do? NO IT ISNT!
-              mCurrentEventFrame = frame;
-              //mCurrentEventFrame = nsnull;
+							if (aForceHandle) {
+								mCurrentEventFrame = frame;
+							}
+							else {
+								mCurrentEventFrame = nsnull;
+							}
               aHandled = PR_FALSE;
               rv = NS_OK;
             }
diff --git a/layout/base/src/nsGenericElement.cpp b/layout/base/src/nsGenericElement.cpp
index 95cb1ba28d7..61066a7ad13 100644
--- a/layout/base/src/nsGenericElement.cpp
+++ b/layout/base/src/nsGenericElement.cpp
@@ -26,12 +26,12 @@
 #include "nsIAtom.h"
 #include "nsINodeInfo.h"
 #include "nsIDocument.h"
-#include "nsIDOMEventReceiver.h"
 #include "nsIDOMNodeList.h"
 #include "nsIDOMDocument.h"
 #include "nsIDOMDocumentFragment.h"
 #include "nsIDOMRange.h"
 #include "nsIDOMText.h"
+#include "nsIDOMEventReceiver.h"
 #include "nsRange.h"
 #include "nsIEventListenerManager.h"
 #include "nsILinkHandler.h"
@@ -71,7 +71,7 @@
 #include "nsLayoutAtoms.h"
 #include "nsHTMLAtoms.h"
 #include "nsLayoutUtils.h"
-
+#include "nsIJSContextStack.h"
 
 #include "nsIServiceManager.h"
 #include "nsIPref.h" // Used by the temp pref, should be removed!
@@ -81,8 +81,8 @@ static PRBool kStrictDOMLevel2 = PR_FALSE;
 NS_DEFINE_IID(kIDOMNodeIID, NS_IDOMNODE_IID);
 NS_DEFINE_IID(kIDOMElementIID, NS_IDOMELEMENT_IID);
 NS_DEFINE_IID(kIDOMTextIID, NS_IDOMTEXT_IID);
-NS_DEFINE_IID(kIDOMEventReceiverIID, NS_IDOMEVENTRECEIVER_IID);
 NS_DEFINE_IID(kIDOMEventTargetIID, NS_IDOMEVENTTARGET_IID);
+NS_DEFINE_IID(kIDOMEventReceiverIID, NS_IDOMEVENTRECEIVER_IID);
 NS_DEFINE_IID(kIScriptObjectOwnerIID, NS_ISCRIPTOBJECTOWNER_IID);
 NS_DEFINE_IID(kIJSScriptObjectIID, NS_IJSSCRIPTOBJECT_IID);
 NS_DEFINE_IID(kISupportsIID, NS_ISUPPORTS_IID);
@@ -2358,44 +2358,56 @@ nsGenericElement::AddScriptEventListener(nsIAtom* aAttribute,
                                          REFNSIID aIID)
 {
   nsresult ret = NS_OK;
-  nsIScriptContext* context;
+  nsCOMPtr<nsIScriptContext> context = nsnull;
+  nsCOMPtr<nsIScriptGlobalObject> global = nsnull;
+  JSContext* cx = nsnull;
 
-  if (nsnull != mDocument) {
-    nsCOMPtr<nsIScriptGlobalObject> global;
-    mDocument->GetScriptGlobalObject(getter_AddRefs(global));
-    if (global) {
-      if (NS_OK == global->GetContext(&context)) {
-        if (mNodeInfo->Equals(nsHTMLAtoms::body) ||
-            mNodeInfo->Equals(nsHTMLAtoms::frameset)) {
-          nsIDOMEventReceiver *receiver;
+  //Try to get context from doc
+  if (mDocument) {
+    if (NS_SUCCEEDED(mDocument->GetScriptGlobalObject(getter_AddRefs(global))) && global) {
+      NS_ENSURE_SUCCESS(global->GetContext(getter_AddRefs(context)), NS_ERROR_FAILURE);
+    }
+  }
 
-          if (nsnull != global && NS_OK == global->QueryInterface(kIDOMEventReceiverIID, (void**)&receiver)) {
-            nsIEventListenerManager *manager;
-            if (NS_OK == receiver->GetListenerManager(&manager)) {
-              nsIScriptObjectOwner *mObjectOwner;
-              if (NS_OK == global->QueryInterface(kIScriptObjectOwnerIID, (void**)&mObjectOwner)) {
-                ret = manager->AddScriptEventListener(context, mObjectOwner, aAttribute, aValue, aIID, PR_FALSE);
-                NS_RELEASE(mObjectOwner);
-              }
-              NS_RELEASE(manager);
-            }
-            NS_RELEASE(receiver);
-          }
-        }
-        else {
-          nsIEventListenerManager *manager;
-          if (NS_OK == GetListenerManager(&manager)) {
-            nsIScriptObjectOwner* cowner;
-            if (NS_OK == mContent->QueryInterface(kIScriptObjectOwnerIID,
-                                                  (void**) &cowner)) {
-              ret = manager->AddScriptEventListener(context, cowner,
-                                                    aAttribute, aValue, aIID, PR_TRUE);
-              NS_RELEASE(cowner);
-            }
-            NS_RELEASE(manager);
-          }
-        }
-        NS_RELEASE(context);
+  if (!context) {
+    // Get JSContext from stack.
+    nsCOMPtr<nsIThreadJSContextStack> stack(do_GetService("nsThreadJSContextStack"));
+    NS_ENSURE_TRUE(stack, NS_ERROR_FAILURE);
+    NS_ENSURE_SUCCESS(stack->Peek(&cx), NS_ERROR_FAILURE);
+
+    if(!cx) {
+      stack->GetSafeJSContext(&cx);
+      NS_ENSURE_TRUE(cx, NS_ERROR_FAILURE);
+    }
+    
+    nsLayoutUtils::GetDynamicScriptContext(cx, getter_AddRefs(context));
+    NS_ENSURE_TRUE(context, NS_ERROR_FAILURE);
+  }
+    
+  //Attributes on the body and frameset tags get set on the global object
+  if (mNodeInfo->Equals(nsHTMLAtoms::body) ||
+      mNodeInfo->Equals(nsHTMLAtoms::frameset)) {
+    if (!global) {
+      if (cx) {
+        nsLayoutUtils::GetDynamicScriptGlobal(cx, getter_AddRefs(global));
+      }
+      NS_ENSURE_TRUE(global, NS_ERROR_FAILURE);
+    }
+    nsCOMPtr<nsIDOMEventReceiver> receiver(do_QueryInterface(global));
+    nsCOMPtr<nsIEventListenerManager> manager;
+    if (receiver && NS_SUCCEEDED(receiver->GetListenerManager(getter_AddRefs(manager)))) {
+      nsCOMPtr<nsIScriptObjectOwner> objOwner(do_QueryInterface(global));
+      if (objOwner) {
+        ret = manager->AddScriptEventListener(context, objOwner, aAttribute, aValue, aIID, PR_FALSE);
+      }
+    }
+  }
+  else {
+    nsCOMPtr<nsIEventListenerManager> manager;
+    if (NS_SUCCEEDED(GetListenerManager(getter_AddRefs(manager)))) {
+      nsCOMPtr<nsIScriptObjectOwner> objOwner(do_QueryInterface(mContent));
+      if (objOwner) {
+        ret = manager->AddScriptEventListener(context, objOwner, aAttribute, aValue, aIID, PR_TRUE);
       }
     }
   }
diff --git a/layout/base/src/nsRange.cpp b/layout/base/src/nsRange.cpp
index 1c75b2dc6ff..7c7ec19457b 100644
--- a/layout/base/src/nsRange.cpp
+++ b/layout/base/src/nsRange.cpp
@@ -425,7 +425,7 @@ nsRange::IntersectsNode(nsIDOMNode* aNode, PRBool* aReturn)
 
 // HOW does the node intersect the range?
 NS_IMETHODIMP
-nsRange::CompareNode(nsIDOMNode* aNode, PRInt16* aReturn)
+nsRange::CompareNode(nsIDOMNode* aNode, PRUint16* aReturn)
 {
   if (!aReturn)
     return NS_ERROR_NULL_POINTER;
diff --git a/layout/base/src/nsRange.h b/layout/base/src/nsRange.h
index e118bf16044..709bd1187b2 100644
--- a/layout/base/src/nsRange.h
+++ b/layout/base/src/nsRange.h
@@ -100,7 +100,7 @@ public:
   NS_IMETHOD    ComparePoint(nsIDOMNode* aParent, PRInt32 aOffset,
                              PRInt16* aResult);
   NS_IMETHOD    IntersectsNode(nsIDOMNode* aNode, PRBool* aReturn);
-  NS_IMETHOD    CompareNode(nsIDOMNode* aNode, PRInt16* aReturn);
+  NS_IMETHOD    CompareNode(nsIDOMNode* aNode, PRUint16* aReturn);
 /*END nsIDOMNSRange interface implementations*/
   
   NS_IMETHOD    GetHasGeneratedBefore(PRBool *aBool);
diff --git a/layout/events/public/nsIPrivateDOMEvent.h b/layout/events/public/nsIPrivateDOMEvent.h
index a0fb3a03144..de3bf0e8838 100644
--- a/layout/events/public/nsIPrivateDOMEvent.h
+++ b/layout/events/public/nsIPrivateDOMEvent.h
@@ -49,6 +49,7 @@ public:
   NS_IMETHOD SetCurrentTarget(nsIDOMEventTarget* aTarget) = 0;
   NS_IMETHOD IsDispatchStopped(PRBool* aIsDispatchPrevented) = 0;
   NS_IMETHOD GetInternalNSEvent(nsEvent** aNSEvent) = 0;
+  NS_IMETHOD GetRealTarget(nsIDOMEventTarget** aRealTarget) = 0;
 };
 
 extern nsresult NS_NewDOMEvent(nsIDOMEvent** aInstancePtrResult, nsIPresContext* aPresContext, nsEvent *aEvent);
diff --git a/layout/events/src/nsDOMEvent.cpp b/layout/events/src/nsDOMEvent.cpp
index 8776982f0cb..c8a2881f1a5 100644
--- a/layout/events/src/nsDOMEvent.cpp
+++ b/layout/events/src/nsDOMEvent.cpp
@@ -85,7 +85,7 @@ nsDOMEvent::nsDOMEvent(nsIPresContext* aPresContext, nsEvent* aEvent, const nsSt
   mText = nsnull;
   mTextRange = nsnull;
 
-  if (aEvent->eventStructType == NS_TEXT_EVENT) {
+  if (aEvent && aEvent->eventStructType == NS_TEXT_EVENT) {
 	  //
 	  // extract the IME composition string
 	  //
@@ -164,6 +164,8 @@ NS_METHOD nsDOMEvent::GetTarget(nsIDOMEventTarget** aTarget)
     return NS_OK;
   }
   
+	*aTarget = nsnull;
+
   nsIEventStateManager *manager;
   nsIContent *targetContent;  
 
@@ -181,19 +183,15 @@ NS_METHOD nsDOMEvent::GetTarget(nsIDOMEventTarget** aTarget)
   }
   else {
     //Always want a target.  Use document if nothing else.
-    nsIPresShell* presShell;
-    nsIDocument* doc;
-    if (NS_SUCCEEDED(mPresContext->GetShell(&presShell))) {
-      presShell->GetDocument(&doc);
-      NS_RELEASE(presShell);
-    }
-
-    if (doc) {
-      if (NS_OK == doc->QueryInterface(NS_GET_IID(nsIDOMEventTarget), (void**)&mTarget)) {
-        *aTarget = mTarget;
-        NS_ADDREF(mTarget);
-      }      
-      NS_RELEASE(doc);
+    nsCOMPtr<nsIDocument> doc;
+		nsCOMPtr<nsIPresShell> presShell;
+		if (NS_SUCCEEDED(mPresContext->GetShell(getter_AddRefs(presShell))) && presShell) {
+      if (NS_SUCCEEDED(presShell->GetDocument(getter_AddRefs(doc))) && doc) {
+				if (NS_SUCCEEDED(doc->QueryInterface(NS_GET_IID(nsIDOMEventTarget), (void**)&mTarget))) {
+					*aTarget = mTarget;
+					NS_ADDREF(mTarget);
+				}      
+			}
     }
   }
 
@@ -456,18 +454,13 @@ NS_METHOD nsDOMEvent::GetClientX(PRInt32* aClientX)
   }
 
   //My god, man, there *must* be a better way to do this.
-  nsIPresShell* shell;
+  nsCOMPtr<nsIPresShell> presShell;
   nsIWidget* rootWidget = nsnull;
-  mPresContext->GetShell(&shell);
-
-  if (shell) {
-    nsIViewManager* vm;
-    shell->GetViewManager(&vm);
-    if (vm) {
+  if (NS_SUCCEEDED(mPresContext->GetShell(getter_AddRefs(presShell))) && presShell) {
+    nsCOMPtr<nsIViewManager> vm;
+		if (NS_SUCCEEDED(presShell->GetViewManager(getter_AddRefs(vm))) && vm) {
       vm->GetWidget(&rootWidget);
-      NS_RELEASE(vm);
     }
-    NS_RELEASE(shell);
   }
 
 
@@ -501,18 +494,13 @@ NS_METHOD nsDOMEvent::GetClientY(PRInt32* aClientY)
   }
 
   //My god, man, there *must* be a better way to do this.
-  nsIPresShell* shell;
+  nsCOMPtr<nsIPresShell> presShell;
   nsIWidget* rootWidget = nsnull;
-  mPresContext->GetShell(&shell);
-
-  if (shell) {
-    nsIViewManager* vm;
-    shell->GetViewManager(&vm);
-    if (vm) {
+  if (NS_SUCCEEDED(mPresContext->GetShell(getter_AddRefs(presShell))) && presShell) {
+    nsCOMPtr<nsIViewManager> vm;
+		if (NS_SUCCEEDED(presShell->GetViewManager(getter_AddRefs(vm))) && vm) {
       vm->GetWidget(&rootWidget);
-      NS_RELEASE(vm);
     }
-    NS_RELEASE(shell);
   }
 
 
@@ -696,8 +684,7 @@ nsresult nsDOMEvent::GetScrollInfo(nsIScrollableView** aScrollableView,
   mPresContext->GetTwipsToPixels(aT2P);
 
   nsCOMPtr<nsIPresShell> presShell;
-  mPresContext->GetShell(getter_AddRefs(presShell));
-  if(presShell) {
+  if (NS_SUCCEEDED(mPresContext->GetShell(getter_AddRefs(presShell))) && presShell) {
      nsCOMPtr<nsIViewManager> vm;
      presShell->GetViewManager(getter_AddRefs(vm));
      if(vm) {
@@ -761,7 +748,15 @@ NS_METHOD nsDOMEvent::GetWhich(PRUint32* aWhich)
 {
   switch (mEvent->eventStructType) {
   case NS_KEY_EVENT:
-    return GetKeyCode(aWhich);
+	  switch (mEvent->message) {
+			case NS_KEY_UP:
+			case NS_KEY_DOWN:
+				return GetKeyCode(aWhich);
+			case NS_KEY_PRESS:
+				return GetCharCode(aWhich);
+			default:
+				break;
+		}
   case NS_MOUSE_EVENT:
     {
     PRUint16 button;
@@ -1037,6 +1032,12 @@ nsDOMEvent::IsDispatchStopped(PRBool* aIsDispatchStopped)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsDOMEvent::GetRealTarget(nsIDOMEventTarget** aRealTarget)
+{
+  return NS_OK;
+}  
+
 NS_IMETHODIMP
 nsDOMEvent::IsHandled(PRBool* aIsHandled)
 {
diff --git a/layout/events/src/nsDOMEvent.h b/layout/events/src/nsDOMEvent.h
index 18361a20638..2a81f574be5 100644
--- a/layout/events/src/nsDOMEvent.h
+++ b/layout/events/src/nsDOMEvent.h
@@ -149,6 +149,7 @@ public:
   NS_IMETHOD    SetCurrentTarget(nsIDOMEventTarget* aCurrentTarget);
   NS_IMETHOD    IsDispatchStopped(PRBool* aIsDispatchStopped);
   NS_IMETHOD    GetInternalNSEvent(nsEvent** aNSEvent);
+  NS_IMETHOD    GetRealTarget(nsIDOMEventTarget** aTarget);
   NS_IMETHOD    IsHandled(PRBool* aHandled);
   NS_IMETHOD    SetHandled(PRBool aHandled);
 
diff --git a/layout/events/src/nsEventListenerManager.cpp b/layout/events/src/nsEventListenerManager.cpp
index 362085205b9..4d58a57a5ba 100644
--- a/layout/events/src/nsEventListenerManager.cpp
+++ b/layout/events/src/nsEventListenerManager.cpp
@@ -247,9 +247,8 @@ nsresult nsEventListenerManager::AddEventListener(nsIDOMEventListener *aListener
 
   PRBool found = PR_FALSE;
   nsListenerStruct* ls;
-  nsIScriptEventListener* sel = nsnull;
-
-  aListener->QueryInterface(kIScriptEventListenerIID, (void**)&sel);
+  nsresult rv;
+  nsCOMPtr<nsIScriptEventListener> sel = do_QueryInterface(aListener, &rv);
 
   for (int i=0; i<(*listeners)->Count(); i++) {
     ls = (nsListenerStruct*)(*listeners)->ElementAt(i);
@@ -259,10 +258,12 @@ nsresult nsEventListenerManager::AddEventListener(nsIDOMEventListener *aListener
       break;
     }
     else if (sel) {
-      nsresult rv;
+      //Listener is an nsIScriptEventListener so we need to use its CheckIfEqual
+      //method to verify equality.
       nsCOMPtr<nsIScriptEventListener> regSel = do_QueryInterface(ls->mListener, &rv);
       if (NS_SUCCEEDED(rv) && regSel) {
-        if (NS_OK == regSel->CheckIfEqual(sel)) {
+        PRBool equal;
+        if (NS_SUCCEEDED(regSel->CheckIfEqual(sel, &equal)) && equal) {
           if (ls->mFlags & aFlags && ls->mSubType & aSubType) {
             found = PR_TRUE;
             break;
@@ -272,8 +273,6 @@ nsresult nsEventListenerManager::AddEventListener(nsIDOMEventListener *aListener
     }
   }
 
-  NS_IF_RELEASE(sel);
-
   if (!found) {
     ls = PR_NEW(nsListenerStruct);
     if (ls) {
@@ -302,6 +301,8 @@ nsresult nsEventListenerManager::RemoveEventListener(nsIDOMEventListener *aListe
   }
 
   nsListenerStruct* ls;
+  nsresult rv;
+  nsCOMPtr<nsIScriptEventListener> sel = do_QueryInterface(aListener, &rv);
 
   for (int i=0; i<(*listeners)->Count(); i++) {
     ls = (nsListenerStruct*)(*listeners)->ElementAt(i);
@@ -315,6 +316,21 @@ nsresult nsEventListenerManager::RemoveEventListener(nsIDOMEventListener *aListe
       }
       break;
     }
+    else if (sel) {
+      //Listener is an nsIScriptEventListener so we need to use its CheckIfEqual
+      //method to verify equality.
+      nsCOMPtr<nsIScriptEventListener> regSel = do_QueryInterface(ls->mListener, &rv);
+      if (NS_SUCCEEDED(rv) && regSel) {
+        PRBool equal;
+        if (NS_SUCCEEDED(regSel->CheckIfEqual(sel, &equal)) && equal) {
+          if (ls->mFlags & aFlags && ls->mSubType & aSubType) {
+            NS_RELEASE(ls->mListener);
+            (*listeners)->RemoveElement((void*)ls);
+            PR_DELETE(ls);
+          }
+        }
+      }
+    }
   }
 
   return NS_OK;
diff --git a/layout/events/src/nsEventStateManager.cpp b/layout/events/src/nsEventStateManager.cpp
index e375a05482f..5b834fdd64f 100644
--- a/layout/events/src/nsEventStateManager.cpp
+++ b/layout/events/src/nsEventStateManager.cpp
@@ -40,6 +40,9 @@
 #include "nsIDOMHTMLAreaElement.h"
 #include "nsIDOMHTMLButtonElement.h"
 #include "nsIDOMHTMLObjectElement.h"
+#include "nsIDOMHTMLImageElement.h"
+#include "nsIDOMHTMLMapElement.h"
+#include "nsIHTMLDocument.h"
 #include "nsINameSpaceManager.h"  // for kNameSpaceID_HTML
 #include "nsIWebShell.h"
 #include "nsIBaseWindow.h"
@@ -590,7 +593,10 @@ nsEventStateManager::PreHandleEvent(nsIPresContext* aPresContext,
         //Alt key is down, we may need to do an accesskey
         if (mAccessKeys) {
           //Someone registered an accesskey.  Find and activate it.
-          nsVoidKey key((void*)keyEvent->charCode);
+          nsAutoString accKey((char)keyEvent->charCode);
+          accKey.ToLowerCase();
+
+          nsVoidKey key((void*)accKey.First());
           if (mAccessKeys->Exists(&key)) {
             nsCOMPtr<nsIContent> content = getter_AddRefs(NS_STATIC_CAST(nsIContent*, mAccessKeys->Get(&key)));
 
@@ -1467,9 +1473,8 @@ nsEventStateManager::GenerateMouseEnterExit(nsIPresContext* aPresContext, nsGUIE
             targetContent->HandleDOMEvent(aPresContext, &event, nsnull, NS_EVENT_FLAG_INIT, &status); 
           }
         
-          if (nsEventStatus_eConsumeNoDefault != status) {
+          if ( status != nsEventStatus_eConsumeNoDefault )
             SetContentState(targetContent, NS_EVENT_STATE_HOVER);
-          }
 
           //Now dispatch to the frame
           if (mCurrentTarget) {
@@ -1519,9 +1524,8 @@ nsEventStateManager::GenerateMouseEnterExit(nsIPresContext* aPresContext, nsGUIE
           if (mLastMouseOverContent) {
             mLastMouseOverContent->HandleDOMEvent(aPresContext, &event, nsnull, NS_EVENT_FLAG_INIT, &status); 
 
-            if (nsEventStatus_eConsumeNoDefault != status) {
-              SetContentState(nsnull, NS_EVENT_STATE_HOVER);
-            }
+          if ( status != nsEventStatus_eConsumeNoDefault )
+            SetContentState(nsnull, NS_EVENT_STATE_HOVER);
           }
 
 
@@ -1872,20 +1876,28 @@ nsEventStateManager::ShiftFocus(PRBool forward)
   if (mPresContext) {
     nsresult rv = mPresContext->GetShell(getter_AddRefs(shell));
     if (NS_SUCCEEDED(rv) && shell){
-      shell->GetPrimaryFrameFor(mCurrentFocus, &primaryFrame);
+      if (topOfDoc) {
+          primaryFrame = nsnull;
+      }
+      else {
+        shell->GetPrimaryFrameFor(mCurrentFocus, &primaryFrame);
+      }
     }
   }
 
   nsCOMPtr<nsIContent> rootContent = getter_AddRefs(mDocument->GetRootContent());
 
   nsCOMPtr<nsIContent> next;
+  //Get the next tab item.  This takes tabIndex into account
   GetNextTabbableContent(rootContent, primaryFrame, forward, getter_AddRefs(next));
 
+  //Either no tabbable items or the end of the document
   if (!next) {
     PRBool focusTaken = PR_FALSE;
 
     SetContentState(nsnull, NS_EVENT_STATE_FOCUS);
 
+    //Offer focus upwards to allow shifting focus to UI controls
     nsCOMPtr<nsISupports> container;
     mPresContext->GetContainer(getter_AddRefs(container));
     nsCOMPtr<nsIBaseWindow> docShellAsWin(do_QueryInterface(container));
@@ -1893,9 +1905,12 @@ nsEventStateManager::ShiftFocus(PRBool forward)
       docShellAsWin->FocusAvailable(docShellAsWin, &focusTaken);
     }
       
+    //No one took focus and we're not already at the top of the doc
+    //so calling ShiftFocus will start at the top of the doc again.
     if (!focusTaken && !topOfDoc) {
       ShiftFocus(forward);
     }
+
     return;
   }
 
@@ -1913,26 +1928,66 @@ nsEventStateManager::ShiftFocus(PRBool forward)
   NS_IF_ADDREF(mCurrentFocus);
 }
 
-/*
- * At some point this will need to be linked into HTML 4.0 tabindex
- */
-
 NS_IMETHODIMP
 nsEventStateManager::GetNextTabbableContent(nsIContent* aRootContent, nsIFrame* aFrame, PRBool forward,
                                             nsIContent** aResult)
 {
   *aResult = nsnull;
+  PRBool keepFirstFrame = PR_FALSE;
 
   nsCOMPtr<nsIBidirectionalEnumerator> frameTraversal;
+
+  if (!aFrame) {
+    //No frame means we need to start with the root content again.
+    nsCOMPtr<nsIPresShell> presShell;
+    if (mPresContext) {
+      nsIFrame* result = nsnull;
+      if (NS_SUCCEEDED(mPresContext->GetShell(getter_AddRefs(presShell))) && presShell) {
+        presShell->GetPrimaryFrameFor(aRootContent, &result);
+      }
+      if (result) {
+        while(NS_SUCCEEDED(result->FirstChild(mPresContext, nsnull, &result)) && result) {
+          aFrame = result;
+        }
+      }
+    }
+    if (!aFrame) {
+      return NS_ERROR_FAILURE;
+    }
+    keepFirstFrame = PR_TRUE;
+  }
+
+  //Need to do special check in case we're in an imagemap which has multiple content per frame
+  if (mCurrentFocus) {
+    nsCOMPtr<nsIAtom> tag;
+    mCurrentFocus->GetTag(*getter_AddRefs(tag));
+    if(nsHTMLAtoms::area==tag.get()) {
+      //Focus is in an imagemap area
+      nsCOMPtr<nsIPresShell> presShell;
+      if (mPresContext) {
+        nsIFrame* result = nsnull;
+        if (NS_SUCCEEDED(mPresContext->GetShell(getter_AddRefs(presShell))) && presShell) {
+          presShell->GetPrimaryFrameFor(mCurrentFocus, &result);
+        }
+        if (result == aFrame) {
+          //The current focus map area is in the current frame, don't skip over it.
+          keepFirstFrame = PR_TRUE;
+        }
+      }
+    }
+  }
+
   nsresult result = NS_NewFrameTraversal(getter_AddRefs(frameTraversal), EXTENSIVE,
                                          mPresContext, aFrame);
 
   if (NS_FAILED(result))
     return NS_OK;
 
-  if (forward)
-    frameTraversal->Next();
-  else frameTraversal->Prev();
+  if (!keepFirstFrame) {
+    if (forward)
+      frameTraversal->Next();
+    else frameTraversal->Prev();
+  }
 
   nsISupports* currentItem;
   frameTraversal->CurrentItem(&currentItem);
@@ -2009,11 +2064,69 @@ nsEventStateManager::GetNextTabbableContent(nsIContent* aRootContent, nsIFrame*
             nextButton->GetDisabled(&disabled);
           }
         }
-        else if(nsHTMLAtoms::area==tag.get()) {
-          nsCOMPtr<nsIDOMHTMLAreaElement> nextArea(do_QueryInterface(child));
-          if (nextArea)
-            nextArea->GetTabIndex(&tabIndex);
-          disabled = PR_FALSE;
+        else if(nsHTMLAtoms::img==tag.get()) {
+          nsCOMPtr<nsIDOMHTMLImageElement> nextImage(do_QueryInterface(child));
+          nsAutoString usemap;
+          if (nextImage) {
+            nextImage->GetAttribute(NS_ConvertASCIItoUCS2("usemap"), usemap);
+            if (usemap.Length()) {
+              //Image is an imagemap.  We need to get its maps and walk its children.
+              usemap.StripWhitespace();
+
+              nsCOMPtr<nsIDocument> doc;
+              if (NS_SUCCEEDED(child->GetDocument(*getter_AddRefs(doc))) && doc) {
+                if (usemap.First() == '#') {
+                  usemap.Cut(0, 1);
+                }
+
+                nsCOMPtr<nsIHTMLDocument> hdoc(do_QueryInterface(doc));
+                if (hdoc) {
+                  nsCOMPtr<nsIDOMHTMLMapElement> hmap;
+                  if (NS_SUCCEEDED(hdoc->GetImageMap(usemap, getter_AddRefs(hmap))) && hmap) {
+                    nsCOMPtr<nsIContent> map(do_QueryInterface(hmap));
+                    if (map) {
+                      nsCOMPtr<nsIContent> childArea;
+                      PRInt32 count, index;
+                      map->ChildCount(count);
+                      //First see if mCurrentFocus is in this map
+                      for (index = 0; index < count; index++) {
+                        map->ChildAt(index, *getter_AddRefs(childArea));
+                        if (childArea.get() == mCurrentFocus) {
+                          nsAutoString tabIndexStr;
+                          childArea->GetAttribute(kNameSpaceID_HTML, nsHTMLAtoms::tabindex, tabIndexStr);
+                          PRInt32 ec, val = tabIndexStr.ToInteger(&ec);
+                          if (NS_OK == ec && mCurrentTabIndex == val) {
+                            //mCurrentFocus is in this map so we must start iterating past it.
+                            //We skip the case where mCurrentFocus has the same tab index
+                            //as mCurrentTabIndex since the next tab ordered element might
+                            //be before it (or after for backwards) in the child list.
+                            break;
+                          }
+                        }
+                      }
+                      PRInt32 increment = forward ? 1 : - 1;
+                      PRInt32 start = index < count ? index + increment : (forward ? 0 : count - 1);
+                      for (index = start; index < count && index >= 0; index += increment) {
+                        //Iterate over the children.
+                        map->ChildAt(index, *getter_AddRefs(childArea));
+
+                        //Got the map area, check its tabindex.
+                        nsAutoString tabIndexStr;
+                        childArea->GetAttribute(kNameSpaceID_HTML, nsHTMLAtoms::tabindex, tabIndexStr);
+                        PRInt32 ec, val = tabIndexStr.ToInteger(&ec);
+                        if (NS_OK == ec && mCurrentTabIndex == val) {
+                          //tabindex == the current one, use it.
+                          *aResult = childArea;
+                          NS_IF_ADDREF(*aResult);
+                          return NS_OK;
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
         }
         else if(nsHTMLAtoms::object==tag.get()) {
           nsCOMPtr<nsIDOMHTMLObjectElement> nextObject(do_QueryInterface(child));
@@ -2061,7 +2174,7 @@ nsEventStateManager::GetNextTabbableContent(nsIContent* aRootContent, nsIFrame*
   }
   //else continue looking for next highest priority tab
   mCurrentTabIndex = GetNextTabIndex(aRootContent, forward);
-  return GetNextTabbableContent(aRootContent, aFrame, forward, aResult);
+  return GetNextTabbableContent(aRootContent, nsnull, forward, aResult);
 }
 
 PRInt32
@@ -2566,7 +2679,10 @@ nsEventStateManager::RegisterAccessKey(nsIFrame * aFrame, nsIContent* aContent,
   }
 
   if (content) {
-    nsVoidKey key((void*)aKey);
+    nsAutoString accKey((char)aKey);
+    accKey.ToLowerCase();
+
+    nsVoidKey key((void*)accKey.First());
 
     mAccessKeys->Put(&key, content);
   }
@@ -2589,7 +2705,10 @@ nsEventStateManager::UnregisterAccessKey(nsIFrame * aFrame, nsIContent* aContent
     content = aContent;
   }
   if (content) {
-    nsVoidKey key((void*)aKey);
+    nsAutoString accKey((char)aKey);
+    accKey.ToLowerCase();
+
+    nsVoidKey key((void*)accKey.First());
 
     nsCOMPtr<nsIContent> oldContent = getter_AddRefs(NS_STATIC_CAST(nsIContent*, mAccessKeys->Get(&key)));
     if (oldContent != content) {
diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index 9ec38528f48..a06f3fbb8ae 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -756,18 +756,6 @@ nsFrame::HandleEvent(nsIPresContext* aPresContext,
                      nsGUIEvent*     aEvent,
                      nsEventStatus*  aEventStatus)
 {
-  NS_ENSURE_ARG_POINTER(aEventStatus);
-  if (nsEventStatus_eConsumeNoDefault == *aEventStatus) {
-    return NS_OK;
-  }
-
-/*i have no idea why this is here keeping incase..
-  if (DisplaySelection(aPresContext) == PR_FALSE) {
-    if (aEvent->message != NS_MOUSE_LEFT_BUTTON_DOWN) {
-      return NS_OK;
-    }
-  }
-*/
   nsCOMPtr<nsIPresShell> shell;
   nsresult rv = aPresContext->GetShell(getter_AddRefs(shell));
   switch (aEvent->message)
@@ -951,6 +939,11 @@ nsFrame::HandlePress(nsIPresContext* aPresContext,
                      nsGUIEvent*     aEvent,
                      nsEventStatus*  aEventStatus)
 {
+  NS_ENSURE_ARG_POINTER(aEventStatus);
+  if (nsEventStatus_eConsumeNoDefault == *aEventStatus) {
+    return NS_OK;
+  }
+
   // check whether style allows selection
   // if not dont tell selection the mouse event even occured.
   
@@ -1102,6 +1095,11 @@ nsFrame::HandleMultiplePress(nsIPresContext* aPresContext,
                              nsGUIEvent*     aEvent,
                              nsEventStatus*  aEventStatus)
 {
+  NS_ENSURE_ARG_POINTER(aEventStatus);
+  if (nsEventStatus_eConsumeNoDefault == *aEventStatus) {
+    return NS_OK;
+  }
+
   nsresult rv;
   if (DisplaySelection(aPresContext) == nsISelectionController::SELECTION_OFF) {
     return NS_OK;
@@ -1328,58 +1326,61 @@ NS_IMETHODIMP nsFrame::HandleRelease(nsIPresContext* aPresContext,
   if (!frameselection)
     return NS_ERROR_FAILURE;
 
-  PRBool supportsDelay = PR_FALSE;
+  NS_ENSURE_ARG_POINTER(aEventStatus);
+  if (nsEventStatus_eConsumeNoDefault != *aEventStatus) {
+    PRBool supportsDelay = PR_FALSE;
 
-  frameselection->GetDelayCaretOverExistingSelection(&supportsDelay);
+    frameselection->GetDelayCaretOverExistingSelection(&supportsDelay);
 
-  if (supportsDelay)
-  {
-    // Check if the frameselection recorded the mouse going down.
-    // If not, the user must have clicked in a part of the selection.
-    // Place the caret before continuing!
-
-    PRBool mouseDown = PR_FALSE;
-
-    result = frameselection->GetMouseDownState(&mouseDown);
-
-    if (NS_FAILED(result))
-      return result;
-
-    nsMouseEvent *me = 0;
-
-    result = frameselection->GetDelayedCaretData(&me);
-
-    if (NS_SUCCEEDED(result) && !mouseDown && me && me->clickCount < 2)
+    if (supportsDelay)
     {
-      // We are doing this to simulate what we would have done on HandlePress
-      result = frameselection->SetMouseDownState( PR_TRUE );
+      // Check if the frameselection recorded the mouse going down.
+      // If not, the user must have clicked in a part of the selection.
+      // Place the caret before continuing!
 
-      nsCOMPtr<nsIContent> content;
-      PRInt32 startOffset = 0, endOffset = 0;
-      PRBool  beginFrameContent = PR_FALSE;
+      PRBool mouseDown = PR_FALSE;
 
-      result = GetContentAndOffsetsFromPoint(aPresContext, me->point, getter_AddRefs(content), startOffset, endOffset, beginFrameContent);
-      if (NS_FAILED(result)) return result;
+      result = frameselection->GetMouseDownState(&mouseDown);
 
-      result = frameselection->HandleClick(content, startOffset , endOffset, me->isShift, PR_FALSE, beginFrameContent);
-      if (NS_FAILED(result)) return result;
-    }
-    else
-    {
-      me = (nsMouseEvent *)aEvent;
-      nsCOMPtr<nsIContent>parentContent;
-      PRInt32  contentOffset;
-      PRUint32 target;
-      result = GetDataForTableSelection(frameselection, me, getter_AddRefs(parentContent), &contentOffset, &target);
+      if (NS_FAILED(result))
+        return result;
 
-      if (NS_SUCCEEDED(result) && parentContent)
+      nsMouseEvent *me = 0;
+
+      result = frameselection->GetDelayedCaretData(&me);
+
+      if (NS_SUCCEEDED(result) && !mouseDown && me && me->clickCount < 2)
       {
-        frameselection->SetMouseDownState( PR_FALSE );
-        result = frameselection->HandleTableSelection(parentContent, contentOffset, target, me);
+        // We are doing this to simulate what we would have done on HandlePress
+        result = frameselection->SetMouseDownState( PR_TRUE );
+
+        nsCOMPtr<nsIContent> content;
+        PRInt32 startOffset = 0, endOffset = 0;
+        PRBool  beginFrameContent = PR_FALSE;
+
+        result = GetContentAndOffsetsFromPoint(aPresContext, me->point, getter_AddRefs(content), startOffset, endOffset, beginFrameContent);
+        if (NS_FAILED(result)) return result;
+
+        result = frameselection->HandleClick(content, startOffset , endOffset, me->isShift, PR_FALSE, beginFrameContent);
         if (NS_FAILED(result)) return result;
       }
+      else
+      {
+        me = (nsMouseEvent *)aEvent;
+        nsCOMPtr<nsIContent>parentContent;
+        PRInt32  contentOffset;
+        PRUint32 target;
+        result = GetDataForTableSelection(frameselection, me, getter_AddRefs(parentContent), &contentOffset, &target);
+
+        if (NS_SUCCEEDED(result) && parentContent)
+        {
+          frameselection->SetMouseDownState( PR_FALSE );
+          result = frameselection->HandleTableSelection(parentContent, contentOffset, target, me);
+          if (NS_FAILED(result)) return result;
+        }
+      }
+      result = frameselection->SetDelayedCaretData(0);
     }
-    result = frameselection->SetDelayedCaretData(0);
   }
 
   // Now handle the normal HandleRelase business.
diff --git a/layout/generic/nsImageFrame.cpp b/layout/generic/nsImageFrame.cpp
index 86c6c290f00..d061b2cc3d3 100644
--- a/layout/generic/nsImageFrame.cpp
+++ b/layout/generic/nsImageFrame.cpp
@@ -59,8 +59,11 @@ static NS_DEFINE_CID(kIOServiceCID, NS_IOSERVICE_CID);
 #include "nsIStyleSet.h"
 #include "nsLayoutAtoms.h"
 #include "nsISizeOfHandler.h"
+
+#include "nsIFrameManager.h"
 #include "nsIScriptSecurityManager.h"
 
+
 #ifdef DEBUG
 #undef NOISY_IMAGE_LOADING
 #else
@@ -175,6 +178,46 @@ if (NS_CONTENT_ATTR_HAS_VALUE == lowSrcResult && lowSrc.Length() > 0) {
   mImageLoader.Init(this, UpdateImageFrame, (void*)&mImageLoader, baseURL, src);
   NS_IF_RELEASE(baseURL);
 
+  nsAutoString usemap;
+  mContent->GetAttribute(kNameSpaceID_HTML, nsHTMLAtoms::usemap, usemap);    
+  if (usemap.Length()) {
+    //Image is an imagemap.  We need to get its maps and set the primary
+    //frame for its children to us.
+    usemap.StripWhitespace();
+
+    nsCOMPtr<nsIDocument> doc;
+    if (NS_SUCCEEDED(mContent->GetDocument(*getter_AddRefs(doc))) && doc) {
+      if (usemap.First() == '#') {
+        usemap.Cut(0, 1);
+      }
+
+      nsCOMPtr<nsIHTMLDocument> hdoc(do_QueryInterface(doc));
+      if (hdoc) {
+        nsCOMPtr<nsIDOMHTMLMapElement> hmap;
+        if (NS_SUCCEEDED(hdoc->GetImageMap(usemap, getter_AddRefs(hmap))) && hmap) {
+          nsCOMPtr<nsIContent> map(do_QueryInterface(hmap));
+          if (map) {
+            nsCOMPtr<nsIPresShell> presShell;
+            if (NS_SUCCEEDED(aPresContext->GetShell(getter_AddRefs(presShell))) &&
+                presShell) {
+              nsCOMPtr<nsIFrameManager> frameManager;
+              if (NS_SUCCEEDED(presShell->GetFrameManager(getter_AddRefs(frameManager))) &&
+                  frameManager) {
+                nsCOMPtr<nsIContent> childArea;
+                PRInt32 count, index;
+                map->ChildCount(count);
+                for (index = 0; index < count; index++) {
+                  map->ChildAt(index, *getter_AddRefs(childArea));
+                  frameManager->SetPrimaryFrameFor(childArea, this);
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
   mInitialLoadCompleted = PR_FALSE;
   return rv;
 }
@@ -624,6 +667,19 @@ nsImageFrame::Paint(nsIPresContext* aPresContext,
         }
       }
 
+      nsImageMap* map = GetImageMap();
+      if (nsnull != map) {
+        nsRect inner;
+        GetInnerArea(aPresContext, inner);
+        PRBool clipState;
+        aRenderingContext.SetColor(NS_RGB(0, 0, 0));
+        aRenderingContext.SetLineStyle(nsLineStyle_kDotted);
+        aRenderingContext.PushState();
+        aRenderingContext.Translate(inner.x, inner.y);
+        map->Draw(aPresContext, aRenderingContext);
+        aRenderingContext.PopState(clipState);
+      }
+
 #ifdef DEBUG
       if ((NS_FRAME_PAINT_LAYER_DEBUG == aWhichLayer) &&
           GetShowFrameBorders()) {
diff --git a/layout/generic/nsImageMap.cpp b/layout/generic/nsImageMap.cpp
index ebac9f5a1e2..3d76818e076 100644
--- a/layout/generic/nsImageMap.cpp
+++ b/layout/generic/nsImageMap.cpp
@@ -22,7 +22,6 @@
 #include "nsImageMap.h"
 #include "nsString.h"
 #include "nsVoidArray.h"
-#include "nsCoord.h"
 #include "nsIRenderingContext.h"
 #include "nsIPresContext.h"
 #include "nsIURL.h"
@@ -43,6 +42,11 @@
 #include "nsHTMLAtoms.h"
 #include "nsIHTMLContent.h"
 #include "nsHTMLIIDs.h"
+#include "nsIDOMEventReceiver.h"
+#include "nsIPresShell.h"
+#include "nsIFrame.h"
+#include "nsIViewManager.h"
+#include "nsCoord.h"
 
 class Area {
 public:
@@ -54,9 +58,11 @@ public:
   virtual PRBool IsInside(nscoord x, nscoord y) = 0;
   virtual void Draw(nsIPresContext* aCX,
                     nsIRenderingContext& aRC) = 0;
+  virtual void GetRect(nsIPresContext* aCX, nsRect& aRect) = 0;
   virtual void GetShapeName(nsString& aResult) const = 0;
 
   void ToHTML(nsString& aResult);
+  void HasFocus(PRBool aHasFocus);
 
 
   /**
@@ -85,6 +91,7 @@ public:
   PRInt32 mNumCoords;
   PRBool mSuppressFeedback;
   PRBool mHasURL;
+  PRBool mHasFocus;
 };
 
 MOZ_DECL_CTOR_COUNTER(Area);
@@ -96,6 +103,7 @@ Area::Area(nsIContent* aArea,
   MOZ_COUNT_CTOR(Area);
   mCoords = nsnull;
   mNumCoords = 0;
+  mHasFocus = PR_FALSE;
 }
 
 Area::~Area()
@@ -366,6 +374,11 @@ void Area::ToHTML(nsString& aResult)
  * will then be parsed into any number of formats including HTML, TXT, etc.
  */
 
+void Area::HasFocus(PRBool aHasFocus)
+{
+  mHasFocus = aHasFocus;
+}
+
 void Area::BeginConvertToXIF(nsIXIFConverter* aConverter) const
 {
   nsAutoString href, target, altText;
@@ -441,6 +454,7 @@ public:
   virtual PRBool IsInside(nscoord x, nscoord y);
   virtual void Draw(nsIPresContext* aCX,
                     nsIRenderingContext& aRC);
+  virtual void GetRect(nsIPresContext* aCX, nsRect& aRect);
   virtual void GetShapeName(nsString& aResult) const;
 };
 
@@ -462,6 +476,10 @@ void DefaultArea::Draw(nsIPresContext* aCX, nsIRenderingContext& aRC)
 {
 }
 
+void DefaultArea::GetRect(nsIPresContext* aCX, nsRect& aRect)
+{
+}
+
 void DefaultArea::GetShapeName(nsString& aResult) const
 {
   aResult.AppendWithConversion("default");
@@ -477,6 +495,7 @@ public:
   virtual PRBool IsInside(nscoord x, nscoord y);
   virtual void Draw(nsIPresContext* aCX,
                     nsIRenderingContext& aRC);
+  virtual void GetRect(nsIPresContext* aCX, nsRect& aRect);
   virtual void GetShapeName(nsString& aResult) const;
 };
 
@@ -508,6 +527,27 @@ PRBool RectArea::IsInside(nscoord x, nscoord y)
 }
 
 void RectArea::Draw(nsIPresContext* aCX, nsIRenderingContext& aRC)
+{
+  if (mHasFocus) {
+    if (mNumCoords >= 4) {
+      float p2t;
+      aCX->GetPixelsToTwips(&p2t);
+      nscoord x1 = NSIntPixelsToTwips(mCoords[0], p2t);
+      nscoord y1 = NSIntPixelsToTwips(mCoords[1], p2t);
+      nscoord x2 = NSIntPixelsToTwips(mCoords[2], p2t);
+      nscoord y2 = NSIntPixelsToTwips(mCoords[3], p2t);
+      if ((x1 > x2)|| (y1 > y2)) {
+        return;
+      }
+      aRC.DrawLine(x1, y1, x1, y2);
+      aRC.DrawLine(x1, y2, x2, y2);
+      aRC.DrawLine(x1, y1, x2, y1);
+      aRC.DrawLine(x2, y1, x2, y2);
+    }
+  }
+}
+
+void RectArea::GetRect(nsIPresContext* aCX, nsRect& aRect)
 {
   if (mNumCoords >= 4) {
     float p2t;
@@ -519,7 +559,9 @@ void RectArea::Draw(nsIPresContext* aCX, nsIRenderingContext& aRC)
     if ((x1 > x2)|| (y1 > y2)) {
       return;
     }
-    aRC.DrawRect(x1, y1, x2 - x1, y2 - y1);
+
+    nsRect tmp(x1, y1, x2, y2);
+    aRect = tmp;
   }
 }
 
@@ -538,6 +580,7 @@ public:
   virtual PRBool IsInside(nscoord x, nscoord y);
   virtual void Draw(nsIPresContext* aCX,
                     nsIRenderingContext& aRC);
+  virtual void GetRect(nsIPresContext* aCX, nsRect& aRect);
   virtual void GetShapeName(nsString& aResult) const;
 };
 
@@ -613,23 +656,47 @@ PRBool PolyArea::IsInside(nscoord x, nscoord y)
 }
 
 void PolyArea::Draw(nsIPresContext* aCX, nsIRenderingContext& aRC)
+{
+  if (mHasFocus) {
+    if (mNumCoords >= 6) {
+      float p2t;
+      aCX->GetPixelsToTwips(&p2t);
+      nscoord x0 = NSIntPixelsToTwips(mCoords[0], p2t);
+      nscoord y0 = NSIntPixelsToTwips(mCoords[1], p2t);
+      nscoord x1, y1;
+      for (PRInt32 i = 2; i < mNumCoords; i += 2) {
+        x1 = NSIntPixelsToTwips(mCoords[i], p2t);
+        y1 = NSIntPixelsToTwips(mCoords[i+1], p2t);
+        aRC.DrawLine(x0, y0, x1, y1);
+        x0 = x1;
+        y0 = y1;
+      }
+      x1 = NSIntPixelsToTwips(mCoords[0], p2t);
+      y1 = NSIntPixelsToTwips(mCoords[1], p2t);
+      aRC.DrawLine(x0, y0, x1, y1);
+    }
+  }
+}
+
+void PolyArea::GetRect(nsIPresContext* aCX, nsRect& aRect)
 {
   if (mNumCoords >= 6) {
     float p2t;
     aCX->GetPixelsToTwips(&p2t);
-    nscoord x0 = NSIntPixelsToTwips(mCoords[0], p2t);
-    nscoord y0 = NSIntPixelsToTwips(mCoords[1], p2t);
-    nscoord x1, y1;
+    nscoord x1, x2, y1, y2, xtmp, ytmp;
+    x1 = x2 = NSIntPixelsToTwips(mCoords[0], p2t);
+    y1 = y2 = NSIntPixelsToTwips(mCoords[1], p2t);
     for (PRInt32 i = 2; i < mNumCoords; i += 2) {
-      x1 = NSIntPixelsToTwips(mCoords[i], p2t);
-      y1 = NSIntPixelsToTwips(mCoords[i+1], p2t);
-      aRC.DrawLine(x0, y0, x1, y1);
-      x0 = x1;
-      y0 = y1;
+      xtmp = NSIntPixelsToTwips(mCoords[i], p2t);
+      ytmp = NSIntPixelsToTwips(mCoords[i+1], p2t);
+      x1 = x1 < xtmp ? x1 : xtmp;
+      y1 = y1 < ytmp ? y1 : ytmp;
+      x2 = x2 > xtmp ? x2 : xtmp;
+      y2 = y2 > ytmp ? y2 : ytmp;
     }
-    x1 = NSIntPixelsToTwips(mCoords[0], p2t);
-    y1 = NSIntPixelsToTwips(mCoords[1], p2t);
-    aRC.DrawLine(x0, y0, x1, y1);
+
+    nsRect tmp(x1, y1, x2, y2);
+    aRect = tmp;
   }
 }
 
@@ -648,6 +715,7 @@ public:
   virtual PRBool IsInside(nscoord x, nscoord y);
   virtual void Draw(nsIPresContext* aCX,
                     nsIRenderingContext& aRC);
+  virtual void GetRect(nsIPresContext* aCX, nsRect& aRect);
   virtual void GetShapeName(nsString& aResult) const;
 };
 
@@ -681,6 +749,26 @@ PRBool CircleArea::IsInside(nscoord x, nscoord y)
 }
 
 void CircleArea::Draw(nsIPresContext* aCX, nsIRenderingContext& aRC)
+{
+  if (mHasFocus) {
+    if (mNumCoords >= 3) {
+      float p2t;
+      aCX->GetPixelsToTwips(&p2t);
+      nscoord x1 = NSIntPixelsToTwips(mCoords[0], p2t);
+      nscoord y1 = NSIntPixelsToTwips(mCoords[1], p2t);
+      nscoord radius = NSIntPixelsToTwips(mCoords[2], p2t);
+      if (radius < 0) {
+        return;
+      }
+      nscoord x = x1 - radius;
+      nscoord y = y1 - radius;
+      nscoord w = 2 * radius;
+      aRC.DrawEllipse(x, y, w, w);
+    }
+  }
+}
+
+void CircleArea::GetRect(nsIPresContext* aCX, nsRect& aRect)
 {
   if (mNumCoords >= 3) {
     float p2t;
@@ -691,10 +779,9 @@ void CircleArea::Draw(nsIPresContext* aCX, nsIRenderingContext& aRC)
     if (radius < 0) {
       return;
     }
-    nscoord x = x1 - radius;
-    nscoord y = y1 - radius;
-    nscoord w = 2 * radius;
-    aRC.DrawEllipse(x, y, w, w);
+
+    nsRect tmp(x1 - radius, y1 - radius, x1 + radius, y1 + radius);
+    aRect = tmp;
   }
 }
 
@@ -722,6 +809,20 @@ nsImageMap::nsImageMap()
 
 nsImageMap::~nsImageMap()
 {
+  //Remove all our focus listeners
+  PRInt32 i, n = mAreas.Count();
+  for (i = 0; i < n; i++) {
+    Area* area = (Area*) mAreas.ElementAt(i);
+    nsCOMPtr<nsIContent> areaContent;
+    area->GetArea(getter_AddRefs(areaContent));
+    if (areaContent) {
+      nsCOMPtr<nsIDOMEventReceiver> rec(do_QueryInterface(areaContent));
+      if (rec) {
+        rec->RemoveEventListenerByIID(this, NS_GET_IID(nsIDOMFocusListener));
+      }
+    }
+  }
+
   FreeAreas();
   if (nsnull != mDocument) {
     mDocument->RemoveObserver(NS_STATIC_CAST(nsIDocumentObserver*, this));
@@ -731,7 +832,31 @@ nsImageMap::~nsImageMap()
   NS_IF_RELEASE(mMap);
 }
 
-NS_IMPL_ISUPPORTS(nsImageMap, kIDocumentObserverIID);
+NS_IMPL_ADDREF(nsImageMap)
+NS_IMPL_RELEASE(nsImageMap)
+
+NS_IMETHODIMP
+nsImageMap::QueryInterface(REFNSIID iid, void** result)
+{
+  if (! result)
+    return NS_ERROR_NULL_POINTER;
+
+  *result = nsnull;
+  if (iid.Equals(NS_GET_IID(nsISupports)) ||
+      iid.Equals(NS_GET_IID(nsIDocumentObserver))) {
+    *result = NS_STATIC_CAST(nsIDocumentObserver*, this);
+  }
+  else if (iid.Equals(NS_GET_IID(nsIDOMFocusListener)) ||
+           iid.Equals(NS_GET_IID(nsIDOMEventListener))) {
+    *result = NS_STATIC_CAST(nsIDOMFocusListener*, this);
+  }
+  else {
+    return NS_NOINTERFACE;
+  }
+
+  NS_ADDREF_THIS();
+  return NS_OK;
+}
 
 void
 nsImageMap::FreeAreas()
@@ -858,6 +983,12 @@ nsImageMap::AddArea(nsIContent* aArea)
   PRBool hasURL = (PRBool)(NS_CONTENT_ATTR_HAS_VALUE != aArea->GetAttribute(kNameSpaceID_None, nsHTMLAtoms::nohref, noHref));
   PRBool suppress = PR_FALSE;/* XXX */
 
+  //Add focus listener to track area focus changes
+  nsCOMPtr<nsIDOMEventReceiver> rec(do_QueryInterface(aArea));
+  if (rec) {
+    rec->AddEventListenerByIID(this, NS_GET_IID(nsIDOMFocusListener));
+  }
+
   Area* area;
   if ((0 == shape.Length()) ||
       shape.EqualsIgnoreCase("rect") ||
@@ -1181,6 +1312,91 @@ nsImageMap::DocumentWillBeDestroyed(nsIDocument *aDocument)
   return NS_OK;
 }
 
+nsresult
+nsImageMap::Focus(nsIDOMEvent* aEvent)
+{
+  return ChangeFocus(aEvent, PR_TRUE);
+}
+
+nsresult
+nsImageMap::Blur(nsIDOMEvent* aEvent)
+{
+  return ChangeFocus(aEvent, PR_FALSE);
+}
+
+nsresult
+nsImageMap::ChangeFocus(nsIDOMEvent* aEvent, PRBool aFocus) {
+  //Set which one of our areas changed focus
+  nsCOMPtr<nsIDOMEventTarget> target;
+  if (NS_SUCCEEDED(aEvent->GetTarget(getter_AddRefs(target))) && target) {
+    nsCOMPtr<nsIContent> targetContent(do_QueryInterface(target));
+    if (targetContent) {
+      PRInt32 i, n = mAreas.Count();
+      for (i = 0; i < n; i++) {
+        Area* area = (Area*) mAreas.ElementAt(i);
+        nsCOMPtr<nsIContent> areaContent;
+        area->GetArea(getter_AddRefs(areaContent));
+        if (areaContent) {
+          if (areaContent.get() == targetContent.get()) {
+            //Set or Remove internal focus
+            area->HasFocus(aFocus);
+            //Now invalidate the rect
+            nsCOMPtr<nsIDocument> doc;
+            //This check is necessary to see if we're still attached to the doc
+            if (NS_SUCCEEDED(targetContent->GetDocument(*getter_AddRefs(doc))) && doc) {
+              nsCOMPtr<nsIPresShell> presShell = getter_AddRefs(doc->GetShellAt(0));
+              if (presShell) {
+                nsIFrame* imgFrame;
+                if (NS_SUCCEEDED(presShell->GetPrimaryFrameFor(targetContent, &imgFrame)) && imgFrame) {
+                  nsCOMPtr<nsIPresContext> presContext;
+                  if (NS_SUCCEEDED(presShell->GetPresContext(getter_AddRefs(presContext))) && presContext) {
+                    nsRect dmgRect;
+                    area->GetRect(presContext, dmgRect);
+                    Invalidate(presContext, imgFrame, dmgRect);
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+  return NS_OK;
+}
+
+nsresult
+nsImageMap::HandleEvent(nsIDOMEvent* aEvent)
+{
+  return NS_OK;
+}
+
+nsresult
+nsImageMap::Invalidate(nsIPresContext* aPresContext, nsIFrame* aFrame, nsRect& aRect)
+{
+  nsCOMPtr<nsIViewManager> viewManager;
+  PRUint32 flags = NS_VMREFRESH_IMMEDIATE;
+  nsIView* view;
+  nsRect damageRect(aRect);
+
+  aFrame->GetView(aPresContext, &view);
+  if (view) {
+    view->GetViewManager(*getter_AddRefs(viewManager));
+    viewManager->UpdateView(view, damageRect, flags);   
+  }
+  else {
+    nsPoint   offset;
+
+    aFrame->GetOffsetFromView(aPresContext, offset, &view);
+    NS_ASSERTION(nsnull != view, "no view");
+    damageRect += offset;
+    view->GetViewManager(*getter_AddRefs(viewManager));
+    viewManager->UpdateView(view, damageRect, flags);
+  }
+  return NS_OK;
+
+}
+
 #ifdef DEBUG
 void
 nsImageMap::SizeOf(nsISizeOfHandler* aHandler, PRUint32* aResult) const
diff --git a/layout/generic/nsImageMap.h b/layout/generic/nsImageMap.h
index 0cd8951c7b4..975461c3cce 100644
--- a/layout/generic/nsImageMap.h
+++ b/layout/generic/nsImageMap.h
@@ -27,6 +27,8 @@
 #include "nsCoord.h"
 #include "nsVoidArray.h"
 #include "nsIDocumentObserver.h"
+#include "nsIDOMFocusListener.h"
+#include "nsIFrame.h"
 
 class nsIContent;
 class nsIDOMHTMLAreaElement;
@@ -35,8 +37,9 @@ class nsIPresContext;
 class nsIRenderingContext;
 class nsIURI;
 class nsString;
+class nsIDOMEvent;
 
-class nsImageMap : public nsIDocumentObserver
+class nsImageMap : public nsIDocumentObserver, public nsIDOMFocusListener
 {
 public:
   nsImageMap();
@@ -126,6 +129,11 @@ public:
                               nsIStyleRule* aStyleRule);
   NS_IMETHOD DocumentWillBeDestroyed(nsIDocument *aDocument);
 
+  //nsIDOMFocusListener
+  virtual nsresult Focus(nsIDOMEvent* aEvent);
+  virtual nsresult Blur(nsIDOMEvent* aEvent);
+  virtual nsresult HandleEvent(nsIDOMEvent* aEvent);
+
 protected:
   virtual ~nsImageMap();
 
@@ -138,6 +146,9 @@ protected:
                              nsIContent* aAncestorContent);
 
   nsresult AddArea(nsIContent* aArea);
+ 
+  nsresult ChangeFocus(nsIDOMEvent* aEvent, PRBool aFocus);
+  nsresult Invalidate(nsIPresContext* aPresContext, nsIFrame* aFrame, nsRect& aRect);
 
   nsIDocument* mDocument;
   nsIDOMHTMLMapElement* mDomMap;
diff --git a/layout/html/base/src/nsFrame.cpp b/layout/html/base/src/nsFrame.cpp
index 9ec38528f48..a06f3fbb8ae 100644
--- a/layout/html/base/src/nsFrame.cpp
+++ b/layout/html/base/src/nsFrame.cpp
@@ -756,18 +756,6 @@ nsFrame::HandleEvent(nsIPresContext* aPresContext,
                      nsGUIEvent*     aEvent,
                      nsEventStatus*  aEventStatus)
 {
-  NS_ENSURE_ARG_POINTER(aEventStatus);
-  if (nsEventStatus_eConsumeNoDefault == *aEventStatus) {
-    return NS_OK;
-  }
-
-/*i have no idea why this is here keeping incase..
-  if (DisplaySelection(aPresContext) == PR_FALSE) {
-    if (aEvent->message != NS_MOUSE_LEFT_BUTTON_DOWN) {
-      return NS_OK;
-    }
-  }
-*/
   nsCOMPtr<nsIPresShell> shell;
   nsresult rv = aPresContext->GetShell(getter_AddRefs(shell));
   switch (aEvent->message)
@@ -951,6 +939,11 @@ nsFrame::HandlePress(nsIPresContext* aPresContext,
                      nsGUIEvent*     aEvent,
                      nsEventStatus*  aEventStatus)
 {
+  NS_ENSURE_ARG_POINTER(aEventStatus);
+  if (nsEventStatus_eConsumeNoDefault == *aEventStatus) {
+    return NS_OK;
+  }
+
   // check whether style allows selection
   // if not dont tell selection the mouse event even occured.
   
@@ -1102,6 +1095,11 @@ nsFrame::HandleMultiplePress(nsIPresContext* aPresContext,
                              nsGUIEvent*     aEvent,
                              nsEventStatus*  aEventStatus)
 {
+  NS_ENSURE_ARG_POINTER(aEventStatus);
+  if (nsEventStatus_eConsumeNoDefault == *aEventStatus) {
+    return NS_OK;
+  }
+
   nsresult rv;
   if (DisplaySelection(aPresContext) == nsISelectionController::SELECTION_OFF) {
     return NS_OK;
@@ -1328,58 +1326,61 @@ NS_IMETHODIMP nsFrame::HandleRelease(nsIPresContext* aPresContext,
   if (!frameselection)
     return NS_ERROR_FAILURE;
 
-  PRBool supportsDelay = PR_FALSE;
+  NS_ENSURE_ARG_POINTER(aEventStatus);
+  if (nsEventStatus_eConsumeNoDefault != *aEventStatus) {
+    PRBool supportsDelay = PR_FALSE;
 
-  frameselection->GetDelayCaretOverExistingSelection(&supportsDelay);
+    frameselection->GetDelayCaretOverExistingSelection(&supportsDelay);
 
-  if (supportsDelay)
-  {
-    // Check if the frameselection recorded the mouse going down.
-    // If not, the user must have clicked in a part of the selection.
-    // Place the caret before continuing!
-
-    PRBool mouseDown = PR_FALSE;
-
-    result = frameselection->GetMouseDownState(&mouseDown);
-
-    if (NS_FAILED(result))
-      return result;
-
-    nsMouseEvent *me = 0;
-
-    result = frameselection->GetDelayedCaretData(&me);
-
-    if (NS_SUCCEEDED(result) && !mouseDown && me && me->clickCount < 2)
+    if (supportsDelay)
     {
-      // We are doing this to simulate what we would have done on HandlePress
-      result = frameselection->SetMouseDownState( PR_TRUE );
+      // Check if the frameselection recorded the mouse going down.
+      // If not, the user must have clicked in a part of the selection.
+      // Place the caret before continuing!
 
-      nsCOMPtr<nsIContent> content;
-      PRInt32 startOffset = 0, endOffset = 0;
-      PRBool  beginFrameContent = PR_FALSE;
+      PRBool mouseDown = PR_FALSE;
 
-      result = GetContentAndOffsetsFromPoint(aPresContext, me->point, getter_AddRefs(content), startOffset, endOffset, beginFrameContent);
-      if (NS_FAILED(result)) return result;
+      result = frameselection->GetMouseDownState(&mouseDown);
 
-      result = frameselection->HandleClick(content, startOffset , endOffset, me->isShift, PR_FALSE, beginFrameContent);
-      if (NS_FAILED(result)) return result;
-    }
-    else
-    {
-      me = (nsMouseEvent *)aEvent;
-      nsCOMPtr<nsIContent>parentContent;
-      PRInt32  contentOffset;
-      PRUint32 target;
-      result = GetDataForTableSelection(frameselection, me, getter_AddRefs(parentContent), &contentOffset, &target);
+      if (NS_FAILED(result))
+        return result;
 
-      if (NS_SUCCEEDED(result) && parentContent)
+      nsMouseEvent *me = 0;
+
+      result = frameselection->GetDelayedCaretData(&me);
+
+      if (NS_SUCCEEDED(result) && !mouseDown && me && me->clickCount < 2)
       {
-        frameselection->SetMouseDownState( PR_FALSE );
-        result = frameselection->HandleTableSelection(parentContent, contentOffset, target, me);
+        // We are doing this to simulate what we would have done on HandlePress
+        result = frameselection->SetMouseDownState( PR_TRUE );
+
+        nsCOMPtr<nsIContent> content;
+        PRInt32 startOffset = 0, endOffset = 0;
+        PRBool  beginFrameContent = PR_FALSE;
+
+        result = GetContentAndOffsetsFromPoint(aPresContext, me->point, getter_AddRefs(content), startOffset, endOffset, beginFrameContent);
+        if (NS_FAILED(result)) return result;
+
+        result = frameselection->HandleClick(content, startOffset , endOffset, me->isShift, PR_FALSE, beginFrameContent);
         if (NS_FAILED(result)) return result;
       }
+      else
+      {
+        me = (nsMouseEvent *)aEvent;
+        nsCOMPtr<nsIContent>parentContent;
+        PRInt32  contentOffset;
+        PRUint32 target;
+        result = GetDataForTableSelection(frameselection, me, getter_AddRefs(parentContent), &contentOffset, &target);
+
+        if (NS_SUCCEEDED(result) && parentContent)
+        {
+          frameselection->SetMouseDownState( PR_FALSE );
+          result = frameselection->HandleTableSelection(parentContent, contentOffset, target, me);
+          if (NS_FAILED(result)) return result;
+        }
+      }
+      result = frameselection->SetDelayedCaretData(0);
     }
-    result = frameselection->SetDelayedCaretData(0);
   }
 
   // Now handle the normal HandleRelase business.
diff --git a/layout/html/base/src/nsImageFrame.cpp b/layout/html/base/src/nsImageFrame.cpp
index 86c6c290f00..d061b2cc3d3 100644
--- a/layout/html/base/src/nsImageFrame.cpp
+++ b/layout/html/base/src/nsImageFrame.cpp
@@ -59,8 +59,11 @@ static NS_DEFINE_CID(kIOServiceCID, NS_IOSERVICE_CID);
 #include "nsIStyleSet.h"
 #include "nsLayoutAtoms.h"
 #include "nsISizeOfHandler.h"
+
+#include "nsIFrameManager.h"
 #include "nsIScriptSecurityManager.h"
 
+
 #ifdef DEBUG
 #undef NOISY_IMAGE_LOADING
 #else
@@ -175,6 +178,46 @@ if (NS_CONTENT_ATTR_HAS_VALUE == lowSrcResult && lowSrc.Length() > 0) {
   mImageLoader.Init(this, UpdateImageFrame, (void*)&mImageLoader, baseURL, src);
   NS_IF_RELEASE(baseURL);
 
+  nsAutoString usemap;
+  mContent->GetAttribute(kNameSpaceID_HTML, nsHTMLAtoms::usemap, usemap);    
+  if (usemap.Length()) {
+    //Image is an imagemap.  We need to get its maps and set the primary
+    //frame for its children to us.
+    usemap.StripWhitespace();
+
+    nsCOMPtr<nsIDocument> doc;
+    if (NS_SUCCEEDED(mContent->GetDocument(*getter_AddRefs(doc))) && doc) {
+      if (usemap.First() == '#') {
+        usemap.Cut(0, 1);
+      }
+
+      nsCOMPtr<nsIHTMLDocument> hdoc(do_QueryInterface(doc));
+      if (hdoc) {
+        nsCOMPtr<nsIDOMHTMLMapElement> hmap;
+        if (NS_SUCCEEDED(hdoc->GetImageMap(usemap, getter_AddRefs(hmap))) && hmap) {
+          nsCOMPtr<nsIContent> map(do_QueryInterface(hmap));
+          if (map) {
+            nsCOMPtr<nsIPresShell> presShell;
+            if (NS_SUCCEEDED(aPresContext->GetShell(getter_AddRefs(presShell))) &&
+                presShell) {
+              nsCOMPtr<nsIFrameManager> frameManager;
+              if (NS_SUCCEEDED(presShell->GetFrameManager(getter_AddRefs(frameManager))) &&
+                  frameManager) {
+                nsCOMPtr<nsIContent> childArea;
+                PRInt32 count, index;
+                map->ChildCount(count);
+                for (index = 0; index < count; index++) {
+                  map->ChildAt(index, *getter_AddRefs(childArea));
+                  frameManager->SetPrimaryFrameFor(childArea, this);
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
   mInitialLoadCompleted = PR_FALSE;
   return rv;
 }
@@ -624,6 +667,19 @@ nsImageFrame::Paint(nsIPresContext* aPresContext,
         }
       }
 
+      nsImageMap* map = GetImageMap();
+      if (nsnull != map) {
+        nsRect inner;
+        GetInnerArea(aPresContext, inner);
+        PRBool clipState;
+        aRenderingContext.SetColor(NS_RGB(0, 0, 0));
+        aRenderingContext.SetLineStyle(nsLineStyle_kDotted);
+        aRenderingContext.PushState();
+        aRenderingContext.Translate(inner.x, inner.y);
+        map->Draw(aPresContext, aRenderingContext);
+        aRenderingContext.PopState(clipState);
+      }
+
 #ifdef DEBUG
       if ((NS_FRAME_PAINT_LAYER_DEBUG == aWhichLayer) &&
           GetShowFrameBorders()) {
diff --git a/layout/html/base/src/nsImageMap.cpp b/layout/html/base/src/nsImageMap.cpp
index ebac9f5a1e2..3d76818e076 100644
--- a/layout/html/base/src/nsImageMap.cpp
+++ b/layout/html/base/src/nsImageMap.cpp
@@ -22,7 +22,6 @@
 #include "nsImageMap.h"
 #include "nsString.h"
 #include "nsVoidArray.h"
-#include "nsCoord.h"
 #include "nsIRenderingContext.h"
 #include "nsIPresContext.h"
 #include "nsIURL.h"
@@ -43,6 +42,11 @@
 #include "nsHTMLAtoms.h"
 #include "nsIHTMLContent.h"
 #include "nsHTMLIIDs.h"
+#include "nsIDOMEventReceiver.h"
+#include "nsIPresShell.h"
+#include "nsIFrame.h"
+#include "nsIViewManager.h"
+#include "nsCoord.h"
 
 class Area {
 public:
@@ -54,9 +58,11 @@ public:
   virtual PRBool IsInside(nscoord x, nscoord y) = 0;
   virtual void Draw(nsIPresContext* aCX,
                     nsIRenderingContext& aRC) = 0;
+  virtual void GetRect(nsIPresContext* aCX, nsRect& aRect) = 0;
   virtual void GetShapeName(nsString& aResult) const = 0;
 
   void ToHTML(nsString& aResult);
+  void HasFocus(PRBool aHasFocus);
 
 
   /**
@@ -85,6 +91,7 @@ public:
   PRInt32 mNumCoords;
   PRBool mSuppressFeedback;
   PRBool mHasURL;
+  PRBool mHasFocus;
 };
 
 MOZ_DECL_CTOR_COUNTER(Area);
@@ -96,6 +103,7 @@ Area::Area(nsIContent* aArea,
   MOZ_COUNT_CTOR(Area);
   mCoords = nsnull;
   mNumCoords = 0;
+  mHasFocus = PR_FALSE;
 }
 
 Area::~Area()
@@ -366,6 +374,11 @@ void Area::ToHTML(nsString& aResult)
  * will then be parsed into any number of formats including HTML, TXT, etc.
  */
 
+void Area::HasFocus(PRBool aHasFocus)
+{
+  mHasFocus = aHasFocus;
+}
+
 void Area::BeginConvertToXIF(nsIXIFConverter* aConverter) const
 {
   nsAutoString href, target, altText;
@@ -441,6 +454,7 @@ public:
   virtual PRBool IsInside(nscoord x, nscoord y);
   virtual void Draw(nsIPresContext* aCX,
                     nsIRenderingContext& aRC);
+  virtual void GetRect(nsIPresContext* aCX, nsRect& aRect);
   virtual void GetShapeName(nsString& aResult) const;
 };
 
@@ -462,6 +476,10 @@ void DefaultArea::Draw(nsIPresContext* aCX, nsIRenderingContext& aRC)
 {
 }
 
+void DefaultArea::GetRect(nsIPresContext* aCX, nsRect& aRect)
+{
+}
+
 void DefaultArea::GetShapeName(nsString& aResult) const
 {
   aResult.AppendWithConversion("default");
@@ -477,6 +495,7 @@ public:
   virtual PRBool IsInside(nscoord x, nscoord y);
   virtual void Draw(nsIPresContext* aCX,
                     nsIRenderingContext& aRC);
+  virtual void GetRect(nsIPresContext* aCX, nsRect& aRect);
   virtual void GetShapeName(nsString& aResult) const;
 };
 
@@ -508,6 +527,27 @@ PRBool RectArea::IsInside(nscoord x, nscoord y)
 }
 
 void RectArea::Draw(nsIPresContext* aCX, nsIRenderingContext& aRC)
+{
+  if (mHasFocus) {
+    if (mNumCoords >= 4) {
+      float p2t;
+      aCX->GetPixelsToTwips(&p2t);
+      nscoord x1 = NSIntPixelsToTwips(mCoords[0], p2t);
+      nscoord y1 = NSIntPixelsToTwips(mCoords[1], p2t);
+      nscoord x2 = NSIntPixelsToTwips(mCoords[2], p2t);
+      nscoord y2 = NSIntPixelsToTwips(mCoords[3], p2t);
+      if ((x1 > x2)|| (y1 > y2)) {
+        return;
+      }
+      aRC.DrawLine(x1, y1, x1, y2);
+      aRC.DrawLine(x1, y2, x2, y2);
+      aRC.DrawLine(x1, y1, x2, y1);
+      aRC.DrawLine(x2, y1, x2, y2);
+    }
+  }
+}
+
+void RectArea::GetRect(nsIPresContext* aCX, nsRect& aRect)
 {
   if (mNumCoords >= 4) {
     float p2t;
@@ -519,7 +559,9 @@ void RectArea::Draw(nsIPresContext* aCX, nsIRenderingContext& aRC)
     if ((x1 > x2)|| (y1 > y2)) {
       return;
     }
-    aRC.DrawRect(x1, y1, x2 - x1, y2 - y1);
+
+    nsRect tmp(x1, y1, x2, y2);
+    aRect = tmp;
   }
 }
 
@@ -538,6 +580,7 @@ public:
   virtual PRBool IsInside(nscoord x, nscoord y);
   virtual void Draw(nsIPresContext* aCX,
                     nsIRenderingContext& aRC);
+  virtual void GetRect(nsIPresContext* aCX, nsRect& aRect);
   virtual void GetShapeName(nsString& aResult) const;
 };
 
@@ -613,23 +656,47 @@ PRBool PolyArea::IsInside(nscoord x, nscoord y)
 }
 
 void PolyArea::Draw(nsIPresContext* aCX, nsIRenderingContext& aRC)
+{
+  if (mHasFocus) {
+    if (mNumCoords >= 6) {
+      float p2t;
+      aCX->GetPixelsToTwips(&p2t);
+      nscoord x0 = NSIntPixelsToTwips(mCoords[0], p2t);
+      nscoord y0 = NSIntPixelsToTwips(mCoords[1], p2t);
+      nscoord x1, y1;
+      for (PRInt32 i = 2; i < mNumCoords; i += 2) {
+        x1 = NSIntPixelsToTwips(mCoords[i], p2t);
+        y1 = NSIntPixelsToTwips(mCoords[i+1], p2t);
+        aRC.DrawLine(x0, y0, x1, y1);
+        x0 = x1;
+        y0 = y1;
+      }
+      x1 = NSIntPixelsToTwips(mCoords[0], p2t);
+      y1 = NSIntPixelsToTwips(mCoords[1], p2t);
+      aRC.DrawLine(x0, y0, x1, y1);
+    }
+  }
+}
+
+void PolyArea::GetRect(nsIPresContext* aCX, nsRect& aRect)
 {
   if (mNumCoords >= 6) {
     float p2t;
     aCX->GetPixelsToTwips(&p2t);
-    nscoord x0 = NSIntPixelsToTwips(mCoords[0], p2t);
-    nscoord y0 = NSIntPixelsToTwips(mCoords[1], p2t);
-    nscoord x1, y1;
+    nscoord x1, x2, y1, y2, xtmp, ytmp;
+    x1 = x2 = NSIntPixelsToTwips(mCoords[0], p2t);
+    y1 = y2 = NSIntPixelsToTwips(mCoords[1], p2t);
     for (PRInt32 i = 2; i < mNumCoords; i += 2) {
-      x1 = NSIntPixelsToTwips(mCoords[i], p2t);
-      y1 = NSIntPixelsToTwips(mCoords[i+1], p2t);
-      aRC.DrawLine(x0, y0, x1, y1);
-      x0 = x1;
-      y0 = y1;
+      xtmp = NSIntPixelsToTwips(mCoords[i], p2t);
+      ytmp = NSIntPixelsToTwips(mCoords[i+1], p2t);
+      x1 = x1 < xtmp ? x1 : xtmp;
+      y1 = y1 < ytmp ? y1 : ytmp;
+      x2 = x2 > xtmp ? x2 : xtmp;
+      y2 = y2 > ytmp ? y2 : ytmp;
     }
-    x1 = NSIntPixelsToTwips(mCoords[0], p2t);
-    y1 = NSIntPixelsToTwips(mCoords[1], p2t);
-    aRC.DrawLine(x0, y0, x1, y1);
+
+    nsRect tmp(x1, y1, x2, y2);
+    aRect = tmp;
   }
 }
 
@@ -648,6 +715,7 @@ public:
   virtual PRBool IsInside(nscoord x, nscoord y);
   virtual void Draw(nsIPresContext* aCX,
                     nsIRenderingContext& aRC);
+  virtual void GetRect(nsIPresContext* aCX, nsRect& aRect);
   virtual void GetShapeName(nsString& aResult) const;
 };
 
@@ -681,6 +749,26 @@ PRBool CircleArea::IsInside(nscoord x, nscoord y)
 }
 
 void CircleArea::Draw(nsIPresContext* aCX, nsIRenderingContext& aRC)
+{
+  if (mHasFocus) {
+    if (mNumCoords >= 3) {
+      float p2t;
+      aCX->GetPixelsToTwips(&p2t);
+      nscoord x1 = NSIntPixelsToTwips(mCoords[0], p2t);
+      nscoord y1 = NSIntPixelsToTwips(mCoords[1], p2t);
+      nscoord radius = NSIntPixelsToTwips(mCoords[2], p2t);
+      if (radius < 0) {
+        return;
+      }
+      nscoord x = x1 - radius;
+      nscoord y = y1 - radius;
+      nscoord w = 2 * radius;
+      aRC.DrawEllipse(x, y, w, w);
+    }
+  }
+}
+
+void CircleArea::GetRect(nsIPresContext* aCX, nsRect& aRect)
 {
   if (mNumCoords >= 3) {
     float p2t;
@@ -691,10 +779,9 @@ void CircleArea::Draw(nsIPresContext* aCX, nsIRenderingContext& aRC)
     if (radius < 0) {
       return;
     }
-    nscoord x = x1 - radius;
-    nscoord y = y1 - radius;
-    nscoord w = 2 * radius;
-    aRC.DrawEllipse(x, y, w, w);
+
+    nsRect tmp(x1 - radius, y1 - radius, x1 + radius, y1 + radius);
+    aRect = tmp;
   }
 }
 
@@ -722,6 +809,20 @@ nsImageMap::nsImageMap()
 
 nsImageMap::~nsImageMap()
 {
+  //Remove all our focus listeners
+  PRInt32 i, n = mAreas.Count();
+  for (i = 0; i < n; i++) {
+    Area* area = (Area*) mAreas.ElementAt(i);
+    nsCOMPtr<nsIContent> areaContent;
+    area->GetArea(getter_AddRefs(areaContent));
+    if (areaContent) {
+      nsCOMPtr<nsIDOMEventReceiver> rec(do_QueryInterface(areaContent));
+      if (rec) {
+        rec->RemoveEventListenerByIID(this, NS_GET_IID(nsIDOMFocusListener));
+      }
+    }
+  }
+
   FreeAreas();
   if (nsnull != mDocument) {
     mDocument->RemoveObserver(NS_STATIC_CAST(nsIDocumentObserver*, this));
@@ -731,7 +832,31 @@ nsImageMap::~nsImageMap()
   NS_IF_RELEASE(mMap);
 }
 
-NS_IMPL_ISUPPORTS(nsImageMap, kIDocumentObserverIID);
+NS_IMPL_ADDREF(nsImageMap)
+NS_IMPL_RELEASE(nsImageMap)
+
+NS_IMETHODIMP
+nsImageMap::QueryInterface(REFNSIID iid, void** result)
+{
+  if (! result)
+    return NS_ERROR_NULL_POINTER;
+
+  *result = nsnull;
+  if (iid.Equals(NS_GET_IID(nsISupports)) ||
+      iid.Equals(NS_GET_IID(nsIDocumentObserver))) {
+    *result = NS_STATIC_CAST(nsIDocumentObserver*, this);
+  }
+  else if (iid.Equals(NS_GET_IID(nsIDOMFocusListener)) ||
+           iid.Equals(NS_GET_IID(nsIDOMEventListener))) {
+    *result = NS_STATIC_CAST(nsIDOMFocusListener*, this);
+  }
+  else {
+    return NS_NOINTERFACE;
+  }
+
+  NS_ADDREF_THIS();
+  return NS_OK;
+}
 
 void
 nsImageMap::FreeAreas()
@@ -858,6 +983,12 @@ nsImageMap::AddArea(nsIContent* aArea)
   PRBool hasURL = (PRBool)(NS_CONTENT_ATTR_HAS_VALUE != aArea->GetAttribute(kNameSpaceID_None, nsHTMLAtoms::nohref, noHref));
   PRBool suppress = PR_FALSE;/* XXX */
 
+  //Add focus listener to track area focus changes
+  nsCOMPtr<nsIDOMEventReceiver> rec(do_QueryInterface(aArea));
+  if (rec) {
+    rec->AddEventListenerByIID(this, NS_GET_IID(nsIDOMFocusListener));
+  }
+
   Area* area;
   if ((0 == shape.Length()) ||
       shape.EqualsIgnoreCase("rect") ||
@@ -1181,6 +1312,91 @@ nsImageMap::DocumentWillBeDestroyed(nsIDocument *aDocument)
   return NS_OK;
 }
 
+nsresult
+nsImageMap::Focus(nsIDOMEvent* aEvent)
+{
+  return ChangeFocus(aEvent, PR_TRUE);
+}
+
+nsresult
+nsImageMap::Blur(nsIDOMEvent* aEvent)
+{
+  return ChangeFocus(aEvent, PR_FALSE);
+}
+
+nsresult
+nsImageMap::ChangeFocus(nsIDOMEvent* aEvent, PRBool aFocus) {
+  //Set which one of our areas changed focus
+  nsCOMPtr<nsIDOMEventTarget> target;
+  if (NS_SUCCEEDED(aEvent->GetTarget(getter_AddRefs(target))) && target) {
+    nsCOMPtr<nsIContent> targetContent(do_QueryInterface(target));
+    if (targetContent) {
+      PRInt32 i, n = mAreas.Count();
+      for (i = 0; i < n; i++) {
+        Area* area = (Area*) mAreas.ElementAt(i);
+        nsCOMPtr<nsIContent> areaContent;
+        area->GetArea(getter_AddRefs(areaContent));
+        if (areaContent) {
+          if (areaContent.get() == targetContent.get()) {
+            //Set or Remove internal focus
+            area->HasFocus(aFocus);
+            //Now invalidate the rect
+            nsCOMPtr<nsIDocument> doc;
+            //This check is necessary to see if we're still attached to the doc
+            if (NS_SUCCEEDED(targetContent->GetDocument(*getter_AddRefs(doc))) && doc) {
+              nsCOMPtr<nsIPresShell> presShell = getter_AddRefs(doc->GetShellAt(0));
+              if (presShell) {
+                nsIFrame* imgFrame;
+                if (NS_SUCCEEDED(presShell->GetPrimaryFrameFor(targetContent, &imgFrame)) && imgFrame) {
+                  nsCOMPtr<nsIPresContext> presContext;
+                  if (NS_SUCCEEDED(presShell->GetPresContext(getter_AddRefs(presContext))) && presContext) {
+                    nsRect dmgRect;
+                    area->GetRect(presContext, dmgRect);
+                    Invalidate(presContext, imgFrame, dmgRect);
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+  return NS_OK;
+}
+
+nsresult
+nsImageMap::HandleEvent(nsIDOMEvent* aEvent)
+{
+  return NS_OK;
+}
+
+nsresult
+nsImageMap::Invalidate(nsIPresContext* aPresContext, nsIFrame* aFrame, nsRect& aRect)
+{
+  nsCOMPtr<nsIViewManager> viewManager;
+  PRUint32 flags = NS_VMREFRESH_IMMEDIATE;
+  nsIView* view;
+  nsRect damageRect(aRect);
+
+  aFrame->GetView(aPresContext, &view);
+  if (view) {
+    view->GetViewManager(*getter_AddRefs(viewManager));
+    viewManager->UpdateView(view, damageRect, flags);   
+  }
+  else {
+    nsPoint   offset;
+
+    aFrame->GetOffsetFromView(aPresContext, offset, &view);
+    NS_ASSERTION(nsnull != view, "no view");
+    damageRect += offset;
+    view->GetViewManager(*getter_AddRefs(viewManager));
+    viewManager->UpdateView(view, damageRect, flags);
+  }
+  return NS_OK;
+
+}
+
 #ifdef DEBUG
 void
 nsImageMap::SizeOf(nsISizeOfHandler* aHandler, PRUint32* aResult) const
diff --git a/layout/html/base/src/nsImageMap.h b/layout/html/base/src/nsImageMap.h
index 0cd8951c7b4..975461c3cce 100644
--- a/layout/html/base/src/nsImageMap.h
+++ b/layout/html/base/src/nsImageMap.h
@@ -27,6 +27,8 @@
 #include "nsCoord.h"
 #include "nsVoidArray.h"
 #include "nsIDocumentObserver.h"
+#include "nsIDOMFocusListener.h"
+#include "nsIFrame.h"
 
 class nsIContent;
 class nsIDOMHTMLAreaElement;
@@ -35,8 +37,9 @@ class nsIPresContext;
 class nsIRenderingContext;
 class nsIURI;
 class nsString;
+class nsIDOMEvent;
 
-class nsImageMap : public nsIDocumentObserver
+class nsImageMap : public nsIDocumentObserver, public nsIDOMFocusListener
 {
 public:
   nsImageMap();
@@ -126,6 +129,11 @@ public:
                               nsIStyleRule* aStyleRule);
   NS_IMETHOD DocumentWillBeDestroyed(nsIDocument *aDocument);
 
+  //nsIDOMFocusListener
+  virtual nsresult Focus(nsIDOMEvent* aEvent);
+  virtual nsresult Blur(nsIDOMEvent* aEvent);
+  virtual nsresult HandleEvent(nsIDOMEvent* aEvent);
+
 protected:
   virtual ~nsImageMap();
 
@@ -138,6 +146,9 @@ protected:
                              nsIContent* aAncestorContent);
 
   nsresult AddArea(nsIContent* aArea);
+ 
+  nsresult ChangeFocus(nsIDOMEvent* aEvent, PRBool aFocus);
+  nsresult Invalidate(nsIPresContext* aPresContext, nsIFrame* aFrame, nsRect& aRect);
 
   nsIDocument* mDocument;
   nsIDOMHTMLMapElement* mDomMap;
diff --git a/layout/html/base/src/nsPresShell.cpp b/layout/html/base/src/nsPresShell.cpp
index 482cc40cac1..195782b02d6 100644
--- a/layout/html/base/src/nsPresShell.cpp
+++ b/layout/html/base/src/nsPresShell.cpp
@@ -710,6 +710,7 @@ public:
   NS_IMETHOD HandleEvent(nsIView*        aView,
                          nsGUIEvent*     aEvent,
                          nsEventStatus*  aEventStatus,
+  											 PRBool          aForceHandle,
                          PRBool&         aHandled);
   NS_IMETHOD HandleDOMEventWithTarget(nsIContent* aTargetContent,
                             nsEvent* aEvent,
@@ -3845,6 +3846,7 @@ NS_IMETHODIMP
 PresShell::HandleEvent(nsIView         *aView,
                        nsGUIEvent*     aEvent,
                        nsEventStatus*  aEventStatus,
+											 PRBool          aForceHandle,
                        PRBool&         aHandled)
 {
   void*     clientData;
@@ -3853,7 +3855,7 @@ PresShell::HandleEvent(nsIView         *aView,
   
   NS_ASSERTION(!(nsnull == aView), "null view");
 
-  aHandled = PR_TRUE;  // XXX Is this right?
+  aHandled = PR_TRUE;
 
   if (mIsDestroying || mIsReflowing) {
     return NS_OK;
@@ -3903,7 +3905,6 @@ PresShell::HandleEvent(nsIView         *aView,
             if (rv != NS_OK) {
               rv = frame->GetFrameForPoint(mPresContext, eventPoint, NS_FRAME_PAINT_LAYER_BACKGROUND, &mCurrentEventFrame);
               if (rv != NS_OK) {
-                // XXX Is this the right thing to do?
 #ifdef XP_MAC
                 // On the Mac it is possible to be running with no windows open, only the native menu bar.
                 // In this situation, we need to handle key board events but there are no frames, so
@@ -3911,7 +3912,12 @@ PresShell::HandleEvent(nsIView         *aView,
                 mCurrentEventContent = mDocument->GetRootContent();
                 mCurrentEventFrame = nsnull;
 #else
-                mCurrentEventFrame = frame;
+								if (aForceHandle) {
+									mCurrentEventFrame = frame;
+								}
+								else {
+									mCurrentEventFrame = nsnull;
+								}
                 aHandled = PR_FALSE;
 #endif
                 rv = NS_OK;
@@ -3934,9 +3940,12 @@ PresShell::HandleEvent(nsIView         *aView,
           if (rv != NS_OK) {
             rv = frame->GetFrameForPoint(mPresContext, eventPoint, NS_FRAME_PAINT_LAYER_BACKGROUND, &mCurrentEventFrame);
             if (rv != NS_OK) {
-              // XXX Is this the right thing to do? NO IT ISNT!
-              mCurrentEventFrame = frame;
-              //mCurrentEventFrame = nsnull;
+							if (aForceHandle) {
+								mCurrentEventFrame = frame;
+							}
+							else {
+								mCurrentEventFrame = nsnull;
+							}
               aHandled = PR_FALSE;
               rv = NS_OK;
             }
diff --git a/layout/html/content/src/nsGenericHTMLElement.cpp b/layout/html/content/src/nsGenericHTMLElement.cpp
index 904a0026ab7..ae6d2adcad2 100644
--- a/layout/html/content/src/nsGenericHTMLElement.cpp
+++ b/layout/html/content/src/nsGenericHTMLElement.cpp
@@ -1178,7 +1178,10 @@ nsGenericHTMLElement::HandleDOMEventForAnchors(nsIContent* aOuter,
           stateManager->SetContentState(mContent, NS_EVENT_STATE_HOVER);
           NS_RELEASE(stateManager);
         }
-
+      }
+      // Set the status bar the same for focus and mouseover
+      case NS_FOCUS_CONTENT:
+      {
         nsAutoString target;
         nsIURI* baseURL = nsnull;
         GetBaseURL(baseURL);
diff --git a/layout/html/content/src/nsHTMLAreaElement.cpp b/layout/html/content/src/nsHTMLAreaElement.cpp
index 5bf9b314b47..22b4903fddc 100644
--- a/layout/html/content/src/nsHTMLAreaElement.cpp
+++ b/layout/html/content/src/nsHTMLAreaElement.cpp
@@ -263,15 +263,17 @@ nsHTMLAreaElement::SetFocus(nsIPresContext* aPresContext)
     esm->SetContentState(this, NS_EVENT_STATE_FOCUS);
     NS_RELEASE(esm);
   }
-
-  // XXX write me
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsHTMLAreaElement::RemoveFocus(nsIPresContext* aPresContext)
 {
-  // XXX write me
+  nsIEventStateManager* esm;
+  if (NS_OK == aPresContext->GetEventStateManager(&esm)) {
+    esm->SetContentState(nsnull, NS_EVENT_STATE_FOCUS);
+    NS_RELEASE(esm);
+  }
   return NS_OK;
 }
 
diff --git a/layout/html/content/src/nsHTMLImageElement.cpp b/layout/html/content/src/nsHTMLImageElement.cpp
index 1a87ddcdc3b..43b233c8a95 100644
--- a/layout/html/content/src/nsHTMLImageElement.cpp
+++ b/layout/html/content/src/nsHTMLImageElement.cpp
@@ -723,12 +723,19 @@ nsHTMLImageElement::SetProperty(JSContext *aContext, JSObject *aObj, jsval aID,
         }
       }
     }
+    else {
+      result = mInner.SetProperty(aContext, aObj, aID, aVp);
+    }
   }
   else {
     result = mInner.SetProperty(aContext, aObj, aID, aVp);
   }
   
-  return (result == NS_OK);
+  if (NS_FAILED(result)) {
+    return PR_FALSE;
+  }
+
+  return PR_TRUE;
 }
 
 PRBool    
diff --git a/layout/html/document/src/html.css b/layout/html/document/src/html.css
index ada8d51341b..7418b32f59f 100644
--- a/layout/html/document/src/html.css
+++ b/layout/html/document/src/html.css
@@ -419,6 +419,7 @@ img[usemap], object[usemap] {
 }
 img[usemap], object[usemap] {
   color: blue;
+  user-focus: normal;
 }
 img:-moz-text {
   /* font-family: sans-serif; */
diff --git a/layout/html/document/src/nsHTMLDocument.cpp b/layout/html/document/src/nsHTMLDocument.cpp
index 9c3ffa81847..a6abc13e0a4 100644
--- a/layout/html/document/src/nsHTMLDocument.cpp
+++ b/layout/html/document/src/nsHTMLDocument.cpp
@@ -1938,6 +1938,15 @@ nsHTMLDocument::OpenCommon(nsIURI* aSourceURL)
 
     result = NS_OpenURI(getter_AddRefs(channel), aSourceURL, nsnull, group);
     if (NS_FAILED(result)) return result;
+
+    //Before we reset the doc notify the globalwindow of the change.
+    if (mScriptGlobalObject) {
+      //Hold onto ourselves on the offchance that we're down to one ref
+      nsCOMPtr<nsIDOMDocument> kungFuDeathGrip (do_QueryInterface((nsIHTMLDocument*)this));
+      result = mScriptGlobalObject->SetNewDocument(kungFuDeathGrip);
+      if (NS_FAILED(result)) return result;
+    }
+
     result = Reset(channel, group);
     if (NS_FAILED(result)) return result;
     if (NS_OK == result) {
diff --git a/layout/style/html.css b/layout/style/html.css
index ada8d51341b..7418b32f59f 100644
--- a/layout/style/html.css
+++ b/layout/style/html.css
@@ -419,6 +419,7 @@ img[usemap], object[usemap] {
 }
 img[usemap], object[usemap] {
   color: blue;
+  user-focus: normal;
 }
 img:-moz-text {
   /* font-family: sans-serif; */
diff --git a/mailnews/addrbook/resources/content/abMailListDialog.js b/mailnews/addrbook/resources/content/abMailListDialog.js
index d203a0c77b5..d80dfc987e6 100644
--- a/mailnews/addrbook/resources/content/abMailListDialog.js
+++ b/mailnews/addrbook/resources/content/abMailListDialog.js
@@ -29,7 +29,7 @@ var hitReturnInList = false;
 
 function handleKeyPress(element, event)
 {
-	if (event.which == 13) 
+	if (event.keyCode == 13) 
 	{
 		hitReturnInList = true;
 		awReturnHit(element);
diff --git a/mailnews/compose/resources/content/addressingWidgetOverlay.xul b/mailnews/compose/resources/content/addressingWidgetOverlay.xul
index b9eaeea22bc..0da72a935d7 100644
--- a/mailnews/compose/resources/content/addressingWidgetOverlay.xul
+++ b/mailnews/compose/resources/content/addressingWidgetOverlay.xul
@@ -72,7 +72,7 @@ Rights Reserved.
 											style="width:0px"
 											onkeypress="if (event.keyCode == 13)
 															awReturnHit(this);
-														else if (event.which == 9)
+														else if (event.keyCode == 9)
 															awTabFromRecipient(this, event);
 														"
 											onchange="contentChanged=true;"
diff --git a/mailnews/compose/resources/content/messengercompose.xul b/mailnews/compose/resources/content/messengercompose.xul
index f3d600d733f..343f49346bc 100644
--- a/mailnews/compose/resources/content/messengercompose.xul
+++ b/mailnews/compose/resources/content/messengercompose.xul
@@ -464,15 +464,15 @@ Rights Reserved.
 					<text value="&subject.label;"/>
 					<spring style="width:0.5em"/>
 				    <textfield id="msgSubject" type="text" flex="100%"
-						onkeyup="SetComposeWindowTitle(event.which);"
-						onkeypress="if (event.which == 9) {
+						onkeyup="SetComposeWindowTitle(event.keyCode);"
+						onkeypress="if (event.keyCode == 9) {
 						                if (event.shiftKey == false) {
 						                    window._content.focus();
 						                    event.preventDefault();
 						                }
 						            }
 						            else
-						                if (event.which == 13)
+						                if (event.keyCode == 13)
 						                    window._content.focus();"
 						onchange="contentChanged=true;"
 						/>
@@ -540,7 +540,7 @@ Rights Reserved.
 
     <!-- The mail message body frame -->
     <editor type="content-primary" id="content-frame" src="about:blank" name="browser.message.body" flex="100%"
-		onkeypress="if (event.which == 9)
+		onkeypress="if (event.keyCode == 9)
 		                if (event.shiftKey == true) {
 		                    document.getElementById('msgSubject').focus();
 		                    event.preventDefault();
diff --git a/profile/resources/content/profileManager.js b/profile/resources/content/profileManager.js
index a8cdb4a8d82..792e89133a9 100644
--- a/profile/resources/content/profileManager.js
+++ b/profile/resources/content/profileManager.js
@@ -249,7 +249,7 @@ function DoEnabling()
 // handle key event on trees
 function HandleKeyEvent( aEvent )
 {
-  switch( aEvent.which ) 
+  switch( aEvent.keyCode ) 
   {
   case 13:
     onStart();
diff --git a/rdf/tests/domds/resources/DOMDataSourceViewer.xul b/rdf/tests/domds/resources/DOMDataSourceViewer.xul
index dee4e3f5fac..b9a3ea11c8c 100644
--- a/rdf/tests/domds/resources/DOMDataSourceViewer.xul
+++ b/rdf/tests/domds/resources/DOMDataSourceViewer.xul
@@ -11,7 +11,7 @@
 
 <script language="JavaScript" src="DOMDataSourceViewer.js"/>
 <box align="vertical" flex="30%">
-  <textfield value="chrome://communicator/content/domviewer/domviewer.html" type="text" name="url" id="url" onkeypress="if (event.which == 13) loadUrl();"/>
+  <textfield value="chrome://communicator/content/domviewer/domviewer.html" type="text" name="url" id="url" onkeypress="if (event.keyCode == 13) loadUrl();"/>
   <box>
     <text value="Show:"/>
     <checkbox oncommand="setMode('content', event.target.checked);" value="Content"/>
diff --git a/view/public/nsIView.h b/view/public/nsIView.h
index 18138c9e6b2..e60f8a71a4c 100644
--- a/view/public/nsIView.h
+++ b/view/public/nsIView.h
@@ -146,7 +146,11 @@ public:
    * @param aEventFlags see nsIView.h for flag definitions
    * @result processing status
    */
-  NS_IMETHOD  HandleEvent(nsGUIEvent *event, PRUint32 aEventFlags, nsEventStatus* aStatus, PRBool& aHandled) = 0;
+  NS_IMETHOD  HandleEvent(nsGUIEvent *event, 
+                          PRUint32 aEventFlags, 
+                          nsEventStatus* aStatus,
+                          PRBool aForceHandle,
+                          PRBool& aHandled) = 0;
 
   /**
    * Called to indicate that the position of the view has been changed.
diff --git a/view/public/nsIViewObserver.h b/view/public/nsIViewObserver.h
index c6eb1d2e402..4d2e7d1b1b5 100644
--- a/view/public/nsIViewObserver.h
+++ b/view/public/nsIViewObserver.h
@@ -59,6 +59,7 @@ public:
   NS_IMETHOD HandleEvent(nsIView *       aView,
                          nsGUIEvent*     aEvent,
                          nsEventStatus*  aEventStatus,
+                         PRBool          aForceHandle,
                          PRBool&         aHandled) = 0;
 
   /* called when the view has been repositioned due to scrolling
diff --git a/view/src/nsScrollingView.cpp b/view/src/nsScrollingView.cpp
index 68436815184..e1ce59457ad 100644
--- a/view/src/nsScrollingView.cpp
+++ b/view/src/nsScrollingView.cpp
@@ -47,7 +47,7 @@ public:
   ScrollBarView(nsScrollingView *aScrollingView);
   ~ScrollBarView();
 
-  NS_IMETHOD  HandleEvent(nsGUIEvent *aEvent, PRUint32 aEventFlags, nsEventStatus* aStatus, PRBool& handled);
+  NS_IMETHOD  HandleEvent(nsGUIEvent *aEvent, PRUint32 aEventFlags, nsEventStatus* aStatus, PRBool aForceHandle, PRBool& handled);
 
   // Do not set the visibility of the ScrollbarView using SetVisibility. Instead it 
   // must be marked as visible or hidden using SetEnabled. 
@@ -83,7 +83,7 @@ ScrollBarView::~ScrollBarView()
 }
 
 NS_IMETHODIMP ScrollBarView::HandleEvent(nsGUIEvent *aEvent, PRUint32 aEventFlags,
-                                           nsEventStatus* aStatus, PRBool& aHandled)
+                                           nsEventStatus* aStatus, PRBool aForceHandle, PRBool& aHandled)
 {
   NS_ENSURE_ARG_POINTER(aStatus);
   *aStatus = nsEventStatus_eIgnore;
@@ -785,7 +785,7 @@ NS_IMETHODIMP_(void) nsScrollingView::Notify(nsITimer * aTimer)
   if (NS_OK == mViewManager->GetViewObserver(obs))
   {
     PRBool handled;
-    obs->HandleEvent((nsIView *)this, &event, &retval, handled);
+    obs->HandleEvent((nsIView *)this, &event, &retval, PR_TRUE, handled);
     NS_RELEASE(obs);
   }
 
diff --git a/view/src/nsView.cpp b/view/src/nsView.cpp
index b92d43c509f..d5dc3be230c 100644
--- a/view/src/nsView.cpp
+++ b/view/src/nsView.cpp
@@ -707,7 +707,7 @@ NS_IMETHODIMP nsView :: Paint(nsIRenderingContext& rc, const nsIRegion& region,
 }
 
 NS_IMETHODIMP nsView :: HandleEvent(nsGUIEvent *event, PRUint32 aEventFlags,
-                                    nsEventStatus* aStatus, PRBool& aHandled)
+                                    nsEventStatus* aStatus, PRBool aForceHandle, PRBool& aHandled)
 {
   NS_ENSURE_ARG_POINTER(aStatus);
 //printf(" %d %d %d %d (%d,%d) \n", this, event->widget, event->widgetSupports, 
@@ -750,7 +750,7 @@ NS_IMETHODIMP nsView :: HandleEvent(nsGUIEvent *event, PRUint32 aEventFlags,
         event->point.x -= trect.x;
         event->point.y -= trect.y;
 
-        pKid->HandleEvent(event, NS_VIEW_FLAG_CHECK_CHILDREN, aStatus, aHandled);
+        pKid->HandleEvent(event, NS_VIEW_FLAG_CHECK_CHILDREN, aStatus, PR_FALSE, aHandled);
 
         event->point.x += trect.x;
         event->point.y += trect.y;
@@ -766,7 +766,7 @@ NS_IMETHODIMP nsView :: HandleEvent(nsGUIEvent *event, PRUint32 aEventFlags,
     //if no child's bounds matched the event or we consumed but still want
     //default behavior check the view itself. -EDV
     if (nsnull != mClientData && nsnull != obs) {
-      obs->HandleEvent((nsIView *)this, event, aStatus, aHandled);
+      obs->HandleEvent((nsIView *)this, event, aStatus, aForceHandle, aHandled);
     }
   } 
   /* XXX Just some debug code to see what event are being thrown away because
diff --git a/view/src/nsView.h b/view/src/nsView.h
index f848d38d2c0..d530c615e73 100644
--- a/view/src/nsView.h
+++ b/view/src/nsView.h
@@ -57,7 +57,11 @@ public:
                     PRUint32 aPaintFlags, PRBool &aResult);
   NS_IMETHOD  Paint(nsIRenderingContext& rc, const nsIRegion& region,
                     PRUint32 aPaintFlags, PRBool &aResult);
-  NS_IMETHOD  HandleEvent(nsGUIEvent *event, PRUint32 aEventFlags, nsEventStatus* aStatus, PRBool& aHandled);
+  NS_IMETHOD  HandleEvent(nsGUIEvent *event, 
+                          PRUint32 aEventFlags,
+                          nsEventStatus* aStatus,
+                          PRBool aForceHandle,
+                          PRBool& aHandled);
   NS_IMETHOD  SetPosition(nscoord x, nscoord y);
   NS_IMETHOD  GetPosition(nscoord *x, nscoord *y) const;
   NS_IMETHOD  SetDimensions(nscoord width, nscoord height, PRBool aPaint = PR_TRUE);
diff --git a/view/src/nsViewManager.cpp b/view/src/nsViewManager.cpp
index 7299b9f055a..5c2abb2c73a 100644
--- a/view/src/nsViewManager.cpp
+++ b/view/src/nsViewManager.cpp
@@ -1755,6 +1755,7 @@ NS_IMETHODIMP nsViewManager :: DispatchEvent(nsGUIEvent *aEvent, nsEventStatus *
                                   NS_VIEW_FLAG_CHECK_PARENT |
                                   NS_VIEW_FLAG_CHECK_SIBLINGS,
                           aStatus,
+                          PR_TRUE,
                           handled);
 
         aEvent->point.x -= offset.x;
diff --git a/view/src/nsViewManager2.cpp b/view/src/nsViewManager2.cpp
index 8089c8114a2..1364f170b22 100755
--- a/view/src/nsViewManager2.cpp
+++ b/view/src/nsViewManager2.cpp
@@ -1384,6 +1384,7 @@ NS_IMETHODIMP nsViewManager2::DispatchEvent(nsGUIEvent *aEvent, nsEventStatus *a
 									  NS_VIEW_FLAG_CHECK_PARENT |
 									  NS_VIEW_FLAG_CHECK_SIBLINGS,
 									  aStatus,
+                    PR_TRUE,
 									  handled);
 
 					aEvent->point.x -= offset.x;
diff --git a/xpfe/browser/resources/content/navigator.xul b/xpfe/browser/resources/content/navigator.xul
index ce3d76526cf..259434c541b 100644
--- a/xpfe/browser/resources/content/navigator.xul
+++ b/xpfe/browser/resources/content/navigator.xul
@@ -274,7 +274,7 @@ Contributor(s): ______________________________________. -->
     	      <image id="page-proxy-button" ondraggesture="nsDragAndDrop.startDrag(event, proxyIconDNDObserver);"/> 
 	          <textfield autocomplete="true" timeout="300" class="plain" 
 	                     searchSessionType="urlbar" id="urlbar" tooltip="aTooltip" tooltiptext="&locationBar.tooltip;"
-	                     onkeypress="if( event.which == 13 ) { addToUrlbarHistory(); BrowserLoadURL(); }" flex="1"/>  
+	                     onkeypress="if( event.keyCode == 13 ) { addToUrlbarHistory(); BrowserLoadURL(); }" flex="1"/>  
           </box>
           <menubutton class="menubutton-icon" id="ubhist">
             <menupopup id="ubhist-popup" popupalign="topright" popupanchor="bottomright"
diff --git a/xpfe/browser/src/navigator-test1.xul b/xpfe/browser/src/navigator-test1.xul
index ed298577cf3..a333ad1f83f 100644
--- a/xpfe/browser/src/navigator-test1.xul
+++ b/xpfe/browser/src/navigator-test1.xul
@@ -545,7 +545,7 @@
 	<box align="vertical" flex="100%">
 	<spring flex="100%"/>
 	<html:input id="urlbar" type="text" style="min-width: 100px; min-height: 25px"
-	  onkeyup="if (event.which == 13) { BrowserLoadURL(); }"/>   
+	  onkeyup="if (event.keyCode == 13) { BrowserLoadURL(); }"/>   
 	<spring flex="100%"/>
 	</box>
 	<titledbutton id="Throbber" onclick="window.frames[0].home()">
diff --git a/xpfe/components/autocomplete/test/autocomplete_test.xul b/xpfe/components/autocomplete/test/autocomplete_test.xul
index 1548108632c..f9f98adf689 100644
--- a/xpfe/components/autocomplete/test/autocomplete_test.xul
+++ b/xpfe/components/autocomplete/test/autocomplete_test.xul
@@ -126,7 +126,7 @@ function Initialize()
 <autocomplete id="test2"
     searchSessionType="addrbook"
     timeout="300"
-    onkeypress="if (event.which == 13) dump('Done, value=' + this.value + '\n');"
+    onkeypress="if (event.keyCode == 13) dump('Done, value=' + this.value + '\n');"
 />
 
 <!--autocomplete
diff --git a/xpfe/components/bookmarks/resources/bm-find.xul b/xpfe/components/bookmarks/resources/bm-find.xul
index 3e8ee370f11..23e0e9da73f 100755
--- a/xpfe/components/bookmarks/resources/bm-find.xul
+++ b/xpfe/components/bookmarks/resources/bm-find.xul
@@ -149,7 +149,7 @@
 				</menupopup>
 			</menulist>
 
-			<textfield id="findtext" type="text" style="width:10em;" onkeypress="if (event.which == 13) { return doFind(); }" />
+			<textfield id="findtext" type="text" style="width:10em;" onkeypress="if (event.keyCode == 13) { return doFind(); }" />
 			<box autostretch="never">
 				<button value="&search.button.label;" onclick="return doFind();" class="dialog toolbar-non-iconic" />
 			</box>
diff --git a/xpfe/components/directory/directory.js b/xpfe/components/directory/directory.js
index c6c59371af2..4a593e3b7a0 100644
--- a/xpfe/components/directory/directory.js
+++ b/xpfe/components/directory/directory.js
@@ -101,7 +101,7 @@ function OnClick(event, node)
     if( event.type == "click" &&
         ( event.button != 1 || event.detail != 2 || node.nodeName != "treeitem") )
       return(false);
-    if( event.type == "keypress" && event.which != 13 )
+    if( event.type == "keypress" && event.keyCode != 13 )
       return(false);
 
     var tree = document.getElementById("tree");
diff --git a/xpfe/components/prefwindow/resources/content/pref-smart_browsing.xul b/xpfe/components/prefwindow/resources/content/pref-smart_browsing.xul
index a69698b3fb1..b7aa0a5027b 100644
--- a/xpfe/components/prefwindow/resources/content/pref-smart_browsing.xul
+++ b/xpfe/components/prefwindow/resources/content/pref-smart_browsing.xul
@@ -131,7 +131,7 @@
 
   function treeHandleEvent( aEvent )
   {
-    if( aEvent.which == 46 )
+    if( aEvent.keyCode == 46 )
       removeDomain();
   }
 
diff --git a/xpfe/components/search/resources/find.xul b/xpfe/components/search/resources/find.xul
index e932eb4107c..1d8a66cb971 100644
--- a/xpfe/components/search/resources/find.xul
+++ b/xpfe/components/search/resources/find.xul
@@ -41,7 +41,7 @@
         <menuitem value="&doesntcontain.label;" data="doesntcontain"/>
       </menupopup>
     </menulist>
-    <textfield id="findtext" type="text" width="20" onkeypress="if (event.which == 13) { doFind(); }" />
+    <textfield id="findtext" type="text" width="20" onkeypress="if (event.keyCode == 13) { doFind(); }" />
     <button value="&search.button.label;" oncommand="doFind();"/>
   </box>          
           
diff --git a/xpfe/components/search/resources/internet.xul b/xpfe/components/search/resources/internet.xul
index b49744d6b04..c4da693a21d 100644
--- a/xpfe/components/search/resources/internet.xul
+++ b/xpfe/components/search/resources/internet.xul
@@ -39,7 +39,7 @@
 	</html:select>
 
 		<html:div>&for.label;</html:div>
-		<html:input id="searchtext" size="20" onkeypress="if (event.which == 13) { doSearch(); }" />
+		<html:input id="searchtext" size="20" onkeypress="if (event.keyCode == 13) { doSearch(); }" />
 		<html:button id="searchbutton" onclick="return doSearch();">&search.button.label;</html:button>
 		<html:button id="stopbutton" onclick="return doStop();" style="display: none;" >&stop.button.label;</html:button>
 		<spring align="horizontal" flex="100%" />
diff --git a/xpfe/components/search/resources/search-panel.xul b/xpfe/components/search/resources/search-panel.xul
index f63354a8913..8b178bc7d71 100644
--- a/xpfe/components/search/resources/search-panel.xul
+++ b/xpfe/components/search/resources/search-panel.xul
@@ -45,7 +45,7 @@
   
   <box class="color-window groove-bottom box-padded outset-right" orient="vertical">
     <box autostretch="never">
-      <textfield id="sidebar-search-text" flex="1" onkeypress="if (event.which == 13) return doSearch();" oninput="return doEnabling();" />
+      <textfield id="sidebar-search-text" flex="1" onkeypress="if (event.keyCode == 13) return doSearch();" oninput="return doEnabling();" />
 		  <box autostretch="never">
 			  <button class="button-toolbar-3" id="searchbutton" value="&search.button.label;" disabled="true" oncommand="return doSearch();}"/>
 			  <button class="button-toolbar-3" id="stopbutton" align="left" src="resource:/res/rdf/loading.gif" value="&stop.button.label;" oncommand="return doStop();" style="display:none;"/>