diff --git a/Makefile.in b/Makefile.in
index 3b9f3234818..0f44bbcf40b 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -166,7 +166,11 @@ SYMBOL_INDEX_NAME = \
 buildsymbols:
 ifdef MOZ_CRASHREPORTER
 ifdef USE_ELF_HACK
-	$(MAKE) -C $(MOZ_BUILD_APP)/installer elfhack
+    ifeq (mobile,$(MOZ_BUILD_APP))
+		$(MAKE) -C mobile/xul/installer elfhack
+    else
+		$(MAKE) -C $(MOZ_BUILD_APP)/installer elfhack
+    endif
 endif
 	echo building symbol store
 	$(RM) -r $(DIST)/crashreporter-symbols
diff --git a/accessible/src/base/AccGroupInfo.cpp b/accessible/src/base/AccGroupInfo.cpp
index be9b2e1d8e5..8df24bd5864 100644
--- a/accessible/src/base/AccGroupInfo.cpp
+++ b/accessible/src/base/AccGroupInfo.cpp
@@ -50,6 +50,12 @@ AccGroupInfo::AccGroupInfo(nsAccessible* aItem, PRUint32 aRole) :
     return;
 
   PRInt32 indexInParent = aItem->IndexInParent();
+  PRInt32 siblingCount = parent->GetChildCount();
+  if (siblingCount < indexInParent) {
+    NS_ERROR("Wrong index in parent! Tree invalidation problem.");
+    return;
+  }
+
   PRInt32 level = nsAccUtils::GetARIAOrDefaultLevel(aItem);
 
   // Compute position in set.
@@ -95,7 +101,6 @@ AccGroupInfo::AccGroupInfo(nsAccessible* aItem, PRUint32 aRole) :
   // Compute set size.
   mSetSize = mPosInSet;
 
-  PRInt32 siblingCount = parent->GetChildCount();
   for (PRInt32 idx = indexInParent + 1; idx < siblingCount; idx++) {
     nsAccessible* sibling = parent->GetChildAt(idx);
 
diff --git a/accessible/src/base/NotificationController.cpp b/accessible/src/base/NotificationController.cpp
index a51a2324b99..f90f891613c 100644
--- a/accessible/src/base/NotificationController.cpp
+++ b/accessible/src/base/NotificationController.cpp
@@ -592,8 +592,8 @@ NotificationController::CoalesceSelChangeEvents(AccSelChangeEvent* aTailEvent,
     if (aThisEvent->mPackedEvent) {
       aThisEvent->mPackedEvent->mEventType =
         aThisEvent->mPackedEvent->mSelChangeType == AccSelChangeEvent::eSelectionAdd ?
-          nsIAccessibleEvent::EVENT_SELECTION_ADD :
-          nsIAccessibleEvent::EVENT_SELECTION_REMOVE;
+          static_cast<PRUint32>(nsIAccessibleEvent::EVENT_SELECTION_ADD) :
+          static_cast<PRUint32>(nsIAccessibleEvent::EVENT_SELECTION_REMOVE);
 
       aThisEvent->mPackedEvent->mEventRule =
         AccEvent::eCoalesceSelectionChange;
@@ -603,8 +603,8 @@ NotificationController::CoalesceSelChangeEvents(AccSelChangeEvent* aTailEvent,
 
     aThisEvent->mEventType =
       aThisEvent->mSelChangeType == AccSelChangeEvent::eSelectionAdd ?
-        nsIAccessibleEvent::EVENT_SELECTION_ADD :
-        nsIAccessibleEvent::EVENT_SELECTION_REMOVE;
+        static_cast<PRUint32>(nsIAccessibleEvent::EVENT_SELECTION_ADD) :
+        static_cast<PRUint32>(nsIAccessibleEvent::EVENT_SELECTION_REMOVE);
 
     return;
   }
diff --git a/accessible/src/msaa/nsAccessibleWrap.cpp b/accessible/src/msaa/nsAccessibleWrap.cpp
index 09fd4fa0244..592755cd577 100644
--- a/accessible/src/msaa/nsAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsAccessibleWrap.cpp
@@ -289,15 +289,12 @@ __try {
   nsresult rv = xpAccessible->GetName(name);
   if (NS_FAILED(rv))
     return GetHRESULT(rv);
-    
-  if (name.IsVoid()) {
-    // Valid return value for the name:
-    // The name was not provided, e.g. no alt attribute for an image.
-    // A screen reader may choose to invent its own accessible name, e.g. from
-    // an image src attribute.
-    // See nsHTMLImageAccessible::GetName()
-    return S_OK;
-  }
+
+  // The name was not provided, e.g. no alt attribute for an image. A screen
+  // reader may choose to invent its own accessible name, e.g. from an image src
+  // attribute. Refer to NS_OK_EMPTY_NAME return value.
+  if (name.IsVoid())
+    return S_FALSE;
 
   *pszName = ::SysAllocStringLen(name.get(), name.Length());
   if (!*pszName)
diff --git a/browser/base/content/aboutSyncTabs.js b/browser/base/content/aboutSyncTabs.js
index 222548e4ef2..2d3a0bbfba5 100644
--- a/browser/base/content/aboutSyncTabs.js
+++ b/browser/base/content/aboutSyncTabs.js
@@ -137,7 +137,6 @@ let RemoteTabViewer = {
                                      , title: title
                                      , hiddenRows: [ "description"
                                                    , "location"
-                                                   , "folderPicker"
                                                    , "loadInSidebar"
                                                    , "keyword" ]
                                      }, window.top);
diff --git a/browser/base/content/browser-places.js b/browser/base/content/browser-places.js
index b85892c12cd..fd4153a550f 100644
--- a/browser/base/content/browser-places.js
+++ b/browser/base/content/browser-places.js
@@ -386,7 +386,6 @@ var PlacesCommandHook = {
                                        , hiddenRows: [ "description"
                                                      , "location"
                                                      , "loadInSidebar"
-                                                     , "folderPicker"
                                                      , "keyword" ]
                                        }, window);
     }
diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index d1d96c4b08c..8948feb3700 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -3173,7 +3173,6 @@ var bookmarksButtonObserver = {
                                        , hiddenRows: [ "description"
                                                      , "location"
                                                      , "loadInSidebar"
-                                                     , "folderPicker"
                                                      , "keyword" ]
                                        }, window);
     } catch(ex) { }
@@ -5802,7 +5801,6 @@ function contentAreaClick(event, isPanelClick)
                                        , loadBookmarkInSidebar: true
                                        , hiddenRows: [ "description"
                                                      , "location"
-                                                     , "folderPicker"
                                                      , "keyword" ]
                                        }, window);
       event.preventDefault();
@@ -6849,8 +6847,9 @@ function AddKeywordForSearchField() {
                                    , postData: postData
                                    , charSet: charset
                                    , hiddenRows: [ "location"
-                                                 , "loadInSidebar"
-                                                 , "folderPicker" ]
+                                                 , "description"
+                                                 , "tags"
+                                                 , "loadInSidebar" ]
                                    }, window);
 }
 
diff --git a/browser/base/content/nsContextMenu.js b/browser/base/content/nsContextMenu.js
index d935ce626bd..f428f406b68 100644
--- a/browser/base/content/nsContextMenu.js
+++ b/browser/base/content/nsContextMenu.js
@@ -1406,7 +1406,6 @@ nsContextMenu.prototype = {
                                        , hiddenRows: [ "description"
                                                      , "location"
                                                      , "loadInSidebar"
-                                                     , "folderPicker"
                                                      , "keyword" ]
                                        }, window.top);
     }
diff --git a/browser/components/places/content/bookmarkProperties.js b/browser/components/places/content/bookmarkProperties.js
index fb2ae8712fc..458949bdb4b 100644
--- a/browser/components/places/content/bookmarkProperties.js
+++ b/browser/components/places/content/bookmarkProperties.js
@@ -264,8 +264,6 @@ var BookmarkPropertiesPanel = {
       NS_ASSERT("itemId" in dialogInfo);
       this._itemId = dialogInfo.itemId;
       this._title = PlacesUtils.bookmarks.getItemTitle(this._itemId);
-      // Don't show folderPicker when editing
-      this._hiddenRows.push("folderPicker");
       this._readOnly = !!dialogInfo.readOnly;
 
       switch (dialogInfo.type) {
diff --git a/browser/components/places/content/controller.js b/browser/components/places/content/controller.js
index 15f8fc0d48b..55813f0a0fd 100644
--- a/browser/components/places/content/controller.js
+++ b/browser/components/places/content/controller.js
@@ -309,7 +309,6 @@ PlacesController.prototype = {
                                        , hiddenRows: [ "description"
                                                      , "keyword"
                                                      , "location"
-                                                     , "folderPicker"
                                                      , "loadInSidebar" ]
                                        , uri: NetUtil.newURI(node.uri)
                                        , title: node.title
@@ -721,6 +720,7 @@ PlacesController.prototype = {
                                      , type: itemType
                                      , itemId: itemId
                                      , readOnly: isRootItem
+                                     , hiddenRows: [ "folderPicker" ]
                                      }, window.top);
   },
 
diff --git a/browser/components/places/src/PlacesUIUtils.jsm b/browser/components/places/src/PlacesUIUtils.jsm
index ea612f9c49e..ef68a3b823e 100644
--- a/browser/components/places/src/PlacesUIUtils.jsm
+++ b/browser/components/places/src/PlacesUIUtils.jsm
@@ -340,29 +340,36 @@ var PlacesUIUtils = {
    *        See documentation at the top of bookmarkProperties.js
    * @param aWindow
    *        Owner window for the new dialog.
-   * @param aMinimalUI [optional]
-   *        Whether to open the dialog in "minimal ui" mode. Do not pass this
-   *        for new callers.  It'll be removed in a future release.
+   * @param aResizable [optional]
+   *        Whether the dialog is allowed to resize.  Do not pass this for new
+   *        callers since it's deprecated.  It'll be removed in future releases.
    *
    * @see documentation at the top of bookmarkProperties.js
    * @return true if any transaction has been performed, false otherwise.
    */
   showBookmarkDialog:
-  function PUIU_showBookmarkDialog(aInfo, aParentWindow, aMinimalUI) {
+  function PUIU_showBookmarkDialog(aInfo, aParentWindow, aResizable) {
+    // This is a compatibility shim for add-ons.  It will warn in the Error
+    // Console when used.
     if (!aParentWindow) {
       aParentWindow = this._getWindow(null);
     }
 
     // Preserve size attributes differently based on the fact the dialog has
-    // a folder picker or not.
-    let minimalUI = "hiddenRows" in aInfo &&
-                    aInfo.hiddenRows.indexOf("folderPicker") != -1;
-    let dialogURL = aMinimalUI ?
+    // a folder picker or not.  If the picker is visible, the dialog should
+    // be resizable since it may not show enough content for the folders
+    // hierarchy.
+    let hasFolderPicker = !("hiddenRows" in aInfo) ||
+                          aInfo.hiddenRows.indexOf("folderPicker") == -1;
+    let resizable = aResizable !== undefined ? aResizable : hasFolderPicker;
+    // Use a different chrome url, since this allows to persist different sizes,
+    // based on resizability of the dialog.
+    let dialogURL = resizable ?
                     "chrome://browser/content/places/bookmarkProperties2.xul" :
                     "chrome://browser/content/places/bookmarkProperties.xul";
 
     let features =
-      "centerscreen,chrome,modal,resizable=" + (aMinimalUI ? "yes" : "no");
+      "centerscreen,chrome,modal,resizable=" + (resizable ? "yes" : "no");
 
     aParentWindow.openDialog(dialogURL, "",  features, aInfo);
     return ("performed" in aInfo && aInfo.performed);
diff --git a/browser/components/sidebar/src/nsSidebar.js b/browser/components/sidebar/src/nsSidebar.js
index e18ed305b99..3a3d41df17e 100644
--- a/browser/components/sidebar/src/nsSidebar.js
+++ b/browser/components/sidebar/src/nsSidebar.js
@@ -110,9 +110,7 @@ function (aTitle, aContentURL, aCustomizeURL, aPersist)
                                          , type: "bookmark"
                                          , hiddenRows: [ "description"
                                                        , "keyword"
-                                                       , "location"
-                                                       , "folderPicker"
-                                                       , "loadInSidebar" ]
+                                                       , "location" ]
                                          , uri: uri
                                          , title: aTitle
                                          , loadBookmarkInSidebar: true
diff --git a/configure.in b/configure.in
index 9c5ec874090..bc728678faa 100644
--- a/configure.in
+++ b/configure.in
@@ -4750,6 +4750,10 @@ if test -z "$MOZ_BUILD_APP"; then
   AC_MSG_RESULT([browser])
   MOZ_BUILD_APP=browser
 else
+  # default mobile to be mobile/xul
+  if test "$MOZ_BUILD_APP" = "mobile" ; then
+    MOZ_BUILD_APP=mobile/xul
+  fi
   # We have a valid application only if it has a build.mk file in its top
   # directory.
   if test ! -f "${srcdir}/${MOZ_BUILD_APP}/build.mk" ; then
@@ -7114,6 +7118,21 @@ elif test -z "$_ENABLE_LOGREFCNT"; then
     AC_DEFINE(NO_BUILD_REFCNT_LOGGING)
 fi
 
+dnl ========================================================
+dnl moz_dump_painting
+dnl ========================================================
+MOZ_ARG_ENABLE_BOOL(dump-painting,
+[  --enable-dump-painting          Enable paint debugging.],
+    MOZ_DUMP_PAINTING=1,
+    MOZ_DUMP_PAINTING= )
+if test -n "$MOZ_DUMP_PAINTING"; then
+    AC_DEFINE(MOZ_DUMP_PAINTING)
+    AC_DEFINE(MOZ_LAYERS_HAVE_LOG)
+fi
+if test -n "$MOZ_DEBUG"; then
+    AC_DEFINE(MOZ_DUMP_PAINTING)
+fi
+
 dnl ========================================================
 dnl = Enable trace malloc
 dnl ========================================================
diff --git a/content/base/public/nsContentCreatorFunctions.h b/content/base/public/nsContentCreatorFunctions.h
index f31e9baeed2..b4c7255ce8e 100644
--- a/content/base/public/nsContentCreatorFunctions.h
+++ b/content/base/public/nsContentCreatorFunctions.h
@@ -58,7 +58,7 @@ class nsNodeInfoManager;
 class nsGenericHTMLElement;
 
 nsresult
-NS_NewElement(nsIContent** aResult, PRInt32 aElementType,
+NS_NewElement(nsIContent** aResult,
               already_AddRefed<nsINodeInfo> aNodeInfo,
               mozilla::dom::FromParser aFromParser);
 
diff --git a/content/base/public/nsContentErrors.h b/content/base/public/nsContentErrors.h
index 4a16574a9f5..8a910cfb06c 100644
--- a/content/base/public/nsContentErrors.h
+++ b/content/base/public/nsContentErrors.h
@@ -45,10 +45,6 @@
 #define NS_HTML_STYLE_PROPERTY_NOT_THERE \
   NS_ERROR_GENERATE_SUCCESS(NS_ERROR_MODULE_CONTENT, 2)
 
-/** Error codes for nsScriptLoader */
-#define NS_CONTENT_SCRIPT_IS_EVENTHANDLER \
-  NS_ERROR_GENERATE_SUCCESS(NS_ERROR_MODULE_CONTENT, 3)
-
 /** Error codes for image loading */
 #define NS_ERROR_IMAGE_SRC_CHANGED \
   NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_CONTENT, 4)
diff --git a/content/base/public/nsContentUtils.h b/content/base/public/nsContentUtils.h
index 550bebfd868..e6e4e710db2 100644
--- a/content/base/public/nsContentUtils.h
+++ b/content/base/public/nsContentUtils.h
@@ -76,13 +76,15 @@ static fp_except_t oldmask = fpsetmask(~allmask);
 #include "nsTArray.h"
 #include "nsTextFragment.h"
 #include "nsReadableUtils.h"
-#include "mozilla/AutoRestore.h"
 #include "nsINode.h"
 #include "nsHashtable.h"
 #include "nsIDOMNode.h"
 #include "nsHtml5Parser.h"
 #include "nsIFragmentContentSink.h"
 #include "nsMathUtils.h"
+
+#include "mozilla/AutoRestore.h"
+#include "mozilla/GuardObjects.h"
 #include "mozilla/TimeStamp.h"
 
 struct nsNativeKeyEvent; // Don't include nsINativeKeyBindings.h here: it will force strange compilation error!
@@ -1720,10 +1722,10 @@ public:
   static bool IsFullScreenKeyInputRestricted();
 
   /**
-   * Returns true if the doctree rooted at aDoc contains any plugins which
-   * we don't control event dispatch for, i.e. do any plugins in this doc tree
-   * receive key events outside of our control? This always returns false
-   * on MacOSX.
+   * Returns true if the doc tree branch which contains aDoc contains any
+   * plugins which we don't control event dispatch for, i.e. do any plugins
+   * in the same tab as this document receive key events outside of our
+   * control? This always returns false on MacOSX.
    */
   static bool HasPluginWithUncontrolledEventDispatch(nsIDocument* aDoc);
 
diff --git a/content/base/public/nsDOMFile.h b/content/base/public/nsDOMFile.h
index c9c1bedd81e..b66ccacd96e 100644
--- a/content/base/public/nsDOMFile.h
+++ b/content/base/public/nsDOMFile.h
@@ -49,12 +49,13 @@
 #include "nsIMutable.h"
 #include "nsCOMArray.h"
 #include "nsCOMPtr.h"
-#include "mozilla/AutoRestore.h"
 #include "nsString.h"
 #include "nsIXMLHttpRequest.h"
 #include "prmem.h"
 #include "nsAutoPtr.h"
 
+#include "mozilla/GuardObjects.h"
+
 #ifndef PR_UINT64_MAX
 #define PR_UINT64_MAX (~(PRUint64)(0))
 #endif
diff --git a/content/base/public/nsIContent.h b/content/base/public/nsIContent.h
index dae882c92d6..40e00bb87c6 100644
--- a/content/base/public/nsIContent.h
+++ b/content/base/public/nsIContent.h
@@ -74,9 +74,9 @@ enum nsLinkState {
 };
 
 // IID for the nsIContent interface
-#define NS_ICONTENT_IID       \
-{ 0xdec4b381, 0xa3fc, 0x402b, \
- { 0x83, 0x96, 0x0a, 0x7b, 0x37, 0x52, 0xcf, 0x70 } }
+#define NS_ICONTENT_IID \
+{ 0xb651e0a7, 0x1471, 0x49cc, \
+  { 0xb4, 0xe1, 0xc2, 0xca, 0x01, 0xfe, 0xb7, 0x80 } }
 
 /**
  * A node of content in a document's content model. This interface
@@ -753,22 +753,12 @@ public:
    * have the parser pass true.  See nsHTMLInputElement.cpp and
    * nsHTMLContentSink::MakeContentObject().
    *
-   * It is ok to ignore an error returned from this function. However the
-   * following errors may be of interest to some callers:
-   *
-   *   NS_ERROR_HTMLPARSER_BLOCK  Returned by script elements to indicate
-   *                              that a script will be loaded asynchronously
-   *
-   * This means that implementations will have to deal with returned error
-   * codes being ignored.
-   *
    * @param aHaveNotified Whether there has been a
    *        ContentInserted/ContentAppended notification for this content node
    *        yet.
    */
-  virtual nsresult DoneAddingChildren(bool aHaveNotified)
+  virtual void DoneAddingChildren(bool aHaveNotified)
   {
-    return NS_OK;
   }
 
   /**
diff --git a/content/base/public/nsIScriptElement.h b/content/base/public/nsIScriptElement.h
index 0e452308eb9..35bea23058b 100644
--- a/content/base/public/nsIScriptElement.h
+++ b/content/base/public/nsIScriptElement.h
@@ -49,8 +49,8 @@
 #include "nsIDOMHTMLScriptElement.h"
 
 #define NS_ISCRIPTELEMENT_IID \
-{ 0x6d625b30, 0xfac4, 0x11de, \
-{ 0x8a, 0x39, 0x08, 0x00, 0x20, 0x0c, 0x9a, 0x66 } }
+{ 0x5bb3b905, 0x5988, 0x476f, \
+  { 0x95, 0x4f, 0x99, 0x02, 0x59, 0x82, 0x24, 0x67 } }
 
 /**
  * Internal interface implemented by script elements
@@ -217,7 +217,44 @@ public:
     return parser.forget();
   }
 
+  /**
+   * This method is called when the parser finishes creating the script
+   * element's children, if any are present.
+   *
+   * @return whether the parser will be blocked while this script is being
+   *         loaded
+   */
+  bool AttemptToExecute()
+  {
+    mDoneAddingChildren = true;
+    bool block = MaybeProcessScript();
+    if (!mAlreadyStarted) {
+      // Need to lose parser-insertedness here to allow another script to cause
+      // execution later.
+      LoseParserInsertedness();
+    }
+    return block;
+  }
+
 protected:
+  /**
+   * Processes the script if it's in the document-tree and links to or
+   * contains a script. Once it has been evaluated there is no way to make it
+   * reevaluate the script, you'll have to create a new element. This also means
+   * that when adding a src attribute to an element that already contains an
+   * inline script, the script referenced by the src attribute will not be
+   * loaded.
+   *
+   * In order to be able to use multiple childNodes, or to use the
+   * fallback mechanism of using both inline script and linked script you have
+   * to add all attributes and childNodes before adding the element to the
+   * document-tree.
+   *
+   * @return whether the parser will be blocked while this script is being
+   *         loaded
+   */
+  virtual bool MaybeProcessScript() = 0;
+
   /**
    * The start line number of the script.
    */
diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
index 6587009a60d..f6c6bcd3510 100644
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -5876,7 +5876,15 @@ nsContentUtils::HasPluginWithUncontrolledEventDispatch(nsIDocument* aDoc)
   return false;
 #endif
   bool result = false;
-  DocTreeContainsWindowedPlugins(aDoc, &result);
+  
+  // Find the top of the document's branch, the child of the chrome document.
+  nsIDocument* doc = aDoc;
+  nsIDocument* parent = nsnull;
+  while (doc && (parent = doc->GetParentDocument()) && !IsChromeDoc(parent)) {
+    doc = parent;
+  }
+
+  DocTreeContainsWindowedPlugins(doc, &result);
   return result;
 }
 
diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index 8915d789ec7..a3fa55c43ef 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -4421,9 +4421,7 @@ nsDocument::CreateElementNS(const nsAString& aNamespaceURI,
                                                      getter_AddRefs(nodeInfo));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  PRInt32 ns = nodeInfo->NamespaceID();
-  return NS_NewElement(aReturn, ns,
-                       nodeInfo.forget(), NOT_FROM_PARSER);
+  return NS_NewElement(aReturn, nodeInfo.forget(), NOT_FROM_PARSER);
 }
 
 NS_IMETHODIMP
@@ -6754,8 +6752,7 @@ nsDocument::CreateElem(const nsAString& aName, nsIAtom *aPrefix, PRInt32 aNamesp
                                 getter_AddRefs(nodeInfo));
   NS_ENSURE_TRUE(nodeInfo, NS_ERROR_OUT_OF_MEMORY);
 
-  return NS_NewElement(aResult, aNamespaceID, nodeInfo.forget(),
-                       NOT_FROM_PARSER);
+  return NS_NewElement(aResult, nodeInfo.forget(), NOT_FROM_PARSER);
 }
 
 bool
diff --git a/content/base/src/nsFrameLoader.cpp b/content/base/src/nsFrameLoader.cpp
index 09310ea8391..7b049368447 100644
--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@@ -105,16 +105,16 @@
 
 #include "nsIDOMChromeWindow.h"
 #include "nsInProcessTabChildGlobal.h"
-#include "mozilla/AutoRestore.h"
-#include "mozilla/unused.h"
 
 #include "Layers.h"
 
 #include "ContentParent.h"
 #include "TabParent.h"
-#include "mozilla/layout/RenderFrameParent.h"
-#include "mozilla/dom/Element.h"
+#include "mozilla/GuardObjects.h"
 #include "mozilla/Preferences.h"
+#include "mozilla/unused.h"
+#include "mozilla/dom/Element.h"
+#include "mozilla/layout/RenderFrameParent.h"
 
 #include "jsapi.h"
 
diff --git a/content/base/src/nsGkAtomList.h b/content/base/src/nsGkAtomList.h
index 1742fb571b9..60ec883eb6f 100644
--- a/content/base/src/nsGkAtomList.h
+++ b/content/base/src/nsGkAtomList.h
@@ -499,6 +499,7 @@ GK_ATOM(keyup, "keyup")
 GK_ATOM(kind, "kind")
 GK_ATOM(label, "label")
 GK_ATOM(lang, "lang")
+GK_ATOM(language, "language")
 GK_ATOM(last, "last")
 GK_ATOM(layer, "layer")
 GK_ATOM(layout, "layout")
@@ -1986,7 +1987,6 @@ GK_ATOM(InlineBlockFrame, "InlineBlockFrame")
 GK_ATOM(invalid, "invalid")
 GK_ATOM(item, "item")
 GK_ATOM(itemset, "itemset")
-GK_ATOM(language, "language")
 GK_ATOM(lineNumber, "line-number")
 GK_ATOM(linkedPanel, "linkedpanel")
 GK_ATOM(live, "live")
diff --git a/content/base/src/nsNameSpaceManager.cpp b/content/base/src/nsNameSpaceManager.cpp
index e174563a070..4e681d92d71 100644
--- a/content/base/src/nsNameSpaceManager.cpp
+++ b/content/base/src/nsNameSpaceManager.cpp
@@ -224,28 +224,29 @@ NameSpaceManagerImpl::GetNameSpaceID(const nsAString& aURI)
 }
 
 nsresult
-NS_NewElement(nsIContent** aResult, PRInt32 aElementType,
+NS_NewElement(nsIContent** aResult,
               already_AddRefed<nsINodeInfo> aNodeInfo, FromParser aFromParser)
 {
-  if (aElementType == kNameSpaceID_XHTML) {
+  PRInt32 ns = aNodeInfo.get()->NamespaceID();
+  if (ns == kNameSpaceID_XHTML) {
     return NS_NewHTMLElement(aResult, aNodeInfo, aFromParser);
   }
 #ifdef MOZ_XUL
-  if (aElementType == kNameSpaceID_XUL) {
+  if (ns == kNameSpaceID_XUL) {
     return NS_NewXULElement(aResult, aNodeInfo);
   }
 #endif
-  if (aElementType == kNameSpaceID_MathML) {
+  if (ns == kNameSpaceID_MathML) {
     return NS_NewMathMLElement(aResult, aNodeInfo);
   }
-  if (aElementType == kNameSpaceID_SVG) {
+  if (ns == kNameSpaceID_SVG) {
     return NS_NewSVGElement(aResult, aNodeInfo, aFromParser);
   }
-  if (aElementType == kNameSpaceID_XMLEvents) {
+  if (ns == kNameSpaceID_XMLEvents) {
     return NS_NewXMLEventsElement(aResult, aNodeInfo);
   }
 #ifdef MOZ_XTF
-  if (aElementType > kNameSpaceID_LastBuiltin) {
+  if (ns > kNameSpaceID_LastBuiltin) {
     nsIXTFService* xtfService = nsContentUtils::GetXTFService();
     NS_ASSERTION(xtfService, "could not get xtf service");
     if (xtfService &&
diff --git a/content/base/src/nsScriptElement.cpp b/content/base/src/nsScriptElement.cpp
index fb927c6bca7..42de750f8ec 100644
--- a/content/base/src/nsScriptElement.cpp
+++ b/content/base/src/nsScriptElement.cpp
@@ -147,7 +147,7 @@ nsScriptElement::ContentInserted(nsIDocument *aDocument,
   MaybeProcessScript();
 }
 
-nsresult
+bool
 nsScriptElement::MaybeProcessScript()
 {
   nsCOMPtr<nsIContent> cont =
@@ -158,7 +158,7 @@ nsScriptElement::MaybeProcessScript()
 
   if (mAlreadyStarted || !mDoneAddingChildren || !cont->IsInDoc() ||
       mMalformed || !HasScriptContent()) {
-    return NS_OK;
+    return false;
   }
 
   FreezeUriAsyncDefer();
@@ -173,21 +173,11 @@ nsScriptElement::MaybeProcessScript()
       nsCOMPtr<nsIDocument> parserDoc = do_QueryInterface(sink->GetTarget());
       if (ownerDoc != parserDoc) {
         // Willful violation of HTML5 as of 2010-12-01
-        return NS_OK;
+        return false;
       }
     }
   }
 
   nsRefPtr<nsScriptLoader> loader = ownerDoc->ScriptLoader();
-  nsresult scriptresult = loader->ProcessScriptElement(this);
-
-  // The only error we don't ignore is NS_ERROR_HTMLPARSER_BLOCK
-  // However we don't want to override other success values
-  // (such as NS_CONTENT_SCRIPT_IS_EVENTHANDLER)
-  if (NS_FAILED(scriptresult) &&
-      scriptresult != NS_ERROR_HTMLPARSER_BLOCK) {
-    scriptresult = NS_OK;
-  }
-
-  return scriptresult;
+  return loader->ProcessScriptElement(this);
 }
diff --git a/content/base/src/nsScriptElement.h b/content/base/src/nsScriptElement.h
index f1ccad5a7ca..8eea6fcdd8a 100644
--- a/content/base/src/nsScriptElement.h
+++ b/content/base/src/nsScriptElement.h
@@ -72,18 +72,5 @@ protected:
    */
   virtual bool HasScriptContent() = 0;
 
-  /**
-   * Processes the script if it's in the document-tree and links to or
-   * contains a script. Once it has been evaluated there is no way to make it
-   * reevaluate the script, you'll have to create a new element. This also means
-   * that when adding a src attribute to an element that already contains an
-   * inline script, the script referenced by the src attribute will not be
-   * loaded.
-   *
-   * In order to be able to use multiple childNodes, or to use the
-   * fallback mechanism of using both inline script and linked script you have
-   * to add all attributes and childNodes before adding the element to the
-   * document-tree.
-   */
-  virtual nsresult MaybeProcessScript();
+  virtual bool MaybeProcessScript();
 };
diff --git a/content/base/src/nsScriptLoader.cpp b/content/base/src/nsScriptLoader.cpp
index a203e0fd86e..4ed4b654565 100644
--- a/content/base/src/nsScriptLoader.cpp
+++ b/content/base/src/nsScriptLoader.cpp
@@ -43,7 +43,6 @@
 
 #include "jscntxt.h"
 #include "nsScriptLoader.h"
-#include "nsIDOMCharacterData.h"
 #include "nsParserUtils.h"
 #include "nsICharsetConverterManager.h"
 #include "nsIUnicodeDecoder.h"
@@ -57,7 +56,6 @@
 #include "nsIScriptSecurityManager.h"
 #include "nsIPrincipal.h"
 #include "nsContentPolicyUtils.h"
-#include "nsIDOMWindow.h"
 #include "nsIHttpChannel.h"
 #include "nsIScriptElement.h"
 #include "nsIDOMHTMLScriptElement.h"
@@ -191,14 +189,15 @@ NS_IMPL_ISUPPORTS1(nsScriptLoader, nsIStreamLoaderObserver)
 // <script for=... event=...> element.
 
 static bool
-IsScriptEventHandler(nsIScriptElement *aScriptElement)
+IsScriptEventHandler(nsIContent* aScriptElement)
 {
-  nsCOMPtr<nsIContent> contElement = do_QueryInterface(aScriptElement);
-  NS_ASSERTION(contElement, "nsIScriptElement isn't nsIContent");
+  if (!aScriptElement->IsHTML()) {
+    return false;
+  }
 
   nsAutoString forAttr, eventAttr;
-  if (!contElement->GetAttr(kNameSpaceID_None, nsGkAtoms::_for, forAttr) ||
-      !contElement->GetAttr(kNameSpaceID_None, nsGkAtoms::event, eventAttr)) {
+  if (!aScriptElement->GetAttr(kNameSpaceID_None, nsGkAtoms::_for, forAttr) ||
+      !aScriptElement->GetAttr(kNameSpaceID_None, nsGkAtoms::event, eventAttr)) {
     return false;
   }
 
@@ -368,22 +367,24 @@ public:
   }
 };
 
-nsresult
+bool
 nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
 {
   // We need a document to evaluate scripts.
-  NS_ENSURE_TRUE(mDocument, NS_ERROR_FAILURE);
+  NS_ENSURE_TRUE(mDocument, false);
 
   // Check to see if scripts has been turned off.
   if (!mEnabled || !mDocument->IsScriptEnabled()) {
-    return NS_ERROR_NOT_AVAILABLE;
+    return false;
   }
 
   NS_ASSERTION(!aElement->IsMalformed(), "Executing malformed script");
 
-  // Check that the script is not an eventhandler
-  if (IsScriptEventHandler(aElement)) {
-    return NS_CONTENT_SCRIPT_IS_EVENTHANDLER;
+  nsCOMPtr<nsIContent> scriptContent = do_QueryInterface(aElement);
+
+  // Step 12. Check that the script is not an eventhandler
+  if (IsScriptEventHandler(scriptContent)) {
+    return false;
   }
 
   // Script evaluation can also be disabled in the current script
@@ -396,7 +397,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
   // XXX is this different from the mDocument->IsScriptEnabled() call?
   nsIScriptGlobalObject *globalObject = mDocument->GetScriptGlobalObject();
   if (!globalObject) {
-    return NS_ERROR_NOT_AVAILABLE;
+    return false;
   }
   
   nsIScriptContext *context = globalObject->GetScriptContext(
@@ -405,7 +406,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
   // If scripts aren't enabled in the current context, there's no
   // point in going on.
   if (!context || !context->GetScriptsEnabled()) {
-    return NS_ERROR_NOT_AVAILABLE;
+    return false;
   }
 
   // Default script language is whatever the root element specifies
@@ -426,7 +427,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
 
     nsAutoString mimeType;
     rv = parser.GetType(mimeType);
-    NS_ENSURE_SUCCESS(rv, rv);
+    NS_ENSURE_SUCCESS(rv, false);
 
     // Javascript keeps the fast path, optimized for most-likely type
     // Table ordered from most to least likely JS MIME types.
@@ -468,13 +469,13 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
       if (NS_FAILED(rv)) {
         // no version attribute - version remains 0.
         if (rv != NS_ERROR_INVALID_ARG)
-          return rv;
+          return false;
       } else {
         nsCOMPtr<nsIScriptRuntime> runtime;
         rv = NS_GetScriptRuntimeByID(typeID, getter_AddRefs(runtime));
         if (NS_FAILED(rv)) {
           NS_ERROR("Failed to locate the language with this ID");
-          return rv;
+          return false;
         }
         rv = runtime->ParseVersion(versionName, &version);
         if (NS_FAILED(rv)) {
@@ -490,7 +491,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
       rv = parser.GetParameter("e4x", value);
       if (NS_FAILED(rv)) {
         if (rv != NS_ERROR_INVALID_ARG)
-          return rv;
+          return false;
       } else {
         if (value.Length() == 1 && value[0] == '1')
           // This means that we need to set JSOPTION_XML in the JS options.
@@ -504,10 +505,8 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
     // no 'type=' element
     // "language" is a deprecated attribute of HTML, so we check it only for
     // HTML script elements.
-    nsCOMPtr<nsIDOMHTMLScriptElement> htmlScriptElement =
-      do_QueryInterface(aElement);
-    if (htmlScriptElement) {
-      htmlScriptElement->GetAttribute(NS_LITERAL_STRING("language"), language);
+    if (scriptContent->IsHTML()) {
+      scriptContent->GetAttr(kNameSpaceID_None, nsGkAtoms::language, language);
       if (!language.IsEmpty()) {
         if (nsParserUtils::IsJavaScriptLanguage(language, &version))
           typeID = nsIProgrammingLanguage::JAVASCRIPT;
@@ -528,7 +527,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
 
   // If we don't know the language, we don't know how to evaluate
   if (typeID == nsIProgrammingLanguage::UNKNOWN) {
-    return NS_ERROR_NOT_AVAILABLE;
+    return false;
   }
   // If not from a chrome document (which is always trusted), we need some way 
   // of checking the language is "safe".  Currently the only other language 
@@ -538,20 +537,19 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
   if (typeID != nsIProgrammingLanguage::JAVASCRIPT &&
       !nsContentUtils::IsChromeDoc(mDocument)) {
     NS_WARNING("Untrusted language called from non-chrome - ignored");
-    return NS_ERROR_NOT_AVAILABLE;
+    return false;
   }
 
-  nsCOMPtr<nsIContent> eltContent(do_QueryInterface(aElement));
-  eltContent->SetScriptTypeID(typeID);
+  scriptContent->SetScriptTypeID(typeID);
 
-  // Step 9. in the HTML5 spec
+  // Step 14. in the HTML5 spec
 
   nsRefPtr<nsScriptLoadRequest> request;
   if (aElement->GetScriptExternal()) {
     // external script
     nsCOMPtr<nsIURI> scriptURI = aElement->GetScriptURI();
     if (!scriptURI) {
-      return NS_ERROR_NOT_AVAILABLE;
+      return false;
     }
     nsTArray<PreloadInfo>::index_type i =
       mPreloads.IndexOf(scriptURI.get(), 0, PreloadURIComparator());
@@ -569,7 +567,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
       aElement->GetScriptCharset(elementCharset);
       if (elementCharset.Equals(preloadCharset)) {
         rv = CheckContentPolicy(mDocument, aElement, request->mURI, type);
-        NS_ENSURE_SUCCESS(rv, rv);
+        NS_ENSURE_SUCCESS(rv, false);
       } else {
         // Drop the preload
         request = nsnull;
@@ -579,12 +577,11 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
     if (!request) {
       // no usable preload
       request = new nsScriptLoadRequest(aElement, version);
-      NS_ENSURE_TRUE(request, NS_ERROR_OUT_OF_MEMORY);
       request->mURI = scriptURI;
       request->mIsInline = false;
       request->mLoading = true;
       rv = StartLoad(request, type);
-      NS_ENSURE_SUCCESS(rv, rv);
+      NS_ENSURE_SUCCESS(rv, false);
     }
 
     request->mJSVersion = version;
@@ -596,7 +593,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
         // loop gets a chance to spin.
         ProcessPendingRequestsAsync();
       }
-      return NS_OK;
+      return false;
     }
     if (!aElement->GetParserCreated()) {
       // Violate the HTML5 spec in order to make LABjs and the "order" plug-in
@@ -608,7 +605,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
         // loop gets a chance to spin.
         ProcessPendingRequestsAsync();
       }
-      return NS_OK;
+      return false;
     }
     // we now have a parser-inserted request that may or may not be still
     // loading
@@ -623,7 +620,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
                    aElement->GetParserCreated() == FROM_PARSER_XSLT,
           "Non-XSLT Defer script on a document without an active parser; bug 592366.");
       mDeferRequests.AppendElement(request);
-      return NS_OK;
+      return false;
     }
 
     if (aElement->GetParserCreated() == FROM_PARSER_XSLT) {
@@ -636,14 +633,14 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
         // loop gets a chance to spin.
         ProcessPendingRequestsAsync();
       }
-      return NS_ERROR_HTMLPARSER_BLOCK;
+      return true;
     }
     if (!request->mLoading && ReadyToExecuteScripts()) {
       // The request has already been loaded and there are no pending style
       // sheets. If the script comes from the network stream, cheat for
       // performance reasons and avoid a trip through the event loop.
       if (aElement->GetParserCreated() == FROM_PARSER_NETWORK) {
-        return ProcessRequest(request);
+        return ProcessRequest(request) == NS_ERROR_HTMLPARSER_BLOCK;
       }
       // Otherwise, we've got a document.written script, make a trip through
       // the event loop to hide the preload effects from the scripts on the
@@ -654,7 +651,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
           "Parser-blocking scripts and XSLT scripts in the same doc!");
       mParserBlockingRequest = request;
       ProcessPendingRequestsAsync();
-      return NS_ERROR_HTMLPARSER_BLOCK;
+      return true;
     }
     // The script hasn't loaded yet or there's a style sheet blocking it.
     // The script will be run when it loads or the style sheet loads.
@@ -663,19 +660,19 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
     NS_ASSERTION(mXSLTRequests.IsEmpty(),
         "Parser-blocking scripts and XSLT scripts in the same doc!");
     mParserBlockingRequest = request;
-    return NS_ERROR_HTMLPARSER_BLOCK;
+    return true;
   }
 
   // inline script
   nsCOMPtr<nsIContentSecurityPolicy> csp;
   rv = mDocument->NodePrincipal()->GetCsp(getter_AddRefs(csp));
-  NS_ENSURE_SUCCESS(rv, rv);
+  NS_ENSURE_SUCCESS(rv, false);
 
   if (csp) {
     PR_LOG(gCspPRLog, PR_LOG_DEBUG, ("New ScriptLoader i ****with CSP****"));
     bool inlineOK;
     rv = csp->GetAllowsInlineScript(&inlineOK);
-    NS_ENSURE_SUCCESS(rv, rv);
+    NS_ENSURE_SUCCESS(rv, false);
 
     if (!inlineOK) {
       PR_LOG(gCspPRLog, PR_LOG_DEBUG, ("CSP blocked inline scripts (2)"));
@@ -696,12 +693,11 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
                                NS_ConvertUTF8toUTF16(asciiSpec),
                                scriptText,
                                aElement->GetScriptLineNumber());
-      return NS_ERROR_FAILURE;
+      return false;
     }
   }
 
   request = new nsScriptLoadRequest(aElement, version);
-  NS_ENSURE_TRUE(request, NS_ERROR_OUT_OF_MEMORY);
   request->mJSVersion = version;
   request->mLoading = false;
   request->mIsInline = true;
@@ -714,14 +710,14 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
     NS_ASSERTION(!mParserBlockingRequest,
         "Parser-blocking scripts and XSLT scripts in the same doc!");
     mXSLTRequests.AppendElement(request);
-    return NS_ERROR_HTMLPARSER_BLOCK;
+    return true;
   }
   if (aElement->GetParserCreated() == NOT_FROM_PARSER) {
     NS_ASSERTION(!nsContentUtils::IsSafeToRunScript(),
         "A script-inserted script is inserted without an update batch?");
     nsContentUtils::AddScriptRunner(new nsScriptRequestProcessor(this,
                                                                  request));
-    return NS_OK;
+    return false;
   }
   if (aElement->GetParserCreated() == FROM_PARSER_NETWORK &&
       !ReadyToExecuteScripts()) {
@@ -730,7 +726,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
     mParserBlockingRequest = request;
     NS_ASSERTION(mXSLTRequests.IsEmpty(),
         "Parser-blocking scripts and XSLT scripts in the same doc!");
-    return NS_ERROR_HTMLPARSER_BLOCK;
+    return true;
   }
   // We now have a document.written inline script or we have an inline script
   // from the network but there is no style sheet that is blocking scripts.
@@ -742,7 +738,7 @@ nsScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
   // is on the call stack.
   NS_ASSERTION(nsContentUtils::IsSafeToRunScript(),
       "Not safe to run a parser-inserted script?");
-  return ProcessRequest(request);
+  return ProcessRequest(request) == NS_ERROR_HTMLPARSER_BLOCK;
 }
 
 nsresult
diff --git a/content/base/src/nsScriptLoader.h b/content/base/src/nsScriptLoader.h
index 56c78c9606c..708d59fefc4 100644
--- a/content/base/src/nsScriptLoader.h
+++ b/content/base/src/nsScriptLoader.h
@@ -108,14 +108,14 @@ public:
    * (i.e. there are no other scripts pending) then ScriptAvailable
    * and ScriptEvaluated will be called before the function returns.
    *
-   * If NS_ERROR_HTMLPARSER_BLOCK is returned the script could not be
-   * executed immediately. In this case ScriptAvailable is guaranteed
-   * to be called at a later point (as well as possibly ScriptEvaluated).
+   * If true is returned the script could not be executed immediately.
+   * In this case ScriptAvailable is guaranteed to be called at a later
+   * point (as well as possibly ScriptEvaluated).
    *
    * @param aElement The element representing the script to be loaded and
    *        evaluated.
    */
-  nsresult ProcessScriptElement(nsIScriptElement* aElement);
+  bool ProcessScriptElement(nsIScriptElement* aElement);
 
   /**
    * Gets the currently executing script. This is useful if you want to
@@ -134,9 +134,8 @@ public:
   /**
    * Whether the loader is enabled or not.
    * When disabled, processing of new script elements is disabled. 
-   * Any call to ProcessScriptElement() will fail with a return code of
-   * NS_ERROR_NOT_AVAILABLE. Note that this DOES NOT disable
-   * currently loading or executing scripts.
+   * Any call to ProcessScriptElement() will return false. Note that
+   * this DOES NOT disable currently loading or executing scripts.
    */
   bool GetEnabled()
   {
diff --git a/content/base/src/nsXMLHttpRequest.cpp b/content/base/src/nsXMLHttpRequest.cpp
index 570ef6bcbb7..20517e8d047 100644
--- a/content/base/src/nsXMLHttpRequest.cpp
+++ b/content/base/src/nsXMLHttpRequest.cpp
@@ -71,6 +71,7 @@
 #include "nsIVariant.h"
 #include "xpcprivate.h"
 #include "nsIParser.h"
+#include "XPCQuickStubs.h"
 #include "nsStringStream.h"
 #include "nsIStreamConverterService.h"
 #include "nsICachingChannel.h"
@@ -1030,15 +1031,8 @@ NS_IMETHODIMP nsXMLHttpRequest::GetResponse(JSContext *aCx, jsval *aResult)
       nsString str;
       rv = GetResponseText(str);
       if (NS_FAILED(rv)) return rv;
-      if (str.IsVoid()) {
-        *aResult = JSVAL_NULL;
-      } else {
-        nsStringBuffer* buf;
-        *aResult = XPCStringConvert::ReadableToJSVal(aCx, str, &buf);
-        if (buf) {
-          str.ForgetSharedBuffer();
-        }
-      }
+      NS_ENSURE_TRUE(xpc_qsStringToJsval(aCx, str, aResult),
+                     NS_ERROR_OUT_OF_MEMORY);
     }
     break;
 
diff --git a/content/html/content/src/nsGenericHTMLElement.cpp b/content/html/content/src/nsGenericHTMLElement.cpp
index 2b2f345bcc8..db6960738fb 100644
--- a/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/content/html/content/src/nsGenericHTMLElement.cpp
@@ -474,13 +474,6 @@ nsGenericHTMLElement::GetAccessKeyLabel(nsAString& aLabel)
   return NS_OK;
 }
 
-static bool
-IsBody(nsIContent *aContent)
-{
-  return aContent->NodeInfo()->Equals(nsGkAtoms::body) &&
-         aContent->IsHTML();
-}
-
 static bool IS_TABLE_CELL(nsIAtom* frameType) {
   return nsGkAtoms::tableCellFrame == frameType ||
     nsGkAtoms::bcTableCellFrame == frameType;
@@ -516,7 +509,7 @@ nsGenericHTMLElement::GetOffsetRect(nsRect& aRect, nsIContent** aOffsetParent)
   Element* docElement = GetCurrentDoc()->GetRootElement();
   nsIContent* content = frame->GetContent();
 
-  if (content && (IsBody(content) || content == docElement)) {
+  if (content && (content->IsHTML(nsGkAtoms::body) || content == docElement)) {
     parent = frame;
   }
   else {
@@ -550,7 +543,7 @@ nsGenericHTMLElement::GetOffsetRect(nsRect& aRect, nsIContent** aOffsetParent)
 
         // Break if the ancestor frame type makes it suitable as offset parent
         // and this element is *not* positioned or if we found the body element.
-        if (isOffsetParent || IsBody(content)) {
+        if (isOffsetParent || content->IsHTML(nsGkAtoms::body)) {
           *aOffsetParent = content;
           NS_ADDREF(*aOffsetParent);
           break;
@@ -1090,8 +1083,8 @@ NS_IMETHODIMP
 nsGenericHTMLElement::SetDraggable(bool aDraggable)
 {
   return SetAttrHelper(nsGkAtoms::draggable,
-                       aDraggable ? NS_LITERAL_STRING("true") :
-                                    NS_LITERAL_STRING("false"));
+                       aDraggable ? NS_LITERAL_STRING("true")
+                                  : NS_LITERAL_STRING("false"));
 }
 
 bool
@@ -1172,8 +1165,7 @@ nsGenericHTMLElement::FindAncestorForm(nsHTMLFormElement* aCurrentForm)
   nsIContent* content = this;
   while (content != bindingParent && content) {
     // If the current ancestor is a form, return it as our form
-    if (content->Tag() == nsGkAtoms::form &&
-        content->IsHTML()) {
+    if (content->IsHTML(nsGkAtoms::form)) {
 #ifdef DEBUG
       if (!nsContentUtils::IsInSameAnonymousTree(this, content)) {
         // It's possible that we started unbinding at |content| or
@@ -1565,10 +1557,6 @@ nsGenericHTMLElement::GetPrimaryPresState(nsGenericHTMLElement* aContent,
     result = history->GetState(key, aPresState);
     if (!*aPresState) {
       *aPresState = new nsPresState();
-      if (!*aPresState) {
-        return NS_ERROR_OUT_OF_MEMORY;
-      }
-        
       result = history->AddState(key, *aPresState);
     }
   }
@@ -1659,7 +1647,7 @@ nsGenericHTMLElement::GetPresContext()
   // Get the document
   nsIDocument* doc = GetDocument();
   if (doc) {
-    // Get presentation shell 0
+    // Get presentation shell.
     nsIPresShell *presShell = doc->GetShell();
     if (presShell) {
       return presShell->GetPresContext();
@@ -1794,9 +1782,9 @@ nsGenericHTMLElement::ParseImageAttribute(nsIAtom* aAttribute,
       (aAttribute == nsGkAtoms::height)) {
     return aResult.ParseSpecialIntValue(aString);
   }
-  else if ((aAttribute == nsGkAtoms::hspace) ||
-           (aAttribute == nsGkAtoms::vspace) ||
-           (aAttribute == nsGkAtoms::border)) {
+  if ((aAttribute == nsGkAtoms::hspace) ||
+      (aAttribute == nsGkAtoms::vspace) ||
+      (aAttribute == nsGkAtoms::border)) {
     return aResult.ParseIntWithBounds(aString, 0);
   }
   return false;
@@ -3137,8 +3125,7 @@ nsGenericHTMLFormElement::UpdateFormOwner(bool aBindToTree,
                      "element should be equals to the current element "
                      "associated with the id in @form!");
 
-        if (element && element->Tag() == nsGkAtoms::form &&
-            element->IsHTML()) {
+        if (element && element->IsHTML(nsGkAtoms::form)) {
           mForm = static_cast<nsHTMLFormElement*>(element);
         }
       }
@@ -3316,9 +3303,8 @@ nsGenericHTMLFrameElement::GetFrameLoader(nsIFrameLoader **aFrameLoader)
 NS_IMETHODIMP_(already_AddRefed<nsFrameLoader>)
 nsGenericHTMLFrameElement::GetFrameLoader()
 {
-  nsFrameLoader* loader = mFrameLoader;
-  NS_IF_ADDREF(loader);
-  return loader;
+  nsRefPtr<nsFrameLoader> loader = mFrameLoader;
+  return loader.forget();
 }
 
 NS_IMETHODIMP
@@ -3398,8 +3384,7 @@ nsGenericHTMLFrameElement::SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
                                               aValue, aNotify);
   NS_ENSURE_SUCCESS(rv, rv);
   
-  if (aNameSpaceID == kNameSpaceID_None &&
-      aName == nsGkAtoms::src) {
+  if (aNameSpaceID == kNameSpaceID_None && aName == nsGkAtoms::src) {
     // Don't propagate error here. The attribute was successfully set, that's
     // what we should reflect.
     LoadSrc();
@@ -3453,18 +3438,18 @@ nsGenericHTMLFrameElement::SizeOf() const
 nsresult
 nsGenericHTMLElement::Blur()
 {
-  if (!ShouldBlur(this))
+  if (!ShouldBlur(this)) {
     return NS_OK;
+  }
 
   nsIDocument* doc = GetCurrentDoc();
-  if (!doc)
+  if (!doc) {
     return NS_OK;
+  }
 
   nsIDOMWindow* win = doc->GetWindow();
   nsIFocusManager* fm = nsFocusManager::GetFocusManager();
   return (win && fm) ? fm->ClearFocus(win) : NS_OK;
-
-  return NS_OK;
 }
 
 nsresult
@@ -3505,8 +3490,8 @@ nsresult nsGenericHTMLElement::Click()
   // Strong in case the event kills it
   nsCOMPtr<nsIDocument> doc = GetCurrentDoc();
 
-  nsCOMPtr<nsIPresShell> shell = nsnull;
-  nsRefPtr<nsPresContext> context = nsnull;
+  nsCOMPtr<nsIPresShell> shell;
+  nsRefPtr<nsPresContext> context;
   if (doc) {
     shell = doc->GetShell();
     if (shell) {
@@ -3653,8 +3638,9 @@ nsGenericHTMLElement::GetEditor(nsIEditor** aEditor)
 {
   *aEditor = nsnull;
 
-  if (!nsContentUtils::IsCallerTrustedForWrite())
+  if (!nsContentUtils::IsCallerTrustedForWrite()) {
     return NS_ERROR_DOM_SECURITY_ERR;
+  }
 
   return GetEditorInternal(aEditor);
 }
@@ -3686,6 +3672,8 @@ nsGenericHTMLElement::GetAssociatedEditor()
 bool
 nsGenericHTMLElement::IsCurrentBodyElement()
 {
+  // TODO Bug 698498: Should this handle the case where GetBody returns a
+  //                  frameset?
   nsCOMPtr<nsIDOMHTMLBodyElement> bodyElement = do_QueryInterface(this);
   if (!bodyElement) {
     return false;
diff --git a/content/html/content/src/nsHTMLButtonElement.cpp b/content/html/content/src/nsHTMLButtonElement.cpp
index dc95c8a6ffe..2a8485c9262 100644
--- a/content/html/content/src/nsHTMLButtonElement.cpp
+++ b/content/html/content/src/nsHTMLButtonElement.cpp
@@ -551,8 +551,6 @@ nsHTMLButtonElement::Reset()
 NS_IMETHODIMP
 nsHTMLButtonElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
 {
-  nsresult rv = NS_OK;
-
   //
   // We only submit if we were the button pressed
   //
@@ -578,7 +576,7 @@ nsHTMLButtonElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
   // Get the value
   //
   nsAutoString value;
-  rv = GetValue(value);
+  nsresult rv = GetValue(value);
   if (NS_FAILED(rv)) {
     return rv;
   }
@@ -586,9 +584,7 @@ nsHTMLButtonElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
   //
   // Submit
   //
-  rv = aFormSubmission->AddNameValuePair(name, value);
-
-  return rv;
+  return aFormSubmission->AddNameValuePair(name, value);
 }
 
 void
@@ -670,4 +666,3 @@ nsHTMLButtonElement::IntrinsicState() const
 
   return state;
 }
-
diff --git a/content/html/content/src/nsHTMLCanvasElement.cpp b/content/html/content/src/nsHTMLCanvasElement.cpp
index b5d22d642c2..d5be47e2e07 100644
--- a/content/html/content/src/nsHTMLCanvasElement.cpp
+++ b/content/html/content/src/nsHTMLCanvasElement.cpp
@@ -277,7 +277,7 @@ nsHTMLCanvasElement::ExtractData(const nsAString& aType,
 
   NS_ENSURE_SUCCESS(rv, rv);
 
-  return CallQueryInterface(imgStream, aStream);
+  imgStream.forget(aStream);
   return NS_OK;
 }
 
@@ -406,7 +406,8 @@ nsHTMLCanvasElement::MozGetAsFileImpl(const nsAString& aName,
   nsRefPtr<nsDOMMemoryFile> file =
     new nsDOMMemoryFile(imgData, imgSize, aName, type);
 
-  return CallQueryInterface(file, aResult);
+  file.forget(aResult);
+  return NS_OK;
 }
 
 nsresult
@@ -457,7 +458,7 @@ nsHTMLCanvasElement::GetContextHelper(const nsAString& aContextId,
     return rv;
   }
 
-  *aContext = ctx.forget().get();
+  ctx.forget(aContext);
 
   return rv;
 }
@@ -572,10 +573,8 @@ nsHTMLCanvasElement::MozGetIPCContext(const nsAString& aContextId,
   if (!aContextId.Equals(NS_LITERAL_STRING("2d")))
     return NS_ERROR_INVALID_ARG;
 
-  nsresult rv;
-
   if (mCurrentContextId.IsEmpty()) {
-    rv = GetContextHelper(aContextId, false, getter_AddRefs(mCurrentContext));
+    nsresult rv = GetContextHelper(aContextId, false, getter_AddRefs(mCurrentContext));
     NS_ENSURE_SUCCESS(rv, rv);
     if (!mCurrentContext) {
       return NS_OK;
@@ -602,27 +601,26 @@ nsHTMLCanvasElement::UpdateContext(nsIPropertyBag *aNewContextOptions)
   if (!mCurrentContext)
     return NS_OK;
 
-  nsresult rv = NS_OK;
   nsIntSize sz = GetWidthHeight();
 
-  rv = mCurrentContext->SetIsOpaque(GetIsOpaque());
+  nsresult rv = mCurrentContext->SetIsOpaque(GetIsOpaque());
   if (NS_FAILED(rv)) {
     mCurrentContext = nsnull;
-    mCurrentContextId.AssignLiteral("");
+    mCurrentContextId.Truncate();
     return rv;
   }
 
   rv = mCurrentContext->SetContextOptions(aNewContextOptions);
   if (NS_FAILED(rv)) {
     mCurrentContext = nsnull;
-    mCurrentContextId.AssignLiteral("");
+    mCurrentContextId.Truncate();
     return rv;
   }
 
   rv = mCurrentContext->SetDimensions(sz.width, sz.height);
   if (NS_FAILED(rv)) {
     mCurrentContext = nsnull;
-    mCurrentContextId.AssignLiteral("");
+    mCurrentContextId.Truncate();
     return rv;
   }
 
@@ -715,10 +713,10 @@ nsHTMLCanvasElement::CountContexts()
 }
 
 nsICanvasRenderingContextInternal *
-nsHTMLCanvasElement::GetContextAtIndex (PRInt32 index)
+nsHTMLCanvasElement::GetContextAtIndex(PRInt32 index)
 {
   if (mCurrentContext && index == 0)
-    return mCurrentContext.get();
+    return mCurrentContext;
 
   return NULL;
 }
diff --git a/content/html/content/src/nsHTMLFieldSetElement.cpp b/content/html/content/src/nsHTMLFieldSetElement.cpp
index 309742b9ed4..5f36fcf9afe 100644
--- a/content/html/content/src/nsHTMLFieldSetElement.cpp
+++ b/content/html/content/src/nsHTMLFieldSetElement.cpp
@@ -63,7 +63,7 @@ nsHTMLFieldSetElement::nsHTMLFieldSetElement(already_AddRefed<nsINodeInfo> aNode
 nsHTMLFieldSetElement::~nsHTMLFieldSetElement()
 {
   PRUint32 length = mDependentElements.Length();
-  for (PRUint32 i=0; i<length; ++i) {
+  for (PRUint32 i = 0; i < length; ++i) {
     mDependentElements[i]->ForgetFieldSet(this);
   }
 }
@@ -264,7 +264,7 @@ nsHTMLFieldSetElement::NotifyElementsForFirstLegendChange(bool aNotify)
   }
 
   PRUint32 length = mElements->Length(true);
-  for (PRUint32 i=0; i<length; ++i) {
+  for (PRUint32 i = 0; i < length; ++i) {
     static_cast<nsGenericHTMLFormElement*>(mElements->GetNodeAt(i))
       ->FieldSetFirstLegendChanged(aNotify);
   }
diff --git a/content/html/content/src/nsHTMLFontElement.cpp b/content/html/content/src/nsHTMLFontElement.cpp
index 78deff415d9..0f58dfd2b7a 100644
--- a/content/html/content/src/nsHTMLFontElement.cpp
+++ b/content/html/content/src/nsHTMLFontElement.cpp
@@ -47,6 +47,7 @@
 #include "nsMappedAttributes.h"
 #include "nsRuleData.h"
 #include "nsIDocument.h"
+#include "nsAlgorithm.h"
 
 using namespace mozilla;
 
@@ -217,7 +218,7 @@ MapAttributesIntoRule(const nsMappedAttributes* aAttributes,
             else
               size = value->GetIntegerValue();
 
-            size = ((0 < size) ? ((size < 8) ? size : 7) : 1); 
+            size = clamped(size, 1, 7);
             fontSize->SetIntValue(size, eCSSUnit_Enumerated);
           }
         }
diff --git a/content/html/content/src/nsHTMLFormElement.cpp b/content/html/content/src/nsHTMLFormElement.cpp
index da2f792604f..667c6467967 100644
--- a/content/html/content/src/nsHTMLFormElement.cpp
+++ b/content/html/content/src/nsHTMLFormElement.cpp
@@ -1998,8 +1998,6 @@ nsHTMLFormElement::WalkRadioGroup(const nsAString& aName,
                                   nsIRadioVisitor* aVisitor,
                                   bool aFlushContent)
 {
-  nsresult rv = NS_OK;
-
   if (aName.IsEmpty()) {
     //
     // XXX If the name is empty, it's not stored in the control list.  There
@@ -2007,60 +2005,52 @@ nsHTMLFormElement::WalkRadioGroup(const nsAString& aName,
     //
     nsCOMPtr<nsIFormControl> control;
     PRUint32 len = GetElementCount();
-    for (PRUint32 i=0; i<len; i++) {
+    for (PRUint32 i = 0; i < len; i++) {
       control = GetElementAt(i);
       if (control->GetType() == NS_FORM_INPUT_RADIO) {
-        nsCOMPtr<nsIContent> controlContent(do_QueryInterface(control));
-        if (controlContent) {
-          if (controlContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name,
-                                          EmptyString(), eCaseMatters)) {
-            if (!aVisitor->Visit(control)) {
-              break;
-            }
-          }
-        }
-      }
-    }
-  } else {
-    //
-    // Get the control / list of controls from the form using form["name"]
-    //
-    nsCOMPtr<nsISupports> item;
-    item = DoResolveName(aName, aFlushContent);
-    rv = item ? NS_OK : NS_ERROR_FAILURE;
-
-    if (item) {
-      //
-      // If it's just a lone radio button, then select it.
-      //
-      nsCOMPtr<nsIFormControl> formControl(do_QueryInterface(item));
-      if (formControl) {
-        if (formControl->GetType() == NS_FORM_INPUT_RADIO) {
-          aVisitor->Visit(formControl);
-        }
-      } else {
-        nsCOMPtr<nsIDOMNodeList> nodeList(do_QueryInterface(item));
-        if (nodeList) {
-          PRUint32 length = 0;
-          nodeList->GetLength(&length);
-          for (PRUint32 i=0; i<length; i++) {
-            nsCOMPtr<nsIDOMNode> node;
-            nodeList->Item(i, getter_AddRefs(node));
-            nsCOMPtr<nsIFormControl> formControl(do_QueryInterface(node));
-            if (formControl) {
-              if (formControl->GetType() == NS_FORM_INPUT_RADIO) {
-                if (!aVisitor->Visit(formControl)) {
-                  break;
-                }
-              }
-            }
-          }
+        nsCOMPtr<nsIContent> controlContent = do_QueryInterface(control);
+        if (controlContent &&
+            controlContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name,
+                                        EmptyString(), eCaseMatters) &&
+            !aVisitor->Visit(control)) {
+          break;
         }
       }
     }
+    return NS_OK;
   }
 
-  return rv;
+  // Get the control / list of controls from the form using form["name"]
+  nsCOMPtr<nsISupports> item = DoResolveName(aName, aFlushContent);
+  if (!item) {
+    return NS_ERROR_FAILURE;
+  }
+
+  // If it's just a lone radio button, then select it.
+  nsCOMPtr<nsIFormControl> formControl = do_QueryInterface(item);
+  if (formControl) {
+    if (formControl->GetType() == NS_FORM_INPUT_RADIO) {
+      aVisitor->Visit(formControl);
+    }
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsIDOMNodeList> nodeList = do_QueryInterface(item);
+  if (!nodeList) {
+    return NS_OK;
+  }
+  PRUint32 length = 0;
+  nodeList->GetLength(&length);
+  for (PRUint32 i = 0; i < length; i++) {
+    nsCOMPtr<nsIDOMNode> node;
+    nodeList->Item(i, getter_AddRefs(node));
+    nsCOMPtr<nsIFormControl> formControl = do_QueryInterface(node);
+    if (formControl && formControl->GetType() == NS_FORM_INPUT_RADIO &&
+        !aVisitor->Visit(formControl)) {
+      break;
+    }
+  }
+  return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -2181,13 +2171,12 @@ void
 nsFormControlList::Clear()
 {
   // Null out childrens' pointer to me.  No refcounting here
-  PRInt32 i;
-  for (i = mElements.Length()-1; i >= 0; i--) {
+  for (PRInt32 i = mElements.Length() - 1; i >= 0; i--) {
     mElements[i]->ClearForm(false);
   }
   mElements.Clear();
 
-  for (i = mNotInElements.Length()-1; i >= 0; i--) {
+  for (PRInt32 i = mNotInElements.Length() - 1; i >= 0; i--) {
     mNotInElements[i]->ClearForm(false);
   }
   mNotInElements.Clear();
@@ -2277,31 +2266,33 @@ nsFormControlList::NamedItem(const nsAString& aName,
 
   *aReturn = nsnull;
 
-  nsresult rv = NS_OK;
-
   nsCOMPtr<nsISupports> supports;
   
-  if (!mNameLookupTable.Get(aName, getter_AddRefs(supports))) // key not found
-     return rv;
-
-  if (supports) {
-    // We found something, check if it's a node
-    CallQueryInterface(supports, aReturn);
-
-    if (!*aReturn) {
-      // If not, we check if it's a node list.
-      nsCOMPtr<nsIDOMNodeList> nodeList(do_QueryInterface(supports));
-      NS_ASSERTION(nodeList, "Huh, what's going one here?");
-
-      if (nodeList) {
-        // And since we're only asking for one node here, we return the first
-        // one from the list.
-        rv = nodeList->Item(0, aReturn);
-      }
-    }
+  if (!mNameLookupTable.Get(aName, getter_AddRefs(supports))) {
+    // key not found
+    return NS_OK;
   }
 
-  return rv;
+  if (!supports) {
+    return NS_OK;
+  }
+
+  // We found something, check if it's a node
+  CallQueryInterface(supports, aReturn);
+  if (*aReturn) {
+    return NS_OK;
+  }
+
+  // If not, we check if it's a node list.
+  nsCOMPtr<nsIDOMNodeList> nodeList = do_QueryInterface(supports);
+  NS_ASSERTION(nodeList, "Huh, what's going one here?");
+  if (!nodeList) {
+    return NS_OK;
+  }
+
+  // And since we're only asking for one node here, we return the first
+  // one from the list.
+  return nodeList->Item(0, aReturn);
 }
 
 nsISupports*
@@ -2328,12 +2319,12 @@ nsFormControlList::AddElementToTable(nsGenericHTMLFormElement* aChild,
 
   if (!supports) {
     // No entry found, add the form control
-    NS_ENSURE_TRUE( mNameLookupTable.Put(aName,
-                                         NS_ISUPPORTS_CAST(nsIContent*, aChild)),
-                    NS_ERROR_FAILURE );
+    NS_ENSURE_TRUE(mNameLookupTable.Put(aName,
+                                        NS_ISUPPORTS_CAST(nsIContent*, aChild)),
+                   NS_ERROR_FAILURE);
   } else {
     // Found something in the hash, check its type
-    nsCOMPtr<nsIContent> content(do_QueryInterface(supports));
+    nsCOMPtr<nsIContent> content = do_QueryInterface(supports);
 
     if (content) {
       // Check if the new content is the same as the one we found in the
@@ -2347,7 +2338,6 @@ nsFormControlList::AddElementToTable(nsGenericHTMLFormElement* aChild,
       // Found an element, create a list, add the element to the list and put
       // the list in the hash
       nsSimpleContentList *list = new nsSimpleContentList(mForm);
-      NS_ENSURE_TRUE(list, NS_ERROR_OUT_OF_MEMORY);
 
       NS_ASSERTION(content->GetParent(), "Item in list without parent");
 
@@ -2365,12 +2355,12 @@ nsFormControlList::AddElementToTable(nsGenericHTMLFormElement* aChild,
                      NS_ERROR_FAILURE);
     } else {
       // There's already a list in the hash, add the child to the list
-      nsCOMPtr<nsIDOMNodeList> nodeList(do_QueryInterface(supports));
+      nsCOMPtr<nsIDOMNodeList> nodeList = do_QueryInterface(supports);
       NS_ENSURE_TRUE(nodeList, NS_ERROR_FAILURE);
 
       // Upcast, uggly, but it works!
-      nsSimpleContentList *list = static_cast<nsSimpleContentList *>
-                                           ((nsIDOMNodeList *)nodeList.get());
+      nsSimpleContentList *list =
+        static_cast<nsSimpleContentList*>(nodeList.get());
 
       NS_ASSERTION(list->Length() > 1,
                    "List should have been converted back to a single element");
@@ -2379,7 +2369,7 @@ nsFormControlList::AddElementToTable(nsGenericHTMLFormElement* aChild,
       // already in the list, since if it tests true the child would
       // have come at the end of the list, and the PositionIsBefore
       // will test false.
-      if(nsContentUtils::PositionIsBefore(list->GetNodeAt(list->Length() - 1), aChild)) {
+      if (nsContentUtils::PositionIsBefore(list->GetNodeAt(list->Length() - 1), aChild)) {
         list->AppendElement(aChild);
         return NS_OK;
       }
@@ -2455,8 +2445,7 @@ nsFormControlList::RemoveElementFromTable(nsGenericHTMLFormElement* aChild,
   NS_ENSURE_TRUE(nodeList, NS_ERROR_FAILURE);
 
   // Upcast, uggly, but it works!
-  nsBaseContentList *list = static_cast<nsBaseContentList *>
-                                       ((nsIDOMNodeList *)nodeList.get());
+  nsBaseContentList *list = static_cast<nsBaseContentList*>(nodeList.get());
 
   list->RemoveElement(aChild);
 
diff --git a/content/html/content/src/nsHTMLFormElement.h b/content/html/content/src/nsHTMLFormElement.h
index a978b38beae..89cbbac51ca 100644
--- a/content/html/content/src/nsHTMLFormElement.h
+++ b/content/html/content/src/nsHTMLFormElement.h
@@ -74,7 +74,7 @@ public:
   KeyType GetKey() const { return mStr; }
   bool KeyEquals(const KeyTypePointer aKey) const
   {
-    return mStr.Equals(*aKey,nsCaseInsensitiveStringComparator());
+    return mStr.Equals(*aKey, nsCaseInsensitiveStringComparator());
   }
 
   static KeyTypePointer KeyToPointer(KeyType aKey) { return &aKey; }
diff --git a/content/html/content/src/nsHTMLImageElement.cpp b/content/html/content/src/nsHTMLImageElement.cpp
index 3c7b2f755e9..7d253b7731f 100644
--- a/content/html/content/src/nsHTMLImageElement.cpp
+++ b/content/html/content/src/nsHTMLImageElement.cpp
@@ -678,7 +678,7 @@ nsHTMLImageElement::GetCORSMode()
   if (value) {
     NS_ASSERTION(value->Type() == nsAttrValue::eEnum,
                  "Why is this not an enum value?");
-    ret = (nsImageLoadingContent::CORSMode) value->GetEnumValue();
+    ret = nsImageLoadingContent::CORSMode(value->GetEnumValue());
   }
 
   return ret;
diff --git a/content/html/content/src/nsHTMLInputElement.cpp b/content/html/content/src/nsHTMLInputElement.cpp
index fb7c876823e..578e6223af9 100644
--- a/content/html/content/src/nsHTMLInputElement.cpp
+++ b/content/html/content/src/nsHTMLInputElement.cpp
@@ -119,6 +119,7 @@
 #include "nsRadioVisitor.h"
 
 #include "mozilla/LookAndFeel.h"
+#include "mozilla/Util.h" // DebugOnly
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -257,8 +258,6 @@ protected:
 NS_IMETHODIMP
 AsyncClickHandler::Run()
 {
-  nsresult rv;
-
   // Get parent nsPIDOMWindow object.
   nsCOMPtr<nsIDocument> doc = mInput->OwnerDoc();
 
@@ -296,9 +295,10 @@ AsyncClickHandler::Run()
 
   bool multi = mInput->HasAttr(kNameSpaceID_None, nsGkAtoms::multiple);
 
-  rv = filePicker->Init(win, title, multi ?
-                        (PRInt16)nsIFilePicker::modeOpenMultiple :
-                        (PRInt16)nsIFilePicker::modeOpen);
+  nsresult rv = filePicker->Init(win, title,
+                                 multi
+                                  ? static_cast<PRInt16>(nsIFilePicker::modeOpenMultiple)
+                                  : static_cast<PRInt16>(nsIFilePicker::modeOpen));
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (mInput->HasAttr(kNameSpaceID_None, nsGkAtoms::accept)) {
@@ -485,9 +485,7 @@ UploadLastDir::FetchLastUsedDirectory(nsIURI* aURI, nsILocalFile** aFile)
     if (!localFile)
       return NS_ERROR_OUT_OF_MEMORY;
     localFile->InitWithPath(prefStr);
-
-    *aFile = localFile;
-    NS_ADDREF(*aFile);
+    localFile.forget(aFile);
   }
   return NS_OK;
 }
@@ -553,15 +551,22 @@ NS_IMPL_NS_NEW_HTML_ELEMENT_CHECK_PARSER(Input)
 
 nsHTMLInputElement::nsHTMLInputElement(already_AddRefed<nsINodeInfo> aNodeInfo,
                                        FromParser aFromParser)
-  : nsGenericHTMLFormElement(aNodeInfo),
-    mType(kInputDefaultType->value),
-    mBitField(0)
+  : nsGenericHTMLFormElement(aNodeInfo)
+  , mType(kInputDefaultType->value)
+  , mDisabledChanged(false)
+  , mValueChanged(false)
+  , mCheckedChanged(false)
+  , mChecked(false)
+  , mHandlingSelectEvent(false)
+  , mShouldInitChecked(false)
+  , mParserCreating(aFromParser != NOT_FROM_PARSER)
+  , mInInternalActivate(false)
+  , mCheckedIsToggled(false)
+  , mIndeterminate(false)
+  , mInhibitRestoration(aFromParser & FROM_PARSER_FRAGMENT)
+  , mCanShowValidUI(true)
+  , mCanShowInvalidUI(true)
 {
-  SET_BOOLBIT(mBitField, BF_PARSER_CREATING, aFromParser);
-  SET_BOOLBIT(mBitField, BF_INHIBIT_RESTORATION,
-      aFromParser & mozilla::dom::FROM_PARSER_FRAGMENT);
-  SET_BOOLBIT(mBitField, BF_CAN_SHOW_INVALID_UI, true);
-  SET_BOOLBIT(mBitField, BF_CAN_SHOW_VALID_UI, true);
   mInputData.mState = new nsTextEditorState(this);
   NS_ADDREF(mInputData.mState);
   
@@ -663,9 +668,9 @@ nsHTMLInputElement::Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const
   *aResult = nsnull;
 
   nsCOMPtr<nsINodeInfo> ni = aNodeInfo;
-  nsHTMLInputElement *it = new nsHTMLInputElement(ni.forget(), NOT_FROM_PARSER);
+  nsRefPtr<nsHTMLInputElement> it =
+    new nsHTMLInputElement(ni.forget(), NOT_FROM_PARSER);
 
-  nsCOMPtr<nsINode> kungFuDeathGrip = it;
   nsresult rv = CopyInnerTo(it);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -676,7 +681,7 @@ nsHTMLInputElement::Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const
     case NS_FORM_INPUT_PASSWORD:
     case NS_FORM_INPUT_TEL:
     case NS_FORM_INPUT_URL:
-      if (GetValueChanged()) {
+      if (mValueChanged) {
         // We don't have our default value anymore.  Set our value on
         // the clone.
         nsAutoString value;
@@ -697,10 +702,10 @@ nsHTMLInputElement::Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const
       break;
     case NS_FORM_INPUT_RADIO:
     case NS_FORM_INPUT_CHECKBOX:
-      if (GET_BOOLBIT(mBitField, BF_CHECKED_CHANGED)) {
+      if (mCheckedChanged) {
         // We no longer have our original checked state.  Set our
         // checked state on the clone.
-        it->DoSetChecked(GetChecked(), false, true);
+        it->DoSetChecked(mChecked, false, true);
       }
       break;
     case NS_FORM_INPUT_IMAGE:
@@ -712,8 +717,7 @@ nsHTMLInputElement::Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const
       break;
   }
 
-  kungFuDeathGrip.swap(*aResult);
-
+  it.forget(aResult);
   return NS_OK;
 }
 
@@ -731,7 +735,7 @@ nsHTMLInputElement::BeforeSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
     if ((aName == nsGkAtoms::name ||
          (aName == nsGkAtoms::type && !mForm)) &&
         mType == NS_FORM_INPUT_RADIO &&
-        (mForm || !(GET_BOOLBIT(mBitField, BF_PARSER_CREATING)))) {
+        (mForm || !mParserCreating)) {
       WillRemoveFromRadioGroup();
     } else if (aNotify && aName == nsGkAtoms::src &&
                mType == NS_FORM_INPUT_IMAGE) {
@@ -742,7 +746,7 @@ nsHTMLInputElement::BeforeSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
         CancelImageRequests(aNotify);
       }
     } else if (aNotify && aName == nsGkAtoms::disabled) {
-      SET_BOOLBIT(mBitField, BF_DISABLED_CHANGED, true);
+      mDisabledChanged = true;
     }
   }
 
@@ -764,7 +768,7 @@ nsHTMLInputElement::AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
     if ((aName == nsGkAtoms::name ||
          (aName == nsGkAtoms::type && !mForm)) &&
         mType == NS_FORM_INPUT_RADIO &&
-        (mForm || !(GET_BOOLBIT(mBitField, BF_PARSER_CREATING)))) {
+        (mForm || !mParserCreating)) {
       AddedToRadioGroup();
       UpdateValueMissingValidityStateForRadio(false);
     }
@@ -774,23 +778,20 @@ nsHTMLInputElement::AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
     // we have to re-set it. This is only the case when GetValueMode() returns
     // VALUE_MODE_VALUE.
     if (aName == nsGkAtoms::value &&
-        !GetValueChanged() && GetValueMode() == VALUE_MODE_VALUE) {
+        !mValueChanged && GetValueMode() == VALUE_MODE_VALUE) {
       SetDefaultValueAsValue();
     }
 
     //
     // Checked must be set no matter what type of control it is, since
-    // GetChecked() must reflect the new value
-    if (aName == nsGkAtoms::checked &&
-        !GET_BOOLBIT(mBitField, BF_CHECKED_CHANGED)) {
+    // mChecked must reflect the new value
+    if (aName == nsGkAtoms::checked && !mCheckedChanged) {
       // Delay setting checked if the parser is creating this element (wait
       // until everything is set)
-      if (GET_BOOLBIT(mBitField, BF_PARSER_CREATING)) {
-        SET_BOOLBIT(mBitField, BF_SHOULD_INIT_CHECKED, true);
+      if (mParserCreating) {
+        mShouldInitChecked = true;
       } else {
-        bool defaultChecked;
-        GetDefaultChecked(&defaultChecked);
-        DoSetChecked(defaultChecked, true, true);
+        DoSetChecked(DefaultChecked(), true, true);
         SetCheckedChanged(false);
       }
     }
@@ -897,7 +898,7 @@ NS_IMPL_ENUM_ATTR_DEFAULT_VALUE(nsHTMLInputElement, Type, type,
 NS_IMETHODIMP
 nsHTMLInputElement::GetIndeterminate(bool* aValue)
 {
-  *aValue = GET_BOOLBIT(mBitField, BF_INDETERMINATE);
+  *aValue = mIndeterminate;
   return NS_OK;
 }
 
@@ -905,7 +906,7 @@ nsresult
 nsHTMLInputElement::SetIndeterminateInternal(bool aValue,
                                              bool aShouldInvalidate)
 {
-  SET_BOOLBIT(mBitField, BF_INDETERMINATE, aValue);
+  mIndeterminate = aValue;
 
   if (aShouldInvalidate) {
     // Repaint the frame
@@ -1011,22 +1012,25 @@ nsHTMLInputElement::SetValue(const nsAString& aValue)
 NS_IMETHODIMP
 nsHTMLInputElement::GetList(nsIDOMHTMLElement** aValue)
 {
+  *aValue = nsnull;
+
   nsAutoString dataListId;
   GetAttr(kNameSpaceID_None, nsGkAtoms::list, dataListId);
-  if (!dataListId.IsEmpty()) {
-    nsIDocument* doc = GetCurrentDoc();
-
-    if (doc) {
-      Element* elem = doc->GetElementById(dataListId);
-
-      if (elem && elem->IsHTML(nsGkAtoms::datalist)) {
-        CallQueryInterface(elem, aValue);
-        return NS_OK;
-      }
-    }
+  if (dataListId.IsEmpty()) {
+    return NS_OK;
   }
 
-  *aValue = nsnull;
+  nsIDocument* doc = GetCurrentDoc();
+  if (!doc) {
+    return NS_OK;
+  }
+
+  Element* element = doc->GetElementById(dataListId);
+  if (!element || !element->IsHTML(nsGkAtoms::datalist)) {
+    return NS_OK;
+  }
+
+  CallQueryInterface(element, aValue);
   return NS_OK;
 }
 
@@ -1042,8 +1046,11 @@ nsHTMLInputElement::MozGetFileNameArray(PRUint32 *aLength, PRUnichar ***aFileNam
   *aLength = mFiles.Count();
   PRUnichar **ret =
     static_cast<PRUnichar **>(NS_Alloc(mFiles.Count() * sizeof(PRUnichar*)));
-  
-  for (PRInt32 i = 0; i <  mFiles.Count(); i++) {
+  if (!ret) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  for (PRInt32 i = 0; i < mFiles.Count(); i++) {
     nsString str;
     mFiles[i]->GetMozFullPathInternal(str);
     ret[i] = NS_strdup(str.get());
@@ -1243,7 +1250,7 @@ nsHTMLInputElement::GetDisplayFileName(nsAString& aValue) const
   }
 
   aValue.Truncate();
-  for (PRUint32 i = 0; i < (PRUint32)mFiles.Count(); ++i) {
+  for (PRInt32 i = 0; i < mFiles.Count(); ++i) {
     nsString str;
     mFiles[i]->GetMozFullPathInternal(str);
     if (i == 0) {
@@ -1319,7 +1326,7 @@ nsHTMLInputElement::UpdateFileList()
     mFileList->Clear();
 
     const nsCOMArray<nsIDOMFile>& files = GetFiles();
-    for (PRUint32 i = 0; i < (PRUint32)files.Count(); ++i) {
+    for (PRInt32 i = 0; i < files.Count(); ++i) {
       if (!mFileList->Append(files[i])) {
         return NS_ERROR_FAILURE;
       }
@@ -1345,7 +1352,7 @@ nsHTMLInputElement::SetValueInternal(const nsAString& aValue,
       // it if it's useless.
       nsAutoString value(aValue);
 
-      if (!GET_BOOLBIT(mBitField, BF_PARSER_CREATING)) {
+      if (!mParserCreating) {
         SanitizeValue(value);
       }
 
@@ -1394,9 +1401,9 @@ nsHTMLInputElement::SetValueInternal(const nsAString& aValue,
 NS_IMETHODIMP
 nsHTMLInputElement::SetValueChanged(bool aValueChanged)
 {
-  bool valueChangedBefore = GetValueChanged();
+  bool valueChangedBefore = mValueChanged;
 
-  SET_BOOLBIT(mBitField, BF_VALUE_CHANGED, aValueChanged);
+  mValueChanged = aValueChanged;
 
   if (valueChangedBefore != aValueChanged) {
     UpdateState(true);
@@ -1408,7 +1415,7 @@ nsHTMLInputElement::SetValueChanged(bool aValueChanged)
 NS_IMETHODIMP 
 nsHTMLInputElement::GetChecked(bool* aChecked)
 {
-  *aChecked = GetChecked();
+  *aChecked = mChecked;
   return NS_OK;
 }
 
@@ -1423,7 +1430,7 @@ nsHTMLInputElement::DoSetCheckedChanged(bool aCheckedChanged,
                                         bool aNotify)
 {
   if (mType == NS_FORM_INPUT_RADIO) {
-    if (GET_BOOLBIT(mBitField, BF_CHECKED_CHANGED) != aCheckedChanged) {
+    if (mCheckedChanged != aCheckedChanged) {
       nsCOMPtr<nsIRadioVisitor> visitor =
         new nsRadioSetCheckedChangedVisitor(aCheckedChanged);
       VisitGroup(visitor, aNotify);
@@ -1436,9 +1443,9 @@ nsHTMLInputElement::DoSetCheckedChanged(bool aCheckedChanged,
 void
 nsHTMLInputElement::SetCheckedChangedInternal(bool aCheckedChanged)
 {
-  bool checkedChangedBefore = GetCheckedChanged();
+  bool checkedChangedBefore = mCheckedChanged;
 
-  SET_BOOLBIT(mBitField, BF_CHECKED_CHANGED, aCheckedChanged);
+  mCheckedChanged = aCheckedChanged;
 
   // This method can't be called when we are not authorized to notify
   // so we do not need a aNotify parameter.
@@ -1457,8 +1464,6 @@ nsresult
 nsHTMLInputElement::DoSetChecked(bool aChecked, bool aNotify,
                                  bool aSetValueChanged)
 {
-  nsresult rv = NS_OK;
-
   // If the user or JS attempts to set checked, whether it actually changes the
   // value or not, we say the value was changed so that defaultValue don't
   // affect it no more.
@@ -1466,66 +1471,53 @@ nsHTMLInputElement::DoSetChecked(bool aChecked, bool aNotify,
     DoSetCheckedChanged(true, aNotify);
   }
 
-  //
   // Don't do anything if we're not changing whether it's checked (it would
   // screw up state actually, especially when you are setting radio button to
   // false)
-  //
-  if (GetChecked() == aChecked) {
+  if (mChecked == aChecked) {
     return NS_OK;
   }
 
-  //
   // Set checked
-  //
-  if (mType == NS_FORM_INPUT_RADIO) {
-    //
-    // For radio button, we need to do some extra fun stuff
-    //
-    if (aChecked) {
-      rv = RadioSetChecked(aNotify);
-    } else {
-      nsIRadioGroupContainer* container = GetRadioGroupContainer();
-      if (container) {
-        nsAutoString name;
-        GetAttr(kNameSpaceID_None, nsGkAtoms::name, name);
-        container->SetCurrentRadioButton(name, nsnull);
-      }
-      // SetCheckedInternal is going to ask all radios to update their
-      // validity state. We have to be sure the radio group container knows
-      // the currently selected radio.
-      SetCheckedInternal(false, aNotify);
-    }
-  } else {
+  if (mType != NS_FORM_INPUT_RADIO) {
     SetCheckedInternal(aChecked, aNotify);
+    return NS_OK;
   }
 
-  return rv;
+  // For radio button, we need to do some extra fun stuff
+  if (aChecked) {
+    return RadioSetChecked(aNotify);
+  }
+
+  nsIRadioGroupContainer* container = GetRadioGroupContainer();
+  if (container) {
+    nsAutoString name;
+    GetAttr(kNameSpaceID_None, nsGkAtoms::name, name);
+    container->SetCurrentRadioButton(name, nsnull);
+  }
+  // SetCheckedInternal is going to ask all radios to update their
+  // validity state. We have to be sure the radio group container knows
+  // the currently selected radio.
+  SetCheckedInternal(false, aNotify);
+  return NS_OK;
 }
 
 nsresult
 nsHTMLInputElement::RadioSetChecked(bool aNotify)
 {
-  nsresult rv = NS_OK;
-
-  //
   // Find the selected radio button so we can deselect it
-  //
   nsCOMPtr<nsIDOMHTMLInputElement> currentlySelected = GetSelectedRadioButton();
 
-  //
   // Deselect the currently selected radio button
-  //
   if (currentlySelected) {
     // Pass true for the aNotify parameter since the currently selected
     // button is already in the document.
-    static_cast<nsHTMLInputElement*>
-               (static_cast<nsIDOMHTMLInputElement*>(currentlySelected))->SetCheckedInternal(false, true);
+    static_cast<nsHTMLInputElement*>(currentlySelected.get())
+      ->SetCheckedInternal(false, true);
   }
 
-  //
   // Let the group know that we are now the One True Radio Button
-  //
+  nsresult rv = NS_OK;
   nsIRadioGroupContainer* container = GetRadioGroupContainer();
   if (container) {
     nsAutoString name;
@@ -1566,9 +1558,7 @@ nsHTMLInputElement::GetRadioGroupContainer() const
 already_AddRefed<nsIDOMHTMLInputElement>
 nsHTMLInputElement::GetSelectedRadioButton()
 {
-  nsIDOMHTMLInputElement* selected;
   nsIRadioGroupContainer* container = GetRadioGroupContainer();
-
   if (!container) {
     return nsnull;
   }
@@ -1576,8 +1566,9 @@ nsHTMLInputElement::GetSelectedRadioButton()
   nsAutoString name;
   GetAttr(kNameSpaceID_None, nsGkAtoms::name, name);
 
-  container->GetCurrentRadioButton(name, &selected);
-  return selected;
+  nsCOMPtr<nsIDOMHTMLInputElement> selected;
+  container->GetCurrentRadioButton(name, getter_AddRefs(selected));
+  return selected.forget();
 }
 
 nsresult
@@ -1596,7 +1587,7 @@ nsHTMLInputElement::MaybeSubmitForm(nsPresContext* aPresContext)
   // Get the default submit element
   nsIFormControl* submitControl = mForm->GetDefaultSubmitElement();
   if (submitControl) {
-    nsCOMPtr<nsIContent> submitContent(do_QueryInterface(submitControl));
+    nsCOMPtr<nsIContent> submitContent = do_QueryInterface(submitControl);
     NS_ASSERTION(submitContent, "Form control not implementing nsIContent?!");
     // Fire the button's onclick handler and let the button handle
     // submitting the form.
@@ -1610,9 +1601,9 @@ nsHTMLInputElement::MaybeSubmitForm(nsPresContext* aPresContext)
     // bug 592124.
     // If there's only one text control, just submit the form
     // Hold strong ref across the event
-    nsRefPtr<nsHTMLFormElement> form(mForm);
+    nsRefPtr<nsHTMLFormElement> form = mForm;
     nsFormEvent event(true, NS_FORM_SUBMIT);
-    nsEventStatus status  = nsEventStatus_eIgnore;
+    nsEventStatus status = nsEventStatus_eIgnore;
     shell->HandleDOMEventWithTarget(mForm, &event, &status);
   }
 
@@ -1622,14 +1613,10 @@ nsHTMLInputElement::MaybeSubmitForm(nsPresContext* aPresContext)
 void
 nsHTMLInputElement::SetCheckedInternal(bool aChecked, bool aNotify)
 {
-  //
   // Set the value
-  //
-  SET_BOOLBIT(mBitField, BF_CHECKED, aChecked);
+  mChecked = aChecked;
 
-  //
   // Notify the frame
-  //
   if (mType == NS_FORM_INPUT_CHECKBOX || mType == NS_FORM_INPUT_RADIO) {
     nsIFrame* frame = GetPrimaryFrame();
     if (frame) {
@@ -1647,31 +1634,31 @@ nsHTMLInputElement::SetCheckedInternal(bool aChecked, bool aNotify)
 NS_IMETHODIMP
 nsHTMLInputElement::Focus()
 {
-  if (mType == NS_FORM_INPUT_FILE) {
-    // for file inputs, focus the button instead
-    nsIFrame* frame = GetPrimaryFrame();
-    if (frame) {
-      nsIFrame* childFrame = frame->GetFirstPrincipalChild();
-      while (childFrame) {
-        // see if the child is a button control
-        nsCOMPtr<nsIFormControl> formCtrl =
-          do_QueryInterface(childFrame->GetContent());
-        if (formCtrl && formCtrl->GetType() == NS_FORM_INPUT_BUTTON) {
-          nsCOMPtr<nsIDOMElement> element(do_QueryInterface(formCtrl));
-          nsIFocusManager* fm = nsFocusManager::GetFocusManager();
-          if (fm && element)
-            fm->SetFocus(element, 0);
-          break;
-        }
-
-        childFrame = childFrame->GetNextSibling();
-      }
-    }
-
-    return NS_OK;
+  if (mType != NS_FORM_INPUT_FILE) {
+    return nsGenericHTMLElement::Focus();
   }
 
-  return nsGenericHTMLElement::Focus();
+  // For file inputs, focus the button instead.
+  nsIFrame* frame = GetPrimaryFrame();
+  if (frame) {
+    for (nsIFrame* childFrame = frame->GetFirstPrincipalChild();
+         childFrame;
+         childFrame = childFrame->GetNextSibling()) {
+      // See if the child is a button control.
+      nsCOMPtr<nsIFormControl> formCtrl =
+        do_QueryInterface(childFrame->GetContent());
+      if (formCtrl && formCtrl->GetType() == NS_FORM_INPUT_BUTTON) {
+        nsCOMPtr<nsIDOMElement> element = do_QueryInterface(formCtrl);
+        nsIFocusManager* fm = nsFocusManager::GetFocusManager();
+        if (fm && element) {
+          fm->SetFocus(element, 0);
+        }
+        break;
+      }
+    }
+  }
+
+  return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -1720,13 +1707,13 @@ nsHTMLInputElement::DispatchSelectEvent(nsPresContext* aPresContext)
   nsEventStatus status = nsEventStatus_eIgnore;
 
   // If already handling select event, don't dispatch a second.
-  if (!GET_BOOLBIT(mBitField, BF_HANDLING_SELECT_EVENT)) {
+  if (!mHandlingSelectEvent) {
     nsEvent event(nsContentUtils::IsCallerChrome(), NS_FORM_SELECTED);
 
-    SET_BOOLBIT(mBitField, BF_HANDLING_SELECT_EVENT, true);
+    mHandlingSelectEvent = true;
     nsEventDispatcher::Dispatch(static_cast<nsIContent*>(this),
                                 aPresContext, &event, nsnull, &status);
-    SET_BOOLBIT(mBitField, BF_HANDLING_SELECT_EVENT, false);
+    mHandlingSelectEvent = false;
   }
 
   // If the DOM event was not canceled (e.g. by a JS event handler
@@ -1768,21 +1755,21 @@ nsHTMLInputElement::NeedToInitializeEditorForEvent(nsEventChainPreVisitor& aVisi
   // certain types of events, because we know that those events are safe to be
   // handled without the editor being initialized.  These events include:
   // mousein/move/out, and DOM mutation events.
-  if (IsSingleLineTextControl(false) &&
-      aVisitor.mEvent->eventStructType != NS_MUTATION_EVENT) {
+  if (!IsSingleLineTextControl(false) ||
+      aVisitor.mEvent->eventStructType == NS_MUTATION_EVENT) {
+    return false;
+  }
 
-    switch (aVisitor.mEvent->message) {
-    case NS_MOUSE_MOVE:
-    case NS_MOUSE_ENTER:
-    case NS_MOUSE_EXIT:
-    case NS_MOUSE_ENTER_SYNTH:
-    case NS_MOUSE_EXIT_SYNTH:
-      return false;
-      break;
-    }
+  switch (aVisitor.mEvent->message) {
+  case NS_MOUSE_MOVE:
+  case NS_MOUSE_ENTER:
+  case NS_MOUSE_EXIT:
+  case NS_MOUSE_ENTER_SYNTH:
+  case NS_MOUSE_EXIT_SYNTH:
+    return false;
+  default:
     return true;
   }
-  return false;
 }
 
 nsresult
@@ -1827,8 +1814,7 @@ nsHTMLInputElement::PreHandleEvent(nsEventChainPreVisitor& aVisitor)
   // a DOMActivate dispatched from click handling, it will not be set.
   bool outerActivateEvent =
     (NS_IS_MOUSE_LEFT_CLICK(aVisitor.mEvent) ||
-     (aVisitor.mEvent->message == NS_UI_ACTIVATE &&
-      !GET_BOOLBIT(mBitField, BF_IN_INTERNAL_ACTIVATE)));
+     (aVisitor.mEvent->message == NS_UI_ACTIVATE && !mInInternalActivate));
 
   if (outerActivateEvent) {
     aVisitor.mItemFlags |= NS_OUTER_ACTIVATE_EVENT;
@@ -1837,12 +1823,12 @@ nsHTMLInputElement::PreHandleEvent(nsEventChainPreVisitor& aVisitor)
   bool originalCheckedValue = false;
 
   if (outerActivateEvent) {
-    SET_BOOLBIT(mBitField, BF_CHECKED_IS_TOGGLED, false);
+    mCheckedIsToggled = false;
 
     switch(mType) {
       case NS_FORM_INPUT_CHECKBOX:
         {
-          if (GET_BOOLBIT(mBitField, BF_INDETERMINATE)) {
+          if (mIndeterminate) {
             // indeterminate is always set to FALSE when the checkbox is toggled
             SetIndeterminateInternal(false, false);
             aVisitor.mItemFlags |= NS_ORIGINAL_INDETERMINATE_VALUE;
@@ -1850,7 +1836,7 @@ nsHTMLInputElement::PreHandleEvent(nsEventChainPreVisitor& aVisitor)
 
           GetChecked(&originalCheckedValue);
           DoSetChecked(!originalCheckedValue, true, true);
-          SET_BOOLBIT(mBitField, BF_CHECKED_IS_TOGGLED, true);
+          mCheckedIsToggled = true;
         }
         break;
 
@@ -1859,10 +1845,10 @@ nsHTMLInputElement::PreHandleEvent(nsEventChainPreVisitor& aVisitor)
           nsCOMPtr<nsIDOMHTMLInputElement> selectedRadioButton = GetSelectedRadioButton();
           aVisitor.mItemData = selectedRadioButton;
 
-          originalCheckedValue = GetChecked();
+          originalCheckedValue = mChecked;
           if (!originalCheckedValue) {
             DoSetChecked(true, true, true);
-            SET_BOOLBIT(mBitField, BF_CHECKED_IS_TOGGLED, true);
+            mCheckedIsToggled = true;
           }
         }
         break;
@@ -1879,7 +1865,7 @@ nsHTMLInputElement::PreHandleEvent(nsEventChainPreVisitor& aVisitor)
 
       default:
         break;
-    } //switch
+    }
   }
 
   if (originalCheckedValue) {
@@ -1986,9 +1972,9 @@ nsHTMLInputElement::PostHandleEvent(nsEventChainPostVisitor& aVisitor)
     nsCOMPtr<nsIPresShell> shell = aVisitor.mPresContext->GetPresShell();
     if (shell) {
       nsEventStatus status = nsEventStatus_eIgnore;
-      SET_BOOLBIT(mBitField, BF_IN_INTERNAL_ACTIVATE, true);
+      mInInternalActivate = true;
       rv = shell->HandleDOMEventWithTarget(this, &actEvent, &status);
-      SET_BOOLBIT(mBitField, BF_IN_INTERNAL_ACTIVATE, false);
+      mInInternalActivate = false;
 
       // If activate is cancelled, we must do the same as when click is
       // cancelled (revert the checkbox to its original value).
@@ -2009,7 +1995,7 @@ nsHTMLInputElement::PostHandleEvent(nsEventChainPostVisitor& aVisitor)
           mForm->OnSubmitClickEnd();
         }
         break;
-    } //switch
+    }
   }
 
   // Reset the flag for other content besides this text field
@@ -2017,7 +2003,7 @@ nsHTMLInputElement::PostHandleEvent(nsEventChainPostVisitor& aVisitor)
     noContentDispatch ? NS_EVENT_FLAG_NO_CONTENT_DISPATCH : NS_EVENT_FLAG_NONE;
 
   // now check to see if the event was "cancelled"
-  if (GET_BOOLBIT(mBitField, BF_CHECKED_IS_TOGGLED) && outerActivateEvent) {
+  if (mCheckedIsToggled && outerActivateEvent) {
     if (aVisitor.mEventStatus == nsEventStatus_eConsumeNoDefault) {
       // if it was cancelled and a radio button, then set the old
       // selected btn to TRUE. if it is a checkbox then set it to its
@@ -2382,7 +2368,7 @@ nsHTMLInputElement::HandleTypeChange(PRUint8 aNewType)
   ValueModeType aOldValueMode = GetValueMode();
   nsAutoString aOldValue;
 
-  if (aOldValueMode == VALUE_MODE_VALUE && !GET_BOOLBIT(mBitField, BF_PARSER_CREATING)) {
+  if (aOldValueMode == VALUE_MODE_VALUE && !mParserCreating) {
     GetValue(aOldValue);
   }
 
@@ -2400,7 +2386,7 @@ nsHTMLInputElement::HandleTypeChange(PRUint8 aNewType)
 
   mType = aNewType;
 
-  if (!GET_BOOLBIT(mBitField, BF_PARSER_CREATING)) {
+  if (!mParserCreating) {
     /**
      * The following code is trying to reproduce the algorithm described here:
      * http://www.whatwg.org/specs/web-apps/current-work/complete.html#input-type-change
@@ -2445,8 +2431,7 @@ nsHTMLInputElement::HandleTypeChange(PRUint8 aNewType)
 void
 nsHTMLInputElement::SanitizeValue(nsAString& aValue)
 {
-  NS_ASSERTION(!GET_BOOLBIT(mBitField, BF_PARSER_CREATING),
-               "The element parsing should be finished!");
+  NS_ASSERTION(!mParserCreating, "The element parsing should be finished!");
 
   switch (mType) {
     case NS_FORM_INPUT_TEXT:
@@ -2873,7 +2858,7 @@ nsHTMLInputElement::SetSelectionDirection(const nsAString& aDirection) {
 NS_IMETHODIMP
 nsHTMLInputElement::GetPhonetic(nsAString& aPhonetic)
 {
-  aPhonetic.Truncate(0);
+  aPhonetic.Truncate();
   nsIFormControlFrame* formControlFrame = GetFormControlFrame(true);
 
   if (formControlFrame) {
@@ -2935,9 +2920,7 @@ nsHTMLInputElement::Reset()
     case VALUE_MODE_VALUE:
       return SetDefaultValueAsValue();
     case VALUE_MODE_DEFAULT_ON:
-      bool resetVal;
-      GetDefaultChecked(&resetVal);
-      return DoSetChecked(resetVal, true, false);
+      return DoSetChecked(DefaultChecked(), true, false);
     case VALUE_MODE_FILENAME:
       ClearFiles(false);
       return NS_OK;
@@ -2950,8 +2933,6 @@ nsHTMLInputElement::Reset()
 NS_IMETHODIMP
 nsHTMLInputElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
 {
-  nsresult rv = NS_OK;
-
   // Disabled elements don't submit
   // For type=reset, and type=button, we just never submit, period.
   // For type=image and type=button, we only submit if we were the button
@@ -2962,7 +2943,7 @@ nsHTMLInputElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
       ((mType == NS_FORM_INPUT_SUBMIT || mType == NS_FORM_INPUT_IMAGE) &&
        aFormSubmission->GetOriginatingElement() != this) ||
       ((mType == NS_FORM_INPUT_RADIO || mType == NS_FORM_INPUT_CHECKBOX) &&
-       !GetChecked())) {
+       !mChecked)) {
     return NS_OK;
   }
 
@@ -3012,7 +2993,7 @@ nsHTMLInputElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
 
   // Get the value
   nsAutoString value;
-  rv = GetValue(value);
+  nsresult rv = GetValue(value);
   if (NS_FAILED(rv)) {
     return rv;
   }
@@ -3034,7 +3015,7 @@ nsHTMLInputElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
 
     const nsCOMArray<nsIDOMFile>& files = GetFiles();
 
-    for (PRUint32 i = 0; i < (PRUint32)files.Count(); ++i) {
+    for (PRInt32 i = 0; i < files.Count(); ++i) {
       aFormSubmission->AddNameFilePair(name, files[i]);
     }
 
@@ -3051,40 +3032,29 @@ nsHTMLInputElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
   if (mType == NS_FORM_INPUT_HIDDEN && name.EqualsLiteral("_charset_")) {
     nsCString charset;
     aFormSubmission->GetCharset(charset);
-    rv = aFormSubmission->AddNameValuePair(name,
-                                           NS_ConvertASCIItoUTF16(charset));
+    return aFormSubmission->AddNameValuePair(name,
+                                             NS_ConvertASCIItoUTF16(charset));
   }
-  else if (IsSingleLineTextControl(true) &&
-           name.EqualsLiteral("isindex") &&
-           aFormSubmission->SupportsIsindexSubmission()) {
-    rv = aFormSubmission->AddIsindex(value);
+  if (IsSingleLineTextControl(true) &&
+      name.EqualsLiteral("isindex") &&
+      aFormSubmission->SupportsIsindexSubmission()) {
+    return aFormSubmission->AddIsindex(value);
   }
-  else {
-    rv = aFormSubmission->AddNameValuePair(name, value);
-  }
-
-  return rv;
+  return aFormSubmission->AddNameValuePair(name, value);
 }
 
 
 NS_IMETHODIMP
 nsHTMLInputElement::SaveState()
 {
-  nsresult rv = NS_OK;
-
-  nsRefPtr<nsHTMLInputElementState> inputState = nsnull;
-
+  nsRefPtr<nsHTMLInputElementState> inputState;
   switch (mType) {
     case NS_FORM_INPUT_CHECKBOX:
     case NS_FORM_INPUT_RADIO:
       {
-        if (GetCheckedChanged()) {
+        if (mCheckedChanged) {
           inputState = new nsHTMLInputElementState();
-          if (!inputState) {
-            return NS_ERROR_OUT_OF_MEMORY;
-          }
-
-          inputState->SetChecked(GetChecked());
+          inputState->SetChecked(mChecked);
         }
         break;
       }
@@ -3099,15 +3069,12 @@ nsHTMLInputElement::SaveState()
     case NS_FORM_INPUT_URL:
     case NS_FORM_INPUT_HIDDEN:
       {
-        if (GetValueChanged()) {
+        if (mValueChanged) {
           inputState = new nsHTMLInputElementState();
-          if (!inputState) {
-            return NS_ERROR_OUT_OF_MEMORY;
-          }
-
           nsAutoString value;
           GetValue(value);
-          rv = nsLinebreakConverter::ConvertStringLineBreaks(
+          DebugOnly<nsresult> rv =
+            nsLinebreakConverter::ConvertStringLineBreaks(
                  value,
                  nsLinebreakConverter::eLinebreakPlatform,
                  nsLinebreakConverter::eLinebreakContent);
@@ -3120,16 +3087,13 @@ nsHTMLInputElement::SaveState()
       {
         if (mFiles.Count()) {
           inputState = new nsHTMLInputElementState();
-          if (!inputState) {
-            return NS_ERROR_OUT_OF_MEMORY;
-          }
-
           inputState->SetFiles(mFiles);
         }
         break;
       }
   }
   
+  nsresult rv = NS_OK;
   nsPresState* state = nsnull;
   if (inputState) {
     rv = GetPrimaryPresState(this, &state);
@@ -3138,7 +3102,7 @@ nsHTMLInputElement::SaveState()
     }
   }
 
-  if (GET_BOOLBIT(mBitField, BF_DISABLED_CHANGED)) {
+  if (mDisabledChanged) {
     rv |= GetPrimaryPresState(this, &state);
     if (state) {
       // We do not want to save the real disabled state but the disabled
@@ -3153,26 +3117,21 @@ nsHTMLInputElement::SaveState()
 void
 nsHTMLInputElement::DoneCreatingElement()
 {
-  SET_BOOLBIT(mBitField, BF_PARSER_CREATING, false);
+  mParserCreating = false;
 
   //
   // Restore state as needed.  Note that disabled state applies to all control
   // types.
   //
   bool restoredCheckedState =
-      GET_BOOLBIT(mBitField, BF_INHIBIT_RESTORATION) ?
-      false :
-      RestoreFormControlState(this, this);
+    !mInhibitRestoration && RestoreFormControlState(this, this);
 
   //
   // If restore does not occur, we initialize .checked using the CHECKED
   // property.
   //
-  if (!restoredCheckedState &&
-      GET_BOOLBIT(mBitField, BF_SHOULD_INIT_CHECKED)) {
-    bool resetVal;
-    GetDefaultChecked(&resetVal);
-    DoSetChecked(resetVal, false, true);
+  if (!restoredCheckedState && mShouldInitChecked) {
+    DoSetChecked(DefaultChecked(), false, true);
     DoSetCheckedChanged(false, false);
   }
 
@@ -3183,7 +3142,7 @@ nsHTMLInputElement::DoneCreatingElement()
     SetValueInternal(aValue, false, false);
   }
 
-  SET_BOOLBIT(mBitField, BF_SHOULD_INIT_CHECKED, false);
+  mShouldInitChecked = false;
 }
 
 nsEventStates
@@ -3195,21 +3154,17 @@ nsHTMLInputElement::IntrinsicState() const
   nsEventStates state = nsGenericHTMLFormElement::IntrinsicState();
   if (mType == NS_FORM_INPUT_CHECKBOX || mType == NS_FORM_INPUT_RADIO) {
     // Check current checked state (:checked)
-    if (GET_BOOLBIT(mBitField, BF_CHECKED)) {
+    if (mChecked) {
       state |= NS_EVENT_STATE_CHECKED;
     }
 
     // Check current indeterminate state (:indeterminate)
-    if (mType == NS_FORM_INPUT_CHECKBOX && GET_BOOLBIT(mBitField, BF_INDETERMINATE)) {
+    if (mType == NS_FORM_INPUT_CHECKBOX && mIndeterminate) {
       state |= NS_EVENT_STATE_INDETERMINATE;
     }
 
     // Check whether we are the default checked element (:default)
-    // The call is to an interface function, which makes it non-const, so we
-    // use a nasty hack :(
-    bool defaultState = false;
-    const_cast<nsHTMLInputElement*>(this)->GetDefaultChecked(&defaultState);
-    if (defaultState) {
+    if (DefaultChecked()) {
       state |= NS_EVENT_STATE_DEFAULT;
     }
   } else if (mType == NS_FORM_INPUT_IMAGE) {
@@ -3230,8 +3185,7 @@ nsHTMLInputElement::IntrinsicState() const
 
       if ((!mForm || !mForm->HasAttr(kNameSpaceID_None, nsGkAtoms::novalidate)) &&
           (GetValidityState(VALIDITY_STATE_CUSTOM_ERROR) ||
-           (GET_BOOLBIT(mBitField, BF_CAN_SHOW_INVALID_UI) &&
-            ShouldShowValidityUI()))) {
+           (mCanShowInvalidUI && ShouldShowValidityUI()))) {
         state |= NS_EVENT_STATE_MOZ_UI_INVALID;
       }
     }
@@ -3246,9 +3200,9 @@ nsHTMLInputElement::IntrinsicState() const
     // 4. The element has already been modified or the user tried to submit the
     //    form owner while invalid.
     if ((!mForm || !mForm->HasAttr(kNameSpaceID_None, nsGkAtoms::novalidate)) &&
-        (GET_BOOLBIT(mBitField, BF_CAN_SHOW_VALID_UI) && ShouldShowValidityUI() &&
+        (mCanShowValidUI && ShouldShowValidityUI() &&
          (IsValid() || (!state.HasState(NS_EVENT_STATE_MOZ_UI_INVALID) &&
-                        !GET_BOOLBIT(mBitField, BF_CAN_SHOW_INVALID_UI))))) {
+                        !mCanShowInvalidUI)))) {
       state |= NS_EVENT_STATE_MOZ_UI_VALID;
     }
   }
@@ -3328,7 +3282,7 @@ void
 nsHTMLInputElement::AddedToRadioGroup()
 {
   // Make sure not to notify if we're still being created by the parser
-  bool notify = !GET_BOOLBIT(mBitField, BF_PARSER_CREATING);
+  bool notify = !mParserCreating;
 
   //
   //  If the input element is not in a form and
@@ -3342,7 +3296,7 @@ nsHTMLInputElement::AddedToRadioGroup()
   // If the input element is checked, and we add it to the group, it will
   // deselect whatever is currently selected in that group
   //
-  if (GetChecked()) {
+  if (mChecked) {
     //
     // If it is checked, call "RadioSetChecked" to perform the selection/
     // deselection ritual.  This has the side effect of repainting the
@@ -3357,7 +3311,7 @@ nsHTMLInputElement::AddedToRadioGroup()
   // For integrity purposes, we have to ensure that "checkedChanged" is
   // the same for this new element as for all the others in the group
   //
-  bool checkedChanged = GET_BOOLBIT(mBitField, BF_CHECKED_CHANGED);
+  bool checkedChanged = mCheckedChanged;
 
   nsCOMPtr<nsIRadioVisitor> visitor =
     new nsRadioGetCheckedChangedVisitor(&checkedChanged, this);
@@ -3394,7 +3348,7 @@ nsHTMLInputElement::WillRemoveFromRadioGroup()
 
   // If this button was checked, we need to notify the group that there is no
   // longer a selected radio button
-  if (GetChecked()) {
+  if (mChecked) {
     container->SetCurrentRadioButton(name, nsnull);
   }
 
@@ -3455,7 +3409,7 @@ nsHTMLInputElement::IsHTMLFocusable(bool aWithMouse, bool *aIsFocusable, PRInt32
     return false;
   }
 
-  if (GetChecked()) {
+  if (mChecked) {
     // Selected radio buttons are tabbable
     *aIsFocusable = defaultFocusable;
     return false;
@@ -3630,7 +3584,7 @@ nsHTMLInputElement::IsTooLong()
 {
   if (!MaxLengthApplies() ||
       !HasAttr(kNameSpaceID_None, nsGkAtoms::maxlength) ||
-      !GetValueChanged()) {
+      !mValueChanged) {
     return false;
   }
 
@@ -3667,7 +3621,7 @@ nsHTMLInputElement::IsValueMissing() const
   switch (mType)
   {
     case NS_FORM_INPUT_CHECKBOX:
-      return !GetChecked();
+      return !mChecked;
     case NS_FORM_INPUT_FILE:
       {
         const nsCOMArray<nsIDOMFile>& files = GetFiles();
@@ -3750,15 +3704,13 @@ nsHTMLInputElement::UpdateTooLongValidityState()
 void
 nsHTMLInputElement::UpdateValueMissingValidityStateForRadio(bool aIgnoreSelf)
 {
-  bool notify = !GET_BOOLBIT(mBitField, BF_PARSER_CREATING);
+  bool notify = !mParserCreating;
   nsCOMPtr<nsIDOMHTMLInputElement> selection = GetSelectedRadioButton();
 
   // If there is no selection, that might mean the radio is not in a group.
   // In that case, we can look for the checked state of the radio.
-  bool selected = selection ? true
-                            : aIgnoreSelf ? false : GetChecked();
-  bool required = aIgnoreSelf ? false
-                              : HasAttr(kNameSpaceID_None, nsGkAtoms::required);
+  bool selected = selection || (!aIgnoreSelf && mChecked);
+  bool required = !aIgnoreSelf && HasAttr(kNameSpaceID_None, nsGkAtoms::required);
   bool valueMissing = false;
 
   nsCOMPtr<nsIRadioGroupContainer> container = GetRadioGroupContainer();
@@ -4072,7 +4024,7 @@ nsHTMLInputElement::GetDefaultValueFromContent(nsAString& aValue)
     GetDefaultValue(aValue);
     // This is called by the frame to show the value.
     // We have to sanitize it when needed.
-    if (!GET_BOOLBIT(mBitField, BF_PARSER_CREATING)) {
+    if (!mParserCreating) {
       SanitizeValue(aValue);
     }
   }
@@ -4081,7 +4033,7 @@ nsHTMLInputElement::GetDefaultValueFromContent(nsAString& aValue)
 NS_IMETHODIMP_(bool)
 nsHTMLInputElement::ValueChanged() const
 {
-  return GetValueChanged();
+  return mValueChanged;
 }
 
 NS_IMETHODIMP_(void)
@@ -4120,9 +4072,9 @@ nsHTMLInputElement::OnValueChanged(bool aNotify)
 
   // :-moz-placeholder pseudo-class may change when the value changes.
   // However, we don't want to waste cycles if the state doesn't apply.
-  if (PlaceholderApplies()
-      && HasAttr(kNameSpaceID_None, nsGkAtoms::placeholder)
-      && !nsContentUtils::IsFocusedContent((nsIContent*)(this))) {
+  if (PlaceholderApplies() &&
+      HasAttr(kNameSpaceID_None, nsGkAtoms::placeholder) &&
+      !nsContentUtils::IsFocusedContent(this)) {
     UpdateState(aNotify);
   }
 }
@@ -4197,15 +4149,14 @@ nsHTMLInputElement::UpdateValidityUIBits(bool aIsFocused)
   if (aIsFocused) {
     // If the invalid UI is shown, we should show it while focusing (and
     // update). Otherwise, we should not.
-    SET_BOOLBIT(mBitField, BF_CAN_SHOW_INVALID_UI,
-                !IsValid() && ShouldShowValidityUI());
+    mCanShowInvalidUI = !IsValid() && ShouldShowValidityUI();
 
     // If neither invalid UI nor valid UI is shown, we shouldn't show the valid
     // UI while typing.
-    SET_BOOLBIT(mBitField, BF_CAN_SHOW_VALID_UI, ShouldShowValidityUI());
+    mCanShowValidUI = ShouldShowValidityUI();
   } else {
-    SET_BOOLBIT(mBitField, BF_CAN_SHOW_INVALID_UI, true);
-    SET_BOOLBIT(mBitField, BF_CAN_SHOW_VALID_UI, true);
+    mCanShowInvalidUI = true;
+    mCanShowValidUI = true;
   }
 }
 
diff --git a/content/html/content/src/nsHTMLInputElement.h b/content/html/content/src/nsHTMLInputElement.h
index 776f3e534d3..38d37b60ad8 100644
--- a/content/html/content/src/nsHTMLInputElement.h
+++ b/content/html/content/src/nsHTMLInputElement.h
@@ -52,29 +52,6 @@
 #include "nsHTMLFormElement.h" // for ShouldShowInvalidUI()
 #include "nsIFile.h"
 
-//
-// Accessors for mBitField
-//
-#define BF_DISABLED_CHANGED 0
-#define BF_VALUE_CHANGED 1
-#define BF_CHECKED_CHANGED 2
-#define BF_CHECKED 3
-#define BF_HANDLING_SELECT_EVENT 4
-#define BF_SHOULD_INIT_CHECKED 5
-#define BF_PARSER_CREATING 6
-#define BF_IN_INTERNAL_ACTIVATE 7
-#define BF_CHECKED_IS_TOGGLED 8
-#define BF_INDETERMINATE 9
-#define BF_INHIBIT_RESTORATION 10
-#define BF_CAN_SHOW_INVALID_UI 11
-#define BF_CAN_SHOW_VALID_UI 12
-
-#define GET_BOOLBIT(bitfield, field) (((bitfield) & (0x01 << (field))) \
-                                        ? true : false)
-#define SET_BOOLBIT(bitfield, field, b) ((b) \
-                                        ? ((bitfield) |=  (0x01 << (field))) \
-                                        : ((bitfield) &= ~(0x01 << (field))))
-
 class nsDOMFileList;
 class nsIRadioGroupContainer;
 class nsIRadioGroupVisitor;
@@ -228,7 +205,7 @@ public:
 
   void SetCheckedChangedInternal(bool aCheckedChanged);
   bool GetCheckedChanged() const {
-    return GET_BOOLBIT(mBitField, BF_CHECKED_CHANGED);
+    return mCheckedChanged;
   }
   void AddedToRadioGroup();
   void WillRemoveFromRadioGroup();
@@ -320,6 +297,10 @@ public:
    */
   void UpdateValidityUIBits(bool aIsFocused);
 
+  bool DefaultChecked() const {
+    return HasAttr(kNameSpaceID_None, nsGkAtoms::checked);
+  }
+
 protected:
   // Pull IsSingleLineTextControl into our scope, otherwise it'd be hidden
   // by the nsITextControlElement version.
@@ -442,14 +423,6 @@ protected:
    */
   void SetCheckedInternal(bool aValue, bool aNotify);
 
-  /**
-   * Syntax sugar to make it easier to check for checked
-   */
-  bool GetChecked() const
-  {
-    return GET_BOOLBIT(mBitField, BF_CHECKED);
-  }
-
   nsresult RadioSetChecked(bool aNotify);
   void SetCheckedChanged(bool aCheckedChanged);
 
@@ -535,14 +508,6 @@ protected:
    */
   nsresult SetDefaultValueAsValue();
 
-  /**
-   * Returns whether the value has been changed since the element has been created.
-   * @return Whether the value has been changed since the element has been created.
-   */
-  bool GetValueChanged() const {
-    return GET_BOOLBIT(mBitField, BF_VALUE_CHANGED);
-  }
-
   /**
    * Return if an element should have a specific validity UI
    * (with :-moz-ui-invalid and :-moz-ui-valid pseudo-classes).
@@ -567,7 +532,7 @@ protected:
         return GetCheckedChanged();
       case VALUE_MODE_VALUE:
       case VALUE_MODE_FILENAME:
-        return GetValueChanged();
+        return mValueChanged;
       default:
         NS_NOTREACHED("We should not be there: there are no other modes.");
         return false;
@@ -584,16 +549,6 @@ protected:
 
   nsCOMPtr<nsIControllers> mControllers;
 
-  /**
-   * The type of this input (<input type=...>) as an integer.
-   * @see nsIFormControl.h (specifically NS_FORM_INPUT_*)
-   */
-  PRUint8                  mType;
-  /**
-   * A bitfield containing our booleans
-   * @see GET_BOOLBIT / SET_BOOLBIT macros and BF_* field identifiers
-   */
-  PRInt16                  mBitField;
   /*
    * In mInputData, the mState field is used if IsSingleLineTextControl returns
    * true and mValue is used otherwise.  We have to be careful when handling it
@@ -627,6 +582,25 @@ protected:
   nsRefPtr<nsDOMFileList>  mFileList;
 
   nsString mStaticDocFileList;
+
+  /**
+   * The type of this input (<input type=...>) as an integer.
+   * @see nsIFormControl.h (specifically NS_FORM_INPUT_*)
+   */
+  PRUint8                  mType;
+  bool                     mDisabledChanged     : 1;
+  bool                     mValueChanged        : 1;
+  bool                     mCheckedChanged      : 1;
+  bool                     mChecked             : 1;
+  bool                     mHandlingSelectEvent : 1;
+  bool                     mShouldInitChecked   : 1;
+  bool                     mParserCreating      : 1;
+  bool                     mInInternalActivate  : 1;
+  bool                     mCheckedIsToggled    : 1;
+  bool                     mIndeterminate       : 1;
+  bool                     mInhibitRestoration  : 1;
+  bool                     mCanShowValidUI      : 1;
+  bool                     mCanShowInvalidUI    : 1;
 };
 
 #endif
diff --git a/content/html/content/src/nsHTMLLabelElement.cpp b/content/html/content/src/nsHTMLLabelElement.cpp
index 363a9f7a857..65021fc7c93 100644
--- a/content/html/content/src/nsHTMLLabelElement.cpp
+++ b/content/html/content/src/nsHTMLLabelElement.cpp
@@ -104,11 +104,8 @@ nsHTMLLabelElement::GetForm(nsIDOMHTMLFormElement** aForm)
 NS_IMETHODIMP
 nsHTMLLabelElement::GetControl(nsIDOMHTMLElement** aElement)
 {
-  *aElement = nsnull;
-
   nsCOMPtr<nsIDOMHTMLElement> element = do_QueryInterface(GetLabeledElement());
-
-  element.swap(*aElement);
+  element.forget(aElement);
   return NS_OK;
 }
 
@@ -170,7 +167,7 @@ DestroyMouseDownPoint(void *    /*aObject*/,
                       void *    aPropertyValue,
                       void *    /*aData*/)
 {
-  nsIntPoint *pt = (nsIntPoint *)aPropertyValue;
+  nsIntPoint* pt = static_cast<nsIntPoint*>(aPropertyValue);
   delete pt;
 }
 
diff --git a/content/html/content/src/nsHTMLLegendElement.cpp b/content/html/content/src/nsHTMLLegendElement.cpp
index 8174f127402..9e22ccca5c2 100644
--- a/content/html/content/src/nsHTMLLegendElement.cpp
+++ b/content/html/content/src/nsHTMLLegendElement.cpp
@@ -83,7 +83,7 @@ NS_IMPL_ELEMENT_CLONE(nsHTMLLegendElement)
 NS_IMETHODIMP
 nsHTMLLegendElement::GetForm(nsIDOMHTMLFormElement** aForm)
 {
-  Element *form = GetFormElement();
+  Element* form = GetFormElement();
 
   return form ? CallQueryInterface(form, aForm) : NS_OK;
 }
@@ -106,7 +106,7 @@ nsHTMLLegendElement::GetFieldSet()
 {
   nsIContent* parent = GetParent();
 
-  if (parent && parent->IsHTML() && parent->Tag() == nsGkAtoms::fieldset) {
+  if (parent && parent->IsHTML(nsGkAtoms::fieldset)) {
     return parent;
   }
 
diff --git a/content/html/content/src/nsHTMLLegendElement.h b/content/html/content/src/nsHTMLLegendElement.h
index 96308ffc12a..c9a7c6f5506 100644
--- a/content/html/content/src/nsHTMLLegendElement.h
+++ b/content/html/content/src/nsHTMLLegendElement.h
@@ -50,8 +50,9 @@ public:
 
   static nsHTMLLegendElement* FromContent(nsIContent *aContent)
   {
-    if (aContent->IsHTML() && aContent->Tag() == nsGkAtoms::legend)
+    if (aContent->IsHTML(nsGkAtoms::legend)) {
       return static_cast<nsHTMLLegendElement*>(aContent);
+    }
     return nsnull;
   }
 
diff --git a/content/html/content/src/nsHTMLLinkElement.cpp b/content/html/content/src/nsHTMLLinkElement.cpp
index 94ee6f7bd67..f21ceb58a62 100644
--- a/content/html/content/src/nsHTMLLinkElement.cpp
+++ b/content/html/content/src/nsHTMLLinkElement.cpp
@@ -166,7 +166,7 @@ NS_IMPL_ELEMENT_CLONE(nsHTMLLinkElement)
 NS_IMETHODIMP
 nsHTMLLinkElement::GetDisabled(bool* aDisabled)
 {
-  nsCOMPtr<nsIDOMStyleSheet> ss(do_QueryInterface(GetStyleSheet()));
+  nsCOMPtr<nsIDOMStyleSheet> ss = do_QueryInterface(GetStyleSheet());
   nsresult result = NS_OK;
 
   if (ss) {
@@ -181,7 +181,7 @@ nsHTMLLinkElement::GetDisabled(bool* aDisabled)
 NS_IMETHODIMP 
 nsHTMLLinkElement::SetDisabled(bool aDisabled)
 {
-  nsCOMPtr<nsIDOMStyleSheet> ss(do_QueryInterface(GetStyleSheet()));
+  nsCOMPtr<nsIDOMStyleSheet> ss = do_QueryInterface(GetStyleSheet());
   nsresult result = NS_OK;
 
   if (ss) {
@@ -281,11 +281,9 @@ nsHTMLLinkElement::CreateAndDispatchEvent(nsIDocument* aDoc,
 
   nsRefPtr<nsPLDOMEvent> event = new nsPLDOMEvent(this, aEventName, true,
                                                   true);
-  if (event) {
-    // Always run async in order to avoid running script when the content
-    // sink isn't expecting it.
-    event->PostDOMEvent();
-  }
+  // Always run async in order to avoid running script when the content
+  // sink isn't expecting it.
+  event->PostDOMEvent();
 }
 
 nsresult
diff --git a/content/html/content/src/nsHTMLMapElement.cpp b/content/html/content/src/nsHTMLMapElement.cpp
index 9413c8c503e..f59d76ea0ba 100644
--- a/content/html/content/src/nsHTMLMapElement.cpp
+++ b/content/html/content/src/nsHTMLMapElement.cpp
@@ -116,7 +116,7 @@ nsHTMLMapElement::GetAreas(nsIDOMHTMLCollection** aAreas)
   if (!mAreas) {
     // Not using NS_GetContentList because this should not be cached
     mAreas = new nsContentList(this,
-                               mNodeInfo->NamespaceID(),
+                               kNameSpaceID_XHTML,
                                nsGkAtoms::area,
                                nsGkAtoms::area,
                                false);
diff --git a/content/html/content/src/nsHTMLMediaElement.cpp b/content/html/content/src/nsHTMLMediaElement.cpp
index f16e1001636..a075e7d66a2 100644
--- a/content/html/content/src/nsHTMLMediaElement.cpp
+++ b/content/html/content/src/nsHTMLMediaElement.cpp
@@ -298,9 +298,8 @@ NS_IMETHODIMP nsHTMLMediaElement::MediaLoadListener::OnStartRequest(nsIRequest*
   }
 
   // Don't continue to load if the request failed or has been canceled.
-  nsresult rv;
   nsresult status;
-  rv = aRequest->GetStatus(&status);
+  nsresult rv = aRequest->GetStatus(&status);
   NS_ENSURE_SUCCESS(rv, rv);
   if (NS_FAILED(status)) {
     if (element)
@@ -332,7 +331,7 @@ NS_IMETHODIMP nsHTMLMediaElement::MediaLoadListener::OnStartRequest(nsIRequest*
 }
 
 NS_IMETHODIMP nsHTMLMediaElement::MediaLoadListener::OnStopRequest(nsIRequest* aRequest, nsISupports* aContext,
-                                                                     nsresult aStatus)
+                                                                   nsresult aStatus)
 {
   if (mNextListener) {
     return mNextListener->OnStopRequest(aRequest, aContext, aStatus);
@@ -341,8 +340,8 @@ NS_IMETHODIMP nsHTMLMediaElement::MediaLoadListener::OnStopRequest(nsIRequest* a
 }
 
 NS_IMETHODIMP nsHTMLMediaElement::MediaLoadListener::OnDataAvailable(nsIRequest* aRequest, nsISupports* aContext,
-                                                                       nsIInputStream* aStream, PRUint32 aOffset,
-                                                                       PRUint32 aCount)
+                                                                     nsIInputStream* aStream, PRUint32 aOffset,
+                                                                     PRUint32 aCount)
 {
   if (!mNextListener) {
     NS_ERROR("Must have a chained listener; OnStartRequest should have canceled this request");
@@ -635,11 +634,10 @@ void nsHTMLMediaElement::SelectResource()
   // AddRemoveSelfReference, since it must still be held
   DispatchAsyncEvent(NS_LITERAL_STRING("loadstart"));
 
-  nsAutoString src;
-  nsCOMPtr<nsIURI> uri;
-
   // If we have a 'src' attribute, use that exclusively.
+  nsAutoString src;
   if (GetAttr(kNameSpaceID_None, nsGkAtoms::src, src)) {
+    nsCOMPtr<nsIURI> uri;
     nsresult rv = NewURIFromString(src, getter_AddRefs(uri));
     if (NS_SUCCEEDED(rv)) {
       LOG(PR_LOG_DEBUG, ("%p Trying load from src=%s", this, NS_ConvertUTF16toUTF8(src).get()));
@@ -728,7 +726,6 @@ void nsHTMLMediaElement::LoadFromSourceChildren()
   NS_ASSERTION(mIsLoadingFromSourceChildren,
                "Must remember we're loading from source children");
   while (true) {
-    nsresult rv;
     nsIContent* child = GetNextSource();
     if (!child) {
       // Exhausted candidates, wait for more candidates to be appended to
@@ -739,25 +736,24 @@ void nsHTMLMediaElement::LoadFromSourceChildren()
       return;
     }
 
-    nsCOMPtr<nsIURI> uri;
-    nsAutoString src,type;
-
     // Must have src attribute.
+    nsAutoString src;
     if (!child->GetAttr(kNameSpaceID_None, nsGkAtoms::src, src)) {
       DispatchAsyncSourceError(child);
       continue;
     }
 
     // If we have a type attribute, it must be a supported type.
-    if (child->HasAttr(kNameSpaceID_None, nsGkAtoms::type) &&
-        child->GetAttr(kNameSpaceID_None, nsGkAtoms::type, type) &&
-        GetCanPlay(type) == CANPLAY_NO)
-    {
+    nsAutoString type;
+    if (child->GetAttr(kNameSpaceID_None, nsGkAtoms::type, type) &&
+        GetCanPlay(type) == CANPLAY_NO) {
       DispatchAsyncSourceError(child);
       continue;
     }
     LOG(PR_LOG_DEBUG, ("%p Trying load from <source>=%s type=%s", this,
       NS_ConvertUTF16toUTF8(src).get(), NS_ConvertUTF16toUTF8(type).get()));
+
+    nsCOMPtr<nsIURI> uri;
     NewURIFromString(src, getter_AddRefs(uri));
     if (!uri) {
       DispatchAsyncSourceError(child);
@@ -775,9 +771,9 @@ void nsHTMLMediaElement::LoadFromSourceChildren()
       return;
     }
 
-    rv = LoadResource(uri);
-    if (NS_SUCCEEDED(rv))
+    if (NS_SUCCEEDED(LoadResource(uri))) {
       return;
+    }
 
     // If we fail to load, loop back and try loading the next resource.
     DispatchAsyncSourceError(child);
@@ -892,15 +888,12 @@ void nsHTMLMediaElement::UpdatePreloadAction()
       ResumeLoad(PRELOAD_METADATA);
     }
   }
-
-  return;
 }
 
 nsresult nsHTMLMediaElement::LoadResource(nsIURI* aURI)
 {
   NS_ASSERTION(mDelayingLoadEvent,
                "Should delay load event (if in document) during load");
-  nsresult rv;
 
   // If a previous call to mozSetup() was made, kill that media stream
   // in order to use this new src instead.
@@ -915,17 +908,19 @@ nsresult nsHTMLMediaElement::LoadResource(nsIURI* aURI)
   }
 
   PRInt16 shouldLoad = nsIContentPolicy::ACCEPT;
-  rv = NS_CheckContentLoadPolicy(nsIContentPolicy::TYPE_MEDIA,
-                                 aURI,
-                                 NodePrincipal(),
-                                 static_cast<nsGenericElement*>(this),
-                                 EmptyCString(), // mime type
-                                 nsnull, // extra
-                                 &shouldLoad,
-                                 nsContentUtils::GetContentPolicy(),
-                                 nsContentUtils::GetSecurityManager());
-  NS_ENSURE_SUCCESS(rv,rv);
-  if (NS_CP_REJECTED(shouldLoad)) return NS_ERROR_FAILURE;
+  nsresult rv = NS_CheckContentLoadPolicy(nsIContentPolicy::TYPE_MEDIA,
+                                          aURI,
+                                          NodePrincipal(),
+                                          static_cast<nsGenericElement*>(this),
+                                          EmptyCString(), // mime type
+                                          nsnull, // extra
+                                          &shouldLoad,
+                                          nsContentUtils::GetContentPolicy(),
+                                          nsContentUtils::GetSecurityManager());
+  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_CP_REJECTED(shouldLoad)) {
+    return NS_ERROR_FAILURE;
+  }
 
   nsCOMPtr<nsILoadGroup> loadGroup = GetDocumentLoadGroup();
 
@@ -1122,12 +1117,11 @@ NS_IMETHODIMP nsHTMLMediaElement::GetDuration(double *aDuration)
 /* readonly attribute nsIDOMHTMLTimeRanges seekable; */
 NS_IMETHODIMP nsHTMLMediaElement::GetSeekable(nsIDOMTimeRanges** aSeekable)
 {
-  nsTimeRanges* ranges = new nsTimeRanges();
-  NS_ADDREF(*aSeekable = ranges);
-
+  nsRefPtr<nsTimeRanges> ranges = new nsTimeRanges();
   if (mDecoder && mReadyState > nsIDOMHTMLMediaElement::HAVE_NOTHING) {
     mDecoder->GetSeekable(ranges);
   }
+  ranges.forget(aSeekable);
   return NS_OK;
 }
 
@@ -1175,7 +1169,7 @@ NS_IMETHODIMP nsHTMLMediaElement::GetVolume(double *aVolume)
 
 NS_IMETHODIMP nsHTMLMediaElement::SetVolume(double aVolume)
 {
-  if (aVolume < 0.0f || aVolume > 1.0f)
+  if (aVolume < 0.0 || aVolume > 1.0)
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
 
   if (aVolume == mVolume)
@@ -1346,14 +1340,17 @@ void nsHTMLMediaElement::StopSuspendingAfterFirstFrame()
 
 void nsHTMLMediaElement::SetPlayedOrSeeked(bool aValue)
 {
-  if (aValue == mHasPlayedOrSeeked)
+  if (aValue == mHasPlayedOrSeeked) {
     return;
+  }
 
   mHasPlayedOrSeeked = aValue;
 
   // Force a reflow so that the poster frame hides or shows immediately.
   nsIFrame* frame = GetPrimaryFrame();
-  if (!frame) return;
+  if (!frame) {
+    return;
+  }
   frame->PresContext()->PresShell()->FrameNeedsReflow(frame,
                                                       nsIPresShell::eTreeChange,
                                                       NS_FRAME_IS_DIRTY);
@@ -1367,7 +1364,7 @@ NS_IMETHODIMP nsHTMLMediaElement::Play()
   if (mNetworkState == nsIDOMHTMLMediaElement::NETWORK_EMPTY) {
     nsresult rv = Load();
     NS_ENSURE_SUCCESS(rv, rv);
-  }  else if (mLoadIsSuspended) {
+  } else if (mLoadIsSuspended) {
     ResumeLoad(PRELOAD_ENOUGH);
   } else if (mDecoder) {
     if (mDecoder->IsEnded()) {
@@ -1425,16 +1422,16 @@ bool nsHTMLMediaElement::ParseAttribute(PRInt32 aNamespaceID,
   };
 
   if (aNamespaceID == kNameSpaceID_None) {
-    if (aAttribute == nsGkAtoms::loopstart
-       || aAttribute == nsGkAtoms::loopend
-       || aAttribute == nsGkAtoms::start
-       || aAttribute == nsGkAtoms::end) {
+    if (aAttribute == nsGkAtoms::loopstart ||
+        aAttribute == nsGkAtoms::loopend ||
+        aAttribute == nsGkAtoms::start ||
+        aAttribute == nsGkAtoms::end) {
       return aResult.ParseDoubleValue(aValue);
     }
-    else if (ParseImageAttribute(aAttribute, aValue, aResult)) {
+    if (ParseImageAttribute(aAttribute, aValue, aResult)) {
       return true;
     }
-    else if (aAttribute == nsGkAtoms::preload) {
+    if (aAttribute == nsGkAtoms::preload) {
       return aResult.ParseEnumValue(aValue, kPreloadTable, false);
     }
   }
@@ -1449,7 +1446,7 @@ nsresult nsHTMLMediaElement::SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
 {
   nsresult rv =
     nsGenericHTMLElement::SetAttr(aNameSpaceID, aName, aPrefix, aValue,
-                                    aNotify);
+                                  aNotify);
   if (NS_FAILED(rv))
     return rv;
   if (aNameSpaceID == kNameSpaceID_None && aName == nsGkAtoms::src) {
@@ -1536,12 +1533,16 @@ static bool IsRawEnabled()
 
 static bool IsRawType(const nsACString& aType)
 {
-  if (!IsRawEnabled())
+  if (!IsRawEnabled()) {
     return false;
-  for (PRUint32 i = 0; i < ArrayLength(gRawTypes); ++i) {
-    if (aType.EqualsASCII(gRawTypes[i]))
-      return true;
   }
+
+  for (PRUint32 i = 0; i < ArrayLength(gRawTypes); ++i) {
+    if (aType.EqualsASCII(gRawTypes[i])) {
+      return true;
+    }
+  }
+
   return false;
 }
 #endif
@@ -1569,12 +1570,16 @@ nsHTMLMediaElement::IsOggEnabled()
 bool
 nsHTMLMediaElement::IsOggType(const nsACString& aType)
 {
-  if (!IsOggEnabled())
+  if (!IsOggEnabled()) {
     return false;
-  for (PRUint32 i = 0; i < ArrayLength(gOggTypes); ++i) {
-    if (aType.EqualsASCII(gOggTypes[i]))
-      return true;
   }
+
+  for (PRUint32 i = 0; i < ArrayLength(gOggTypes); ++i) {
+    if (aType.EqualsASCII(gOggTypes[i])) {
+      return true;
+    }
+  }
+
   return false;
 }
 #endif
@@ -1604,12 +1609,16 @@ nsHTMLMediaElement::IsWaveEnabled()
 bool
 nsHTMLMediaElement::IsWaveType(const nsACString& aType)
 {
-  if (!IsWaveEnabled())
+  if (!IsWaveEnabled()) {
     return false;
-  for (PRUint32 i = 0; i < ArrayLength(gWaveTypes); ++i) {
-    if (aType.EqualsASCII(gWaveTypes[i]))
-      return true;
   }
+
+  for (PRUint32 i = 0; i < ArrayLength(gWaveTypes); ++i) {
+    if (aType.EqualsASCII(gWaveTypes[i])) {
+      return true;
+    }
+  }
+
   return false;
 }
 #endif
@@ -1636,12 +1645,16 @@ nsHTMLMediaElement::IsWebMEnabled()
 bool
 nsHTMLMediaElement::IsWebMType(const nsACString& aType)
 {
-  if (!IsWebMEnabled())
+  if (!IsWebMEnabled()) {
     return false;
-  for (PRUint32 i = 0; i < ArrayLength(gWebMTypes); ++i) {
-    if (aType.EqualsASCII(gWebMTypes[i]))
-      return true;
   }
+
+  for (PRUint32 i = 0; i < ArrayLength(gWebMTypes); ++i) {
+    if (aType.EqualsASCII(gWebMTypes[i])) {
+      return true;
+    }
+  }
+
   return false;
 }
 #endif
@@ -1760,10 +1773,16 @@ NS_IMETHODIMP
 nsHTMLMediaElement::CanPlayType(const nsAString& aType, nsAString& aResult)
 {
   switch (GetCanPlay(aType)) {
-  case CANPLAY_NO: aResult.AssignLiteral(""); break;
-  case CANPLAY_YES: aResult.AssignLiteral("probably"); break;
+  case CANPLAY_NO:
+    aResult.Truncate();
+    break;
+  case CANPLAY_YES:
+    aResult.AssignLiteral("probably");
+    break;
   default:
-  case CANPLAY_MAYBE: aResult.AssignLiteral("maybe"); break;
+  case CANPLAY_MAYBE:
+    aResult.AssignLiteral("maybe");
+    break;
   }
   return NS_OK;
 }
@@ -1774,32 +1793,32 @@ nsHTMLMediaElement::CreateDecoder(const nsACString& aType)
 #ifdef MOZ_RAW
   if (IsRawType(aType)) {
     nsRefPtr<nsRawDecoder> decoder = new nsRawDecoder();
-    if (decoder && decoder->Init(this)) {
-      return decoder.forget().get();
+    if (decoder->Init(this)) {
+      return decoder.forget();
     }
   }
 #endif
 #ifdef MOZ_OGG
   if (IsOggType(aType)) {
     nsRefPtr<nsOggDecoder> decoder = new nsOggDecoder();
-    if (decoder && decoder->Init(this)) {
-      return decoder.forget().get();
+    if (decoder->Init(this)) {
+      return decoder.forget();
     }
   }
 #endif
 #ifdef MOZ_WAVE
   if (IsWaveType(aType)) {
     nsRefPtr<nsWaveDecoder> decoder = new nsWaveDecoder();
-    if (decoder && decoder->Init(this)) {
-      return decoder.forget().get();
+    if (decoder->Init(this)) {
+      return decoder.forget();
     }
   }
 #endif
 #ifdef MOZ_WEBM
   if (IsWebMType(aType)) {
     nsRefPtr<nsWebMDecoder> decoder = new nsWebMDecoder();
-    if (decoder && decoder->Init(this)) {
-      return decoder.forget().get();
+    if (decoder->Init(this)) {
+      return decoder.forget();
     }
   }
 #endif
@@ -1913,7 +1932,8 @@ nsresult nsHTMLMediaElement::NewURIFromString(const nsAutoString& aURISpec, nsIU
   nsCOMPtr<nsIDocument> doc = OwnerDoc();
 
   nsCOMPtr<nsIURI> baseURI = GetBaseURI();
-  nsresult rv = nsContentUtils::NewURIWithDocumentCharset(aURI,
+  nsCOMPtr<nsIURI> uri;
+  nsresult rv = nsContentUtils::NewURIWithDocumentCharset(getter_AddRefs(uri),
                                                           aURISpec,
                                                           doc,
                                                           baseURI);
@@ -1922,16 +1942,16 @@ nsresult nsHTMLMediaElement::NewURIFromString(const nsAutoString& aURISpec, nsIU
   bool equal;
   if (aURISpec.IsEmpty() &&
       doc->GetDocumentURI() &&
-      NS_SUCCEEDED(doc->GetDocumentURI()->Equals(*aURI, &equal)) &&
+      NS_SUCCEEDED(doc->GetDocumentURI()->Equals(uri, &equal)) &&
       equal) {
     // It's not possible for a media resource to be embedded in the current
     // document we extracted aURISpec from, so there's no point returning
     // the current document URI just to let the caller attempt and fail to
     // decode it.
-    NS_RELEASE(*aURI);
     return NS_ERROR_DOM_INVALID_STATE_ERR;
   }
 
+  uri.forget(aURI);
   return NS_OK;
 }
 
@@ -2485,11 +2505,11 @@ void nsHTMLMediaElement::NotifyAddedSource()
 
 nsIContent* nsHTMLMediaElement::GetNextSource()
 {
-  nsresult rv = NS_OK;
   nsCOMPtr<nsIDOMNode> thisDomNode = do_QueryObject(this);
 
   mSourceLoadCandidate = nsnull;
 
+  nsresult rv = NS_OK;
   if (!mSourcePointer) {
     // First time this has been run, create a selection to cover children.
     mSourcePointer = do_CreateInstance("@mozilla.org/content/range;1");
@@ -2518,14 +2538,13 @@ nsIContent* nsHTMLMediaElement::GetNextSource()
       return nsnull; // No more children.
 
     // Advance the range to the next child.
-    rv = mSourcePointer->SetStart(thisDomNode, startOffset+1);
+    rv = mSourcePointer->SetStart(thisDomNode, startOffset + 1);
     NS_ENSURE_SUCCESS(rv, nsnull);
 
     nsIContent* child = GetChildAt(startOffset);
 
     // If child is a <source> element, it is the next candidate.
-    if (child && child->IsHTML(nsGkAtoms::source))
-    {
+    if (child && child->IsHTML(nsGkAtoms::source)) {
       mSourceLoadCandidate = child;
       return child;
     }
@@ -2534,7 +2553,8 @@ nsIContent* nsHTMLMediaElement::GetNextSource()
   return nsnull;
 }
 
-void nsHTMLMediaElement::ChangeDelayLoadStatus(bool aDelay) {
+void nsHTMLMediaElement::ChangeDelayLoadStatus(bool aDelay)
+{
   if (mDelayingLoadEvent == aDelay)
     return;
 
@@ -2599,13 +2619,13 @@ nsHTMLMediaElement::CopyInnerTo(nsGenericElement* aDest) const
 
 nsresult nsHTMLMediaElement::GetBuffered(nsIDOMTimeRanges** aBuffered)
 {
-  nsTimeRanges* ranges = new nsTimeRanges();
-  NS_ADDREF(*aBuffered = ranges);
+  nsRefPtr<nsTimeRanges> ranges = new nsTimeRanges();
   if (mReadyState >= nsIDOMHTMLMediaElement::HAVE_CURRENT_DATA && mDecoder) {
     // If GetBuffered fails we ignore the error result and just return the
     // time ranges we found up till the error.
     mDecoder->GetBuffered(ranges);
   }
+  ranges.forget(aBuffered);
   return NS_OK;
 }
 
@@ -2620,7 +2640,7 @@ void nsHTMLMediaElement::SetRequestHeaders(nsIHttpChannel* aChannel)
   // So, disable the standard "Accept-Encoding: gzip,deflate" that we usually send.
   // See bug 614760.
   aChannel->SetRequestHeader(NS_LITERAL_CSTRING("Accept-Encoding"),
-                             NS_LITERAL_CSTRING(""), false);
+                             EmptyCString(), false);
 
   // Set the Referer header
   aChannel->SetReferrer(OwnerDoc()->GetDocumentURI());
diff --git a/content/html/content/src/nsHTMLMetaElement.cpp b/content/html/content/src/nsHTMLMetaElement.cpp
index 8a57923d6f4..a0a4f098a5a 100644
--- a/content/html/content/src/nsHTMLMetaElement.cpp
+++ b/content/html/content/src/nsHTMLMetaElement.cpp
@@ -150,7 +150,5 @@ nsHTMLMetaElement::CreateAndDispatchEvent(nsIDocument* aDoc,
 
   nsRefPtr<nsPLDOMEvent> event = new nsPLDOMEvent(this, aEventName, true,
                                                   true);
-  if (event) {
-    event->PostDOMEvent();
-  }
+  event->PostDOMEvent();
 }
diff --git a/content/html/content/src/nsHTMLObjectElement.cpp b/content/html/content/src/nsHTMLObjectElement.cpp
index b984b8d30d8..7da2d1ad6a6 100644
--- a/content/html/content/src/nsHTMLObjectElement.cpp
+++ b/content/html/content/src/nsHTMLObjectElement.cpp
@@ -129,7 +129,7 @@ public:
 
   virtual bool IsDisabled() const { return false; }
 
-  virtual nsresult DoneAddingChildren(bool aHaveNotified);
+  virtual void DoneAddingChildren(bool aHaveNotified);
   virtual bool IsDoneAddingChildren();
 
   virtual bool ParseAttribute(PRInt32 aNamespaceID,
@@ -200,7 +200,7 @@ nsHTMLObjectElement::IsDoneAddingChildren()
   return mIsDoneAddingChildren;
 }
 
-nsresult
+void
 nsHTMLObjectElement::DoneAddingChildren(bool aHaveNotified)
 {
   mIsDoneAddingChildren = true;
@@ -210,7 +210,6 @@ nsHTMLObjectElement::DoneAddingChildren(bool aHaveNotified)
   if (IsInDoc()) {
     StartObjectLoad(aHaveNotified);
   }
-  return NS_OK;
 }
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsHTMLObjectElement)
diff --git a/content/html/content/src/nsHTMLOutputElement.cpp b/content/html/content/src/nsHTMLOutputElement.cpp
index 11170bc09d4..5dcf0d6d0d2 100644
--- a/content/html/content/src/nsHTMLOutputElement.cpp
+++ b/content/html/content/src/nsHTMLOutputElement.cpp
@@ -173,9 +173,7 @@ NS_IMETHODIMP
 nsHTMLOutputElement::Reset()
 {
   mValueModeFlag = eModeDefault;
-  nsresult rv = nsContentUtils::SetNodeTextContent(this, mDefaultValue,
-                                                   true);
-  return rv;
+  return nsContentUtils::SetNodeTextContent(this, mDefaultValue, true);
 }
 
 NS_IMETHODIMP
diff --git a/content/html/content/src/nsHTMLScriptElement.cpp b/content/html/content/src/nsHTMLScriptElement.cpp
index 963098b120a..bce7dd68c76 100644
--- a/content/html/content/src/nsHTMLScriptElement.cpp
+++ b/content/html/content/src/nsHTMLScriptElement.cpp
@@ -114,9 +114,6 @@ public:
                               nsIContent* aBindingParent,
                               bool aCompileEventHandlers);
 
-  virtual nsresult DoneAddingChildren(bool aHaveNotified);
-  virtual bool IsDoneAddingChildren();
-
   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
 
   // nsGenericElement
@@ -125,11 +122,8 @@ public:
 
   virtual nsXPCClassInfo* GetClassInfo();
 protected:
-  bool IsOnloadEventForWindow();
-
   // nsScriptElement
   virtual bool HasScriptContent();
-  virtual nsresult MaybeProcessScript();
 };
 
 
@@ -269,25 +263,6 @@ nsHTMLScriptElement::SetInnerHTML(const nsAString& aInnerHTML)
   return nsContentUtils::SetNodeTextContent(this, aInnerHTML, true);
 }
 
-nsresult
-nsHTMLScriptElement::DoneAddingChildren(bool aHaveNotified)
-{
-  mDoneAddingChildren = true;
-  nsresult rv = MaybeProcessScript();
-  if (!mAlreadyStarted) {
-    // Need to lose parser-insertedness here to allow another script to cause
-    // execution later.
-    LoseParserInsertedness();
-  }
-  return rv;
-}
-
-bool
-nsHTMLScriptElement::IsDoneAddingChildren()
-{
-  return mDoneAddingChildren;
-}
-
 // variation of this code in nsSVGScriptElement - check if changes
 // need to be transfered when modifying
 
@@ -342,14 +317,3 @@ nsHTMLScriptElement::HasScriptContent()
   return (mFrozen ? mExternal : HasAttr(kNameSpaceID_None, nsGkAtoms::src)) ||
          nsContentUtils::HasNonEmptyTextContent(this);
 }
-
-nsresult
-nsHTMLScriptElement::MaybeProcessScript()
-{
-  nsresult rv = nsScriptElement::MaybeProcessScript();
-  if (rv == NS_CONTENT_SCRIPT_IS_EVENTHANDLER)
-    // Don't return NS_CONTENT_SCRIPT_IS_EVENTHANDLER since callers can't deal
-    rv = NS_OK;
-
-  return rv;
-}
diff --git a/content/html/content/src/nsHTMLSelectElement.cpp b/content/html/content/src/nsHTMLSelectElement.cpp
index 6725d4db7af..531ec36bd16 100644
--- a/content/html/content/src/nsHTMLSelectElement.cpp
+++ b/content/html/content/src/nsHTMLSelectElement.cpp
@@ -273,7 +273,7 @@ nsHTMLSelectElement::InsertOptionsIntoList(nsIContent* aOptions,
     // Actually select the options if the added options warrant it
     nsCOMPtr<nsIDOMNode> optionNode;
     nsCOMPtr<nsIDOMHTMLOptionElement> option;
-    for (PRInt32 i=aListIndex;i<insertIndex;i++) {
+    for (PRInt32 i = aListIndex; i < insertIndex; i++) {
       // Notify the frame that the option is added
       if (!didGetFrame || (selectFrame && !weakSelectFrame.IsAlive())) {
         selectFrame = GetSelectFrame();
@@ -326,7 +326,7 @@ nsHTMLSelectElement::RemoveOptionsFromList(nsIContent* aOptions,
     nsISelectControlFrame* selectFrame = GetSelectFrame();
     if (selectFrame) {
       nsAutoScriptBlocker scriptBlocker;
-      for (int i = aListIndex; i < aListIndex + numRemoved; ++i) {
+      for (PRInt32 i = aListIndex; i < aListIndex + numRemoved; ++i) {
         selectFrame->RemoveOption(i);
       }
     }
@@ -394,7 +394,7 @@ nsHTMLSelectElement::InsertOptionsIntoListRecurse(nsIContent* aOptions,
          child;
          child = child->GetNextSibling()) {
       nsresult rv = InsertOptionsIntoListRecurse(child,
-                                                 aInsertIndex, aDepth+1);
+                                                 aInsertIndex, aDepth + 1);
       NS_ENSURE_SUCCESS(rv, rv);
     }
   }
@@ -438,7 +438,6 @@ nsHTMLSelectElement::RemoveOptionsFromListRecurse(nsIContent* aOptions,
     for (nsIContent* child = aOptions->GetFirstChild();
          child;
          child = child->GetNextSibling()) {
-
       nsresult rv = RemoveOptionsFromListRecurse(child,
                                                  aRemoveIndex,
                                                  aNumRemoved,
@@ -765,19 +764,15 @@ nsHTMLSelectElement::GetLength(PRUint32* aLength)
 NS_IMETHODIMP
 nsHTMLSelectElement::SetLength(PRUint32 aLength)
 {
-  nsresult rv=NS_OK;
-
   PRUint32 curlen;
-  PRUint32 i;
-
-  rv = GetLength(&curlen);
+  nsresult rv = GetLength(&curlen);
   if (NS_FAILED(rv)) {
     curlen = 0;
   }
 
   if (curlen > aLength) { // Remove extra options
-    for (i = curlen; i > aLength && NS_SUCCEEDED(rv); --i) {
-      rv = Remove(i-1);
+    for (PRUint32 i = curlen; i > aLength && NS_SUCCEEDED(rv); --i) {
+      rv = Remove(i - 1);
     }
   } else if (aLength > curlen) {
     if (aLength > MAX_DYNAMIC_SELECT_LENGTH) {
@@ -804,7 +799,7 @@ nsHTMLSelectElement::SetLength(PRUint32 aLength)
 
     nsCOMPtr<nsIDOMNode> node(do_QueryInterface(element));
 
-    for (i = curlen; i < aLength; i++) {
+    for (PRUint32 i = curlen; i < aLength; i++) {
       nsCOMPtr<nsIDOMNode> tmpNode;
 
       rv = AppendChild(node, getter_AddRefs(tmpNode));
@@ -892,7 +887,7 @@ nsHTMLSelectElement::OnOptionSelected(nsISelectControlFrame* aSelectFrame,
     mSelectedIndex = aIndex;
     SetSelectionChanged(true, aNotify);
   } else if (!aSelected && aIndex == mSelectedIndex) {
-    FindSelectedIndex(aIndex+1, aNotify);
+    FindSelectedIndex(aIndex + 1, aNotify);
   }
 
   if (aChangeOptionState) {
@@ -922,7 +917,7 @@ nsHTMLSelectElement::FindSelectedIndex(PRInt32 aStartIndex, bool aNotify)
   SetSelectionChanged(true, aNotify);
   PRUint32 len;
   GetLength(&len);
-  for (PRInt32 i=aStartIndex; i<(PRInt32)len; i++) {
+  for (PRInt32 i = aStartIndex; i < PRInt32(len); i++) {
     if (IsOptionSelectedByIndex(i)) {
       mSelectedIndex = i;
       SetSelectionChanged(true, aNotify);
@@ -1070,7 +1065,7 @@ nsHTMLSelectElement::SetOptionsSelectedByIndex(PRInt32 aStartIndex,
        || aStartIndex == -1)
        && previousSelectedIndex != -1) {
       for (PRInt32 optIndex = previousSelectedIndex;
-           optIndex < (PRInt32)numItems;
+           optIndex < PRInt32(numItems);
            optIndex++) {
         if (optIndex < aStartIndex || optIndex > aEndIndex) {
           nsIDOMHTMLOptionElement *option = mOptions->ItemAsOption(optIndex);
@@ -1232,42 +1227,35 @@ nsHTMLSelectElement::GetValue(nsAString& aValue)
     }
   }
 
-  aValue.Truncate(0);
+  aValue.Truncate();
   return rv;
 }
 
 NS_IMETHODIMP
 nsHTMLSelectElement::SetValue(const nsAString& aValue)
 {
-  nsresult rv = NS_OK;
-
   PRUint32 length;
-  rv = GetLength(&length);
-  if (NS_SUCCEEDED(rv)) {
-    PRUint32 i;
-    for (i = 0; i < length; i++) {
-      nsCOMPtr<nsIDOMNode> node;
+  nsresult rv = GetLength(&length);
+  NS_ENSURE_SUCCESS(rv, rv);
 
-      rv = Item(i, getter_AddRefs(node));
+  for (PRUint32 i = 0; i < length; i++) {
+    nsCOMPtr<nsIDOMNode> node;
+    rv = Item(i, getter_AddRefs(node));
+    if (NS_FAILED(rv) || !node) {
+      continue;
+    }
 
-      if (NS_SUCCEEDED(rv) && node) {
-        nsCOMPtr<nsIDOMHTMLOptionElement> option = do_QueryInterface(node);
-
-        if (option) {
-          nsAutoString optionVal;
-
-          option->GetValue(optionVal);
-
-          if (optionVal.Equals(aValue)) {
-            SetSelectedIndexInternal((PRInt32)i, true);
-
-            break;
-          }
-        }
-      }
+    nsCOMPtr<nsIDOMHTMLOptionElement> option = do_QueryInterface(node);
+    if (!option) {
+      continue;
+    }
+    nsAutoString optionVal;
+    option->GetValue(optionVal);
+    if (optionVal.Equals(aValue)) {
+      SetSelectedIndexInternal(PRInt32(i), true);
+      break;
     }
   }
-
   return rv;
 }
 
@@ -1327,7 +1315,7 @@ nsHTMLSelectElement::SelectSomething(bool aNotify)
 
   PRUint32 count;
   GetLength(&count);
-  for (PRUint32 i=0; i<count; i++) {
+  for (PRUint32 i = 0; i < count; i++) {
     bool disabled;
     nsresult rv = IsOptionDisabled(i, &disabled);
 
@@ -1443,7 +1431,7 @@ nsHTMLSelectElement::UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute,
   return rv;
 }
 
-nsresult
+void
 nsHTMLSelectElement::DoneAddingChildren(bool aHaveNotified)
 {
   mIsDoneAddingChildren = true;
@@ -1480,8 +1468,6 @@ nsHTMLSelectElement::DoneAddingChildren(bool aHaveNotified)
   }
 
   mDefaultSelectionSet = true;
-
-  return NS_OK;
 }
 
 bool
@@ -1627,9 +1613,6 @@ NS_IMETHODIMP
 nsHTMLSelectElement::SaveState()
 {
   nsRefPtr<nsSelectState> state = new nsSelectState();
-  if (!state) {
-    return NS_ERROR_OUT_OF_MEMORY;
-  }
 
   PRUint32 len;
   GetLength(&len);
@@ -1699,7 +1682,7 @@ nsHTMLSelectElement::RestoreStateTo(nsSelectState* aNewSelected)
   SetOptionsSelectedByIndex(-1, -1, true, true, true, true, nsnull);
 
   // Next set the proper ones
-  for (PRInt32 i = 0; i < (PRInt32)len; i++) {
+  for (PRInt32 i = 0; i < PRInt32(len); i++) {
     nsIDOMHTMLOptionElement *option = mOptions->ItemAsOption(i);
     if (option) {
       nsAutoString value;
@@ -1709,8 +1692,6 @@ nsHTMLSelectElement::RestoreStateTo(nsSelectState* aNewSelected)
       }
     }
   }
-
-  //CheckSelectSomething();
 }
 
 NS_IMETHODIMP
@@ -1772,8 +1753,6 @@ static NS_DEFINE_CID(kFormProcessorCID, NS_FORMPROCESSOR_CID);
 NS_IMETHODIMP
 nsHTMLSelectElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
 {
-  nsresult rv = NS_OK;
-
   // Disabled elements don't submit
   if (IsDisabled()) {
     return NS_OK;
@@ -1798,13 +1777,13 @@ nsHTMLSelectElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
   nsCOMPtr<nsIFormProcessor> keyGenProcessor;
   if (GetAttr(kNameSpaceID_None, nsGkAtoms::_moz_type, mozType) &&
       mozType.EqualsLiteral("-mozilla-keygen")) {
-    keyGenProcessor = do_GetService(kFormProcessorCID, &rv);
+    keyGenProcessor = do_GetService(kFormProcessorCID);
   }
 
   for (PRUint32 optIndex = 0; optIndex < len; optIndex++) {
     // Don't send disabled options
     bool disabled;
-    rv = IsOptionDisabled(optIndex, &disabled);
+    nsresult rv = IsOptionDisabled(optIndex, &disabled);
     if (NS_FAILED(rv) || disabled) {
       continue;
     }
@@ -1847,7 +1826,9 @@ nsHTMLSelectElement::GetHasOptGroups(bool* aHasGroups)
   return NS_OK;
 }
 
-void nsHTMLSelectElement::DispatchContentReset() {
+void
+nsHTMLSelectElement::DispatchContentReset()
+{
   nsIFormControlFrame* formControlFrame = GetFormControlFrame(false);
   if (formControlFrame) {
     // Only dispatch content reset notification if this is a list control
@@ -1898,20 +1879,18 @@ nsHTMLSelectElement::IsValueMissing()
   }
 
   PRUint32 length;
-  nsIDOMHTMLOptionElement* option = nsnull;
-  bool disabled;
-  bool selected;
-
   mOptions->GetLength(&length);
 
-  for (PRUint32 i=0; i<length; ++i) {
-    option = mOptions->ItemAsOption(i);
+  for (PRUint32 i = 0; i < length; ++i) {
+    nsIDOMHTMLOptionElement* option = mOptions->ItemAsOption(i);
+    bool selected;
     NS_ENSURE_SUCCESS(option->GetSelected(&selected), false);
 
     if (!selected) {
       continue;
     }
 
+    bool disabled;
     IsOptionDisabled(i, &disabled);
     if (disabled) {
       continue;
@@ -1935,28 +1914,21 @@ nsHTMLSelectElement::UpdateValueMissingValidityState()
 
 nsresult
 nsHTMLSelectElement::GetValidationMessage(nsAString& aValidationMessage,
-                                            ValidityStateType aType)
+                                          ValidityStateType aType)
 {
-  nsresult rv = NS_OK;
-
-  switch (aType)
-  {
-    case VALIDITY_STATE_VALUE_MISSING:
-      {
-        nsXPIDLString message;
-
-        rv = nsContentUtils::GetLocalizedString(nsContentUtils::eDOM_PROPERTIES,
-                                                "FormValidationSelectMissing",
-                                                message);
-
-        aValidationMessage = message;
-      }
-      break;
-    default:
-      rv = nsIConstraintValidation::GetValidationMessage(aValidationMessage, aType);
+  switch (aType) {
+    case VALIDITY_STATE_VALUE_MISSING: {
+      nsXPIDLString message;
+      nsresult rv = nsContentUtils::GetLocalizedString(nsContentUtils::eDOM_PROPERTIES,
+                                                       "FormValidationSelectMissing",
+                                                       message);
+      aValidationMessage = message;
+      return rv;
+    }
+    default: {
+      return nsIConstraintValidation::GetValidationMessage(aValidationMessage, aType);
+    }
   }
-
-  return rv;
 }
 
 #ifdef DEBUG
@@ -2302,4 +2274,3 @@ nsHTMLSelectElement::SetSelectionChanged(bool aValue, bool aNotify)
     UpdateState(aNotify);
   }
 }
-
diff --git a/content/html/content/src/nsHTMLSelectElement.h b/content/html/content/src/nsHTMLSelectElement.h
index 16b96d81f25..3c0f9b64beb 100644
--- a/content/html/content/src/nsHTMLSelectElement.h
+++ b/content/html/content/src/nsHTMLSelectElement.h
@@ -398,7 +398,7 @@ public:
   virtual nsresult UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute,
                              bool aNotify);
   
-  virtual nsresult DoneAddingChildren(bool aHaveNotified);
+  virtual void DoneAddingChildren(bool aHaveNotified);
   virtual bool IsDoneAddingChildren() {
     return mIsDoneAddingChildren;
   }
diff --git a/content/html/content/src/nsHTMLSharedElement.cpp b/content/html/content/src/nsHTMLSharedElement.cpp
index 206341ece34..4f74c888b71 100644
--- a/content/html/content/src/nsHTMLSharedElement.cpp
+++ b/content/html/content/src/nsHTMLSharedElement.cpp
@@ -382,8 +382,8 @@ nsHTMLSharedElement::SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
                              nsIAtom* aPrefix, const nsAString& aValue,
                              bool aNotify)
 {
-  nsresult rv =  nsGenericHTMLElement::SetAttr(aNameSpaceID, aName, aPrefix,
-                                               aValue, aNotify);
+  nsresult rv = nsGenericHTMLElement::SetAttr(aNameSpaceID, aName, aPrefix,
+                                              aValue, aNotify);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // If the href attribute of a <base> tag is changing, we may need to update
diff --git a/content/html/content/src/nsHTMLSharedObjectElement.cpp b/content/html/content/src/nsHTMLSharedObjectElement.cpp
index 438c090cdec..d12769df1f0 100644
--- a/content/html/content/src/nsHTMLSharedObjectElement.cpp
+++ b/content/html/content/src/nsHTMLSharedObjectElement.cpp
@@ -50,13 +50,6 @@
 #include "nsIDOMGetSVGDocument.h"
 #include "nsIDOMSVGDocument.h"
 
-// XXX this is to get around conflicts with windows.h defines
-// introduced through jni.h
-#ifdef XP_WIN
-#undef GetClassName
-#undef GetObject
-#endif
-
 using namespace mozilla;
 using namespace mozilla::dom;
 
@@ -127,7 +120,7 @@ public:
   virtual bool IsHTMLFocusable(bool aWithMouse, bool *aIsFocusable, PRInt32 *aTabIndex);
   virtual PRUint32 GetDesiredIMEState();
 
-  virtual nsresult DoneAddingChildren(bool aHaveNotified);
+  virtual void DoneAddingChildren(bool aHaveNotified);
   virtual bool IsDoneAddingChildren();
 
   virtual bool ParseAttribute(PRInt32 aNamespaceID,
@@ -215,7 +208,7 @@ nsHTMLSharedObjectElement::IsDoneAddingChildren()
   return mIsDoneAddingChildren;
 }
 
-nsresult
+void
 nsHTMLSharedObjectElement::DoneAddingChildren(bool aHaveNotified)
 {
   if (!mIsDoneAddingChildren) {
@@ -227,8 +220,6 @@ nsHTMLSharedObjectElement::DoneAddingChildren(bool aHaveNotified)
       StartObjectLoad(aHaveNotified);
     }
   }
-
-  return NS_OK;
 }
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsHTMLSharedObjectElement)
diff --git a/content/html/content/src/nsHTMLStyleElement.cpp b/content/html/content/src/nsHTMLStyleElement.cpp
index 2508cae2835..78860b6b2ab 100644
--- a/content/html/content/src/nsHTMLStyleElement.cpp
+++ b/content/html/content/src/nsHTMLStyleElement.cpp
@@ -170,36 +170,24 @@ NS_IMPL_ELEMENT_CLONE(nsHTMLStyleElement)
 NS_IMETHODIMP
 nsHTMLStyleElement::GetDisabled(bool* aDisabled)
 {
-  nsresult result = NS_OK;
-  
-  if (GetStyleSheet()) {
-    nsCOMPtr<nsIDOMStyleSheet> ss(do_QueryInterface(GetStyleSheet()));
-
-    if (ss) {
-      result = ss->GetDisabled(aDisabled);
-    }
-  }
-  else {
+  nsCOMPtr<nsIDOMStyleSheet> ss = do_QueryInterface(GetStyleSheet());
+  if (!ss) {
     *aDisabled = false;
+    return NS_OK;
   }
 
-  return result;
+  return ss->GetDisabled(aDisabled);
 }
 
 NS_IMETHODIMP 
 nsHTMLStyleElement::SetDisabled(bool aDisabled)
 {
-  nsresult result = NS_OK;
-  
-  if (GetStyleSheet()) {
-    nsCOMPtr<nsIDOMStyleSheet> ss(do_QueryInterface(GetStyleSheet()));
-
-    if (ss) {
-      result = ss->SetDisabled(aDisabled);
-    }
+  nsCOMPtr<nsIDOMStyleSheet> ss = do_QueryInterface(GetStyleSheet());
+  if (!ss) {
+    return NS_OK;
   }
 
-  return result;
+  return ss->SetDisabled(aDisabled);
 }
 
 NS_IMPL_STRING_ATTR(nsHTMLStyleElement, Media, media)
@@ -367,6 +355,4 @@ nsHTMLStyleElement::GetStyleSheetInfo(nsAString& aTitle,
   // If we get here we assume that we're loading a css file, so set the
   // type to 'text/css'
   aType.AssignLiteral("text/css");
-
-  return;
 }
diff --git a/content/html/content/src/nsHTMLTableCellElement.cpp b/content/html/content/src/nsHTMLTableCellElement.cpp
index 0ed79a00bb6..f55461a19d1 100644
--- a/content/html/content/src/nsHTMLTableCellElement.cpp
+++ b/content/html/content/src/nsHTMLTableCellElement.cpp
@@ -88,10 +88,9 @@ public:
 
   virtual nsXPCClassInfo* GetClassInfo();
 protected:
-  // This does not return a nsresult since all we care about is if we
-  // found the row element that this cell is in or not.
-  void GetRow(nsIDOMHTMLTableRowElement** aRow);
-  nsIContent * GetTable();
+  nsHTMLTableElement* GetTable() const;
+
+  already_AddRefed<nsIDOMHTMLTableRowElement> GetRow() const;
 };
 
 
@@ -127,40 +126,40 @@ NS_IMPL_ELEMENT_CLONE(nsHTMLTableCellElement)
 
 
 // protected method
-void
-nsHTMLTableCellElement::GetRow(nsIDOMHTMLTableRowElement** aRow)
+already_AddRefed<nsIDOMHTMLTableRowElement>
+nsHTMLTableCellElement::GetRow() const
 {
-  *aRow = nsnull;
-
-  nsCOMPtr<nsIDOMNode> rowNode;
-  GetParentNode(getter_AddRefs(rowNode));
-
-  if (rowNode) {
-    CallQueryInterface(rowNode, aRow);
-  }
+  nsCOMPtr<nsIDOMHTMLTableRowElement> row = do_QueryInterface(GetParent());
+  return row.forget();
 }
 
 // protected method
-nsIContent*
-nsHTMLTableCellElement::GetTable()
+nsHTMLTableElement*
+nsHTMLTableCellElement::GetTable() const
 {
-  nsIContent *result = nsnull;
-
   nsIContent *parent = GetParent();
-  if (parent) {  // GetParent() should be a row
-    nsIContent* section = parent->GetParent();
-    if (section) {
-      if (section->IsHTML() &&
-          section->NodeInfo()->Equals(nsGkAtoms::table)) {
-        // XHTML, without a row group
-        result = section;
-      } else {
-        // we have a row group.
-        result = section->GetParent();
-      }
-    }
+  if (!parent) {
+    return nsnull;
   }
-  return result;
+
+  // parent should be a row.
+  nsIContent* section = parent->GetParent();
+  if (!section) {
+    return nsnull;
+  }
+
+  if (section->IsHTML(nsGkAtoms::table)) {
+    // XHTML, without a row group.
+    return static_cast<nsHTMLTableElement*>(section);
+  }
+
+  // We have a row group.
+  nsIContent* result = section->GetParent();
+  if (result && result->IsHTML(nsGkAtoms::table)) {
+    return static_cast<nsHTMLTableElement*>(result);
+  }
+
+  return nsnull;
 }
 
 NS_IMETHODIMP
@@ -168,10 +167,7 @@ nsHTMLTableCellElement::GetCellIndex(PRInt32* aCellIndex)
 {
   *aCellIndex = -1;
 
-  nsCOMPtr<nsIDOMHTMLTableRowElement> row;
-
-  GetRow(getter_AddRefs(row));
-
+  nsCOMPtr<nsIDOMHTMLTableRowElement> row = GetRow();
   if (!row) {
     return NS_OK;
   }
@@ -187,16 +183,13 @@ nsHTMLTableCellElement::GetCellIndex(PRInt32* aCellIndex)
   PRUint32 numCells;
   cells->GetLength(&numCells);
 
-  bool found = false;
-  PRUint32 i;
-
-  for (i = 0; (i < numCells) && !found; i++) {
+  for (PRUint32 i = 0; i < numCells; i++) {
     nsCOMPtr<nsIDOMNode> node;
     cells->Item(i, getter_AddRefs(node));
 
     if (node.get() == static_cast<nsIDOMNode *>(this)) {
       *aCellIndex = i;
-      found = true;
+      break;
     }
   }
 
@@ -210,13 +203,12 @@ nsHTMLTableCellElement::WalkContentStyleRules(nsRuleWalker* aRuleWalker)
   nsresult rv = nsGenericHTMLElement::WalkContentStyleRules(aRuleWalker);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsIContent* node = GetTable();
-  if (node && node->IsHTML(nsGkAtoms::table)) {
-    nsHTMLTableElement* table = static_cast<nsHTMLTableElement*>(node);
+  if (nsHTMLTableElement* table = GetTable()) {
     nsMappedAttributes* tableInheritedAttributes =
       table->GetAttributesMappedForCell();
-    if (tableInheritedAttributes)
+    if (tableInheritedAttributes) {
       aRuleWalker->Forward(tableInheritedAttributes);
+    }
   }
   return NS_OK;
 }
@@ -242,10 +234,7 @@ nsHTMLTableCellElement::GetAlign(nsAString& aValue)
 {
   if (!GetAttr(kNameSpaceID_None, nsGkAtoms::align, aValue)) {
     // There's no align attribute, ask the row for the alignment.
-
-    nsCOMPtr<nsIDOMHTMLTableRowElement> row;
-    GetRow(getter_AddRefs(row));
-
+    nsCOMPtr<nsIDOMHTMLTableRowElement> row = GetRow();
     if (row) {
       return row->GetAlign(aValue);
     }
diff --git a/content/html/content/src/nsHTMLTableElement.cpp b/content/html/content/src/nsHTMLTableElement.cpp
index 1144e5593f6..5cf1ca42c3e 100644
--- a/content/html/content/src/nsHTMLTableElement.cpp
+++ b/content/html/content/src/nsHTMLTableElement.cpp
@@ -103,7 +103,7 @@ protected:
 TableRowsCollection::TableRowsCollection(nsHTMLTableElement *aParent)
   : mParent(aParent)
   , mOrphanRows(new nsContentList(mParent,
-                                  mParent->NodeInfo()->NamespaceID(),
+                                  kNameSpaceID_XHTML,
                                   nsGkAtoms::tr,
                                   nsGkAtoms::tr,
                                   false))
@@ -383,27 +383,23 @@ NS_IMPL_STRING_ATTR(nsHTMLTableElement, Summary, summary)
 NS_IMPL_STRING_ATTR(nsHTMLTableElement, Width, width)
 
 
+already_AddRefed<nsIDOMHTMLTableCaptionElement>
+nsHTMLTableElement::GetCaption()
+{
+  for (nsIContent* cur = nsINode::GetFirstChild(); cur; cur = cur->GetNextSibling()) {
+    nsCOMPtr<nsIDOMHTMLTableCaptionElement> caption = do_QueryInterface(cur);
+    if (caption) {
+      return caption.forget();
+    }
+  }
+  return nsnull;
+}
+
 NS_IMETHODIMP
 nsHTMLTableElement::GetCaption(nsIDOMHTMLTableCaptionElement** aValue)
 {
-  *aValue = nsnull;
-  nsCOMPtr<nsIDOMNode> child;
-  GetFirstChild(getter_AddRefs(child));
-
-  while (child) {
-    nsCOMPtr<nsIDOMHTMLTableCaptionElement> caption(do_QueryInterface(child));
-
-    if (caption) {
-      *aValue = caption;
-      NS_ADDREF(*aValue);
-
-      break;
-    }
-
-    nsIDOMNode *temp = child.get();
-    temp->GetNextSibling(getter_AddRefs(child));
-  }
-
+  nsCOMPtr<nsIDOMHTMLTableCaptionElement> caption = GetCaption();
+  caption.forget(aValue);
   return NS_OK;
 }
 
@@ -425,22 +421,14 @@ nsHTMLTableElement::SetCaption(nsIDOMHTMLTableCaptionElement* aValue)
 already_AddRefed<nsIDOMHTMLTableSectionElement>
 nsHTMLTableElement::GetSection(nsIAtom *aTag)
 {
-  nsCOMPtr<nsIDOMHTMLTableSectionElement> section;
-
   for (nsIContent* child = nsINode::GetFirstChild();
        child;
        child = child->GetNextSibling()) {
-
-    section = do_QueryInterface(child);
-
+    nsCOMPtr<nsIDOMHTMLTableSectionElement> section = do_QueryInterface(child);
     if (section && child->NodeInfo()->Equals(aTag)) {
-      nsIDOMHTMLTableSectionElement *result = section;
-      NS_ADDREF(result);
-
-      return result;
+      return section.forget();
     }
   }
-
   return nsnull;
 }
 
@@ -536,7 +524,7 @@ nsHTMLTableElement::TBodies()
   if (!mTBodies) {
     // Not using NS_GetContentList because this should not be cached
     mTBodies = new nsContentList(this,
-                                 mNodeInfo->NamespaceID(),
+                                 kNameSpaceID_XHTML,
                                  nsGkAtoms::tbody,
                                  nsGkAtoms::tbody,
                                  false);
@@ -549,41 +537,34 @@ NS_IMETHODIMP
 nsHTMLTableElement::CreateTHead(nsIDOMHTMLElement** aValue)
 {
   *aValue = nsnull;
-  nsresult rv = NS_OK;
-  nsCOMPtr<nsIDOMHTMLTableSectionElement> head;
 
-  GetTHead(getter_AddRefs(head));
-
-  if (head) { // return the existing thead
-    CallQueryInterface(head, aValue);
-
-    NS_ASSERTION(*aValue, "head must be a DOMHTMLElement");
-  }
-  else
-  { // create a new head rowgroup
-    nsCOMPtr<nsINodeInfo> nodeInfo;
-
-    nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::thead,
-                                getter_AddRefs(nodeInfo));
-
-    nsCOMPtr<nsIContent> newHead = NS_NewHTMLTableSectionElement(nodeInfo.forget());
-
-    if (newHead) {
-      nsCOMPtr<nsIDOMNode> child;
-
-      rv = GetFirstChild(getter_AddRefs(child));
-
-      if (NS_FAILED(rv)) {
-        return rv;
-      }
-
-      CallQueryInterface(newHead, aValue);
-
-      nsCOMPtr<nsIDOMNode> resultChild;
-      rv = InsertBefore(*aValue, child, getter_AddRefs(resultChild));
-    }
+  nsRefPtr<nsIDOMHTMLTableSectionElement> head = GetTHead();
+  if (head) {
+    // return the existing thead
+    head.forget(aValue);
+    return NS_OK;
   }
 
+  nsCOMPtr<nsINodeInfo> nodeInfo;
+  nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::thead,
+                              getter_AddRefs(nodeInfo));
+
+  nsCOMPtr<nsIContent> newHead =
+    NS_NewHTMLTableSectionElement(nodeInfo.forget());
+
+  if (!newHead) {
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsIDOMNode> child;
+  nsresult rv = GetFirstChild(getter_AddRefs(child));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIDOMHTMLElement> newHeadAsDOMElement = do_QueryInterface(newHead);
+
+  nsCOMPtr<nsIDOMNode> resultChild;
+  InsertBefore(newHeadAsDOMElement, child, getter_AddRefs(resultChild));
+  newHeadAsDOMElement.forget(aValue);
   return NS_OK;
 }
 
@@ -606,30 +587,26 @@ NS_IMETHODIMP
 nsHTMLTableElement::CreateTFoot(nsIDOMHTMLElement** aValue)
 {
   *aValue = nsnull;
-  nsresult rv = NS_OK;
-  nsCOMPtr<nsIDOMHTMLTableSectionElement> foot;
 
-  GetTFoot(getter_AddRefs(foot));
-
-  if (foot) { // return the existing tfoot
-    CallQueryInterface(foot, aValue);
-
-    NS_ASSERTION(*aValue, "foot must be a DOMHTMLElement");
+  nsRefPtr<nsIDOMHTMLTableSectionElement> foot = GetTFoot();
+  if (foot) {
+    // return the existing tfoot
+    foot.forget(aValue);
+    return NS_OK;
   }
-  else
-  { // create a new foot rowgroup
-    nsCOMPtr<nsINodeInfo> nodeInfo;
-    nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::tfoot,
-                                getter_AddRefs(nodeInfo));
+  // create a new foot rowgroup
+  nsCOMPtr<nsINodeInfo> nodeInfo;
+  nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::tfoot,
+                              getter_AddRefs(nodeInfo));
 
-    nsCOMPtr<nsIContent> newFoot = NS_NewHTMLTableSectionElement(nodeInfo.forget());
+  nsCOMPtr<nsIContent> newFoot = NS_NewHTMLTableSectionElement(nodeInfo.forget());
 
-    if (newFoot) {
-      rv = AppendChildTo(newFoot, true);
-      CallQueryInterface(newFoot, aValue);
-    }
+  if (!newFoot) {
+    return NS_OK;
   }
-
+  AppendChildTo(newFoot, true);
+  nsCOMPtr<nsIDOMHTMLElement> newFootAsDOMElement = do_QueryInterface(newFoot);
+  newFootAsDOMElement.forget(aValue);
   return NS_OK;
 }
 
@@ -652,30 +629,28 @@ NS_IMETHODIMP
 nsHTMLTableElement::CreateCaption(nsIDOMHTMLElement** aValue)
 {
   *aValue = nsnull;
-  nsresult rv = NS_OK;
-  nsCOMPtr<nsIDOMHTMLTableCaptionElement> caption;
 
-  GetCaption(getter_AddRefs(caption));
-
-  if (caption) { // return the existing thead
-    CallQueryInterface(caption, aValue);
-
-    NS_ASSERTION(*aValue, "caption must be a DOMHTMLElement");
-  }
-  else
-  { // create a new head rowgroup
-    nsCOMPtr<nsINodeInfo> nodeInfo;
-    nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::caption,
-                                getter_AddRefs(nodeInfo));
-
-    nsCOMPtr<nsIContent> newCaption = NS_NewHTMLTableCaptionElement(nodeInfo.forget());
-
-    if (newCaption) {
-      rv = AppendChildTo(newCaption, true);
-      CallQueryInterface(newCaption, aValue);
-    }
+  if (nsRefPtr<nsIDOMHTMLTableCaptionElement> caption = GetCaption()) {
+    // return the existing caption
+    caption.forget(aValue);
+    return NS_OK;
   }
 
+  // create a new head rowgroup
+  nsCOMPtr<nsINodeInfo> nodeInfo;
+  nsContentUtils::NameChanged(mNodeInfo, nsGkAtoms::caption,
+                              getter_AddRefs(nodeInfo));
+
+  nsCOMPtr<nsIContent> newCaption = NS_NewHTMLTableCaptionElement(nodeInfo.forget());
+
+  if (!newCaption) {
+    return NS_OK;
+  }
+
+  AppendChildTo(newCaption, true);
+  nsCOMPtr<nsIDOMHTMLElement> captionAsDOMElement =
+    do_QueryInterface(newCaption);
+  captionAsDOMElement.forget(aValue);
   return NS_OK;
 }
 
@@ -710,8 +685,6 @@ nsHTMLTableElement::InsertRow(PRInt32 aIndex, nsIDOMHTMLElement** aValue)
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
-  nsresult rv;
-
   nsCOMPtr<nsIDOMHTMLCollection> rows;
   GetRows(getter_AddRefs(rows));
 
@@ -725,6 +698,7 @@ nsHTMLTableElement::InsertRow(PRInt32 aIndex, nsIDOMHTMLElement** aValue)
   // use local variable refIndex so we can remember original aIndex
   PRUint32 refIndex = (PRUint32)aIndex;
 
+  nsresult rv;
   if (rowCount > 0) {
     if (refIndex == rowCount || aIndex == -1) {
       // we set refIndex to the last row so we can get the last row's
@@ -766,19 +740,17 @@ nsHTMLTableElement::InsertRow(PRInt32 aIndex, nsIDOMHTMLElement** aValue)
         CallQueryInterface(retChild, aValue);
       }
     }
-  }
-  else
-  { // the row count was 0, so 
+  } else {
+    // the row count was 0, so 
     // find the first row group and insert there as first child
     nsCOMPtr<nsIDOMNode> rowGroup;
 
-    PRInt32 namespaceID = mNodeInfo->NamespaceID();
     for (nsIContent* child = nsINode::GetFirstChild();
          child;
          child = child->GetNextSibling()) {
       nsINodeInfo *childInfo = child->NodeInfo();
       nsIAtom *localName = childInfo->NameAtom();
-      if (childInfo->NamespaceID() == namespaceID &&
+      if (childInfo->NamespaceID() == kNameSpaceID_XHTML &&
           (localName == nsGkAtoms::thead ||
            localName == nsGkAtoms::tbody ||
            localName == nsGkAtoms::tfoot)) {
diff --git a/content/html/content/src/nsHTMLTableElement.h b/content/html/content/src/nsHTMLTableElement.h
index 623395bf0fa..1f78ba49051 100644
--- a/content/html/content/src/nsHTMLTableElement.h
+++ b/content/html/content/src/nsHTMLTableElement.h
@@ -100,6 +100,7 @@ public:
   already_AddRefed<nsIDOMHTMLTableSectionElement> GetTFoot() {
     return GetSection(nsGkAtoms::tfoot);
   }
+  already_AddRefed<nsIDOMHTMLTableCaptionElement> GetCaption();
   nsContentList* TBodies();
 protected:
   already_AddRefed<nsIDOMHTMLTableSectionElement> GetSection(nsIAtom *aTag);
diff --git a/content/html/content/src/nsHTMLTableRowElement.cpp b/content/html/content/src/nsHTMLTableRowElement.cpp
index 17c201d96c8..8b616dfd312 100644
--- a/content/html/content/src/nsHTMLTableRowElement.cpp
+++ b/content/html/content/src/nsHTMLTableRowElement.cpp
@@ -134,15 +134,10 @@ nsresult
 nsHTMLTableRowElement::GetSection(nsIDOMHTMLTableSectionElement** aSection)
 {
   NS_ENSURE_ARG_POINTER(aSection);
-  *aSection = nsnull;
-
-  nsCOMPtr<nsIDOMNode> sectionNode;
-  nsresult rv = GetParentNode(getter_AddRefs(sectionNode));
-  if (NS_SUCCEEDED(rv) && sectionNode) {
-    rv = CallQueryInterface(sectionNode, aSection);
-  }
-
-  return rv;
+  nsCOMPtr<nsIDOMHTMLTableSectionElement> section =
+    do_QueryInterface(GetParent());
+  section.forget(aSection);
+  return NS_OK;
 }
 
 // protected method
@@ -152,25 +147,25 @@ nsHTMLTableRowElement::GetTable(nsIDOMHTMLTableElement** aTable)
   NS_ENSURE_ARG_POINTER(aTable);
   *aTable = nsnull;
 
-  nsCOMPtr<nsIDOMNode> sectionNode;
-  nsresult rv = GetParentNode(getter_AddRefs(sectionNode));
-  if (!sectionNode) {
-    return rv;
+  nsIContent* parent = GetParent();
+  if (!parent) {
+    return NS_OK;
   }
 
   // We may not be in a section
-  rv = CallQueryInterface(sectionNode, aTable);
-  if (NS_SUCCEEDED(rv)) {
-    return rv;
+  nsCOMPtr<nsIDOMHTMLTableElement> table = do_QueryInterface(parent);
+  if (table) {
+    table.forget(aTable);
+    return NS_OK;
   }
 
-  nsCOMPtr<nsIDOMNode> tableNode;
-  rv = sectionNode->GetParentNode(getter_AddRefs(tableNode));
-  if (!tableNode) {
-    return rv;
+  parent = parent->GetParent();
+  if (!parent) {
+    return NS_OK;
   }
-  
-  return CallQueryInterface(tableNode, aTable);
+  table = do_QueryInterface(parent);
+  table.forget(aTable);
+  return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -178,62 +173,46 @@ nsHTMLTableRowElement::GetRowIndex(PRInt32* aValue)
 {
   *aValue = -1;
   nsCOMPtr<nsIDOMHTMLTableElement> table;
-
-  nsresult result = GetTable(getter_AddRefs(table));
-
-  if (NS_SUCCEEDED(result) && table) {
-    nsCOMPtr<nsIDOMHTMLCollection> rows;
-
-    table->GetRows(getter_AddRefs(rows));
-
-    PRUint32 numRows;
-    rows->GetLength(&numRows);
-
-    bool found = false;
-
-    for (PRUint32 i = 0; (i < numRows) && !found; i++) {
-      nsCOMPtr<nsIDOMNode> node;
-
-      rows->Item(i, getter_AddRefs(node));
-
-      if (node.get() == static_cast<nsIDOMNode *>(this)) {
-        *aValue = i;
-        found = true;
-      }
-    }
+  nsresult rv = GetTable(getter_AddRefs(table));
+  if (NS_FAILED(rv) || !table) {
+    return rv;
   }
 
-  return result;
+  nsCOMPtr<nsIDOMHTMLCollection> rows;
+  table->GetRows(getter_AddRefs(rows));
+
+  PRUint32 numRows;
+  rows->GetLength(&numRows);
+
+  for (PRUint32 i = 0; i < numRows; i++) {
+    if (rows->GetNodeAt(i) == static_cast<nsIContent*>(this)) {
+      *aValue = i;
+      break;
+    }
+  }
+  return NS_OK;
 }
 
 NS_IMETHODIMP
 nsHTMLTableRowElement::GetSectionRowIndex(PRInt32* aValue)
 {
   *aValue = -1;
-
   nsCOMPtr<nsIDOMHTMLTableSectionElement> section;
+  nsresult rv = GetSection(getter_AddRefs(section));
+  if (NS_FAILED(rv) || !section) {
+    return rv;
+  }
 
-  nsresult result = GetSection(getter_AddRefs(section));
+  nsCOMPtr<nsIDOMHTMLCollection> rows;
+  section->GetRows(getter_AddRefs(rows));
 
-  if (NS_SUCCEEDED(result) && section) {
-    nsCOMPtr<nsIDOMHTMLCollection> rows;
-
-    section->GetRows(getter_AddRefs(rows));
-
-    bool found = false;
-    PRUint32 numRows;
-
-    rows->GetLength(&numRows);
-
-    for (PRUint32 i = 0; (i < numRows) && !found; i++) {
-      nsCOMPtr<nsIDOMNode> node;
-      rows->Item(i, getter_AddRefs(node));
-
-      if (node.get() == static_cast<nsIDOMNode *>(this)) {
-        *aValue = i;
-        found = true;
-      }
-    } 
+  PRUint32 numRows;
+  rows->GetLength(&numRows);
+  for (PRUint32 i = 0; i < numRows; i++) {
+    if (rows->GetNodeAt(i) == static_cast<nsIContent*>(this)) {
+      *aValue = i;
+      break;
+    }
   }
 
   return NS_OK;
@@ -261,8 +240,6 @@ nsHTMLTableRowElement::GetCells(nsIDOMHTMLCollection** aValue)
                                nsnull,
                                kNameSpaceID_XHTML,
                                false);
-
-    NS_ENSURE_TRUE(mCells, NS_ERROR_OUT_OF_MEMORY);
   }
 
   NS_ADDREF(*aValue = mCells);
@@ -470,4 +447,3 @@ nsHTMLTableRowElement::GetAttributeMappingFunction() const
 {
   return &MapAttributesIntoRule;
 }
-
diff --git a/content/html/content/src/nsHTMLTableSectionElement.cpp b/content/html/content/src/nsHTMLTableSectionElement.cpp
index 9db75d737e1..32167d5a060 100644
--- a/content/html/content/src/nsHTMLTableSectionElement.cpp
+++ b/content/html/content/src/nsHTMLTableSectionElement.cpp
@@ -135,16 +135,12 @@ NS_IMPL_STRING_ATTR(nsHTMLTableSectionElement, ChOff, charoff)
 NS_IMETHODIMP
 nsHTMLTableSectionElement::GetRows(nsIDOMHTMLCollection** aValue)
 {
-  *aValue = nsnull;
-
   if (!mRows) {
     mRows = new nsContentList(this,
                               mNodeInfo->NamespaceID(),
                               nsGkAtoms::tr,
                               nsGkAtoms::tr,
                               false);
-
-    NS_ENSURE_TRUE(mRows, NS_ERROR_OUT_OF_MEMORY);
   }
 
   NS_ADDREF(*aValue = mRows);
diff --git a/content/html/content/src/nsHTMLTextAreaElement.cpp b/content/html/content/src/nsHTMLTextAreaElement.cpp
index fbfcee1a8c9..4191803122c 100644
--- a/content/html/content/src/nsHTMLTextAreaElement.cpp
+++ b/content/html/content/src/nsHTMLTextAreaElement.cpp
@@ -201,7 +201,7 @@ public:
 
   virtual bool IsHTMLFocusable(bool aWithMouse, bool *aIsFocusable, PRInt32 *aTabIndex);
 
-  virtual nsresult DoneAddingChildren(bool aHaveNotified);
+  virtual void DoneAddingChildren(bool aHaveNotified);
   virtual bool IsDoneAddingChildren();
 
   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
@@ -775,7 +775,7 @@ nsHTMLTextAreaElement::PostHandleEvent(nsEventChainPostVisitor& aVisitor)
   return NS_OK;
 }
 
-nsresult
+void
 nsHTMLTextAreaElement::DoneAddingChildren(bool aHaveNotified)
 {
   if (!mValueChanged) {
@@ -790,8 +790,6 @@ nsHTMLTextAreaElement::DoneAddingChildren(bool aHaveNotified)
   }
 
   mDoneAddingChildren = true;
-
-  return NS_OK;
 }
 
 bool
@@ -1037,8 +1035,6 @@ nsHTMLTextAreaElement::Reset()
 NS_IMETHODIMP
 nsHTMLTextAreaElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
 {
-  nsresult rv = NS_OK;
-
   // Disabled elements don't submit
   if (IsDisabled()) {
     return NS_OK;
@@ -1062,9 +1058,7 @@ nsHTMLTextAreaElement::SubmitNamesValues(nsFormSubmission* aFormSubmission)
   //
   // Submit
   //
-  rv = aFormSubmission->AddNameValuePair(name, value);
-
-  return rv;
+  return aFormSubmission->AddNameValuePair(name, value);
 }
 
 NS_IMETHODIMP
@@ -1086,8 +1080,8 @@ nsHTMLTextAreaElement::SaveState()
                nsLinebreakConverter::eLinebreakContent);
       NS_ASSERTION(NS_SUCCEEDED(rv), "Converting linebreaks failed!");
 
-      nsCOMPtr<nsISupportsString> pState
-        (do_CreateInstance(NS_SUPPORTS_STRING_CONTRACTID));
+      nsCOMPtr<nsISupportsString> pState =
+        do_CreateInstance(NS_SUPPORTS_STRING_CONTRACTID);
       if (!pState) {
         return NS_ERROR_OUT_OF_MEMORY;
       }
@@ -1309,7 +1303,7 @@ nsHTMLTextAreaElement::CopyInnerTo(nsGenericElement* aDest) const
 
   if (aDest->OwnerDoc()->IsStaticDocument()) {
     nsAutoString value;
-    const_cast<nsHTMLTextAreaElement*>(this)->GetValue(value);
+    GetValueInternal(value, true);
     static_cast<nsHTMLTextAreaElement*>(aDest)->SetValue(value);
   }
   return NS_OK;
@@ -1569,4 +1563,3 @@ nsHTMLTextAreaElement::FieldSetDisabledChanged(bool aNotify)
 
   nsGenericHTMLFormElement::FieldSetDisabledChanged(aNotify);
 }
-
diff --git a/content/html/content/src/nsHTMLTitleElement.cpp b/content/html/content/src/nsHTMLTitleElement.cpp
index b33fd0f97c1..65affa4d3d2 100644
--- a/content/html/content/src/nsHTMLTitleElement.cpp
+++ b/content/html/content/src/nsHTMLTitleElement.cpp
@@ -84,7 +84,7 @@ public:
   virtual void UnbindFromTree(bool aDeep = true,
                               bool aNullParent = true);
 
-  virtual nsresult DoneAddingChildren(bool aHaveNotified);
+  virtual void DoneAddingChildren(bool aHaveNotified);
 
   virtual nsXPCClassInfo* GetClassInfo();
 private:
@@ -200,13 +200,12 @@ nsHTMLTitleElement::UnbindFromTree(bool aDeep, bool aNullParent)
   nsGenericHTMLElement::UnbindFromTree(aDeep, aNullParent);
 }
 
-nsresult
+void
 nsHTMLTitleElement::DoneAddingChildren(bool aHaveNotified)
 {
   if (!aHaveNotified) {
     SendTitleChangeEvent(false);
   }
-  return NS_OK;
 }
 
 void
diff --git a/content/html/content/src/nsHTMLVideoElement.cpp b/content/html/content/src/nsHTMLVideoElement.cpp
index 35eebb6696f..95a126c927c 100644
--- a/content/html/content/src/nsHTMLVideoElement.cpp
+++ b/content/html/content/src/nsHTMLVideoElement.cpp
@@ -165,22 +165,22 @@ nsHTMLVideoElement::GetAttributeMappingFunction() const
 
 nsresult nsHTMLVideoElement::SetAcceptHeader(nsIHttpChannel* aChannel)
 {
-    nsCAutoString value(
+  nsCAutoString value(
 #ifdef MOZ_WEBM
-        "video/webm,"
+      "video/webm,"
 #endif
 #ifdef MOZ_OGG
-        "video/ogg,"
+      "video/ogg,"
 #endif
-        "video/*;q=0.9,"
+      "video/*;q=0.9,"
 #ifdef MOZ_OGG
-        "application/ogg;q=0.7,"
+      "application/ogg;q=0.7,"
 #endif
-        "audio/*;q=0.6,*/*;q=0.5");
+      "audio/*;q=0.6,*/*;q=0.5");
 
-    return aChannel->SetRequestHeader(NS_LITERAL_CSTRING("Accept"),
-                                      value,
-                                      false);
+  return aChannel->SetRequestHeader(NS_LITERAL_CSTRING("Accept"),
+                                    value,
+                                    false);
 }
 
 NS_IMPL_URI_ATTR(nsHTMLVideoElement, Poster, poster)
diff --git a/content/html/content/test/Makefile.in b/content/html/content/test/Makefile.in
index 4a30ab38ee3..fad5c540e4b 100644
--- a/content/html/content/test/Makefile.in
+++ b/content/html/content/test/Makefile.in
@@ -270,6 +270,7 @@ _TEST_FILES = \
 		test_bug664299.html \
 		test_bug666200.html \
 		test_bug666666.html \
+		test_bug669012.html \
 		test_bug674558.html \
 		test_bug583533.html \
 		test_restore_from_parser_fragment.html \
diff --git a/content/html/content/test/test_bug669012.html b/content/html/content/test/test_bug669012.html
new file mode 100644
index 00000000000..e6be933fafc
--- /dev/null
+++ b/content/html/content/test/test_bug669012.html
@@ -0,0 +1,45 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=669012
+-->
+<head>
+  <title>Test for Bug 669012</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=669012">Mozilla Bug 669012</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+<script>
+var run = 0;
+</script>
+<svg>
+<script>
+run++;
+ok(true, "Should run SVG script without attributes")
+</script>
+<script for=window event=onload>
+run++;
+ok(true, "Should run SVG script with for=window event=onload")
+</script>
+<script for=window event=foo>
+run++;
+ok(true, "Should run SVG script with for=window event=foo")
+</script>
+<script for=foo event=onload>
+run++;
+ok(true, "Should run SVG script with for=foo event=onload")
+</script>
+</svg>
+</div>
+<pre id="test">
+<script type="application/javascript">
+/** Test for Bug 669012 **/
+is(run, 4, "Should have run all tests")
+</script>
+</pre>
+</body>
+</html>
diff --git a/content/html/document/src/nsHTMLContentSink.cpp b/content/html/document/src/nsHTMLContentSink.cpp
index dc3e61d1ec6..82788a7173e 100644
--- a/content/html/document/src/nsHTMLContentSink.cpp
+++ b/content/html/document/src/nsHTMLContentSink.cpp
@@ -2800,20 +2800,18 @@ HTMLContentSink::ProcessSCRIPTEndTag(nsGenericHTMLElement *content,
   mHTMLDocument->ScriptLoading(sele);
 
   // Now tell the script that it's ready to go. This may execute the script
-  // or return NS_ERROR_HTMLPARSER_BLOCK. Or neither if the script doesn't
-  // need executing.
-  nsresult rv = content->DoneAddingChildren(true);
+  // or return true, or neither if the script doesn't need executing.
+  bool block = sele->AttemptToExecute();
 
   // If the act of insertion evaluated the script, we're fine.
   // Else, block the parser till the script has loaded.
-  if (rv == NS_ERROR_HTMLPARSER_BLOCK) {
+  if (block) {
     // If this append fails we'll never unblock the parser, but the UI will
     // still remain responsive. There are other ways to deal with this, but
     // the end result is always that the page gets botched, so there is no
     // real point in making it more complicated.
     mScriptElements.AppendObject(sele);
-  }
-  else {
+  } else {
     // This may have already happened if the script executed, but in case
     // it didn't then remove the element so that it doesn't get stuck forever.
     mHTMLDocument->ScriptExecuted(sele);
@@ -2822,10 +2820,10 @@ HTMLContentSink::ProcessSCRIPTEndTag(nsGenericHTMLElement *content,
   // If the parser got blocked, make sure to return the appropriate rv.
   // I'm not sure if this is actually needed or not.
   if (mParser && !mParser->IsParserEnabled()) {
-    rv = NS_ERROR_HTMLPARSER_BLOCK;
+    block = true;
   }
 
-  return rv;
+  return block ? NS_ERROR_HTMLPARSER_BLOCK : NS_OK;
 }
 
 // 3 ways to load a style sheet: inline, style src=, link tag
diff --git a/content/html/document/src/nsHTMLDocument.cpp b/content/html/document/src/nsHTMLDocument.cpp
index 79c8c3b1201..a2724be426d 100644
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -950,10 +950,8 @@ nsHTMLDocument::StartDocumentLoad(const char* aCommand,
 
   // Set the parser as the stream listener for the document loader...
   if (mParser) {
-    rv = mParser->GetStreamListener(aDocListener);
-    if (NS_FAILED(rv)) {
-      return rv;
-    }
+    nsCOMPtr<nsIStreamListener> listener = mParser->GetStreamListener();
+    listener.forget(aDocListener);
 
 #ifdef DEBUG_charset
     printf(" charset = %s source %d\n",
diff --git a/content/smil/crashtests/691337-1.svg b/content/smil/crashtests/691337-1.svg
new file mode 100644
index 00000000000..c341faa6b2f
--- /dev/null
+++ b/content/smil/crashtests/691337-1.svg
@@ -0,0 +1,8 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
+  <rect width="100" height="100" fill="blue">
+    <animate attributeName="fill"
+      begin="999999999999999999999999999999999999999999999999999999999999999999999999999999999"
+      dur="5s" from="blue" to="red" repeatCount="indefinite" additive="sum"/>
+  </rect>
+</svg>
diff --git a/content/smil/crashtests/691337-2.svg b/content/smil/crashtests/691337-2.svg
new file mode 100644
index 00000000000..f4408ae5ee6
--- /dev/null
+++ b/content/smil/crashtests/691337-2.svg
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
+  <rect width="100" height="100" fill="blue">
+    <animate attributeName="fill" id="a"
+      begin="4999999999999999" dur="5s" from="blue" to="red"
+      repeatCount="indefinite" additive="sum"/>
+    <animate attributeName="fill"
+      begin="a.begin+4999999999999999"
+      dur="5s" from="blue" to="red" repeatCount="indefinite" additive="sum"/>
+  </rect>
+</svg>
diff --git a/content/smil/crashtests/crashtests.list b/content/smil/crashtests/crashtests.list
index 17c458eb74d..3efd69b72c3 100644
--- a/content/smil/crashtests/crashtests.list
+++ b/content/smil/crashtests/crashtests.list
@@ -43,5 +43,7 @@ load 678822-1.svg
 load 678847-1.svg
 load 678938-1.svg
 load 690994-1.svg
+load 691337-1.svg
+load 691337-2.svg
 load 697640-1.svg
 load 699325-1.svg
diff --git a/content/smil/nsSMILParserUtils.cpp b/content/smil/nsSMILParserUtils.cpp
index 83a7c328db3..8e066c8edce 100644
--- a/content/smil/nsSMILParserUtils.cpp
+++ b/content/smil/nsSMILParserUtils.cpp
@@ -730,7 +730,6 @@ nsSMILParserUtils::ParseClockValue(const nsAString& aSpec,
   PRUint8 colonCount = 0;
 
   bool started = false;
-  bool isValid = true;
 
   PRInt32 metricMultiplicand = MSEC_PER_SEC;
 
@@ -759,16 +758,14 @@ nsSMILParserUtils::ParseClockValue(const nsAString& aSpec,
 
     } else if ((aFlags & kClockValueAllowSign)
                && (*start == '+' || *start == '-')) {
+      // check sign has not already been set
       if (sign != 0) {
-        // sign has already been set
-        isValid = false;
-        break;
+        return NS_ERROR_FAILURE;
       }
 
+      // check sign is not in middle of string
       if (started) {
-        // sign appears in the middle of the string
-        isValid = false;
-        break;
+        return NS_ERROR_FAILURE;
       }
 
       sign = (*start == '+') ? 1 : -1;
@@ -778,10 +775,8 @@ nsSMILParserUtils::ParseClockValue(const nsAString& aSpec,
       prevNumCouldBeMin = numCouldBeMin;
 
       if (!ParseClockComponent(start, end, component, numIsReal, numCouldBeMin,
-                               numCouldBeSec)) {
-        isValid = false;
-        break;
-      }
+                               numCouldBeSec))
+        return NS_ERROR_FAILURE;
 
       started = true;
     } else if (*start == ':') {
@@ -789,31 +784,27 @@ nsSMILParserUtils::ParseClockValue(const nsAString& aSpec,
 
       // Neither minutes nor hours can be reals
       if (numIsReal) {
-        isValid = false;
-        break;
+        return NS_ERROR_FAILURE;
       }
 
       // Clock value can't start with a ':'
       if (!started) {
-        isValid = false;
-        break;
+        return NS_ERROR_FAILURE;
       }
 
       // Can't have more than two colons
       if (colonCount > 2) {
-        isValid = false;
-        break;
+        return NS_ERROR_FAILURE;
       }
 
       // Multiply the offset by 60 and add the last accumulated component
-      offset = offset * 60 + PRInt64(component);
+      offset = offset * 60 + nsSMILTime(component);
 
       component = 0.0;
       ++start;
     } else if (NS_IS_ALPHA(*start)) {
       if (colonCount > 0) {
-        isValid = false;
-        break;
+        return NS_ERROR_FAILURE;
       }
 
       if ((aFlags & kClockValueAllowIndefinite)
@@ -828,68 +819,68 @@ nsSMILParserUtils::ParseClockValue(const nsAString& aSpec,
       } else if (aIsMedia && ConsumeSubstring(start, end, "media")) {
         *aIsMedia = true;
       } else if (!ParseMetricMultiplicand(start, end, metricMultiplicand)) {
-        isValid = false;
-        break;
+        return NS_ERROR_FAILURE;
       }
 
       // Nothing must come after the string except whitespace
       break;
     } else {
-      isValid = false;
-      break;
+      return NS_ERROR_FAILURE;
     }
   }
 
   if (!started) {
-    isValid = false;
+    return NS_ERROR_FAILURE;
   }
 
   // Process remainder of string (if any) to ensure it is only trailing
   // whitespace (embedded whitespace is not allowed)
   SkipBeginWsp(start, end);
   if (start != end) {
-    isValid = false;
+    return NS_ERROR_FAILURE;
   }
 
   // No more processing required if the value was "indefinite" or "media".
-  if (isIndefinite || (aIsMedia && *aIsMedia))
+  if (isIndefinite || (aIsMedia && *aIsMedia)) {
     return NS_OK;
+  }
 
   // If there is more than one colon then the previous component must be a
   // correctly formatted minute (i.e. two digits between 00 and 59) and the
   // latest component must be a correctly formatted second (i.e. two digits
   // before the .)
   if (colonCount > 0 && (!prevNumCouldBeMin || !numCouldBeSec)) {
-    isValid = false;
+    return NS_ERROR_FAILURE;
   }
 
-  if (isValid) {
-    // Tack on the last component
-    if (colonCount > 0) {
-      offset = offset * 60 * 1000;
-      component *= 1000;
-      // rounding
-      component = (component >= 0) ? component + 0.5 : component - 0.5;
-      offset += PRInt64(component);
-    } else {
-      component *= metricMultiplicand;
-      // rounding
-      component = (component >= 0) ? component + 0.5 : component - 0.5;
-      offset = PRInt64(component);
-    }
-
-    if (aResult) {
-      nsSMILTime millis = offset;
-
-      if (sign == -1) {
-        millis = -offset;
-      }
-
-      aResult->SetMillis(millis);
-    }
+  // Tack on the last component
+  if (colonCount > 0) {
+    offset = offset * 60 * 1000;
+    component *= 1000;
+    // rounding
+    component = (component >= 0) ? component + 0.5 : component - 0.5;
+    offset += nsSMILTime(component);
+  } else {
+    component *= metricMultiplicand;
+    // rounding
+    component = (component >= 0) ? component + 0.5 : component - 0.5;
+    offset = nsSMILTime(component);
   }
 
-  return (isValid) ? NS_OK : NS_ERROR_FAILURE;
+  // we haven't applied the sign yet so if the result is negative we must have
+  // overflowed
+  if (offset < 0) {
+    return NS_ERROR_FAILURE;
+  }
+
+  if (aResult) {
+    if (sign == -1) {
+      offset = -offset;
+    }
+    aResult->SetMillis(offset);
+  }
+
+  return NS_OK;
 }
 
 PRInt32
diff --git a/content/smil/nsSMILTimeValueSpec.cpp b/content/smil/nsSMILTimeValueSpec.cpp
index decbbdc76d9..a5df46d04cc 100644
--- a/content/smil/nsSMILTimeValueSpec.cpp
+++ b/content/smil/nsSMILTimeValueSpec.cpp
@@ -48,6 +48,7 @@
 #include "nsGUIEvent.h"
 #include "nsIDOMTimeEvent.h"
 #include "nsString.h"
+#include <limits>
 
 using namespace mozilla::dom;
 
@@ -182,8 +183,9 @@ nsSMILTimeValueSpec::HandleNewInterval(nsSMILInterval& aInterval,
     ConvertBetweenTimeContainers(baseInstance.Time(), aSrcContainer);
 
   // Apply offset
-  if (newTime.IsDefinite()) {
-    newTime.SetMillis(newTime.GetMillis() + mParams.mOffset.GetMillis());
+  if (!ApplyOffset(newTime)) {
+    NS_WARNING("New time overflows nsSMILTime, ignoring");
+    return;
   }
 
   // Create the instance time and register it with the interval
@@ -218,9 +220,9 @@ nsSMILTimeValueSpec::HandleChangedInstanceTime(
     ConvertBetweenTimeContainers(aBaseTime.Time(), aSrcContainer);
 
   // Apply offset
-  if (updatedTime.IsDefinite()) {
-    updatedTime.SetMillis(updatedTime.GetMillis() +
-                          mParams.mOffset.GetMillis());
+  if (!ApplyOffset(updatedTime)) {
+    NS_WARNING("Updated time overflows nsSMILTime, ignoring");
+    return;
   }
 
   // The timed element that owns the instance time does the updating so it can
@@ -339,7 +341,7 @@ nsSMILTimeValueSpec::RegisterEventListener(Element* aTarget)
   nsEventListenerManager* elm = GetEventListenerManager(aTarget);
   if (!elm)
     return;
-  
+
   elm->AddEventListenerByType(mEventListener,
                               nsDependentAtomString(mParams.mEventSymbol),
                               NS_EVENT_FLAG_BUBBLE |
@@ -407,7 +409,11 @@ nsSMILTimeValueSpec::HandleEvent(nsIDOMEvent* aEvent)
     return;
 
   nsSMILTime currentTime = container->GetCurrentTime();
-  nsSMILTimeValue newTime(currentTime + mParams.mOffset.GetMillis());
+  nsSMILTimeValue newTime(currentTime);
+  if (!ApplyOffset(newTime)) {
+    NS_WARNING("New time generated from event overflows nsSMILTime, ignoring");
+    return;
+  }
 
   nsRefPtr<nsSMILInstanceTime> newInstance =
     new nsSMILInstanceTime(newTime, nsSMILInstanceTime::SOURCE_EVENT);
@@ -535,3 +541,21 @@ nsSMILTimeValueSpec::ConvertBetweenTimeContainers(
 
   return dstContainer->ParentToContainerTime(docTime.GetMillis());
 }
+
+bool
+nsSMILTimeValueSpec::ApplyOffset(nsSMILTimeValue& aTime) const
+{
+  // indefinite + offset = indefinite. Likewise for unresolved times.
+  if (!aTime.IsDefinite()) {
+    return true;
+  }
+
+  double resultAsDouble =
+    (double)aTime.GetMillis() + mParams.mOffset.GetMillis();
+  if (resultAsDouble > std::numeric_limits<nsSMILTime>::max() ||
+      resultAsDouble < std::numeric_limits<nsSMILTime>::min()) {
+    return false;
+  }
+  aTime.SetMillis(aTime.GetMillis() + mParams.mOffset.GetMillis());
+  return true;
+}
diff --git a/content/smil/nsSMILTimeValueSpec.h b/content/smil/nsSMILTimeValueSpec.h
index 072046eb2f8..913ae75adee 100644
--- a/content/smil/nsSMILTimeValueSpec.h
+++ b/content/smil/nsSMILTimeValueSpec.h
@@ -102,6 +102,7 @@ protected:
   bool CheckAccessKeyEventDetail(nsIDOMEvent* aEvent);
   nsSMILTimeValue ConvertBetweenTimeContainers(const nsSMILTimeValue& aSrcTime,
                                       const nsSMILTimeContainer* aSrcContainer);
+  bool ApplyOffset(nsSMILTimeValue& aTime) const;
 
   nsSMILTimedElement*           mOwner;
   bool                          mIsBegin; // Indicates if *we* are a begin spec,
diff --git a/content/smil/nsSMILTimedElement.cpp b/content/smil/nsSMILTimedElement.cpp
index d564cf16c09..fefd6944c13 100644
--- a/content/smil/nsSMILTimedElement.cpp
+++ b/content/smil/nsSMILTimedElement.cpp
@@ -1888,9 +1888,9 @@ nsSMILTimedElement::ActiveTimeToSimpleTime(nsSMILTime aActiveTime,
 {
   nsSMILTime result;
 
-  NS_ASSERTION(mSimpleDur.IsResolved(),
+  NS_ABORT_IF_FALSE(mSimpleDur.IsResolved(),
       "Unresolved simple duration in ActiveTimeToSimpleTime");
-  NS_ASSERTION(aActiveTime >= 0, "Expecting non-negative active time");
+  NS_ABORT_IF_FALSE(aActiveTime >= 0, "Expecting non-negative active time");
   // Note that a negative aActiveTime will give us a negative value for
   // aRepeatIteration, which is bad because aRepeatIteration is unsigned
 
diff --git a/content/smil/test/test_smilDynamicDelayedBeginElement.xhtml b/content/smil/test/test_smilDynamicDelayedBeginElement.xhtml
index c454d39f7cd..cf72ea049ce 100644
--- a/content/smil/test/test_smilDynamicDelayedBeginElement.xhtml
+++ b/content/smil/test/test_smilDynamicDelayedBeginElement.xhtml
@@ -28,7 +28,15 @@ const INITIAL_VAL = "500px"
 const FROM_VAL = "20px";
 const TO_VAL   = "80px";
 
-// Helper function
+// Helper functions
+
+// This function allows 10ms to pass
+function allowTimeToPass() {
+  var initialDate = new Date();
+  while (new Date() - initialDate < 10) {}
+}
+
+// This function returns a newly created <animate> element for use in this test
 function createAnim() {
   var a = document.createElementNS('http://www.w3.org/2000/svg', 'animate');
   a.setAttribute('attributeName', 'width');
@@ -50,13 +58,18 @@ function main() {
 
   // In unpatched Firefox builds, we'll only trigger Bug 699143 if we insert
   // an animation and call beginElement() **after** the document start-time.
-  // Hence, we use executeSoon here to allow some time to pass.
+  // Hence, we use executeSoon here to allow some time to pass.  (And then
+  // we'll use a short busy-loop, for good measure.)
   SimpleTest.executeSoon(runTest);
 }
 
 function runTest() {
   var svg = SMILUtil.getSVGRoot();
 
+  // In case our executeSoon fired immediately, we force a very small amount
+  // of time to pass here, using a 10ms busy-loop.
+  allowTimeToPass();
+
   is(svg.getCurrentTime(), 0,
      "even though we've allowed time to pass, we shouldn't have bothered " +
      "updating the current time, since there aren't any animation elements");
diff --git a/content/svg/content/src/nsSVGScriptElement.cpp b/content/svg/content/src/nsSVGScriptElement.cpp
index ce314f2e049..3a54a32df54 100644
--- a/content/svg/content/src/nsSVGScriptElement.cpp
+++ b/content/svg/content/src/nsSVGScriptElement.cpp
@@ -94,8 +94,6 @@ public:
   virtual void DidChangeString(PRUint8 aAttrEnum);
 
   // nsIContent specializations:
-  virtual nsresult DoneAddingChildren(bool aHaveNotified);
-  virtual bool IsDoneAddingChildren();
   virtual nsresult BindToTree(nsIDocument* aDocument, nsIContent* aParent,
                               nsIContent* aBindingParent,
                               bool aCompileEventHandlers);
@@ -274,25 +272,6 @@ nsSVGScriptElement::GetStringInfo()
 //----------------------------------------------------------------------
 // nsIContent methods
 
-nsresult
-nsSVGScriptElement::DoneAddingChildren(bool aHaveNotified)
-{
-  mDoneAddingChildren = true;
-  nsresult rv = MaybeProcessScript();
-  if (!mAlreadyStarted) {
-    // Need to lose parser-insertedness here to allow another script to cause
-    // execution later.
-    LoseParserInsertedness();
-  }
-  return rv;
-}
-
-bool
-nsSVGScriptElement::IsDoneAddingChildren()
-{
-  return mDoneAddingChildren;
-}
-
 nsresult
 nsSVGScriptElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
                                nsIContent* aBindingParent,
diff --git a/content/svg/content/src/nsSVGTitleElement.cpp b/content/svg/content/src/nsSVGTitleElement.cpp
index 2bfd1673034..f1117b495fd 100644
--- a/content/svg/content/src/nsSVGTitleElement.cpp
+++ b/content/svg/content/src/nsSVGTitleElement.cpp
@@ -77,7 +77,7 @@ public:
   virtual void UnbindFromTree(bool aDeep = true,
                               bool aNullParent = true);
 
-  virtual nsresult DoneAddingChildren(bool aHaveNotified);
+  virtual void DoneAddingChildren(bool aHaveNotified);
 
   virtual nsXPCClassInfo* GetClassInfo();
 private:
@@ -180,13 +180,12 @@ nsSVGTitleElement::UnbindFromTree(bool aDeep, bool aNullParent)
   nsSVGTitleElementBase::UnbindFromTree(aDeep, aNullParent);
 }
 
-nsresult
+void
 nsSVGTitleElement::DoneAddingChildren(bool aHaveNotified)
 {
   if (!aHaveNotified) {
     SendTitleChangeEvent(false);
   }
-  return NS_OK;
 }
 
 void
diff --git a/content/xbl/src/nsXBLBinding.cpp b/content/xbl/src/nsXBLBinding.cpp
index 283d550a960..56cc1fc9023 100644
--- a/content/xbl/src/nsXBLBinding.cpp
+++ b/content/xbl/src/nsXBLBinding.cpp
@@ -1208,19 +1208,17 @@ nsresult
 nsXBLBinding::DoInitJSClass(JSContext *cx, JSObject *global, JSObject *obj,
                             const nsAFlatCString& aClassName,
                             nsXBLPrototypeBinding* aProtoBinding,
-                            void **aClassObject)
+                            JSObject** aClassObject)
 {
   // First ensure our JS class is initialized.
-  jsval val;
-  JSObject* proto = NULL;
-
   nsCAutoString className(aClassName);
   JSObject* parent_proto = nsnull;  // If we have an "obj" we can set this
   JSAutoRequest ar(cx);
 
   JSAutoEnterCompartment ac;
-  if (!ac.enter(cx, global))
-      return NS_ERROR_FAILURE;
+  if (!ac.enter(cx, global)) {
+    return NS_ERROR_FAILURE;
+  }
 
   if (obj) {
     // Retrieve the current prototype of obj.
@@ -1246,6 +1244,8 @@ nsXBLBinding::DoInitJSClass(JSContext *cx, JSObject *global, JSObject *obj,
     }
   }
 
+  jsval val;
+  JSObject* proto = NULL;
   if ((!::JS_LookupPropertyWithFlags(cx, global, className.get(),
                                      JSRESOLVE_CLASSNAME,
                                      &val)) ||
@@ -1336,7 +1336,7 @@ nsXBLBinding::DoInitJSClass(JSContext *cx, JSObject *global, JSObject *obj,
       return NS_ERROR_OUT_OF_MEMORY;
     }
 
-    *aClassObject = (void*)proto;
+    *aClassObject = proto;
   }
   else {
     proto = JSVAL_TO_OBJECT(val);
diff --git a/content/xbl/src/nsXBLBinding.h b/content/xbl/src/nsXBLBinding.h
index 4343364ed41..22cfbda6a11 100644
--- a/content/xbl/src/nsXBLBinding.h
+++ b/content/xbl/src/nsXBLBinding.h
@@ -146,7 +146,7 @@ public:
   static nsresult DoInitJSClass(JSContext *cx, JSObject *global, JSObject *obj,
                                 const nsAFlatCString& aClassName,
                                 nsXBLPrototypeBinding* aProtoBinding,
-                                void **aClassObject);
+                                JSObject** aClassObject);
 
   bool AllowScripts();  // XXX make const
 
diff --git a/content/xbl/src/nsXBLDocumentInfo.cpp b/content/xbl/src/nsXBLDocumentInfo.cpp
index 1ce7e7fc099..cf1e3009896 100644
--- a/content/xbl/src/nsXBLDocumentInfo.cpp
+++ b/content/xbl/src/nsXBLDocumentInfo.cpp
@@ -311,9 +311,7 @@ nsXBLDocGlobalObject::EnsureScriptEnvironment(PRUint32 aLangID)
   nsCOMPtr<nsIScriptRuntime> scriptRuntime;
   rv = NS_GetScriptRuntimeByID(aLangID, getter_AddRefs(scriptRuntime));
   NS_ENSURE_SUCCESS(rv, rv);
-  nsCOMPtr<nsIScriptContext> newCtx;
-  rv = scriptRuntime->CreateContext(getter_AddRefs(newCtx));
-  NS_ENSURE_SUCCESS(rv, rv);
+  nsCOMPtr<nsIScriptContext> newCtx = scriptRuntime->CreateContext();
   rv = SetScriptContext(aLangID, newCtx);
 
   JSContext *cx = mScriptContext->GetNativeContext();
diff --git a/content/xbl/src/nsXBLProtoImpl.cpp b/content/xbl/src/nsXBLProtoImpl.cpp
index 6dc7f0af9f7..c60ac7ed56b 100644
--- a/content/xbl/src/nsXBLProtoImpl.cpp
+++ b/content/xbl/src/nsXBLProtoImpl.cpp
@@ -95,7 +95,7 @@ nsXBLProtoImpl::InstallImplementation(nsXBLPrototypeBinding* aBinding, nsIConten
   // This function also has the side effect of building up the prototype implementation if it has
   // not been built already.
   nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
-  void * targetClassObject = nsnull;
+  JSObject* targetClassObject = nsnull;
   nsresult rv = InitTargetObjects(aBinding, context, aBoundElement,
                                   getter_AddRefs(holder), &targetClassObject);
   NS_ENSURE_SUCCESS(rv, rv); // kick out if we were unable to properly intialize our target objects
@@ -122,7 +122,7 @@ nsXBLProtoImpl::InitTargetObjects(nsXBLPrototypeBinding* aBinding,
                                   nsIScriptContext* aContext, 
                                   nsIContent* aBoundElement, 
                                   nsIXPConnectJSObjectHolder** aScriptObjectHolder, 
-                                  void** aTargetClassObject)
+                                  JSObject** aTargetClassObject)
 {
   nsresult rv = NS_OK;
   *aScriptObjectHolder = nsnull;
@@ -161,8 +161,9 @@ nsXBLProtoImpl::InitTargetObjects(nsXBLPrototypeBinding* aBinding,
   // object's old base class becomes the new class' base class.
   rv = aBinding->InitClass(mClassName, jscontext, global, JSVAL_TO_OBJECT(v),
                            aTargetClassObject);
-  if (NS_FAILED(rv))
+  if (NS_FAILED(rv)) {
     return rv;
+  }
 
   nsContentUtils::PreserveWrapper(aBoundElement, aBoundElement);
 
@@ -189,13 +190,13 @@ nsXBLProtoImpl::CompilePrototypeMembers(nsXBLPrototypeBinding* aBinding)
   JSObject *global = globalObject->GetGlobalJSObject();
   
 
-  void* classObject;
+  JSObject* classObject;
   nsresult rv = aBinding->InitClass(mClassName, cx, global, global,
                                     &classObject);
   if (NS_FAILED(rv))
     return rv;
 
-  mClassObject = (JSObject*) classObject;
+  mClassObject = classObject;
   if (!mClassObject)
     return NS_ERROR_FAILURE;
 
@@ -307,15 +308,15 @@ nsXBLProtoImpl::Read(nsIScriptContext* aContext,
                      nsIScriptGlobalObject* aGlobal)
 {
   // Set up a class object first so that deserialization is possible
-  JSContext *cx = static_cast<JSContext *>(aContext->GetNativeContext());
+  JSContext *cx = aContext->GetNativeContext();
   JSObject *global = aGlobal->GetGlobalJSObject();
 
-  void* classObject;
+  JSObject* classObject;
   nsresult rv = aBinding->InitClass(mClassName, cx, global, global, &classObject);
   NS_ENSURE_SUCCESS(rv, rv);
   NS_ENSURE_TRUE(classObject, NS_ERROR_FAILURE);
 
-  mClassObject = (JSObject*) classObject;
+  mClassObject = classObject;
 
   nsXBLProtoImplField* previousField = nsnull;
   nsXBLProtoImplMember* previousMember = nsnull;
diff --git a/content/xbl/src/nsXBLProtoImpl.h b/content/xbl/src/nsXBLProtoImpl.h
index 0389979ca9d..a0b14e616ac 100644
--- a/content/xbl/src/nsXBLProtoImpl.h
+++ b/content/xbl/src/nsXBLProtoImpl.h
@@ -73,7 +73,7 @@ public:
   nsresult InitTargetObjects(nsXBLPrototypeBinding* aBinding, nsIScriptContext* aContext, 
                              nsIContent* aBoundElement, 
                              nsIXPConnectJSObjectHolder** aScriptObjectHolder,
-                             void** aTargetClassObject);
+                             JSObject** aTargetClassObject);
   nsresult CompilePrototypeMembers(nsXBLPrototypeBinding* aBinding);
 
   void SetMemberList(nsXBLProtoImplMember* aMemberList)
@@ -131,8 +131,8 @@ public:
   nsCString mClassName; // The name of the class. 
 
 protected:
-  void* mClassObject;   // The class object for the binding. We'll use this to pre-compile properties 
-                        // and methods for the binding.
+  JSObject* mClassObject; // The class object for the binding. We'll use this to pre-compile properties
+                          // and methods for the binding.
 
   nsXBLProtoImplMember* mMembers; // The members of an implementation are chained in this singly-linked list.
 
diff --git a/content/xbl/src/nsXBLProtoImplField.cpp b/content/xbl/src/nsXBLProtoImplField.cpp
index 74f7e432d9e..845ae58c827 100644
--- a/content/xbl/src/nsXBLProtoImplField.cpp
+++ b/content/xbl/src/nsXBLProtoImplField.cpp
@@ -148,9 +148,10 @@ nsXBLProtoImplField::InstallField(nsIScriptContext* aContext,
                                         aBoundNode,
                                         aPrincipal, uriSpec.get(),
                                         mLineNumber, JSVERSION_LATEST,
-                                        (void*) &result, &undefined);
-  if (NS_FAILED(rv))
+                                        &result, &undefined);
+  if (NS_FAILED(rv)) {
     return rv;
+  }
 
   if (undefined) {
     result = JSVAL_VOID;
diff --git a/content/xbl/src/nsXBLProtoImplMethod.cpp b/content/xbl/src/nsXBLProtoImplMethod.cpp
index b76cd3bd2dd..d331e3c5c5f 100644
--- a/content/xbl/src/nsXBLProtoImplMethod.cpp
+++ b/content/xbl/src/nsXBLProtoImplMethod.cpp
@@ -272,9 +272,7 @@ nsresult
 nsXBLProtoImplMethod::Read(nsIScriptContext* aContext,
                            nsIObjectInputStream* aStream)
 {
-  void* methodCode;
-  nsresult rv = XBL_DeserializeFunction(aContext, aStream, this, &methodCode);
-  mJSMethodObject = (JSObject *)methodCode;
+  nsresult rv = XBL_DeserializeFunction(aContext, aStream, &mJSMethodObject);
   if (NS_FAILED(rv)) {
     SetUncompiledMethod(nsnull);
     return rv;
diff --git a/content/xbl/src/nsXBLProtoImplMethod.h b/content/xbl/src/nsXBLProtoImplMethod.h
index bf6cc8ad488..240150b453b 100644
--- a/content/xbl/src/nsXBLProtoImplMethod.h
+++ b/content/xbl/src/nsXBLProtoImplMethod.h
@@ -180,6 +180,7 @@ public:
     return NS_OK;
   }
 
+  using nsXBLProtoImplMethod::Write;
   nsresult Write(nsIScriptContext* aContext,
                  nsIObjectOutputStream* aStream,
                  XBLBindingSerializeDetails aType);
diff --git a/content/xbl/src/nsXBLProtoImplProperty.cpp b/content/xbl/src/nsXBLProtoImplProperty.cpp
index 2cea12ef94e..9d4aab2aef8 100644
--- a/content/xbl/src/nsXBLProtoImplProperty.cpp
+++ b/content/xbl/src/nsXBLProtoImplProperty.cpp
@@ -360,24 +360,23 @@ nsXBLProtoImplProperty::Read(nsIScriptContext* aContext,
                              nsIObjectInputStream* aStream,
                              XBLBindingSerializeDetails aType)
 {
-  nsresult rv;
-  void* scriptObject;
-
   if (aType == XBLBinding_Serialize_GetterProperty ||
       aType == XBLBinding_Serialize_GetterSetterProperty) {
-    rv = XBL_DeserializeFunction(aContext, aStream, this, &scriptObject);
+    JSObject* getterObject;
+    nsresult rv = XBL_DeserializeFunction(aContext, aStream, &getterObject);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    mJSGetterObject = (JSObject *)scriptObject;
+    mJSGetterObject = getterObject;
     mJSAttributes |= JSPROP_GETTER | JSPROP_SHARED;
   }
 
   if (aType == XBLBinding_Serialize_SetterProperty ||
       aType == XBLBinding_Serialize_GetterSetterProperty) {
-    rv = XBL_DeserializeFunction(aContext, aStream, this, &scriptObject);
+    JSObject* setterObject;
+    nsresult rv = XBL_DeserializeFunction(aContext, aStream, &setterObject);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    mJSSetterObject = (JSObject *)scriptObject;
+    mJSSetterObject = setterObject;
     mJSAttributes |= JSPROP_SETTER | JSPROP_SHARED;
   }
 
diff --git a/content/xbl/src/nsXBLPrototypeBinding.cpp b/content/xbl/src/nsXBLPrototypeBinding.cpp
index e709e59a6ee..57b5a015f4f 100644
--- a/content/xbl/src/nsXBLPrototypeBinding.cpp
+++ b/content/xbl/src/nsXBLPrototypeBinding.cpp
@@ -78,12 +78,11 @@
 #include "nsXBLResourceLoader.h"
 #include "mozilla/dom/Element.h"
 
-using namespace mozilla;
-
 #ifdef MOZ_XUL
 #include "nsXULElement.h"
 #endif
 
+using namespace mozilla;
 using namespace mozilla::dom;
 
 // Helper Classes =====================================================================
@@ -869,7 +868,7 @@ nsresult
 nsXBLPrototypeBinding::InitClass(const nsCString& aClassName,
                                  JSContext * aContext, JSObject * aGlobal,
                                  JSObject * aScriptObject,
-                                 void ** aClassObject)
+                                 JSObject** aClassObject)
 {
   NS_ENSURE_ARG_POINTER(aClassObject); 
 
@@ -1904,9 +1903,7 @@ nsXBLPrototypeBinding::ReadContentNode(nsIObjectInputStream* aStream,
   }
   else {
 #endif
-    nsCOMPtr<nsINodeInfo> ni = nodeInfo;
-    NS_NewElement(getter_AddRefs(content), nodeInfo->NamespaceID(),
-                  ni.forget(), mozilla::dom::NOT_FROM_PARSER);
+    NS_NewElement(getter_AddRefs(content), nodeInfo.forget(), NOT_FROM_PARSER);
 
     for (PRUint32 i = 0; i < attrCount; i++) {
       rv = ReadNamespace(aStream, namespaceID);
diff --git a/content/xbl/src/nsXBLPrototypeBinding.h b/content/xbl/src/nsXBLPrototypeBinding.h
index 7ec080a3ddd..ec108fbf0cc 100644
--- a/content/xbl/src/nsXBLPrototypeBinding.h
+++ b/content/xbl/src/nsXBLPrototypeBinding.h
@@ -155,7 +155,7 @@ public:
 
   nsresult InitClass(const nsCString& aClassName, JSContext * aContext,
                      JSObject * aGlobal, JSObject * aScriptObject,
-                     void ** aClassObject);
+                     JSObject** aClassObject);
 
   nsresult ConstructInterfaceTable(const nsAString& aImpls);
   
diff --git a/content/xbl/src/nsXBLSerialize.cpp b/content/xbl/src/nsXBLSerialize.cpp
index bba6a7091b6..d453cbee6f8 100644
--- a/content/xbl/src/nsXBLSerialize.cpp
+++ b/content/xbl/src/nsXBLSerialize.cpp
@@ -15,7 +15,7 @@
  * The Original Code is mozilla.org code.
  *
  * The Initial Developer of the Original Code is
- *   Mozilla Corporation.
+ * the Mozilla Foundation.
  * Portions created by the Initial Developer are Copyright (C) 2011
  * the Initial Developer. All Rights Reserved.
  *
@@ -45,23 +45,20 @@ XBL_SerializeFunction(nsIScriptContext* aContext,
                       nsIObjectOutputStream* aStream,
                       JSObject* aFunctionObject)
 {
-  nsresult rv;
-
-  JSContext* cx = (JSContext*) aContext->GetNativeContext();
+  JSContext* cx = aContext->GetNativeContext();
   JSXDRState *xdr = ::JS_XDRNewMem(cx, JSXDR_ENCODE);
   if (!xdr)
     return NS_ERROR_OUT_OF_MEMORY;
-  xdr->userdata = (void*) aStream;
-
-  jsval funval = OBJECT_TO_JSVAL(aFunctionObject);
+  xdr->userdata = static_cast<void*>(aStream);
 
   JSAutoRequest ar(cx);
-  if (! ::JS_XDRFunctionObject(xdr, &aFunctionObject)) {
+  nsresult rv;
+  if (!JS_XDRFunctionObject(xdr, &aFunctionObject)) {
     rv = NS_ERROR_FAILURE;
   } else {
     uint32 size;
     const char* data = reinterpret_cast<const char*>
-                                         (::JS_XDRMemGetData(xdr, &size));
+                                       (JS_XDRMemGetData(xdr, &size));
     NS_ASSERTION(data, "no decoded JSXDRState data!");
 
     rv = aStream->Write32(size);
@@ -69,7 +66,7 @@ XBL_SerializeFunction(nsIScriptContext* aContext,
       rv = aStream->WriteBytes(data, size);
   }
 
-  ::JS_XDRDestroy(xdr);
+  JS_XDRDestroy(xdr);
 
   return rv;
 }
@@ -78,12 +75,9 @@ XBL_SerializeFunction(nsIScriptContext* aContext,
 nsresult
 XBL_DeserializeFunction(nsIScriptContext* aContext,
                         nsIObjectInputStream* aStream,
-                        void* aHolder,
-                        void **aScriptObject)
+                        JSObject** aFunctionObject)
 {
-  *aScriptObject = nsnull;
-
-  JSObject* functionObject = nsnull;
+  *aFunctionObject = nsnull;
 
   PRUint32 size;
   nsresult rv = aStream->Read32(&size);
@@ -95,29 +89,26 @@ XBL_DeserializeFunction(nsIScriptContext* aContext,
   if (NS_FAILED(rv))
     return rv;
 
-  JSContext* cx = (JSContext*) aContext->GetNativeContext();
-  JSXDRState *xdr = ::JS_XDRNewMem(cx, JSXDR_DECODE);
+  JSContext* cx = aContext->GetNativeContext();
+  JSXDRState *xdr = JS_XDRNewMem(cx, JSXDR_DECODE);
   if (!xdr) {
     rv = NS_ERROR_OUT_OF_MEMORY;
   } else {
-    xdr->userdata = (void*) aStream;
+    xdr->userdata = static_cast<void*>(aStream);
     JSAutoRequest ar(cx);
-    ::JS_XDRMemSetData(xdr, data, size);
+    JS_XDRMemSetData(xdr, data, size);
 
-    if (! ::JS_XDRFunctionObject(xdr, &functionObject)) {
+    if (!JS_XDRFunctionObject(xdr, aFunctionObject)) {
       rv = NS_ERROR_FAILURE;
     }
 
     uint32 junk;
-    data = (char*) ::JS_XDRMemGetData(xdr, &junk);
-    ::JS_XDRMemSetData(xdr, NULL, 0);
-    ::JS_XDRDestroy(xdr);
+    data = static_cast<char*>(JS_XDRMemGetData(xdr, &junk));
+    JS_XDRMemSetData(xdr, NULL, 0);
+    JS_XDRDestroy(xdr);
   }
 
   nsMemory::Free(data);
   NS_ENSURE_SUCCESS(rv, rv);
-
-  *aScriptObject = functionObject;
-
   return rv;
 }
diff --git a/content/xbl/src/nsXBLSerialize.h b/content/xbl/src/nsXBLSerialize.h
index ca4f7b11afa..9e32252ad95 100644
--- a/content/xbl/src/nsXBLSerialize.h
+++ b/content/xbl/src/nsXBLSerialize.h
@@ -15,7 +15,7 @@
  * The Original Code is mozilla.org code.
  *
  * The Initial Developer of the Original Code is
- *   Mozilla Corporation.
+ * the Mozilla Foundation.
  * Portions created by the Initial Developer are Copyright (C) 2011
  * the Initial Developer. All Rights Reserved.
  *
@@ -113,7 +113,6 @@ XBL_SerializeFunction(nsIScriptContext* aContext,
 nsresult
 XBL_DeserializeFunction(nsIScriptContext* aContext,
                         nsIObjectInputStream* aStream,
-                        void* aHolder,
-                        void **aScriptObject);
+                        JSObject** aFunctionObject);
 
 #endif // nsXBLSerialize_h__
diff --git a/content/xml/document/src/nsXMLContentSink.cpp b/content/xml/document/src/nsXMLContentSink.cpp
index 526560e7f04..c5af9edc15e 100644
--- a/content/xml/document/src/nsXMLContentSink.cpp
+++ b/content/xml/document/src/nsXMLContentSink.cpp
@@ -497,8 +497,7 @@ nsXMLContentSink::CreateElement(const PRUnichar** aAtts, PRUint32 aAttsCount,
 
   nsCOMPtr<nsINodeInfo> ni = aNodeInfo;
   nsCOMPtr<nsIContent> content;
-  rv = NS_NewElement(getter_AddRefs(content), aNodeInfo->NamespaceID(),
-                     ni.forget(), aFromParser);
+  rv = NS_NewElement(getter_AddRefs(content), ni.forget(), aFromParser);
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (aNodeInfo->Equals(nsGkAtoms::script, kNameSpaceID_XHTML)
@@ -586,29 +585,24 @@ nsXMLContentSink::CloseElement(nsIContent* aContent)
     return NS_OK;
   }
 
-  nsresult rv = NS_OK;
-
   if (nodeInfo->Equals(nsGkAtoms::script, kNameSpaceID_XHTML)
       || nodeInfo->Equals(nsGkAtoms::script, kNameSpaceID_SVG)
     ) {
     mConstrainSize = true; 
+    nsCOMPtr<nsIScriptElement> sele = do_QueryInterface(aContent);
 
     if (mPreventScriptExecution) {
-      nsCOMPtr<nsIScriptElement> sele = do_QueryInterface(aContent);
-      NS_ASSERTION(sele, "script did QI correctly!");
       sele->PreventExecution();
-      return rv;
+      return NS_OK;
     }
 
     // Now tell the script that it's ready to go. This may execute the script
-    // or return NS_ERROR_HTMLPARSER_BLOCK. Or neither if the script doesn't
-    // need executing.
-    rv = aContent->DoneAddingChildren(true);
+    // or return true, or neither if the script doesn't need executing.
+    bool block = sele->AttemptToExecute();
 
     // If the act of insertion evaluated the script, we're fine.
     // Else, block the parser till the script has loaded.
-    if (rv == NS_ERROR_HTMLPARSER_BLOCK) {
-      nsCOMPtr<nsIScriptElement> sele = do_QueryInterface(aContent);
+    if (block) {
       mScriptElements.AppendObject(sele);
     }
 
@@ -617,12 +611,13 @@ nsXMLContentSink::CloseElement(nsIContent* aContent)
     if (mParser && !mParser->IsParserEnabled()) {
       // XXX The HTML sink doesn't call BlockParser here, why do we?
       mParser->BlockParser();
-      rv = NS_ERROR_HTMLPARSER_BLOCK;
+      block = true;
     }
 
-    return rv;
+    return block ? NS_ERROR_HTMLPARSER_BLOCK : NS_OK;
   }
   
+  nsresult rv = NS_OK;
   if (nodeInfo->Equals(nsGkAtoms::meta, kNameSpaceID_XHTML) &&
            // Need to check here to make sure this meta tag does not set
            // mPrettyPrintXML to false when we have a special root!
diff --git a/content/xslt/src/xslt/txMozillaXMLOutput.cpp b/content/xslt/src/xslt/txMozillaXMLOutput.cpp
index 3ed62757b50..1755e5ef672 100644
--- a/content/xslt/src/xslt/txMozillaXMLOutput.cpp
+++ b/content/xslt/src/xslt/txMozillaXMLOutput.cpp
@@ -63,6 +63,7 @@
 #include "nsIStyleSheetLinkingElement.h"
 #include "nsIDocumentTransformer.h"
 #include "mozilla/css/Loader.h"
+#include "mozilla/dom/Element.h"
 #include "nsICharsetAlias.h"
 #include "nsIHTMLContentSink.h"
 #include "nsContentUtils.h"
@@ -303,9 +304,7 @@ txMozillaXMLOutput::endElement()
     NS_ASSERTION(mCurrentNode->IsElement(), "borked mCurrentNode");
     NS_ENSURE_TRUE(mCurrentNode->IsElement(), NS_ERROR_UNEXPECTED);
 
-    nsIContent* element = static_cast<nsIContent*>
-                                     (static_cast<nsINode*>
-                                                 (mCurrentNode));
+    Element* element = mCurrentNode->AsElement();
 
     // Handle html-elements
     if (!mNoFixup) {
@@ -318,21 +317,21 @@ txMozillaXMLOutput::endElement()
         PRInt32 ns = element->GetNameSpaceID();
         nsIAtom* localName = element->Tag();
 
-        if ((ns == kNameSpaceID_XHTML && (localName == nsGkAtoms::script ||
-                                          localName == nsGkAtoms::title ||
+        if ((ns == kNameSpaceID_XHTML && (localName == nsGkAtoms::title ||
                                           localName == nsGkAtoms::object ||
                                           localName == nsGkAtoms::applet ||
                                           localName == nsGkAtoms::select ||
                                           localName == nsGkAtoms::textarea)) ||
-            (ns == kNameSpaceID_SVG && (localName == nsGkAtoms::script ||
-                                        localName == nsGkAtoms::title))) {
-
-            rv = element->DoneAddingChildren(true);
-
+            (ns == kNameSpaceID_SVG && localName == nsGkAtoms::title)) {
+            element->DoneAddingChildren(true);
+        } else if ((ns == kNameSpaceID_XHTML || ns == kNameSpaceID_SVG) &&
+                   localName == nsGkAtoms::script) {
+            nsCOMPtr<nsIScriptElement> sele = do_QueryInterface(element);
+            NS_ABORT_IF_FALSE(sele, "script elements need to implement nsIScriptElement");
+            bool block = sele->AttemptToExecute();
             // If the act of insertion evaluated the script, we're fine.
             // Else, add this script element to the array of loading scripts.
-            if (rv == NS_ERROR_HTMLPARSER_BLOCK) {
-                nsCOMPtr<nsIScriptElement> sele = do_QueryInterface(element);
+            if (block) {
                 rv = mNotifier->AddScriptElement(sele);
                 NS_ENSURE_SUCCESS(rv, rv);
             }
@@ -556,12 +555,12 @@ txMozillaXMLOutput::startElementInternal(nsIAtom* aPrefix,
     mOpenedElementIsHTML = false;
 
     // Create the element
-    nsCOMPtr<nsINodeInfo> ni;
-    ni = mNodeInfoManager->GetNodeInfo(aLocalName, aPrefix, aNsID,
-                                       nsIDOMNode::ELEMENT_NODE);
+    nsCOMPtr<nsINodeInfo> ni =
+        mNodeInfoManager->GetNodeInfo(aLocalName, aPrefix, aNsID,
+                                      nsIDOMNode::ELEMENT_NODE);
     NS_ENSURE_TRUE(ni, NS_ERROR_OUT_OF_MEMORY);
 
-    NS_NewElement(getter_AddRefs(mOpenedElement), aNsID, ni.forget(),
+    NS_NewElement(getter_AddRefs(mOpenedElement), ni.forget(),
                   mCreatingNewDocument ?
                   FROM_PARSER_XSLT : FROM_PARSER_FRAGMENT);
 
diff --git a/content/xtf/src/nsXTFElementWrapper.cpp b/content/xtf/src/nsXTFElementWrapper.cpp
index c7613849ab1..38285d28521 100644
--- a/content/xtf/src/nsXTFElementWrapper.cpp
+++ b/content/xtf/src/nsXTFElementWrapper.cpp
@@ -518,13 +518,11 @@ nsXTFElementWrapper::BeginAddingChildren()
     GetXTFElement()->BeginAddingChildren();
 }
 
-nsresult
+void
 nsXTFElementWrapper::DoneAddingChildren(bool aHaveNotified)
 {
   if (mNotificationMask & nsIXTFElement::NOTIFY_DONE_ADDING_CHILDREN)
     GetXTFElement()->DoneAddingChildren();
-
-  return NS_OK;
 }
 
 already_AddRefed<nsINodeInfo>
diff --git a/content/xtf/src/nsXTFElementWrapper.h b/content/xtf/src/nsXTFElementWrapper.h
index 3d2a1e4c09c..0d1c44b330d 100644
--- a/content/xtf/src/nsXTFElementWrapper.h
+++ b/content/xtf/src/nsXTFElementWrapper.h
@@ -111,7 +111,7 @@ public:
   virtual nsEventStates IntrinsicState() const;
 
   virtual void BeginAddingChildren();
-  virtual nsresult DoneAddingChildren(bool aHaveNotified);
+  virtual void DoneAddingChildren(bool aHaveNotified);
 
   virtual nsIAtom *GetClassAttributeName() const;
   virtual const nsAttrValue* DoGetClasses() const;
diff --git a/content/xul/content/src/nsXULContextMenuBuilder.cpp b/content/xul/content/src/nsXULContextMenuBuilder.cpp
index 4df7292b1f1..cdb4202fef1 100644
--- a/content/xul/content/src/nsXULContextMenuBuilder.cpp
+++ b/content/xul/content/src/nsXULContextMenuBuilder.cpp
@@ -39,6 +39,8 @@
 #include "nsIDOMHTMLMenuItemElement.h"
 #include "nsXULContextMenuBuilder.h"
 
+using namespace mozilla;
+using namespace mozilla::dom;
 
 nsXULContextMenuBuilder::nsXULContextMenuBuilder()
   : mCurrentGeneratedItemId(0)
@@ -247,8 +249,7 @@ nsXULContextMenuBuilder::CreateElement(nsIAtom* aTag,
     aTag, nsnull, kNameSpaceID_XUL, nsIDOMNode::ELEMENT_NODE);
   NS_ENSURE_TRUE(nodeInfo, NS_ERROR_OUT_OF_MEMORY);
 
-  nsresult rv = NS_NewElement(aResult, kNameSpaceID_XUL, nodeInfo.forget(),
-                              mozilla::dom::NOT_FROM_PARSER);
+  nsresult rv = NS_NewElement(aResult, nodeInfo.forget(), NOT_FROM_PARSER);
   if (NS_FAILED(rv)) {
     return rv;
   }
diff --git a/content/xul/content/src/nsXULElement.cpp b/content/xul/content/src/nsXULElement.cpp
index b0329c7c1c4..c5b3e3d5c23 100644
--- a/content/xul/content/src/nsXULElement.cpp
+++ b/content/xul/content/src/nsXULElement.cpp
@@ -3141,7 +3141,6 @@ nsXULPrototypeScript::Compile(const PRUnichar* aText,
     nsScriptObjectHolder newScriptObject(context);
     rv = context->CompileScript(aText,
                                 aTextLength,
-                                nsnull,
                                 // Use the enclosing document's principal
                                 // XXX is this right? or should we use the
                                 // protodoc's?
diff --git a/content/xul/document/src/nsXULDocument.cpp b/content/xul/document/src/nsXULDocument.cpp
index fe6846cd10c..4175a4bed35 100644
--- a/content/xul/document/src/nsXULDocument.cpp
+++ b/content/xul/document/src/nsXULDocument.cpp
@@ -3703,9 +3703,8 @@ nsXULDocument::CreateElementFromPrototype(nsXULPrototypeElement* aPrototype,
                                                     nsIDOMNode::ELEMENT_NODE);
         if (!newNodeInfo) return NS_ERROR_OUT_OF_MEMORY;
         nsCOMPtr<nsIContent> content;
-        PRInt32 ns = newNodeInfo->NamespaceID();
         nsCOMPtr<nsINodeInfo> xtfNi = newNodeInfo;
-        rv = NS_NewElement(getter_AddRefs(content), ns, newNodeInfo.forget(),
+        rv = NS_NewElement(getter_AddRefs(content), newNodeInfo.forget(),
                            NOT_FROM_PARSER);
         if (NS_FAILED(rv))
             return rv;
diff --git a/content/xul/document/src/nsXULPrototypeDocument.cpp b/content/xul/document/src/nsXULPrototypeDocument.cpp
index e9bdf05f794..0077608e99d 100644
--- a/content/xul/document/src/nsXULPrototypeDocument.cpp
+++ b/content/xul/document/src/nsXULPrototypeDocument.cpp
@@ -723,8 +723,7 @@ nsXULPDGlobalObject::EnsureScriptEnvironment(PRUint32 lang_id)
                                         getter_AddRefs(languageRuntime));
   NS_ENSURE_SUCCESS(rv, NS_OK);
 
-  nsCOMPtr<nsIScriptContext> ctxNew;
-  rv = languageRuntime->CreateContext(getter_AddRefs(ctxNew));
+  nsCOMPtr<nsIScriptContext> ctxNew = languageRuntime->CreateContext();
   // We have to setup a special global object.  We do this then
   // attach it as the global for this context.  Then, ::SetScriptContext
   // will re-fetch the global and set it up in our language globals array.
diff --git a/content/xul/templates/src/nsXULContentBuilder.cpp b/content/xul/templates/src/nsXULContentBuilder.cpp
index 88f23be62a5..d158b50e5a4 100644
--- a/content/xul/templates/src/nsXULContentBuilder.cpp
+++ b/content/xul/templates/src/nsXULContentBuilder.cpp
@@ -1399,20 +1399,17 @@ nsXULContentBuilder::CreateElement(PRInt32 aNameSpaceID,
     if (! doc)
         return NS_ERROR_NOT_INITIALIZED;
 
-    nsresult rv;
     nsCOMPtr<nsIContent> result;
+    nsCOMPtr<nsINodeInfo> nodeInfo =
+        doc->NodeInfoManager()->GetNodeInfo(aTag, nsnull, aNameSpaceID,
+                                            nsIDOMNode::ELEMENT_NODE);
 
-    nsCOMPtr<nsINodeInfo> nodeInfo;
-    nodeInfo = doc->NodeInfoManager()->GetNodeInfo(aTag, nsnull, aNameSpaceID,
-                                                   nsIDOMNode::ELEMENT_NODE);
-
-    rv = NS_NewElement(getter_AddRefs(result), aNameSpaceID, nodeInfo.forget(),
-                       NOT_FROM_PARSER);
+    nsresult rv = NS_NewElement(getter_AddRefs(result), nodeInfo.forget(),
+                                NOT_FROM_PARSER);
     if (NS_FAILED(rv))
         return rv;
 
-    *aResult = result;
-    NS_ADDREF(*aResult);
+    result.forget(aResult);
     return NS_OK;
 }
 
diff --git a/docshell/base/Makefile.in b/docshell/base/Makefile.in
index d986b30a4d4..497d47b1263 100644
--- a/docshell/base/Makefile.in
+++ b/docshell/base/Makefile.in
@@ -119,6 +119,5 @@ LOCAL_INCLUDES += \
   -I$(srcdir)/../shistory/src \
   -I$(topsrcdir)/dom/base \
   -I$(topsrcdir)/layout/base \
-  -I$(topsrcdir)/js/xpconnect/src \
   -I$(topsrcdir)/xpcom/ds \
   $(NULL)
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 647c7187708..1c0c6e3a353 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -665,6 +665,11 @@ DispatchPings(nsIContent *content, nsIURI *referrer)
 static nsDOMPerformanceNavigationType
 ConvertLoadTypeToNavigationType(PRUint32 aLoadType)
 {
+  // Not initialized, assume it's normal load.
+  if (aLoadType == 0) {
+    aLoadType = LOAD_NORMAL;
+  }
+
   nsDOMPerformanceNavigationType result = nsIDOMPerformanceNavigation::TYPE_RESERVED;
   switch (aLoadType) {
     case LOAD_NORMAL:
@@ -5874,12 +5879,7 @@ nsDocShell::OnStateChange(nsIWebProgress * aProgress, nsIRequest * aRequest,
         channel->GetURI(getter_AddRefs(uri));
         nsCAutoString aURI;
         uri->GetAsciiSpec(aURI);
-        // If load type is not set, this is not a 'normal' load.
-        // No need to collect timing.
-        if (mLoadType == 0) {
-            mTiming = nsnull;
-        }
-        else if (this == aProgress){
+        if (this == aProgress){
             rv = MaybeInitTiming();
             if (mTiming) {
                 mTiming->NotifyFetchStart(uri, ConvertLoadTypeToNavigationType(mLoadType));
diff --git a/docshell/test/Makefile.in b/docshell/test/Makefile.in
index b2eda9a0b68..b8f03c8166a 100644
--- a/docshell/test/Makefile.in
+++ b/docshell/test/Makefile.in
@@ -124,6 +124,7 @@ _TEST_FILES = \
 		file_bug680257.html \
 		test_bug691547.html \
 		bug691547_frame.html \
+		test_bug694612.html \
 		$(NULL)
 
 ifeq ($(MOZ_WIDGET_TOOLKIT),cocoa)
diff --git a/docshell/test/test_bug694612.html b/docshell/test/test_bug694612.html
new file mode 100644
index 00000000000..85c2401467d
--- /dev/null
+++ b/docshell/test/test_bug694612.html
@@ -0,0 +1,27 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=694612
+-->
+<head>
+  <title>Test for Bug 694612</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=694612">Mozilla Bug 694612</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script type="application/javascript">
+/** Test for Bug 694612 **/
+SimpleTest.waitForExplicitFinish();
+</script>
+<object type="text/html"
+        data="data:text/html,<script>parent.isnot(performance, null, 'should have performance API in an <object>'); parent.SimpleTest.finish();</script>">
+</object>
+</pre>
+</body>
+</html>
diff --git a/dom/base/nsDOMWindowUtils.cpp b/dom/base/nsDOMWindowUtils.cpp
index 5022940046b..2583f1ffdd2 100644
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -1548,61 +1548,30 @@ nsDOMWindowUtils::IsInModalState(bool *retval)
 }
 
 NS_IMETHODIMP
-nsDOMWindowUtils::GetParent()
+nsDOMWindowUtils::GetParent(const JS::Value& aObject,
+                            JSContext* aCx,
+                            JS::Value* aParent)
 {
   // This wasn't privileged in the past, but better to expose less than more.
   if (!IsUniversalXPConnectCapable()) {
     return NS_ERROR_DOM_SECURITY_ERR;
   }
 
-  nsCOMPtr<nsIXPConnect> xpc = nsContentUtils::XPConnect();
-
-  // get the xpconnect native call context
-  nsAXPCNativeCallContext *cc = nsnull;
-  xpc->GetCurrentNativeCallContext(&cc);
-  if(!cc)
-    return NS_ERROR_FAILURE;
-
-  // Get JSContext of current call
-  JSContext* cx;
-  nsresult rv = cc->GetJSContext(&cx);
-  if(NS_FAILED(rv) || !cx)
-    return NS_ERROR_FAILURE;
-
-  // get place for return value
-  jsval *rval = nsnull;
-  rv = cc->GetRetValPtr(&rval);
-  if(NS_FAILED(rv) || !rval)
-    return NS_ERROR_FAILURE;
-
-  // get argc and argv and verify arg count
-  PRUint32 argc;
-  rv = cc->GetArgc(&argc);
-  if(NS_FAILED(rv))
-    return NS_ERROR_FAILURE;
-
-  if(argc != 1)
-    return NS_ERROR_XPC_NOT_ENOUGH_ARGS;
-
-  jsval* argv;
-  rv = cc->GetArgvPtr(&argv);
-  if(NS_FAILED(rv) || !argv)
-    return NS_ERROR_FAILURE;
-
-  // first argument must be an object
-  if(JSVAL_IS_PRIMITIVE(argv[0]))
+  // First argument must be an object.
+  if (JSVAL_IS_PRIMITIVE(aObject)) {
     return NS_ERROR_XPC_BAD_CONVERT_JS;
+  }
 
-  JSObject *parent = JS_GetParent(cx, JSVAL_TO_OBJECT(argv[0]));
-  *rval = OBJECT_TO_JSVAL(parent);
+  JSObject* parent = JS_GetParent(aCx, JSVAL_TO_OBJECT(aObject));
+  *aParent = OBJECT_TO_JSVAL(parent);
 
   // Outerize if necessary.
   if (parent) {
-    if (JSObjectOp outerize = js::GetObjectClass(parent)->ext.outerObject)
-      *rval = OBJECT_TO_JSVAL(outerize(cx, parent));
+    if (JSObjectOp outerize = js::GetObjectClass(parent)->ext.outerObject) {
+      *aParent = OBJECT_TO_JSVAL(outerize(aCx, parent));
+    }
   }
 
-  cc->SetReturnValueWasSet(true);
   return NS_OK;
 }
 
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 4ce0a1286a6..3eee0639bf9 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -1558,10 +1558,7 @@ nsGlobalWindow::EnsureScriptEnvironment(PRUint32 aLangID)
   nsresult rv = NS_GetScriptRuntimeByID(aLangID, getter_AddRefs(scriptRuntime));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCOMPtr<nsIScriptContext> context;
-  rv = scriptRuntime->CreateContext(getter_AddRefs(context));
-  NS_ENSURE_SUCCESS(rv, rv);
-
+  nsCOMPtr<nsIScriptContext> context = scriptRuntime->CreateContext();
   return SetScriptContext(aLangID, context);
 }
 
diff --git a/dom/base/nsIScriptContext.h b/dom/base/nsIScriptContext.h
index 2ad64b3a282..03954df1dab 100644
--- a/dom/base/nsIScriptContext.h
+++ b/dom/base/nsIScriptContext.h
@@ -74,8 +74,8 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsIScriptContextPrincipal,
                               NS_ISCRIPTCONTEXTPRINCIPAL_IID)
 
 #define NS_ISCRIPTCONTEXT_IID \
-{ 0x2e583bf4, 0x3c1f, 0x432d, \
-  { 0x82, 0x83, 0x8d, 0xee, 0x7e, 0xcc, 0xc8, 0x8b } }
+{ 0x164ea909, 0x5cee, 0x4e20, \
+  { 0x9f, 0xed, 0x43, 0x13, 0xab, 0xac, 0x1c, 0xd3 } }
 
 /* This MUST match JSVERSION_DEFAULT.  This version stuff if we don't
    know what language we have is a little silly... */
@@ -121,15 +121,13 @@ public:
                                   nsAString *aRetValue,
                                   bool* aIsUndefined) = 0;
 
-  // Note JS bigotry remains here - 'void *aRetValue' is assumed to be a
-  // jsval.  This must move to JSObject before it can be made agnostic.
   virtual nsresult EvaluateStringWithValue(const nsAString& aScript,
-                                           void *aScopeObject,
+                                           JSObject* aScopeObject,
                                            nsIPrincipal *aPrincipal,
                                            const char *aURL,
                                            PRUint32 aLineNo,
                                            PRUint32 aVersion,
-                                           void* aRetValue,
+                                           JS::Value* aRetValue,
                                            bool* aIsUndefined) = 0;
 
   /**
@@ -137,8 +135,6 @@ public:
    *
    * @param aText a PRUnichar buffer containing script source
    * @param aTextLength number of characters in aText
-   * @param aScopeObject an object telling the scope in which to execute,
-   *                     or nsnull to use a default scope
    * @param aPrincipal the principal that produced the script
    * @param aURL the URL or filename for error messages
    * @param aLineNo the starting line number of the script for error messages
@@ -151,7 +147,6 @@ public:
    **/
   virtual nsresult CompileScript(const PRUnichar* aText,
                                  PRInt32 aTextLength,
-                                 void* aScopeObject,
                                  nsIPrincipal* aPrincipal,
                                  const char* aURL,
                                  PRUint32 aLineNo,
diff --git a/dom/base/nsIScriptRuntime.h b/dom/base/nsIScriptRuntime.h
index 7760274babd..7bf3af9e70c 100644
--- a/dom/base/nsIScriptRuntime.h
+++ b/dom/base/nsIScriptRuntime.h
@@ -39,10 +39,9 @@
 
 #include "nsIScriptContext.h"
 
-// {47032A4D-0C22-4125-94B7-864A4B744335}
 #define NS_ISCRIPTRUNTIME_IID \
-{ 0x47032a4d, 0xc22, 0x4125, { 0x94, 0xb7, 0x86, 0x4a, 0x4b, 0x74, 0x43, 0x35 } }
-
+{ 0x2c8d774e, 0xb52a, 0x43ec, \
+  { 0x8e, 0xbc, 0x82, 0x75, 0xb9, 0x34, 0x20, 0x57 } }
 
 /**
  * A singleton language environment for an application.  Responsible for
@@ -66,7 +65,7 @@ public:
   virtual nsresult ParseVersion(const nsString &aVersionStr, PRUint32 *verFlags) = 0;
   
   /* Factory for a new context for this language */
-  virtual nsresult CreateContext(nsIScriptContext **ret) = 0;
+  virtual already_AddRefed<nsIScriptContext> CreateContext() = 0;
   
   /* Memory managment for script objects returned from various
    * nsIScriptContext methods.  These are identical to those in
diff --git a/dom/base/nsJSEnvironment.cpp b/dom/base/nsJSEnvironment.cpp
index 7259cd36a34..851cb00756a 100644
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -1196,17 +1196,20 @@ nsJSContext::GetCCRefcnt()
 
 nsresult
 nsJSContext::EvaluateStringWithValue(const nsAString& aScript,
-                                     void *aScopeObject,
+                                     JSObject* aScopeObject,
                                      nsIPrincipal *aPrincipal,
                                      const char *aURL,
                                      PRUint32 aLineNo,
                                      PRUint32 aVersion,
-                                     void* aRetValue,
+                                     JS::Value* aRetValue,
                                      bool* aIsUndefined)
 {
   NS_TIME_FUNCTION_MIN_FMT(1.0, "%s (line %d) (url: %s, line: %d)", MOZ_FUNCTION_NAME,
                            __LINE__, aURL, aLineNo);
 
+  NS_ABORT_IF_FALSE(aScopeObject,
+    "Shouldn't call EvaluateStringWithValue with null scope object.");
+
   NS_ENSURE_TRUE(mIsInitialized, NS_ERROR_NOT_INITIALIZED);
 
   if (!mScriptsEnabled) {
@@ -1217,15 +1220,12 @@ nsJSContext::EvaluateStringWithValue(const nsAString& aScript,
     return NS_OK;
   }
 
-  nsresult rv;
-  if (!aScopeObject)
-    aScopeObject = ::JS_GetGlobalObject(mContext);
-
   // Safety first: get an object representing the script's principals, i.e.,
   // the entities who signed this script, or the fully-qualified-domain-name
   // or "codebase" from which it was loaded.
   JSPrincipals *jsprin;
   nsIPrincipal *principal = aPrincipal;
+  nsresult rv;
   if (!aPrincipal) {
     nsIScriptGlobalObject *global = GetGlobalObject();
     if (!global)
@@ -1277,7 +1277,7 @@ nsJSContext::EvaluateStringWithValue(const nsAString& aScript,
     JSAutoRequest ar(mContext);
 
     JSAutoEnterCompartment ac;
-    if (!ac.enter(mContext, (JSObject *)aScopeObject)) {
+    if (!ac.enter(mContext, aScopeObject)) {
       JSPRINCIPALS_DROP(mContext, jsprin);
       stack->Pop(nsnull);
       return NS_ERROR_FAILURE;
@@ -1286,9 +1286,9 @@ nsJSContext::EvaluateStringWithValue(const nsAString& aScript,
     ++mExecuteDepth;
 
     ok = ::JS_EvaluateUCScriptForPrincipalsVersion(mContext,
-                                                   (JSObject *)aScopeObject,
+                                                   aScopeObject,
                                                    jsprin,
-                                                   (jschar*)PromiseFlatString(aScript).get(),
+                                                   static_cast<const jschar*>(PromiseFlatString(aScript).get()),
                                                    aScript.Length(),
                                                    aURL,
                                                    aLineNo,
@@ -1315,7 +1315,7 @@ nsJSContext::EvaluateStringWithValue(const nsAString& aScript,
       *aIsUndefined = JSVAL_IS_VOID(val);
     }
 
-    *static_cast<jsval*>(aRetValue) = val;
+    *aRetValue = val;
     // XXX - nsScriptObjectHolder should be used once this method moves to
     // the new world order. However, use of 'jsval' appears to make this
     // tricky...
@@ -1545,7 +1545,6 @@ nsJSContext::EvaluateString(const nsAString& aScript,
 nsresult
 nsJSContext::CompileScript(const PRUnichar* aText,
                            PRInt32 aTextLength,
-                           void *aScopeObject,
                            nsIPrincipal *aPrincipal,
                            const char *aURL,
                            PRUint32 aLineNo,
@@ -1554,11 +1553,9 @@ nsJSContext::CompileScript(const PRUnichar* aText,
 {
   NS_ENSURE_TRUE(mIsInitialized, NS_ERROR_NOT_INITIALIZED);
 
-  nsresult rv;
   NS_ENSURE_ARG_POINTER(aPrincipal);
 
-  if (!aScopeObject)
-    aScopeObject = ::JS_GetGlobalObject(mContext);
+  JSObject* scopeObject = ::JS_GetGlobalObject(mContext);
 
   JSPrincipals *jsprin;
   aPrincipal->GetJSPrincipals(mContext, &jsprin);
@@ -1566,7 +1563,7 @@ nsJSContext::CompileScript(const PRUnichar* aText,
 
   bool ok = false;
 
-  rv = sSecurityManager->CanExecuteScripts(mContext, aPrincipal, &ok);
+  nsresult rv = sSecurityManager->CanExecuteScripts(mContext, aPrincipal, &ok);
   if (NS_FAILED(rv)) {
     JSPRINCIPALS_DROP(mContext, jsprin);
     return NS_ERROR_FAILURE;
@@ -1582,9 +1579,9 @@ nsJSContext::CompileScript(const PRUnichar* aText,
 
     JSScript* script =
         ::JS_CompileUCScriptForPrincipalsVersion(mContext,
-                                                 (JSObject *)aScopeObject,
+                                                 scopeObject,
                                                  jsprin,
-                                                 (jschar*) aText,
+                                                 static_cast<const jschar*>(aText),
                                                  aTextLength,
                                                  aURL,
                                                  aLineNo,
@@ -3512,15 +3509,11 @@ NS_INTERFACE_MAP_END
 NS_IMPL_ADDREF(nsJSRuntime)
 NS_IMPL_RELEASE(nsJSRuntime)
 
-nsresult
-nsJSRuntime::CreateContext(nsIScriptContext **aContext)
+already_AddRefed<nsIScriptContext>
+nsJSRuntime::CreateContext()
 {
-  nsCOMPtr<nsIScriptContext> scriptContext;
-
-  *aContext = new nsJSContext(sRuntime);
-  NS_ENSURE_TRUE(*aContext, NS_ERROR_OUT_OF_MEMORY);
-  NS_ADDREF(*aContext);
-  return NS_OK;
+  nsCOMPtr<nsIScriptContext> scriptContext = new nsJSContext(sRuntime);
+  return scriptContext.forget();
 }
 
 nsresult
diff --git a/dom/base/nsJSEnvironment.h b/dom/base/nsJSEnvironment.h
index 5aedda2cd59..ddb9f71eafe 100644
--- a/dom/base/nsJSEnvironment.h
+++ b/dom/base/nsJSEnvironment.h
@@ -81,17 +81,16 @@ public:
                                   nsAString *aRetValue,
                                   bool* aIsUndefined);
   virtual nsresult EvaluateStringWithValue(const nsAString& aScript,
-                                     void *aScopeObject,
-                                     nsIPrincipal *aPrincipal,
-                                     const char *aURL,
-                                     PRUint32 aLineNo,
-                                     PRUint32 aVersion,
-                                     void* aRetValue,
-                                     bool* aIsUndefined);
+                                           JSObject* aScopeObject,
+                                           nsIPrincipal* aPrincipal,
+                                           const char* aURL,
+                                           PRUint32 aLineNo,
+                                           PRUint32 aVersion,
+                                           JS::Value* aRetValue,
+                                           bool* aIsUndefined);
 
   virtual nsresult CompileScript(const PRUnichar* aText,
                                  PRInt32 aTextLength,
-                                 void *aScopeObject,
                                  nsIPrincipal *principal,
                                  const char *aURL,
                                  PRUint32 aLineNo,
@@ -313,10 +312,10 @@ public:
   NS_DECL_ISUPPORTS
 
   virtual PRUint32 GetScriptTypeID() {
-            return nsIProgrammingLanguage::JAVASCRIPT;
+    return nsIProgrammingLanguage::JAVASCRIPT;
   }
 
-  virtual nsresult CreateContext(nsIScriptContext **ret);
+  virtual already_AddRefed<nsIScriptContext> CreateContext();
 
   virtual nsresult ParseVersion(const nsString &aVersionStr, PRUint32 *flags);
 
diff --git a/dom/interfaces/base/nsIDOMWindowUtils.idl b/dom/interfaces/base/nsIDOMWindowUtils.idl
index 9e55574e815..09dd00d6dc4 100644
--- a/dom/interfaces/base/nsIDOMWindowUtils.idl
+++ b/dom/interfaces/base/nsIDOMWindowUtils.idl
@@ -68,7 +68,7 @@ interface nsIDOMWindow;
 interface nsIDOMFile;
 interface nsIFile;
 
-[scriptable, uuid(910484d7-219c-4c72-b999-7a7e9c954646)]
+[scriptable, uuid(c5cf91b3-0b89-4417-b13c-5540ba6ebde8)]
 interface nsIDOMWindowUtils : nsISupports {
 
   /**
@@ -774,7 +774,7 @@ interface nsIDOMWindowUtils : nsISupports {
    * @param obj The JavaScript object whose parent is to be gotten.
    * @return the parent.
    */
-  void getParent(/* obj */);
+  [implicit_jscontext] jsval getParent(in jsval obj);
 
   /**
    * Get the id of the outer window of this window.  This will never throw.
diff --git a/dom/plugins/base/nsNPAPIPlugin.cpp b/dom/plugins/base/nsNPAPIPlugin.cpp
index 8f0e4bbd6eb..aa7f0625bc4 100644
--- a/dom/plugins/base/nsNPAPIPlugin.cpp
+++ b/dom/plugins/base/nsNPAPIPlugin.cpp
@@ -1646,6 +1646,8 @@ _evaluate(NPP npp, NPObject* npobj, NPString *script, NPVariant *result)
   }
 
   obj = JS_ObjectToInnerObject(cx, obj);
+  NS_ABORT_IF_FALSE(obj,
+    "JS_ObjectToInnerObject should never return null with non-null input.");
 
   // Root obj and the rval (below).
   jsval vec[] = { OBJECT_TO_JSVAL(obj), JSVAL_NULL };
diff --git a/dom/plugins/ipc/PluginUtilsOSX.h b/dom/plugins/ipc/PluginUtilsOSX.h
index 920dc6e050c..4dd0330c1ac 100644
--- a/dom/plugins/ipc/PluginUtilsOSX.h
+++ b/dom/plugins/ipc/PluginUtilsOSX.h
@@ -94,8 +94,7 @@ public:
 
 private:
   void *mCALayer;
-  nsRefPtr<nsCARenderer> mFrontRenderer;
-  nsRefPtr<nsCARenderer> mBackRenderer;
+  nsRefPtr<nsCARenderer> mCARenderer;
   nsRefPtr<nsIOSurface> mFrontSurface;
   nsRefPtr<nsIOSurface> mBackSurface;
 };
diff --git a/dom/plugins/ipc/PluginUtilsOSX.mm b/dom/plugins/ipc/PluginUtilsOSX.mm
index 21ff2a7cb00..78895c54924 100644
--- a/dom/plugins/ipc/PluginUtilsOSX.mm
+++ b/dom/plugins/ipc/PluginUtilsOSX.mm
@@ -345,67 +345,66 @@ bool nsDoubleBufferCARenderer::InitFrontSurface(size_t aWidth, size_t aHeight,
 
   mFrontSurface = nsIOSurface::CreateIOSurface(aWidth, aHeight);
   if (!mFrontSurface) {
+    mCARenderer = nsnull;
     return false;
   }
 
-  mFrontRenderer = new nsCARenderer();
-  if (!mFrontRenderer) {
-    mFrontSurface = nsnull;
-    return false;
-  }
+  if (!mCARenderer) {
+    mCARenderer = new nsCARenderer();
+    if (!mCARenderer) {
+      mFrontSurface = nsnull;
+      return false;
+    }
 
-  nsRefPtr<nsIOSurface> ioSurface = nsIOSurface::LookupSurface(mFrontSurface->GetIOSurfaceID());
-  if (!ioSurface) {
-    mFrontRenderer = nsnull;
-    mFrontSurface = nsnull;
-    return false;
-  }
+    mCARenderer->AttachIOSurface(mFrontSurface);
 
-  mFrontRenderer->AttachIOSurface(ioSurface);
-
-  nsresult result = mFrontRenderer->SetupRenderer(mCALayer,
-                        ioSurface->GetWidth(),
-                        ioSurface->GetHeight(),
+    nsresult result = mCARenderer->SetupRenderer(mCALayer,
+                        mFrontSurface->GetWidth(),
+                        mFrontSurface->GetHeight(),
                         aAllowOfflineRenderer);
 
-  return result == NS_OK;
+    if (result != NS_OK) {
+      mCARenderer = nsnull;
+      mFrontSurface = nsnull;
+      return false;
+    }
+  } else {
+    mCARenderer->AttachIOSurface(mFrontSurface);
+  }
+
+  return true;
 }
 
 void nsDoubleBufferCARenderer::Render() {
-  if (!HasFrontSurface()) {
+  if (!HasFrontSurface() || !mCARenderer) {
     return;
   }
 
-  mFrontRenderer->Render(GetFrontSurfaceWidth(), GetFrontSurfaceHeight(), nsnull);
+  mCARenderer->Render(GetFrontSurfaceWidth(), GetFrontSurfaceHeight(), nsnull);
 }
 
 void nsDoubleBufferCARenderer::SwapSurfaces() {
-  if (mFrontRenderer) {
-    mFrontRenderer->DettachCALayer();
-  }
-
-  nsRefPtr<nsCARenderer> prevFrontRenderer = mFrontRenderer;
   nsRefPtr<nsIOSurface> prevFrontSurface = mFrontSurface;
-
-  mFrontRenderer = mBackRenderer;
   mFrontSurface = mBackSurface;
-
-  mBackRenderer = prevFrontRenderer;
   mBackSurface = prevFrontSurface;
 
-  if (mFrontRenderer) {
-    mFrontRenderer->AttachCALayer(mCALayer);
+  if (mFrontSurface) {
+    mCARenderer->AttachIOSurface(mFrontSurface);
   }
 }
 
 void nsDoubleBufferCARenderer::ClearFrontSurface() {
-  mFrontRenderer = nsnull;
   mFrontSurface = nsnull;
+  if (!mFrontSurface && !mBackSurface) {
+    mCARenderer = nsnull;
+  }
 }
 
 void nsDoubleBufferCARenderer::ClearBackSurface() {
-  mBackRenderer = nsnull;
   mBackSurface = nsnull;
+  if (!mFrontSurface && !mBackSurface) {
+    mCARenderer = nsnull;
+  }
 }
 
 } //PluginUtilsOSX
diff --git a/editor/libeditor/html/nsHTMLEditor.cpp b/editor/libeditor/html/nsHTMLEditor.cpp
index bb71271c6b2..658d8da8dbf 100644
--- a/editor/libeditor/html/nsHTMLEditor.cpp
+++ b/editor/libeditor/html/nsHTMLEditor.cpp
@@ -101,6 +101,8 @@
 #include "nsIParserService.h"
 #include "mozilla/dom/Element.h"
 
+using namespace mozilla;
+
 // Some utilities to handle annoying overloading of "A" tag for link and named anchor
 static char hrefText[] = "href";
 static char anchorTxt[] = "anchor";
@@ -3718,57 +3720,45 @@ nsHTMLEditor::GetEmbeddedObjects(nsISupportsArray** aNodeList)
 {
   NS_ENSURE_TRUE(aNodeList, NS_ERROR_NULL_POINTER);
 
-  nsresult res;
-
-  res = NS_NewISupportsArray(aNodeList);
-  NS_ENSURE_SUCCESS(res, res);
+  nsresult rv = NS_NewISupportsArray(aNodeList);
+  NS_ENSURE_SUCCESS(rv, rv);
   NS_ENSURE_TRUE(*aNodeList, NS_ERROR_NULL_POINTER);
 
   nsCOMPtr<nsIContentIterator> iter =
-      do_CreateInstance("@mozilla.org/content/post-content-iterator;1", &res);
+      do_CreateInstance("@mozilla.org/content/post-content-iterator;1", &rv);
   NS_ENSURE_TRUE(iter, NS_ERROR_NULL_POINTER);
-  if ((NS_SUCCEEDED(res)))
-  {
-    nsCOMPtr<nsIDOMDocument> domdoc;
-    nsEditor::GetDocument(getter_AddRefs(domdoc));
-    NS_ENSURE_TRUE(domdoc, NS_ERROR_UNEXPECTED);
+  NS_ENSURE_SUCCESS(rv, rv);
 
-    nsCOMPtr<nsIDocument> doc (do_QueryInterface(domdoc));
-    NS_ENSURE_TRUE(doc, NS_ERROR_UNEXPECTED);
+  nsCOMPtr<nsIDOMDocument> domdoc;
+  nsEditor::GetDocument(getter_AddRefs(domdoc));
+  NS_ENSURE_TRUE(domdoc, NS_ERROR_UNEXPECTED);
 
-    iter->Init(doc->GetRootElement());
+  nsCOMPtr<nsIDocument> doc = do_QueryInterface(domdoc);
+  NS_ENSURE_TRUE(doc, NS_ERROR_UNEXPECTED);
 
-    // loop through the content iterator for each content node
-    while (!iter->IsDone())
-    {
-      nsCOMPtr<nsIDOMNode> node (do_QueryInterface(iter->GetCurrentNode()));
-      if (node)
-      {
-        nsAutoString tagName;
-        node->GetNodeName(tagName);
-        ToLowerCase(tagName);
+  iter->Init(doc->GetRootElement());
 
-        // See if it's an image or an embed and also include all links.
-        // Let mail decide which link to send or not
-        if (tagName.EqualsLiteral("img") || tagName.EqualsLiteral("embed") ||
-            tagName.EqualsLiteral("a"))
-          (*aNodeList)->AppendElement(node);
-        else if (tagName.EqualsLiteral("body"))
-        {
-          nsCOMPtr<nsIDOMElement> element = do_QueryInterface(node);
-          if (element)
-          {
-            bool hasBackground = false;
-            if (NS_SUCCEEDED(element->HasAttribute(NS_LITERAL_STRING("background"), &hasBackground)) && hasBackground)
-              (*aNodeList)->AppendElement(node);
-          }
-        }
+  // Loop through the content iterator for each content node.
+  while (!iter->IsDone()) {
+    nsINode* node = iter->GetCurrentNode();
+    if (node->IsElement()) {
+      dom::Element* element = node->AsElement();
+
+      // See if it's an image or an embed and also include all links.
+      // Let mail decide which link to send or not
+      if (element->IsHTML(nsGkAtoms::img) ||
+          element->IsHTML(nsGkAtoms::embed) ||
+          element->IsHTML(nsGkAtoms::a) ||
+          (element->IsHTML(nsGkAtoms::body) &&
+           element->HasAttr(kNameSpaceID_None, nsGkAtoms::background))) {
+        nsCOMPtr<nsIDOMNode> domNode = do_QueryInterface(node);
+        (*aNodeList)->AppendElement(domNode);
       }
-      iter->Next();
     }
+    iter->Next();
   }
 
-  return res;
+  return rv;
 }
 
 
diff --git a/gfx/2d/Blur.cpp b/gfx/2d/Blur.cpp
deleted file mode 100644
index b03853a575d..00000000000
--- a/gfx/2d/Blur.cpp
+++ /dev/null
@@ -1,526 +0,0 @@
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla gfx.
- *
- * The Initial Developer of the Original Code is Mozilla Foundation.
- * Portions created by the Initial Developer are Copyright (C) 2011
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#include <algorithm>
-#include <math.h>
-
-#include "CheckedInt.h"
-#include "mozilla/Util.h"
-
-#include "mozilla/gfx/Blur.h"
-
-#ifndef M_PI
-#define M_PI 3.14159265358979323846
-#endif
-
-using namespace std;
-
-namespace mozilla {
-namespace gfx {
-
-/**
- * Box blur involves looking at one pixel, and setting its value to the average
- * of its neighbouring pixels.
- * @param aInput The input buffer.
- * @param aOutput The output buffer.
- * @param aLeftLobe The number of pixels to blend on the left.
- * @param aRightLobe The number of pixels to blend on the right.
- * @param aWidth The number of columns in the buffers.
- * @param aRows The number of rows in the buffers.
- * @param aSkipRect An area to skip blurring in.
- * XXX shouldn't we pass stride in separately here?
- */
-static void
-BoxBlurHorizontal(unsigned char* aInput,
-                  unsigned char* aOutput,
-                  int32_t aLeftLobe,
-                  int32_t aRightLobe,
-                  int32_t aWidth,
-                  int32_t aRows,
-                  const IntRect& aSkipRect)
-{
-    MOZ_ASSERT(aWidth > 0);
-
-    int32_t boxSize = aLeftLobe + aRightLobe + 1;
-    bool skipRectCoversWholeRow = 0 >= aSkipRect.x &&
-                                  aWidth <= aSkipRect.XMost();
-
-    for (int32_t y = 0; y < aRows; y++) {
-        // Check whether the skip rect intersects this row. If the skip
-        // rect covers the whole surface in this row, we can avoid
-        // this row entirely (and any others along the skip rect).
-        bool inSkipRectY = y >= aSkipRect.y &&
-                           y < aSkipRect.YMost();
-        if (inSkipRectY && skipRectCoversWholeRow) {
-            y = aSkipRect.YMost() - 1;
-            continue;
-        }
-
-        int32_t alphaSum = 0;
-        for (int32_t i = 0; i < boxSize; i++) {
-            int32_t pos = i - aLeftLobe;
-            // See assertion above; if aWidth is zero, then we would have no
-            // valid position to clamp to.
-            pos = max(pos, 0);
-            pos = min(pos, aWidth - 1);
-            alphaSum += aInput[aWidth * y + pos];
-        }
-        for (int32_t x = 0; x < aWidth; x++) {
-            // Check whether we are within the skip rect. If so, go
-            // to the next point outside the skip rect.
-            if (inSkipRectY && x >= aSkipRect.x &&
-                x < aSkipRect.XMost()) {
-                x = aSkipRect.XMost();
-                if (x >= aWidth)
-                    break;
-
-                // Recalculate the neighbouring alpha values for
-                // our new point on the surface.
-                alphaSum = 0;
-                for (int32_t i = 0; i < boxSize; i++) {
-                    int32_t pos = x + i - aLeftLobe;
-                    // See assertion above; if aWidth is zero, then we would have no
-                    // valid position to clamp to.
-                    pos = max(pos, 0);
-                    pos = min(pos, aWidth - 1);
-                    alphaSum += aInput[aWidth * y + pos];
-                }
-            }
-            int32_t tmp = x - aLeftLobe;
-            int32_t last = max(tmp, 0);
-            int32_t next = min(tmp + boxSize, aWidth - 1);
-
-            aOutput[aWidth * y + x] = alphaSum / boxSize;
-
-            alphaSum += aInput[aWidth * y + next] -
-                        aInput[aWidth * y + last];
-        }
-    }
-}
-
-/**
- * Identical to BoxBlurHorizontal, except it blurs top and bottom instead of
- * left and right.
- * XXX shouldn't we pass stride in separately here?
- */
-static void
-BoxBlurVertical(unsigned char* aInput,
-                unsigned char* aOutput,
-                int32_t aTopLobe,
-                int32_t aBottomLobe,
-                int32_t aWidth,
-                int32_t aRows,
-                const IntRect& aSkipRect)
-{
-    MOZ_ASSERT(aRows > 0);
-
-    int32_t boxSize = aTopLobe + aBottomLobe + 1;
-    bool skipRectCoversWholeColumn = 0 >= aSkipRect.y &&
-                                     aRows <= aSkipRect.YMost();
-
-    for (int32_t x = 0; x < aWidth; x++) {
-        bool inSkipRectX = x >= aSkipRect.x &&
-                           x < aSkipRect.XMost();
-        if (inSkipRectX && skipRectCoversWholeColumn) {
-            x = aSkipRect.XMost() - 1;
-            continue;
-        }
-
-        int32_t alphaSum = 0;
-        for (int32_t i = 0; i < boxSize; i++) {
-            int32_t pos = i - aTopLobe;
-            // See assertion above; if aRows is zero, then we would have no
-            // valid position to clamp to.
-            pos = max(pos, 0);
-            pos = min(pos, aRows - 1);
-            alphaSum += aInput[aWidth * pos + x];
-        }
-        for (int32_t y = 0; y < aRows; y++) {
-            if (inSkipRectX && y >= aSkipRect.y &&
-                y < aSkipRect.YMost()) {
-                y = aSkipRect.YMost();
-                if (y >= aRows)
-                    break;
-
-                alphaSum = 0;
-                for (int32_t i = 0; i < boxSize; i++) {
-                    int32_t pos = y + i - aTopLobe;
-                    // See assertion above; if aRows is zero, then we would have no
-                    // valid position to clamp to.
-                    pos = max(pos, 0);
-                    pos = min(pos, aRows - 1);
-                    alphaSum += aInput[aWidth * pos + x];
-                }
-            }
-            int32_t tmp = y - aTopLobe;
-            int32_t last = max(tmp, 0);
-            int32_t next = min(tmp + boxSize, aRows - 1);
-
-            aOutput[aWidth * y + x] = alphaSum/boxSize;
-
-            alphaSum += aInput[aWidth * next + x] -
-                        aInput[aWidth * last + x];
-        }
-    }
-}
-
-static void ComputeLobes(int32_t aRadius, int32_t aLobes[3][2])
-{
-    int32_t major, minor, final;
-
-    /* See http://www.w3.org/TR/SVG/filters.html#feGaussianBlur for
-     * some notes about approximating the Gaussian blur with box-blurs.
-     * The comments below are in the terminology of that page.
-     */
-    int32_t z = aRadius / 3;
-    switch (aRadius % 3) {
-    case 0:
-        // aRadius = z*3; choose d = 2*z + 1
-        major = minor = final = z;
-        break;
-    case 1:
-        // aRadius = z*3 + 1
-        // This is a tricky case since there is no value of d which will
-        // yield a radius of exactly aRadius. If d is odd, i.e. d=2*k + 1
-        // for some integer k, then the radius will be 3*k. If d is even,
-        // i.e. d=2*k, then the radius will be 3*k - 1.
-        // So we have to choose values that don't match the standard
-        // algorithm.
-        major = z + 1;
-        minor = final = z;
-        break;
-    case 2:
-        // aRadius = z*3 + 2; choose d = 2*z + 2
-        major = final = z + 1;
-        minor = z;
-        break;
-    default:
-        // Mathematical impossibility!
-        MOZ_ASSERT(false);
-        major = minor = final = 0;
-    }
-    MOZ_ASSERT(major + minor + final == aRadius);
-
-    aLobes[0][0] = major;
-    aLobes[0][1] = minor;
-    aLobes[1][0] = minor;
-    aLobes[1][1] = major;
-    aLobes[2][0] = final;
-    aLobes[2][1] = final;
-}
-
-static void
-SpreadHorizontal(unsigned char* aInput,
-                 unsigned char* aOutput,
-                 int32_t aRadius,
-                 int32_t aWidth,
-                 int32_t aRows,
-                 int32_t aStride,
-                 const IntRect& aSkipRect)
-{
-    if (aRadius == 0) {
-        memcpy(aOutput, aInput, aStride * aRows);
-        return;
-    }
-
-    bool skipRectCoversWholeRow = 0 >= aSkipRect.x &&
-                                    aWidth <= aSkipRect.XMost();
-    for (int32_t y = 0; y < aRows; y++) {
-        // Check whether the skip rect intersects this row. If the skip
-        // rect covers the whole surface in this row, we can avoid
-        // this row entirely (and any others along the skip rect).
-        bool inSkipRectY = y >= aSkipRect.y &&
-                             y < aSkipRect.YMost();
-        if (inSkipRectY && skipRectCoversWholeRow) {
-            y = aSkipRect.YMost() - 1;
-            continue;
-        }
-
-        for (int32_t x = 0; x < aWidth; x++) {
-            // Check whether we are within the skip rect. If so, go
-            // to the next point outside the skip rect.
-            if (inSkipRectY && x >= aSkipRect.x &&
-                x < aSkipRect.XMost()) {
-                x = aSkipRect.XMost();
-                if (x >= aWidth)
-                    break;
-            }
-
-            int32_t sMin = max(x - aRadius, 0);
-            int32_t sMax = min(x + aRadius, aWidth - 1);
-            int32_t v = 0;
-            for (int32_t s = sMin; s <= sMax; ++s) {
-                v = max<int32_t>(v, aInput[aStride * y + s]);
-            }
-            aOutput[aStride * y + x] = v;
-        }
-    }
-}
-
-static void
-SpreadVertical(unsigned char* aInput,
-               unsigned char* aOutput,
-               int32_t aRadius,
-               int32_t aWidth,
-               int32_t aRows,
-               int32_t aStride,
-               const IntRect& aSkipRect)
-{
-    if (aRadius == 0) {
-        memcpy(aOutput, aInput, aStride * aRows);
-        return;
-    }
-
-    bool skipRectCoversWholeColumn = 0 >= aSkipRect.y &&
-                                     aRows <= aSkipRect.YMost();
-    for (int32_t x = 0; x < aWidth; x++) {
-        bool inSkipRectX = x >= aSkipRect.x &&
-                           x < aSkipRect.XMost();
-        if (inSkipRectX && skipRectCoversWholeColumn) {
-            x = aSkipRect.XMost() - 1;
-            continue;
-        }
-
-        for (int32_t y = 0; y < aRows; y++) {
-            // Check whether we are within the skip rect. If so, go
-            // to the next point outside the skip rect.
-            if (inSkipRectX && y >= aSkipRect.y &&
-                y < aSkipRect.YMost()) {
-                y = aSkipRect.YMost();
-                if (y >= aRows)
-                    break;
-            }
-
-            int32_t sMin = max(y - aRadius, 0);
-            int32_t sMax = min(y + aRadius, aRows - 1);
-            int32_t v = 0;
-            for (int32_t s = sMin; s <= sMax; ++s) {
-                v = max<int32_t>(v, aInput[aStride * s + x]);
-            }
-            aOutput[aStride * y + x] = v;
-        }
-    }
-}
-
-static CheckedInt<int32_t>
-RoundUpToMultipleOf4(int32_t aVal)
-{
-  CheckedInt<int32_t> val(aVal);
-
-  val += 3;
-  val /= 4;
-  val *= 4;
-
-  return val;
-}
-
-AlphaBoxBlur::AlphaBoxBlur(const Rect& aRect,
-                           const IntSize& aSpreadRadius,
-                           const IntSize& aBlurRadius,
-                           const Rect* aDirtyRect,
-                           const Rect* aSkipRect)
- : mSpreadRadius(aSpreadRadius),
-   mBlurRadius(aBlurRadius),
-   mData(NULL)
-{
-  Rect rect(aRect);
-  rect.Inflate(Size(aBlurRadius + aSpreadRadius));
-  rect.RoundOut();
-
-  if (aDirtyRect) {
-    // If we get passed a dirty rect from layout, we can minimize the
-    // shadow size and make painting faster.
-    mHasDirtyRect = true;
-    mDirtyRect = *aDirtyRect;
-    Rect requiredBlurArea = mDirtyRect.Intersect(rect);
-    requiredBlurArea.Inflate(Size(aBlurRadius + aSpreadRadius));
-    rect = requiredBlurArea.Intersect(rect);
-  } else {
-    mHasDirtyRect = false;
-  }
-
-  if (rect.IsEmpty()) {
-    return;
-  }
-
-  if (aSkipRect) {
-    // If we get passed a skip rect, we can lower the amount of
-    // blurring/spreading we need to do. We convert it to IntRect to avoid
-    // expensive int<->float conversions if we were to use Rect instead.
-    Rect skipRect = *aSkipRect;
-    skipRect.RoundIn();
-    skipRect.Deflate(Size(aBlurRadius + aSpreadRadius));
-    mSkipRect = IntRect(skipRect.x, skipRect.y, skipRect.width, skipRect.height);
-
-    IntRect shadowIntRect(rect.x, rect.y, rect.width, rect.height);
-    mSkipRect.IntersectRect(mSkipRect, shadowIntRect);
-
-    if (mSkipRect.IsEqualInterior(shadowIntRect))
-      return;
-
-    mSkipRect -= shadowIntRect.TopLeft();
-  } else {
-    mSkipRect = IntRect(0, 0, 0, 0);
-  }
-
-  mRect = IntRect(rect.x, rect.y, rect.width, rect.height);
-
-  CheckedInt<int32_t> stride = RoundUpToMultipleOf4(mRect.width);
-  if (stride.valid()) {
-    mStride = stride.value();
-
-    CheckedInt<int32_t> size = CheckedInt<int32_t>(mStride) * mRect.height *
-                               sizeof(unsigned char);
-    if (size.valid()) {
-      mData = static_cast<unsigned char*>(malloc(size.value()));
-      memset(mData, 0, size.value());
-    }
-  }
-}
-
-AlphaBoxBlur::~AlphaBoxBlur()
-{
-  free(mData);
-}
-
-unsigned char*
-AlphaBoxBlur::GetData()
-{
-  return mData;
-}
-
-IntSize
-AlphaBoxBlur::GetSize()
-{
-  IntSize size(mRect.width, mRect.height);
-  return size;
-}
-
-int32_t
-AlphaBoxBlur::GetStride()
-{
-  return mStride;
-}
-
-IntRect
-AlphaBoxBlur::GetRect()
-{
-  return mRect;
-}
-
-Rect*
-AlphaBoxBlur::GetDirtyRect()
-{
-  if (mHasDirtyRect) {
-    return &mDirtyRect;
-  }
-
-  return NULL;
-}
-
-void
-AlphaBoxBlur::Blur()
-{
-  if (!mData) {
-    return;
-  }
-
-  // no need to do all this if not blurring or spreading
-  if (mBlurRadius != IntSize(0,0) || mSpreadRadius != IntSize(0,0)) {
-    int32_t stride = GetStride();
-
-    // No need to use CheckedInt here - we have validated it in the constructor.
-    size_t szB = stride * GetSize().height * sizeof(unsigned char);
-    unsigned char* tmpData = static_cast<unsigned char*>(malloc(szB));
-    if (!tmpData)
-      return; // OOM
-
-    memset(tmpData, 0, szB);
-
-    if (mSpreadRadius.width > 0 || mSpreadRadius.height > 0) {
-      SpreadHorizontal(mData, tmpData, mSpreadRadius.width, GetSize().width, GetSize().height, stride, mSkipRect);
-      SpreadVertical(tmpData, mData, mSpreadRadius.height, GetSize().width, GetSize().height, stride, mSkipRect);
-    }
-
-    if (mBlurRadius.width > 0) {
-      int32_t lobes[3][2];
-      ComputeLobes(mBlurRadius.width, lobes);
-      BoxBlurHorizontal(mData, tmpData, lobes[0][0], lobes[0][1], stride, GetSize().height, mSkipRect);
-      BoxBlurHorizontal(tmpData, mData, lobes[1][0], lobes[1][1], stride, GetSize().height, mSkipRect);
-      BoxBlurHorizontal(mData, tmpData, lobes[2][0], lobes[2][1], stride, GetSize().height, mSkipRect);
-    } else {
-      memcpy(tmpData, mData, stride * GetSize().height);
-    }
-
-    if (mBlurRadius.height > 0) {
-      int32_t lobes[3][2];
-      ComputeLobes(mBlurRadius.height, lobes);
-      BoxBlurVertical(tmpData, mData, lobes[0][0], lobes[0][1], stride, GetSize().height, mSkipRect);
-      BoxBlurVertical(mData, tmpData, lobes[1][0], lobes[1][1], stride, GetSize().height, mSkipRect);
-      BoxBlurVertical(tmpData, mData, lobes[2][0], lobes[2][1], stride, GetSize().height, mSkipRect);
-    } else {
-      memcpy(mData, tmpData, stride * GetSize().height);
-    }
-
-    free(tmpData);
-  }
-
-}
-
-/**
- * Compute the box blur size (which we're calling the blur radius) from
- * the standard deviation.
- *
- * Much of this, the 3 * sqrt(2 * pi) / 4, is the known value for
- * approximating a Gaussian using box blurs.  This yields quite a good
- * approximation for a Gaussian.  Then we multiply this by 1.5 since our
- * code wants the radius of the entire triple-box-blur kernel instead of
- * the diameter of an individual box blur.  For more details, see:
- *   http://www.w3.org/TR/SVG11/filters.html#feGaussianBlurElement
- *   https://bugzilla.mozilla.org/show_bug.cgi?id=590039#c19
- */
-static const Float GAUSSIAN_SCALE_FACTOR = (3 * sqrt(2 * M_PI) / 4) * 1.5;
-
-IntSize
-AlphaBoxBlur::CalculateBlurRadius(const Point& aStd)
-{
-    IntSize size(static_cast<int32_t>(floor(aStd.x * GAUSSIAN_SCALE_FACTOR + 0.5)),
-                 static_cast<int32_t>(floor(aStd.y * GAUSSIAN_SCALE_FACTOR + 0.5)));
-
-    return size;
-}
-
-}
-}
diff --git a/gfx/2d/Blur.h b/gfx/2d/Blur.h
deleted file mode 100644
index 4220ea60b6c..00000000000
--- a/gfx/2d/Blur.h
+++ /dev/null
@@ -1,180 +0,0 @@
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla gfx.
- *
- * The Initial Developer of the Original Code is Mozilla Foundation.
- * Portions created by the Initial Developer are Copyright (C) 2011
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#include "mozilla/gfx/Rect.h"
-#include "mozilla/gfx/Point.h"
-
-namespace mozilla {
-namespace gfx {
-
-/**
- * Implementation of a triple box blur approximation of a Gaussian blur.
- *
- * A Gaussian blur is good for blurring because, when done independently
- * in the horizontal and vertical directions, it matches the result that
- * would be obtained using a different (rotated) set of axes.  A triple
- * box blur is a very close approximation of a Gaussian.
- *
- * Creates an 8-bit alpha channel context for callers to draw in,
- * spreads the contents of that context, and blurs the contents.
- *
- * A spread N makes each output pixel the maximum value of all source
- * pixels within a square of side length 2N+1 centered on the output pixel.
- *
- * A temporary surface is created in the Init function. The caller then draws
- * any desired content onto the context acquired through GetContext, and lastly
- * calls Paint to apply the blurred content as an alpha mask.
- */
-class AlphaBoxBlur
-{
-public:
-
-  /** Constructs a box blur and initializes the backing surface.
-   *
-   * @param aRect The coordinates of the surface to create in device units.
-   *
-   * @param aBlurRadius The blur radius in pixels.  This is the radius of the
-   *   entire (triple) kernel function.  Each individual box blur has radius
-   *   approximately 1/3 this value, or diameter approximately 2/3 this value.
-   *   This parameter should nearly always be computed using CalculateBlurRadius,
-   *   below.
-   *
-   * @param aDirtyRect A pointer to a dirty rect, measured in device units, if
-   *   available.  This will be used for optimizing the blur operation. It is
-   *   safe to pass NULL here.
-   *
-   * @param aSkipRect A pointer to a rect, measured in device units, that
-   *   represents an area where blurring is unnecessary and shouldn't be done for
-   *   speed reasons. It is safe to pass NULL here.
-   */
-  AlphaBoxBlur(const Rect& aRect,
-               const IntSize& aSpreadRadius,
-               const IntSize& aBlurRadius,
-               const Rect* aDirtyRect,
-               const Rect* aSkipRect);
-
-  ~AlphaBoxBlur();
-
-  /**
-   * Return the pointer to memory allocated by the constructor for the 8-bit
-   * alpha surface you need to be blurred. After you draw to this surface, call
-   * Blur(), below, to have its contents blurred.
-   */
-  unsigned char* GetData();
-
-  /**
-   * Return the size, in pixels, of the 8-bit alpha surface backed by the
-   * pointer returned by GetData().
-   */
-  IntSize GetSize();
-
-  /**
-   * Return the stride, in bytes, of the 8-bit alpha surface backed by the
-   * pointer returned by GetData().
-   */
-  int32_t GetStride();
-
-  /**
-   * Returns the device-space rectangle the 8-bit alpha surface covers.
-   */
-  IntRect GetRect();
-
-  /**
-   * Return a pointer to a dirty rect, as passed in to the constructor, or NULL
-   * if none was passed in.
-   */
-  Rect* GetDirtyRect();
-
-  /**
-   * Perform the blur in-place on the surface backed by the pointer returned by
-   * GetData().
-   */
-  void Blur();
-
-  /**
-   * Calculates a blur radius that, when used with box blur, approximates a
-   * Gaussian blur with the given standard deviation.  The result of this
-   * function should be used as the aBlurRadius parameter to AlphaBoxBlur's
-   * constructor, above.
-   */
-  static IntSize CalculateBlurRadius(const Point& aStandardDeviation);
-
-private:
-
-  /**
-   * A rect indicating the area where blurring is unnecessary, and the blur
-   * algorithm should skip over it.
-   */
-  IntRect mSkipRect;
-
-  /**
-   * The device-space rectangle the the backing 8-bit alpha surface covers.
-   */
-  IntRect mRect;
-
-  /**
-   * A copy of the dirty rect passed to the constructor. This will only be valid if
-   * mHasDirtyRect is true.
-   */
-  Rect mDirtyRect;
-
-  /**
-   * The spread radius, in pixels.
-   */
-  IntSize mSpreadRadius;
-
-  /**
-   * The blur radius, in pixels.
-   */
-  IntSize mBlurRadius;
-
-  /**
-   * A pointer to the backing 8-bit alpha surface.
-   */
-  unsigned char* mData;
-
-  /**
-   * The stride of the data contained in mData.
-   */
-  int32_t mStride;
-
-  /**
-   * Whether mDirtyRect contains valid data.
-   */
-  bool mHasDirtyRect;
-};
-
-}
-}
diff --git a/gfx/2d/Makefile.in b/gfx/2d/Makefile.in
index 5f4fcf5f483..0c576474a67 100644
--- a/gfx/2d/Makefile.in
+++ b/gfx/2d/Makefile.in
@@ -56,7 +56,6 @@ EXPORTS_mozilla/gfx	= \
         BaseMargin.h \
         BaseRect.h \
         BaseSize.h \
-        Blur.h \
         PathHelpers.h \
         Point.h \
         Matrix.h \
@@ -69,7 +68,6 @@ CPPSRCS	= \
         Matrix.cpp \
         DrawTargetCairo.cpp \
         SourceSurfaceCairo.cpp \
-        Blur.cpp \
         $(NULL)
 
 
diff --git a/gfx/layers/basic/BasicLayers.cpp b/gfx/layers/basic/BasicLayers.cpp
index bff039852b8..babb9343984 100644
--- a/gfx/layers/basic/BasicLayers.cpp
+++ b/gfx/layers/basic/BasicLayers.cpp
@@ -43,6 +43,8 @@
 #include "mozilla/layers/PLayersParent.h"
 #include "mozilla/gfx/2D.h"
 
+#include "mozilla/Types.h"
+
 #include "ipc/ShadowLayerChild.h"
 
 #include "BasicLayers.h"
@@ -2209,17 +2211,17 @@ private:
     return static_cast<BasicShadowLayerManager*>(mManager);
   }
 
-  NS_OVERRIDE virtual void
+  virtual void
   PaintBuffer(gfxContext* aContext,
               const nsIntRegion& aRegionToDraw,
               const nsIntRegion& aExtendedRegionToDraw,
               const nsIntRegion& aRegionToInvalidate,
               bool aDidSelfCopy,
               LayerManager::DrawThebesLayerCallback aCallback,
-              void* aCallbackData);
+              void* aCallbackData) MOZ_OVERRIDE;
 
-  NS_OVERRIDE virtual already_AddRefed<gfxASurface>
-  CreateBuffer(Buffer::ContentType aType, const nsIntSize& aSize);
+  virtual already_AddRefed<gfxASurface>
+  CreateBuffer(Buffer::ContentType aType, const nsIntSize& aSize) MOZ_OVERRIDE;
 
   void DestroyBackBuffer()
   {
diff --git a/gfx/ots/src/layout.cc b/gfx/ots/src/layout.cc
index 8dea164fb96..0482a27b854 100644
--- a/gfx/ots/src/layout.cc
+++ b/gfx/ots/src/layout.cc
@@ -147,7 +147,7 @@ bool ParseFeatureTable(const uint8_t *data, const size_t length,
   }
 
   const unsigned feature_table_end =
-      2 * static_cast<unsigned>(num_lookups) + 4;
+      2 * static_cast<unsigned>(lookup_count) + 4;
   if (feature_table_end > std::numeric_limits<uint16_t>::max()) {
     return OTS_FAILURE();
   }
diff --git a/gfx/qcms/transform.c b/gfx/qcms/transform.c
index 9a6562bf271..f19517fc1b1 100644
--- a/gfx/qcms/transform.c
+++ b/gfx/qcms/transform.c
@@ -1078,7 +1078,8 @@ qcms_transform* qcms_transform_precacheLUT_float(qcms_transform *transform, qcms
 	//XXX: qcms_modular_transform_data may return either the src or dest buffer. If so it must not be free-ed
 	if (src && lut != src) {
 		free(src);
-	} else if (dest && lut != src) {
+	}
+	if (dest && lut != dest) {
 		free(dest);
 	}
 
diff --git a/gfx/thebes/gfxASurface.cpp b/gfx/thebes/gfxASurface.cpp
index 1372441df9b..672cc62107b 100644
--- a/gfx/thebes/gfxASurface.cpp
+++ b/gfx/thebes/gfxASurface.cpp
@@ -712,7 +712,7 @@ gfxASurface::RecordMemoryFreed()
     }
 }
 
-#ifdef DEBUG
+#ifdef MOZ_DUMP_PAINTING
 void
 gfxASurface::WriteAsPNG(const char* aFile)
 {
diff --git a/gfx/thebes/gfxASurface.h b/gfx/thebes/gfxASurface.h
index 8160ad53633..914459c8cda 100644
--- a/gfx/thebes/gfxASurface.h
+++ b/gfx/thebes/gfxASurface.h
@@ -229,7 +229,7 @@ public:
 
     virtual const gfxIntSize GetSize() const { return gfxIntSize(-1, -1); }
 
-#ifdef DEBUG
+#ifdef MOZ_DUMP_PAINTING
     /**
      * Debug functions to encode the current image as a PNG and export it.
      */
diff --git a/gfx/thebes/gfxAndroidPlatform.cpp b/gfx/thebes/gfxAndroidPlatform.cpp
index d7a991a1598..0c80421955d 100644
--- a/gfx/thebes/gfxAndroidPlatform.cpp
+++ b/gfx/thebes/gfxAndroidPlatform.cpp
@@ -79,6 +79,12 @@ gfxAndroidPlatform::CreateOffscreenSurface(const gfxIntSize& size,
     return newSurface.forget();
 }
 
+RefPtr<DrawTarget>
+gfxAndroidPlatform::CreateOffscreenDrawTarget(const IntSize& aSize, SurfaceFormat aFormat)
+{
+  return Factory::CreateDrawTarget(BACKEND_SKIA, aSize, aFormat);
+}
+
 nsresult
 gfxAndroidPlatform::GetFontList(nsIAtom *aLangGroup,
                                 const nsACString& aGenericFamily,
diff --git a/gfx/thebes/gfxAndroidPlatform.h b/gfx/thebes/gfxAndroidPlatform.h
index ace86270505..3f12aabe1d5 100644
--- a/gfx/thebes/gfxAndroidPlatform.h
+++ b/gfx/thebes/gfxAndroidPlatform.h
@@ -65,6 +65,9 @@ public:
     virtual already_AddRefed<gfxASurface>
     CreateOffscreenSurface(const gfxIntSize& size,
                            gfxASurface::gfxContentType contentType);
+    
+    virtual mozilla::RefPtr<mozilla::gfx::DrawTarget>
+      CreateOffscreenDrawTarget(const mozilla::gfx::IntSize& aSize, mozilla::gfx::SurfaceFormat aFormat);
 
     virtual gfxImageFormat GetOffscreenFormat() { return gfxASurface::ImageFormatRGB16_565; }
     
diff --git a/gfx/thebes/gfxBlur.cpp b/gfx/thebes/gfxBlur.cpp
index cd9fffc6b5b..26e18fb108e 100644
--- a/gfx/thebes/gfxBlur.cpp
+++ b/gfx/thebes/gfxBlur.cpp
@@ -37,12 +37,14 @@
 
 #include "gfxBlur.h"
 
-#include "mozilla/gfx/Blur.h"
+#include "nsMathUtils.h"
+#include "nsTArray.h"
 
-using namespace mozilla::gfx;
+#ifndef M_PI
+#define M_PI 3.14159265358979323846
+#endif
 
 gfxAlphaBoxBlur::gfxAlphaBoxBlur()
- : mBlur(nsnull)
 {
 }
 
@@ -57,63 +59,418 @@ gfxAlphaBoxBlur::Init(const gfxRect& aRect,
                       const gfxRect* aDirtyRect,
                       const gfxRect* aSkipRect)
 {
-    Rect rect(aRect.x, aRect.y, aRect.width, aRect.height);
-    IntSize spreadRadius(aSpreadRadius.width, aSpreadRadius.height);
-    IntSize blurRadius(aBlurRadius.width, aBlurRadius.height);
-    nsAutoPtr<Rect> dirtyRect;
+    mSpreadRadius = aSpreadRadius;
+    mBlurRadius = aBlurRadius;
+
+    gfxRect rect(aRect);
+    rect.Inflate(aBlurRadius + aSpreadRadius);
+    rect.RoundOut();
+
     if (aDirtyRect) {
-      dirtyRect = new Rect(aDirtyRect->x, aDirtyRect->y, aDirtyRect->width, aDirtyRect->height);
-    }
-    nsAutoPtr<Rect> skipRect;
-    if (aSkipRect) {
-      skipRect = new Rect(aSkipRect->x, aSkipRect->y, aSkipRect->width, aSkipRect->height);
+        // If we get passed a dirty rect from layout, we can minimize the
+        // shadow size and make painting faster.
+        mHasDirtyRect = true;
+        mDirtyRect = *aDirtyRect;
+        gfxRect requiredBlurArea = mDirtyRect.Intersect(rect);
+        requiredBlurArea.Inflate(aBlurRadius + aSpreadRadius);
+        rect = requiredBlurArea.Intersect(rect);
+    } else {
+        mHasDirtyRect = false;
     }
 
-    mBlur = new AlphaBoxBlur(rect, spreadRadius, blurRadius, dirtyRect, skipRect);
-
-    unsigned char* data = mBlur->GetData();
-    if (!data)
-      return nsnull;
-
-    IntSize size = mBlur->GetSize();
-    // Make an alpha-only surface to draw on. We will play with the data after
-    // everything is drawn to create a blur effect.
-    mImageSurface = new gfxImageSurface(data, gfxIntSize(size.width, size.height),
-                                        mBlur->GetStride(),
-                                        gfxASurface::ImageFormatA8);
-    if (mImageSurface->CairoStatus())
+    // Check rect empty after accounting for aDirtyRect, since that may have
+    // make the rectangle empty. BoxBlurVertical and BoxBlurHorizontal require
+    // that we have a nonzero number of rows and columns.
+    if (rect.IsEmpty())
         return nsnull;
 
-    IntRect irect = mBlur->GetRect();
-    gfxPoint topleft(irect.TopLeft().x, irect.TopLeft().y);
+    if (aSkipRect) {
+        // If we get passed a skip rect, we can lower the amount of
+        // blurring/spreading we need to do. We convert it to nsIntRect to avoid
+        // expensive int<->float conversions if we were to use gfxRect instead.
+        gfxRect skipRect = *aSkipRect;
+        skipRect.RoundIn();
+        skipRect.Deflate(aBlurRadius + aSpreadRadius);
+        gfxUtils::GfxRectToIntRect(skipRect, &mSkipRect);
+        nsIntRect shadowIntRect;
+        gfxUtils::GfxRectToIntRect(rect, &shadowIntRect);
+        mSkipRect.IntersectRect(mSkipRect, shadowIntRect);
+        if (mSkipRect.IsEqualInterior(shadowIntRect))
+          return nsnull;
+
+        mSkipRect -= shadowIntRect.TopLeft();
+    } else {
+        mSkipRect = nsIntRect(0, 0, 0, 0);
+    }
+
+    // Make an alpha-only surface to draw on. We will play with the data after
+    // everything is drawn to create a blur effect.
+    mImageSurface = new gfxImageSurface(gfxIntSize(static_cast<PRInt32>(rect.Width()), static_cast<PRInt32>(rect.Height())),
+                                        gfxASurface::ImageFormatA8);
+    if (!mImageSurface || mImageSurface->CairoStatus())
+        return nsnull;
 
     // Use a device offset so callers don't need to worry about translating
     // coordinates, they can draw as if this was part of the destination context
     // at the coordinates of rect.
-    mImageSurface->SetDeviceOffset(-topleft);
+    mImageSurface->SetDeviceOffset(-rect.TopLeft());
 
     mContext = new gfxContext(mImageSurface);
 
     return mContext;
 }
 
+/**
+ * Box blur involves looking at one pixel, and setting its value to the average
+ * of its neighbouring pixels.
+ * @param aInput The input buffer.
+ * @param aOutput The output buffer.
+ * @param aLeftLobe The number of pixels to blend on the left.
+ * @param aRightLobe The number of pixels to blend on the right.
+ * @param aWidth The number of columns in the buffers.
+ * @param aRows The number of rows in the buffers.
+ * @param aSkipRect An area to skip blurring in.
+ * XXX shouldn't we pass stride in separately here?
+ */
+static void
+BoxBlurHorizontal(unsigned char* aInput,
+                  unsigned char* aOutput,
+                  PRInt32 aLeftLobe,
+                  PRInt32 aRightLobe,
+                  PRInt32 aWidth,
+                  PRInt32 aRows,
+                  const nsIntRect& aSkipRect)
+{
+    NS_ASSERTION(aWidth > 0, "Can't handle zero width here");
+
+    PRInt32 boxSize = aLeftLobe + aRightLobe + 1;
+    bool skipRectCoversWholeRow = 0 >= aSkipRect.x &&
+                                    aWidth <= aSkipRect.XMost();
+    if (boxSize == 1) {
+        memcpy(aOutput, aInput, aWidth*aRows);
+        return;
+    }
+    PRUint32 reciprocal = (PRUint64(1) << 32)/boxSize;
+
+    for (PRInt32 y = 0; y < aRows; y++) {
+        // Check whether the skip rect intersects this row. If the skip
+        // rect covers the whole surface in this row, we can avoid
+        // this row entirely (and any others along the skip rect).
+        bool inSkipRectY = y >= aSkipRect.y &&
+                             y < aSkipRect.YMost();
+        if (inSkipRectY && skipRectCoversWholeRow) {
+            y = aSkipRect.YMost() - 1;
+            continue;
+        }
+
+        PRUint32 alphaSum = 0;
+        for (PRInt32 i = 0; i < boxSize; i++) {
+            PRInt32 pos = i - aLeftLobe;
+            // See assertion above; if aWidth is zero, then we would have no
+            // valid position to clamp to.
+            pos = NS_MAX(pos, 0);
+            pos = NS_MIN(pos, aWidth - 1);
+            alphaSum += aInput[aWidth * y + pos];
+        }
+        for (PRInt32 x = 0; x < aWidth; x++) {
+            // Check whether we are within the skip rect. If so, go
+            // to the next point outside the skip rect.
+            if (inSkipRectY && x >= aSkipRect.x &&
+                x < aSkipRect.XMost()) {
+                x = aSkipRect.XMost();
+                if (x >= aWidth)
+                    break;
+
+                // Recalculate the neighbouring alpha values for
+                // our new point on the surface.
+                alphaSum = 0;
+                for (PRInt32 i = 0; i < boxSize; i++) {
+                    PRInt32 pos = x + i - aLeftLobe;
+                    // See assertion above; if aWidth is zero, then we would have no
+                    // valid position to clamp to.
+                    pos = NS_MAX(pos, 0);
+                    pos = NS_MIN(pos, aWidth - 1);
+                    alphaSum += aInput[aWidth * y + pos];
+                }
+            }
+            PRInt32 tmp = x - aLeftLobe;
+            PRInt32 last = NS_MAX(tmp, 0);
+            PRInt32 next = NS_MIN(tmp + boxSize, aWidth - 1);
+
+            aOutput[aWidth * y + x] = (PRUint64(alphaSum)*reciprocal) >> 32;
+
+            alphaSum += aInput[aWidth * y + next] -
+                        aInput[aWidth * y + last];
+        }
+    }
+}
+
+/**
+ * Identical to BoxBlurHorizontal, except it blurs top and bottom instead of
+ * left and right.
+ * XXX shouldn't we pass stride in separately here?
+ */
+static void
+BoxBlurVertical(unsigned char* aInput,
+                unsigned char* aOutput,
+                PRInt32 aTopLobe,
+                PRInt32 aBottomLobe,
+                PRInt32 aWidth,
+                PRInt32 aRows,
+                const nsIntRect& aSkipRect)
+{
+    NS_ASSERTION(aRows > 0, "Can't handle zero rows here");
+
+    PRInt32 boxSize = aTopLobe + aBottomLobe + 1;
+    bool skipRectCoversWholeColumn = 0 >= aSkipRect.y &&
+                                       aRows <= aSkipRect.YMost();
+    if (boxSize == 1) {
+        memcpy(aOutput, aInput, aWidth*aRows);
+        return;
+    }
+    PRUint32 reciprocal = (PRUint64(1) << 32)/boxSize;
+
+    for (PRInt32 x = 0; x < aWidth; x++) {
+        bool inSkipRectX = x >= aSkipRect.x &&
+                             x < aSkipRect.XMost();
+        if (inSkipRectX && skipRectCoversWholeColumn) {
+            x = aSkipRect.XMost() - 1;
+            continue;
+        }
+
+        PRUint32 alphaSum = 0;
+        for (PRInt32 i = 0; i < boxSize; i++) {
+            PRInt32 pos = i - aTopLobe;
+            // See assertion above; if aRows is zero, then we would have no
+            // valid position to clamp to.
+            pos = NS_MAX(pos, 0);
+            pos = NS_MIN(pos, aRows - 1);
+            alphaSum += aInput[aWidth * pos + x];
+        }
+        for (PRInt32 y = 0; y < aRows; y++) {
+            if (inSkipRectX && y >= aSkipRect.y &&
+                y < aSkipRect.YMost()) {
+                y = aSkipRect.YMost();
+                if (y >= aRows)
+                    break;
+
+                alphaSum = 0;
+                for (PRInt32 i = 0; i < boxSize; i++) {
+                    PRInt32 pos = y + i - aTopLobe;
+                    // See assertion above; if aRows is zero, then we would have no
+                    // valid position to clamp to.
+                    pos = NS_MAX(pos, 0);
+                    pos = NS_MIN(pos, aRows - 1);
+                    alphaSum += aInput[aWidth * pos + x];
+                }
+            }
+            PRInt32 tmp = y - aTopLobe;
+            PRInt32 last = NS_MAX(tmp, 0);
+            PRInt32 next = NS_MIN(tmp + boxSize, aRows - 1);
+
+            aOutput[aWidth * y + x] = (PRUint64(alphaSum)*reciprocal) >> 32;
+
+            alphaSum += aInput[aWidth * next + x] -
+                        aInput[aWidth * last + x];
+        }
+    }
+}
+
+static void ComputeLobes(PRInt32 aRadius, PRInt32 aLobes[3][2])
+{
+    PRInt32 major, minor, final;
+
+    /* See http://www.w3.org/TR/SVG/filters.html#feGaussianBlur for
+     * some notes about approximating the Gaussian blur with box-blurs.
+     * The comments below are in the terminology of that page.
+     */
+    PRInt32 z = aRadius/3;
+    switch (aRadius % 3) {
+    case 0:
+        // aRadius = z*3; choose d = 2*z + 1
+        major = minor = final = z;
+        break;
+    case 1:
+        // aRadius = z*3 + 1
+        // This is a tricky case since there is no value of d which will
+        // yield a radius of exactly aRadius. If d is odd, i.e. d=2*k + 1
+        // for some integer k, then the radius will be 3*k. If d is even,
+        // i.e. d=2*k, then the radius will be 3*k - 1.
+        // So we have to choose values that don't match the standard
+        // algorithm.
+        major = z + 1;
+        minor = final = z;
+        break;
+    case 2:
+        // aRadius = z*3 + 2; choose d = 2*z + 2
+        major = final = z + 1;
+        minor = z;
+        break;
+    default:
+        NS_ERROR("Mathematical impossibility.");
+        major = minor = final = 0;
+    }
+    NS_ASSERTION(major + minor + final == aRadius,
+                 "Lobes don't sum to the right length");
+
+    aLobes[0][0] = major;
+    aLobes[0][1] = minor;
+    aLobes[1][0] = minor;
+    aLobes[1][1] = major;
+    aLobes[2][0] = final;
+    aLobes[2][1] = final;
+}
+
+static void
+SpreadHorizontal(unsigned char* aInput,
+                 unsigned char* aOutput,
+                 PRInt32 aRadius,
+                 PRInt32 aWidth,
+                 PRInt32 aRows,
+                 PRInt32 aStride,
+                 const nsIntRect& aSkipRect)
+{
+    if (aRadius == 0) {
+        memcpy(aOutput, aInput, aStride*aRows);
+        return;
+    }
+
+    bool skipRectCoversWholeRow = 0 >= aSkipRect.x &&
+                                    aWidth <= aSkipRect.XMost();
+    for (PRInt32 y = 0; y < aRows; y++) {
+        // Check whether the skip rect intersects this row. If the skip
+        // rect covers the whole surface in this row, we can avoid
+        // this row entirely (and any others along the skip rect).
+        bool inSkipRectY = y >= aSkipRect.y &&
+                             y < aSkipRect.YMost();
+        if (inSkipRectY && skipRectCoversWholeRow) {
+            y = aSkipRect.YMost() - 1;
+            continue;
+        }
+
+        for (PRInt32 x = 0; x < aWidth; x++) {
+            // Check whether we are within the skip rect. If so, go
+            // to the next point outside the skip rect.
+            if (inSkipRectY && x >= aSkipRect.x &&
+                x < aSkipRect.XMost()) {
+                x = aSkipRect.XMost();
+                if (x >= aWidth)
+                    break;
+            }
+
+            PRInt32 sMin = NS_MAX(x - aRadius, 0);
+            PRInt32 sMax = NS_MIN(x + aRadius, aWidth - 1);
+            PRInt32 v = 0;
+            for (PRInt32 s = sMin; s <= sMax; ++s) {
+                v = NS_MAX<PRInt32>(v, aInput[aStride * y + s]);
+            }
+            aOutput[aStride * y + x] = v;
+        }
+    }
+}
+
+static void
+SpreadVertical(unsigned char* aInput,
+               unsigned char* aOutput,
+               PRInt32 aRadius,
+               PRInt32 aWidth,
+               PRInt32 aRows,
+               PRInt32 aStride,
+               const nsIntRect& aSkipRect)
+{
+    if (aRadius == 0) {
+        memcpy(aOutput, aInput, aStride*aRows);
+        return;
+    }
+
+    bool skipRectCoversWholeColumn = 0 >= aSkipRect.y &&
+                                       aRows <= aSkipRect.YMost();
+    for (PRInt32 x = 0; x < aWidth; x++) {
+        bool inSkipRectX = x >= aSkipRect.x &&
+                             x < aSkipRect.XMost();
+        if (inSkipRectX && skipRectCoversWholeColumn) {
+            x = aSkipRect.XMost() - 1;
+            continue;
+        }
+
+        for (PRInt32 y = 0; y < aRows; y++) {
+            // Check whether we are within the skip rect. If so, go
+            // to the next point outside the skip rect.
+            if (inSkipRectX && y >= aSkipRect.y &&
+                y < aSkipRect.YMost()) {
+                y = aSkipRect.YMost();
+                if (y >= aRows)
+                    break;
+            }
+
+            PRInt32 sMin = NS_MAX(y - aRadius, 0);
+            PRInt32 sMax = NS_MIN(y + aRadius, aRows - 1);
+            PRInt32 v = 0;
+            for (PRInt32 s = sMin; s <= sMax; ++s) {
+                v = NS_MAX<PRInt32>(v, aInput[aStride * s + x]);
+            }
+            aOutput[aStride * y + x] = v;
+        }
+    }
+}
+
 void
 gfxAlphaBoxBlur::Paint(gfxContext* aDestinationCtx, const gfxPoint& offset)
 {
     if (!mContext)
         return;
 
-    mBlur->Blur();
+    unsigned char* boxData = mImageSurface->Data();
 
-    Rect* dirtyrect = mBlur->GetDirtyRect();
+    // no need to do all this if not blurring or spreading
+    if (mBlurRadius != gfxIntSize(0,0) || mSpreadRadius != gfxIntSize(0,0)) {
+        nsTArray<unsigned char> tempAlphaDataBuf;
+        PRSize szB = mImageSurface->GetDataSize();
+        if (!tempAlphaDataBuf.SetLength(szB))
+           return; // OOM
+
+        unsigned char* tmpData = tempAlphaDataBuf.Elements();
+        // .SetLength above doesn't initialise the new elements since
+        // they are unsigned chars and so have no default constructor.
+        // So we have to initialise them by hand.
+        memset(tmpData, 0, szB);
+
+        PRInt32 stride = mImageSurface->Stride();
+        PRInt32 rows = mImageSurface->Height();
+        PRInt32 width = mImageSurface->Width();
+
+        if (mSpreadRadius.width > 0 || mSpreadRadius.height > 0) {
+            SpreadHorizontal(boxData, tmpData, mSpreadRadius.width, width, rows, stride, mSkipRect);
+            SpreadVertical(tmpData, boxData, mSpreadRadius.height, width, rows, stride, mSkipRect);
+        }
+
+        if (mBlurRadius.width > 0) {
+            PRInt32 lobes[3][2];
+            ComputeLobes(mBlurRadius.width, lobes);
+            BoxBlurHorizontal(boxData, tmpData, lobes[0][0], lobes[0][1], stride, rows, mSkipRect);
+            BoxBlurHorizontal(tmpData, boxData, lobes[1][0], lobes[1][1], stride, rows, mSkipRect);
+            BoxBlurHorizontal(boxData, tmpData, lobes[2][0], lobes[2][1], stride, rows, mSkipRect);
+        } else {
+            memcpy(tmpData, boxData, stride*rows);
+        }
+
+        if (mBlurRadius.height > 0) {
+            PRInt32 lobes[3][2];
+            ComputeLobes(mBlurRadius.height, lobes);
+            BoxBlurVertical(tmpData, boxData, lobes[0][0], lobes[0][1], stride, rows, mSkipRect);
+            BoxBlurVertical(boxData, tmpData, lobes[1][0], lobes[1][1], stride, rows, mSkipRect);
+            BoxBlurVertical(tmpData, boxData, lobes[2][0], lobes[2][1], stride, rows, mSkipRect);
+        } else {
+            memcpy(boxData, tmpData, stride*rows);
+        }
+    }
 
     // Avoid a semi-expensive clip operation if we can, otherwise
     // clip to the dirty rect
-    if (dirtyrect) {
+    if (mHasDirtyRect) {
         aDestinationCtx->Save();
         aDestinationCtx->NewPath();
-        gfxRect dirty(dirtyrect->x, dirtyrect->y, dirtyrect->width, dirtyrect->height);
-        aDestinationCtx->Rectangle(dirty);
+        aDestinationCtx->Rectangle(mDirtyRect);
         aDestinationCtx->Clip();
         aDestinationCtx->Mask(mImageSurface, offset);
         aDestinationCtx->Restore();
@@ -122,9 +479,23 @@ gfxAlphaBoxBlur::Paint(gfxContext* aDestinationCtx, const gfxPoint& offset)
     }
 }
 
+/**
+ * Compute the box blur size (which we're calling the blur radius) from
+ * the standard deviation.
+ *
+ * Much of this, the 3 * sqrt(2 * pi) / 4, is the known value for
+ * approximating a Gaussian using box blurs.  This yields quite a good
+ * approximation for a Gaussian.  Then we multiply this by 1.5 since our
+ * code wants the radius of the entire triple-box-blur kernel instead of
+ * the diameter of an individual box blur.  For more details, see:
+ *   http://www.w3.org/TR/SVG11/filters.html#feGaussianBlurElement
+ *   https://bugzilla.mozilla.org/show_bug.cgi?id=590039#c19
+ */
+static const gfxFloat GAUSSIAN_SCALE_FACTOR = (3 * sqrt(2 * M_PI) / 4) * 1.5;
+
 gfxIntSize gfxAlphaBoxBlur::CalculateBlurRadius(const gfxPoint& aStd)
 {
-    Point std(aStd.x, aStd.y);
-    IntSize size = AlphaBoxBlur::CalculateBlurRadius(std);
-    return gfxIntSize(size.width, size.height);
+    return gfxIntSize(
+        static_cast<PRInt32>(floor(aStd.x * GAUSSIAN_SCALE_FACTOR + 0.5)),
+        static_cast<PRInt32>(floor(aStd.y * GAUSSIAN_SCALE_FACTOR + 0.5)));
 }
diff --git a/gfx/thebes/gfxBlur.h b/gfx/thebes/gfxBlur.h
index ed56c467568..48a91b5e7e7 100644
--- a/gfx/thebes/gfxBlur.h
+++ b/gfx/thebes/gfxBlur.h
@@ -42,12 +42,7 @@
 #include "gfxImageSurface.h"
 #include "gfxTypes.h"
 #include "gfxUtils.h"
-
-namespace mozilla {
-  namespace gfx {
-    class AlphaBoxBlur;
-  }
-}
+#include "nsRect.h"
 
 /**
  * Implementation of a triple box blur approximation of a Gaussian blur.
@@ -127,6 +122,15 @@ public:
     static gfxIntSize CalculateBlurRadius(const gfxPoint& aStandardDeviation);
 
 protected:
+    /**
+     * The spread radius, in pixels.
+     */
+    gfxIntSize mSpreadRadius;
+    /**
+     * The blur radius, in pixels.
+     */
+    gfxIntSize mBlurRadius;
+
     /**
      * The context of the temporary alpha surface.
      */
@@ -137,10 +141,18 @@ protected:
      */
     nsRefPtr<gfxImageSurface> mImageSurface;
 
-     /**
-      * The object that actually does the blurring for us.
-      */
-    nsAutoPtr<mozilla::gfx::AlphaBoxBlur> mBlur;
+    /**
+     * A copy of the dirty rect passed to Init(). This will only be valid if
+     * mHasDirtyRect is TRUE.
+     */
+    gfxRect mDirtyRect;
+    /**
+     * A rect indicating the area where blurring is unnecessary, and the blur
+     * algorithm should skip over it.
+     */
+    nsIntRect mSkipRect;
+
+    bool mHasDirtyRect;
 };
 
 #endif /* GFX_BLUR_H */
diff --git a/gfx/thebes/gfxContext.cpp b/gfx/thebes/gfxContext.cpp
index 5185c1655fb..aac7fd8affe 100644
--- a/gfx/thebes/gfxContext.cpp
+++ b/gfx/thebes/gfxContext.cpp
@@ -1068,7 +1068,7 @@ gfxContext::RoundedRectangle(const gfxRect& rect,
     cairo_close_path (mCairo);
 }
 
-#ifdef DEBUG
+#ifdef MOZ_DUMP_PAINTING
 void
 gfxContext::WriteAsPNG(const char* aFile)
 { 
diff --git a/gfx/thebes/gfxContext.h b/gfx/thebes/gfxContext.h
index fdc9d4d6502..bb20f1683eb 100644
--- a/gfx/thebes/gfxContext.h
+++ b/gfx/thebes/gfxContext.h
@@ -681,7 +681,7 @@ public:
     void ClearFlag(PRInt32 aFlag) { mFlags &= ~aFlag; }
     PRInt32 GetFlags() const { return mFlags; }
 
-#ifdef DEBUG
+#ifdef MOZ_DUMP_PAINTING
     /**
      * Debug functions to encode the current surface as a PNG and export it.
      */
diff --git a/gfx/thebes/gfxUtils.cpp b/gfx/thebes/gfxUtils.cpp
index 48d4eec46fe..ac1073839d2 100644
--- a/gfx/thebes/gfxUtils.cpp
+++ b/gfx/thebes/gfxUtils.cpp
@@ -49,6 +49,7 @@
 
 using namespace mozilla;
 using namespace mozilla::layers;
+using namespace mozilla::gfx;
 
 static PRUint8 sUnpremultiplyTable[256*256];
 static PRUint8 sPremultiplyTable[256*256];
@@ -655,3 +656,41 @@ gfxUtils::ConvertYCbCrToRGB(const PlanarYCbCrImage::Data& aData,
                                yuvtype);
   }
 }
+
+#ifdef MOZ_DUMP_PAINTING
+/* static */ void
+gfxUtils::WriteAsPNG(DrawTarget* aDT, const char* aFile)
+{
+  aDT->Flush();
+  nsRefPtr<gfxASurface> surf = gfxPlatform::GetPlatform()->GetThebesSurfaceForDrawTarget(aDT);
+  if (surf) {
+    surf->WriteAsPNG(aFile);
+  } else {
+    NS_WARNING("Failed to get Thebes surface!");
+  }
+}
+
+/* static */ void
+gfxUtils::DumpAsDataURL(DrawTarget* aDT)
+{
+  aDT->Flush();
+  nsRefPtr<gfxASurface> surf = gfxPlatform::GetPlatform()->GetThebesSurfaceForDrawTarget(aDT);
+  if (surf) {
+    surf->DumpAsDataURL();
+  } else {
+    NS_WARNING("Failed to get Thebes surface!");
+  }
+}
+
+/* static */ void
+gfxUtils::CopyAsDataURL(DrawTarget* aDT)
+{
+  aDT->Flush();
+  nsRefPtr<gfxASurface> surf = gfxPlatform::GetPlatform()->GetThebesSurfaceForDrawTarget(aDT);
+  if (surf) {
+    surf->CopyAsDataURL();
+  } else {
+    NS_WARNING("Failed to get Thebes surface!");
+  }
+}
+#endif
diff --git a/gfx/thebes/gfxUtils.h b/gfx/thebes/gfxUtils.h
index a4f5c43c11e..5da826fa793 100644
--- a/gfx/thebes/gfxUtils.h
+++ b/gfx/thebes/gfxUtils.h
@@ -42,6 +42,7 @@
 #include "gfxPattern.h"
 #include "gfxImageSurface.h"
 #include "ImageLayers.h"
+#include "mozilla/gfx/2D.h"
 
 class gfxDrawable;
 class nsIntRegion;
@@ -150,6 +151,23 @@ public:
                       const gfxIntSize& aDestSize,
                       unsigned char* aDestBuffer,
                       PRInt32 aStride);
+
+#ifdef MOZ_DUMP_PAINTING
+    /**
+     * Writes a binary PNG file.
+     */
+    static void WriteAsPNG(mozilla::gfx::DrawTarget* aDT, const char* aFile);
+
+    /**
+     * Write as a PNG encoded Data URL to stdout.
+     */
+    static void DumpAsDataURL(mozilla::gfx::DrawTarget* aDT);
+
+    /**
+     * Copy a PNG encoded Data URL to the clipboard.
+     */
+    static void CopyAsDataURL(mozilla::gfx::DrawTarget* aDT);
+#endif
 };
 
 #endif
diff --git a/gfx/thebes/nsCoreAnimationSupport.h b/gfx/thebes/nsCoreAnimationSupport.h
index c4391e5e2ba..aa467d2bb0e 100644
--- a/gfx/thebes/nsCoreAnimationSupport.h
+++ b/gfx/thebes/nsCoreAnimationSupport.h
@@ -93,6 +93,8 @@ public:
   static void SaveToDisk(nsIOSurface *surf);
 #endif
 private:
+  void SetBounds(int aWidth, int aHeight);
+  void SetViewport(int aWidth, int aHeight);
   void Destroy();
 
   void *mCARenderer;
diff --git a/gfx/thebes/nsCoreAnimationSupport.mm b/gfx/thebes/nsCoreAnimationSupport.mm
index 30d10037f09..36311e8022b 100644
--- a/gfx/thebes/nsCoreAnimationSupport.mm
+++ b/gfx/thebes/nsCoreAnimationSupport.mm
@@ -491,26 +491,8 @@ nsresult nsCARenderer::SetupRenderer(void *aCALayer, int aWidth, int aHeight,
     return NS_ERROR_FAILURE;
   }
 
-  // Create a transaction and disable animations
-  // to make the position update instant.
-  [CATransaction begin];
-  NSMutableDictionary *newActions = [[NSMutableDictionary alloc] initWithObjectsAndKeys:[NSNull null], @"onOrderIn",
-                                   [NSNull null], @"onOrderOut",
-                                   [NSNull null], @"sublayers",
-                                   [NSNull null], @"contents",
-                                   [NSNull null], @"position",
-                                   [NSNull null], @"bounds",
-                                   nil];
-  layer.actions = newActions;
-  [newActions release];
-
-  [CATransaction setValue: [NSNumber numberWithFloat:0.0f] forKey: kCATransactionAnimationDuration];
-  [CATransaction setValue: (id) kCFBooleanTrue forKey: kCATransactionDisableActions];
-  [layer setBounds:CGRectMake(0, 0, aWidth, aHeight)];
-  [layer setPosition:CGPointMake(aWidth/2.0, aHeight/2.0)];
   caRenderer.layer = layer;
-  caRenderer.bounds = CGRectMake(0, 0, aWidth, aHeight);
-  [CATransaction commit];
+  SetBounds(aWidth, aHeight);
 
   // We target rendering to a CGImage if no shared IOSurface are given.
   if (!mIOSurface) {
@@ -599,14 +581,7 @@ nsresult nsCARenderer::SetupRenderer(void *aCALayer, int aWidth, int aHeight,
     return NS_ERROR_FAILURE;
   }
 
-  ::glViewport(0.0, 0.0, aWidth, aHeight);
-  ::glMatrixMode(GL_PROJECTION);
-  ::glLoadIdentity();
-  ::glOrtho (0.0, aWidth, 0.0, aHeight, -1, 1);
-
-  // Render upside down to speed up CGContextDrawImage
-  ::glTranslatef(0.0f, aHeight, 0.0);
-  ::glScalef(1.0, -1.0, 1.0);
+  SetViewport(aWidth, aHeight);
 
   GLenum result = ::glGetError();
   if (result != GL_NO_ERROR) {
@@ -625,21 +600,83 @@ nsresult nsCARenderer::SetupRenderer(void *aCALayer, int aWidth, int aHeight,
   return NS_OK;
 }
 
+void nsCARenderer::SetBounds(int aWidth, int aHeight) {
+  CARenderer* caRenderer = (CARenderer*)mCARenderer;
+  CALayer* layer = [mCARenderer layer];
+
+  // Create a transaction and disable animations
+  // to make the position update instant.
+  [CATransaction begin];
+  NSMutableDictionary *newActions = [[NSMutableDictionary alloc] initWithObjectsAndKeys:[NSNull null], @"onOrderIn",
+                                   [NSNull null], @"onOrderOut",
+                                   [NSNull null], @"sublayers",
+                                   [NSNull null], @"contents",
+                                   [NSNull null], @"position",
+                                   [NSNull null], @"bounds",
+                                   nil];
+  layer.actions = newActions;
+  [newActions release];
+
+  [CATransaction setValue: [NSNumber numberWithFloat:0.0f] forKey: kCATransactionAnimationDuration];
+  [CATransaction setValue: (id) kCFBooleanTrue forKey: kCATransactionDisableActions];
+  [layer setBounds:CGRectMake(0, 0, aWidth, aHeight)];
+  [layer setPosition:CGPointMake(aWidth/2.0, aHeight/2.0)];
+  caRenderer.bounds = CGRectMake(0, 0, aWidth, aHeight);
+  [CATransaction commit];
+
+}
+
+void nsCARenderer::SetViewport(int aWidth, int aHeight) {
+  ::glViewport(0.0, 0.0, aWidth, aHeight);
+  ::glMatrixMode(GL_PROJECTION);
+  ::glLoadIdentity();
+  ::glOrtho (0.0, aWidth, 0.0, aHeight, -1, 1);
+
+  // Render upside down to speed up CGContextDrawImage
+  ::glTranslatef(0.0f, aHeight, 0.0);
+  ::glScalef(1.0, -1.0, 1.0);
+}
+
 void nsCARenderer::AttachIOSurface(nsRefPtr<nsIOSurface> aSurface) {
-  if (mIOSurface && 
+  if (mIOSurface &&
       aSurface->GetIOSurfaceID() == mIOSurface->GetIOSurfaceID()) {
     // This object isn't needed since we already have a
     // handle to the same io surface.
     aSurface = nsnull;
     return;
   }
-  if (mCARenderer) {
-    // We are attaching a larger IOSurface, we need to
-    // resize our elements.
-    Destroy(); 
-  }
 
   mIOSurface = aSurface;
+
+  // Update the framebuffer and viewport
+  if (mCARenderer) {
+    CARenderer* caRenderer = (CARenderer*)mCARenderer;
+    int width = caRenderer.bounds.size.width;
+    int height = caRenderer.bounds.size.height;
+
+    CGLContextObj oldContext = ::CGLGetCurrentContext();
+    ::CGLSetCurrentContext(mOpenGLContext);
+    ::glBindTexture(GL_TEXTURE_RECTANGLE_ARB, mIOTexture);
+    nsIOSurfaceLib::CGLTexImageIOSurface2D(mOpenGLContext, GL_TEXTURE_RECTANGLE_ARB,
+                                           GL_RGBA, mIOSurface->GetWidth(), mIOSurface->GetHeight(),
+                                           GL_BGRA, GL_UNSIGNED_INT_8_8_8_8_REV,
+                                           mIOSurface->mIOSurfacePtr, 0);
+    ::glBindTexture(GL_TEXTURE_RECTANGLE_ARB, 0);
+
+    // Rebind the FBO to make it live
+    ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, mFBO);
+
+    if (mIOSurface->GetWidth() != width || mIOSurface->GetHeight() != height) {
+      width = mIOSurface->GetWidth();
+      height = mIOSurface->GetHeight();
+      SetBounds(width, height);
+      SetViewport(width, height);
+    }
+
+    if (oldContext) {
+      ::CGLSetCurrentContext(oldContext);
+    }
+  }
 }
 
 IOSurfaceID nsCARenderer::GetIOSurfaceID() {
@@ -841,7 +878,7 @@ void nsCARenderer::SaveToDisk(nsIOSurface *surf) {
   CFURLRef url = ::CFURLCreateWithString( NULL, cfStr, NULL);
 
   CFStringRef type = kUTTypePNG;
-  size_t count = 1; 
+  size_t count = 1;
   CFDictionaryRef options = NULL;
   CGImageDestinationRef dest = ::CGImageDestinationCreateWithURL(url, type, count, options);
 
diff --git a/image/decoders/nsBMPDecoder.cpp b/image/decoders/nsBMPDecoder.cpp
index eca01914968..67367ebe021 100644
--- a/image/decoders/nsBMPDecoder.cpp
+++ b/image/decoders/nsBMPDecoder.cpp
@@ -379,14 +379,17 @@ nsBMPDecoder::WriteInternal(const char* aBuffer, PRUint32 aCount)
         // Tell the superclass we're starting a frame
         PostFrameStart();
     }
-    PRUint8 bpc; // bytes per color
-    bpc = (mBFH.bihsize == OS2_BIH_LENGTH) ? 3 : 4; // OS/2 Bitmaps have no padding byte
-    if (mColors && (mPos >= mLOH && (mPos < (mLOH + mNumColors * bpc)))) {
-        // We will receive (mNumColors * bpc) bytes of color data
-        PRUint32 colorBytes = mPos - mLOH; // Number of bytes already received
-        PRUint8 colorNum = colorBytes / bpc; // Color which is currently received
-        PRUint8 at = colorBytes % bpc;
-        while (aCount && (mPos < (mLOH + mNumColors * bpc))) {
+
+    if (mColors && mPos >= mLOH) {
+      // OS/2 Bitmaps have no padding byte
+      PRUint8 bytesPerColor = (mBFH.bihsize == OS2_BIH_LENGTH) ? 3 : 4;
+      if (mPos < (mLOH + mNumColors * bytesPerColor)) {
+        // Number of bytes already received
+        PRUint32 colorBytes = mPos - mLOH; 
+        // Color which is currently received
+        PRUint8 colorNum = colorBytes / bytesPerColor;
+        PRUint8 at = colorBytes % bytesPerColor;
+        while (aCount && (mPos < (mLOH + mNumColors * bytesPerColor))) {
             switch (at) {
                 case 0:
                     mColors[colorNum].blue = *aBuffer;
@@ -403,8 +406,9 @@ nsBMPDecoder::WriteInternal(const char* aBuffer, PRUint32 aCount)
                     break;
             }
             mPos++; aBuffer++; aCount--;
-            at = (at + 1) % bpc;
+            at = (at + 1) % bytesPerColor;
         }
+      }
     }
     else if (aCount && mBIH.compression == BI_BITFIELDS && mPos < (WIN_HEADER_LENGTH + BITFIELD_LENGTH)) {
         // If compression is used, this is a windows bitmap, hence we can
diff --git a/image/test/mochitest/animationPolling.js b/image/test/mochitest/animationPolling.js
index 29d0dcd1139..53c18d73d3d 100644
--- a/image/test/mochitest/animationPolling.js
+++ b/image/test/mochitest/animationPolling.js
@@ -1,5 +1,4 @@
 var currentTest;
-var gIsImageLoaded = false;
 var gIsRefImageLoaded = false;
 
 function pollForSuccess ()
@@ -14,11 +13,6 @@ function pollForSuccess ()
   }
 };
 
-function imageLoadCallback()
-{
-  gIsImageLoaded = true;
-}
-
 function referencePoller()
 {
   currentTest.takeReferenceSnapshot();
@@ -30,7 +24,8 @@ function reuseImageCallback()
 }
 
 function failTest ()
-{
+{    imageLoadCallback();
+
   if (currentTest.isTestFinished || currentTest.closeFunc) {
     return;
   }
@@ -110,15 +105,18 @@ function AnimationTest(pollFreq, timeout, referenceElementId, imageElementId,
   this.cleanId = cleanId ? cleanId : '';
   this.xulTest = xulTest ? xulTest : '';
   this.closeFunc = closeFunc ? closeFunc : '';
+};
 
+AnimationTest.prototype.preloadImage = function()
+{
   if (this.srcAttr) {
     this.myImage = new Image();
-    this.myImage.onload = imageLoadCallback;
+    this.myImage.onload = function() { currentTest.continueTest(); };
     this.myImage.src = this.srcAttr;
   } else {
-    gIsImageLoaded = true;
+    this.continueTest();
   }
-}
+};
 
 AnimationTest.prototype.outputDebugInfo = function(message, id, dataUri)
 {
@@ -176,16 +174,25 @@ AnimationTest.prototype.takeBlankSnapshot = function()
 /**
  * Begin the AnimationTest. This will utilize the information provided in the
  * constructor to invoke a mochitest on animated images. It will automatically
- * fail if allowed to run past the timeout.
+ * fail if allowed to run past the timeout. This will attempt to preload an
+ * image, if applicable, and then asynchronously call continueTest(), or if not
+ * applicable, synchronously trigger a call to continueTest().
  */
-AnimationTest.prototype.beginTest = function ()
+AnimationTest.prototype.beginTest = function()
 {
   SimpleTest.waitForExplicitFinish();
 
   currentTest = this;
+  this.preloadImage();
+};
 
-  this.takeReferenceSnapshot();
-
+/**
+ * This is the second part of the test. It is triggered (eventually) from
+ * beginTest() either synchronously or asynchronously, as an image load
+ * callback.
+ */
+AnimationTest.prototype.continueTest = function()
+{
   // In case something goes wrong, fail earlier than mochitest timeout,
   // and with more information.
   setTimeout(failTest, this.timeout);
@@ -194,6 +201,7 @@ AnimationTest.prototype.beginTest = function ()
     this.disableDisplay(document.getElementById(this.imageElementId));
   }
 
+  this.takeReferenceSnapshot();
   this.setupPolledImage();
   setTimeout(pollForSuccess, 10);
 };
@@ -273,6 +281,7 @@ AnimationTest.prototype.takeReferenceSnapshot = function ()
     this.enableDisplay(referenceDiv);
 
     this.referenceSnapshot = snapshotWindow(window, false);
+
     var snapResult = compareSnapshots(this.cleanSnapshot, this.referenceSnapshot,
                                       false);
     if (!snapResult[0]) {
diff --git a/image/test/mochitest/test_svg_animatedGIF.html b/image/test/mochitest/test_svg_animatedGIF.html
index d7889726d1f..d21ab10c66c 100644
--- a/image/test/mochitest/test_svg_animatedGIF.html
+++ b/image/test/mochitest/test_svg_animatedGIF.html
@@ -40,7 +40,7 @@ const FAILURE_TIMEOUT = 120000; // Fail early after 120 seconds (2 minutes)
 
 function main() {
   var animTest = new AnimationTest(20, FAILURE_TIMEOUT, 'referenceDiv',
-      							   'embeddedSVG', 'debug', '', 'src');
+                                   'embeddedSVG', 'debug', '');
   animTest.beginTest();
 }
 
diff --git a/image/test/mochitest/test_svg_filter_animation.html b/image/test/mochitest/test_svg_filter_animation.html
index c58505416a2..13ec65654dc 100644
--- a/image/test/mochitest/test_svg_filter_animation.html
+++ b/image/test/mochitest/test_svg_filter_animation.html
@@ -30,7 +30,7 @@ const FAILURE_TIMEOUT = 120000; // Fail early after 120 seconds (2 minutes)
 
 function main() {
   var animTest = new AnimationTest(20, FAILURE_TIMEOUT, 'referenceImage',
-                       'embeddedSVGFilt', 'debug', '', 'src');
+                                   'embeddedSVGFilt', 'debug', '');
   animTest.beginTest();
 }
 
diff --git a/ipc/ipdl/ipdl/lower.py b/ipc/ipdl/ipdl/lower.py
index ff47ab14ab7..d482be8c636 100644
--- a/ipc/ipdl/ipdl/lower.py
+++ b/ipc/ipdl/ipdl/lower.py
@@ -3367,7 +3367,7 @@ class _GenerateProtocolActorCode(ipdl.ast.Visitor):
             # SharedMemory* CreateSharedMemory(size, type, bool, id_t*):
             #   nsAutoPtr<SharedMemory> seg(Shmem::Alloc(size, type, unsafe));
             #   if (!shmem)
-            #     return false
+            #     return null;
             #   Shmem s(seg, [nextshmemid]);
             #   Message descriptor;
             #   if (!s->ShareTo(subprocess, mId, descriptor) ||
@@ -3395,7 +3395,7 @@ class _GenerateProtocolActorCode(ipdl.ast.Visitor):
                                             p.routingId()))
             ])
             failif = StmtIf(ExprNot(descriptorvar))
-            failif.addifstmt(StmtReturn.FALSE)
+            failif.addifstmt(StmtReturn(ExprLiteral.NULL))
             createshmem.addstmt(failif)
 
             failif = StmtIf(ExprNot(ExprCall(
diff --git a/js/src/Makefile.in b/js/src/Makefile.in
index e0e4bfbf01e..0b80434d0ea 100644
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -283,6 +283,7 @@ VPATH		+= \
 EXPORTS_NAMESPACES += mozilla
 
 EXPORTS_mozilla = \
+		GuardObjects.h \
 		RangedPtr.h \
 		RefPtr.h \
 		Types.h	\
diff --git a/js/src/gc/Statistics.cpp b/js/src/gc/Statistics.cpp
index 170739d60b1..7c3a998bd2a 100644
--- a/js/src/gc/Statistics.cpp
+++ b/js/src/gc/Statistics.cpp
@@ -118,6 +118,7 @@ Statistics::makeTable(ColumnInfo *cols)
 
 Statistics::Statistics(JSRuntime *rt)
   : runtime(rt)
+  , triggerReason(PUBLIC_API) //dummy reason to satisfy makeTable
 {
     char *env = getenv("MOZ_GCTIMER");
     if (!env || strcmp(env, "none") == 0) {
diff --git a/js/src/jit-test/tests/basic/bug702426-regexp-gc.js b/js/src/jit-test/tests/basic/bug702426-regexp-gc.js
new file mode 100644
index 00000000000..206e2fd9579
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug702426-regexp-gc.js
@@ -0,0 +1,5 @@
+function g(code) {
+    eval("(function(){" + code + "})")()
+}
+g("evalcx(\"(/a/g,function(){})\")");
+g("'a'.replace(/a/g,gc)")
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index e5adf9d3373..6d33ff74dae 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -723,6 +723,8 @@ JSRuntime::JSRuntime()
     functionNamespaceObject(NULL),
 #ifdef JS_THREADSAFE
     interruptCounter(0),
+#else
+    threadData(thisFromCtor()),
 #endif
     trustedPrincipals_(NULL),
     shapeGen(0),
diff --git a/js/src/jscntxt.cpp b/js/src/jscntxt.cpp
index 5a8c1e3f70a..ac3a1ed2d11 100644
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -87,6 +87,7 @@
 #endif
 #include "frontend/TokenStream.h"
 #include "frontend/ParseMaps.h"
+#include "yarr/BumpPointerAllocator.h"
 
 #include "jsatominlines.h"
 #include "jscntxtinlines.h"
@@ -98,8 +99,9 @@ using namespace js::gc;
 
 namespace js {
 
-ThreadData::ThreadData()
-  : interruptFlags(0),
+ThreadData::ThreadData(JSRuntime *rt)
+  : rt(rt),
+    interruptFlags(0),
 #ifdef JS_THREADSAFE
     requestDepth(0),
 #endif
@@ -111,6 +113,8 @@ ThreadData::ThreadData()
 #endif
     waiveGCQuota(false),
     tempLifoAlloc(TEMP_LIFO_ALLOC_PRIMARY_CHUNK_SIZE),
+    execAlloc(NULL),
+    bumpAlloc(NULL),
     repCache(NULL),
     dtoaState(NULL),
     nativeStackBase(GetNativeStackBase()),
@@ -126,6 +130,9 @@ ThreadData::~ThreadData()
 {
     JS_ASSERT(!repCache);
 
+    rt->delete_<JSC::ExecutableAllocator>(execAlloc);
+    rt->delete_<WTF::BumpPointerAllocator>(bumpAlloc);
+
     if (dtoaState)
         js_DestroyDtoaState(dtoaState);
 }
@@ -140,6 +147,8 @@ ThreadData::init()
 void
 ThreadData::triggerOperationCallback(JSRuntime *rt)
 {
+    JS_ASSERT(rt == this->rt);
+
     /*
      * Use JS_ATOMIC_SET and JS_ATOMIC_INCREMENT in the hope that it ensures
      * the write will become immediately visible to other processors polling
@@ -157,13 +166,40 @@ ThreadData::triggerOperationCallback(JSRuntime *rt)
 #endif
 }
 
+JSC::ExecutableAllocator *
+ThreadData::createExecutableAllocator(JSContext *cx)
+{
+    JS_ASSERT(!execAlloc);
+    JS_ASSERT(cx->runtime == rt);
+
+    execAlloc = rt->new_<JSC::ExecutableAllocator>();
+    if (!execAlloc)
+        js_ReportOutOfMemory(cx);
+    return execAlloc;
+}
+
+WTF::BumpPointerAllocator *
+ThreadData::createBumpPointerAllocator(JSContext *cx)
+{
+    JS_ASSERT(!bumpAlloc);
+    JS_ASSERT(cx->runtime == rt);
+
+    bumpAlloc = rt->new_<WTF::BumpPointerAllocator>();
+    if (!bumpAlloc)
+        js_ReportOutOfMemory(cx);
+    return bumpAlloc;
+}
+
 RegExpPrivateCache *
-ThreadData::createRegExpPrivateCache(JSRuntime *rt)
+ThreadData::createRegExpPrivateCache(JSContext *cx)
 {
     JS_ASSERT(!repCache);
+    JS_ASSERT(cx->runtime == rt);
+
     RegExpPrivateCache *newCache = rt->new_<RegExpPrivateCache>(rt);
 
     if (!newCache || !newCache->init()) {
+        js_ReportOutOfMemory(cx);
         rt->delete_<RegExpPrivateCache>(newCache);
         return NULL;
     }
@@ -173,7 +209,7 @@ ThreadData::createRegExpPrivateCache(JSRuntime *rt)
 }
 
 void
-ThreadData::purgeRegExpPrivateCache(JSRuntime *rt)
+ThreadData::purgeRegExpPrivateCache()
 {
     rt->delete_<RegExpPrivateCache>(repCache);
     repCache = NULL;
@@ -223,7 +259,7 @@ js_CurrentThreadAndLockGC(JSRuntime *rt)
     } else {
         JS_UNLOCK_GC(rt);
 
-        thread = OffTheBooks::new_<JSThread>(id);
+        thread = OffTheBooks::new_<JSThread>(rt, id);
         if (!thread || !thread->init()) {
             Foreground::delete_(thread);
             return NULL;
@@ -352,10 +388,10 @@ js_PurgeThreads_PostGlobalSweep(JSContext *cx)
         JSThread *thread = e.front().value;
 
         JS_ASSERT(!JS_CLIST_IS_EMPTY(&thread->contextList));
-        thread->data.purgeRegExpPrivateCache(cx->runtime);
+        thread->data.purgeRegExpPrivateCache();
     }
 #else
-    cx->runtime->threadData.purgeRegExpPrivateCache(cx->runtime);
+    cx->runtime->threadData.purgeRegExpPrivateCache();
 #endif
 }
 
diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index 7b6c7505f31..f91e02499e9 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -153,6 +153,8 @@ struct PendingProxyOperation {
 };
 
 struct ThreadData {
+    JSRuntime           *rt;
+
     /*
      * If non-zero, we were been asked to call the operation callback as soon
      * as possible.  If the thread has an active request, this contributes
@@ -198,23 +200,45 @@ struct ThreadData {
     LifoAlloc           tempLifoAlloc;
 
   private:
-    js::RegExpPrivateCache       *repCache;
+    /*
+     * Both of these allocators are used for regular expression code which is shared at the
+     * thread-data level.
+     */
+    JSC::ExecutableAllocator    *execAlloc;
+    WTF::BumpPointerAllocator   *bumpAlloc;
+    js::RegExpPrivateCache      *repCache;
 
-    js::RegExpPrivateCache *createRegExpPrivateCache(JSRuntime *rt);
+    JSC::ExecutableAllocator *createExecutableAllocator(JSContext *cx);
+    WTF::BumpPointerAllocator *createBumpPointerAllocator(JSContext *cx);
+    js::RegExpPrivateCache *createRegExpPrivateCache(JSContext *cx);
 
   public:
-    js::RegExpPrivateCache *getRegExpPrivateCache() { return repCache; }
+    JSC::ExecutableAllocator *getOrCreateExecutableAllocator(JSContext *cx) {
+        if (execAlloc)
+            return execAlloc;
 
-    /* N.B. caller is responsible for reporting OOM. */
-    js::RegExpPrivateCache *getOrCreateRegExpPrivateCache(JSRuntime *rt) {
+        return createExecutableAllocator(cx);
+    }
+
+    WTF::BumpPointerAllocator *getOrCreateBumpPointerAllocator(JSContext *cx) {
+        if (bumpAlloc)
+            return bumpAlloc;
+
+        return createBumpPointerAllocator(cx);
+    }
+
+    js::RegExpPrivateCache *getRegExpPrivateCache() {
+        return repCache;
+    }
+    js::RegExpPrivateCache *getOrCreateRegExpPrivateCache(JSContext *cx) {
         if (repCache)
             return repCache;
 
-        return createRegExpPrivateCache(rt);
+        return createRegExpPrivateCache(cx);
     }
 
     /* Called at the end of the global GC sweep phase to deallocate repCache memory. */
-    void purgeRegExpPrivateCache(JSRuntime *rt);
+    void purgeRegExpPrivateCache();
 
     /*
      * The GSN cache is per thread since even multi-cx-per-thread embeddings
@@ -240,7 +264,7 @@ struct ThreadData {
     size_t              noGCOrAllocationCheck;
 #endif
 
-    ThreadData();
+    ThreadData(JSRuntime *rt);
     ~ThreadData();
 
     bool init();
@@ -297,12 +321,13 @@ struct JSThread {
     /* Factored out of JSThread for !JS_THREADSAFE embedding in JSRuntime. */
     js::ThreadData      data;
 
-    JSThread(void *id)
+    JSThread(JSRuntime *rt, void *id)
       : id(id),
-        suspendCount(0)
+        suspendCount(0),
 # ifdef DEBUG
-      , checkRequestDepth(0)
+        checkRequestDepth(0),
 # endif
+        data(rt)
     {
         JS_INIT_CLIST(&contextList);
     }
diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index 4a52f7ef559..d49993b7e40 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -87,9 +87,6 @@ JSCompartment::JSCompartment(JSRuntime *rt)
     hasDebugModeCodeToDrop(false),
 #ifdef JS_METHODJIT
     jaegerCompartment_(NULL),
-#endif
-#if ENABLE_YARR_JIT
-    regExpAllocator(NULL),
 #endif
     propertyTree(thisForCtor()),
     emptyArgumentsShape(NULL),
@@ -110,10 +107,6 @@ JSCompartment::JSCompartment(JSRuntime *rt)
 
 JSCompartment::~JSCompartment()
 {
-#if ENABLE_YARR_JIT
-    Foreground::delete_(regExpAllocator);
-#endif
-
 #ifdef JS_METHODJIT
     Foreground::delete_(jaegerCompartment_);
 #endif
@@ -143,10 +136,6 @@ JSCompartment::init(JSContext *cx)
     if (!scriptFilenameTable.init())
         return false;
 
-    regExpAllocator = rt->new_<WTF::BumpPointerAllocator>();
-    if (!regExpAllocator)
-        return false;
-
     if (!backEdgeTable.init())
         return false;
 
diff --git a/js/src/jscompartment.h b/js/src/jscompartment.h
index c01476833be..a253314756f 100644
--- a/js/src/jscompartment.h
+++ b/js/src/jscompartment.h
@@ -53,9 +53,6 @@
 #pragma warning(disable:4251) /* Silence warning about JS_FRIEND_API and data members. */
 #endif
 
-namespace JSC { class ExecutableAllocator; }
-namespace WTF { class BumpPointerAllocator; }
-
 namespace js {
 
 /* Holds the number of recording attemps for an address. */
@@ -423,7 +420,7 @@ struct JS_FRIEND_API(JSCompartment) {
      * Cleared on every GC, unless the GC happens during analysis (indicated
      * by activeAnalysis, which is implied by activeInference).
      */
-    static const size_t TYPE_LIFO_ALLOC_PRIMARY_CHUNK_SIZE = 1 << 12;
+    static const size_t TYPE_LIFO_ALLOC_PRIMARY_CHUNK_SIZE = 256 * 1024;
     js::LifoAlloc                typeLifoAlloc;
     bool                         activeAnalysis;
     bool                         activeInference;
@@ -473,7 +470,6 @@ struct JS_FRIEND_API(JSCompartment) {
 
     void getMjitCodeStats(size_t& method, size_t& regexp, size_t& unused) const;
 #endif
-    WTF::BumpPointerAllocator    *regExpAllocator;
 
     /*
      * Shared scope property tree, and arena-pool for allocating its nodes.
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 07dc9f48bef..723a78a127d 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -1947,7 +1947,7 @@ AutoGCRooter::trace(JSTracer *trc)
       case NAMESPACES: {
         JSXMLArray<JSObject> &array = static_cast<AutoNamespaceArray *>(this)->array;
         MarkObjectRange(trc, array.length, array.vector, "JSXMLArray.vector");
-        array.cursors->trace(trc);
+        js_XMLArrayCursorTrace(trc, array.cursors);
         return;
       }
 
@@ -2400,36 +2400,32 @@ DecommitFreePages(JSContext *cx)
 
     for (GCChunkSet::Range r(rt->gcChunkSet.all()); !r.empty(); r.popFront()) {
         Chunk *chunk = r.front();
-        while (chunk) {
-            ArenaHeader *aheader = static_cast<ArenaHeader*>(chunk->info.freeArenasHead);
+        ArenaHeader *aheader = chunk->info.freeArenasHead;
 
-            /*
-             * In the non-failure case, the list will be gone at the end of
-             * the loop. In the case where we fail, we relink all failed
-             * decommits into a new list on freeArenasHead.
-             */
-            chunk->info.freeArenasHead = NULL;
+        /*
+         * In the non-failure case, the list will be gone at the end of
+         * the loop. In the case where we fail, we relink all failed
+         * decommits into a new list on freeArenasHead.
+         */
+        chunk->info.freeArenasHead = NULL;
 
-            while (aheader) {
-                /* Store aside everything we will need after decommit. */
-                ArenaHeader *next = aheader->next;
+        while (aheader) {
+            /* Store aside everything we will need after decommit. */
+            ArenaHeader *next = aheader->next;
 
-                bool success = DecommitMemory(aheader, ArenaSize);
-                if (!success) {
-                    aheader->next = chunk->info.freeArenasHead;
-                    chunk->info.freeArenasHead = aheader;
-                    continue;
-                }
-
-                size_t arenaOffset = Chunk::arenaIndex(reinterpret_cast<uintptr_t>(aheader));
-                chunk->decommittedArenas.set(arenaOffset);
-                --chunk->info.numArenasFreeCommitted;
-                --rt->gcNumFreeArenas;
-
-                aheader = next;
+            bool success = DecommitMemory(aheader, ArenaSize);
+            if (!success) {
+                aheader->next = chunk->info.freeArenasHead;
+                chunk->info.freeArenasHead = aheader;
+                continue;
             }
 
-            chunk = chunk->info.next;
+            size_t arenaIndex = Chunk::arenaIndex(aheader->arenaAddress());
+            chunk->decommittedArenas.set(arenaIndex);
+            --chunk->info.numArenasFreeCommitted;
+            --rt->gcNumFreeArenas;
+
+            aheader = next;
         }
     }
 }
diff --git a/js/src/jsgcmark.h b/js/src/jsgcmark.h
index b9205416dae..ef8cd5a2724 100644
--- a/js/src/jsgcmark.h
+++ b/js/src/jsgcmark.h
@@ -210,6 +210,12 @@ Mark(JSTracer *trc, const MarkablePtr<JSObject> &o, const char *name)
     MarkObject(trc, o, name);
 }
 
+inline void
+Mark(JSTracer *trc, const MarkablePtr<JSXML> &xml, const char *name)
+{
+    MarkXML(trc, xml, name);
+}
+
 inline bool
 IsMarked(JSContext *cx, const js::Value &v)
 {
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 1b5ad439aa3..14e26e1cf54 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -501,7 +501,6 @@ static JSBool
 obj_toSource(JSContext *cx, uintN argc, Value *vp)
 {
     JSBool ok;
-    JSHashEntry *he;
     JSIdArray *ida;
     jschar *chars, *ochars, *vsharp;
     const jschar *idstrchars, *vchars;
@@ -527,10 +526,10 @@ obj_toSource(JSContext *cx, uintN argc, Value *vp)
     if (!obj)
         return false;
 
-    if (!(he = js_EnterSharpObject(cx, obj, &ida, &chars))) {
-        ok = JS_FALSE;
-        goto out;
-    }
+    JSHashEntry *he = js_EnterSharpObject(cx, obj, &ida, &chars);
+    if (!he)
+        return false;
+
     if (!ida) {
         /*
          * We didn't enter -- obj is already "sharp", meaning we've visited it
@@ -816,25 +815,21 @@ obj_toSource(JSContext *cx, uintN argc, Value *vp)
     if (!ok) {
         if (chars)
             Foreground::free_(chars);
-        goto out;
+        return false;
     }
 
     if (!chars) {
         JS_ReportOutOfMemory(cx);
-        ok = JS_FALSE;
-        goto out;
+        return false;
     }
   make_string:
     str = js_NewString(cx, chars, nchars);
     if (!str) {
         cx->free_(chars);
-        ok = JS_FALSE;
-        goto out;
+        return false;
     }
     vp->setString(str);
-    ok = JS_TRUE;
-  out:
-    return ok;
+    return true;
 
   overflow:
     cx->free_(vsharp);
diff --git a/js/src/jsprvtd.h b/js/src/jsprvtd.h
index 2c6c29f7674..c55e9783d18 100644
--- a/js/src/jsprvtd.h
+++ b/js/src/jsprvtd.h
@@ -269,6 +269,18 @@ struct TypeCompartment;
 
 } /* namespace js */
 
+namespace JSC {
+
+class ExecutableAllocator;
+
+} /* namespace JSC */
+
+namespace WTF {
+
+class BumpPointerAllocator;
+
+} /* namespace WTF */
+
 } /* export "C++" */
 
 #else
diff --git a/js/src/jswrapper.h b/js/src/jswrapper.h
index 8577076ba99..19a37b60f54 100644
--- a/js/src/jswrapper.h
+++ b/js/src/jswrapper.h
@@ -42,6 +42,8 @@
 #ifndef jswrapper_h___
 #define jswrapper_h___
 
+#include "mozilla/Types.h"
+
 #include "jsapi.h"
 #include "jsproxy.h"
 
@@ -62,37 +64,37 @@ class JS_FRIEND_API(Wrapper) : public ProxyHandler
 
     /* ES5 Harmony fundamental wrapper traps. */
     virtual bool getPropertyDescriptor(JSContext *cx, JSObject *wrapper, jsid id, bool set,
-                                       PropertyDescriptor *desc);
+                                       PropertyDescriptor *desc) MOZ_OVERRIDE;
     virtual bool getOwnPropertyDescriptor(JSContext *cx, JSObject *wrapper, jsid id, bool set,
-                                          PropertyDescriptor *desc);
+                                          PropertyDescriptor *desc) MOZ_OVERRIDE;
     virtual bool defineProperty(JSContext *cx, JSObject *wrapper, jsid id,
-                                PropertyDescriptor *desc);
-    virtual bool getOwnPropertyNames(JSContext *cx, JSObject *wrapper, AutoIdVector &props);
-    virtual bool delete_(JSContext *cx, JSObject *wrapper, jsid id, bool *bp);
-    virtual bool enumerate(JSContext *cx, JSObject *wrapper, AutoIdVector &props);
-    virtual bool fix(JSContext *cx, JSObject *wrapper, Value *vp);
+                                PropertyDescriptor *desc) MOZ_OVERRIDE;
+    virtual bool getOwnPropertyNames(JSContext *cx, JSObject *wrapper, AutoIdVector &props) MOZ_OVERRIDE;
+    virtual bool delete_(JSContext *cx, JSObject *wrapper, jsid id, bool *bp) MOZ_OVERRIDE;
+    virtual bool enumerate(JSContext *cx, JSObject *wrapper, AutoIdVector &props) MOZ_OVERRIDE;
+    virtual bool fix(JSContext *cx, JSObject *wrapper, Value *vp) MOZ_OVERRIDE;
 
     /* ES5 Harmony derived wrapper traps. */
-    virtual bool has(JSContext *cx, JSObject *wrapper, jsid id, bool *bp);
-    virtual bool hasOwn(JSContext *cx, JSObject *wrapper, jsid id, bool *bp);
-    virtual bool get(JSContext *cx, JSObject *wrapper, JSObject *receiver, jsid id, Value *vp);
+    virtual bool has(JSContext *cx, JSObject *wrapper, jsid id, bool *bp) MOZ_OVERRIDE;
+    virtual bool hasOwn(JSContext *cx, JSObject *wrapper, jsid id, bool *bp) MOZ_OVERRIDE;
+    virtual bool get(JSContext *cx, JSObject *wrapper, JSObject *receiver, jsid id, Value *vp) MOZ_OVERRIDE;
     virtual bool set(JSContext *cx, JSObject *wrapper, JSObject *receiver, jsid id, bool strict,
-                     Value *vp);
-    virtual bool keys(JSContext *cx, JSObject *wrapper, AutoIdVector &props);
-    virtual bool iterate(JSContext *cx, JSObject *wrapper, uintN flags, Value *vp);
+                     Value *vp) MOZ_OVERRIDE;
+    virtual bool keys(JSContext *cx, JSObject *wrapper, AutoIdVector &props) MOZ_OVERRIDE;
+    virtual bool iterate(JSContext *cx, JSObject *wrapper, uintN flags, Value *vp) MOZ_OVERRIDE;
 
     /* Spidermonkey extensions. */
-    virtual bool call(JSContext *cx, JSObject *wrapper, uintN argc, Value *vp);
-    virtual bool construct(JSContext *cx, JSObject *wrapper, uintN argc, Value *argv, Value *rval);
-    virtual bool nativeCall(JSContext *cx, JSObject *wrapper, Class *clasp, Native native, CallArgs args);
-    virtual bool hasInstance(JSContext *cx, JSObject *wrapper, const Value *vp, bool *bp);
-    virtual JSType typeOf(JSContext *cx, JSObject *proxy);
-    virtual bool objectClassIs(JSObject *obj, ESClassValue classValue, JSContext *cx);
-    virtual JSString *obj_toString(JSContext *cx, JSObject *wrapper);
-    virtual JSString *fun_toString(JSContext *cx, JSObject *wrapper, uintN indent);
-    virtual bool defaultValue(JSContext *cx, JSObject *wrapper, JSType hint, Value *vp);
+    virtual bool call(JSContext *cx, JSObject *wrapper, uintN argc, Value *vp) MOZ_OVERRIDE;
+    virtual bool construct(JSContext *cx, JSObject *wrapper, uintN argc, Value *argv, Value *rval) MOZ_OVERRIDE;
+    virtual bool nativeCall(JSContext *cx, JSObject *wrapper, Class *clasp, Native native, CallArgs args) MOZ_OVERRIDE;
+    virtual bool hasInstance(JSContext *cx, JSObject *wrapper, const Value *vp, bool *bp) MOZ_OVERRIDE;
+    virtual JSType typeOf(JSContext *cx, JSObject *proxy) MOZ_OVERRIDE;
+    virtual bool objectClassIs(JSObject *obj, ESClassValue classValue, JSContext *cx) MOZ_OVERRIDE;
+    virtual JSString *obj_toString(JSContext *cx, JSObject *wrapper) MOZ_OVERRIDE;
+    virtual JSString *fun_toString(JSContext *cx, JSObject *wrapper, uintN indent) MOZ_OVERRIDE;
+    virtual bool defaultValue(JSContext *cx, JSObject *wrapper, JSType hint, Value *vp) MOZ_OVERRIDE;
 
-    virtual void trace(JSTracer *trc, JSObject *wrapper);
+    virtual void trace(JSTracer *trc, JSObject *wrapper) MOZ_OVERRIDE;
 
     /* Policy enforcement traps. */
     enum Action { GET, SET, CALL };
@@ -125,34 +127,34 @@ class JS_FRIEND_API(CrossCompartmentWrapper) : public Wrapper
 
     /* ES5 Harmony fundamental wrapper traps. */
     virtual bool getPropertyDescriptor(JSContext *cx, JSObject *wrapper, jsid id, bool set,
-                                       PropertyDescriptor *desc);
+                                       PropertyDescriptor *desc) MOZ_OVERRIDE;
     virtual bool getOwnPropertyDescriptor(JSContext *cx, JSObject *wrapper, jsid id, bool set,
-                                          PropertyDescriptor *desc);
+                                          PropertyDescriptor *desc) MOZ_OVERRIDE;
     virtual bool defineProperty(JSContext *cx, JSObject *wrapper, jsid id,
-                                PropertyDescriptor *desc);
-    virtual bool getOwnPropertyNames(JSContext *cx, JSObject *wrapper, AutoIdVector &props);
-    virtual bool delete_(JSContext *cx, JSObject *wrapper, jsid id, bool *bp);
-    virtual bool enumerate(JSContext *cx, JSObject *wrapper, AutoIdVector &props);
+                                PropertyDescriptor *desc) MOZ_OVERRIDE;
+    virtual bool getOwnPropertyNames(JSContext *cx, JSObject *wrapper, AutoIdVector &props) MOZ_OVERRIDE;
+    virtual bool delete_(JSContext *cx, JSObject *wrapper, jsid id, bool *bp) MOZ_OVERRIDE;
+    virtual bool enumerate(JSContext *cx, JSObject *wrapper, AutoIdVector &props) MOZ_OVERRIDE;
 
     /* ES5 Harmony derived wrapper traps. */
-    virtual bool has(JSContext *cx, JSObject *wrapper, jsid id, bool *bp);
-    virtual bool hasOwn(JSContext *cx, JSObject *wrapper, jsid id, bool *bp);
-    virtual bool get(JSContext *cx, JSObject *wrapper, JSObject *receiver, jsid id, Value *vp);
+    virtual bool has(JSContext *cx, JSObject *wrapper, jsid id, bool *bp) MOZ_OVERRIDE;
+    virtual bool hasOwn(JSContext *cx, JSObject *wrapper, jsid id, bool *bp) MOZ_OVERRIDE;
+    virtual bool get(JSContext *cx, JSObject *wrapper, JSObject *receiver, jsid id, Value *vp) MOZ_OVERRIDE;
     virtual bool set(JSContext *cx, JSObject *wrapper, JSObject *receiver, jsid id, bool strict,
-                     Value *vp);
-    virtual bool keys(JSContext *cx, JSObject *wrapper, AutoIdVector &props);
-    virtual bool iterate(JSContext *cx, JSObject *wrapper, uintN flags, Value *vp);
+                     Value *vp) MOZ_OVERRIDE;
+    virtual bool keys(JSContext *cx, JSObject *wrapper, AutoIdVector &props) MOZ_OVERRIDE;
+    virtual bool iterate(JSContext *cx, JSObject *wrapper, uintN flags, Value *vp) MOZ_OVERRIDE;
 
     /* Spidermonkey extensions. */
-    virtual bool call(JSContext *cx, JSObject *wrapper, uintN argc, Value *vp);
-    virtual bool construct(JSContext *cx, JSObject *wrapper, uintN argc, Value *argv, Value *rval);
-    virtual bool nativeCall(JSContext *cx, JSObject *wrapper, Class *clasp, Native native, CallArgs args);
-    virtual bool hasInstance(JSContext *cx, JSObject *wrapper, const Value *vp, bool *bp);
-    virtual JSString *obj_toString(JSContext *cx, JSObject *wrapper);
-    virtual JSString *fun_toString(JSContext *cx, JSObject *wrapper, uintN indent);
-    virtual bool defaultValue(JSContext *cx, JSObject *wrapper, JSType hint, Value *vp);
+    virtual bool call(JSContext *cx, JSObject *wrapper, uintN argc, Value *vp) MOZ_OVERRIDE;
+    virtual bool construct(JSContext *cx, JSObject *wrapper, uintN argc, Value *argv, Value *rval) MOZ_OVERRIDE;
+    virtual bool nativeCall(JSContext *cx, JSObject *wrapper, Class *clasp, Native native, CallArgs args) MOZ_OVERRIDE;
+    virtual bool hasInstance(JSContext *cx, JSObject *wrapper, const Value *vp, bool *bp) MOZ_OVERRIDE;
+    virtual JSString *obj_toString(JSContext *cx, JSObject *wrapper) MOZ_OVERRIDE;
+    virtual JSString *fun_toString(JSContext *cx, JSObject *wrapper, uintN indent) MOZ_OVERRIDE;
+    virtual bool defaultValue(JSContext *cx, JSObject *wrapper, JSType hint, Value *vp) MOZ_OVERRIDE;
 
-    virtual void trace(JSTracer *trc, JSObject *wrapper);
+    virtual void trace(JSTracer *trc, JSObject *wrapper) MOZ_OVERRIDE;
 
     static CrossCompartmentWrapper singleton;
 };
@@ -172,8 +174,8 @@ class JS_FRIEND_API(SecurityWrapper) : public Base
   public:
     SecurityWrapper(uintN flags);
 
-    virtual bool nativeCall(JSContext *cx, JSObject *wrapper, Class *clasp, Native native, CallArgs args);
-    virtual bool objectClassIs(JSObject *obj, ESClassValue classValue, JSContext *cx);
+    virtual bool nativeCall(JSContext *cx, JSObject *wrapper, Class *clasp, Native native, CallArgs args) MOZ_OVERRIDE;
+    virtual bool objectClassIs(JSObject *obj, ESClassValue classValue, JSContext *cx) MOZ_OVERRIDE;
 };
 
 typedef SecurityWrapper<Wrapper> SameCompartmentSecurityWrapper;
diff --git a/js/src/jsxml.cpp b/js/src/jsxml.cpp
index 8075d73cf86..975e886d2b5 100644
--- a/js/src/jsxml.cpp
+++ b/js/src/jsxml.cpp
@@ -874,29 +874,19 @@ attr_identity(const JSXML *xmla, const JSXML *xmlb)
     return qname_identity(xmla->name, xmlb->name);
 }
 
-template<>
-void
-JSXMLArrayCursor<JSXML>::trace(JSTracer *trc)
-{
-    for (JSXMLArrayCursor<JSXML> *cursor = this; cursor; cursor = cursor->next)
-        MarkXML(trc, cursor->root, "cursor_root");
-}
-
-template<>
-void
-JSXMLArrayCursor<JSObject>::trace(JSTracer *trc)
-{
-    for (JSXMLArrayCursor<JSObject> *cursor = this; cursor; cursor = cursor->next)
-        MarkObject(trc, cursor->root, "cursor_root");
-}
-
 template<class T>
-static void
-XMLArrayCursorTrace(JSTracer *trc, JSXMLArrayCursor<T> *cursor)
+void
+js_XMLArrayCursorTrace(JSTracer *trc, JSXMLArrayCursor<T> *cursor)
 {
-    cursor->trace(trc);
+    for (; cursor; cursor = cursor->next) {
+        if (cursor->root)
+            Mark(trc, (const MarkablePtr<T> &)cursor->root, "cursor_root");
+    }
 }
 
+template void js_XMLArrayCursorTrace<JSXML>(JSTracer *trc, JSXMLArrayCursor<JSXML> *cursor);
+template void js_XMLArrayCursorTrace<JSObject>(JSTracer *trc, JSXMLArrayCursor<JSObject> *cursor);
+
 template<class T>
 static HeapPtr<T> *
 ReallocateVector(HeapPtr<T> *vector, size_t count)
@@ -7360,7 +7350,7 @@ js_TraceXML(JSTracer *trc, JSXML *xml)
     }
 
     MarkXMLRange(trc, xml->xml_kids.length, xml->xml_kids.vector, "xml_kids");
-    XMLArrayCursorTrace(trc, xml->xml_kids.cursors);
+    js_XMLArrayCursorTrace(trc, xml->xml_kids.cursors);
 
     if (xml->xml_class == JSXML_CLASS_LIST) {
         if (xml->xml_target)
@@ -7371,10 +7361,10 @@ js_TraceXML(JSTracer *trc, JSXML *xml)
         MarkObjectRange(trc, xml->xml_namespaces.length,
                         xml->xml_namespaces.vector,
                         "xml_namespaces");
-        XMLArrayCursorTrace(trc, xml->xml_namespaces.cursors);
+        js_XMLArrayCursorTrace(trc, xml->xml_namespaces.cursors);
 
         MarkXMLRange(trc, xml->xml_attrs.length, xml->xml_attrs.vector, "xml_attrs");
-        XMLArrayCursorTrace(trc, xml->xml_attrs.cursors);
+        js_XMLArrayCursorTrace(trc, xml->xml_attrs.cursors);
     }
 }
 
diff --git a/js/src/jsxml.h b/js/src/jsxml.h
index 888c9d6bb00..4a82e1fd7e4 100644
--- a/js/src/jsxml.h
+++ b/js/src/jsxml.h
@@ -121,10 +121,12 @@ struct JSXMLArrayCursor
             return NULL;
         return root = array->vector[index];
     }
-
-    void trace(JSTracer *trc);
 };
 
+template<class T>
+void
+js_XMLArrayCursorTrace(JSTracer *trc, JSXMLArrayCursor<T> *cursor);
+
 #define JSXML_PRESET_CAPACITY   JS_BIT(31)
 #define JSXML_CAPACITY_MASK     JS_BITMASK(31)
 #define JSXML_CAPACITY(array)   ((array)->capacity & JSXML_CAPACITY_MASK)
diff --git a/js/src/vm/RegExpObject-inl.h b/js/src/vm/RegExpObject-inl.h
index 157a5a8522c..3c28f462daf 100644
--- a/js/src/vm/RegExpObject-inl.h
+++ b/js/src/vm/RegExpObject-inl.h
@@ -248,7 +248,7 @@ RegExpObject::setSticky(bool enabled)
 inline RegExpPrivateCache *
 detail::RegExpPrivate::getOrCreateCache(JSContext *cx)
 {
-    if (RegExpPrivateCache *cache = cx->threadData()->getOrCreateRegExpPrivateCache(cx->runtime))
+    if (RegExpPrivateCache *cache = cx->threadData()->getOrCreateRegExpPrivateCache(cx))
         return cache;
 
     js_ReportOutOfMemory(cx);
@@ -379,18 +379,27 @@ detail::RegExpPrivateCode::compile(JSContext *cx, JSLinearString &pattern, Token
 
 #ifdef JS_METHODJIT
     if (isJITRuntimeEnabled(cx) && !yarrPattern.m_containsBackreferences) {
-        if (!cx->compartment->ensureJaegerCompartmentExists(cx))
+        JSC::ExecutableAllocator *execAlloc = cx->threadData()->getOrCreateExecutableAllocator(cx);
+        if (!execAlloc) {
+            js_ReportOutOfMemory(cx);
             return false;
+        }
 
-        JSGlobalData globalData(cx->compartment->jaegerCompartment()->execAlloc());
+        JSGlobalData globalData(execAlloc);
         jitCompile(yarrPattern, &globalData, codeBlock);
         if (!codeBlock.isFallBack())
             return true;
     }
 #endif
 
+    WTF::BumpPointerAllocator *bumpAlloc = cx->threadData()->getOrCreateBumpPointerAllocator(cx);
+    if (!bumpAlloc) {
+        js_ReportOutOfMemory(cx);
+        return false;
+    }
+
     codeBlock.setFallBack(true);
-    byteCode = byteCompile(yarrPattern, cx->compartment->regExpAllocator).get();
+    byteCode = byteCompile(yarrPattern, bumpAlloc).get();
     return true;
 #else /* !defined(ENABLE_YARR_JIT) */
     int error = 0;
diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
index fd8a3f9ef62..cf70ad985fc 100644
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -2023,8 +2023,8 @@ public:
                                data.gcHeapUnusedPercentage,
                                "Fraction of the garbage-collected JavaScript heap that is unused. "
                                "Computed as ('js-gc-heap-chunk-clean-unused' + "
-                               "'js-gc-heap-chunk-dirty-unused' + 'js-gc-heap-arena-unused') / "
-                               "'js-gc-heap'.",
+                               "'js-gc-heap-chunk-dirty-unused' + 'js-gc-heap-decommitted' + "
+                               "'js-gc-heap-arena-unused') / 'js-gc-heap'.",
                                callback, closure);
 
         ReportMemoryBytes(NS_LITERAL_CSTRING("js-total-objects"),
diff --git a/js/xpconnect/src/XPCQuickStubs.cpp b/js/xpconnect/src/XPCQuickStubs.cpp
index 4c9931e3d67..278047c5d03 100644
--- a/js/xpconnect/src/XPCQuickStubs.cpp
+++ b/js/xpconnect/src/XPCQuickStubs.cpp
@@ -1,6 +1,5 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- *
- * ***** BEGIN LICENSE BLOCK *****
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
@@ -1001,7 +1000,7 @@ xpc_qsJsvalToCharStr(JSContext *cx, jsval v, JSAutoByteString *bytes)
 }
 
 JSBool
-xpc_qsJsvalToWcharStr(JSContext *cx, jsval v, jsval *pval, PRUnichar **pstr)
+xpc_qsJsvalToWcharStr(JSContext *cx, jsval v, jsval *pval, const PRUnichar **pstr)
 {
     JSString *str;
 
@@ -1020,8 +1019,7 @@ xpc_qsJsvalToWcharStr(JSContext *cx, jsval v, jsval *pval, PRUnichar **pstr)
     if (!chars)
         return JS_FALSE;
 
-    // XXXbz this is casting away constness too...  That seems like a bad idea.
-    *pstr = const_cast<jschar *>(chars);
+    *pstr = static_cast<const PRUnichar *>(chars);
     return JS_TRUE;
 }
 
diff --git a/js/xpconnect/src/XPCQuickStubs.h b/js/xpconnect/src/XPCQuickStubs.h
index 6986ae15ca7..377cb765f47 100644
--- a/js/xpconnect/src/XPCQuickStubs.h
+++ b/js/xpconnect/src/XPCQuickStubs.h
@@ -467,7 +467,7 @@ JSBool
 xpc_qsJsvalToCharStr(JSContext *cx, jsval v, JSAutoByteString *bytes);
 
 JSBool
-xpc_qsJsvalToWcharStr(JSContext *cx, jsval v, jsval *pval, PRUnichar **pstr);
+xpc_qsJsvalToWcharStr(JSContext *cx, jsval v, jsval *pval, const PRUnichar **pstr);
 
 
 /** Convert an nsString to jsval, returning JS_TRUE on success.
diff --git a/js/xpconnect/src/XPCWrappedNativeInfo.cpp b/js/xpconnect/src/XPCWrappedNativeInfo.cpp
index 5a4be17d5b3..49b54e770fe 100644
--- a/js/xpconnect/src/XPCWrappedNativeInfo.cpp
+++ b/js/xpconnect/src/XPCWrappedNativeInfo.cpp
@@ -45,45 +45,6 @@
 
 /***************************************************************************/
 
-/*
- * Helper that clones JS Function objects along with both of its
- * reserved slots.
- */
-
-JSObject *
-xpc_CloneJSFunction(XPCCallContext &ccx, JSObject *funobj, JSObject *parent)
-{
-    JSObject *clone = JS_CloneFunctionObject(ccx, funobj, parent);
-    if (!clone)
-        return nsnull;
-
-    AUTO_MARK_JSVAL(ccx, OBJECT_TO_JSVAL(clone));
-
-    XPCWrappedNativeScope *scope =
-        XPCWrappedNativeScope::FindInJSObjectScope(ccx, parent);
-
-    if (!scope) {
-        return nsnull;
-    }
-
-    // Make sure to break the prototype chain to the function object
-    // we cloned to prevent its scope from leaking into the clones
-    // scope.
-    JS_SetPrototype(ccx, clone, scope->GetPrototypeJSFunction());
-
-    // Copy the reserved slots to the clone.
-    jsval ifaceVal, memberVal;
-    if (!JS_GetReservedSlot(ccx, funobj, 0, &ifaceVal) ||
-        !JS_GetReservedSlot(ccx, funobj, 1, &memberVal))
-        return nsnull;
-
-    if (!JS_SetReservedSlot(ccx, clone, 0, ifaceVal) ||
-        !JS_SetReservedSlot(ccx, clone, 1, memberVal))
-        return nsnull;
-
-    return clone;
-}
-
 // XPCNativeMember
 
 // static
diff --git a/js/xpconnect/src/codegen.py b/js/xpconnect/src/codegen.py
index 17736f8d4ec..0060f822c37 100644
--- a/js/xpconnect/src/codegen.py
+++ b/js/xpconnect/src/codegen.py
@@ -170,7 +170,7 @@ argumentUnboxingTemplates = {
         "    char *${name} = ${name}_bytes.ptr();\n",
 
     'wstring':
-        "    PRUnichar *${name};\n"
+        "    const PRUnichar *${name};\n"
         "    if (!xpc_qsJsvalToWcharStr(cx, ${argVal}, ${argPtr}, &${name}))\n"
         "        return JS_FALSE;\n",
 
diff --git a/js/xpconnect/src/qsgen.py b/js/xpconnect/src/qsgen.py
index 69c88fee3a0..bd4b2adf326 100644
--- a/js/xpconnect/src/qsgen.py
+++ b/js/xpconnect/src/qsgen.py
@@ -488,7 +488,7 @@ argumentUnboxingTemplates = {
         "    char *${name} = ${name}_bytes.ptr();\n",
 
     'wstring':
-        "    PRUnichar *${name};\n"
+        "    const PRUnichar *${name};\n"
         "    if (!xpc_qsJsvalToWcharStr(cx, ${argVal}, ${argPtr}, &${name}))\n"
         "        return JS_FALSE;\n",
 
diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h
index d5130e41b41..69742f2cd5f 100644
--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -96,7 +96,7 @@
 #include "nsReadableUtils.h"
 #include "nsXPIDLString.h"
 #include "nsAutoJSValHolder.h"
-#include "mozilla/AutoRestore.h"
+#include "mozilla/GuardObjects.h"
 #include "mozilla/ReentrantMonitor.h"
 #include "mozilla/Mutex.h"
 #include "nsDataHashtable.h"
@@ -1686,9 +1686,6 @@ private:
     JSBool mNewDOMBindingsEnabled;
 };
 
-JSObject* xpc_CloneJSFunction(XPCCallContext &ccx, JSObject *funobj,
-                              JSObject *parent);
-
 /***************************************************************************/
 // XPCNativeMember represents a single idl declared method, attribute or
 // constant.
diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index 3b6634254e9..f46a4c6a1cb 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -2172,7 +2172,7 @@ FrameLayerBuilder::CheckDOMModified()
   return true;
 }
 
-#ifdef DEBUG
+#ifdef MOZ_DUMP_PAINTING
 void
 FrameLayerBuilder::DumpRetainedLayerTree()
 {
diff --git a/layout/base/FrameLayerBuilder.h b/layout/base/FrameLayerBuilder.h
index 99a2e6dd47f..22980c0e273 100644
--- a/layout/base/FrameLayerBuilder.h
+++ b/layout/base/FrameLayerBuilder.h
@@ -237,7 +237,7 @@ public:
                               const nsIntRegion& aRegionToInvalidate,
                               void* aCallbackData);
 
-#ifdef DEBUG
+#ifdef MOZ_DUMP_PAINTING
   /**
    * Dumps this FrameLayerBuilder's retained layer manager's retained
    * layer tree to stderr.
diff --git a/layout/base/nsDisplayList.cpp b/layout/base/nsDisplayList.cpp
index 6465b9c5f81..de169fa2e03 100644
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -64,6 +64,8 @@
 #include "BasicLayers.h"
 #include "nsBoxFrame.h"
 #include "nsViewportFrame.h"
+#include "nsSVGEffects.h"
+#include "nsSVGClipPathFrame.h"
 
 using namespace mozilla;
 using namespace mozilla::layers;
@@ -2608,7 +2610,7 @@ already_AddRefed<Layer> nsDisplayTransform::BuildLayer(nsDisplayListBuilder *aBu
 
   // Add the preserve-3d flag for this layer, BuildContainerLayerFor clears all flags,
   // so we never need to explicitely unset this flag.
-  if (mFrame->Preserves3D()) {
+  if (mFrame->Preserves3D() || mFrame->Preserves3DChildren()) {
     container->SetContentFlags(container->GetContentFlags() | Layer::CONTENT_PRESERVE_3D);
   }
   return container.forget();
@@ -2998,3 +3000,44 @@ bool nsDisplaySVGEffects::TryMerge(nsDisplayListBuilder* aBuilder, nsDisplayItem
     other->mBounds + other->mEffectsFrame->GetOffsetTo(mEffectsFrame));
   return true;
 }
+
+#ifdef MOZ_DUMP_PAINTING
+void
+nsDisplaySVGEffects::PrintEffects(FILE* aOutput)
+{
+  nsIFrame* firstFrame =
+    nsLayoutUtils::GetFirstContinuationOrSpecialSibling(mEffectsFrame);
+  nsSVGEffects::EffectProperties effectProperties =
+    nsSVGEffects::GetEffectProperties(firstFrame);
+  bool isOK = true;
+  nsSVGClipPathFrame *clipPathFrame = effectProperties.GetClipPathFrame(&isOK);
+  bool first = true;
+  fprintf(aOutput, " effects=(");
+  if (mEffectsFrame->GetStyleDisplay()->mOpacity != 1.0f) {
+    first = false;
+    fprintf(aOutput, "opacity(%f)", mEffectsFrame->GetStyleDisplay()->mOpacity);
+  }
+  if (clipPathFrame) {
+    if (!first) {
+      fprintf(aOutput, ", ");
+    }
+    fprintf(aOutput, "clip(%s)", clipPathFrame->IsTrivial() ? "trivial" : "non-trivial");
+    first = false;
+  }
+  if (effectProperties.GetFilterFrame(&isOK)) {
+    if (!first) {
+      fprintf(aOutput, ", ");
+    }
+    fprintf(aOutput, "filter");
+    first = false;
+  }
+  if (effectProperties.GetMaskFrame(&isOK)) {
+    if (!first) {
+      fprintf(aOutput, ", ");
+    }
+    fprintf(aOutput, "mask");
+  }
+  fprintf(aOutput, ")");
+}
+#endif
+
diff --git a/layout/base/nsDisplayList.h b/layout/base/nsDisplayList.h
index 59a3a18d918..670c6b2dde9 100644
--- a/layout/base/nsDisplayList.h
+++ b/layout/base/nsDisplayList.h
@@ -105,7 +105,7 @@ class nsDisplayItem;
  */
 
 // All types are defined in nsDisplayItemTypes.h
-#ifdef NS_DEBUG
+#ifdef MOZ_DUMP_PAINTING
 #define NS_DISPLAY_DECL_NAME(n, e) \
   virtual const char* Name() { return n; } \
   virtual Type GetType() { return e; }
@@ -794,7 +794,7 @@ public:
    */
   const nsRect& GetVisibleRect() { return mVisibleRect; }
   
-#ifdef NS_DEBUG
+#ifdef MOZ_DUMP_PAINTING
   /**
    * For debugging and stuff
    */
@@ -1292,7 +1292,7 @@ public:
   nsDisplayGeneric(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
                    PaintCallback aPaint, const char* aName, Type aType)
     : nsDisplayItem(aBuilder, aFrame), mPaint(aPaint)
-#ifdef DEBUG
+#ifdef MOZ_DUMP_PAINTING
       , mName(aName)
 #endif
       , mType(aType)
@@ -1318,7 +1318,7 @@ public:
 
 protected:
   PaintCallback mPaint;
-#ifdef DEBUG
+#ifdef MOZ_DUMP_PAINTING
   const char*   mName;
 #endif
   Type mType;
@@ -2052,6 +2052,10 @@ public:
 
   nsIFrame* GetEffectsFrame() { return mEffectsFrame; }
 
+#ifdef MOZ_DUMP_PAINTING
+  void PrintEffects(FILE* aOutput);
+#endif
+
 private:
   nsIFrame* mEffectsFrame;
   // relative to mEffectsFrame
diff --git a/layout/base/nsLayoutDebugger.cpp b/layout/base/nsLayoutDebugger.cpp
index 4baa54ee8e7..734df7453bc 100644
--- a/layout/base/nsLayoutDebugger.cpp
+++ b/layout/base/nsLayoutDebugger.cpp
@@ -148,22 +148,28 @@ nsLayoutDebugger::GetStyleSize(nsIPresShell* aPresentation,
   *aSizeInBytesResult = 0;
   return NS_ERROR_FAILURE;
 }
+#endif
 
+#ifdef MOZ_DUMP_PAINTING
 static void
 PrintDisplayListTo(nsDisplayListBuilder* aBuilder, const nsDisplayList& aList,
                    PRInt32 aIndent, FILE* aOutput)
 {
   for (nsDisplayItem* i = aList.GetBottom(); i != nsnull; i = i->GetAbove()) {
+#ifdef DEBUG
     if (aList.DidComputeVisibility() && i->GetVisibleRect().IsEmpty())
       continue;
+#endif
     for (PRInt32 j = 0; j < aIndent; ++j) {
       fputc(' ', aOutput);
     }
     nsIFrame* f = i->GetUnderlyingFrame();
     nsAutoString fName;
+#ifdef DEBUG
     if (f) {
       f->GetFrameName(fName);
     }
+#endif
     nsRect rect = i->GetBounds(aBuilder);
     switch (i->GetType()) {
       case nsDisplayItem::TYPE_CLIP:
@@ -183,9 +189,11 @@ PrintDisplayListTo(nsDisplayListBuilder* aBuilder, const nsDisplayList& aList,
         nsDisplayTransform* t = static_cast<nsDisplayTransform*>(i);
         list = t->GetStoredList()->GetList();
     }
+#ifdef DEBUG
     if (!list || list->DidComputeVisibility()) {
       opaque = i->GetOpaqueRegion(aBuilder);
     }
+#endif
     fprintf(aOutput, "%s %p(%s) (%d,%d,%d,%d)(%d,%d,%d,%d)%s%s",
             i->Name(), (void*)f, NS_ConvertUTF16toUTF8(fName).get(),
             rect.x, rect.y, rect.width, rect.height,
@@ -199,6 +207,9 @@ PrintDisplayListTo(nsDisplayListBuilder* aBuilder, const nsDisplayList& aList,
         fprintf(aOutput, " layer=%p", layer);
       }
     }
+    if (i->GetType() == nsDisplayItem::TYPE_SVG_EFFECTS) {
+      (static_cast<nsDisplaySVGEffects*>(i))->PrintEffects(aOutput);
+    }
     fputc('\n', aOutput);
     if (list) {
       PrintDisplayListTo(aBuilder, *list, aIndent + 4, aOutput);
diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
index 546abc05996..3e7724cedea 100644
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -1266,7 +1266,7 @@ nsLayoutUtils::CombineBreakType(PRUint8 aOrigBreakType,
   return breakType;
 }
 
-#ifdef DEBUG
+#ifdef MOZ_DUMP_PAINTING
 #include <stdio.h>
 
 static bool gDumpPaintList = getenv("MOZ_DUMP_PAINT_LIST") != 0;
@@ -1351,7 +1351,7 @@ nsLayoutUtils::GetFramesForArea(nsIFrame* aFrame, const nsRect& aRect,
   builder.LeavePresShell(aFrame, target);
   NS_ENSURE_SUCCESS(rv, rv);
 
-#ifdef DEBUG
+#ifdef MOZ_DUMP_PAINTING
   if (gDumpEventList) {
     fprintf(stdout, "Event handling --- (%d,%d):\n", aRect.x, aRect.y);
     nsFrame::PrintDisplayList(&builder, list);
@@ -1661,7 +1661,7 @@ nsLayoutUtils::PaintFrame(nsRenderingContext* aRenderingContext, nsIFrame* aFram
     willFlushRetainedLayers = true;
   }
 
-#ifdef DEBUG
+#ifdef MOZ_DUMP_PAINTING
   if (gDumpPaintList) {
     fprintf(stdout, "Painting --- before optimization (dirty %d,%d,%d,%d):\n",
             dirtyRect.x, dirtyRect.y, dirtyRect.width, dirtyRect.height);
@@ -1713,7 +1713,7 @@ nsLayoutUtils::PaintFrame(nsRenderingContext* aRenderingContext, nsIFrame* aFram
     }
   }
 
-#ifdef DEBUG
+#ifdef MOZ_DUMP_PAINTING
   if (gDumpPaintList) {
     fprintf(stdout, "Painting --- after optimization:\n");
     nsFrame::PrintDisplayList(&builder, list);
diff --git a/layout/generic/nsContainerFrame.cpp b/layout/generic/nsContainerFrame.cpp
index c085b8e60d2..62940d710cb 100644
--- a/layout/generic/nsContainerFrame.cpp
+++ b/layout/generic/nsContainerFrame.cpp
@@ -208,53 +208,35 @@ nsContainerFrame::RemoveFrame(ChildListID aListID,
     }
   }
 
-  if (aOldFrame) {
-    // Loop and destroy the frame and all of its continuations.
-    // If the frame we are removing is a brFrame, we need a reflow so
-    // the line the brFrame was on can attempt to pull up any frames
-    // that can fit from lines below it.
-    bool generateReflowCommand = true;
+  // Loop and destroy aOldFrame and all of its continuations.
+  // Request a reflow on the parent frames involved unless we were explicitly
+  // told not to (kNoReflowPrincipalList).
+  bool generateReflowCommand = true;
 #ifdef IBMBIDI
-    if (kNoReflowPrincipalList == aListID) {
-      generateReflowCommand = false;
-    }
+  if (kNoReflowPrincipalList == aListID) {
+    generateReflowCommand = false;
+  }
 #endif
-    nsContainerFrame* parent = static_cast<nsContainerFrame*>(aOldFrame->GetParent());
-    while (aOldFrame) {
-      // When the parent is an inline frame we have a simple task - just
-      // remove the frame from its parents list and generate a reflow
-      // command.
-      nsIFrame* oldFrameNextContinuation = aOldFrame->GetNextContinuation();
-      //XXXfr probably should use StealFrame here. I'm not sure if we need to
-      //      check the overflow lists atm, but we'll need a prescontext lookup
-      //      for overflow containers once we can split abspos elements with
-      //      inline containing blocks.
-      if (parent == this) {
-        if (!parent->mFrames.DestroyFrameIfPresent(aOldFrame)) {
-          // Try to remove it from our overflow list, if we have one.
-          // The simplest way is to reuse StealFrame.
-          StealFrame(PresContext(), aOldFrame, true);
-          aOldFrame->Destroy();
-        }
-      } else {
-        // This recursive call takes care of all continuations after aOldFrame,
-        // so we don't need to loop anymore.
-        parent->RemoveFrame(kPrincipalList, aOldFrame);
-        break;
-      }
-      aOldFrame = oldFrameNextContinuation;
-      if (aOldFrame) {
-        parent = static_cast<nsContainerFrame*>(aOldFrame->GetParent());
-      }
-    }
-
-    if (generateReflowCommand) {
-      PresContext()->PresShell()->
-        FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+  nsPresContext* pc = PresContext();
+  nsContainerFrame* lastParent = nsnull;
+  while (aOldFrame) {
+    //XXXfr probably should use StealFrame here. I'm not sure if we need to
+    //      check the overflow lists atm, but we'll need a prescontext lookup
+    //      for overflow containers once we can split abspos elements with
+    //      inline containing blocks.
+    nsIFrame* oldFrameNextContinuation = aOldFrame->GetNextContinuation();
+    nsContainerFrame* parent =
+      static_cast<nsContainerFrame*>(aOldFrame->GetParent());
+    parent->StealFrame(pc, aOldFrame, true);
+    aOldFrame->Destroy();
+    aOldFrame = oldFrameNextContinuation;
+    if (parent != lastParent && generateReflowCommand) {
+      pc->PresShell()->
+        FrameNeedsReflow(parent, nsIPresShell::eTreeChange,
                          NS_FRAME_HAS_DIRTY_CHILDREN);
+      lastParent = parent;
     }
   }
-
   return NS_OK;
 }
 
diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index dec6ab3fc65..c6e195abbc9 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -1598,7 +1598,7 @@ WrapPreserve3DListInternal(nsIFrame* aFrame, nsDisplayListBuilder *aBuilder, nsD
     // and then flush this list into newList by wrapping the whole lot with a single
     // nsDisplayTransform.
 
-    if (childFrame && childFrame->GetParent()->Preserves3DChildren()) {
+    if (childFrame && (childFrame->GetParent()->Preserves3DChildren() || childFrame == aFrame)) {
       switch (item->GetType()) {
         case nsDisplayItem::TYPE_TRANSFORM: {
           if (!temp.IsEmpty()) {
@@ -6627,12 +6627,11 @@ nsIFrame::FinishAndStoreOverflow(nsOverflowAreas& aOverflowAreas,
      */
     nsRect newBounds(nsPoint(0, 0), aNewSize);
     // Transform affects both overflow areas.
-    if (!Preserves3DChildren()) {
-      NS_FOR_FRAME_OVERFLOW_TYPES(otype) {
-        nsRect& o = aOverflowAreas.Overflow(otype);
-        o = nsDisplayTransform::TransformRect(o, this, nsPoint(0, 0), &newBounds);
-      }
-    } else {
+    NS_FOR_FRAME_OVERFLOW_TYPES(otype) {
+      nsRect& o = aOverflowAreas.Overflow(otype);
+      o = nsDisplayTransform::TransformRect(o, this, nsPoint(0, 0), &newBounds);
+    }
+    if (Preserves3DChildren()) {
       ComputePreserve3DChildrenOverflow(aOverflowAreas, newBounds);
     }
   }
@@ -6785,8 +6784,8 @@ nsIFrame::ComputePreserve3DChildrenOverflow(nsOverflowAreas& aOverflowAreas, con
     }
   }
 
-  aOverflowAreas.Overflow(eVisualOverflow) = childVisual;
-  aOverflowAreas.Overflow(eScrollableOverflow) = childScrollable;
+  aOverflowAreas.Overflow(eVisualOverflow) = aOverflowAreas.Overflow(eVisualOverflow).Union(childVisual);
+  aOverflowAreas.Overflow(eScrollableOverflow) = aOverflowAreas.Overflow(eScrollableOverflow).Union(childScrollable);
 }
 
 void
diff --git a/layout/generic/nsFrame.h b/layout/generic/nsFrame.h
index 565323083ab..020deef2d68 100644
--- a/layout/generic/nsFrame.h
+++ b/layout/generic/nsFrame.h
@@ -702,6 +702,10 @@ public:
   static void ShowEventTargetFrameBorder(bool aEnable);
   static bool GetShowEventTargetFrameBorder();
 
+#endif
+#ifdef MOZ_DUMP_PAINTING
+public:
+
   static void PrintDisplayList(nsDisplayListBuilder* aBuilder,
                                const nsDisplayList& aList);
 
diff --git a/layout/generic/nsTextFrameThebes.cpp b/layout/generic/nsTextFrameThebes.cpp
index f7868013594..16aa29aa8eb 100644
--- a/layout/generic/nsTextFrameThebes.cpp
+++ b/layout/generic/nsTextFrameThebes.cpp
@@ -7740,7 +7740,13 @@ nsTextFrame::IsEmpty()
 NS_IMETHODIMP
 nsTextFrame::GetFrameName(nsAString& aResult) const
 {
-  return MakeFrameName(NS_LITERAL_STRING("Text"), aResult);
+  MakeFrameName(NS_LITERAL_STRING("Text"), aResult);
+  PRInt32 totalContentLength;
+  nsCAutoString tmp;
+  ToCString(tmp, &totalContentLength);
+  tmp.SetLength(NS_MIN(tmp.Length(), 50u));
+  aResult += NS_LITERAL_STRING("\"") + NS_ConvertASCIItoUTF16(tmp) + NS_LITERAL_STRING("\"");
+  return NS_OK;
 }
 
 NS_IMETHODIMP_(nsFrameState)
@@ -7762,12 +7768,8 @@ nsTextFrame::List(FILE* out, PRInt32 aIndent) const
   }
   fprintf(out, " [run=%p]", static_cast<void*>(mTextRun));
 
-  PRInt32 totalContentLength;
-  nsCAutoString tmp;
-  ToCString(tmp, &totalContentLength);
-
   // Output the first/last content offset and prev/next in flow info
-  bool isComplete = GetContentEnd() == totalContentLength;
+  bool isComplete = GetContentEnd() == GetContent()->TextLength();
   fprintf(out, "[%d,%d,%c] ", 
           GetContentOffset(), GetContentLength(),
           isComplete ? 'T':'F');
@@ -7811,20 +7813,7 @@ nsTextFrame::List(FILE* out, PRInt32 aIndent) const
     fprintf(out, " pst=%s",
             NS_LossyConvertUTF16toASCII(atomString).get());
   }
-  fputs("<\n", out);
-
-  // Output the text
-  aIndent++;
-
-  IndentBy(out, aIndent);
-  fputs("\"", out);
-  fputs(tmp.get(), out);
-  fputs("\"\n", out);
-
-  aIndent--;
-  IndentBy(out, aIndent);
-  fputs(">\n", out);
-
+  fputs("\n", out);
   return NS_OK;
 }
 #endif
diff --git a/layout/reftests/text/reftest.list b/layout/reftests/text/reftest.list
index 44b5256971a..96bc848e1e3 100644
--- a/layout/reftests/text/reftest.list
+++ b/layout/reftests/text/reftest.list
@@ -99,41 +99,41 @@ random-if(!winWidget) == arial-bold-lam-alef-1.html arial-bold-lam-alef-1-ref.ht
 == auto-hyphenation-5.html auto-hyphenation-5-ref.html
 == auto-hyphenation-6.html auto-hyphenation-6-ref.html
 == auto-hyphenation-7.html auto-hyphenation-7-ref.html
-# Android ships only the en-US hyphenation dictionary
-skip-if(Android) == auto-hyphenation-af-1.html auto-hyphenation-af-1-ref.html
-skip-if(Android) == auto-hyphenation-bg-1.html auto-hyphenation-bg-1-ref.html
-skip-if(Android) == auto-hyphenation-ca-1.html auto-hyphenation-ca-1-ref.html
-skip-if(Android) == auto-hyphenation-cy-1.html auto-hyphenation-cy-1-ref.html
-skip-if(Android) == auto-hyphenation-da-1.html auto-hyphenation-da-1-ref.html
-skip-if(Android) == auto-hyphenation-de-1901-1.html auto-hyphenation-de-1901-1-ref.html
-skip-if(Android) == auto-hyphenation-de-1996-1.html auto-hyphenation-de-1996-1-ref.html
-skip-if(Android) != auto-hyphenation-de-1901-1.html auto-hyphenation-de-1996-1.html
-skip-if(Android) == auto-hyphenation-de-ch-1.html auto-hyphenation-de-ch-1-ref.html
-skip-if(Android) == auto-hyphenation-eo-1.html auto-hyphenation-eo-1-ref.html
-skip-if(Android) == auto-hyphenation-es-1.html auto-hyphenation-es-1-ref.html
-skip-if(Android) == auto-hyphenation-et-1.html auto-hyphenation-et-1-ref.html
-skip-if(Android) == auto-hyphenation-fi-1.html auto-hyphenation-fi-1-ref.html
-skip-if(Android) == auto-hyphenation-fr-1.html auto-hyphenation-fr-1-ref.html
-skip-if(Android) == auto-hyphenation-gl-1.html auto-hyphenation-gl-1-ref.html
-skip-if(Android) == auto-hyphenation-hr-1.html auto-hyphenation-hr-1-ref.html
-skip-if(Android) == auto-hyphenation-hsb-1.html auto-hyphenation-hsb-1-ref.html
-skip-if(Android) == auto-hyphenation-hu-1.html auto-hyphenation-hu-1-ref.html
-skip-if(Android) == auto-hyphenation-ia-1.html auto-hyphenation-ia-1-ref.html
-skip-if(Android) == auto-hyphenation-is-1.html auto-hyphenation-is-1-ref.html
-skip-if(Android) == auto-hyphenation-it-1.html auto-hyphenation-it-1-ref.html
-skip-if(Android) == auto-hyphenation-kmr-1.html auto-hyphenation-kmr-1-ref.html
-skip-if(Android) == auto-hyphenation-la-1.html auto-hyphenation-la-1-ref.html
-skip-if(Android) == auto-hyphenation-lt-1.html auto-hyphenation-lt-1-ref.html
-skip-if(Android) == auto-hyphenation-mn-1.html auto-hyphenation-mn-1-ref.html
-skip-if(Android) == auto-hyphenation-nb-1.html auto-hyphenation-nb-1-ref.html
-skip-if(Android) == auto-hyphenation-nl-1.html auto-hyphenation-nl-1-ref.html
-skip-if(Android) == auto-hyphenation-nn-1.html auto-hyphenation-nn-1-ref.html
-skip-if(Android) == auto-hyphenation-pt-1.html auto-hyphenation-pt-1-ref.html
-skip-if(Android) == auto-hyphenation-ru-1.html auto-hyphenation-ru-1-ref.html
-skip-if(Android) == auto-hyphenation-sh-1.html auto-hyphenation-sh-1-ref.html
-skip-if(Android) == auto-hyphenation-sl-1.html auto-hyphenation-sl-1-ref.html
-skip-if(Android) == auto-hyphenation-sr-1.html auto-hyphenation-sr-1-ref.html
-skip-if(Android) == auto-hyphenation-sv-1.html auto-hyphenation-sv-1-ref.html # test swedish patterns
-skip-if(Android) != auto-hyphenation-sv-1.html auto-hyphenation-sv-1-notref.html # verify swedish != english
-skip-if(Android) == auto-hyphenation-tr-1.html auto-hyphenation-tr-1-ref.html
-skip-if(Android) == auto-hyphenation-uk-1.html auto-hyphenation-uk-1-ref.html
+== auto-hyphenation-af-1.html auto-hyphenation-af-1-ref.html
+== auto-hyphenation-bg-1.html auto-hyphenation-bg-1-ref.html
+== auto-hyphenation-ca-1.html auto-hyphenation-ca-1-ref.html
+== auto-hyphenation-cy-1.html auto-hyphenation-cy-1-ref.html
+== auto-hyphenation-da-1.html auto-hyphenation-da-1-ref.html
+== auto-hyphenation-de-1901-1.html auto-hyphenation-de-1901-1-ref.html
+== auto-hyphenation-de-1996-1.html auto-hyphenation-de-1996-1-ref.html
+!= auto-hyphenation-de-1901-1.html auto-hyphenation-de-1996-1.html
+== auto-hyphenation-de-ch-1.html auto-hyphenation-de-ch-1-ref.html
+== auto-hyphenation-eo-1.html auto-hyphenation-eo-1-ref.html
+== auto-hyphenation-es-1.html auto-hyphenation-es-1-ref.html
+== auto-hyphenation-et-1.html auto-hyphenation-et-1-ref.html
+== auto-hyphenation-fi-1.html auto-hyphenation-fi-1-ref.html
+== auto-hyphenation-fr-1.html auto-hyphenation-fr-1-ref.html
+== auto-hyphenation-gl-1.html auto-hyphenation-gl-1-ref.html
+== auto-hyphenation-hr-1.html auto-hyphenation-hr-1-ref.html
+== auto-hyphenation-hsb-1.html auto-hyphenation-hsb-1-ref.html
+== auto-hyphenation-hu-1.html auto-hyphenation-hu-1-ref.html
+== auto-hyphenation-ia-1.html auto-hyphenation-ia-1-ref.html
+== auto-hyphenation-is-1.html auto-hyphenation-is-1-ref.html
+== auto-hyphenation-it-1.html auto-hyphenation-it-1-ref.html
+== auto-hyphenation-kmr-1.html auto-hyphenation-kmr-1-ref.html
+== auto-hyphenation-la-1.html auto-hyphenation-la-1-ref.html
+== auto-hyphenation-lt-1.html auto-hyphenation-lt-1-ref.html
+== auto-hyphenation-mn-1.html auto-hyphenation-mn-1-ref.html
+== auto-hyphenation-nb-1.html auto-hyphenation-nb-1-ref.html
+== auto-hyphenation-nl-1.html auto-hyphenation-nl-1-ref.html
+== auto-hyphenation-nn-1.html auto-hyphenation-nn-1-ref.html
+== auto-hyphenation-pt-1.html auto-hyphenation-pt-1-ref.html
+== auto-hyphenation-ru-1.html auto-hyphenation-ru-1-ref.html
+== auto-hyphenation-sh-1.html auto-hyphenation-sh-1-ref.html
+== auto-hyphenation-sl-1.html auto-hyphenation-sl-1-ref.html
+== auto-hyphenation-sr-1.html auto-hyphenation-sr-1-ref.html
+== auto-hyphenation-sv-1.html auto-hyphenation-sv-1-ref.html # test swedish patterns
+!= auto-hyphenation-sv-1.html auto-hyphenation-sv-1-notref.html # verify swedish != english
+== auto-hyphenation-tr-1.html auto-hyphenation-tr-1-ref.html
+== auto-hyphenation-uk-1.html auto-hyphenation-uk-1-ref.html
+
diff --git a/layout/reftests/transform-3d/green-rect.html b/layout/reftests/transform-3d/green-rect.html
new file mode 100644
index 00000000000..4e6d13e951f
--- /dev/null
+++ b/layout/reftests/transform-3d/green-rect.html
@@ -0,0 +1,14 @@
+<html>
+    <head>
+        <style type="text/css">
+        #parent {
+            width: 100px;
+            height: 100px;
+            background-color: #00FF00;
+        }
+        </style>
+    </head>
+    <body>
+        <div id="parent"></div>
+    </body>
+</html>
diff --git a/layout/reftests/transform-3d/preserve3d-3-ref.html b/layout/reftests/transform-3d/preserve3d-3-ref.html
new file mode 100644
index 00000000000..2590d9df313
--- /dev/null
+++ b/layout/reftests/transform-3d/preserve3d-3-ref.html
@@ -0,0 +1,8 @@
+<html>
+<head>
+</head>
+<body>
+  <div style="-moz-transform: rotatex(45deg); width: 100px; height: 100px; background:red;">
+</div>
+</body>
+</html>
diff --git a/layout/reftests/transform-3d/preserve3d-3a.html b/layout/reftests/transform-3d/preserve3d-3a.html
new file mode 100644
index 00000000000..a28f814e9ef
--- /dev/null
+++ b/layout/reftests/transform-3d/preserve3d-3a.html
@@ -0,0 +1,8 @@
+<html>
+<head>
+</head>
+<body>
+  <div style="-moz-transform: rotatex(45deg); -moz-transform-style: preserve-3d; width: 100px; height: 100px; background:red;">
+  </div>
+</body>
+</html>
diff --git a/layout/reftests/transform-3d/preserve3d-4a.html b/layout/reftests/transform-3d/preserve3d-4a.html
new file mode 100644
index 00000000000..0bf0cbe4c71
--- /dev/null
+++ b/layout/reftests/transform-3d/preserve3d-4a.html
@@ -0,0 +1,9 @@
+<html>
+<head>
+</head>
+<body>
+    <div style="-moz-transform: rotatex(90deg); -moz-transform-style: preserve-3d; opacity: 0.9999;">
+        <div style="-moz-transform: rotatex(90deg); width: 100px; height: 100px; background-color: #00FF00"></div>
+  </div>
+</body>
+</html>
diff --git a/layout/reftests/transform-3d/reftest.list b/layout/reftests/transform-3d/reftest.list
index 847cba5671c..03a75acffee 100644
--- a/layout/reftests/transform-3d/reftest.list
+++ b/layout/reftests/transform-3d/reftest.list
@@ -16,6 +16,8 @@ fails == preserve3d-1a.html preserve3d-1-ref.html
 == preserve3d-2b.html preserve3d-2-ref.html
 == preserve3d-2c.html preserve3d-2-ref.html
 == preserve3d-2d.html preserve3d-2-ref.html
+== preserve3d-3a.html preserve3d-3-ref.html
+== preserve3d-4a.html green-rect.html
 == scale3d-z.html scalez-1-ref.html
 == scale3d-all.html scale3d-1-ref.html
 == scale3d-xz.html scale3d-2-ref.html
@@ -35,5 +37,6 @@ fails == preserve3d-1a.html preserve3d-1-ref.html
 == sorting-2a.html sorting-2-ref.html
 # Parallel planes, same z depth (shouldn't be sorted!)
 == sorting-2b.html sorting-2-ref.html
+== sorting-3a.html green-rect.html
 # Different, but equivalent (for the given transform) transform origins
 == rotatex-transformorigin-1a.html rotatex-transformorigin-1-ref.html
diff --git a/layout/reftests/transform-3d/sorting-3a.html b/layout/reftests/transform-3d/sorting-3a.html
new file mode 100644
index 00000000000..00c62b5ce65
--- /dev/null
+++ b/layout/reftests/transform-3d/sorting-3a.html
@@ -0,0 +1,25 @@
+<html>
+    <head>
+        <style type="text/css">
+        #parent {
+            -moz-transform-style: preserve-3d;
+            -moz-transform: rotateX(180deg);
+            width: 100px;
+            height: 100px;
+            background-color: #00FF00;
+        }
+
+        #child {
+          width: 100px;
+          height: 100px;
+          background-color: red;
+          -moz-transform: translatez(10px);
+        }
+        </style>
+    </head>
+    <body>
+        <div id="parent">
+            <div id="child"></div>
+        </div>
+    </body>
+</html>
diff --git a/mfbt/GuardObjects.h b/mfbt/GuardObjects.h
new file mode 100644
index 00000000000..c1c43ea93a4
--- /dev/null
+++ b/mfbt/GuardObjects.h
@@ -0,0 +1,163 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* vim: set ts=8 sw=4 et tw=99 ft=cpp: */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   L. David Baron <dbaron@dbaron.org>, Mozilla Corporation (original author)
+ *   Ms2ger <ms2ger@gmail.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef mozilla_GuardObjects_h
+#define mozilla_GuardObjects_h
+
+#include "mozilla/Types.h"
+#include "mozilla/Util.h"
+
+namespace mozilla {
+  /**
+   * The following classes are designed to cause assertions to detect
+   * inadvertent use of guard objects as temporaries.  In other words,
+   * when we have a guard object whose only purpose is its constructor and
+   * destructor (and is never otherwise referenced), the intended use
+   * might be:
+   *     AutoRestore savePainting(mIsPainting);
+   * but is is easy to accidentally write:
+   *     AutoRestore(mIsPainting);
+   * which compiles just fine, but runs the destructor well before the
+   * intended time.
+   *
+   * They work by adding (#ifdef DEBUG) an additional parameter to the
+   * guard object's constructor, with a default value, so that users of
+   * the guard object's API do not need to do anything.  The default value
+   * of this parameter is a temporary object.  C++ (ISO/IEC 14882:1998),
+   * section 12.2 [class.temporary], clauses 4 and 5 seem to assume a
+   * guarantee that temporaries are destroyed in the reverse of their
+   * construction order, but I actually can't find a statement that that
+   * is true in the general case (beyond the two specific cases mentioned
+   * there).  However, it seems to be true.
+   *
+   * These classes are intended to be used only via the macros immediately
+   * below them:
+   *   MOZILLA_DECL_USE_GUARD_OBJECT_NOTIFIER declares (ifdef DEBUG) a member
+   *     variable, and should be put where a declaration of a private
+   *     member variable would be placed.
+   *   MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM should be placed at the end of the
+   *     parameters to each constructor of the guard object; it declares
+   *     (ifdef DEBUG) an additional parameter.  (But use the *_ONLY_PARAM
+   *     variant for constructors that take no other parameters.)
+   *   MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL should likewise be used in
+   *     the implementation of such constructors when they are not inline.
+   *   MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM_TO_PARENT should be used in
+   *     the implementation of such constructors to pass the parameter to
+   *     a base class that also uses these macros
+   *   MOZILLA_GUARD_OBJECT_NOTIFIER_INIT is a statement that belongs in each
+   *     constructor.  It uses the parameter declared by
+   *     MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM.
+   *
+   * For more details, and examples of using these macros, see
+   * https://developer.mozilla.org/en/Using_RAII_classes_in_Mozilla
+   */
+#ifdef DEBUG
+  class GuardObjectNotifier
+  {
+  private:
+    bool* mStatementDone;
+  public:
+    GuardObjectNotifier() : mStatementDone(NULL) {}
+
+    ~GuardObjectNotifier() {
+      *mStatementDone = true;
+    }
+
+    void SetStatementDone(bool *aStatementDone) {
+      mStatementDone = aStatementDone;
+    }
+  };
+
+  class GuardObjectNotificationReceiver
+  {
+  private:
+    bool mStatementDone;
+  public:
+    GuardObjectNotificationReceiver() : mStatementDone(false) {}
+
+    ~GuardObjectNotificationReceiver() {
+      /*
+       * Assert that the guard object was not used as a temporary.
+       * (Note that this assert might also fire if Init is not called
+       * because the guard object's implementation is not using the
+       * above macros correctly.)
+       */
+      MOZ_ASSERT(mStatementDone);
+    }
+
+    void Init(const GuardObjectNotifier &aNotifier) {
+      /*
+       * aNotifier is passed as a const reference so that we can pass a
+       * temporary, but we really intend it as non-const
+       */
+      const_cast<GuardObjectNotifier&>(aNotifier).
+          SetStatementDone(&mStatementDone);
+    }
+  };
+
+  #define MOZILLA_DECL_USE_GUARD_OBJECT_NOTIFIER \
+      mozilla::GuardObjectNotificationReceiver _mCheckNotUsedAsTemporary;
+  #define MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM \
+      , const mozilla::GuardObjectNotifier& _notifier = \
+                mozilla::GuardObjectNotifier()
+  #define MOZILLA_GUARD_OBJECT_NOTIFIER_ONLY_PARAM \
+      const mozilla::GuardObjectNotifier& _notifier = \
+              mozilla::GuardObjectNotifier()
+  #define MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL \
+      , const mozilla::GuardObjectNotifier& _notifier
+  #define MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM_TO_PARENT \
+      , _notifier
+  #define MOZILLA_GUARD_OBJECT_NOTIFIER_INIT \
+      PR_BEGIN_MACRO _mCheckNotUsedAsTemporary.Init(_notifier); PR_END_MACRO
+
+#else /* defined(DEBUG) */
+
+  #define MOZILLA_DECL_USE_GUARD_OBJECT_NOTIFIER
+  #define MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM
+  #define MOZILLA_GUARD_OBJECT_NOTIFIER_ONLY_PARAM
+  #define MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL
+  #define MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM_TO_PARENT
+  #define MOZILLA_GUARD_OBJECT_NOTIFIER_INIT PR_BEGIN_MACRO PR_END_MACRO
+
+#endif /* !defined(DEBUG) */
+
+} // namespace mozilla
+
+#endif /* mozilla_GuardObjects_h */
diff --git a/mfbt/Types.h b/mfbt/Types.h
index 67f0b3c9434..24bd6263e2d 100644
--- a/mfbt/Types.h
+++ b/mfbt/Types.h
@@ -79,9 +79,9 @@
  * other code needs to see import declarations when using mfbt.
  */
 #if defined(IMPL_MFBT)
-# define MFBT_API(type_)       MOZ_EXPORT_API(type_)
+#  define MFBT_API(type_)       MOZ_EXPORT_API(type_)
 #else
-# define MFBT_API(type_)       MOZ_IMPORT_API(type_)
+#  define MFBT_API(type_)       MOZ_IMPORT_API(type_)
 #endif
 
 
@@ -90,6 +90,43 @@
 
 #ifdef __cplusplus
 
+/*
+ * g++ requires -std=c++0x or -std=gnu++0x to support C++11 functionality
+ * without warnings (functionality used by the macros below).  These modes are
+ * detectable by checking whether __GXX_EXPERIMENTAL_CXX0X__ is defined or, more
+ * standardly, by checking whether __cplusplus has a C++11 or greater value.
+ * Current versions of g++ do not correctly set __cplusplus, so we check both
+ * for forward compatibility.
+ */
+#if defined(__clang__)
+#  if __clang_major__ >= 3
+#    define MOZ_HAVE_CXX11_DELETE
+#    define MOZ_HAVE_CXX11_OVERRIDE
+#  elif __clang_major__ == 2
+#    if __clang_minor__ >= 9
+#      define MOZ_HAVE_CXX11_DELETE
+#    endif
+#  endif
+#elif defined(__GNUC__)
+#  if defined(__GXX_EXPERIMENTAL_CXX0X__) || __cplusplus >= 201103L
+#    if __GNUC__ > 4
+#      define MOZ_HAVE_CXX11_DELETE
+#      define MOZ_HAVE_CXX11_OVERRIDE
+#    elif __GNUC__ == 4
+#      if __GNUC_MINOR__ >= 7
+#        define MOZ_HAVE_CXX11_OVERRIDE
+#      endif
+#      if __GNUC_MINOR__ >= 4
+#        define MOZ_HAVE_CXX11_DELETE
+#      endif
+#    endif
+#  endif
+#elif defined(_MSC_VER)
+#  if _MSC_VER >= 1400
+#    define MOZ_HAVE_CXX11_OVERRIDE
+#  endif
+#endif
+
 /*
  * MOZ_DELETE, specified immediately prior to the ';' terminating an undefined-
  * method declaration, attempts to delete that method from the corresponding
@@ -112,23 +149,51 @@
  * MOZ_DELETE relies on C++11 functionality not universally implemented.  As a
  * backstop, method declarations using MOZ_DELETE should be private.
  */
-#if defined(__clang__) && (__clang_major__ >= 3 || (__clang_major__ == 2 && __clang_minor__ >= 9))
-# define MOZ_DELETE            = delete
-#elif defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 4))
- /*
-  * g++ >= 4.4 requires -std=c++0x or -std=gnu++0x to support deleted functions
-  * without warnings.  These modes are detectable by the experimental macro used
-  * below or, more standardly, by checking whether __cplusplus has a C++11 or
-  * greater value.  Current versions of g++ do not correctly set __cplusplus, so
-  * we check both for forward compatibility.
-  */
-# if defined(__GXX_EXPERIMENTAL_CXX0X__) || __cplusplus >= 201103L
-#  define MOZ_DELETE           = delete
-# else
-#  define MOZ_DELETE           /* = delete */
-# endif
+#if defined(MOZ_HAVE_CXX11_DELETE)
+#  define MOZ_DELETE            = delete
 #else
-# define MOZ_DELETE            /* no = delete support, or unknown support */
+#  define MOZ_DELETE            /* no support */
+#endif
+
+/*
+ * MOZ_OVERRIDE explicitly indicates that a virtual member function in a class
+ * overrides a member function of a base class, rather than potentially being a
+ * new member function.  MOZ_OVERRIDE should be placed immediately before the
+ * ';' terminating the member function's declaration, or before '= 0;' if the
+ * member function is pure.  If the member function is defined in the class
+ * definition, it should appear before the opening brace of the function body.
+ *
+ *   class Base
+ *   {
+ *     public:
+ *       virtual void f() = 0;
+ *   };
+ *   class Derived1 : public Base
+ *   {
+ *     public:
+ *       virtual void f() MOZ_OVERRIDE;
+ *   };
+ *   class Derived2 : public Base
+ *   {
+ *     public:
+ *       virtual void f() MOZ_OVERRIDE = 0;
+ *   };
+ *   class Derived3 : public Base
+ *   {
+ *     public:
+ *       virtual void f() MOZ_OVERRIDE { }
+ *   };
+ *
+ * In compilers supporting C++11 override controls, MOZ_OVERRIDE *requires* that
+ * the function marked with it override a member function of a base class: it
+ * is a compile error if it does not.  Otherwise MOZ_OVERRIDE does not affect
+ * semantics and merely documents the override relationship to the reader (but
+ * of course must still be used correctly to not break C++11 compilers).
+ */
+#if defined(MOZ_HAVE_CXX11_OVERRIDE)
+#  define MOZ_OVERRIDE          override
+#else
+#  define MOZ_OVERRIDE          /* no support */
 #endif
 
 #endif /* __cplusplus */
diff --git a/mfbt/Util.h b/mfbt/Util.h
index 5322cf28dcb..6d87a25ee67 100644
--- a/mfbt/Util.h
+++ b/mfbt/Util.h
@@ -69,14 +69,10 @@ MOZ_END_EXTERN_C
  * which it fails will stop running in a loud and dramatic way.
  */
 #ifdef DEBUG
-
-# define MOZ_ASSERT(expr_)                                      \
-    ((expr_) ? (void)0 : JS_Assert(#expr_, __FILE__, __LINE__))
-
+#  define MOZ_ASSERT(expr_)                                      \
+     ((expr_) ? (void)0 : JS_Assert(#expr_, __FILE__, __LINE__))
 #else
-
-# define MOZ_ASSERT(expr_) ((void)0)
-
+#  define MOZ_ASSERT(expr_) ((void)0)
 #endif  /* DEBUG */
 
 /*
@@ -86,15 +82,15 @@ MOZ_END_EXTERN_C
  * may ignore this directive if it chooses.
  */
 #ifndef MOZ_INLINE
-# if defined __cplusplus
-#  define MOZ_INLINE          inline
-# elif defined _MSC_VER
-#  define MOZ_INLINE          __inline
-# elif defined __GNUC__
-#  define MOZ_INLINE          __inline__
-# else
-#  define MOZ_INLINE          inline
-# endif
+#  if defined __cplusplus
+#    define MOZ_INLINE          inline
+#  elif defined _MSC_VER
+#    define MOZ_INLINE          __inline
+#  elif defined __GNUC__
+#    define MOZ_INLINE          __inline__
+#  else
+#    define MOZ_INLINE          inline
+#  endif
 #endif
 
 /*
@@ -105,15 +101,15 @@ MOZ_END_EXTERN_C
  * to do so).
  */
 #ifndef MOZ_ALWAYS_INLINE
-# if defined DEBUG
-#  define MOZ_ALWAYS_INLINE   MOZ_INLINE
-# elif defined _MSC_VER
-#  define MOZ_ALWAYS_INLINE   __forceinline
-# elif defined __GNUC__
-#  define MOZ_ALWAYS_INLINE   __attribute__((always_inline)) MOZ_INLINE
-# else
-#  define MOZ_ALWAYS_INLINE   MOZ_INLINE
-# endif
+#  if defined DEBUG
+#    define MOZ_ALWAYS_INLINE   MOZ_INLINE
+#  elif defined _MSC_VER
+#    define MOZ_ALWAYS_INLINE   __forceinline
+#  elif defined __GNUC__
+#    define MOZ_ALWAYS_INLINE   __attribute__((always_inline)) MOZ_INLINE
+#  else
+#    define MOZ_ALWAYS_INLINE   MOZ_INLINE
+#  endif
 #endif
 
 /*
@@ -123,13 +119,13 @@ MOZ_END_EXTERN_C
  * guaranteed to support this, but most do.
  */
 #ifndef MOZ_NEVER_INLINE
-# if defined _MSC_VER
-#  define MOZ_NEVER_INLINE __declspec(noinline)
-# elif defined __GNUC__
-#  define MOZ_NEVER_INLINE __attribute__((noinline))
-# else
-#  define MOZ_NEVER_INLINE
-# endif
+#  if defined _MSC_VER
+#    define MOZ_NEVER_INLINE __declspec(noinline)
+#  elif defined __GNUC__
+#    define MOZ_NEVER_INLINE __attribute__((noinline))
+#  else
+#    define MOZ_NEVER_INLINE
+#  endif
 #endif
 
 #ifdef __cplusplus
@@ -224,18 +220,14 @@ public:
  */
 
 #if defined(__GNUC__)
-#define MOZ_ALIGNED_DECL(_type, _align) \
-  _type __attribute__((aligned(_align)))
-
+#  define MOZ_ALIGNED_DECL(_type, _align) \
+     _type __attribute__((aligned(_align)))
 #elif defined(_MSC_VER)
-#define MOZ_ALIGNED_DECL(_type, _align) \
-  __declspec(align(_align)) _type
-
+#  define MOZ_ALIGNED_DECL(_type, _align) \
+     __declspec(align(_align)) _type
 #else
-
-#warning "We don't know how to align variables on this compiler."
-#define MOZ_ALIGNED_DECL(_type, _align) _type
-
+#  warning "We don't know how to align variables on this compiler."
+#  define MOZ_ALIGNED_DECL(_type, _align) _type
 #endif
 
 /*
diff --git a/mobile/branding/aurora/android-resources.mn b/mobile/branding/aurora/android-resources.mn
deleted file mode 100644
index 0eb7e5d77e2..00000000000
--- a/mobile/branding/aurora/android-resources.mn
+++ /dev/null
@@ -1,6 +0,0 @@
-mobile/app/android/drawable/alertaddons.png
-mobile/app/android/drawable/alertdownloads.png
-mobile/branding/aurora/content/splash.png
-mobile/branding/aurora/content/splash_v9.9.png
-mobile/branding/aurora/content/splash_v8.9.png
-mobile/branding/aurora/content/favicon32.png
diff --git a/mobile/branding/beta/android-resources.mn b/mobile/branding/beta/android-resources.mn
deleted file mode 100644
index d735648d622..00000000000
--- a/mobile/branding/beta/android-resources.mn
+++ /dev/null
@@ -1,6 +0,0 @@
-mobile/app/android/drawable/alertaddons.png
-mobile/app/android/drawable/alertdownloads.png
-mobile/branding/beta/content/splash.png
-mobile/branding/beta/content/splash_v9.9.png
-mobile/branding/beta/content/splash_v8.9.png
-mobile/branding/beta/content/favicon32.png
diff --git a/mobile/branding/nightly/android-resources.mn b/mobile/branding/nightly/android-resources.mn
deleted file mode 100644
index 738e36c8402..00000000000
--- a/mobile/branding/nightly/android-resources.mn
+++ /dev/null
@@ -1,6 +0,0 @@
-mobile/app/android/drawable/alertaddons.png
-mobile/app/android/drawable/alertdownloads.png
-mobile/branding/nightly/content/splash.png
-mobile/branding/nightly/content/splash_v9.9.png
-mobile/branding/nightly/content/splash_v8.9.png
-mobile/branding/nightly/content/favicon32.png
diff --git a/mobile/branding/official/android-resources.mn b/mobile/branding/official/android-resources.mn
deleted file mode 100644
index 88c43acd9e8..00000000000
--- a/mobile/branding/official/android-resources.mn
+++ /dev/null
@@ -1,6 +0,0 @@
-mobile/app/android/drawable/alertaddons.png
-mobile/app/android/drawable/alertdownloads.png
-mobile/branding/official/content/splash.png
-mobile/branding/official/content/splash_v9.9.png
-mobile/branding/official/content/splash_v8.9.png
-mobile/branding/official/content/favicon32.png
diff --git a/mobile/branding/unofficial/Makefile.in b/mobile/branding/unofficial/Makefile.in
deleted file mode 100644
index bdf28e61f92..00000000000
--- a/mobile/branding/unofficial/Makefile.in
+++ /dev/null
@@ -1,49 +0,0 @@
-# ***** BEGIN LICENSE BLOCK *****
-# Version: MPL 1.1/GPL 2.0/LGPL 2.1
-#
-# The contents of this file are subject to the Mozilla Public License Version
-# 1.1 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-# http://www.mozilla.org/MPL/
-#
-# Software distributed under the License is distributed on an "AS IS" basis,
-# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-# for the specific language governing rights and limitations under the
-# License.
-#
-# The Original Code is mozilla.org code.
-#
-# The Initial Developer of the Original Code is Mozilla Corporation.
-# Portions created by the Initial Developer are Copyright (C) 2009
-# the Initial Developer. All Rights Reserved.
-#
-# Contributor(s):
-#   Justin Dolske <dolske@mozilla.com> (original author)
-#
-# Alternatively, the contents of this file may be used under the terms of
-# either the GNU General Public License Version 2 or later (the "GPL"), or
-# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-# in which case the provisions of the GPL or the LGPL are applicable instead
-# of those above. If you wish to allow use of your version of this file only
-# under the terms of either the GPL or the LGPL, and not to allow others to
-# use your version of this file under the terms of the MPL, indicate your
-# decision by deleting the provisions above and replace them with the notice
-# and other provisions required by the GPL or the LGPL. If you do not delete
-# the provisions above, a recipient may use your version of this file under
-# the terms of any one of the MPL, the GPL or the LGPL.
-#
-# ***** END LICENSE BLOCK *****
-
-DEPTH = ../../..
-topsrcdir = @top_srcdir@
-srcdir = @srcdir@
-VPATH = @srcdir@
-
-include $(DEPTH)/config/autoconf.mk
-
-DIRS = \
-	content \
-	locales \
-	$(NULL)
-
-include $(topsrcdir)/config/rules.mk
diff --git a/mobile/branding/unofficial/android-resources.mn b/mobile/branding/unofficial/android-resources.mn
deleted file mode 100644
index c676f533200..00000000000
--- a/mobile/branding/unofficial/android-resources.mn
+++ /dev/null
@@ -1,6 +0,0 @@
-mobile/app/android/drawable/alertaddons.png
-mobile/app/android/drawable/alertdownloads.png
-mobile/branding/unofficial/content/splash.png
-mobile/branding/unofficial/content/splash_v9.9.png
-mobile/branding/unofficial/content/splash_v8.9.png
-mobile/branding/unofficial/content/favicon32.png
diff --git a/mobile/branding/unofficial/content/Makefile.in b/mobile/branding/unofficial/content/Makefile.in
deleted file mode 100644
index 973bfd053d8..00000000000
--- a/mobile/branding/unofficial/content/Makefile.in
+++ /dev/null
@@ -1,25 +0,0 @@
-# Branding Makefile
-#  - jars chrome artwork
-
-DEPTH = ../../../..
-topsrcdir = @top_srcdir@
-srcdir = @srcdir@
-VPATH = @srcdir@
-
-include $(DEPTH)/config/autoconf.mk
-
-include $(topsrcdir)/config/rules.mk
-
-LINUX_BRANDING_FILES = \
-	fennec_26x26.png \
-	fennec_40x40.png \
-	fennec_48x48.png \
-	fennec_72x72.png \
-	fennec_scalable.png \
-	fennec_maemo_icon26.txt \
-	$(NULL)
-
-export::
-	$(NSINSTALL) -D $(DIST)/branding
-	cp $(addprefix $(srcdir)/, $(LINUX_BRANDING_FILES)) $(DIST)/branding/
-	$(NSINSTALL) -D $(DIST)/install
diff --git a/mobile/LICENSE b/mobile/xul/LICENSE
similarity index 100%
rename from mobile/LICENSE
rename to mobile/xul/LICENSE
diff --git a/mobile/Makefile.in b/mobile/xul/Makefile.in
similarity index 99%
rename from mobile/Makefile.in
rename to mobile/xul/Makefile.in
index 3dcc5a76c1d..803213b44e0 100644
--- a/mobile/Makefile.in
+++ b/mobile/xul/Makefile.in
@@ -36,7 +36,7 @@
 #
 # ***** END LICENSE BLOCK *****
 
-DEPTH      = ..
+DEPTH      = ../..
 topsrcdir  = @top_srcdir@
 srcdir     = @srcdir@
 VPATH      = @srcdir@
diff --git a/mobile/app/Makefile.in b/mobile/xul/app/Makefile.in
similarity index 99%
rename from mobile/app/Makefile.in
rename to mobile/xul/app/Makefile.in
index 7bcadafb12e..f7ab6448f26 100644
--- a/mobile/app/Makefile.in
+++ b/mobile/xul/app/Makefile.in
@@ -35,7 +35,7 @@
 #
 # ***** END LICENSE BLOCK *****
 
-DEPTH     = ../..
+DEPTH     = ../../..
 topsrcdir = @top_srcdir@
 srcdir    = @srcdir@
 VPATH     = @srcdir@
diff --git a/mobile/app/android/drawable-hdpi/alertaddons.png b/mobile/xul/app/android/drawable-hdpi/alertaddons.png
similarity index 100%
rename from mobile/app/android/drawable-hdpi/alertaddons.png
rename to mobile/xul/app/android/drawable-hdpi/alertaddons.png
diff --git a/mobile/app/android/drawable-hdpi/alertdownloads.png b/mobile/xul/app/android/drawable-hdpi/alertdownloads.png
similarity index 100%
rename from mobile/app/android/drawable-hdpi/alertdownloads.png
rename to mobile/xul/app/android/drawable-hdpi/alertdownloads.png
diff --git a/mobile/app/android/drawable/alertaddons.png b/mobile/xul/app/android/drawable/alertaddons.png
similarity index 100%
rename from mobile/app/android/drawable/alertaddons.png
rename to mobile/xul/app/android/drawable/alertaddons.png
diff --git a/mobile/app/android/drawable/alertdownloads.png b/mobile/xul/app/android/drawable/alertdownloads.png
similarity index 100%
rename from mobile/app/android/drawable/alertdownloads.png
rename to mobile/xul/app/android/drawable/alertdownloads.png
diff --git a/mobile/app/application.ini b/mobile/xul/app/application.ini
similarity index 100%
rename from mobile/app/application.ini
rename to mobile/xul/app/application.ini
diff --git a/mobile/app/macbuild/Contents/Info.plist.in b/mobile/xul/app/macbuild/Contents/Info.plist.in
similarity index 100%
rename from mobile/app/macbuild/Contents/Info.plist.in
rename to mobile/xul/app/macbuild/Contents/Info.plist.in
diff --git a/mobile/app/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in b/mobile/xul/app/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in
similarity index 100%
rename from mobile/app/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in
rename to mobile/xul/app/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in
diff --git a/mobile/app/maemo/toolbar_splash.png b/mobile/xul/app/maemo/toolbar_splash.png
similarity index 100%
rename from mobile/app/maemo/toolbar_splash.png
rename to mobile/xul/app/maemo/toolbar_splash.png
diff --git a/mobile/app/mobile.ico b/mobile/xul/app/mobile.ico
similarity index 100%
rename from mobile/app/mobile.ico
rename to mobile/xul/app/mobile.ico
diff --git a/mobile/app/mobile.js b/mobile/xul/app/mobile.js
similarity index 100%
rename from mobile/app/mobile.js
rename to mobile/xul/app/mobile.js
diff --git a/mobile/app/nsBrowserApp.cpp b/mobile/xul/app/nsBrowserApp.cpp
similarity index 100%
rename from mobile/app/nsBrowserApp.cpp
rename to mobile/xul/app/nsBrowserApp.cpp
diff --git a/mobile/app/profile/extensions/Makefile.in b/mobile/xul/app/profile/extensions/Makefile.in
similarity index 99%
rename from mobile/app/profile/extensions/Makefile.in
rename to mobile/xul/app/profile/extensions/Makefile.in
index 4b17a30661f..3d848671c7c 100644
--- a/mobile/app/profile/extensions/Makefile.in
+++ b/mobile/xul/app/profile/extensions/Makefile.in
@@ -35,7 +35,7 @@
 #
 # ***** END LICENSE BLOCK *****
 
-DEPTH		= ../../../..
+DEPTH		= ../../../../..
 topsrcdir	= @top_srcdir@
 srcdir		= @srcdir@
 VPATH		= @srcdir@
diff --git a/mobile/app/profile/extensions/feedback@mobile.mozilla.org/chrome.manifest b/mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/chrome.manifest
similarity index 100%
rename from mobile/app/profile/extensions/feedback@mobile.mozilla.org/chrome.manifest
rename to mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/chrome.manifest
diff --git a/mobile/app/profile/extensions/feedback@mobile.mozilla.org/content/content.js b/mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/content/content.js
similarity index 100%
rename from mobile/app/profile/extensions/feedback@mobile.mozilla.org/content/content.js
rename to mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/content/content.js
diff --git a/mobile/app/profile/extensions/feedback@mobile.mozilla.org/content/overlay.js b/mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/content/overlay.js
similarity index 100%
rename from mobile/app/profile/extensions/feedback@mobile.mozilla.org/content/overlay.js
rename to mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/content/overlay.js
diff --git a/mobile/app/profile/extensions/feedback@mobile.mozilla.org/content/overlay.xul b/mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/content/overlay.xul
similarity index 100%
rename from mobile/app/profile/extensions/feedback@mobile.mozilla.org/content/overlay.xul
rename to mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/content/overlay.xul
diff --git a/mobile/app/profile/extensions/feedback@mobile.mozilla.org/defaults/preferences/preferences.js b/mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/defaults/preferences/preferences.js
similarity index 100%
rename from mobile/app/profile/extensions/feedback@mobile.mozilla.org/defaults/preferences/preferences.js
rename to mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/defaults/preferences/preferences.js
diff --git a/mobile/app/profile/extensions/feedback@mobile.mozilla.org/install.rdf.in b/mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/install.rdf.in
similarity index 100%
rename from mobile/app/profile/extensions/feedback@mobile.mozilla.org/install.rdf.in
rename to mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/install.rdf.in
diff --git a/mobile/app/profile/extensions/feedback@mobile.mozilla.org/skin/beta-hdpi.png b/mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/skin/beta-hdpi.png
similarity index 100%
rename from mobile/app/profile/extensions/feedback@mobile.mozilla.org/skin/beta-hdpi.png
rename to mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/skin/beta-hdpi.png
diff --git a/mobile/app/profile/extensions/feedback@mobile.mozilla.org/skin/dino-32.png b/mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/skin/dino-32.png
similarity index 100%
rename from mobile/app/profile/extensions/feedback@mobile.mozilla.org/skin/dino-32.png
rename to mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/skin/dino-32.png
diff --git a/mobile/app/profile/extensions/feedback@mobile.mozilla.org/skin/happy-32.png b/mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/skin/happy-32.png
similarity index 100%
rename from mobile/app/profile/extensions/feedback@mobile.mozilla.org/skin/happy-32.png
rename to mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/skin/happy-32.png
diff --git a/mobile/app/profile/extensions/feedback@mobile.mozilla.org/skin/overlay.css b/mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/skin/overlay.css
similarity index 100%
rename from mobile/app/profile/extensions/feedback@mobile.mozilla.org/skin/overlay.css
rename to mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/skin/overlay.css
diff --git a/mobile/app/profile/extensions/feedback@mobile.mozilla.org/skin/sad-32.png b/mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/skin/sad-32.png
similarity index 100%
rename from mobile/app/profile/extensions/feedback@mobile.mozilla.org/skin/sad-32.png
rename to mobile/xul/app/profile/extensions/feedback@mobile.mozilla.org/skin/sad-32.png
diff --git a/mobile/branding/beta/Makefile.in b/mobile/xul/branding/aurora/Makefile.in
similarity index 98%
rename from mobile/branding/beta/Makefile.in
rename to mobile/xul/branding/aurora/Makefile.in
index bdf28e61f92..88b80f13649 100644
--- a/mobile/branding/beta/Makefile.in
+++ b/mobile/xul/branding/aurora/Makefile.in
@@ -34,7 +34,7 @@
 #
 # ***** END LICENSE BLOCK *****
 
-DEPTH = ../../..
+DEPTH = ../../../..
 topsrcdir = @top_srcdir@
 srcdir = @srcdir@
 VPATH = @srcdir@
diff --git a/mobile/xul/branding/aurora/android-resources.mn b/mobile/xul/branding/aurora/android-resources.mn
new file mode 100644
index 00000000000..1c1fe53d4ef
--- /dev/null
+++ b/mobile/xul/branding/aurora/android-resources.mn
@@ -0,0 +1,6 @@
+mobile/xul/app/android/drawable/alertaddons.png
+mobile/xul/app/android/drawable/alertdownloads.png
+mobile/xul/branding/aurora/content/splash.png
+mobile/xul/branding/aurora/content/splash_v9.9.png
+mobile/xul/branding/aurora/content/splash_v8.9.png
+mobile/xul/branding/aurora/content/favicon32.png
diff --git a/mobile/branding/aurora/configure.sh b/mobile/xul/branding/aurora/configure.sh
similarity index 100%
rename from mobile/branding/aurora/configure.sh
rename to mobile/xul/branding/aurora/configure.sh
diff --git a/mobile/branding/aurora/content/Makefile.in b/mobile/xul/branding/aurora/content/Makefile.in
similarity index 95%
rename from mobile/branding/aurora/content/Makefile.in
rename to mobile/xul/branding/aurora/content/Makefile.in
index 973bfd053d8..8e11e24800f 100644
--- a/mobile/branding/aurora/content/Makefile.in
+++ b/mobile/xul/branding/aurora/content/Makefile.in
@@ -1,7 +1,7 @@
 # Branding Makefile
 #  - jars chrome artwork
 
-DEPTH = ../../../..
+DEPTH = ../../../../..
 topsrcdir = @top_srcdir@
 srcdir = @srcdir@
 VPATH = @srcdir@
diff --git a/mobile/branding/aurora/content/about.png b/mobile/xul/branding/aurora/content/about.png
similarity index 100%
rename from mobile/branding/aurora/content/about.png
rename to mobile/xul/branding/aurora/content/about.png
diff --git a/mobile/branding/aurora/content/favicon32.png b/mobile/xul/branding/aurora/content/favicon32.png
similarity index 100%
rename from mobile/branding/aurora/content/favicon32.png
rename to mobile/xul/branding/aurora/content/favicon32.png
diff --git a/mobile/branding/aurora/content/fennec_26x26.png b/mobile/xul/branding/aurora/content/fennec_26x26.png
similarity index 100%
rename from mobile/branding/aurora/content/fennec_26x26.png
rename to mobile/xul/branding/aurora/content/fennec_26x26.png
diff --git a/mobile/branding/aurora/content/fennec_40x40.png b/mobile/xul/branding/aurora/content/fennec_40x40.png
similarity index 100%
rename from mobile/branding/aurora/content/fennec_40x40.png
rename to mobile/xul/branding/aurora/content/fennec_40x40.png
diff --git a/mobile/branding/aurora/content/fennec_48x48.png b/mobile/xul/branding/aurora/content/fennec_48x48.png
similarity index 100%
rename from mobile/branding/aurora/content/fennec_48x48.png
rename to mobile/xul/branding/aurora/content/fennec_48x48.png
diff --git a/mobile/branding/aurora/content/fennec_72x72.png b/mobile/xul/branding/aurora/content/fennec_72x72.png
similarity index 100%
rename from mobile/branding/aurora/content/fennec_72x72.png
rename to mobile/xul/branding/aurora/content/fennec_72x72.png
diff --git a/mobile/branding/aurora/content/fennec_maemo_icon26.txt b/mobile/xul/branding/aurora/content/fennec_maemo_icon26.txt
similarity index 100%
rename from mobile/branding/aurora/content/fennec_maemo_icon26.txt
rename to mobile/xul/branding/aurora/content/fennec_maemo_icon26.txt
diff --git a/mobile/branding/aurora/content/fennec_scalable.png b/mobile/xul/branding/aurora/content/fennec_scalable.png
similarity index 100%
rename from mobile/branding/aurora/content/fennec_scalable.png
rename to mobile/xul/branding/aurora/content/fennec_scalable.png
diff --git a/mobile/branding/aurora/content/jar.mn b/mobile/xul/branding/aurora/content/jar.mn
similarity index 100%
rename from mobile/branding/aurora/content/jar.mn
rename to mobile/xul/branding/aurora/content/jar.mn
diff --git a/mobile/branding/aurora/content/logo.png b/mobile/xul/branding/aurora/content/logo.png
similarity index 100%
rename from mobile/branding/aurora/content/logo.png
rename to mobile/xul/branding/aurora/content/logo.png
diff --git a/mobile/branding/aurora/content/logoWordmark.png b/mobile/xul/branding/aurora/content/logoWordmark.png
similarity index 100%
rename from mobile/branding/aurora/content/logoWordmark.png
rename to mobile/xul/branding/aurora/content/logoWordmark.png
diff --git a/mobile/branding/aurora/content/splash.png b/mobile/xul/branding/aurora/content/splash.png
similarity index 100%
rename from mobile/branding/aurora/content/splash.png
rename to mobile/xul/branding/aurora/content/splash.png
diff --git a/mobile/branding/aurora/content/splash_v8.9.png b/mobile/xul/branding/aurora/content/splash_v8.9.png
similarity index 100%
rename from mobile/branding/aurora/content/splash_v8.9.png
rename to mobile/xul/branding/aurora/content/splash_v8.9.png
diff --git a/mobile/branding/aurora/content/splash_v9.9.png b/mobile/xul/branding/aurora/content/splash_v9.9.png
similarity index 100%
rename from mobile/branding/aurora/content/splash_v9.9.png
rename to mobile/xul/branding/aurora/content/splash_v9.9.png
diff --git a/mobile/branding/nightly/locales/Makefile.in b/mobile/xul/branding/aurora/locales/Makefile.in
similarity index 98%
rename from mobile/branding/nightly/locales/Makefile.in
rename to mobile/xul/branding/aurora/locales/Makefile.in
index fd37ba4097c..059e6450283 100644
--- a/mobile/branding/nightly/locales/Makefile.in
+++ b/mobile/xul/branding/aurora/locales/Makefile.in
@@ -34,7 +34,7 @@
 #
 # ***** END LICENSE BLOCK *****
 
-DEPTH          = ../../../..
+DEPTH          = ../../../../..
 topsrcdir      = @top_srcdir@
 srcdir         = @srcdir@
 VPATH          = @srcdir@
diff --git a/mobile/branding/aurora/locales/en-US/brand.dtd b/mobile/xul/branding/aurora/locales/en-US/brand.dtd
similarity index 100%
rename from mobile/branding/aurora/locales/en-US/brand.dtd
rename to mobile/xul/branding/aurora/locales/en-US/brand.dtd
diff --git a/mobile/branding/aurora/locales/en-US/brand.properties b/mobile/xul/branding/aurora/locales/en-US/brand.properties
similarity index 100%
rename from mobile/branding/aurora/locales/en-US/brand.properties
rename to mobile/xul/branding/aurora/locales/en-US/brand.properties
diff --git a/mobile/branding/aurora/locales/jar.mn b/mobile/xul/branding/aurora/locales/jar.mn
similarity index 100%
rename from mobile/branding/aurora/locales/jar.mn
rename to mobile/xul/branding/aurora/locales/jar.mn
diff --git a/mobile/branding/aurora/Makefile.in b/mobile/xul/branding/beta/Makefile.in
similarity index 98%
rename from mobile/branding/aurora/Makefile.in
rename to mobile/xul/branding/beta/Makefile.in
index bdf28e61f92..88b80f13649 100644
--- a/mobile/branding/aurora/Makefile.in
+++ b/mobile/xul/branding/beta/Makefile.in
@@ -34,7 +34,7 @@
 #
 # ***** END LICENSE BLOCK *****
 
-DEPTH = ../../..
+DEPTH = ../../../..
 topsrcdir = @top_srcdir@
 srcdir = @srcdir@
 VPATH = @srcdir@
diff --git a/mobile/xul/branding/beta/android-resources.mn b/mobile/xul/branding/beta/android-resources.mn
new file mode 100644
index 00000000000..a23aab97a40
--- /dev/null
+++ b/mobile/xul/branding/beta/android-resources.mn
@@ -0,0 +1,6 @@
+mobile/xul/app/android/drawable/alertaddons.png
+mobile/xul/app/android/drawable/alertdownloads.png
+mobile/xul/branding/beta/content/splash.png
+mobile/xul/branding/beta/content/splash_v9.9.png
+mobile/xul/branding/beta/content/splash_v8.9.png
+mobile/xul/branding/beta/content/favicon32.png
diff --git a/mobile/branding/beta/configure.sh b/mobile/xul/branding/beta/configure.sh
similarity index 100%
rename from mobile/branding/beta/configure.sh
rename to mobile/xul/branding/beta/configure.sh
diff --git a/mobile/branding/beta/content/Makefile.in b/mobile/xul/branding/beta/content/Makefile.in
similarity index 95%
rename from mobile/branding/beta/content/Makefile.in
rename to mobile/xul/branding/beta/content/Makefile.in
index 973bfd053d8..8e11e24800f 100644
--- a/mobile/branding/beta/content/Makefile.in
+++ b/mobile/xul/branding/beta/content/Makefile.in
@@ -1,7 +1,7 @@
 # Branding Makefile
 #  - jars chrome artwork
 
-DEPTH = ../../../..
+DEPTH = ../../../../..
 topsrcdir = @top_srcdir@
 srcdir = @srcdir@
 VPATH = @srcdir@
diff --git a/mobile/branding/beta/content/about.png b/mobile/xul/branding/beta/content/about.png
similarity index 100%
rename from mobile/branding/beta/content/about.png
rename to mobile/xul/branding/beta/content/about.png
diff --git a/mobile/branding/beta/content/favicon32.png b/mobile/xul/branding/beta/content/favicon32.png
similarity index 100%
rename from mobile/branding/beta/content/favicon32.png
rename to mobile/xul/branding/beta/content/favicon32.png
diff --git a/mobile/branding/beta/content/fennec_26x26.png b/mobile/xul/branding/beta/content/fennec_26x26.png
similarity index 100%
rename from mobile/branding/beta/content/fennec_26x26.png
rename to mobile/xul/branding/beta/content/fennec_26x26.png
diff --git a/mobile/branding/beta/content/fennec_40x40.png b/mobile/xul/branding/beta/content/fennec_40x40.png
similarity index 100%
rename from mobile/branding/beta/content/fennec_40x40.png
rename to mobile/xul/branding/beta/content/fennec_40x40.png
diff --git a/mobile/branding/beta/content/fennec_48x48.png b/mobile/xul/branding/beta/content/fennec_48x48.png
similarity index 100%
rename from mobile/branding/beta/content/fennec_48x48.png
rename to mobile/xul/branding/beta/content/fennec_48x48.png
diff --git a/mobile/branding/beta/content/fennec_72x72.png b/mobile/xul/branding/beta/content/fennec_72x72.png
similarity index 100%
rename from mobile/branding/beta/content/fennec_72x72.png
rename to mobile/xul/branding/beta/content/fennec_72x72.png
diff --git a/mobile/branding/beta/content/fennec_maemo_icon26.txt b/mobile/xul/branding/beta/content/fennec_maemo_icon26.txt
similarity index 100%
rename from mobile/branding/beta/content/fennec_maemo_icon26.txt
rename to mobile/xul/branding/beta/content/fennec_maemo_icon26.txt
diff --git a/mobile/branding/beta/content/fennec_scalable.png b/mobile/xul/branding/beta/content/fennec_scalable.png
similarity index 100%
rename from mobile/branding/beta/content/fennec_scalable.png
rename to mobile/xul/branding/beta/content/fennec_scalable.png
diff --git a/mobile/branding/beta/content/jar.mn b/mobile/xul/branding/beta/content/jar.mn
similarity index 100%
rename from mobile/branding/beta/content/jar.mn
rename to mobile/xul/branding/beta/content/jar.mn
diff --git a/mobile/branding/beta/content/logo.png b/mobile/xul/branding/beta/content/logo.png
similarity index 100%
rename from mobile/branding/beta/content/logo.png
rename to mobile/xul/branding/beta/content/logo.png
diff --git a/mobile/branding/beta/content/logoWordmark.png b/mobile/xul/branding/beta/content/logoWordmark.png
similarity index 100%
rename from mobile/branding/beta/content/logoWordmark.png
rename to mobile/xul/branding/beta/content/logoWordmark.png
diff --git a/mobile/branding/beta/content/splash.png b/mobile/xul/branding/beta/content/splash.png
similarity index 100%
rename from mobile/branding/beta/content/splash.png
rename to mobile/xul/branding/beta/content/splash.png
diff --git a/mobile/branding/beta/content/splash_v8.9.png b/mobile/xul/branding/beta/content/splash_v8.9.png
similarity index 100%
rename from mobile/branding/beta/content/splash_v8.9.png
rename to mobile/xul/branding/beta/content/splash_v8.9.png
diff --git a/mobile/branding/beta/content/splash_v9.9.png b/mobile/xul/branding/beta/content/splash_v9.9.png
similarity index 100%
rename from mobile/branding/beta/content/splash_v9.9.png
rename to mobile/xul/branding/beta/content/splash_v9.9.png
diff --git a/mobile/branding/official/locales/Makefile.in b/mobile/xul/branding/beta/locales/Makefile.in
similarity index 98%
rename from mobile/branding/official/locales/Makefile.in
rename to mobile/xul/branding/beta/locales/Makefile.in
index 6baeb636634..289657bc173 100644
--- a/mobile/branding/official/locales/Makefile.in
+++ b/mobile/xul/branding/beta/locales/Makefile.in
@@ -34,7 +34,7 @@
 #
 # ***** END LICENSE BLOCK *****
 
-DEPTH          = ../../../..
+DEPTH          = ../../../../..
 topsrcdir      = @top_srcdir@
 srcdir         = @srcdir@
 VPATH          = @srcdir@
diff --git a/mobile/branding/beta/locales/en-US/brand.dtd b/mobile/xul/branding/beta/locales/en-US/brand.dtd
similarity index 100%
rename from mobile/branding/beta/locales/en-US/brand.dtd
rename to mobile/xul/branding/beta/locales/en-US/brand.dtd
diff --git a/mobile/branding/beta/locales/en-US/brand.properties b/mobile/xul/branding/beta/locales/en-US/brand.properties
similarity index 100%
rename from mobile/branding/beta/locales/en-US/brand.properties
rename to mobile/xul/branding/beta/locales/en-US/brand.properties
diff --git a/mobile/branding/beta/locales/jar.mn b/mobile/xul/branding/beta/locales/jar.mn
similarity index 100%
rename from mobile/branding/beta/locales/jar.mn
rename to mobile/xul/branding/beta/locales/jar.mn
diff --git a/mobile/branding/nightly/Makefile.in b/mobile/xul/branding/nightly/Makefile.in
similarity index 98%
rename from mobile/branding/nightly/Makefile.in
rename to mobile/xul/branding/nightly/Makefile.in
index bdf28e61f92..88b80f13649 100644
--- a/mobile/branding/nightly/Makefile.in
+++ b/mobile/xul/branding/nightly/Makefile.in
@@ -34,7 +34,7 @@
 #
 # ***** END LICENSE BLOCK *****
 
-DEPTH = ../../..
+DEPTH = ../../../..
 topsrcdir = @top_srcdir@
 srcdir = @srcdir@
 VPATH = @srcdir@
diff --git a/mobile/xul/branding/nightly/android-resources.mn b/mobile/xul/branding/nightly/android-resources.mn
new file mode 100644
index 00000000000..d4a9c1b0876
--- /dev/null
+++ b/mobile/xul/branding/nightly/android-resources.mn
@@ -0,0 +1,6 @@
+mobile/xul/app/android/drawable/alertaddons.png
+mobile/xul/app/android/drawable/alertdownloads.png
+mobile/xul/branding/nightly/content/splash.png
+mobile/xul/branding/nightly/content/splash_v9.9.png
+mobile/xul/branding/nightly/content/splash_v8.9.png
+mobile/xul/branding/nightly/content/favicon32.png
diff --git a/mobile/branding/nightly/configure.sh b/mobile/xul/branding/nightly/configure.sh
similarity index 100%
rename from mobile/branding/nightly/configure.sh
rename to mobile/xul/branding/nightly/configure.sh
diff --git a/mobile/branding/nightly/content/Makefile.in b/mobile/xul/branding/nightly/content/Makefile.in
similarity index 95%
rename from mobile/branding/nightly/content/Makefile.in
rename to mobile/xul/branding/nightly/content/Makefile.in
index 973bfd053d8..8e11e24800f 100644
--- a/mobile/branding/nightly/content/Makefile.in
+++ b/mobile/xul/branding/nightly/content/Makefile.in
@@ -1,7 +1,7 @@
 # Branding Makefile
 #  - jars chrome artwork
 
-DEPTH = ../../../..
+DEPTH = ../../../../..
 topsrcdir = @top_srcdir@
 srcdir = @srcdir@
 VPATH = @srcdir@
diff --git a/mobile/branding/nightly/content/about.png b/mobile/xul/branding/nightly/content/about.png
similarity index 100%
rename from mobile/branding/nightly/content/about.png
rename to mobile/xul/branding/nightly/content/about.png
diff --git a/mobile/branding/nightly/content/favicon32.png b/mobile/xul/branding/nightly/content/favicon32.png
similarity index 100%
rename from mobile/branding/nightly/content/favicon32.png
rename to mobile/xul/branding/nightly/content/favicon32.png
diff --git a/mobile/branding/nightly/content/fennec_26x26.png b/mobile/xul/branding/nightly/content/fennec_26x26.png
similarity index 100%
rename from mobile/branding/nightly/content/fennec_26x26.png
rename to mobile/xul/branding/nightly/content/fennec_26x26.png
diff --git a/mobile/branding/nightly/content/fennec_40x40.png b/mobile/xul/branding/nightly/content/fennec_40x40.png
similarity index 100%
rename from mobile/branding/nightly/content/fennec_40x40.png
rename to mobile/xul/branding/nightly/content/fennec_40x40.png
diff --git a/mobile/branding/nightly/content/fennec_48x48.png b/mobile/xul/branding/nightly/content/fennec_48x48.png
similarity index 100%
rename from mobile/branding/nightly/content/fennec_48x48.png
rename to mobile/xul/branding/nightly/content/fennec_48x48.png
diff --git a/mobile/branding/nightly/content/fennec_72x72.png b/mobile/xul/branding/nightly/content/fennec_72x72.png
similarity index 100%
rename from mobile/branding/nightly/content/fennec_72x72.png
rename to mobile/xul/branding/nightly/content/fennec_72x72.png
diff --git a/mobile/branding/nightly/content/fennec_maemo_icon26.txt b/mobile/xul/branding/nightly/content/fennec_maemo_icon26.txt
similarity index 100%
rename from mobile/branding/nightly/content/fennec_maemo_icon26.txt
rename to mobile/xul/branding/nightly/content/fennec_maemo_icon26.txt
diff --git a/mobile/branding/nightly/content/fennec_scalable.png b/mobile/xul/branding/nightly/content/fennec_scalable.png
similarity index 100%
rename from mobile/branding/nightly/content/fennec_scalable.png
rename to mobile/xul/branding/nightly/content/fennec_scalable.png
diff --git a/mobile/branding/nightly/content/jar.mn b/mobile/xul/branding/nightly/content/jar.mn
similarity index 100%
rename from mobile/branding/nightly/content/jar.mn
rename to mobile/xul/branding/nightly/content/jar.mn
diff --git a/mobile/branding/nightly/content/logo.png b/mobile/xul/branding/nightly/content/logo.png
similarity index 100%
rename from mobile/branding/nightly/content/logo.png
rename to mobile/xul/branding/nightly/content/logo.png
diff --git a/mobile/branding/nightly/content/logoWordmark.png b/mobile/xul/branding/nightly/content/logoWordmark.png
similarity index 100%
rename from mobile/branding/nightly/content/logoWordmark.png
rename to mobile/xul/branding/nightly/content/logoWordmark.png
diff --git a/mobile/branding/nightly/content/splash.png b/mobile/xul/branding/nightly/content/splash.png
similarity index 100%
rename from mobile/branding/nightly/content/splash.png
rename to mobile/xul/branding/nightly/content/splash.png
diff --git a/mobile/branding/nightly/content/splash_v8.9.png b/mobile/xul/branding/nightly/content/splash_v8.9.png
similarity index 100%
rename from mobile/branding/nightly/content/splash_v8.9.png
rename to mobile/xul/branding/nightly/content/splash_v8.9.png
diff --git a/mobile/branding/nightly/content/splash_v9.9.png b/mobile/xul/branding/nightly/content/splash_v9.9.png
similarity index 100%
rename from mobile/branding/nightly/content/splash_v9.9.png
rename to mobile/xul/branding/nightly/content/splash_v9.9.png
diff --git a/mobile/branding/aurora/locales/Makefile.in b/mobile/xul/branding/nightly/locales/Makefile.in
similarity index 98%
rename from mobile/branding/aurora/locales/Makefile.in
rename to mobile/xul/branding/nightly/locales/Makefile.in
index fd37ba4097c..059e6450283 100644
--- a/mobile/branding/aurora/locales/Makefile.in
+++ b/mobile/xul/branding/nightly/locales/Makefile.in
@@ -34,7 +34,7 @@
 #
 # ***** END LICENSE BLOCK *****
 
-DEPTH          = ../../../..
+DEPTH          = ../../../../..
 topsrcdir      = @top_srcdir@
 srcdir         = @srcdir@
 VPATH          = @srcdir@
diff --git a/mobile/branding/nightly/locales/en-US/brand.dtd b/mobile/xul/branding/nightly/locales/en-US/brand.dtd
similarity index 100%
rename from mobile/branding/nightly/locales/en-US/brand.dtd
rename to mobile/xul/branding/nightly/locales/en-US/brand.dtd
diff --git a/mobile/branding/nightly/locales/en-US/brand.properties b/mobile/xul/branding/nightly/locales/en-US/brand.properties
similarity index 100%
rename from mobile/branding/nightly/locales/en-US/brand.properties
rename to mobile/xul/branding/nightly/locales/en-US/brand.properties
diff --git a/mobile/branding/nightly/locales/jar.mn b/mobile/xul/branding/nightly/locales/jar.mn
similarity index 100%
rename from mobile/branding/nightly/locales/jar.mn
rename to mobile/xul/branding/nightly/locales/jar.mn
diff --git a/mobile/branding/official/Makefile.in b/mobile/xul/branding/official/Makefile.in
similarity index 98%
rename from mobile/branding/official/Makefile.in
rename to mobile/xul/branding/official/Makefile.in
index bdf28e61f92..88b80f13649 100644
--- a/mobile/branding/official/Makefile.in
+++ b/mobile/xul/branding/official/Makefile.in
@@ -34,7 +34,7 @@
 #
 # ***** END LICENSE BLOCK *****
 
-DEPTH = ../../..
+DEPTH = ../../../..
 topsrcdir = @top_srcdir@
 srcdir = @srcdir@
 VPATH = @srcdir@
diff --git a/mobile/xul/branding/official/android-resources.mn b/mobile/xul/branding/official/android-resources.mn
new file mode 100644
index 00000000000..6bcd6f1c510
--- /dev/null
+++ b/mobile/xul/branding/official/android-resources.mn
@@ -0,0 +1,6 @@
+mobile/xul/app/android/drawable/alertaddons.png
+mobile/xul/app/android/drawable/alertdownloads.png
+mobile/xul/branding/official/content/splash.png
+mobile/xul/branding/official/content/splash_v9.9.png
+mobile/xul/branding/official/content/splash_v8.9.png
+mobile/xul/branding/official/content/favicon32.png
diff --git a/mobile/branding/official/configure.sh b/mobile/xul/branding/official/configure.sh
similarity index 100%
rename from mobile/branding/official/configure.sh
rename to mobile/xul/branding/official/configure.sh
diff --git a/mobile/branding/official/content/Makefile.in b/mobile/xul/branding/official/content/Makefile.in
similarity index 95%
rename from mobile/branding/official/content/Makefile.in
rename to mobile/xul/branding/official/content/Makefile.in
index 973bfd053d8..8e11e24800f 100644
--- a/mobile/branding/official/content/Makefile.in
+++ b/mobile/xul/branding/official/content/Makefile.in
@@ -1,7 +1,7 @@
 # Branding Makefile
 #  - jars chrome artwork
 
-DEPTH = ../../../..
+DEPTH = ../../../../..
 topsrcdir = @top_srcdir@
 srcdir = @srcdir@
 VPATH = @srcdir@
diff --git a/mobile/branding/official/content/about.png b/mobile/xul/branding/official/content/about.png
similarity index 100%
rename from mobile/branding/official/content/about.png
rename to mobile/xul/branding/official/content/about.png
diff --git a/mobile/branding/official/content/favicon32.png b/mobile/xul/branding/official/content/favicon32.png
similarity index 100%
rename from mobile/branding/official/content/favicon32.png
rename to mobile/xul/branding/official/content/favicon32.png
diff --git a/mobile/branding/official/content/fennec_26x26.png b/mobile/xul/branding/official/content/fennec_26x26.png
similarity index 100%
rename from mobile/branding/official/content/fennec_26x26.png
rename to mobile/xul/branding/official/content/fennec_26x26.png
diff --git a/mobile/branding/official/content/fennec_40x40.png b/mobile/xul/branding/official/content/fennec_40x40.png
similarity index 100%
rename from mobile/branding/official/content/fennec_40x40.png
rename to mobile/xul/branding/official/content/fennec_40x40.png
diff --git a/mobile/branding/official/content/fennec_48x48.png b/mobile/xul/branding/official/content/fennec_48x48.png
similarity index 100%
rename from mobile/branding/official/content/fennec_48x48.png
rename to mobile/xul/branding/official/content/fennec_48x48.png
diff --git a/mobile/branding/official/content/fennec_72x72.png b/mobile/xul/branding/official/content/fennec_72x72.png
similarity index 100%
rename from mobile/branding/official/content/fennec_72x72.png
rename to mobile/xul/branding/official/content/fennec_72x72.png
diff --git a/mobile/branding/official/content/fennec_maemo_icon26.txt b/mobile/xul/branding/official/content/fennec_maemo_icon26.txt
similarity index 100%
rename from mobile/branding/official/content/fennec_maemo_icon26.txt
rename to mobile/xul/branding/official/content/fennec_maemo_icon26.txt
diff --git a/mobile/branding/official/content/fennec_scalable.png b/mobile/xul/branding/official/content/fennec_scalable.png
similarity index 100%
rename from mobile/branding/official/content/fennec_scalable.png
rename to mobile/xul/branding/official/content/fennec_scalable.png
diff --git a/mobile/branding/official/content/jar.mn b/mobile/xul/branding/official/content/jar.mn
similarity index 100%
rename from mobile/branding/official/content/jar.mn
rename to mobile/xul/branding/official/content/jar.mn
diff --git a/mobile/branding/official/content/logo.png b/mobile/xul/branding/official/content/logo.png
similarity index 100%
rename from mobile/branding/official/content/logo.png
rename to mobile/xul/branding/official/content/logo.png
diff --git a/mobile/branding/official/content/logoWordmark.png b/mobile/xul/branding/official/content/logoWordmark.png
similarity index 100%
rename from mobile/branding/official/content/logoWordmark.png
rename to mobile/xul/branding/official/content/logoWordmark.png
diff --git a/mobile/branding/official/content/splash.png b/mobile/xul/branding/official/content/splash.png
similarity index 100%
rename from mobile/branding/official/content/splash.png
rename to mobile/xul/branding/official/content/splash.png
diff --git a/mobile/branding/official/content/splash_v8.9.png b/mobile/xul/branding/official/content/splash_v8.9.png
similarity index 100%
rename from mobile/branding/official/content/splash_v8.9.png
rename to mobile/xul/branding/official/content/splash_v8.9.png
diff --git a/mobile/branding/official/content/splash_v9.9.png b/mobile/xul/branding/official/content/splash_v9.9.png
similarity index 100%
rename from mobile/branding/official/content/splash_v9.9.png
rename to mobile/xul/branding/official/content/splash_v9.9.png
diff --git a/mobile/branding/beta/locales/Makefile.in b/mobile/xul/branding/official/locales/Makefile.in
similarity index 98%
rename from mobile/branding/beta/locales/Makefile.in
rename to mobile/xul/branding/official/locales/Makefile.in
index 6baeb636634..289657bc173 100644
--- a/mobile/branding/beta/locales/Makefile.in
+++ b/mobile/xul/branding/official/locales/Makefile.in
@@ -34,7 +34,7 @@
 #
 # ***** END LICENSE BLOCK *****
 
-DEPTH          = ../../../..
+DEPTH          = ../../../../..
 topsrcdir      = @top_srcdir@
 srcdir         = @srcdir@
 VPATH          = @srcdir@
diff --git a/mobile/branding/official/locales/en-US/brand.dtd b/mobile/xul/branding/official/locales/en-US/brand.dtd
similarity index 100%
rename from mobile/branding/official/locales/en-US/brand.dtd
rename to mobile/xul/branding/official/locales/en-US/brand.dtd
diff --git a/mobile/branding/official/locales/en-US/brand.properties b/mobile/xul/branding/official/locales/en-US/brand.properties
similarity index 100%
rename from mobile/branding/official/locales/en-US/brand.properties
rename to mobile/xul/branding/official/locales/en-US/brand.properties
diff --git a/mobile/branding/official/locales/jar.mn b/mobile/xul/branding/official/locales/jar.mn
similarity index 100%
rename from mobile/branding/official/locales/jar.mn
rename to mobile/xul/branding/official/locales/jar.mn
diff --git a/mobile/xul/branding/unofficial/Makefile.in b/mobile/xul/branding/unofficial/Makefile.in
new file mode 100644
index 00000000000..88b80f13649
--- /dev/null
+++ b/mobile/xul/branding/unofficial/Makefile.in
@@ -0,0 +1,49 @@
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is mozilla.org code.
+#
+# The Initial Developer of the Original Code is Mozilla Corporation.
+# Portions created by the Initial Developer are Copyright (C) 2009
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#   Justin Dolske <dolske@mozilla.com> (original author)
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either the GNU General Public License Version 2 or later (the "GPL"), or
+# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+DEPTH = ../../../..
+topsrcdir = @top_srcdir@
+srcdir = @srcdir@
+VPATH = @srcdir@
+
+include $(DEPTH)/config/autoconf.mk
+
+DIRS = \
+	content \
+	locales \
+	$(NULL)
+
+include $(topsrcdir)/config/rules.mk
diff --git a/mobile/xul/branding/unofficial/android-resources.mn b/mobile/xul/branding/unofficial/android-resources.mn
new file mode 100644
index 00000000000..4789965d01b
--- /dev/null
+++ b/mobile/xul/branding/unofficial/android-resources.mn
@@ -0,0 +1,6 @@
+mobile/xul/app/android/drawable/alertaddons.png
+mobile/xul/app/android/drawable/alertdownloads.png
+mobile/xul/branding/unofficial/content/splash.png
+mobile/xul/branding/unofficial/content/splash_v9.9.png
+mobile/xul/branding/unofficial/content/splash_v8.9.png
+mobile/xul/branding/unofficial/content/favicon32.png
diff --git a/mobile/branding/unofficial/configure.sh b/mobile/xul/branding/unofficial/configure.sh
similarity index 100%
rename from mobile/branding/unofficial/configure.sh
rename to mobile/xul/branding/unofficial/configure.sh
diff --git a/mobile/xul/branding/unofficial/content/Makefile.in b/mobile/xul/branding/unofficial/content/Makefile.in
new file mode 100644
index 00000000000..8e11e24800f
--- /dev/null
+++ b/mobile/xul/branding/unofficial/content/Makefile.in
@@ -0,0 +1,25 @@
+# Branding Makefile
+#  - jars chrome artwork
+
+DEPTH = ../../../../..
+topsrcdir = @top_srcdir@
+srcdir = @srcdir@
+VPATH = @srcdir@
+
+include $(DEPTH)/config/autoconf.mk
+
+include $(topsrcdir)/config/rules.mk
+
+LINUX_BRANDING_FILES = \
+	fennec_26x26.png \
+	fennec_40x40.png \
+	fennec_48x48.png \
+	fennec_72x72.png \
+	fennec_scalable.png \
+	fennec_maemo_icon26.txt \
+	$(NULL)
+
+export::
+	$(NSINSTALL) -D $(DIST)/branding
+	cp $(addprefix $(srcdir)/, $(LINUX_BRANDING_FILES)) $(DIST)/branding/
+	$(NSINSTALL) -D $(DIST)/install
diff --git a/mobile/branding/unofficial/content/about.png b/mobile/xul/branding/unofficial/content/about.png
similarity index 100%
rename from mobile/branding/unofficial/content/about.png
rename to mobile/xul/branding/unofficial/content/about.png
diff --git a/mobile/branding/unofficial/content/favicon32.png b/mobile/xul/branding/unofficial/content/favicon32.png
similarity index 100%
rename from mobile/branding/unofficial/content/favicon32.png
rename to mobile/xul/branding/unofficial/content/favicon32.png
diff --git a/mobile/branding/unofficial/content/fennec_26x26.png b/mobile/xul/branding/unofficial/content/fennec_26x26.png
similarity index 100%
rename from mobile/branding/unofficial/content/fennec_26x26.png
rename to mobile/xul/branding/unofficial/content/fennec_26x26.png
diff --git a/mobile/branding/unofficial/content/fennec_40x40.png b/mobile/xul/branding/unofficial/content/fennec_40x40.png
similarity index 100%
rename from mobile/branding/unofficial/content/fennec_40x40.png
rename to mobile/xul/branding/unofficial/content/fennec_40x40.png
diff --git a/mobile/branding/unofficial/content/fennec_48x48.png b/mobile/xul/branding/unofficial/content/fennec_48x48.png
similarity index 100%
rename from mobile/branding/unofficial/content/fennec_48x48.png
rename to mobile/xul/branding/unofficial/content/fennec_48x48.png
diff --git a/mobile/branding/unofficial/content/fennec_72x72.png b/mobile/xul/branding/unofficial/content/fennec_72x72.png
similarity index 100%
rename from mobile/branding/unofficial/content/fennec_72x72.png
rename to mobile/xul/branding/unofficial/content/fennec_72x72.png
diff --git a/mobile/branding/unofficial/content/fennec_maemo_icon26.txt b/mobile/xul/branding/unofficial/content/fennec_maemo_icon26.txt
similarity index 100%
rename from mobile/branding/unofficial/content/fennec_maemo_icon26.txt
rename to mobile/xul/branding/unofficial/content/fennec_maemo_icon26.txt
diff --git a/mobile/branding/unofficial/content/fennec_scalable.png b/mobile/xul/branding/unofficial/content/fennec_scalable.png
similarity index 100%
rename from mobile/branding/unofficial/content/fennec_scalable.png
rename to mobile/xul/branding/unofficial/content/fennec_scalable.png
diff --git a/mobile/branding/unofficial/content/jar.mn b/mobile/xul/branding/unofficial/content/jar.mn
similarity index 100%
rename from mobile/branding/unofficial/content/jar.mn
rename to mobile/xul/branding/unofficial/content/jar.mn
diff --git a/mobile/branding/unofficial/content/logo.png b/mobile/xul/branding/unofficial/content/logo.png
similarity index 100%
rename from mobile/branding/unofficial/content/logo.png
rename to mobile/xul/branding/unofficial/content/logo.png
diff --git a/mobile/branding/unofficial/content/logoWordmark.png b/mobile/xul/branding/unofficial/content/logoWordmark.png
similarity index 100%
rename from mobile/branding/unofficial/content/logoWordmark.png
rename to mobile/xul/branding/unofficial/content/logoWordmark.png
diff --git a/mobile/branding/unofficial/content/splash.png b/mobile/xul/branding/unofficial/content/splash.png
similarity index 100%
rename from mobile/branding/unofficial/content/splash.png
rename to mobile/xul/branding/unofficial/content/splash.png
diff --git a/mobile/branding/unofficial/content/splash_v8.9.png b/mobile/xul/branding/unofficial/content/splash_v8.9.png
similarity index 100%
rename from mobile/branding/unofficial/content/splash_v8.9.png
rename to mobile/xul/branding/unofficial/content/splash_v8.9.png
diff --git a/mobile/branding/unofficial/content/splash_v9.9.png b/mobile/xul/branding/unofficial/content/splash_v9.9.png
similarity index 100%
rename from mobile/branding/unofficial/content/splash_v9.9.png
rename to mobile/xul/branding/unofficial/content/splash_v9.9.png
diff --git a/mobile/branding/unofficial/locales/Makefile.in b/mobile/xul/branding/unofficial/locales/Makefile.in
similarity index 98%
rename from mobile/branding/unofficial/locales/Makefile.in
rename to mobile/xul/branding/unofficial/locales/Makefile.in
index 9f277f5ed97..ff953528944 100644
--- a/mobile/branding/unofficial/locales/Makefile.in
+++ b/mobile/xul/branding/unofficial/locales/Makefile.in
@@ -35,7 +35,7 @@
 #
 # ***** END LICENSE BLOCK *****
 
-DEPTH          = ../../../..
+DEPTH          = ../../../../..
 topsrcdir      = @top_srcdir@
 srcdir         = @srcdir@
 VPATH          = @srcdir@
diff --git a/mobile/branding/unofficial/locales/en-US/brand.dtd b/mobile/xul/branding/unofficial/locales/en-US/brand.dtd
similarity index 100%
rename from mobile/branding/unofficial/locales/en-US/brand.dtd
rename to mobile/xul/branding/unofficial/locales/en-US/brand.dtd
diff --git a/mobile/branding/unofficial/locales/en-US/brand.properties b/mobile/xul/branding/unofficial/locales/en-US/brand.properties
similarity index 100%
rename from mobile/branding/unofficial/locales/en-US/brand.properties
rename to mobile/xul/branding/unofficial/locales/en-US/brand.properties
diff --git a/mobile/branding/unofficial/locales/jar.mn b/mobile/xul/branding/unofficial/locales/jar.mn
similarity index 100%
rename from mobile/branding/unofficial/locales/jar.mn
rename to mobile/xul/branding/unofficial/locales/jar.mn
diff --git a/mobile/build.mk b/mobile/xul/build.mk
similarity index 91%
rename from mobile/build.mk
rename to mobile/xul/build.mk
index 30aee7a52be..7d4db2d73b7 100644
--- a/mobile/build.mk
+++ b/mobile/xul/build.mk
@@ -37,7 +37,7 @@
 
 ifndef LIBXUL_SDK
 # Needed for building our components as part of libxul
-APP_LIBXUL_DIRS += mobile/components/build
+APP_LIBXUL_DIRS += mobile/xul/components/build
 
 include $(topsrcdir)/toolkit/toolkit-tiers.mk
 else
@@ -60,25 +60,25 @@ endif
 
 tier_app_dirs += \
   $(MOZ_BRANDING_DIRECTORY) \
-  mobile \
+  mobile/xul \
   $(NULL)
 
 
 installer: 
-	@$(MAKE) -C mobile/installer installer
+	@$(MAKE) -C mobile/xul/installer installer
 
 package:
-	@$(MAKE) -C mobile/installer
+	@$(MAKE) -C mobile/xul/installer
 
 install::
 	@echo "Mobile can't be installed directly."
 	@exit 1
 
 deb: package
-	@$(MAKE) -C mobile/installer deb
+	@$(MAKE) -C mobile/xul/installer deb
 
 upload::
-	@$(MAKE) -C mobile/installer upload
+	@$(MAKE) -C mobile/xul/installer upload
 
 ifdef ENABLE_TESTS
 # Implemented in testing/testsuite-targets.mk
diff --git a/mobile/chrome/Makefile.in b/mobile/xul/chrome/Makefile.in
similarity index 98%
rename from mobile/chrome/Makefile.in
rename to mobile/xul/chrome/Makefile.in
index 37adece347b..ca93fec14b6 100644
--- a/mobile/chrome/Makefile.in
+++ b/mobile/xul/chrome/Makefile.in
@@ -35,7 +35,7 @@
 #
 # ***** END LICENSE BLOCK *****
 
-DEPTH     = ../..
+DEPTH     = ../../..
 topsrcdir = @top_srcdir@
 srcdir    = @srcdir@
 VPATH     = @srcdir@
diff --git a/mobile/chrome/content/AlertsHelper.js b/mobile/xul/chrome/content/AlertsHelper.js
similarity index 100%
rename from mobile/chrome/content/AlertsHelper.js
rename to mobile/xul/chrome/content/AlertsHelper.js
diff --git a/mobile/chrome/content/AnimatedZoom.js b/mobile/xul/chrome/content/AnimatedZoom.js
similarity index 100%
rename from mobile/chrome/content/AnimatedZoom.js
rename to mobile/xul/chrome/content/AnimatedZoom.js
diff --git a/mobile/chrome/content/AppMenu.js b/mobile/xul/chrome/content/AppMenu.js
similarity index 100%
rename from mobile/chrome/content/AppMenu.js
rename to mobile/xul/chrome/content/AppMenu.js
diff --git a/mobile/chrome/content/AwesomePanel.js b/mobile/xul/chrome/content/AwesomePanel.js
similarity index 100%
rename from mobile/chrome/content/AwesomePanel.js
rename to mobile/xul/chrome/content/AwesomePanel.js
diff --git a/mobile/chrome/content/BookmarkHelper.js b/mobile/xul/chrome/content/BookmarkHelper.js
similarity index 100%
rename from mobile/chrome/content/BookmarkHelper.js
rename to mobile/xul/chrome/content/BookmarkHelper.js
diff --git a/mobile/chrome/content/BookmarkPopup.js b/mobile/xul/chrome/content/BookmarkPopup.js
similarity index 100%
rename from mobile/chrome/content/BookmarkPopup.js
rename to mobile/xul/chrome/content/BookmarkPopup.js
diff --git a/mobile/chrome/content/CaptureDialog.js b/mobile/xul/chrome/content/CaptureDialog.js
similarity index 100%
rename from mobile/chrome/content/CaptureDialog.js
rename to mobile/xul/chrome/content/CaptureDialog.js
diff --git a/mobile/chrome/content/CaptureDialog.xul b/mobile/xul/chrome/content/CaptureDialog.xul
similarity index 100%
rename from mobile/chrome/content/CaptureDialog.xul
rename to mobile/xul/chrome/content/CaptureDialog.xul
diff --git a/mobile/chrome/content/CapturePickerUI.js b/mobile/xul/chrome/content/CapturePickerUI.js
similarity index 100%
rename from mobile/chrome/content/CapturePickerUI.js
rename to mobile/xul/chrome/content/CapturePickerUI.js
diff --git a/mobile/chrome/content/CharsetMenu.js b/mobile/xul/chrome/content/CharsetMenu.js
similarity index 100%
rename from mobile/chrome/content/CharsetMenu.js
rename to mobile/xul/chrome/content/CharsetMenu.js
diff --git a/mobile/chrome/content/ContentPopupHelper.js b/mobile/xul/chrome/content/ContentPopupHelper.js
similarity index 100%
rename from mobile/chrome/content/ContentPopupHelper.js
rename to mobile/xul/chrome/content/ContentPopupHelper.js
diff --git a/mobile/chrome/content/ContextCommands.js b/mobile/xul/chrome/content/ContextCommands.js
similarity index 100%
rename from mobile/chrome/content/ContextCommands.js
rename to mobile/xul/chrome/content/ContextCommands.js
diff --git a/mobile/chrome/content/IndexedDB.js b/mobile/xul/chrome/content/IndexedDB.js
similarity index 100%
rename from mobile/chrome/content/IndexedDB.js
rename to mobile/xul/chrome/content/IndexedDB.js
diff --git a/mobile/chrome/content/LoginManagerChild.js b/mobile/xul/chrome/content/LoginManagerChild.js
similarity index 100%
rename from mobile/chrome/content/LoginManagerChild.js
rename to mobile/xul/chrome/content/LoginManagerChild.js
diff --git a/mobile/chrome/content/MasterPasswordUI.js b/mobile/xul/chrome/content/MasterPasswordUI.js
similarity index 100%
rename from mobile/chrome/content/MasterPasswordUI.js
rename to mobile/xul/chrome/content/MasterPasswordUI.js
diff --git a/mobile/chrome/content/MenuListHelperUI.js b/mobile/xul/chrome/content/MenuListHelperUI.js
similarity index 100%
rename from mobile/chrome/content/MenuListHelperUI.js
rename to mobile/xul/chrome/content/MenuListHelperUI.js
diff --git a/mobile/chrome/content/OfflineApps.js b/mobile/xul/chrome/content/OfflineApps.js
similarity index 100%
rename from mobile/chrome/content/OfflineApps.js
rename to mobile/xul/chrome/content/OfflineApps.js
diff --git a/mobile/chrome/content/PageActions.js b/mobile/xul/chrome/content/PageActions.js
similarity index 100%
rename from mobile/chrome/content/PageActions.js
rename to mobile/xul/chrome/content/PageActions.js
diff --git a/mobile/chrome/content/SelectHelperUI.js b/mobile/xul/chrome/content/SelectHelperUI.js
similarity index 100%
rename from mobile/chrome/content/SelectHelperUI.js
rename to mobile/xul/chrome/content/SelectHelperUI.js
diff --git a/mobile/chrome/content/SelectionHelper.js b/mobile/xul/chrome/content/SelectionHelper.js
similarity index 100%
rename from mobile/chrome/content/SelectionHelper.js
rename to mobile/xul/chrome/content/SelectionHelper.js
diff --git a/mobile/chrome/content/SharingUI.js b/mobile/xul/chrome/content/SharingUI.js
similarity index 100%
rename from mobile/chrome/content/SharingUI.js
rename to mobile/xul/chrome/content/SharingUI.js
diff --git a/mobile/chrome/content/TabletSidebar.js b/mobile/xul/chrome/content/TabletSidebar.js
similarity index 100%
rename from mobile/chrome/content/TabletSidebar.js
rename to mobile/xul/chrome/content/TabletSidebar.js
diff --git a/mobile/chrome/content/TabsPopup.js b/mobile/xul/chrome/content/TabsPopup.js
similarity index 100%
rename from mobile/chrome/content/TabsPopup.js
rename to mobile/xul/chrome/content/TabsPopup.js
diff --git a/mobile/chrome/content/Util.js b/mobile/xul/chrome/content/Util.js
similarity index 100%
rename from mobile/chrome/content/Util.js
rename to mobile/xul/chrome/content/Util.js
diff --git a/mobile/chrome/content/WebappsUI.js b/mobile/xul/chrome/content/WebappsUI.js
similarity index 100%
rename from mobile/chrome/content/WebappsUI.js
rename to mobile/xul/chrome/content/WebappsUI.js
diff --git a/mobile/chrome/content/about.xhtml b/mobile/xul/chrome/content/about.xhtml
similarity index 100%
rename from mobile/chrome/content/about.xhtml
rename to mobile/xul/chrome/content/about.xhtml
diff --git a/mobile/chrome/content/aboutCertError.xhtml b/mobile/xul/chrome/content/aboutCertError.xhtml
similarity index 100%
rename from mobile/chrome/content/aboutCertError.xhtml
rename to mobile/xul/chrome/content/aboutCertError.xhtml
diff --git a/mobile/chrome/content/aboutHome.xhtml b/mobile/xul/chrome/content/aboutHome.xhtml
similarity index 100%
rename from mobile/chrome/content/aboutHome.xhtml
rename to mobile/xul/chrome/content/aboutHome.xhtml
diff --git a/mobile/chrome/content/aboutRights.xhtml b/mobile/xul/chrome/content/aboutRights.xhtml
similarity index 100%
rename from mobile/chrome/content/aboutRights.xhtml
rename to mobile/xul/chrome/content/aboutRights.xhtml
diff --git a/mobile/chrome/content/bindings.xml b/mobile/xul/chrome/content/bindings.xml
similarity index 100%
rename from mobile/chrome/content/bindings.xml
rename to mobile/xul/chrome/content/bindings.xml
diff --git a/mobile/chrome/content/bindings/arrowbox.xml b/mobile/xul/chrome/content/bindings/arrowbox.xml
similarity index 100%
rename from mobile/chrome/content/bindings/arrowbox.xml
rename to mobile/xul/chrome/content/bindings/arrowbox.xml
diff --git a/mobile/chrome/content/bindings/browser.js b/mobile/xul/chrome/content/bindings/browser.js
similarity index 100%
rename from mobile/chrome/content/bindings/browser.js
rename to mobile/xul/chrome/content/bindings/browser.js
diff --git a/mobile/chrome/content/bindings/browser.xml b/mobile/xul/chrome/content/bindings/browser.xml
similarity index 100%
rename from mobile/chrome/content/bindings/browser.xml
rename to mobile/xul/chrome/content/bindings/browser.xml
diff --git a/mobile/chrome/content/bindings/checkbox.xml b/mobile/xul/chrome/content/bindings/checkbox.xml
similarity index 100%
rename from mobile/chrome/content/bindings/checkbox.xml
rename to mobile/xul/chrome/content/bindings/checkbox.xml
diff --git a/mobile/chrome/content/bindings/console.xml b/mobile/xul/chrome/content/bindings/console.xml
similarity index 100%
rename from mobile/chrome/content/bindings/console.xml
rename to mobile/xul/chrome/content/bindings/console.xml
diff --git a/mobile/chrome/content/bindings/dialog.xml b/mobile/xul/chrome/content/bindings/dialog.xml
similarity index 100%
rename from mobile/chrome/content/bindings/dialog.xml
rename to mobile/xul/chrome/content/bindings/dialog.xml
diff --git a/mobile/chrome/content/bindings/downloads.xml b/mobile/xul/chrome/content/bindings/downloads.xml
similarity index 100%
rename from mobile/chrome/content/bindings/downloads.xml
rename to mobile/xul/chrome/content/bindings/downloads.xml
diff --git a/mobile/chrome/content/bindings/extensions.xml b/mobile/xul/chrome/content/bindings/extensions.xml
similarity index 100%
rename from mobile/chrome/content/bindings/extensions.xml
rename to mobile/xul/chrome/content/bindings/extensions.xml
diff --git a/mobile/chrome/content/bindings/pageaction.xml b/mobile/xul/chrome/content/bindings/pageaction.xml
similarity index 100%
rename from mobile/chrome/content/bindings/pageaction.xml
rename to mobile/xul/chrome/content/bindings/pageaction.xml
diff --git a/mobile/chrome/content/blockedSite.xhtml b/mobile/xul/chrome/content/blockedSite.xhtml
similarity index 100%
rename from mobile/chrome/content/blockedSite.xhtml
rename to mobile/xul/chrome/content/blockedSite.xhtml
diff --git a/mobile/chrome/content/browser-scripts.js b/mobile/xul/chrome/content/browser-scripts.js
similarity index 100%
rename from mobile/chrome/content/browser-scripts.js
rename to mobile/xul/chrome/content/browser-scripts.js
diff --git a/mobile/chrome/content/browser-ui.js b/mobile/xul/chrome/content/browser-ui.js
similarity index 100%
rename from mobile/chrome/content/browser-ui.js
rename to mobile/xul/chrome/content/browser-ui.js
diff --git a/mobile/chrome/content/browser.css b/mobile/xul/chrome/content/browser.css
similarity index 100%
rename from mobile/chrome/content/browser.css
rename to mobile/xul/chrome/content/browser.css
diff --git a/mobile/chrome/content/browser.js b/mobile/xul/chrome/content/browser.js
similarity index 100%
rename from mobile/chrome/content/browser.js
rename to mobile/xul/chrome/content/browser.js
diff --git a/mobile/chrome/content/browser.xul b/mobile/xul/chrome/content/browser.xul
similarity index 100%
rename from mobile/chrome/content/browser.xul
rename to mobile/xul/chrome/content/browser.xul
diff --git a/mobile/chrome/content/commandUtil.js b/mobile/xul/chrome/content/commandUtil.js
similarity index 100%
rename from mobile/chrome/content/commandUtil.js
rename to mobile/xul/chrome/content/commandUtil.js
diff --git a/mobile/chrome/content/common-ui.js b/mobile/xul/chrome/content/common-ui.js
similarity index 100%
rename from mobile/chrome/content/common-ui.js
rename to mobile/xul/chrome/content/common-ui.js
diff --git a/mobile/chrome/content/config.js b/mobile/xul/chrome/content/config.js
similarity index 100%
rename from mobile/chrome/content/config.js
rename to mobile/xul/chrome/content/config.js
diff --git a/mobile/chrome/content/config.xul b/mobile/xul/chrome/content/config.xul
similarity index 100%
rename from mobile/chrome/content/config.xul
rename to mobile/xul/chrome/content/config.xul
diff --git a/mobile/chrome/content/console.js b/mobile/xul/chrome/content/console.js
similarity index 100%
rename from mobile/chrome/content/console.js
rename to mobile/xul/chrome/content/console.js
diff --git a/mobile/chrome/content/content.js b/mobile/xul/chrome/content/content.js
similarity index 100%
rename from mobile/chrome/content/content.js
rename to mobile/xul/chrome/content/content.js
diff --git a/mobile/chrome/content/cursor.css b/mobile/xul/chrome/content/cursor.css
similarity index 100%
rename from mobile/chrome/content/cursor.css
rename to mobile/xul/chrome/content/cursor.css
diff --git a/mobile/chrome/content/downloads.js b/mobile/xul/chrome/content/downloads.js
similarity index 100%
rename from mobile/chrome/content/downloads.js
rename to mobile/xul/chrome/content/downloads.js
diff --git a/mobile/chrome/content/exceptions.js b/mobile/xul/chrome/content/exceptions.js
similarity index 100%
rename from mobile/chrome/content/exceptions.js
rename to mobile/xul/chrome/content/exceptions.js
diff --git a/mobile/chrome/content/extensions.js b/mobile/xul/chrome/content/extensions.js
similarity index 100%
rename from mobile/chrome/content/extensions.js
rename to mobile/xul/chrome/content/extensions.js
diff --git a/mobile/chrome/content/forms.js b/mobile/xul/chrome/content/forms.js
similarity index 100%
rename from mobile/chrome/content/forms.js
rename to mobile/xul/chrome/content/forms.js
diff --git a/mobile/chrome/content/fullscreen-video.js b/mobile/xul/chrome/content/fullscreen-video.js
similarity index 100%
rename from mobile/chrome/content/fullscreen-video.js
rename to mobile/xul/chrome/content/fullscreen-video.js
diff --git a/mobile/chrome/content/fullscreen-video.xhtml b/mobile/xul/chrome/content/fullscreen-video.xhtml
similarity index 100%
rename from mobile/chrome/content/fullscreen-video.xhtml
rename to mobile/xul/chrome/content/fullscreen-video.xhtml
diff --git a/mobile/chrome/content/input.js b/mobile/xul/chrome/content/input.js
similarity index 100%
rename from mobile/chrome/content/input.js
rename to mobile/xul/chrome/content/input.js
diff --git a/mobile/chrome/content/languages.properties b/mobile/xul/chrome/content/languages.properties
similarity index 100%
rename from mobile/chrome/content/languages.properties
rename to mobile/xul/chrome/content/languages.properties
diff --git a/mobile/chrome/content/localePicker.js b/mobile/xul/chrome/content/localePicker.js
similarity index 100%
rename from mobile/chrome/content/localePicker.js
rename to mobile/xul/chrome/content/localePicker.js
diff --git a/mobile/chrome/content/localePicker.xul b/mobile/xul/chrome/content/localePicker.xul
similarity index 100%
rename from mobile/chrome/content/localePicker.xul
rename to mobile/xul/chrome/content/localePicker.xul
diff --git a/mobile/chrome/content/masterPassword.xul b/mobile/xul/chrome/content/masterPassword.xul
similarity index 100%
rename from mobile/chrome/content/masterPassword.xul
rename to mobile/xul/chrome/content/masterPassword.xul
diff --git a/mobile/chrome/content/netError.xhtml b/mobile/xul/chrome/content/netError.xhtml
similarity index 100%
rename from mobile/chrome/content/netError.xhtml
rename to mobile/xul/chrome/content/netError.xhtml
diff --git a/mobile/chrome/content/notification.xml b/mobile/xul/chrome/content/notification.xml
similarity index 100%
rename from mobile/chrome/content/notification.xml
rename to mobile/xul/chrome/content/notification.xml
diff --git a/mobile/chrome/content/preferences.js b/mobile/xul/chrome/content/preferences.js
similarity index 100%
rename from mobile/chrome/content/preferences.js
rename to mobile/xul/chrome/content/preferences.js
diff --git a/mobile/chrome/content/prompt/alert.xul b/mobile/xul/chrome/content/prompt/alert.xul
similarity index 100%
rename from mobile/chrome/content/prompt/alert.xul
rename to mobile/xul/chrome/content/prompt/alert.xul
diff --git a/mobile/chrome/content/prompt/confirm.xul b/mobile/xul/chrome/content/prompt/confirm.xul
similarity index 100%
rename from mobile/chrome/content/prompt/confirm.xul
rename to mobile/xul/chrome/content/prompt/confirm.xul
diff --git a/mobile/chrome/content/prompt/prompt.js b/mobile/xul/chrome/content/prompt/prompt.js
similarity index 100%
rename from mobile/chrome/content/prompt/prompt.js
rename to mobile/xul/chrome/content/prompt/prompt.js
diff --git a/mobile/chrome/content/prompt/prompt.xul b/mobile/xul/chrome/content/prompt/prompt.xul
similarity index 100%
rename from mobile/chrome/content/prompt/prompt.xul
rename to mobile/xul/chrome/content/prompt/prompt.xul
diff --git a/mobile/chrome/content/prompt/promptPassword.xul b/mobile/xul/chrome/content/prompt/promptPassword.xul
similarity index 100%
rename from mobile/chrome/content/prompt/promptPassword.xul
rename to mobile/xul/chrome/content/prompt/promptPassword.xul
diff --git a/mobile/chrome/content/prompt/select.xul b/mobile/xul/chrome/content/prompt/select.xul
similarity index 100%
rename from mobile/chrome/content/prompt/select.xul
rename to mobile/xul/chrome/content/prompt/select.xul
diff --git a/mobile/chrome/content/removeMasterPassword.xul b/mobile/xul/chrome/content/removeMasterPassword.xul
similarity index 100%
rename from mobile/chrome/content/removeMasterPassword.xul
rename to mobile/xul/chrome/content/removeMasterPassword.xul
diff --git a/mobile/chrome/content/sanitize.js b/mobile/xul/chrome/content/sanitize.js
similarity index 100%
rename from mobile/chrome/content/sanitize.js
rename to mobile/xul/chrome/content/sanitize.js
diff --git a/mobile/chrome/content/share.xul b/mobile/xul/chrome/content/share.xul
similarity index 100%
rename from mobile/chrome/content/share.xul
rename to mobile/xul/chrome/content/share.xul
diff --git a/mobile/chrome/content/sync.js b/mobile/xul/chrome/content/sync.js
similarity index 100%
rename from mobile/chrome/content/sync.js
rename to mobile/xul/chrome/content/sync.js
diff --git a/mobile/chrome/content/tabs.xml b/mobile/xul/chrome/content/tabs.xml
similarity index 100%
rename from mobile/chrome/content/tabs.xml
rename to mobile/xul/chrome/content/tabs.xml
diff --git a/mobile/chrome/content/webapps.xul b/mobile/xul/chrome/content/webapps.xul
similarity index 100%
rename from mobile/chrome/content/webapps.xul
rename to mobile/xul/chrome/content/webapps.xul
diff --git a/mobile/chrome/jar.mn b/mobile/xul/chrome/jar.mn
similarity index 100%
rename from mobile/chrome/jar.mn
rename to mobile/xul/chrome/jar.mn
diff --git a/mobile/chrome/tests/Makefile.in b/mobile/xul/chrome/tests/Makefile.in
similarity index 99%
rename from mobile/chrome/tests/Makefile.in
rename to mobile/xul/chrome/tests/Makefile.in
index 8eb8887bd17..5780f544d80 100644
--- a/mobile/chrome/tests/Makefile.in
+++ b/mobile/xul/chrome/tests/Makefile.in
@@ -35,7 +35,7 @@
 #
 # ***** END LICENSE BLOCK *****
 
-DEPTH     = ../../..
+DEPTH     = ../../../..
 topsrcdir = @top_srcdir@
 srcdir    = @srcdir@
 VPATH     = @srcdir@
diff --git a/mobile/chrome/tests/addons/browser_install1_1/bootstrap.js b/mobile/xul/chrome/tests/addons/browser_install1_1/bootstrap.js
similarity index 100%
rename from mobile/chrome/tests/addons/browser_install1_1/bootstrap.js
rename to mobile/xul/chrome/tests/addons/browser_install1_1/bootstrap.js
diff --git a/mobile/chrome/tests/addons/browser_install1_1/install.rdf b/mobile/xul/chrome/tests/addons/browser_install1_1/install.rdf
similarity index 100%
rename from mobile/chrome/tests/addons/browser_install1_1/install.rdf
rename to mobile/xul/chrome/tests/addons/browser_install1_1/install.rdf
diff --git a/mobile/chrome/tests/addons/browser_install1_2/install.rdf b/mobile/xul/chrome/tests/addons/browser_install1_2/install.rdf
similarity index 100%
rename from mobile/chrome/tests/addons/browser_install1_2/install.rdf
rename to mobile/xul/chrome/tests/addons/browser_install1_2/install.rdf
diff --git a/mobile/chrome/tests/addons/browser_install1_3/install.rdf b/mobile/xul/chrome/tests/addons/browser_install1_3/install.rdf
similarity index 100%
rename from mobile/chrome/tests/addons/browser_install1_3/install.rdf
rename to mobile/xul/chrome/tests/addons/browser_install1_3/install.rdf
diff --git a/mobile/chrome/tests/addons/browser_locale1/boostrap.js b/mobile/xul/chrome/tests/addons/browser_locale1/boostrap.js
similarity index 100%
rename from mobile/chrome/tests/addons/browser_locale1/boostrap.js
rename to mobile/xul/chrome/tests/addons/browser_locale1/boostrap.js
diff --git a/mobile/chrome/tests/addons/browser_locale1/chrome.manifest b/mobile/xul/chrome/tests/addons/browser_locale1/chrome.manifest
similarity index 100%
rename from mobile/chrome/tests/addons/browser_locale1/chrome.manifest
rename to mobile/xul/chrome/tests/addons/browser_locale1/chrome.manifest
diff --git a/mobile/chrome/tests/addons/browser_locale1/install.rdf b/mobile/xul/chrome/tests/addons/browser_locale1/install.rdf
similarity index 100%
rename from mobile/chrome/tests/addons/browser_locale1/install.rdf
rename to mobile/xul/chrome/tests/addons/browser_locale1/install.rdf
diff --git a/mobile/chrome/tests/browser_addons.js b/mobile/xul/chrome/tests/browser_addons.js
similarity index 100%
rename from mobile/chrome/tests/browser_addons.js
rename to mobile/xul/chrome/tests/browser_addons.js
diff --git a/mobile/chrome/tests/browser_addons_locales.js b/mobile/xul/chrome/tests/browser_addons_locales.js
similarity index 100%
rename from mobile/chrome/tests/browser_addons_locales.js
rename to mobile/xul/chrome/tests/browser_addons_locales.js
diff --git a/mobile/chrome/tests/browser_appmenu.js b/mobile/xul/chrome/tests/browser_appmenu.js
similarity index 100%
rename from mobile/chrome/tests/browser_appmenu.js
rename to mobile/xul/chrome/tests/browser_appmenu.js
diff --git a/mobile/chrome/tests/browser_autocomplete.html b/mobile/xul/chrome/tests/browser_autocomplete.html
similarity index 100%
rename from mobile/chrome/tests/browser_autocomplete.html
rename to mobile/xul/chrome/tests/browser_autocomplete.html
diff --git a/mobile/chrome/tests/browser_autocomplete.js b/mobile/xul/chrome/tests/browser_autocomplete.js
similarity index 100%
rename from mobile/chrome/tests/browser_autocomplete.js
rename to mobile/xul/chrome/tests/browser_autocomplete.js
diff --git a/mobile/chrome/tests/browser_autocompletesearch.js b/mobile/xul/chrome/tests/browser_autocompletesearch.js
similarity index 100%
rename from mobile/chrome/tests/browser_autocompletesearch.js
rename to mobile/xul/chrome/tests/browser_autocompletesearch.js
diff --git a/mobile/chrome/tests/browser_awesomescreen.js b/mobile/xul/chrome/tests/browser_awesomescreen.js
similarity index 100%
rename from mobile/chrome/tests/browser_awesomescreen.js
rename to mobile/xul/chrome/tests/browser_awesomescreen.js
diff --git a/mobile/chrome/tests/browser_blank_01.html b/mobile/xul/chrome/tests/browser_blank_01.html
similarity index 100%
rename from mobile/chrome/tests/browser_blank_01.html
rename to mobile/xul/chrome/tests/browser_blank_01.html
diff --git a/mobile/chrome/tests/browser_blank_02.html b/mobile/xul/chrome/tests/browser_blank_02.html
similarity index 100%
rename from mobile/chrome/tests/browser_blank_02.html
rename to mobile/xul/chrome/tests/browser_blank_02.html
diff --git a/mobile/chrome/tests/browser_blank_03.html b/mobile/xul/chrome/tests/browser_blank_03.html
similarity index 100%
rename from mobile/chrome/tests/browser_blank_03.html
rename to mobile/xul/chrome/tests/browser_blank_03.html
diff --git a/mobile/chrome/tests/browser_bookmarks.js b/mobile/xul/chrome/tests/browser_bookmarks.js
similarity index 100%
rename from mobile/chrome/tests/browser_bookmarks.js
rename to mobile/xul/chrome/tests/browser_bookmarks.js
diff --git a/mobile/chrome/tests/browser_bookmarks_star.js b/mobile/xul/chrome/tests/browser_bookmarks_star.js
similarity index 100%
rename from mobile/chrome/tests/browser_bookmarks_star.js
rename to mobile/xul/chrome/tests/browser_bookmarks_star.js
diff --git a/mobile/chrome/tests/browser_bookmarks_tags.js b/mobile/xul/chrome/tests/browser_bookmarks_tags.js
similarity index 100%
rename from mobile/chrome/tests/browser_bookmarks_tags.js
rename to mobile/xul/chrome/tests/browser_bookmarks_tags.js
diff --git a/mobile/chrome/tests/browser_click_content.html b/mobile/xul/chrome/tests/browser_click_content.html
similarity index 100%
rename from mobile/chrome/tests/browser_click_content.html
rename to mobile/xul/chrome/tests/browser_click_content.html
diff --git a/mobile/chrome/tests/browser_click_content.js b/mobile/xul/chrome/tests/browser_click_content.js
similarity index 100%
rename from mobile/chrome/tests/browser_click_content.js
rename to mobile/xul/chrome/tests/browser_click_content.js
diff --git a/mobile/chrome/tests/browser_contacts.js b/mobile/xul/chrome/tests/browser_contacts.js
similarity index 100%
rename from mobile/chrome/tests/browser_contacts.js
rename to mobile/xul/chrome/tests/browser_contacts.js
diff --git a/mobile/chrome/tests/browser_contentpopup.html b/mobile/xul/chrome/tests/browser_contentpopup.html
similarity index 100%
rename from mobile/chrome/tests/browser_contentpopup.html
rename to mobile/xul/chrome/tests/browser_contentpopup.html
diff --git a/mobile/chrome/tests/browser_contentpopup.js b/mobile/xul/chrome/tests/browser_contentpopup.js
similarity index 100%
rename from mobile/chrome/tests/browser_contentpopup.js
rename to mobile/xul/chrome/tests/browser_contentpopup.js
diff --git a/mobile/chrome/tests/browser_dragger.js b/mobile/xul/chrome/tests/browser_dragger.js
similarity index 100%
rename from mobile/chrome/tests/browser_dragger.js
rename to mobile/xul/chrome/tests/browser_dragger.js
diff --git a/mobile/chrome/tests/browser_escape.js b/mobile/xul/chrome/tests/browser_escape.js
similarity index 100%
rename from mobile/chrome/tests/browser_escape.js
rename to mobile/xul/chrome/tests/browser_escape.js
diff --git a/mobile/chrome/tests/browser_find.js b/mobile/xul/chrome/tests/browser_find.js
similarity index 100%
rename from mobile/chrome/tests/browser_find.js
rename to mobile/xul/chrome/tests/browser_find.js
diff --git a/mobile/chrome/tests/browser_focus.html b/mobile/xul/chrome/tests/browser_focus.html
similarity index 100%
rename from mobile/chrome/tests/browser_focus.html
rename to mobile/xul/chrome/tests/browser_focus.html
diff --git a/mobile/chrome/tests/browser_focus.js b/mobile/xul/chrome/tests/browser_focus.js
similarity index 100%
rename from mobile/chrome/tests/browser_focus.js
rename to mobile/xul/chrome/tests/browser_focus.js
diff --git a/mobile/chrome/tests/browser_forms.html b/mobile/xul/chrome/tests/browser_forms.html
similarity index 100%
rename from mobile/chrome/tests/browser_forms.html
rename to mobile/xul/chrome/tests/browser_forms.html
diff --git a/mobile/chrome/tests/browser_forms.js b/mobile/xul/chrome/tests/browser_forms.js
similarity index 100%
rename from mobile/chrome/tests/browser_forms.js
rename to mobile/xul/chrome/tests/browser_forms.js
diff --git a/mobile/chrome/tests/browser_formsZoom.html b/mobile/xul/chrome/tests/browser_formsZoom.html
similarity index 100%
rename from mobile/chrome/tests/browser_formsZoom.html
rename to mobile/xul/chrome/tests/browser_formsZoom.html
diff --git a/mobile/chrome/tests/browser_formsZoom.js b/mobile/xul/chrome/tests/browser_formsZoom.js
similarity index 100%
rename from mobile/chrome/tests/browser_formsZoom.js
rename to mobile/xul/chrome/tests/browser_formsZoom.js
diff --git a/mobile/chrome/tests/browser_history.js b/mobile/xul/chrome/tests/browser_history.js
similarity index 100%
rename from mobile/chrome/tests/browser_history.js
rename to mobile/xul/chrome/tests/browser_history.js
diff --git a/mobile/chrome/tests/browser_install.xml b/mobile/xul/chrome/tests/browser_install.xml
similarity index 100%
rename from mobile/chrome/tests/browser_install.xml
rename to mobile/xul/chrome/tests/browser_install.xml
diff --git a/mobile/chrome/tests/browser_localepicker.js b/mobile/xul/chrome/tests/browser_localepicker.js
similarity index 100%
rename from mobile/chrome/tests/browser_localepicker.js
rename to mobile/xul/chrome/tests/browser_localepicker.js
diff --git a/mobile/chrome/tests/browser_localepicker_escape.js b/mobile/xul/chrome/tests/browser_localepicker_escape.js
similarity index 100%
rename from mobile/chrome/tests/browser_localepicker_escape.js
rename to mobile/xul/chrome/tests/browser_localepicker_escape.js
diff --git a/mobile/chrome/tests/browser_localerepository.js b/mobile/xul/chrome/tests/browser_localerepository.js
similarity index 100%
rename from mobile/chrome/tests/browser_localerepository.js
rename to mobile/xul/chrome/tests/browser_localerepository.js
diff --git a/mobile/chrome/tests/browser_localerepository_buildid.js b/mobile/xul/chrome/tests/browser_localerepository_buildid.js
similarity index 100%
rename from mobile/chrome/tests/browser_localerepository_buildid.js
rename to mobile/xul/chrome/tests/browser_localerepository_buildid.js
diff --git a/mobile/chrome/tests/browser_localerepository_pref.js b/mobile/xul/chrome/tests/browser_localerepository_pref.js
similarity index 100%
rename from mobile/chrome/tests/browser_localerepository_pref.js
rename to mobile/xul/chrome/tests/browser_localerepository_pref.js
diff --git a/mobile/chrome/tests/browser_mainui.js b/mobile/xul/chrome/tests/browser_mainui.js
similarity index 100%
rename from mobile/chrome/tests/browser_mainui.js
rename to mobile/xul/chrome/tests/browser_mainui.js
diff --git a/mobile/chrome/tests/browser_navigation.js b/mobile/xul/chrome/tests/browser_navigation.js
similarity index 100%
rename from mobile/chrome/tests/browser_navigation.js
rename to mobile/xul/chrome/tests/browser_navigation.js
diff --git a/mobile/chrome/tests/browser_preferences_fulltoggle.js b/mobile/xul/chrome/tests/browser_preferences_fulltoggle.js
similarity index 100%
rename from mobile/chrome/tests/browser_preferences_fulltoggle.js
rename to mobile/xul/chrome/tests/browser_preferences_fulltoggle.js
diff --git a/mobile/chrome/tests/browser_preferences_text.js b/mobile/xul/chrome/tests/browser_preferences_text.js
similarity index 100%
rename from mobile/chrome/tests/browser_preferences_text.js
rename to mobile/xul/chrome/tests/browser_preferences_text.js
diff --git a/mobile/chrome/tests/browser_rect.js b/mobile/xul/chrome/tests/browser_rect.js
similarity index 100%
rename from mobile/chrome/tests/browser_rect.js
rename to mobile/xul/chrome/tests/browser_rect.js
diff --git a/mobile/chrome/tests/browser_rememberPassword.js b/mobile/xul/chrome/tests/browser_rememberPassword.js
similarity index 100%
rename from mobile/chrome/tests/browser_rememberPassword.js
rename to mobile/xul/chrome/tests/browser_rememberPassword.js
diff --git a/mobile/chrome/tests/browser_scroll.html b/mobile/xul/chrome/tests/browser_scroll.html
similarity index 100%
rename from mobile/chrome/tests/browser_scroll.html
rename to mobile/xul/chrome/tests/browser_scroll.html
diff --git a/mobile/chrome/tests/browser_scroll.js b/mobile/xul/chrome/tests/browser_scroll.js
similarity index 100%
rename from mobile/chrome/tests/browser_scroll.js
rename to mobile/xul/chrome/tests/browser_scroll.js
diff --git a/mobile/chrome/tests/browser_scrollbar.js b/mobile/xul/chrome/tests/browser_scrollbar.js
similarity index 100%
rename from mobile/chrome/tests/browser_scrollbar.js
rename to mobile/xul/chrome/tests/browser_scrollbar.js
diff --git a/mobile/chrome/tests/browser_scrollbar.sjs b/mobile/xul/chrome/tests/browser_scrollbar.sjs
similarity index 100%
rename from mobile/chrome/tests/browser_scrollbar.sjs
rename to mobile/xul/chrome/tests/browser_scrollbar.sjs
diff --git a/mobile/chrome/tests/browser_select.html b/mobile/xul/chrome/tests/browser_select.html
similarity index 100%
rename from mobile/chrome/tests/browser_select.html
rename to mobile/xul/chrome/tests/browser_select.html
diff --git a/mobile/chrome/tests/browser_select.js b/mobile/xul/chrome/tests/browser_select.js
similarity index 100%
rename from mobile/chrome/tests/browser_select.js
rename to mobile/xul/chrome/tests/browser_select.js
diff --git a/mobile/chrome/tests/browser_sessionstore.js b/mobile/xul/chrome/tests/browser_sessionstore.js
similarity index 100%
rename from mobile/chrome/tests/browser_sessionstore.js
rename to mobile/xul/chrome/tests/browser_sessionstore.js
diff --git a/mobile/chrome/tests/browser_sidebars.js b/mobile/xul/chrome/tests/browser_sidebars.js
similarity index 100%
rename from mobile/chrome/tests/browser_sidebars.js
rename to mobile/xul/chrome/tests/browser_sidebars.js
diff --git a/mobile/chrome/tests/browser_tabs.js b/mobile/xul/chrome/tests/browser_tabs.js
similarity index 100%
rename from mobile/chrome/tests/browser_tabs.js
rename to mobile/xul/chrome/tests/browser_tabs.js
diff --git a/mobile/chrome/tests/browser_tap_content.html b/mobile/xul/chrome/tests/browser_tap_content.html
similarity index 100%
rename from mobile/chrome/tests/browser_tap_content.html
rename to mobile/xul/chrome/tests/browser_tap_content.html
diff --git a/mobile/chrome/tests/browser_tap_contentedit.html b/mobile/xul/chrome/tests/browser_tap_contentedit.html
similarity index 100%
rename from mobile/chrome/tests/browser_tap_contentedit.html
rename to mobile/xul/chrome/tests/browser_tap_contentedit.html
diff --git a/mobile/chrome/tests/browser_tapping.js b/mobile/xul/chrome/tests/browser_tapping.js
similarity index 100%
rename from mobile/chrome/tests/browser_tapping.js
rename to mobile/xul/chrome/tests/browser_tapping.js
diff --git a/mobile/chrome/tests/browser_tapping_edit.js b/mobile/xul/chrome/tests/browser_tapping_edit.js
similarity index 100%
rename from mobile/chrome/tests/browser_tapping_edit.js
rename to mobile/xul/chrome/tests/browser_tapping_edit.js
diff --git a/mobile/chrome/tests/browser_test.js b/mobile/xul/chrome/tests/browser_test.js
similarity index 100%
rename from mobile/chrome/tests/browser_test.js
rename to mobile/xul/chrome/tests/browser_test.js
diff --git a/mobile/chrome/tests/browser_thumbnails.js b/mobile/xul/chrome/tests/browser_thumbnails.js
similarity index 100%
rename from mobile/chrome/tests/browser_thumbnails.js
rename to mobile/xul/chrome/tests/browser_thumbnails.js
diff --git a/mobile/chrome/tests/browser_title.sjs b/mobile/xul/chrome/tests/browser_title.sjs
similarity index 100%
rename from mobile/chrome/tests/browser_title.sjs
rename to mobile/xul/chrome/tests/browser_title.sjs
diff --git a/mobile/chrome/tests/browser_upgrade.rdf b/mobile/xul/chrome/tests/browser_upgrade.rdf
similarity index 100%
rename from mobile/chrome/tests/browser_upgrade.rdf
rename to mobile/xul/chrome/tests/browser_upgrade.rdf
diff --git a/mobile/chrome/tests/browser_viewport.js b/mobile/xul/chrome/tests/browser_viewport.js
similarity index 100%
rename from mobile/chrome/tests/browser_viewport.js
rename to mobile/xul/chrome/tests/browser_viewport.js
diff --git a/mobile/chrome/tests/browser_viewport.sjs b/mobile/xul/chrome/tests/browser_viewport.sjs
similarity index 100%
rename from mobile/chrome/tests/browser_viewport.sjs
rename to mobile/xul/chrome/tests/browser_viewport.sjs
diff --git a/mobile/chrome/tests/browser_vkb.js b/mobile/xul/chrome/tests/browser_vkb.js
similarity index 100%
rename from mobile/chrome/tests/browser_vkb.js
rename to mobile/xul/chrome/tests/browser_vkb.js
diff --git a/mobile/chrome/tests/head.js b/mobile/xul/chrome/tests/head.js
similarity index 100%
rename from mobile/chrome/tests/head.js
rename to mobile/xul/chrome/tests/head.js
diff --git a/mobile/chrome/tests/locales_list.sjs b/mobile/xul/chrome/tests/locales_list.sjs
similarity index 100%
rename from mobile/chrome/tests/locales_list.sjs
rename to mobile/xul/chrome/tests/locales_list.sjs
diff --git a/mobile/chrome/tests/mock_autocomplete.json b/mobile/xul/chrome/tests/mock_autocomplete.json
similarity index 100%
rename from mobile/chrome/tests/mock_autocomplete.json
rename to mobile/xul/chrome/tests/mock_autocomplete.json
diff --git a/mobile/chrome/tests/remote_autocomplete.js b/mobile/xul/chrome/tests/remote_autocomplete.js
similarity index 100%
rename from mobile/chrome/tests/remote_autocomplete.js
rename to mobile/xul/chrome/tests/remote_autocomplete.js
diff --git a/mobile/chrome/tests/remote_contentpopup.js b/mobile/xul/chrome/tests/remote_contentpopup.js
similarity index 100%
rename from mobile/chrome/tests/remote_contentpopup.js
rename to mobile/xul/chrome/tests/remote_contentpopup.js
diff --git a/mobile/chrome/tests/remote_focus.js b/mobile/xul/chrome/tests/remote_focus.js
similarity index 100%
rename from mobile/chrome/tests/remote_focus.js
rename to mobile/xul/chrome/tests/remote_focus.js
diff --git a/mobile/chrome/tests/remote_forms.js b/mobile/xul/chrome/tests/remote_forms.js
similarity index 100%
rename from mobile/chrome/tests/remote_forms.js
rename to mobile/xul/chrome/tests/remote_forms.js
diff --git a/mobile/chrome/tests/remote_formsZoom.js b/mobile/xul/chrome/tests/remote_formsZoom.js
similarity index 100%
rename from mobile/chrome/tests/remote_formsZoom.js
rename to mobile/xul/chrome/tests/remote_formsZoom.js
diff --git a/mobile/chrome/tests/remote_head.js b/mobile/xul/chrome/tests/remote_head.js
similarity index 100%
rename from mobile/chrome/tests/remote_head.js
rename to mobile/xul/chrome/tests/remote_head.js
diff --git a/mobile/chrome/tests/remote_vkb.js b/mobile/xul/chrome/tests/remote_vkb.js
similarity index 100%
rename from mobile/chrome/tests/remote_vkb.js
rename to mobile/xul/chrome/tests/remote_vkb.js
diff --git a/mobile/components/AboutRedirector.js b/mobile/xul/components/AboutRedirector.js
similarity index 100%
rename from mobile/components/AboutRedirector.js
rename to mobile/xul/components/AboutRedirector.js
diff --git a/mobile/components/AddonUpdateService.js b/mobile/xul/components/AddonUpdateService.js
similarity index 100%
rename from mobile/components/AddonUpdateService.js
rename to mobile/xul/components/AddonUpdateService.js
diff --git a/mobile/components/AlertsService.js b/mobile/xul/components/AlertsService.js
similarity index 100%
rename from mobile/components/AlertsService.js
rename to mobile/xul/components/AlertsService.js
diff --git a/mobile/components/AutoCompleteCache.js b/mobile/xul/components/AutoCompleteCache.js
similarity index 100%
rename from mobile/components/AutoCompleteCache.js
rename to mobile/xul/components/AutoCompleteCache.js
diff --git a/mobile/components/BlocklistPrompt.js b/mobile/xul/components/BlocklistPrompt.js
similarity index 100%
rename from mobile/components/BlocklistPrompt.js
rename to mobile/xul/components/BlocklistPrompt.js
diff --git a/mobile/components/BrowserCLH.js b/mobile/xul/components/BrowserCLH.js
similarity index 100%
rename from mobile/components/BrowserCLH.js
rename to mobile/xul/components/BrowserCLH.js
diff --git a/mobile/components/BrowserStartup.js b/mobile/xul/components/BrowserStartup.js
similarity index 100%
rename from mobile/components/BrowserStartup.js
rename to mobile/xul/components/BrowserStartup.js
diff --git a/mobile/components/CapturePicker.js b/mobile/xul/components/CapturePicker.js
similarity index 100%
rename from mobile/components/CapturePicker.js
rename to mobile/xul/components/CapturePicker.js
diff --git a/mobile/components/ContentDispatchChooser.js b/mobile/xul/components/ContentDispatchChooser.js
similarity index 100%
rename from mobile/components/ContentDispatchChooser.js
rename to mobile/xul/components/ContentDispatchChooser.js
diff --git a/mobile/components/ContentPermissionPrompt.js b/mobile/xul/components/ContentPermissionPrompt.js
similarity index 100%
rename from mobile/components/ContentPermissionPrompt.js
rename to mobile/xul/components/ContentPermissionPrompt.js
diff --git a/mobile/components/DirectoryProvider.js b/mobile/xul/components/DirectoryProvider.js
similarity index 100%
rename from mobile/components/DirectoryProvider.js
rename to mobile/xul/components/DirectoryProvider.js
diff --git a/mobile/components/DownloadManagerUI.js b/mobile/xul/components/DownloadManagerUI.js
similarity index 100%
rename from mobile/components/DownloadManagerUI.js
rename to mobile/xul/components/DownloadManagerUI.js
diff --git a/mobile/components/FormAutoComplete.js b/mobile/xul/components/FormAutoComplete.js
similarity index 100%
rename from mobile/components/FormAutoComplete.js
rename to mobile/xul/components/FormAutoComplete.js
diff --git a/mobile/components/HelperAppDialog.js b/mobile/xul/components/HelperAppDialog.js
similarity index 100%
rename from mobile/components/HelperAppDialog.js
rename to mobile/xul/components/HelperAppDialog.js
diff --git a/mobile/components/LoginManager.js b/mobile/xul/components/LoginManager.js
similarity index 100%
rename from mobile/components/LoginManager.js
rename to mobile/xul/components/LoginManager.js
diff --git a/mobile/components/LoginManagerPrompter.idl b/mobile/xul/components/LoginManagerPrompter.idl
similarity index 100%
rename from mobile/components/LoginManagerPrompter.idl
rename to mobile/xul/components/LoginManagerPrompter.idl
diff --git a/mobile/components/LoginManagerPrompter.js b/mobile/xul/components/LoginManagerPrompter.js
similarity index 100%
rename from mobile/components/LoginManagerPrompter.js
rename to mobile/xul/components/LoginManagerPrompter.js
diff --git a/mobile/components/Makefile.in b/mobile/xul/components/Makefile.in
similarity index 99%
rename from mobile/components/Makefile.in
rename to mobile/xul/components/Makefile.in
index 3ebffd1d6df..7eb512e290a 100644
--- a/mobile/components/Makefile.in
+++ b/mobile/xul/components/Makefile.in
@@ -36,7 +36,7 @@
 #
 # ***** END LICENSE BLOCK *****
 
-DEPTH      = ../..
+DEPTH      = ../../..
 topsrcdir  = @top_srcdir@
 srcdir     = @srcdir@
 VPATH      = @srcdir@
diff --git a/mobile/components/MobileComponents.manifest b/mobile/xul/components/MobileComponents.manifest
similarity index 100%
rename from mobile/components/MobileComponents.manifest
rename to mobile/xul/components/MobileComponents.manifest
diff --git a/mobile/components/PromptService.js b/mobile/xul/components/PromptService.js
similarity index 100%
rename from mobile/components/PromptService.js
rename to mobile/xul/components/PromptService.js
diff --git a/mobile/components/SafeBrowsing.js b/mobile/xul/components/SafeBrowsing.js
similarity index 100%
rename from mobile/components/SafeBrowsing.js
rename to mobile/xul/components/SafeBrowsing.js
diff --git a/mobile/components/SessionStore.idl b/mobile/xul/components/SessionStore.idl
similarity index 100%
rename from mobile/components/SessionStore.idl
rename to mobile/xul/components/SessionStore.idl
diff --git a/mobile/components/SessionStore.js b/mobile/xul/components/SessionStore.js
similarity index 100%
rename from mobile/components/SessionStore.js
rename to mobile/xul/components/SessionStore.js
diff --git a/mobile/components/Sidebar.js b/mobile/xul/components/Sidebar.js
similarity index 100%
rename from mobile/components/Sidebar.js
rename to mobile/xul/components/Sidebar.js
diff --git a/mobile/components/UpdatePrompt.js b/mobile/xul/components/UpdatePrompt.js
similarity index 100%
rename from mobile/components/UpdatePrompt.js
rename to mobile/xul/components/UpdatePrompt.js
diff --git a/mobile/components/XPIDialogService.js b/mobile/xul/components/XPIDialogService.js
similarity index 100%
rename from mobile/components/XPIDialogService.js
rename to mobile/xul/components/XPIDialogService.js
diff --git a/mobile/components/build/Makefile.in b/mobile/xul/components/build/Makefile.in
similarity index 99%
rename from mobile/components/build/Makefile.in
rename to mobile/xul/components/build/Makefile.in
index c547682e724..d1b510e7759 100644
--- a/mobile/components/build/Makefile.in
+++ b/mobile/xul/components/build/Makefile.in
@@ -36,7 +36,7 @@
 #
 # ***** END LICENSE BLOCK *****
 
-DEPTH		= ../../..
+DEPTH		= ../../../..
 topsrcdir	= @top_srcdir@
 srcdir		= @srcdir@
 VPATH		= @srcdir@
diff --git a/mobile/components/build/nsBrowserComponents.h b/mobile/xul/components/build/nsBrowserComponents.h
similarity index 100%
rename from mobile/components/build/nsBrowserComponents.h
rename to mobile/xul/components/build/nsBrowserComponents.h
diff --git a/mobile/components/build/nsBrowserModule.cpp b/mobile/xul/components/build/nsBrowserModule.cpp
similarity index 100%
rename from mobile/components/build/nsBrowserModule.cpp
rename to mobile/xul/components/build/nsBrowserModule.cpp
diff --git a/mobile/components/build/nsIShellService.idl b/mobile/xul/components/build/nsIShellService.idl
similarity index 100%
rename from mobile/components/build/nsIShellService.idl
rename to mobile/xul/components/build/nsIShellService.idl
diff --git a/mobile/components/build/nsShellService.cpp b/mobile/xul/components/build/nsShellService.cpp
similarity index 100%
rename from mobile/components/build/nsShellService.cpp
rename to mobile/xul/components/build/nsShellService.cpp
diff --git a/mobile/components/build/nsShellService.h b/mobile/xul/components/build/nsShellService.h
similarity index 100%
rename from mobile/components/build/nsShellService.h
rename to mobile/xul/components/build/nsShellService.h
diff --git a/mobile/config/mozconfigs/android/debug b/mobile/xul/config/mozconfigs/android/debug
similarity index 88%
rename from mobile/config/mozconfigs/android/debug
rename to mobile/xul/config/mozconfigs/android/debug
index ee1c58d30c7..5a8f6aff0f1 100644
--- a/mobile/config/mozconfigs/android/debug
+++ b/mobile/xul/config/mozconfigs/android/debug
@@ -4,6 +4,7 @@ ac_add_options --enable-debug
 
 # Build Fennec
 ac_add_options --enable-application=mobile
+ac_add_options --disable-elf-hack
 
 # Android
 ac_add_options --target=arm-linux-androideabi
@@ -18,4 +19,4 @@ ac_add_options --with-system-zlib
 export JAVA_HOME=/tools/jdk6
 export MOZILLA_OFFICIAL=1
 
-ac_add_options --with-branding=mobile/branding/nightly
+ac_add_options --with-branding=mobile/xul/branding/nightly
diff --git a/mobile/config/mozconfigs/android/nightly b/mobile/xul/config/mozconfigs/android/nightly
similarity index 90%
rename from mobile/config/mozconfigs/android/nightly
rename to mobile/xul/config/mozconfigs/android/nightly
index efe04e3a21f..053ca9b2215 100644
--- a/mobile/config/mozconfigs/android/nightly
+++ b/mobile/xul/config/mozconfigs/android/nightly
@@ -6,6 +6,7 @@ ac_add_options --enable-js-diagnostics
 
 # Build Fennec
 ac_add_options --enable-application=mobile
+ac_add_options --disable-elf-hack
 
 # Android
 ac_add_options --target=arm-linux-androideabi
@@ -21,4 +22,4 @@ ac_add_options --enable-update-channel=${MOZ_UPDATE_CHANNEL}
 export JAVA_HOME=/tools/jdk6
 export MOZILLA_OFFICIAL=1
 
-ac_add_options --with-branding=mobile/branding/nightly
+ac_add_options --with-branding=mobile/xul/branding/nightly
diff --git a/mobile/config/mozconfigs/linux-desktop/l10n-mozconfig b/mobile/xul/config/mozconfigs/linux-desktop/l10n-mozconfig
similarity index 100%
rename from mobile/config/mozconfigs/linux-desktop/l10n-mozconfig
rename to mobile/xul/config/mozconfigs/linux-desktop/l10n-mozconfig
diff --git a/mobile/config/mozconfigs/linux-desktop/nightly b/mobile/xul/config/mozconfigs/linux-desktop/nightly
similarity index 100%
rename from mobile/config/mozconfigs/linux-desktop/nightly
rename to mobile/xul/config/mozconfigs/linux-desktop/nightly
diff --git a/mobile/config/mozconfigs/macosx-desktop/l10n-mozconfig b/mobile/xul/config/mozconfigs/macosx-desktop/l10n-mozconfig
similarity index 100%
rename from mobile/config/mozconfigs/macosx-desktop/l10n-mozconfig
rename to mobile/xul/config/mozconfigs/macosx-desktop/l10n-mozconfig
diff --git a/mobile/config/mozconfigs/macosx-desktop/nightly b/mobile/xul/config/mozconfigs/macosx-desktop/nightly
similarity index 100%
rename from mobile/config/mozconfigs/macosx-desktop/nightly
rename to mobile/xul/config/mozconfigs/macosx-desktop/nightly
diff --git a/mobile/config/mozconfigs/win32-desktop/l10n-mozconfig b/mobile/xul/config/mozconfigs/win32-desktop/l10n-mozconfig
similarity index 100%
rename from mobile/config/mozconfigs/win32-desktop/l10n-mozconfig
rename to mobile/xul/config/mozconfigs/win32-desktop/l10n-mozconfig
diff --git a/mobile/config/mozconfigs/win32-desktop/nightly b/mobile/xul/config/mozconfigs/win32-desktop/nightly
similarity index 100%
rename from mobile/config/mozconfigs/win32-desktop/nightly
rename to mobile/xul/config/mozconfigs/win32-desktop/nightly
diff --git a/mobile/confvars.sh b/mobile/xul/confvars.sh
similarity index 95%
rename from mobile/confvars.sh
rename to mobile/xul/confvars.sh
index 733678370bf..9b9363cad56 100644
--- a/mobile/confvars.sh
+++ b/mobile/xul/confvars.sh
@@ -40,8 +40,8 @@ MOZ_APP_UA_NAME=Fennec
 
 MOZ_APP_VERSION=11.0a1
 
-MOZ_BRANDING_DIRECTORY=mobile/branding/unofficial
-MOZ_OFFICIAL_BRANDING_DIRECTORY=mobile/branding/official
+MOZ_BRANDING_DIRECTORY=mobile/xul/branding/unofficial
+MOZ_OFFICIAL_BRANDING_DIRECTORY=mobile/xul/branding/official
 # MOZ_APP_DISPLAYNAME is set by branding/configure.sh
 
 MOZ_SAFE_BROWSING=
diff --git a/mobile/installer/Makefile.in b/mobile/xul/installer/Makefile.in
similarity index 99%
rename from mobile/installer/Makefile.in
rename to mobile/xul/installer/Makefile.in
index 585e712363e..9c14db85320 100644
--- a/mobile/installer/Makefile.in
+++ b/mobile/xul/installer/Makefile.in
@@ -36,7 +36,7 @@
 #
 # ***** END LICENSE BLOCK *****
 
-DEPTH     = ../..
+DEPTH     = ../../..
 topsrcdir = @top_srcdir@
 srcdir    = @srcdir@
 VPATH     = @srcdir@
diff --git a/mobile/installer/debian/backup.in b/mobile/xul/installer/debian/backup.in
similarity index 100%
rename from mobile/installer/debian/backup.in
rename to mobile/xul/installer/debian/backup.in
diff --git a/mobile/installer/debian/changelog.in b/mobile/xul/installer/debian/changelog.in
similarity index 100%
rename from mobile/installer/debian/changelog.in
rename to mobile/xul/installer/debian/changelog.in
diff --git a/mobile/installer/debian/compat.in b/mobile/xul/installer/debian/compat.in
similarity index 100%
rename from mobile/installer/debian/compat.in
rename to mobile/xul/installer/debian/compat.in
diff --git a/mobile/installer/debian/control.in b/mobile/xul/installer/debian/control.in
similarity index 100%
rename from mobile/installer/debian/control.in
rename to mobile/xul/installer/debian/control.in
diff --git a/mobile/installer/debian/fennec-cud.sh.in b/mobile/xul/installer/debian/fennec-cud.sh.in
similarity index 100%
rename from mobile/installer/debian/fennec-cud.sh.in
rename to mobile/xul/installer/debian/fennec-cud.sh.in
diff --git a/mobile/installer/debian/fennec-rfs.sh.in b/mobile/xul/installer/debian/fennec-rfs.sh.in
similarity index 100%
rename from mobile/installer/debian/fennec-rfs.sh.in
rename to mobile/xul/installer/debian/fennec-rfs.sh.in
diff --git a/mobile/installer/debian/fennec.aegis.in b/mobile/xul/installer/debian/fennec.aegis.in
similarity index 100%
rename from mobile/installer/debian/fennec.aegis.in
rename to mobile/xul/installer/debian/fennec.aegis.in
diff --git a/mobile/installer/debian/fennec.conf.in b/mobile/xul/installer/debian/fennec.conf.in
similarity index 100%
rename from mobile/installer/debian/fennec.conf.in
rename to mobile/xul/installer/debian/fennec.conf.in
diff --git a/mobile/installer/debian/fennec.desktop.in b/mobile/xul/installer/debian/fennec.desktop.in
similarity index 100%
rename from mobile/installer/debian/fennec.desktop.in
rename to mobile/xul/installer/debian/fennec.desktop.in
diff --git a/mobile/installer/debian/fennec.links.in b/mobile/xul/installer/debian/fennec.links.in
similarity index 100%
rename from mobile/installer/debian/fennec.links.in
rename to mobile/xul/installer/debian/fennec.links.in
diff --git a/mobile/installer/debian/fennec.policy.in b/mobile/xul/installer/debian/fennec.policy.in
similarity index 100%
rename from mobile/installer/debian/fennec.policy.in
rename to mobile/xul/installer/debian/fennec.policy.in
diff --git a/mobile/installer/debian/fennec.postinst.in b/mobile/xul/installer/debian/fennec.postinst.in
similarity index 100%
rename from mobile/installer/debian/fennec.postinst.in
rename to mobile/xul/installer/debian/fennec.postinst.in
diff --git a/mobile/installer/debian/fennec.preinst.in b/mobile/xul/installer/debian/fennec.preinst.in
similarity index 100%
rename from mobile/installer/debian/fennec.preinst.in
rename to mobile/xul/installer/debian/fennec.preinst.in
diff --git a/mobile/installer/debian/fennec.prerm.in b/mobile/xul/installer/debian/fennec.prerm.in
similarity index 100%
rename from mobile/installer/debian/fennec.prerm.in
rename to mobile/xul/installer/debian/fennec.prerm.in
diff --git a/mobile/installer/debian/fennec.service.in b/mobile/xul/installer/debian/fennec.service.in
similarity index 100%
rename from mobile/installer/debian/fennec.service.in
rename to mobile/xul/installer/debian/fennec.service.in
diff --git a/mobile/installer/debian/files.in b/mobile/xul/installer/debian/files.in
similarity index 100%
rename from mobile/installer/debian/files.in
rename to mobile/xul/installer/debian/files.in
diff --git a/mobile/installer/debian/menu.in b/mobile/xul/installer/debian/menu.in
similarity index 100%
rename from mobile/installer/debian/menu.in
rename to mobile/xul/installer/debian/menu.in
diff --git a/mobile/installer/debian/restore.in b/mobile/xul/installer/debian/restore.in
similarity index 100%
rename from mobile/installer/debian/restore.in
rename to mobile/xul/installer/debian/restore.in
diff --git a/mobile/installer/mobile-l10n.js b/mobile/xul/installer/mobile-l10n.js
similarity index 100%
rename from mobile/installer/mobile-l10n.js
rename to mobile/xul/installer/mobile-l10n.js
diff --git a/mobile/installer/package-manifest.in b/mobile/xul/installer/package-manifest.in
similarity index 100%
rename from mobile/installer/package-manifest.in
rename to mobile/xul/installer/package-manifest.in
diff --git a/mobile/installer/removed-files.in b/mobile/xul/installer/removed-files.in
similarity index 100%
rename from mobile/installer/removed-files.in
rename to mobile/xul/installer/removed-files.in
diff --git a/mobile/locales/Makefile.in b/mobile/xul/locales/Makefile.in
similarity index 99%
rename from mobile/locales/Makefile.in
rename to mobile/xul/locales/Makefile.in
index 448a3595e50..24b2d21bd7a 100644
--- a/mobile/locales/Makefile.in
+++ b/mobile/xul/locales/Makefile.in
@@ -36,11 +36,11 @@
 #
 # ***** END LICENSE BLOCK *****
 
-DEPTH     = ../..
+DEPTH     = ../../..
 topsrcdir = @top_srcdir@
 srcdir    = @srcdir@
 VPATH     = @srcdir@
-relativesrcdir = mobile/locales
+relativesrcdir = mobile/xul/locales
 
 include $(DEPTH)/config/autoconf.mk
 include $(topsrcdir)/config/config.mk
diff --git a/mobile/locales/all-locales b/mobile/xul/locales/all-locales
similarity index 100%
rename from mobile/locales/all-locales
rename to mobile/xul/locales/all-locales
diff --git a/mobile/locales/en-US/chrome/about.dtd b/mobile/xul/locales/en-US/chrome/about.dtd
similarity index 100%
rename from mobile/locales/en-US/chrome/about.dtd
rename to mobile/xul/locales/en-US/chrome/about.dtd
diff --git a/mobile/locales/en-US/chrome/aboutCertError.dtd b/mobile/xul/locales/en-US/chrome/aboutCertError.dtd
similarity index 100%
rename from mobile/locales/en-US/chrome/aboutCertError.dtd
rename to mobile/xul/locales/en-US/chrome/aboutCertError.dtd
diff --git a/mobile/locales/en-US/chrome/aboutHome.dtd b/mobile/xul/locales/en-US/chrome/aboutHome.dtd
similarity index 100%
rename from mobile/locales/en-US/chrome/aboutHome.dtd
rename to mobile/xul/locales/en-US/chrome/aboutHome.dtd
diff --git a/mobile/locales/en-US/chrome/browser.dtd b/mobile/xul/locales/en-US/chrome/browser.dtd
similarity index 100%
rename from mobile/locales/en-US/chrome/browser.dtd
rename to mobile/xul/locales/en-US/chrome/browser.dtd
diff --git a/mobile/locales/en-US/chrome/browser.properties b/mobile/xul/locales/en-US/chrome/browser.properties
similarity index 100%
rename from mobile/locales/en-US/chrome/browser.properties
rename to mobile/xul/locales/en-US/chrome/browser.properties
diff --git a/mobile/locales/en-US/chrome/checkbox.dtd b/mobile/xul/locales/en-US/chrome/checkbox.dtd
similarity index 100%
rename from mobile/locales/en-US/chrome/checkbox.dtd
rename to mobile/xul/locales/en-US/chrome/checkbox.dtd
diff --git a/mobile/locales/en-US/chrome/config.dtd b/mobile/xul/locales/en-US/chrome/config.dtd
similarity index 100%
rename from mobile/locales/en-US/chrome/config.dtd
rename to mobile/xul/locales/en-US/chrome/config.dtd
diff --git a/mobile/locales/en-US/chrome/feedback.dtd b/mobile/xul/locales/en-US/chrome/feedback.dtd
similarity index 100%
rename from mobile/locales/en-US/chrome/feedback.dtd
rename to mobile/xul/locales/en-US/chrome/feedback.dtd
diff --git a/mobile/locales/en-US/chrome/localepicker.properties b/mobile/xul/locales/en-US/chrome/localepicker.properties
similarity index 100%
rename from mobile/locales/en-US/chrome/localepicker.properties
rename to mobile/xul/locales/en-US/chrome/localepicker.properties
diff --git a/mobile/locales/en-US/chrome/notification.dtd b/mobile/xul/locales/en-US/chrome/notification.dtd
similarity index 100%
rename from mobile/locales/en-US/chrome/notification.dtd
rename to mobile/xul/locales/en-US/chrome/notification.dtd
diff --git a/mobile/locales/en-US/chrome/overrides/appstrings.properties b/mobile/xul/locales/en-US/chrome/overrides/appstrings.properties
similarity index 100%
rename from mobile/locales/en-US/chrome/overrides/appstrings.properties
rename to mobile/xul/locales/en-US/chrome/overrides/appstrings.properties
diff --git a/mobile/locales/en-US/chrome/overrides/netError.dtd b/mobile/xul/locales/en-US/chrome/overrides/netError.dtd
similarity index 100%
rename from mobile/locales/en-US/chrome/overrides/netError.dtd
rename to mobile/xul/locales/en-US/chrome/overrides/netError.dtd
diff --git a/mobile/locales/en-US/chrome/overrides/passwordmgr.properties b/mobile/xul/locales/en-US/chrome/overrides/passwordmgr.properties
similarity index 100%
rename from mobile/locales/en-US/chrome/overrides/passwordmgr.properties
rename to mobile/xul/locales/en-US/chrome/overrides/passwordmgr.properties
diff --git a/mobile/locales/en-US/chrome/phishing.dtd b/mobile/xul/locales/en-US/chrome/phishing.dtd
similarity index 100%
rename from mobile/locales/en-US/chrome/phishing.dtd
rename to mobile/xul/locales/en-US/chrome/phishing.dtd
diff --git a/mobile/locales/en-US/chrome/preferences.dtd b/mobile/xul/locales/en-US/chrome/preferences.dtd
similarity index 100%
rename from mobile/locales/en-US/chrome/preferences.dtd
rename to mobile/xul/locales/en-US/chrome/preferences.dtd
diff --git a/mobile/locales/en-US/chrome/prompt.dtd b/mobile/xul/locales/en-US/chrome/prompt.dtd
similarity index 100%
rename from mobile/locales/en-US/chrome/prompt.dtd
rename to mobile/xul/locales/en-US/chrome/prompt.dtd
diff --git a/mobile/locales/en-US/chrome/region.properties b/mobile/xul/locales/en-US/chrome/region.properties
similarity index 100%
rename from mobile/locales/en-US/chrome/region.properties
rename to mobile/xul/locales/en-US/chrome/region.properties
diff --git a/mobile/locales/en-US/chrome/sync.dtd b/mobile/xul/locales/en-US/chrome/sync.dtd
similarity index 100%
rename from mobile/locales/en-US/chrome/sync.dtd
rename to mobile/xul/locales/en-US/chrome/sync.dtd
diff --git a/mobile/locales/en-US/chrome/sync.properties b/mobile/xul/locales/en-US/chrome/sync.properties
similarity index 100%
rename from mobile/locales/en-US/chrome/sync.properties
rename to mobile/xul/locales/en-US/chrome/sync.properties
diff --git a/mobile/locales/en-US/chrome/webapps.dtd b/mobile/xul/locales/en-US/chrome/webapps.dtd
similarity index 100%
rename from mobile/locales/en-US/chrome/webapps.dtd
rename to mobile/xul/locales/en-US/chrome/webapps.dtd
diff --git a/mobile/locales/en-US/crashreporter/crashreporter-override.ini b/mobile/xul/locales/en-US/crashreporter/crashreporter-override.ini
similarity index 100%
rename from mobile/locales/en-US/crashreporter/crashreporter-override.ini
rename to mobile/xul/locales/en-US/crashreporter/crashreporter-override.ini
diff --git a/mobile/locales/en-US/defines.inc b/mobile/xul/locales/en-US/defines.inc
similarity index 100%
rename from mobile/locales/en-US/defines.inc
rename to mobile/xul/locales/en-US/defines.inc
diff --git a/mobile/locales/en-US/installer/setup.ini b/mobile/xul/locales/en-US/installer/setup.ini
similarity index 100%
rename from mobile/locales/en-US/installer/setup.ini
rename to mobile/xul/locales/en-US/installer/setup.ini
diff --git a/mobile/locales/en-US/mobile-l10n.js b/mobile/xul/locales/en-US/mobile-l10n.js
similarity index 100%
rename from mobile/locales/en-US/mobile-l10n.js
rename to mobile/xul/locales/en-US/mobile-l10n.js
diff --git a/mobile/locales/en-US/profile/bookmarks.inc b/mobile/xul/locales/en-US/profile/bookmarks.inc
similarity index 100%
rename from mobile/locales/en-US/profile/bookmarks.inc
rename to mobile/xul/locales/en-US/profile/bookmarks.inc
diff --git a/mobile/locales/en-US/searchplugins/amazondotcom.xml b/mobile/xul/locales/en-US/searchplugins/amazondotcom.xml
similarity index 100%
rename from mobile/locales/en-US/searchplugins/amazondotcom.xml
rename to mobile/xul/locales/en-US/searchplugins/amazondotcom.xml
diff --git a/mobile/locales/en-US/searchplugins/google.xml b/mobile/xul/locales/en-US/searchplugins/google.xml
similarity index 100%
rename from mobile/locales/en-US/searchplugins/google.xml
rename to mobile/xul/locales/en-US/searchplugins/google.xml
diff --git a/mobile/locales/en-US/searchplugins/list.txt b/mobile/xul/locales/en-US/searchplugins/list.txt
similarity index 100%
rename from mobile/locales/en-US/searchplugins/list.txt
rename to mobile/xul/locales/en-US/searchplugins/list.txt
diff --git a/mobile/locales/en-US/searchplugins/twitter.xml b/mobile/xul/locales/en-US/searchplugins/twitter.xml
similarity index 100%
rename from mobile/locales/en-US/searchplugins/twitter.xml
rename to mobile/xul/locales/en-US/searchplugins/twitter.xml
diff --git a/mobile/locales/en-US/searchplugins/wikipedia.xml b/mobile/xul/locales/en-US/searchplugins/wikipedia.xml
similarity index 100%
rename from mobile/locales/en-US/searchplugins/wikipedia.xml
rename to mobile/xul/locales/en-US/searchplugins/wikipedia.xml
diff --git a/mobile/locales/en-US/searchplugins/yahoo.xml b/mobile/xul/locales/en-US/searchplugins/yahoo.xml
similarity index 100%
rename from mobile/locales/en-US/searchplugins/yahoo.xml
rename to mobile/xul/locales/en-US/searchplugins/yahoo.xml
diff --git a/mobile/locales/en-US/updater/updater.ini b/mobile/xul/locales/en-US/updater/updater.ini
similarity index 100%
rename from mobile/locales/en-US/updater/updater.ini
rename to mobile/xul/locales/en-US/updater/updater.ini
diff --git a/mobile/locales/filter.py b/mobile/xul/locales/filter.py
similarity index 100%
rename from mobile/locales/filter.py
rename to mobile/xul/locales/filter.py
diff --git a/mobile/locales/generic/install.rdf b/mobile/xul/locales/generic/install.rdf
similarity index 100%
rename from mobile/locales/generic/install.rdf
rename to mobile/xul/locales/generic/install.rdf
diff --git a/mobile/locales/generic/profile/bookmarks.json.in b/mobile/xul/locales/generic/profile/bookmarks.json.in
similarity index 100%
rename from mobile/locales/generic/profile/bookmarks.json.in
rename to mobile/xul/locales/generic/profile/bookmarks.json.in
diff --git a/mobile/locales/jar.mn b/mobile/xul/locales/jar.mn
similarity index 100%
rename from mobile/locales/jar.mn
rename to mobile/xul/locales/jar.mn
diff --git a/mobile/locales/l10n-central.ini b/mobile/xul/locales/l10n-central.ini
similarity index 100%
rename from mobile/locales/l10n-central.ini
rename to mobile/xul/locales/l10n-central.ini
diff --git a/mobile/locales/l10n-mozilla-1.9.2.ini b/mobile/xul/locales/l10n-mozilla-1.9.2.ini
similarity index 100%
rename from mobile/locales/l10n-mozilla-1.9.2.ini
rename to mobile/xul/locales/l10n-mozilla-1.9.2.ini
diff --git a/mobile/locales/l10n-mozilla-2.0.ini b/mobile/xul/locales/l10n-mozilla-2.0.ini
similarity index 100%
rename from mobile/locales/l10n-mozilla-2.0.ini
rename to mobile/xul/locales/l10n-mozilla-2.0.ini
diff --git a/mobile/locales/l10n.ini b/mobile/xul/locales/l10n.ini
similarity index 84%
rename from mobile/locales/l10n.ini
rename to mobile/xul/locales/l10n.ini
index c6f1781372d..588ae6d6eb6 100644
--- a/mobile/locales/l10n.ini
+++ b/mobile/xul/locales/l10n.ini
@@ -1,6 +1,6 @@
 [general]
 depth = ../..
-all = mobile/locales/all-locales
+all = mobile/xul/locales/all-locales
 
 [compare]
 dirs = mobile
diff --git a/mobile/locales/maemo-locales b/mobile/xul/locales/maemo-locales
similarity index 100%
rename from mobile/locales/maemo-locales
rename to mobile/xul/locales/maemo-locales
diff --git a/mobile/makefiles.sh b/mobile/xul/makefiles.sh
similarity index 85%
rename from mobile/makefiles.sh
rename to mobile/xul/makefiles.sh
index 99f971fc533..95a6759ed5b 100644
--- a/mobile/makefiles.sh
+++ b/mobile/xul/makefiles.sh
@@ -40,19 +40,19 @@ netwerk/locales/Makefile
 dom/locales/Makefile
 toolkit/locales/Makefile
 security/manager/locales/Makefile
-mobile/app/Makefile
-mobile/app/profile/extensions/Makefile
+mobile/xul/app/Makefile
+mobile/xul/app/profile/extensions/Makefile
 $MOZ_BRANDING_DIRECTORY/Makefile
 $MOZ_BRANDING_DIRECTORY/locales/Makefile
-mobile/chrome/Makefile
-mobile/chrome/tests/Makefile
-mobile/components/Makefile
-mobile/components/build/Makefile
-mobile/modules/Makefile
-mobile/installer/Makefile
-mobile/locales/Makefile
-mobile/Makefile
-mobile/themes/core/Makefile"
+mobile/xul/chrome/Makefile
+mobile/xul/chrome/tests/Makefile
+mobile/xul/components/Makefile
+mobile/xul/components/build/Makefile
+mobile/xul/modules/Makefile
+mobile/xul/installer/Makefile
+mobile/xul/locales/Makefile
+mobile/xul/Makefile
+mobile/xul/themes/core/Makefile"
 
 if test -n "$MOZ_UPDATE_PACKAGING"; then
    add_makefiles "
diff --git a/mobile/modules/LocaleRepository.jsm b/mobile/xul/modules/LocaleRepository.jsm
similarity index 100%
rename from mobile/modules/LocaleRepository.jsm
rename to mobile/xul/modules/LocaleRepository.jsm
diff --git a/mobile/modules/Makefile.in b/mobile/xul/modules/Makefile.in
similarity index 98%
rename from mobile/modules/Makefile.in
rename to mobile/xul/modules/Makefile.in
index c3093d82baf..98472a4182b 100644
--- a/mobile/modules/Makefile.in
+++ b/mobile/xul/modules/Makefile.in
@@ -35,7 +35,7 @@
 #
 # ***** END LICENSE BLOCK *****
 
-DEPTH      = ../..
+DEPTH      = ../../..
 topsrcdir  = @top_srcdir@
 srcdir     = @srcdir@
 VPATH      = @srcdir@
diff --git a/mobile/modules/contacts.jsm b/mobile/xul/modules/contacts.jsm
similarity index 100%
rename from mobile/modules/contacts.jsm
rename to mobile/xul/modules/contacts.jsm
diff --git a/mobile/modules/linuxTypes.jsm b/mobile/xul/modules/linuxTypes.jsm
similarity index 100%
rename from mobile/modules/linuxTypes.jsm
rename to mobile/xul/modules/linuxTypes.jsm
diff --git a/mobile/modules/video.jsm b/mobile/xul/modules/video.jsm
similarity index 100%
rename from mobile/modules/video.jsm
rename to mobile/xul/modules/video.jsm
diff --git a/mobile/themes/core/Makefile.in b/mobile/xul/themes/core/Makefile.in
similarity index 98%
rename from mobile/themes/core/Makefile.in
rename to mobile/xul/themes/core/Makefile.in
index 8cc28f3216e..b692a414a54 100644
--- a/mobile/themes/core/Makefile.in
+++ b/mobile/xul/themes/core/Makefile.in
@@ -36,7 +36,7 @@
 #
 # ***** END LICENSE BLOCK *****
 
-DEPTH	    = ../../..
+DEPTH	    = ../../../..
 topsrcdir	= @top_srcdir@
 srcdir		= @srcdir@
 VPATH		= @srcdir@
diff --git a/mobile/themes/core/about.css b/mobile/xul/themes/core/about.css
similarity index 100%
rename from mobile/themes/core/about.css
rename to mobile/xul/themes/core/about.css
diff --git a/mobile/themes/core/aboutHome.css b/mobile/xul/themes/core/aboutHome.css
similarity index 100%
rename from mobile/themes/core/aboutHome.css
rename to mobile/xul/themes/core/aboutHome.css
diff --git a/mobile/themes/core/aboutPage.css b/mobile/xul/themes/core/aboutPage.css
similarity index 100%
rename from mobile/themes/core/aboutPage.css
rename to mobile/xul/themes/core/aboutPage.css
diff --git a/mobile/themes/core/browser.css b/mobile/xul/themes/core/browser.css
similarity index 100%
rename from mobile/themes/core/browser.css
rename to mobile/xul/themes/core/browser.css
diff --git a/mobile/themes/core/config.css b/mobile/xul/themes/core/config.css
similarity index 100%
rename from mobile/themes/core/config.css
rename to mobile/xul/themes/core/config.css
diff --git a/mobile/themes/core/content.css b/mobile/xul/themes/core/content.css
similarity index 100%
rename from mobile/themes/core/content.css
rename to mobile/xul/themes/core/content.css
diff --git a/mobile/themes/core/defines.inc b/mobile/xul/themes/core/defines.inc
similarity index 100%
rename from mobile/themes/core/defines.inc
rename to mobile/xul/themes/core/defines.inc
diff --git a/mobile/themes/core/forms.css b/mobile/xul/themes/core/forms.css
similarity index 100%
rename from mobile/themes/core/forms.css
rename to mobile/xul/themes/core/forms.css
diff --git a/mobile/themes/core/gingerbread/browser.css b/mobile/xul/themes/core/gingerbread/browser.css
similarity index 100%
rename from mobile/themes/core/gingerbread/browser.css
rename to mobile/xul/themes/core/gingerbread/browser.css
diff --git a/mobile/themes/core/gingerbread/content.css b/mobile/xul/themes/core/gingerbread/content.css
similarity index 100%
rename from mobile/themes/core/gingerbread/content.css
rename to mobile/xul/themes/core/gingerbread/content.css
diff --git a/mobile/themes/core/gingerbread/defines.inc b/mobile/xul/themes/core/gingerbread/defines.inc
similarity index 100%
rename from mobile/themes/core/gingerbread/defines.inc
rename to mobile/xul/themes/core/gingerbread/defines.inc
diff --git a/mobile/themes/core/gingerbread/forms.css b/mobile/xul/themes/core/gingerbread/forms.css
similarity index 100%
rename from mobile/themes/core/gingerbread/forms.css
rename to mobile/xul/themes/core/gingerbread/forms.css
diff --git a/mobile/themes/core/gingerbread/images/aboutBackground.jpg b/mobile/xul/themes/core/gingerbread/images/aboutBackground.jpg
similarity index 100%
rename from mobile/themes/core/gingerbread/images/aboutBackground.jpg
rename to mobile/xul/themes/core/gingerbread/images/aboutBackground.jpg
diff --git a/mobile/themes/core/gingerbread/images/addons-default-hdpi.png b/mobile/xul/themes/core/gingerbread/images/addons-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/addons-default-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/addons-default-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/alert-addons-30.png b/mobile/xul/themes/core/gingerbread/images/alert-addons-30.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/alert-addons-30.png
rename to mobile/xul/themes/core/gingerbread/images/alert-addons-30.png
diff --git a/mobile/themes/core/gingerbread/images/alert-downloads-30.png b/mobile/xul/themes/core/gingerbread/images/alert-downloads-30.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/alert-downloads-30.png
rename to mobile/xul/themes/core/gingerbread/images/alert-downloads-30.png
diff --git a/mobile/themes/core/gingerbread/images/allpages-48.png b/mobile/xul/themes/core/gingerbread/images/allpages-48.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/allpages-48.png
rename to mobile/xul/themes/core/gingerbread/images/allpages-48.png
diff --git a/mobile/themes/core/gingerbread/images/appmenu-active-hdpi.png b/mobile/xul/themes/core/gingerbread/images/appmenu-active-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/appmenu-active-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/appmenu-active-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/appmenu-addons-hdpi.png b/mobile/xul/themes/core/gingerbread/images/appmenu-addons-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/appmenu-addons-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/appmenu-addons-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/appmenu-downloads-hdpi.png b/mobile/xul/themes/core/gingerbread/images/appmenu-downloads-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/appmenu-downloads-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/appmenu-downloads-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/appmenu-findinpage-hdpi.png b/mobile/xul/themes/core/gingerbread/images/appmenu-findinpage-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/appmenu-findinpage-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/appmenu-findinpage-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/appmenu-more-hdpi.png b/mobile/xul/themes/core/gingerbread/images/appmenu-more-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/appmenu-more-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/appmenu-more-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/appmenu-preferences-hdpi.png b/mobile/xul/themes/core/gingerbread/images/appmenu-preferences-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/appmenu-preferences-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/appmenu-preferences-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/appmenu-share-hdpi.png b/mobile/xul/themes/core/gingerbread/images/appmenu-share-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/appmenu-share-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/appmenu-share-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/appmenu-site-hdpi.png b/mobile/xul/themes/core/gingerbread/images/appmenu-site-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/appmenu-site-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/appmenu-site-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/arrowbox-down.png b/mobile/xul/themes/core/gingerbread/images/arrowbox-down.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/arrowbox-down.png
rename to mobile/xul/themes/core/gingerbread/images/arrowbox-down.png
diff --git a/mobile/themes/core/gingerbread/images/arrowbox-horiz.png b/mobile/xul/themes/core/gingerbread/images/arrowbox-horiz.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/arrowbox-horiz.png
rename to mobile/xul/themes/core/gingerbread/images/arrowbox-horiz.png
diff --git a/mobile/themes/core/gingerbread/images/arrowbox-up.png b/mobile/xul/themes/core/gingerbread/images/arrowbox-up.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/arrowbox-up.png
rename to mobile/xul/themes/core/gingerbread/images/arrowbox-up.png
diff --git a/mobile/themes/core/gingerbread/images/arrowdown-16.png b/mobile/xul/themes/core/gingerbread/images/arrowdown-16.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/arrowdown-16.png
rename to mobile/xul/themes/core/gingerbread/images/arrowdown-16.png
diff --git a/mobile/themes/core/gingerbread/images/arrowdowndark-16.png b/mobile/xul/themes/core/gingerbread/images/arrowdowndark-16.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/arrowdowndark-16.png
rename to mobile/xul/themes/core/gingerbread/images/arrowdowndark-16.png
diff --git a/mobile/themes/core/gingerbread/images/arrowleft-16.png b/mobile/xul/themes/core/gingerbread/images/arrowleft-16.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/arrowleft-16.png
rename to mobile/xul/themes/core/gingerbread/images/arrowleft-16.png
diff --git a/mobile/themes/core/gingerbread/images/arrowleftdark-16.png b/mobile/xul/themes/core/gingerbread/images/arrowleftdark-16.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/arrowleftdark-16.png
rename to mobile/xul/themes/core/gingerbread/images/arrowleftdark-16.png
diff --git a/mobile/themes/core/gingerbread/images/arrowright-16.png b/mobile/xul/themes/core/gingerbread/images/arrowright-16.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/arrowright-16.png
rename to mobile/xul/themes/core/gingerbread/images/arrowright-16.png
diff --git a/mobile/themes/core/gingerbread/images/arrowrightdark-16.png b/mobile/xul/themes/core/gingerbread/images/arrowrightdark-16.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/arrowrightdark-16.png
rename to mobile/xul/themes/core/gingerbread/images/arrowrightdark-16.png
diff --git a/mobile/themes/core/gingerbread/images/arrowup-16.png b/mobile/xul/themes/core/gingerbread/images/arrowup-16.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/arrowup-16.png
rename to mobile/xul/themes/core/gingerbread/images/arrowup-16.png
diff --git a/mobile/themes/core/gingerbread/images/arrowupdark-16.png b/mobile/xul/themes/core/gingerbread/images/arrowupdark-16.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/arrowupdark-16.png
rename to mobile/xul/themes/core/gingerbread/images/arrowupdark-16.png
diff --git a/mobile/themes/core/gingerbread/images/autocomplete-bookmarked-hdpi.png b/mobile/xul/themes/core/gingerbread/images/autocomplete-bookmarked-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/autocomplete-bookmarked-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/autocomplete-bookmarked-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/autocomplete-desktop-hdpi.png b/mobile/xul/themes/core/gingerbread/images/autocomplete-desktop-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/autocomplete-desktop-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/autocomplete-desktop-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/autocomplete-search-hdpi.png b/mobile/xul/themes/core/gingerbread/images/autocomplete-search-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/autocomplete-search-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/autocomplete-search-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/back-default-hdpi.png b/mobile/xul/themes/core/gingerbread/images/back-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/back-default-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/back-default-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/bookmark-default-hdpi.png b/mobile/xul/themes/core/gingerbread/images/bookmark-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/bookmark-default-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/bookmark-default-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/bookmark-starred-hdpi.png b/mobile/xul/themes/core/gingerbread/images/bookmark-starred-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/bookmark-starred-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/bookmark-starred-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/bookmarks-48.png b/mobile/xul/themes/core/gingerbread/images/bookmarks-48.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/bookmarks-48.png
rename to mobile/xul/themes/core/gingerbread/images/bookmarks-48.png
diff --git a/mobile/themes/core/gingerbread/images/browseaddons-bg.jpg b/mobile/xul/themes/core/gingerbread/images/browseaddons-bg.jpg
similarity index 100%
rename from mobile/themes/core/gingerbread/images/browseaddons-bg.jpg
rename to mobile/xul/themes/core/gingerbread/images/browseaddons-bg.jpg
diff --git a/mobile/themes/core/gingerbread/images/button-bg.png b/mobile/xul/themes/core/gingerbread/images/button-bg.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/button-bg.png
rename to mobile/xul/themes/core/gingerbread/images/button-bg.png
diff --git a/mobile/themes/core/gingerbread/images/check-30.png b/mobile/xul/themes/core/gingerbread/images/check-30.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/check-30.png
rename to mobile/xul/themes/core/gingerbread/images/check-30.png
diff --git a/mobile/themes/core/gingerbread/images/check-selected-hdpi.png b/mobile/xul/themes/core/gingerbread/images/check-selected-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/check-selected-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/check-selected-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/check-unselected-hdpi.png b/mobile/xul/themes/core/gingerbread/images/check-unselected-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/check-unselected-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/check-unselected-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/close-active-hdpi.png b/mobile/xul/themes/core/gingerbread/images/close-active-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/close-active-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/close-active-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/close-active-tablet-hdpi.png b/mobile/xul/themes/core/gingerbread/images/close-active-tablet-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/close-active-tablet-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/close-active-tablet-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/close-background-hdpi-rtl.png b/mobile/xul/themes/core/gingerbread/images/close-background-hdpi-rtl.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/close-background-hdpi-rtl.png
rename to mobile/xul/themes/core/gingerbread/images/close-background-hdpi-rtl.png
diff --git a/mobile/themes/core/gingerbread/images/close-background-hdpi.png b/mobile/xul/themes/core/gingerbread/images/close-background-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/close-background-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/close-background-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/close-default-hdpi.png b/mobile/xul/themes/core/gingerbread/images/close-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/close-default-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/close-default-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/close-default-tablet-hdpi.png b/mobile/xul/themes/core/gingerbread/images/close-default-tablet-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/close-default-tablet-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/close-default-tablet-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/close-inactive-tab-hdpi.png b/mobile/xul/themes/core/gingerbread/images/close-inactive-tab-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/close-inactive-tab-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/close-inactive-tab-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/close-inactive-tab-tablet-hdpi.png b/mobile/xul/themes/core/gingerbread/images/close-inactive-tab-tablet-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/close-inactive-tab-tablet-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/close-inactive-tab-tablet-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/console-default-hdpi.png b/mobile/xul/themes/core/gingerbread/images/console-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/console-default-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/console-default-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/downloads-default-hdpi.png b/mobile/xul/themes/core/gingerbread/images/downloads-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/downloads-default-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/downloads-default-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/dropmarker-hdpi.png b/mobile/xul/themes/core/gingerbread/images/dropmarker-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/dropmarker-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/dropmarker-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/endcap-active-bg.png b/mobile/xul/themes/core/gingerbread/images/endcap-active-bg.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/endcap-active-bg.png
rename to mobile/xul/themes/core/gingerbread/images/endcap-active-bg.png
diff --git a/mobile/themes/core/gingerbread/images/endcap-default-bg.png b/mobile/xul/themes/core/gingerbread/images/endcap-default-bg.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/endcap-default-bg.png
rename to mobile/xul/themes/core/gingerbread/images/endcap-default-bg.png
diff --git a/mobile/themes/core/gingerbread/images/endcap-ev-active-bg.png b/mobile/xul/themes/core/gingerbread/images/endcap-ev-active-bg.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/endcap-ev-active-bg.png
rename to mobile/xul/themes/core/gingerbread/images/endcap-ev-active-bg.png
diff --git a/mobile/themes/core/gingerbread/images/endcap-ev-default-bg.png b/mobile/xul/themes/core/gingerbread/images/endcap-ev-default-bg.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/endcap-ev-default-bg.png
rename to mobile/xul/themes/core/gingerbread/images/endcap-ev-default-bg.png
diff --git a/mobile/themes/core/gingerbread/images/endcap-ssl-active-bg.png b/mobile/xul/themes/core/gingerbread/images/endcap-ssl-active-bg.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/endcap-ssl-active-bg.png
rename to mobile/xul/themes/core/gingerbread/images/endcap-ssl-active-bg.png
diff --git a/mobile/themes/core/gingerbread/images/endcap-ssl-default-bg.png b/mobile/xul/themes/core/gingerbread/images/endcap-ssl-default-bg.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/endcap-ssl-default-bg.png
rename to mobile/xul/themes/core/gingerbread/images/endcap-ssl-default-bg.png
diff --git a/mobile/themes/core/gingerbread/images/errorpage-larry-black.png b/mobile/xul/themes/core/gingerbread/images/errorpage-larry-black.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/errorpage-larry-black.png
rename to mobile/xul/themes/core/gingerbread/images/errorpage-larry-black.png
diff --git a/mobile/themes/core/gingerbread/images/errorpage-larry-white.png b/mobile/xul/themes/core/gingerbread/images/errorpage-larry-white.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/errorpage-larry-white.png
rename to mobile/xul/themes/core/gingerbread/images/errorpage-larry-white.png
diff --git a/mobile/themes/core/gingerbread/images/errorpage-warning.png b/mobile/xul/themes/core/gingerbread/images/errorpage-warning.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/errorpage-warning.png
rename to mobile/xul/themes/core/gingerbread/images/errorpage-warning.png
diff --git a/mobile/themes/core/gingerbread/images/favicon-default-32.png b/mobile/xul/themes/core/gingerbread/images/favicon-default-32.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/favicon-default-32.png
rename to mobile/xul/themes/core/gingerbread/images/favicon-default-32.png
diff --git a/mobile/themes/core/gingerbread/images/folder-32.png b/mobile/xul/themes/core/gingerbread/images/folder-32.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/folder-32.png
rename to mobile/xul/themes/core/gingerbread/images/folder-32.png
diff --git a/mobile/themes/core/gingerbread/images/forward-default-hdpi.png b/mobile/xul/themes/core/gingerbread/images/forward-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/forward-default-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/forward-default-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/handle-end.png b/mobile/xul/themes/core/gingerbread/images/handle-end.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/handle-end.png
rename to mobile/xul/themes/core/gingerbread/images/handle-end.png
diff --git a/mobile/themes/core/gingerbread/images/handle-start.png b/mobile/xul/themes/core/gingerbread/images/handle-start.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/handle-start.png
rename to mobile/xul/themes/core/gingerbread/images/handle-start.png
diff --git a/mobile/themes/core/gingerbread/images/history-48.png b/mobile/xul/themes/core/gingerbread/images/history-48.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/history-48.png
rename to mobile/xul/themes/core/gingerbread/images/history-48.png
diff --git a/mobile/themes/core/gingerbread/images/identity-default-hdpi.png b/mobile/xul/themes/core/gingerbread/images/identity-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/identity-default-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/identity-default-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/identity-ev-hdpi.png b/mobile/xul/themes/core/gingerbread/images/identity-ev-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/identity-ev-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/identity-ev-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/identity-ssl-hdpi.png b/mobile/xul/themes/core/gingerbread/images/identity-ssl-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/identity-ssl-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/identity-ssl-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/locked-hdpi.png b/mobile/xul/themes/core/gingerbread/images/locked-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/locked-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/locked-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/mute-hdpi.png b/mobile/xul/themes/core/gingerbread/images/mute-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/mute-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/mute-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/navigation-magnifier-30.png b/mobile/xul/themes/core/gingerbread/images/navigation-magnifier-30.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/navigation-magnifier-30.png
rename to mobile/xul/themes/core/gingerbread/images/navigation-magnifier-30.png
diff --git a/mobile/themes/core/gingerbread/images/newtab-default-hdpi.png b/mobile/xul/themes/core/gingerbread/images/newtab-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/newtab-default-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/newtab-default-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/newtab-default-tablet-hdpi.png b/mobile/xul/themes/core/gingerbread/images/newtab-default-tablet-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/newtab-default-tablet-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/newtab-default-tablet-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/next-disabled-hdpi.png b/mobile/xul/themes/core/gingerbread/images/next-disabled-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/next-disabled-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/next-disabled-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/next-hdpi.png b/mobile/xul/themes/core/gingerbread/images/next-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/next-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/next-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/pause-hdpi.png b/mobile/xul/themes/core/gingerbread/images/pause-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/pause-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/pause-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/play-hdpi.png b/mobile/xul/themes/core/gingerbread/images/play-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/play-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/play-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/popup-selected-item-hdpi.png b/mobile/xul/themes/core/gingerbread/images/popup-selected-item-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/popup-selected-item-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/popup-selected-item-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/preferences-default-hdpi.png b/mobile/xul/themes/core/gingerbread/images/preferences-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/preferences-default-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/preferences-default-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/previous-disabled-hdpi.png b/mobile/xul/themes/core/gingerbread/images/previous-disabled-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/previous-disabled-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/previous-disabled-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/previous-hdpi.png b/mobile/xul/themes/core/gingerbread/images/previous-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/previous-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/previous-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/radio-selected-hdpi.png b/mobile/xul/themes/core/gingerbread/images/radio-selected-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/radio-selected-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/radio-selected-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/radio-unselected-hdpi.png b/mobile/xul/themes/core/gingerbread/images/radio-unselected-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/radio-unselected-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/radio-unselected-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/reload-hdpi.png b/mobile/xul/themes/core/gingerbread/images/reload-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/reload-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/reload-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/remotetabs-32.png b/mobile/xul/themes/core/gingerbread/images/remotetabs-32.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/remotetabs-32.png
rename to mobile/xul/themes/core/gingerbread/images/remotetabs-32.png
diff --git a/mobile/themes/core/gingerbread/images/remotetabs-48.png b/mobile/xul/themes/core/gingerbread/images/remotetabs-48.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/remotetabs-48.png
rename to mobile/xul/themes/core/gingerbread/images/remotetabs-48.png
diff --git a/mobile/themes/core/gingerbread/images/row-header-bg.png b/mobile/xul/themes/core/gingerbread/images/row-header-bg.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/row-header-bg.png
rename to mobile/xul/themes/core/gingerbread/images/row-header-bg.png
diff --git a/mobile/themes/core/gingerbread/images/scrubber-hdpi.png b/mobile/xul/themes/core/gingerbread/images/scrubber-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/scrubber-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/scrubber-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/search-clear-30.png b/mobile/xul/themes/core/gingerbread/images/search-clear-30.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/search-clear-30.png
rename to mobile/xul/themes/core/gingerbread/images/search-clear-30.png
diff --git a/mobile/themes/core/gingerbread/images/search-glass-30.png b/mobile/xul/themes/core/gingerbread/images/search-glass-30.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/search-glass-30.png
rename to mobile/xul/themes/core/gingerbread/images/search-glass-30.png
diff --git a/mobile/themes/core/gingerbread/images/settings-default-hdpi.png b/mobile/xul/themes/core/gingerbread/images/settings-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/settings-default-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/settings-default-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/stop-hdpi.png b/mobile/xul/themes/core/gingerbread/images/stop-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/stop-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/stop-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/tab-active-hdpi.png b/mobile/xul/themes/core/gingerbread/images/tab-active-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/tab-active-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/tab-active-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/tab-closed-hdpi.png b/mobile/xul/themes/core/gingerbread/images/tab-closed-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/tab-closed-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/tab-closed-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/tab-inactive-hdpi.png b/mobile/xul/themes/core/gingerbread/images/tab-inactive-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/tab-inactive-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/tab-inactive-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/tab-reopen-hdpi.png b/mobile/xul/themes/core/gingerbread/images/tab-reopen-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/tab-reopen-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/tab-reopen-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/tab-reopen-tablet-hdpi.png b/mobile/xul/themes/core/gingerbread/images/tab-reopen-tablet-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/tab-reopen-tablet-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/tab-reopen-tablet-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/task-back-hdpi.png b/mobile/xul/themes/core/gingerbread/images/task-back-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/task-back-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/task-back-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/task-back-rtl-hdpi.png b/mobile/xul/themes/core/gingerbread/images/task-back-rtl-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/task-back-rtl-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/task-back-rtl-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/task-close-hdpi.png b/mobile/xul/themes/core/gingerbread/images/task-close-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/task-close-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/task-close-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/task-switch-hdpi.png b/mobile/xul/themes/core/gingerbread/images/task-switch-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/task-switch-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/task-switch-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/textbox-bg.png b/mobile/xul/themes/core/gingerbread/images/textbox-bg.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/textbox-bg.png
rename to mobile/xul/themes/core/gingerbread/images/textbox-bg.png
diff --git a/mobile/themes/core/gingerbread/images/throbber.png b/mobile/xul/themes/core/gingerbread/images/throbber.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/throbber.png
rename to mobile/xul/themes/core/gingerbread/images/throbber.png
diff --git a/mobile/themes/core/gingerbread/images/toggle-off.png b/mobile/xul/themes/core/gingerbread/images/toggle-off.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/toggle-off.png
rename to mobile/xul/themes/core/gingerbread/images/toggle-off.png
diff --git a/mobile/themes/core/gingerbread/images/toggle-on.png b/mobile/xul/themes/core/gingerbread/images/toggle-on.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/toggle-on.png
rename to mobile/xul/themes/core/gingerbread/images/toggle-on.png
diff --git a/mobile/themes/core/gingerbread/images/unlocked-hdpi.png b/mobile/xul/themes/core/gingerbread/images/unlocked-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/unlocked-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/unlocked-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/unmute-hdpi.png b/mobile/xul/themes/core/gingerbread/images/unmute-hdpi.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/unmute-hdpi.png
rename to mobile/xul/themes/core/gingerbread/images/unmute-hdpi.png
diff --git a/mobile/themes/core/gingerbread/images/urlbar-bg.png b/mobile/xul/themes/core/gingerbread/images/urlbar-bg.png
similarity index 100%
rename from mobile/themes/core/gingerbread/images/urlbar-bg.png
rename to mobile/xul/themes/core/gingerbread/images/urlbar-bg.png
diff --git a/mobile/themes/core/gingerbread/localePicker.css b/mobile/xul/themes/core/gingerbread/localePicker.css
similarity index 100%
rename from mobile/themes/core/gingerbread/localePicker.css
rename to mobile/xul/themes/core/gingerbread/localePicker.css
diff --git a/mobile/themes/core/gingerbread/platform.css b/mobile/xul/themes/core/gingerbread/platform.css
similarity index 100%
rename from mobile/themes/core/gingerbread/platform.css
rename to mobile/xul/themes/core/gingerbread/platform.css
diff --git a/mobile/themes/core/header.css b/mobile/xul/themes/core/header.css
similarity index 100%
rename from mobile/themes/core/header.css
rename to mobile/xul/themes/core/header.css
diff --git a/mobile/themes/core/honeycomb/browser.css b/mobile/xul/themes/core/honeycomb/browser.css
similarity index 100%
rename from mobile/themes/core/honeycomb/browser.css
rename to mobile/xul/themes/core/honeycomb/browser.css
diff --git a/mobile/themes/core/honeycomb/defines.inc b/mobile/xul/themes/core/honeycomb/defines.inc
similarity index 100%
rename from mobile/themes/core/honeycomb/defines.inc
rename to mobile/xul/themes/core/honeycomb/defines.inc
diff --git a/mobile/themes/core/honeycomb/forms.css b/mobile/xul/themes/core/honeycomb/forms.css
similarity index 100%
rename from mobile/themes/core/honeycomb/forms.css
rename to mobile/xul/themes/core/honeycomb/forms.css
diff --git a/mobile/themes/core/honeycomb/images/aboutBackground.jpg b/mobile/xul/themes/core/honeycomb/images/aboutBackground.jpg
similarity index 100%
rename from mobile/themes/core/honeycomb/images/aboutBackground.jpg
rename to mobile/xul/themes/core/honeycomb/images/aboutBackground.jpg
diff --git a/mobile/themes/core/honeycomb/images/addons-default-hdpi.png b/mobile/xul/themes/core/honeycomb/images/addons-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/addons-default-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/addons-default-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/alert-addons-30.png b/mobile/xul/themes/core/honeycomb/images/alert-addons-30.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/alert-addons-30.png
rename to mobile/xul/themes/core/honeycomb/images/alert-addons-30.png
diff --git a/mobile/themes/core/honeycomb/images/alert-downloads-30.png b/mobile/xul/themes/core/honeycomb/images/alert-downloads-30.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/alert-downloads-30.png
rename to mobile/xul/themes/core/honeycomb/images/alert-downloads-30.png
diff --git a/mobile/themes/core/honeycomb/images/allpages-48.png b/mobile/xul/themes/core/honeycomb/images/allpages-48.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/allpages-48.png
rename to mobile/xul/themes/core/honeycomb/images/allpages-48.png
diff --git a/mobile/themes/core/honeycomb/images/appmenu-active-hdpi.png b/mobile/xul/themes/core/honeycomb/images/appmenu-active-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/appmenu-active-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/appmenu-active-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/appmenu-addons-hdpi.png b/mobile/xul/themes/core/honeycomb/images/appmenu-addons-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/appmenu-addons-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/appmenu-addons-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/appmenu-addsearch-hdpi.png b/mobile/xul/themes/core/honeycomb/images/appmenu-addsearch-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/appmenu-addsearch-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/appmenu-addsearch-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/appmenu-downloads-hdpi.png b/mobile/xul/themes/core/honeycomb/images/appmenu-downloads-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/appmenu-downloads-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/appmenu-downloads-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/appmenu-findinpage-hdpi.png b/mobile/xul/themes/core/honeycomb/images/appmenu-findinpage-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/appmenu-findinpage-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/appmenu-findinpage-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/appmenu-more-hdpi.png b/mobile/xul/themes/core/honeycomb/images/appmenu-more-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/appmenu-more-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/appmenu-more-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/appmenu-preferences-hdpi.png b/mobile/xul/themes/core/honeycomb/images/appmenu-preferences-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/appmenu-preferences-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/appmenu-preferences-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/appmenu-saveas-hdpi.png b/mobile/xul/themes/core/honeycomb/images/appmenu-saveas-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/appmenu-saveas-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/appmenu-saveas-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/appmenu-share-hdpi.png b/mobile/xul/themes/core/honeycomb/images/appmenu-share-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/appmenu-share-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/appmenu-share-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/appmenu-site-hdpi.png b/mobile/xul/themes/core/honeycomb/images/appmenu-site-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/appmenu-site-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/appmenu-site-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/arrowbox-down.png b/mobile/xul/themes/core/honeycomb/images/arrowbox-down.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/arrowbox-down.png
rename to mobile/xul/themes/core/honeycomb/images/arrowbox-down.png
diff --git a/mobile/themes/core/honeycomb/images/arrowbox-horiz.png b/mobile/xul/themes/core/honeycomb/images/arrowbox-horiz.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/arrowbox-horiz.png
rename to mobile/xul/themes/core/honeycomb/images/arrowbox-horiz.png
diff --git a/mobile/themes/core/honeycomb/images/arrowbox-up.png b/mobile/xul/themes/core/honeycomb/images/arrowbox-up.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/arrowbox-up.png
rename to mobile/xul/themes/core/honeycomb/images/arrowbox-up.png
diff --git a/mobile/themes/core/honeycomb/images/arrowdown-16.png b/mobile/xul/themes/core/honeycomb/images/arrowdown-16.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/arrowdown-16.png
rename to mobile/xul/themes/core/honeycomb/images/arrowdown-16.png
diff --git a/mobile/themes/core/honeycomb/images/arrowdowndark-16.png b/mobile/xul/themes/core/honeycomb/images/arrowdowndark-16.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/arrowdowndark-16.png
rename to mobile/xul/themes/core/honeycomb/images/arrowdowndark-16.png
diff --git a/mobile/themes/core/honeycomb/images/arrowleft-16.png b/mobile/xul/themes/core/honeycomb/images/arrowleft-16.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/arrowleft-16.png
rename to mobile/xul/themes/core/honeycomb/images/arrowleft-16.png
diff --git a/mobile/themes/core/honeycomb/images/arrowleftdark-16.png b/mobile/xul/themes/core/honeycomb/images/arrowleftdark-16.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/arrowleftdark-16.png
rename to mobile/xul/themes/core/honeycomb/images/arrowleftdark-16.png
diff --git a/mobile/themes/core/honeycomb/images/arrowright-16.png b/mobile/xul/themes/core/honeycomb/images/arrowright-16.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/arrowright-16.png
rename to mobile/xul/themes/core/honeycomb/images/arrowright-16.png
diff --git a/mobile/themes/core/honeycomb/images/arrowrightdark-16.png b/mobile/xul/themes/core/honeycomb/images/arrowrightdark-16.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/arrowrightdark-16.png
rename to mobile/xul/themes/core/honeycomb/images/arrowrightdark-16.png
diff --git a/mobile/themes/core/honeycomb/images/arrowup-16.png b/mobile/xul/themes/core/honeycomb/images/arrowup-16.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/arrowup-16.png
rename to mobile/xul/themes/core/honeycomb/images/arrowup-16.png
diff --git a/mobile/themes/core/honeycomb/images/arrowupdark-16.png b/mobile/xul/themes/core/honeycomb/images/arrowupdark-16.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/arrowupdark-16.png
rename to mobile/xul/themes/core/honeycomb/images/arrowupdark-16.png
diff --git a/mobile/themes/core/honeycomb/images/autocomplete-all-hdpi.png b/mobile/xul/themes/core/honeycomb/images/autocomplete-all-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/autocomplete-all-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/autocomplete-all-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/autocomplete-all-selected-hdpi.png b/mobile/xul/themes/core/honeycomb/images/autocomplete-all-selected-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/autocomplete-all-selected-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/autocomplete-all-selected-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/autocomplete-bookmarked-hdpi.png b/mobile/xul/themes/core/honeycomb/images/autocomplete-bookmarked-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/autocomplete-bookmarked-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/autocomplete-bookmarked-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/autocomplete-bookmarked-selected-hdpi.png b/mobile/xul/themes/core/honeycomb/images/autocomplete-bookmarked-selected-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/autocomplete-bookmarked-selected-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/autocomplete-bookmarked-selected-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/autocomplete-desktop-hdpi.png b/mobile/xul/themes/core/honeycomb/images/autocomplete-desktop-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/autocomplete-desktop-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/autocomplete-desktop-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/autocomplete-desktop-selected-hdpi.png b/mobile/xul/themes/core/honeycomb/images/autocomplete-desktop-selected-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/autocomplete-desktop-selected-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/autocomplete-desktop-selected-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/autocomplete-history-hdpi.png b/mobile/xul/themes/core/honeycomb/images/autocomplete-history-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/autocomplete-history-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/autocomplete-history-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/autocomplete-history-selected-hdpi.png b/mobile/xul/themes/core/honeycomb/images/autocomplete-history-selected-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/autocomplete-history-selected-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/autocomplete-history-selected-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/autocomplete-search-hdpi.png b/mobile/xul/themes/core/honeycomb/images/autocomplete-search-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/autocomplete-search-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/autocomplete-search-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/back-default-hdpi.png b/mobile/xul/themes/core/honeycomb/images/back-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/back-default-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/back-default-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/bookmark-default-hdpi.png b/mobile/xul/themes/core/honeycomb/images/bookmark-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/bookmark-default-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/bookmark-default-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/bookmark-starred-hdpi.png b/mobile/xul/themes/core/honeycomb/images/bookmark-starred-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/bookmark-starred-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/bookmark-starred-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/bookmarks-48.png b/mobile/xul/themes/core/honeycomb/images/bookmarks-48.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/bookmarks-48.png
rename to mobile/xul/themes/core/honeycomb/images/bookmarks-48.png
diff --git a/mobile/themes/core/honeycomb/images/browseaddons-bg.jpg b/mobile/xul/themes/core/honeycomb/images/browseaddons-bg.jpg
similarity index 100%
rename from mobile/themes/core/honeycomb/images/browseaddons-bg.jpg
rename to mobile/xul/themes/core/honeycomb/images/browseaddons-bg.jpg
diff --git a/mobile/themes/core/honeycomb/images/button-bg.png b/mobile/xul/themes/core/honeycomb/images/button-bg.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/button-bg.png
rename to mobile/xul/themes/core/honeycomb/images/button-bg.png
diff --git a/mobile/themes/core/honeycomb/images/check-selected-hdpi.png b/mobile/xul/themes/core/honeycomb/images/check-selected-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/check-selected-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/check-selected-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/check-selected-tap-hdpi.png b/mobile/xul/themes/core/honeycomb/images/check-selected-tap-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/check-selected-tap-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/check-selected-tap-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/check-unselected-hdpi.png b/mobile/xul/themes/core/honeycomb/images/check-unselected-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/check-unselected-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/check-unselected-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/check-unselected-tap-hdpi.png b/mobile/xul/themes/core/honeycomb/images/check-unselected-tap-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/check-unselected-tap-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/check-unselected-tap-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/close-active-hdpi.png b/mobile/xul/themes/core/honeycomb/images/close-active-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/close-active-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/close-active-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/close-active-tablet-hdpi.png b/mobile/xul/themes/core/honeycomb/images/close-active-tablet-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/close-active-tablet-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/close-active-tablet-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/close-background-hdpi-rtl.png b/mobile/xul/themes/core/honeycomb/images/close-background-hdpi-rtl.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/close-background-hdpi-rtl.png
rename to mobile/xul/themes/core/honeycomb/images/close-background-hdpi-rtl.png
diff --git a/mobile/themes/core/honeycomb/images/close-background-hdpi.png b/mobile/xul/themes/core/honeycomb/images/close-background-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/close-background-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/close-background-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/close-default-hdpi.png b/mobile/xul/themes/core/honeycomb/images/close-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/close-default-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/close-default-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/close-default-tablet-hdpi.png b/mobile/xul/themes/core/honeycomb/images/close-default-tablet-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/close-default-tablet-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/close-default-tablet-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/close-inactive-tab-hdpi.png b/mobile/xul/themes/core/honeycomb/images/close-inactive-tab-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/close-inactive-tab-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/close-inactive-tab-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/close-inactive-tab-tablet-hdpi.png b/mobile/xul/themes/core/honeycomb/images/close-inactive-tab-tablet-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/close-inactive-tab-tablet-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/close-inactive-tab-tablet-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/console-default-hdpi.png b/mobile/xul/themes/core/honeycomb/images/console-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/console-default-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/console-default-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/downloads-default-hdpi.png b/mobile/xul/themes/core/honeycomb/images/downloads-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/downloads-default-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/downloads-default-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/dropmarker-hdpi.png b/mobile/xul/themes/core/honeycomb/images/dropmarker-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/dropmarker-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/dropmarker-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/errorpage-larry-black.png b/mobile/xul/themes/core/honeycomb/images/errorpage-larry-black.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/errorpage-larry-black.png
rename to mobile/xul/themes/core/honeycomb/images/errorpage-larry-black.png
diff --git a/mobile/themes/core/honeycomb/images/errorpage-larry-white.png b/mobile/xul/themes/core/honeycomb/images/errorpage-larry-white.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/errorpage-larry-white.png
rename to mobile/xul/themes/core/honeycomb/images/errorpage-larry-white.png
diff --git a/mobile/themes/core/honeycomb/images/errorpage-warning.png b/mobile/xul/themes/core/honeycomb/images/errorpage-warning.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/errorpage-warning.png
rename to mobile/xul/themes/core/honeycomb/images/errorpage-warning.png
diff --git a/mobile/themes/core/honeycomb/images/favicon-default-32.png b/mobile/xul/themes/core/honeycomb/images/favicon-default-32.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/favicon-default-32.png
rename to mobile/xul/themes/core/honeycomb/images/favicon-default-32.png
diff --git a/mobile/themes/core/honeycomb/images/folder-32.png b/mobile/xul/themes/core/honeycomb/images/folder-32.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/folder-32.png
rename to mobile/xul/themes/core/honeycomb/images/folder-32.png
diff --git a/mobile/themes/core/honeycomb/images/forward-default-hdpi.png b/mobile/xul/themes/core/honeycomb/images/forward-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/forward-default-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/forward-default-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/history-48.png b/mobile/xul/themes/core/honeycomb/images/history-48.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/history-48.png
rename to mobile/xul/themes/core/honeycomb/images/history-48.png
diff --git a/mobile/themes/core/honeycomb/images/identity-default-hdpi.png b/mobile/xul/themes/core/honeycomb/images/identity-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/identity-default-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/identity-default-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/identity-ev-hdpi.png b/mobile/xul/themes/core/honeycomb/images/identity-ev-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/identity-ev-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/identity-ev-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/identity-ssl-hdpi.png b/mobile/xul/themes/core/honeycomb/images/identity-ssl-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/identity-ssl-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/identity-ssl-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/locked-hdpi.png b/mobile/xul/themes/core/honeycomb/images/locked-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/locked-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/locked-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/menu-hdpi.png b/mobile/xul/themes/core/honeycomb/images/menu-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/menu-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/menu-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/menu-top-insideglow-green.png b/mobile/xul/themes/core/honeycomb/images/menu-top-insideglow-green.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/menu-top-insideglow-green.png
rename to mobile/xul/themes/core/honeycomb/images/menu-top-insideglow-green.png
diff --git a/mobile/themes/core/honeycomb/images/menu-top-insideglow-grey.png b/mobile/xul/themes/core/honeycomb/images/menu-top-insideglow-grey.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/menu-top-insideglow-grey.png
rename to mobile/xul/themes/core/honeycomb/images/menu-top-insideglow-grey.png
diff --git a/mobile/themes/core/honeycomb/images/menu-top-insideglow.png b/mobile/xul/themes/core/honeycomb/images/menu-top-insideglow.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/menu-top-insideglow.png
rename to mobile/xul/themes/core/honeycomb/images/menu-top-insideglow.png
diff --git a/mobile/themes/core/honeycomb/images/mute-hdpi.png b/mobile/xul/themes/core/honeycomb/images/mute-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/mute-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/mute-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/navigation-magnifier-30.png b/mobile/xul/themes/core/honeycomb/images/navigation-magnifier-30.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/navigation-magnifier-30.png
rename to mobile/xul/themes/core/honeycomb/images/navigation-magnifier-30.png
diff --git a/mobile/themes/core/honeycomb/images/newtab-default-hdpi.png b/mobile/xul/themes/core/honeycomb/images/newtab-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/newtab-default-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/newtab-default-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/newtab-default-tablet-hdpi.png b/mobile/xul/themes/core/honeycomb/images/newtab-default-tablet-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/newtab-default-tablet-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/newtab-default-tablet-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/newtab-tabmenu-tablet-hdpi.png b/mobile/xul/themes/core/honeycomb/images/newtab-tabmenu-tablet-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/newtab-tabmenu-tablet-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/newtab-tabmenu-tablet-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/next-disabled-hdpi.png b/mobile/xul/themes/core/honeycomb/images/next-disabled-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/next-disabled-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/next-disabled-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/next-hdpi.png b/mobile/xul/themes/core/honeycomb/images/next-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/next-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/next-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/panelrow-active-hdpi.png b/mobile/xul/themes/core/honeycomb/images/panelrow-active-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/panelrow-active-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/panelrow-active-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/panelrow-default-hdpi.png b/mobile/xul/themes/core/honeycomb/images/panelrow-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/panelrow-default-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/panelrow-default-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/panelrow-selected-hdpi.png b/mobile/xul/themes/core/honeycomb/images/panelrow-selected-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/panelrow-selected-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/panelrow-selected-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/pause-hdpi.png b/mobile/xul/themes/core/honeycomb/images/pause-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/pause-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/pause-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/play-hdpi.png b/mobile/xul/themes/core/honeycomb/images/play-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/play-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/play-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/popup-bg-hdpi.png b/mobile/xul/themes/core/honeycomb/images/popup-bg-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/popup-bg-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/popup-bg-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/popup-selected-item-hdpi.png b/mobile/xul/themes/core/honeycomb/images/popup-selected-item-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/popup-selected-item-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/popup-selected-item-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/preferences-default-hdpi.png b/mobile/xul/themes/core/honeycomb/images/preferences-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/preferences-default-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/preferences-default-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/previous-disabled-hdpi.png b/mobile/xul/themes/core/honeycomb/images/previous-disabled-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/previous-disabled-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/previous-disabled-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/previous-hdpi.png b/mobile/xul/themes/core/honeycomb/images/previous-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/previous-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/previous-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/reload-hdpi.png b/mobile/xul/themes/core/honeycomb/images/reload-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/reload-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/reload-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/remotetabs-32.png b/mobile/xul/themes/core/honeycomb/images/remotetabs-32.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/remotetabs-32.png
rename to mobile/xul/themes/core/honeycomb/images/remotetabs-32.png
diff --git a/mobile/themes/core/honeycomb/images/remotetabs-48.png b/mobile/xul/themes/core/honeycomb/images/remotetabs-48.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/remotetabs-48.png
rename to mobile/xul/themes/core/honeycomb/images/remotetabs-48.png
diff --git a/mobile/themes/core/honeycomb/images/row-header-bg.png b/mobile/xul/themes/core/honeycomb/images/row-header-bg.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/row-header-bg.png
rename to mobile/xul/themes/core/honeycomb/images/row-header-bg.png
diff --git a/mobile/themes/core/honeycomb/images/scrubber-hdpi.png b/mobile/xul/themes/core/honeycomb/images/scrubber-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/scrubber-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/scrubber-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/search-clear-30.png b/mobile/xul/themes/core/honeycomb/images/search-clear-30.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/search-clear-30.png
rename to mobile/xul/themes/core/honeycomb/images/search-clear-30.png
diff --git a/mobile/themes/core/honeycomb/images/search-glass-30.png b/mobile/xul/themes/core/honeycomb/images/search-glass-30.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/search-glass-30.png
rename to mobile/xul/themes/core/honeycomb/images/search-glass-30.png
diff --git a/mobile/themes/core/honeycomb/images/settings-default-hdpi.png b/mobile/xul/themes/core/honeycomb/images/settings-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/settings-default-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/settings-default-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/sidebarbutton-active-hdpi.png b/mobile/xul/themes/core/honeycomb/images/sidebarbutton-active-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/sidebarbutton-active-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/sidebarbutton-active-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/stop-hdpi.png b/mobile/xul/themes/core/honeycomb/images/stop-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/stop-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/stop-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/tab-active-hdpi.png b/mobile/xul/themes/core/honeycomb/images/tab-active-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/tab-active-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/tab-active-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/tab-closed-hdpi.png b/mobile/xul/themes/core/honeycomb/images/tab-closed-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/tab-closed-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/tab-closed-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/tab-inactive-hdpi.png b/mobile/xul/themes/core/honeycomb/images/tab-inactive-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/tab-inactive-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/tab-inactive-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/tab-reopen-hdpi.png b/mobile/xul/themes/core/honeycomb/images/tab-reopen-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/tab-reopen-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/tab-reopen-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/tab-reopen-tablet-hdpi.png b/mobile/xul/themes/core/honeycomb/images/tab-reopen-tablet-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/tab-reopen-tablet-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/tab-reopen-tablet-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/tabs-default-bg-rtl.png b/mobile/xul/themes/core/honeycomb/images/tabs-default-bg-rtl.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/tabs-default-bg-rtl.png
rename to mobile/xul/themes/core/honeycomb/images/tabs-default-bg-rtl.png
diff --git a/mobile/themes/core/honeycomb/images/tabs-default-bg.png b/mobile/xul/themes/core/honeycomb/images/tabs-default-bg.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/tabs-default-bg.png
rename to mobile/xul/themes/core/honeycomb/images/tabs-default-bg.png
diff --git a/mobile/themes/core/honeycomb/images/tabs-hdpi.png b/mobile/xul/themes/core/honeycomb/images/tabs-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/tabs-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/tabs-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/tabs-selected-bg-rtl.png b/mobile/xul/themes/core/honeycomb/images/tabs-selected-bg-rtl.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/tabs-selected-bg-rtl.png
rename to mobile/xul/themes/core/honeycomb/images/tabs-selected-bg-rtl.png
diff --git a/mobile/themes/core/honeycomb/images/tabs-selected-bg.png b/mobile/xul/themes/core/honeycomb/images/tabs-selected-bg.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/tabs-selected-bg.png
rename to mobile/xul/themes/core/honeycomb/images/tabs-selected-bg.png
diff --git a/mobile/themes/core/honeycomb/images/task-back-hdpi.png b/mobile/xul/themes/core/honeycomb/images/task-back-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/task-back-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/task-back-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/task-back-rtl-hdpi.png b/mobile/xul/themes/core/honeycomb/images/task-back-rtl-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/task-back-rtl-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/task-back-rtl-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/task-close-hdpi.png b/mobile/xul/themes/core/honeycomb/images/task-close-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/task-close-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/task-close-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/task-switch-hdpi.png b/mobile/xul/themes/core/honeycomb/images/task-switch-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/task-switch-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/task-switch-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/textbox-bg.png b/mobile/xul/themes/core/honeycomb/images/textbox-bg.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/textbox-bg.png
rename to mobile/xul/themes/core/honeycomb/images/textbox-bg.png
diff --git a/mobile/themes/core/honeycomb/images/throbber.png b/mobile/xul/themes/core/honeycomb/images/throbber.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/throbber.png
rename to mobile/xul/themes/core/honeycomb/images/throbber.png
diff --git a/mobile/themes/core/honeycomb/images/toggle-off.png b/mobile/xul/themes/core/honeycomb/images/toggle-off.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/toggle-off.png
rename to mobile/xul/themes/core/honeycomb/images/toggle-off.png
diff --git a/mobile/themes/core/honeycomb/images/toggle-on.png b/mobile/xul/themes/core/honeycomb/images/toggle-on.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/toggle-on.png
rename to mobile/xul/themes/core/honeycomb/images/toggle-on.png
diff --git a/mobile/themes/core/honeycomb/images/unlocked-hdpi.png b/mobile/xul/themes/core/honeycomb/images/unlocked-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/unlocked-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/unlocked-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/unmute-hdpi.png b/mobile/xul/themes/core/honeycomb/images/unmute-hdpi.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/unmute-hdpi.png
rename to mobile/xul/themes/core/honeycomb/images/unmute-hdpi.png
diff --git a/mobile/themes/core/honeycomb/images/urlbar-border-bottom-active.png b/mobile/xul/themes/core/honeycomb/images/urlbar-border-bottom-active.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/urlbar-border-bottom-active.png
rename to mobile/xul/themes/core/honeycomb/images/urlbar-border-bottom-active.png
diff --git a/mobile/themes/core/honeycomb/images/urlbar-border-bottom.png b/mobile/xul/themes/core/honeycomb/images/urlbar-border-bottom.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/urlbar-border-bottom.png
rename to mobile/xul/themes/core/honeycomb/images/urlbar-border-bottom.png
diff --git a/mobile/themes/core/honeycomb/images/urlbar-border-side-active.png b/mobile/xul/themes/core/honeycomb/images/urlbar-border-side-active.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/urlbar-border-side-active.png
rename to mobile/xul/themes/core/honeycomb/images/urlbar-border-side-active.png
diff --git a/mobile/themes/core/honeycomb/images/urlbar-border-side.png b/mobile/xul/themes/core/honeycomb/images/urlbar-border-side.png
similarity index 100%
rename from mobile/themes/core/honeycomb/images/urlbar-border-side.png
rename to mobile/xul/themes/core/honeycomb/images/urlbar-border-side.png
diff --git a/mobile/themes/core/honeycomb/platform.css b/mobile/xul/themes/core/honeycomb/platform.css
similarity index 100%
rename from mobile/themes/core/honeycomb/platform.css
rename to mobile/xul/themes/core/honeycomb/platform.css
diff --git a/mobile/themes/core/images/aboutBackground.jpg b/mobile/xul/themes/core/images/aboutBackground.jpg
similarity index 100%
rename from mobile/themes/core/images/aboutBackground.jpg
rename to mobile/xul/themes/core/images/aboutBackground.jpg
diff --git a/mobile/themes/core/images/addons-32.png b/mobile/xul/themes/core/images/addons-32.png
similarity index 100%
rename from mobile/themes/core/images/addons-32.png
rename to mobile/xul/themes/core/images/addons-32.png
diff --git a/mobile/themes/core/images/addons-default-hdpi.png b/mobile/xul/themes/core/images/addons-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/addons-default-hdpi.png
rename to mobile/xul/themes/core/images/addons-default-hdpi.png
diff --git a/mobile/themes/core/images/alert-addons-30.png b/mobile/xul/themes/core/images/alert-addons-30.png
similarity index 100%
rename from mobile/themes/core/images/alert-addons-30.png
rename to mobile/xul/themes/core/images/alert-addons-30.png
diff --git a/mobile/themes/core/images/alert-downloads-30.png b/mobile/xul/themes/core/images/alert-downloads-30.png
similarity index 100%
rename from mobile/themes/core/images/alert-downloads-30.png
rename to mobile/xul/themes/core/images/alert-downloads-30.png
diff --git a/mobile/themes/core/images/allpages-48.png b/mobile/xul/themes/core/images/allpages-48.png
similarity index 100%
rename from mobile/themes/core/images/allpages-48.png
rename to mobile/xul/themes/core/images/allpages-48.png
diff --git a/mobile/themes/core/images/appmenu-active-hdpi.png b/mobile/xul/themes/core/images/appmenu-active-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/appmenu-active-hdpi.png
rename to mobile/xul/themes/core/images/appmenu-active-hdpi.png
diff --git a/mobile/themes/core/images/appmenu-addons-hdpi.png b/mobile/xul/themes/core/images/appmenu-addons-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/appmenu-addons-hdpi.png
rename to mobile/xul/themes/core/images/appmenu-addons-hdpi.png
diff --git a/mobile/themes/core/images/appmenu-downloads-hdpi.png b/mobile/xul/themes/core/images/appmenu-downloads-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/appmenu-downloads-hdpi.png
rename to mobile/xul/themes/core/images/appmenu-downloads-hdpi.png
diff --git a/mobile/themes/core/images/appmenu-findinpage-hdpi.png b/mobile/xul/themes/core/images/appmenu-findinpage-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/appmenu-findinpage-hdpi.png
rename to mobile/xul/themes/core/images/appmenu-findinpage-hdpi.png
diff --git a/mobile/themes/core/images/appmenu-more-hdpi.png b/mobile/xul/themes/core/images/appmenu-more-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/appmenu-more-hdpi.png
rename to mobile/xul/themes/core/images/appmenu-more-hdpi.png
diff --git a/mobile/themes/core/images/appmenu-preferences-hdpi.png b/mobile/xul/themes/core/images/appmenu-preferences-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/appmenu-preferences-hdpi.png
rename to mobile/xul/themes/core/images/appmenu-preferences-hdpi.png
diff --git a/mobile/themes/core/images/appmenu-share-hdpi.png b/mobile/xul/themes/core/images/appmenu-share-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/appmenu-share-hdpi.png
rename to mobile/xul/themes/core/images/appmenu-share-hdpi.png
diff --git a/mobile/themes/core/images/appmenu-site-hdpi.png b/mobile/xul/themes/core/images/appmenu-site-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/appmenu-site-hdpi.png
rename to mobile/xul/themes/core/images/appmenu-site-hdpi.png
diff --git a/mobile/themes/core/images/arrowbox-down.png b/mobile/xul/themes/core/images/arrowbox-down.png
similarity index 100%
rename from mobile/themes/core/images/arrowbox-down.png
rename to mobile/xul/themes/core/images/arrowbox-down.png
diff --git a/mobile/themes/core/images/arrowbox-horiz.png b/mobile/xul/themes/core/images/arrowbox-horiz.png
similarity index 100%
rename from mobile/themes/core/images/arrowbox-horiz.png
rename to mobile/xul/themes/core/images/arrowbox-horiz.png
diff --git a/mobile/themes/core/images/arrowbox-up.png b/mobile/xul/themes/core/images/arrowbox-up.png
similarity index 100%
rename from mobile/themes/core/images/arrowbox-up.png
rename to mobile/xul/themes/core/images/arrowbox-up.png
diff --git a/mobile/themes/core/images/arrowdown-16.png b/mobile/xul/themes/core/images/arrowdown-16.png
similarity index 100%
rename from mobile/themes/core/images/arrowdown-16.png
rename to mobile/xul/themes/core/images/arrowdown-16.png
diff --git a/mobile/themes/core/images/arrowdowndark-16.png b/mobile/xul/themes/core/images/arrowdowndark-16.png
similarity index 100%
rename from mobile/themes/core/images/arrowdowndark-16.png
rename to mobile/xul/themes/core/images/arrowdowndark-16.png
diff --git a/mobile/themes/core/images/arrowleft-16.png b/mobile/xul/themes/core/images/arrowleft-16.png
similarity index 100%
rename from mobile/themes/core/images/arrowleft-16.png
rename to mobile/xul/themes/core/images/arrowleft-16.png
diff --git a/mobile/themes/core/images/arrowleftdark-16.png b/mobile/xul/themes/core/images/arrowleftdark-16.png
similarity index 100%
rename from mobile/themes/core/images/arrowleftdark-16.png
rename to mobile/xul/themes/core/images/arrowleftdark-16.png
diff --git a/mobile/themes/core/images/arrowright-16.png b/mobile/xul/themes/core/images/arrowright-16.png
similarity index 100%
rename from mobile/themes/core/images/arrowright-16.png
rename to mobile/xul/themes/core/images/arrowright-16.png
diff --git a/mobile/themes/core/images/arrowrightdark-16.png b/mobile/xul/themes/core/images/arrowrightdark-16.png
similarity index 100%
rename from mobile/themes/core/images/arrowrightdark-16.png
rename to mobile/xul/themes/core/images/arrowrightdark-16.png
diff --git a/mobile/themes/core/images/arrowup-16.png b/mobile/xul/themes/core/images/arrowup-16.png
similarity index 100%
rename from mobile/themes/core/images/arrowup-16.png
rename to mobile/xul/themes/core/images/arrowup-16.png
diff --git a/mobile/themes/core/images/arrowupdark-16.png b/mobile/xul/themes/core/images/arrowupdark-16.png
similarity index 100%
rename from mobile/themes/core/images/arrowupdark-16.png
rename to mobile/xul/themes/core/images/arrowupdark-16.png
diff --git a/mobile/themes/core/images/aurora-lightbox-bg.jpg b/mobile/xul/themes/core/images/aurora-lightbox-bg.jpg
similarity index 100%
rename from mobile/themes/core/images/aurora-lightbox-bg.jpg
rename to mobile/xul/themes/core/images/aurora-lightbox-bg.jpg
diff --git a/mobile/themes/core/images/aurora-lightbox-close.png b/mobile/xul/themes/core/images/aurora-lightbox-close.png
similarity index 100%
rename from mobile/themes/core/images/aurora-lightbox-close.png
rename to mobile/xul/themes/core/images/aurora-lightbox-close.png
diff --git a/mobile/themes/core/images/aurora-lightbox-logo.png b/mobile/xul/themes/core/images/aurora-lightbox-logo.png
similarity index 100%
rename from mobile/themes/core/images/aurora-lightbox-logo.png
rename to mobile/xul/themes/core/images/aurora-lightbox-logo.png
diff --git a/mobile/themes/core/images/autocomplete-bookmarked-hdpi.png b/mobile/xul/themes/core/images/autocomplete-bookmarked-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/autocomplete-bookmarked-hdpi.png
rename to mobile/xul/themes/core/images/autocomplete-bookmarked-hdpi.png
diff --git a/mobile/themes/core/images/autocomplete-desktop-hdpi.png b/mobile/xul/themes/core/images/autocomplete-desktop-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/autocomplete-desktop-hdpi.png
rename to mobile/xul/themes/core/images/autocomplete-desktop-hdpi.png
diff --git a/mobile/themes/core/images/autocomplete-search-hdpi.png b/mobile/xul/themes/core/images/autocomplete-search-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/autocomplete-search-hdpi.png
rename to mobile/xul/themes/core/images/autocomplete-search-hdpi.png
diff --git a/mobile/themes/core/images/back-default-hdpi.png b/mobile/xul/themes/core/images/back-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/back-default-hdpi.png
rename to mobile/xul/themes/core/images/back-default-hdpi.png
diff --git a/mobile/themes/core/images/bookmark-default-hdpi.png b/mobile/xul/themes/core/images/bookmark-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/bookmark-default-hdpi.png
rename to mobile/xul/themes/core/images/bookmark-default-hdpi.png
diff --git a/mobile/themes/core/images/bookmark-starred-hdpi.png b/mobile/xul/themes/core/images/bookmark-starred-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/bookmark-starred-hdpi.png
rename to mobile/xul/themes/core/images/bookmark-starred-hdpi.png
diff --git a/mobile/themes/core/images/bookmarks-48.png b/mobile/xul/themes/core/images/bookmarks-48.png
similarity index 100%
rename from mobile/themes/core/images/bookmarks-48.png
rename to mobile/xul/themes/core/images/bookmarks-48.png
diff --git a/mobile/themes/core/images/browseaddons-bg.jpg b/mobile/xul/themes/core/images/browseaddons-bg.jpg
similarity index 100%
rename from mobile/themes/core/images/browseaddons-bg.jpg
rename to mobile/xul/themes/core/images/browseaddons-bg.jpg
diff --git a/mobile/themes/core/images/button-bg.png b/mobile/xul/themes/core/images/button-bg.png
similarity index 100%
rename from mobile/themes/core/images/button-bg.png
rename to mobile/xul/themes/core/images/button-bg.png
diff --git a/mobile/themes/core/images/check-30.png b/mobile/xul/themes/core/images/check-30.png
similarity index 100%
rename from mobile/themes/core/images/check-30.png
rename to mobile/xul/themes/core/images/check-30.png
diff --git a/mobile/themes/core/images/check-selected-30.png b/mobile/xul/themes/core/images/check-selected-30.png
similarity index 100%
rename from mobile/themes/core/images/check-selected-30.png
rename to mobile/xul/themes/core/images/check-selected-30.png
diff --git a/mobile/themes/core/images/check-unselected-30.png b/mobile/xul/themes/core/images/check-unselected-30.png
similarity index 100%
rename from mobile/themes/core/images/check-unselected-30.png
rename to mobile/xul/themes/core/images/check-unselected-30.png
diff --git a/mobile/themes/core/images/checkmark-hdpi.png b/mobile/xul/themes/core/images/checkmark-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/checkmark-hdpi.png
rename to mobile/xul/themes/core/images/checkmark-hdpi.png
diff --git a/mobile/themes/core/images/close-active-hdpi.png b/mobile/xul/themes/core/images/close-active-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/close-active-hdpi.png
rename to mobile/xul/themes/core/images/close-active-hdpi.png
diff --git a/mobile/themes/core/images/close-active-tablet-hdpi.png b/mobile/xul/themes/core/images/close-active-tablet-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/close-active-tablet-hdpi.png
rename to mobile/xul/themes/core/images/close-active-tablet-hdpi.png
diff --git a/mobile/themes/core/images/close-background-hdpi-rtl.png b/mobile/xul/themes/core/images/close-background-hdpi-rtl.png
similarity index 100%
rename from mobile/themes/core/images/close-background-hdpi-rtl.png
rename to mobile/xul/themes/core/images/close-background-hdpi-rtl.png
diff --git a/mobile/themes/core/images/close-background-hdpi.png b/mobile/xul/themes/core/images/close-background-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/close-background-hdpi.png
rename to mobile/xul/themes/core/images/close-background-hdpi.png
diff --git a/mobile/themes/core/images/close-default-hdpi.png b/mobile/xul/themes/core/images/close-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/close-default-hdpi.png
rename to mobile/xul/themes/core/images/close-default-hdpi.png
diff --git a/mobile/themes/core/images/close-default-tablet-hdpi.png b/mobile/xul/themes/core/images/close-default-tablet-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/close-default-tablet-hdpi.png
rename to mobile/xul/themes/core/images/close-default-tablet-hdpi.png
diff --git a/mobile/themes/core/images/close-inactive-tab-hdpi.png b/mobile/xul/themes/core/images/close-inactive-tab-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/close-inactive-tab-hdpi.png
rename to mobile/xul/themes/core/images/close-inactive-tab-hdpi.png
diff --git a/mobile/themes/core/images/close-inactive-tab-tablet-hdpi.png b/mobile/xul/themes/core/images/close-inactive-tab-tablet-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/close-inactive-tab-tablet-hdpi.png
rename to mobile/xul/themes/core/images/close-inactive-tab-tablet-hdpi.png
diff --git a/mobile/themes/core/images/console-default-hdpi.png b/mobile/xul/themes/core/images/console-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/console-default-hdpi.png
rename to mobile/xul/themes/core/images/console-default-hdpi.png
diff --git a/mobile/themes/core/images/downloads-default-hdpi.png b/mobile/xul/themes/core/images/downloads-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/downloads-default-hdpi.png
rename to mobile/xul/themes/core/images/downloads-default-hdpi.png
diff --git a/mobile/themes/core/images/dropmarker-hdpi.png b/mobile/xul/themes/core/images/dropmarker-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/dropmarker-hdpi.png
rename to mobile/xul/themes/core/images/dropmarker-hdpi.png
diff --git a/mobile/themes/core/images/endcap-active-bg.png b/mobile/xul/themes/core/images/endcap-active-bg.png
similarity index 100%
rename from mobile/themes/core/images/endcap-active-bg.png
rename to mobile/xul/themes/core/images/endcap-active-bg.png
diff --git a/mobile/themes/core/images/endcap-default-bg.png b/mobile/xul/themes/core/images/endcap-default-bg.png
similarity index 100%
rename from mobile/themes/core/images/endcap-default-bg.png
rename to mobile/xul/themes/core/images/endcap-default-bg.png
diff --git a/mobile/themes/core/images/endcap-ev-active-bg.png b/mobile/xul/themes/core/images/endcap-ev-active-bg.png
similarity index 100%
rename from mobile/themes/core/images/endcap-ev-active-bg.png
rename to mobile/xul/themes/core/images/endcap-ev-active-bg.png
diff --git a/mobile/themes/core/images/endcap-ev-default-bg.png b/mobile/xul/themes/core/images/endcap-ev-default-bg.png
similarity index 100%
rename from mobile/themes/core/images/endcap-ev-default-bg.png
rename to mobile/xul/themes/core/images/endcap-ev-default-bg.png
diff --git a/mobile/themes/core/images/endcap-ssl-active-bg.png b/mobile/xul/themes/core/images/endcap-ssl-active-bg.png
similarity index 100%
rename from mobile/themes/core/images/endcap-ssl-active-bg.png
rename to mobile/xul/themes/core/images/endcap-ssl-active-bg.png
diff --git a/mobile/themes/core/images/endcap-ssl-default-bg.png b/mobile/xul/themes/core/images/endcap-ssl-default-bg.png
similarity index 100%
rename from mobile/themes/core/images/endcap-ssl-default-bg.png
rename to mobile/xul/themes/core/images/endcap-ssl-default-bg.png
diff --git a/mobile/themes/core/images/errorpage-larry-black.png b/mobile/xul/themes/core/images/errorpage-larry-black.png
similarity index 100%
rename from mobile/themes/core/images/errorpage-larry-black.png
rename to mobile/xul/themes/core/images/errorpage-larry-black.png
diff --git a/mobile/themes/core/images/errorpage-larry-white.png b/mobile/xul/themes/core/images/errorpage-larry-white.png
similarity index 100%
rename from mobile/themes/core/images/errorpage-larry-white.png
rename to mobile/xul/themes/core/images/errorpage-larry-white.png
diff --git a/mobile/themes/core/images/errorpage-warning.png b/mobile/xul/themes/core/images/errorpage-warning.png
similarity index 100%
rename from mobile/themes/core/images/errorpage-warning.png
rename to mobile/xul/themes/core/images/errorpage-warning.png
diff --git a/mobile/themes/core/images/favicon-default-32.png b/mobile/xul/themes/core/images/favicon-default-32.png
similarity index 100%
rename from mobile/themes/core/images/favicon-default-32.png
rename to mobile/xul/themes/core/images/favicon-default-32.png
diff --git a/mobile/themes/core/images/folder-32.png b/mobile/xul/themes/core/images/folder-32.png
similarity index 100%
rename from mobile/themes/core/images/folder-32.png
rename to mobile/xul/themes/core/images/folder-32.png
diff --git a/mobile/themes/core/images/forward-default-hdpi.png b/mobile/xul/themes/core/images/forward-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/forward-default-hdpi.png
rename to mobile/xul/themes/core/images/forward-default-hdpi.png
diff --git a/mobile/themes/core/images/handle-end.png b/mobile/xul/themes/core/images/handle-end.png
similarity index 100%
rename from mobile/themes/core/images/handle-end.png
rename to mobile/xul/themes/core/images/handle-end.png
diff --git a/mobile/themes/core/images/handle-start.png b/mobile/xul/themes/core/images/handle-start.png
similarity index 100%
rename from mobile/themes/core/images/handle-start.png
rename to mobile/xul/themes/core/images/handle-start.png
diff --git a/mobile/themes/core/images/history-48.png b/mobile/xul/themes/core/images/history-48.png
similarity index 100%
rename from mobile/themes/core/images/history-48.png
rename to mobile/xul/themes/core/images/history-48.png
diff --git a/mobile/themes/core/images/homescreen-blank-hdpi.png b/mobile/xul/themes/core/images/homescreen-blank-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/homescreen-blank-hdpi.png
rename to mobile/xul/themes/core/images/homescreen-blank-hdpi.png
diff --git a/mobile/themes/core/images/homescreen-default-hdpi.png b/mobile/xul/themes/core/images/homescreen-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/homescreen-default-hdpi.png
rename to mobile/xul/themes/core/images/homescreen-default-hdpi.png
diff --git a/mobile/themes/core/images/identity-default-hdpi.png b/mobile/xul/themes/core/images/identity-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/identity-default-hdpi.png
rename to mobile/xul/themes/core/images/identity-default-hdpi.png
diff --git a/mobile/themes/core/images/identity-ev-hdpi.png b/mobile/xul/themes/core/images/identity-ev-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/identity-ev-hdpi.png
rename to mobile/xul/themes/core/images/identity-ev-hdpi.png
diff --git a/mobile/themes/core/images/identity-ssl-hdpi.png b/mobile/xul/themes/core/images/identity-ssl-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/identity-ssl-hdpi.png
rename to mobile/xul/themes/core/images/identity-ssl-hdpi.png
diff --git a/mobile/themes/core/images/locked-hdpi.png b/mobile/xul/themes/core/images/locked-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/locked-hdpi.png
rename to mobile/xul/themes/core/images/locked-hdpi.png
diff --git a/mobile/themes/core/images/menu-hdpi.png b/mobile/xul/themes/core/images/menu-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/menu-hdpi.png
rename to mobile/xul/themes/core/images/menu-hdpi.png
diff --git a/mobile/themes/core/images/mozilla-32.png b/mobile/xul/themes/core/images/mozilla-32.png
similarity index 100%
rename from mobile/themes/core/images/mozilla-32.png
rename to mobile/xul/themes/core/images/mozilla-32.png
diff --git a/mobile/themes/core/images/mute-hdpi.png b/mobile/xul/themes/core/images/mute-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/mute-hdpi.png
rename to mobile/xul/themes/core/images/mute-hdpi.png
diff --git a/mobile/themes/core/images/navigation-magnifier-30.png b/mobile/xul/themes/core/images/navigation-magnifier-30.png
similarity index 100%
rename from mobile/themes/core/images/navigation-magnifier-30.png
rename to mobile/xul/themes/core/images/navigation-magnifier-30.png
diff --git a/mobile/themes/core/images/newtab-default-hdpi.png b/mobile/xul/themes/core/images/newtab-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/newtab-default-hdpi.png
rename to mobile/xul/themes/core/images/newtab-default-hdpi.png
diff --git a/mobile/themes/core/images/newtab-default-tablet-hdpi.png b/mobile/xul/themes/core/images/newtab-default-tablet-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/newtab-default-tablet-hdpi.png
rename to mobile/xul/themes/core/images/newtab-default-tablet-hdpi.png
diff --git a/mobile/themes/core/images/next-disabled-hdpi.png b/mobile/xul/themes/core/images/next-disabled-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/next-disabled-hdpi.png
rename to mobile/xul/themes/core/images/next-disabled-hdpi.png
diff --git a/mobile/themes/core/images/next-hdpi.png b/mobile/xul/themes/core/images/next-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/next-hdpi.png
rename to mobile/xul/themes/core/images/next-hdpi.png
diff --git a/mobile/themes/core/images/panelrow-active-hdpi.png b/mobile/xul/themes/core/images/panelrow-active-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/panelrow-active-hdpi.png
rename to mobile/xul/themes/core/images/panelrow-active-hdpi.png
diff --git a/mobile/themes/core/images/panelrow-default-hdpi.png b/mobile/xul/themes/core/images/panelrow-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/panelrow-default-hdpi.png
rename to mobile/xul/themes/core/images/panelrow-default-hdpi.png
diff --git a/mobile/themes/core/images/panelrow-selected-hdpi.png b/mobile/xul/themes/core/images/panelrow-selected-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/panelrow-selected-hdpi.png
rename to mobile/xul/themes/core/images/panelrow-selected-hdpi.png
diff --git a/mobile/themes/core/images/pause-hdpi.png b/mobile/xul/themes/core/images/pause-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/pause-hdpi.png
rename to mobile/xul/themes/core/images/pause-hdpi.png
diff --git a/mobile/themes/core/images/play-hdpi.png b/mobile/xul/themes/core/images/play-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/play-hdpi.png
rename to mobile/xul/themes/core/images/play-hdpi.png
diff --git a/mobile/themes/core/images/popup-bg-hdpi.png b/mobile/xul/themes/core/images/popup-bg-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/popup-bg-hdpi.png
rename to mobile/xul/themes/core/images/popup-bg-hdpi.png
diff --git a/mobile/themes/core/images/popup-selected-item-hdpi.png b/mobile/xul/themes/core/images/popup-selected-item-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/popup-selected-item-hdpi.png
rename to mobile/xul/themes/core/images/popup-selected-item-hdpi.png
diff --git a/mobile/themes/core/images/preferences-default-hdpi.png b/mobile/xul/themes/core/images/preferences-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/preferences-default-hdpi.png
rename to mobile/xul/themes/core/images/preferences-default-hdpi.png
diff --git a/mobile/themes/core/images/previous-disabled-hdpi.png b/mobile/xul/themes/core/images/previous-disabled-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/previous-disabled-hdpi.png
rename to mobile/xul/themes/core/images/previous-disabled-hdpi.png
diff --git a/mobile/themes/core/images/previous-hdpi.png b/mobile/xul/themes/core/images/previous-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/previous-hdpi.png
rename to mobile/xul/themes/core/images/previous-hdpi.png
diff --git a/mobile/themes/core/images/ratings-18.png b/mobile/xul/themes/core/images/ratings-18.png
similarity index 100%
rename from mobile/themes/core/images/ratings-18.png
rename to mobile/xul/themes/core/images/ratings-18.png
diff --git a/mobile/themes/core/images/reload-hdpi.png b/mobile/xul/themes/core/images/reload-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/reload-hdpi.png
rename to mobile/xul/themes/core/images/reload-hdpi.png
diff --git a/mobile/themes/core/images/remotetabs-32.png b/mobile/xul/themes/core/images/remotetabs-32.png
similarity index 100%
rename from mobile/themes/core/images/remotetabs-32.png
rename to mobile/xul/themes/core/images/remotetabs-32.png
diff --git a/mobile/themes/core/images/remotetabs-48.png b/mobile/xul/themes/core/images/remotetabs-48.png
similarity index 100%
rename from mobile/themes/core/images/remotetabs-48.png
rename to mobile/xul/themes/core/images/remotetabs-48.png
diff --git a/mobile/themes/core/images/row-header-bg.png b/mobile/xul/themes/core/images/row-header-bg.png
similarity index 100%
rename from mobile/themes/core/images/row-header-bg.png
rename to mobile/xul/themes/core/images/row-header-bg.png
diff --git a/mobile/themes/core/images/scrubber-hdpi.png b/mobile/xul/themes/core/images/scrubber-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/scrubber-hdpi.png
rename to mobile/xul/themes/core/images/scrubber-hdpi.png
diff --git a/mobile/themes/core/images/search-clear-30.png b/mobile/xul/themes/core/images/search-clear-30.png
similarity index 100%
rename from mobile/themes/core/images/search-clear-30.png
rename to mobile/xul/themes/core/images/search-clear-30.png
diff --git a/mobile/themes/core/images/search-glass-30.png b/mobile/xul/themes/core/images/search-glass-30.png
similarity index 100%
rename from mobile/themes/core/images/search-glass-30.png
rename to mobile/xul/themes/core/images/search-glass-30.png
diff --git a/mobile/themes/core/images/section-collapsed-16.png b/mobile/xul/themes/core/images/section-collapsed-16.png
similarity index 100%
rename from mobile/themes/core/images/section-collapsed-16.png
rename to mobile/xul/themes/core/images/section-collapsed-16.png
diff --git a/mobile/themes/core/images/section-expanded-16.png b/mobile/xul/themes/core/images/section-expanded-16.png
similarity index 100%
rename from mobile/themes/core/images/section-expanded-16.png
rename to mobile/xul/themes/core/images/section-expanded-16.png
diff --git a/mobile/themes/core/images/settings-default-hdpi.png b/mobile/xul/themes/core/images/settings-default-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/settings-default-hdpi.png
rename to mobile/xul/themes/core/images/settings-default-hdpi.png
diff --git a/mobile/themes/core/images/sidebarbutton-active-hdpi.png b/mobile/xul/themes/core/images/sidebarbutton-active-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/sidebarbutton-active-hdpi.png
rename to mobile/xul/themes/core/images/sidebarbutton-active-hdpi.png
diff --git a/mobile/themes/core/images/stop-hdpi.png b/mobile/xul/themes/core/images/stop-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/stop-hdpi.png
rename to mobile/xul/themes/core/images/stop-hdpi.png
diff --git a/mobile/themes/core/images/tab-active-hdpi.png b/mobile/xul/themes/core/images/tab-active-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/tab-active-hdpi.png
rename to mobile/xul/themes/core/images/tab-active-hdpi.png
diff --git a/mobile/themes/core/images/tab-closed-hdpi.png b/mobile/xul/themes/core/images/tab-closed-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/tab-closed-hdpi.png
rename to mobile/xul/themes/core/images/tab-closed-hdpi.png
diff --git a/mobile/themes/core/images/tab-inactive-hdpi.png b/mobile/xul/themes/core/images/tab-inactive-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/tab-inactive-hdpi.png
rename to mobile/xul/themes/core/images/tab-inactive-hdpi.png
diff --git a/mobile/themes/core/images/tab-reopen-hdpi.png b/mobile/xul/themes/core/images/tab-reopen-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/tab-reopen-hdpi.png
rename to mobile/xul/themes/core/images/tab-reopen-hdpi.png
diff --git a/mobile/themes/core/images/tab-reopen-tablet-hdpi.png b/mobile/xul/themes/core/images/tab-reopen-tablet-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/tab-reopen-tablet-hdpi.png
rename to mobile/xul/themes/core/images/tab-reopen-tablet-hdpi.png
diff --git a/mobile/themes/core/images/tabs-hdpi.png b/mobile/xul/themes/core/images/tabs-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/tabs-hdpi.png
rename to mobile/xul/themes/core/images/tabs-hdpi.png
diff --git a/mobile/themes/core/images/task-back-hdpi.png b/mobile/xul/themes/core/images/task-back-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/task-back-hdpi.png
rename to mobile/xul/themes/core/images/task-back-hdpi.png
diff --git a/mobile/themes/core/images/task-back-rtl-hdpi.png b/mobile/xul/themes/core/images/task-back-rtl-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/task-back-rtl-hdpi.png
rename to mobile/xul/themes/core/images/task-back-rtl-hdpi.png
diff --git a/mobile/themes/core/images/task-close-hdpi.png b/mobile/xul/themes/core/images/task-close-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/task-close-hdpi.png
rename to mobile/xul/themes/core/images/task-close-hdpi.png
diff --git a/mobile/themes/core/images/task-switch-hdpi.png b/mobile/xul/themes/core/images/task-switch-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/task-switch-hdpi.png
rename to mobile/xul/themes/core/images/task-switch-hdpi.png
diff --git a/mobile/themes/core/images/textbox-bg.png b/mobile/xul/themes/core/images/textbox-bg.png
similarity index 100%
rename from mobile/themes/core/images/textbox-bg.png
rename to mobile/xul/themes/core/images/textbox-bg.png
diff --git a/mobile/themes/core/images/throbber.png b/mobile/xul/themes/core/images/throbber.png
similarity index 100%
rename from mobile/themes/core/images/throbber.png
rename to mobile/xul/themes/core/images/throbber.png
diff --git a/mobile/themes/core/images/toggle-off.png b/mobile/xul/themes/core/images/toggle-off.png
similarity index 100%
rename from mobile/themes/core/images/toggle-off.png
rename to mobile/xul/themes/core/images/toggle-off.png
diff --git a/mobile/themes/core/images/toggle-on.png b/mobile/xul/themes/core/images/toggle-on.png
similarity index 100%
rename from mobile/themes/core/images/toggle-on.png
rename to mobile/xul/themes/core/images/toggle-on.png
diff --git a/mobile/themes/core/images/unlocked-hdpi.png b/mobile/xul/themes/core/images/unlocked-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/unlocked-hdpi.png
rename to mobile/xul/themes/core/images/unlocked-hdpi.png
diff --git a/mobile/themes/core/images/unmute-hdpi.png b/mobile/xul/themes/core/images/unmute-hdpi.png
similarity index 100%
rename from mobile/themes/core/images/unmute-hdpi.png
rename to mobile/xul/themes/core/images/unmute-hdpi.png
diff --git a/mobile/themes/core/jar.mn b/mobile/xul/themes/core/jar.mn
similarity index 100%
rename from mobile/themes/core/jar.mn
rename to mobile/xul/themes/core/jar.mn
diff --git a/mobile/themes/core/localePicker.css b/mobile/xul/themes/core/localePicker.css
similarity index 100%
rename from mobile/themes/core/localePicker.css
rename to mobile/xul/themes/core/localePicker.css
diff --git a/mobile/themes/core/netError.css b/mobile/xul/themes/core/netError.css
similarity index 100%
rename from mobile/themes/core/netError.css
rename to mobile/xul/themes/core/netError.css
diff --git a/mobile/themes/core/notification.css b/mobile/xul/themes/core/notification.css
similarity index 100%
rename from mobile/themes/core/notification.css
rename to mobile/xul/themes/core/notification.css
diff --git a/mobile/themes/core/platform.css b/mobile/xul/themes/core/platform.css
similarity index 100%
rename from mobile/themes/core/platform.css
rename to mobile/xul/themes/core/platform.css
diff --git a/mobile/themes/core/tablet.css b/mobile/xul/themes/core/tablet.css
similarity index 100%
rename from mobile/themes/core/tablet.css
rename to mobile/xul/themes/core/tablet.css
diff --git a/mobile/themes/core/touchcontrols.css b/mobile/xul/themes/core/touchcontrols.css
similarity index 100%
rename from mobile/themes/core/touchcontrols.css
rename to mobile/xul/themes/core/touchcontrols.css
diff --git a/parser/html/nsHtml5Parser.cpp b/parser/html/nsHtml5Parser.cpp
index 20ce8911ce3..bf86a933583 100644
--- a/parser/html/nsHtml5Parser.cpp
+++ b/parser/html/nsHtml5Parser.cpp
@@ -177,11 +177,10 @@ nsHtml5Parser::GetDTD(nsIDTD** aDTD)
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsHtml5Parser::GetStreamListener(nsIStreamListener** aListener)
+nsIStreamListener*
+nsHtml5Parser::GetStreamListener()
 {
-  NS_IF_ADDREF(*aListener = mStreamParser);
-  return NS_OK;
+  return mStreamParser;
 }
 
 NS_IMETHODIMP
diff --git a/parser/html/nsHtml5Parser.h b/parser/html/nsHtml5Parser.h
index 529a80e96b3..4efa1037af7 100644
--- a/parser/html/nsHtml5Parser.h
+++ b/parser/html/nsHtml5Parser.h
@@ -137,7 +137,7 @@ class nsHtml5Parser : public nsIParser,
     /**
      * Get the stream parser for this parser
      */
-    NS_IMETHOD GetStreamListener(nsIStreamListener** aListener);
+    virtual nsIStreamListener* GetStreamListener();
 
     /**
      * Don't call. For interface compat only.
diff --git a/parser/html/nsHtml5TreeOpExecutor.cpp b/parser/html/nsHtml5TreeOpExecutor.cpp
index b85e960deab..3f3b3405b18 100644
--- a/parser/html/nsHtml5TreeOpExecutor.cpp
+++ b/parser/html/nsHtml5TreeOpExecutor.cpp
@@ -745,12 +745,8 @@ nsHtml5TreeOpExecutor::RunScript(nsIContent* aScriptElement)
   }
 
   if (sele->GetScriptDeferred() || sele->GetScriptAsync()) {
-    #ifdef DEBUG
-    nsresult rv = 
-    #endif
-    aScriptElement->DoneAddingChildren(true); // scripts ignore the argument
-    NS_ASSERTION(rv != NS_ERROR_HTMLPARSER_BLOCK, 
-                 "Defer or async script tried to block.");
+    DebugOnly<bool> block = sele->AttemptToExecute();
+    NS_ASSERTION(!block, "Defer or async script tried to block.");
     return;
   }
   
@@ -767,13 +763,12 @@ nsHtml5TreeOpExecutor::RunScript(nsIContent* aScriptElement)
 
   // Copied from nsXMLContentSink
   // Now tell the script that it's ready to go. This may execute the script
-  // or return NS_ERROR_HTMLPARSER_BLOCK. Or neither if the script doesn't
-  // need executing.
-  nsresult rv = aScriptElement->DoneAddingChildren(true);
+  // or return true, or neither if the script doesn't need executing.
+  bool block = sele->AttemptToExecute();
 
   // If the act of insertion evaluated the script, we're fine.
   // Else, block the parser till the script has loaded.
-  if (rv == NS_ERROR_HTMLPARSER_BLOCK) {
+  if (block) {
     mScriptElements.AppendObject(sele);
     if (mParser) {
       mParser->BlockParser();
diff --git a/parser/html/nsHtml5TreeOperation.cpp b/parser/html/nsHtml5TreeOperation.cpp
index bfae5c444a6..4e709e292a8 100644
--- a/parser/html/nsHtml5TreeOperation.cpp
+++ b/parser/html/nsHtml5TreeOperation.cpp
@@ -386,7 +386,7 @@ nsHtml5TreeOperation::Perform(nsHtml5TreeOpExecutor* aBuilder,
         GetNodeInfo(name, nsnull, ns, nsIDOMNode::ELEMENT_NODE);
       NS_ASSERTION(nodeInfo, "Got null nodeinfo.");
       NS_NewElement(getter_AddRefs(newContent),
-                    ns, nodeInfo.forget(),
+                    nodeInfo.forget(),
                     (mOpCode == eTreeOpCreateElementNetwork ?
                      dom::FROM_PARSER_NETWORK
                      : (aBuilder->IsFragmentMode() ?
@@ -431,7 +431,6 @@ nsHtml5TreeOperation::Perform(nsHtml5TreeOpExecutor* aBuilder,
           nsCOMPtr<nsIContent> optionElt;
           nsCOMPtr<nsINodeInfo> ni = optionNodeInfo;
           NS_NewElement(getter_AddRefs(optionElt), 
-                        optionNodeInfo->NamespaceID(), 
                         ni.forget(),
                         (mOpCode == eTreeOpCreateElementNetwork ?
                          dom::FROM_PARSER_NETWORK
diff --git a/parser/htmlparser/public/nsIParser.h b/parser/htmlparser/public/nsIParser.h
index 4e232b36f29..c14baed0413 100644
--- a/parser/htmlparser/public/nsIParser.h
+++ b/parser/htmlparser/public/nsIParser.h
@@ -55,8 +55,8 @@
 #include "nsIAtom.h"
 
 #define NS_IPARSER_IID \
-{ 0xcbc0cbd8, 0xbbb7, 0x46d6, \
-  { 0xa5, 0x51, 0x37, 0x8a, 0x69, 0x53, 0xa7, 0x14 } }
+{ 0xc9169398, 0x897a, 0x481d, \
+  { 0xa9, 0x5f, 0xd6, 0x60, 0x6e, 0xf8, 0x37, 0x56 } }
 
 // {41421C60-310A-11d4-816F-000064657374}
 #define NS_IDEBUG_DUMP_CONTENT_IID \
@@ -196,10 +196,8 @@ class nsIParser : public nsISupports {
     
     /**
      * Get the nsIStreamListener for this parser
-     * @param aDTD out param that will contain the result
-     * @return NS_OK if successful
      */
-    NS_IMETHOD GetStreamListener(nsIStreamListener** aListener) = 0;
+    virtual nsIStreamListener* GetStreamListener() = 0;
 
     /**************************************************************************
      *  Parse methods always begin with an input source, and perform
diff --git a/parser/htmlparser/src/nsParser.cpp b/parser/htmlparser/src/nsParser.cpp
index 005acf9b318..ab6639a4b0c 100644
--- a/parser/htmlparser/src/nsParser.cpp
+++ b/parser/htmlparser/src/nsParser.cpp
@@ -2976,9 +2976,8 @@ nsParser::GetDTD(nsIDTD** aDTD)
 /**
  * Get this as nsIStreamListener
  */
-NS_IMETHODIMP
-nsParser::GetStreamListener(nsIStreamListener** aListener)
+nsIStreamListener*
+nsParser::GetStreamListener()
 {
-  NS_ADDREF(*aListener = this);
-  return NS_OK;
+  return this;
 }
diff --git a/parser/htmlparser/src/nsParser.h b/parser/htmlparser/src/nsParser.h
index 7cdb13e3e40..9d9c4f11fd8 100644
--- a/parser/htmlparser/src/nsParser.h
+++ b/parser/htmlparser/src/nsParser.h
@@ -294,10 +294,8 @@ class nsParser : public nsIParser,
   
     /**
      * Get the nsIStreamListener for this parser
-     * @param aDTD out param that will contain the result
-     * @return NS_OK if successful
      */
-    NS_IMETHOD GetStreamListener(nsIStreamListener** aListener);
+    virtual nsIStreamListener* GetStreamListener();
 
     /** 
      * Detects the existence of a META tag with charset information in 
diff --git a/testing/jetpack/jetpack-location.txt b/testing/jetpack/jetpack-location.txt
index e56dddf056b..cf205cf2bbc 100644
--- a/testing/jetpack/jetpack-location.txt
+++ b/testing/jetpack/jetpack-location.txt
@@ -1 +1 @@
-http://hg.mozilla.org/projects/addon-sdk/archive/1e7de63d8710.tar.bz2
+http://hg.mozilla.org/projects/addon-sdk/archive/f70019f659ce.tar.bz2
diff --git a/testing/peptest/Makefile.in b/testing/peptest/Makefile.in
new file mode 100644
index 00000000000..6bb0d33c44e
--- /dev/null
+++ b/testing/peptest/Makefile.in
@@ -0,0 +1,56 @@
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is peptest.
+#
+# The Initial Developer of the Original Code is
+#   Mozilla Corporation 
+# Portions created by the Initial Developer are Copyright (C) 2011
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#   Andrew Halberstadt <ahalberstadt@mozilla.com> (Original author)
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either of the GNU General Public License Version 2 or later (the "GPL"),
+# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+DEPTH = ../..
+topsrcdir = @top_srcdir@
+srcdir = @srcdir@
+VPATH = @srcdir@
+
+include $(DEPTH)/config/autoconf.mk
+
+MODULE = testing_peptest
+
+include $(topsrcdir)/config/rules.mk
+
+TEST_FILES = \
+  tests \
+  $(NULL)
+
+stage-package: PKG_STAGE = $(DIST)/test-package-stage
+stage-package:
+	$(NSINSTALL) -D $(PKG_STAGE)/peptest
+	@(cd $(srcdir) && tar $(TAR_CREATE_FLAGS) - $(TEST_FILES)) | (cd $(PKG_STAGE)/peptest && tar -xf -)
diff --git a/testing/peptest/tests/firefox/examples/example_tests.ini b/testing/peptest/tests/firefox/examples/example_tests.ini
new file mode 100644
index 00000000000..3d2da0d6c92
--- /dev/null
+++ b/testing/peptest/tests/firefox/examples/example_tests.ini
@@ -0,0 +1,6 @@
+[test_contextMenu.js]
+[test_openBlankTab.js]
+[test_openBookmarksMenu.js]
+[test_searchGoogle.js]
+[test_openWindow.js]
+[test_resizeWindow.js]
diff --git a/testing/peptest/tests/firefox/examples/test_contextMenu.js b/testing/peptest/tests/firefox/examples/test_contextMenu.js
new file mode 100644
index 00000000000..b6fbae4720a
--- /dev/null
+++ b/testing/peptest/tests/firefox/examples/test_contextMenu.js
@@ -0,0 +1,107 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is peptest.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *  Andrew Halberstadt <halbersa@gmail.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+
+/**
+ * This test is designed to test responsiveness while performing actions
+ * on various context menus in both content and chrome.
+ */
+
+// Import mozmill and initialize a controller
+Components.utils.import("resource://mozmill/driver/mozmill.js")
+let c = getBrowserController();
+
+// Open mozilla.org and wait for the page to load
+c.open("http://mozilla.org");
+c.waitForPageLoad();
+
+// Grab reference to element on page (this is the <body> element in this case)
+let page = findElement.ID(c.tabs.activeTab, 'home');
+// Perform our first action, reload.
+// It is very important to only place things that we
+// are interested in testing inside of a performAction call
+performAction('content_reload', function() {
+  page.rightClick();
+  page.keypress('r');
+});
+c.waitForPageLoad();
+
+c.open("http://google.com");
+c.waitForPageLoad();
+
+page = findElement.ID(c.tabs.activeTab, 'main');
+// Perform our second action, go back
+performAction('content_back', function() {
+  page.rightClick();
+  page.keypress('b');
+});
+// Bug 699400 - waitForPageLoad times out when pressing back button
+c.sleep(10);
+
+page = findElement.ID(c.tabs.activeTab, 'home');
+// Perform our third action, scroll through context menu
+performAction('content_scroll', function() {
+  page.rightClick();
+  for (let i = 0; i < 15; ++i) {
+    page.keypress('VK_DOWN');
+    // Sleep to better emulate a user
+    c.sleep(10);
+  }
+});
+
+// Now test context menus in chrome
+let bar = findElement.ID(c.window.document, "appmenu-toolbar-button");
+bar.click();
+performAction('chrome_menu', function() {
+  bar.rightClick();
+  bar.keypress('m');
+});
+
+performAction('chrome_addon', function() {
+  bar.rightClick();
+  bar.keypress('a');
+});
+
+performAction('chrome_scroll', function() {
+  bar.rightClick();
+  for (let i = 0; i < 15; ++i) {
+    page.keypress('VK_DOWN');
+    // Sleep to better emulate a user
+    c.sleep(10);
+  }
+});
+
diff --git a/testing/peptest/tests/firefox/examples/test_openBlankTab.js b/testing/peptest/tests/firefox/examples/test_openBlankTab.js
new file mode 100644
index 00000000000..3f64dc31cb6
--- /dev/null
+++ b/testing/peptest/tests/firefox/examples/test_openBlankTab.js
@@ -0,0 +1,53 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is peptest.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *  Andrew Halberstadt <halbersa@gmail.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+// Initialize mozmill
+Components.utils.import('resource://mozmill/driver/mozmill.js');
+let c = getBrowserController();
+
+c.open('http://mozilla.org');
+c.waitForPageLoad();
+
+// Only put things you want to test for responsiveness inside a perfom action call
+let page = findElement.ID(c.tabs.activeTab, "home");
+performAction('open_blank_tab', function() {
+  page.keypress('t', {'ctrlKey': true});
+});
+
+performAction('close_blank_tab', function() {
+  page.keypress('w', {'ctrlKey': true});
+});
diff --git a/testing/peptest/tests/firefox/examples/test_openBookmarksMenu.js b/testing/peptest/tests/firefox/examples/test_openBookmarksMenu.js
new file mode 100644
index 00000000000..794f729d846
--- /dev/null
+++ b/testing/peptest/tests/firefox/examples/test_openBookmarksMenu.js
@@ -0,0 +1,58 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is peptest.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *  Andrew Halberstadt <halbersa@gmail.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+// Import mozmill and initialize a controller
+Components.utils.import('resource://mozmill/driver/mozmill.js');
+let c = getBrowserController();
+
+c.open('http://mozilla.org');
+c.waitForPageLoad();
+
+let bookmark = findElement.ID(c.window.document, "bookmarksMenu");
+performAction('scroll_bookmarks', function() {
+  bookmark.click();
+  for (let i = 0; i < 15; ++i) {
+    bookmark.keypress('VK_DOWN');
+    // Sleep to better emulate a user
+    c.sleep(10);
+  }
+});
+
+let showall = findElement.ID(c.window.document, "bookmarksShowAll");
+performAction('show_all_bookmarks', function() {
+  showall.click();
+});
diff --git a/testing/peptest/tests/firefox/examples/test_openWindow.js b/testing/peptest/tests/firefox/examples/test_openWindow.js
new file mode 100644
index 00000000000..e70c38f4d77
--- /dev/null
+++ b/testing/peptest/tests/firefox/examples/test_openWindow.js
@@ -0,0 +1,45 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is peptest.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *  Andrew Halberstadt <halbersa@gmail.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+// Import mozmill and initialize a controller
+Components.utils.import("resource://mozmill/driver/mozmill.js");
+let controller = getBrowserController();
+
+let win = findElement.ID(controller.window.document, 'main-window');
+performAction("open_window", function() {
+  win.keypress("n", {"ctrlKey":true});
+});
diff --git a/testing/peptest/tests/firefox/examples/test_resizeWindow.js b/testing/peptest/tests/firefox/examples/test_resizeWindow.js
new file mode 100644
index 00000000000..747c7687194
--- /dev/null
+++ b/testing/peptest/tests/firefox/examples/test_resizeWindow.js
@@ -0,0 +1,56 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is peptest.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *  Andrew Halberstadt <halbersa@gmail.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+// Most of the other example tests use Mozmill to perform various
+// automation. Note that this is not necessary.
+//
+// This test will check responsiveness while resizing the window
+
+let window = getWindow();
+let width = window.outerWidth;
+let height = window.outerHeight;
+
+performAction('resize_by', function() {
+  window.resizeBy(100, 100);
+});
+
+performAction('resize_to', function() {
+  window.resizeTo(800, 600);
+});
+
+// Tests should clean up after themselves
+window.resizeTo(width, height);
diff --git a/testing/peptest/tests/firefox/examples/test_searchGoogle.js b/testing/peptest/tests/firefox/examples/test_searchGoogle.js
new file mode 100644
index 00000000000..b98da0f421d
--- /dev/null
+++ b/testing/peptest/tests/firefox/examples/test_searchGoogle.js
@@ -0,0 +1,50 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is peptest.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *  Andrew Halberstadt <halbersa@gmail.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+// Import mozmill and initialize a controller
+Components.utils.import("resource://mozmill/driver/mozmill.js");
+let controller = getBrowserController();
+
+controller.open("http://google.ca");
+controller.waitForPageLoad();
+
+let textbox = findElement.ID(controller.tabs.activeTab, 'lst-ib');
+let button = findElement.Name(controller.tabs.activeTab, 'btnK');
+performAction('enterText', function() {
+  textbox.sendKeys('foobar');
+  button.click();
+});
diff --git a/testing/peptest/tests/firefox/firefox_all.ini b/testing/peptest/tests/firefox/firefox_all.ini
new file mode 100644
index 00000000000..73439806141
--- /dev/null
+++ b/testing/peptest/tests/firefox/firefox_all.ini
@@ -0,0 +1,2 @@
+# All Firefox tests - include other manifests here
+[include:examples/example_tests.ini]
diff --git a/testing/peptest/tests/thunderbird/thunderbird_all.ini b/testing/peptest/tests/thunderbird/thunderbird_all.ini
new file mode 100644
index 00000000000..d914c458462
--- /dev/null
+++ b/testing/peptest/tests/thunderbird/thunderbird_all.ini
@@ -0,0 +1 @@
+[include:examples/example_tests.ini]
diff --git a/testing/testsuite-targets.mk b/testing/testsuite-targets.mk
index 4889c201855..2eea447ecdb 100644
--- a/testing/testsuite-targets.mk
+++ b/testing/testsuite-targets.mk
@@ -233,7 +233,7 @@ include $(topsrcdir)/toolkit/mozapps/installer/package-name.mk
 
 ifndef UNIVERSAL_BINARY
 PKG_STAGE = $(DIST)/test-package-stage
-package-tests: stage-mochitest stage-reftest stage-xpcshell stage-jstests stage-jetpack stage-firebug
+package-tests: stage-mochitest stage-reftest stage-xpcshell stage-jstests stage-jetpack stage-firebug stage-peptest
 else
 # This staging area has been built for us by universal/flight.mk
 PKG_STAGE = $(DIST)/universal/test-package-stage
@@ -255,7 +255,7 @@ package-tests: stage-android
 endif
 
 make-stage-dir:
-	rm -rf $(PKG_STAGE) && $(NSINSTALL) -D $(PKG_STAGE) && $(NSINSTALL) -D $(PKG_STAGE)/bin && $(NSINSTALL) -D $(PKG_STAGE)/bin/components && $(NSINSTALL) -D $(PKG_STAGE)/certs && $(NSINSTALL) -D $(PKG_STAGE)/jetpack && $(NSINSTALL) -D $(PKG_STAGE)/firebug
+	rm -rf $(PKG_STAGE) && $(NSINSTALL) -D $(PKG_STAGE) && $(NSINSTALL) -D $(PKG_STAGE)/bin && $(NSINSTALL) -D $(PKG_STAGE)/bin/components && $(NSINSTALL) -D $(PKG_STAGE)/certs && $(NSINSTALL) -D $(PKG_STAGE)/jetpack && $(NSINSTALL) -D $(PKG_STAGE)/firebug && $(NSINSTALL) -D $(PKG_STAGE)/peptest
 
 stage-mochitest: make-stage-dir
 	$(MAKE) -C $(DEPTH)/testing/mochitest stage-package
@@ -280,9 +280,12 @@ stage-jetpack: make-stage-dir
 
 stage-firebug: make-stage-dir
 	$(MAKE) -C $(DEPTH)/testing/firebug stage-package
+
+stage-peptest: make-stage-dir
+	$(MAKE) -C $(DEPTH)/testing/peptest stage-package
 .PHONY: \
   mochitest mochitest-plain mochitest-chrome mochitest-a11y mochitest-ipcplugins \
   reftest crashtest \
   xpcshell-tests \
   jstestbrowser \
-  package-tests make-stage-dir stage-mochitest stage-reftest stage-xpcshell stage-jstests stage-android stage-jetpack stage-firebug
+  package-tests make-stage-dir stage-mochitest stage-reftest stage-xpcshell stage-jstests stage-android stage-jetpack stage-firebug stage-peptest
diff --git a/toolkit/components/autocomplete/nsAutoCompleteController.cpp b/toolkit/components/autocomplete/nsAutoCompleteController.cpp
index 4adc1a4378a..f98f4249744 100644
--- a/toolkit/components/autocomplete/nsAutoCompleteController.cpp
+++ b/toolkit/components/autocomplete/nsAutoCompleteController.cpp
@@ -1306,10 +1306,11 @@ nsAutoCompleteController::ProcessResult(PRInt32 aSearchIndex, nsIAutoCompleteRes
   // Make sure the popup is open, if necessary, since we now have at least one
   // search result ready to display. Don't force the popup closed if we might
   // get results in the future to avoid unnecessarily canceling searches.
-  if (mRowCount)
+  if (mRowCount) {
     OpenPopup();
-  else if (result != nsIAutoCompleteResult::RESULT_NOMATCH_ONGOING)
+  } else if (mSearchesOngoing == 0) {
     ClosePopup();
+  }
 
   if (mSearchesOngoing == 0) {
     // If this is the last search to return, cleanup
diff --git a/toolkit/components/autocomplete/tests/unit/test_440866.js b/toolkit/components/autocomplete/tests/unit/test_440866.js
new file mode 100644
index 00000000000..996c458aead
--- /dev/null
+++ b/toolkit/components/autocomplete/tests/unit/test_440866.js
@@ -0,0 +1,317 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Bug 440866 unit test code.
+ *
+ * The Initial Developer of the Original Code is
+ *   The Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Felix Fung <felix.the.cheshire.cat@gmail.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+const Cc = Components.classes;
+const Ci = Components.interfaces;
+
+/**
+ * Unit test for Bug 440866 - First AutoCompleteSearch that returns
+ * RESULT_NOMATCH cancels all other searches when popup is open
+ */
+
+
+
+/**
+ * Dummy nsIAutoCompleteInput source that returns
+ * the given list of AutoCompleteSearch names.
+ *
+ * Implements only the methods needed for this test.
+ */
+function AutoCompleteInput(aSearches) {
+  this.searches = aSearches;
+}
+AutoCompleteInput.prototype = {
+  constructor: AutoCompleteInput,
+
+  // Array of AutoCompleteSearch names
+  searches: null,
+
+  minResultsForPopup: 0,
+  timeout: 10,
+  searchParam: "",
+  textValue: "",
+  disableAutoComplete: false,
+  completeDefaultIndex: false,
+
+  get searchCount() {
+    return this.searches.length;
+  },
+
+  getSearchAt: function(aIndex) {
+    return this.searches[aIndex];
+  },
+
+  onSearchBegin: function() {},
+  onSearchComplete: function() {},
+
+  popupOpen: false,
+
+  popup: {
+    setSelectedIndex: function(aIndex) {},
+    invalidate: function() {},
+
+    // nsISupports implementation
+    QueryInterface: function(iid) {
+      if (iid.equals(Ci.nsISupports) ||
+          iid.equals(Ci.nsIAutoCompletePopup))
+        return this;
+
+      throw Components.results.NS_ERROR_NO_INTERFACE;
+    }
+  },
+
+  // nsISupports implementation
+  QueryInterface: function(iid) {
+    if (iid.equals(Ci.nsISupports) ||
+        iid.equals(Ci.nsIAutoCompleteInput))
+      return this;
+
+    throw Components.results.NS_ERROR_NO_INTERFACE;
+  }
+}
+
+
+
+/**
+ * nsIAutoCompleteResult implementation
+ */
+function AutoCompleteResult(aValues, aComments, aStyles) {
+  this._values = aValues;
+  this._comments = aComments;
+  this._styles = aStyles;
+
+  if (this._values.length > 0) {
+    this.searchResult = Ci.nsIAutoCompleteResult.RESULT_SUCCESS;
+  } else {
+    this.searchResult = Ci.nsIAutoCompleteResult.NOMATCH;
+  }
+}
+AutoCompleteResult.prototype = {
+  constructor: AutoCompleteResult,
+
+  // Arrays
+  _values: null,
+  _comments: null,
+  _styles: null,
+
+  searchString: "",
+  searchResult: null,
+
+  defaultIndex: 0,
+
+  get matchCount() {
+    return this._values.length;
+  },
+
+  getValueAt: function(aIndex) {
+    return this._values[aIndex];
+  },
+
+  getLabelAt: function(aIndex) {
+    return this.getValueAt(aIndex);
+  },
+
+  getCommentAt: function(aIndex) {
+    return this._comments[aIndex];
+  },
+
+  getStyleAt: function(aIndex) {
+    return this._styles[aIndex];
+  },
+
+  getImageAt: function(aIndex) {
+    return "";
+  },
+
+  removeValueAt: function (aRowIndex, aRemoveFromDb) {},
+
+  // nsISupports implementation
+  QueryInterface: function(iid) {
+    if (iid.equals(Ci.nsISupports) ||
+        iid.equals(Ci.nsIAutoCompleteResult))
+      return this;
+
+    throw Components.results.NS_ERROR_NO_INTERFACE;
+  }
+}
+
+
+
+/**
+ * nsIAutoCompleteSearch implementation that always returns
+ * the same result set.
+ */
+function AutoCompleteSearch(aName, aResult) {
+  this.name = aName;
+  this._result = aResult;
+}
+AutoCompleteSearch.prototype = {
+  constructor: AutoCompleteSearch,
+
+  // Search name. Used by AutoCompleteController
+  name: null,
+
+  // AutoCompleteResult
+  _result:null,
+
+
+  /**
+   * Return the same result set for every search
+   */
+  startSearch: function(aSearchString,
+                        aSearchParam,
+                        aPreviousResult,
+                        aListener)
+  {
+    aListener.onSearchResult(this, this._result);
+  },
+
+  stopSearch: function() {},
+
+  // nsISupports implementation
+  QueryInterface: function(iid) {
+    if (iid.equals(Ci.nsISupports) ||
+        iid.equals(Ci.nsIFactory) ||
+        iid.equals(Ci.nsIAutoCompleteSearch))
+      return this;
+
+    throw Components.results.NS_ERROR_NO_INTERFACE;
+  },
+
+  // nsIFactory implementation
+  createInstance: function(outer, iid) {
+    return this.QueryInterface(iid);
+  }
+}
+
+
+
+/**
+ * Helper to register an AutoCompleteSearch with the given name.
+ * Allows the AutoCompleteController to find the search.
+ */
+function registerAutoCompleteSearch(aSearch) {
+  var name = "@mozilla.org/autocomplete/search;1?name=" + aSearch.name;
+
+  var uuidGenerator = Cc["@mozilla.org/uuid-generator;1"].
+                      getService(Ci.nsIUUIDGenerator);
+  var cid = uuidGenerator.generateUUID();
+
+  var desc = "Test AutoCompleteSearch";
+
+  var componentManager = Components.manager
+                                   .QueryInterface(Ci.nsIComponentRegistrar);
+  componentManager.registerFactory(cid, desc, name, aSearch);
+
+  // Keep the id on the object so we can unregister later
+  aSearch.cid = cid;
+}
+
+
+
+/**
+ * Helper to unregister an AutoCompleteSearch.
+ */
+function unregisterAutoCompleteSearch(aSearch) {
+  var componentManager = Components.manager
+                                   .QueryInterface(Ci.nsIComponentRegistrar);
+  componentManager.unregisterFactory(aSearch.cid, aSearch);
+}
+
+
+
+/**
+ * Test AutoComplete with multiple AutoCompleteSearch sources.
+ */
+function run_test() {
+
+  // Make an AutoCompleteSearch that always returns nothing
+  var emptySearch = new AutoCompleteSearch("test-empty-search",
+                             new AutoCompleteResult([], [], []));
+
+  // Make an AutoCompleteSearch that returns two values
+  var expectedValues = ["test1", "test2"];
+  var regularSearch = new AutoCompleteSearch("test-regular-search",
+                             new AutoCompleteResult(expectedValues, [], []));
+
+  // Register searches so AutoCompleteController can find them
+  registerAutoCompleteSearch(emptySearch);
+  registerAutoCompleteSearch(regularSearch);
+
+  var controller = Components.classes["@mozilla.org/autocomplete/controller;1"].
+                   getService(Components.interfaces.nsIAutoCompleteController);
+
+  // Make an AutoCompleteInput that uses our searches
+  // and confirms results on search complete
+  var input = new AutoCompleteInput([emptySearch.name, regularSearch.name]);
+  var numSearchesStarted = 0;
+
+  input.onSearchBegin = function() {
+    numSearchesStarted++;
+    do_check_eq(numSearchesStarted, 1);
+    do_check_eq(input.searchCount, 2);
+  };
+
+  input.onSearchComplete = function() {
+    do_check_eq(numSearchesStarted, 1);
+
+    do_check_eq(controller.searchStatus,
+                Ci.nsIAutoCompleteController.STATUS_COMPLETE_MATCH);
+    do_check_eq(controller.matchCount, 2);
+
+    // Confirm expected result values
+    for (var i = 0; i < expectedValues.length; i++) {
+      do_check_eq(expectedValues[i], controller.getValueAt(i));
+    }
+
+    do_check_true(input.popupOpen);
+
+    // Unregister searches
+    unregisterAutoCompleteSearch(emptySearch);
+    unregisterAutoCompleteSearch(regularSearch);
+
+    do_test_finished();
+  };
+
+  controller.input = input;
+
+  // Search is asynchronous, so don't let the test finish immediately
+  do_test_pending();
+
+  controller.startSearch("test");
+}
+
diff --git a/toolkit/components/autocomplete/tests/unit/xpcshell.ini b/toolkit/components/autocomplete/tests/unit/xpcshell.ini
index a6765bb5bcb..15a1f9a9a1a 100644
--- a/toolkit/components/autocomplete/tests/unit/xpcshell.ini
+++ b/toolkit/components/autocomplete/tests/unit/xpcshell.ini
@@ -5,6 +5,7 @@ tail =
 [test_330578.js]
 [test_378079.js]
 [test_393191.js]
+[test_440866.js]
 [test_463023.js]
 [test_autocomplete_multiple.js]
 [test_previousResult.js]
diff --git a/toolkit/components/build/nsToolkitCompsCID.h b/toolkit/components/build/nsToolkitCompsCID.h
index 0d9bac659ca..9ddd2b6c1dc 100644
--- a/toolkit/components/build/nsToolkitCompsCID.h
+++ b/toolkit/components/build/nsToolkitCompsCID.h
@@ -160,9 +160,9 @@
 #define NS_TYPEAHEADFIND_CID \
 { 0xe7f70966, 0x9a37, 0x48d7, { 0x8a, 0xeb, 0x35, 0x99, 0x8f, 0x31, 0x09, 0x0e} }
 
-// {5edc87c2-6960-44e5-8431-bdfbb56f6aff}
+// {51464459-4e46-4f31-8745-4acfa7c1e2f2}
 #define NS_URLCLASSIFIERPREFIXSET_CID \
-{ 0x5edc87c2, 0x6960, 0x44e5, { 0x84, 0x31, 0xbd, 0xfb, 0xb5, 0x6f, 0x6a, 0xff} }
+{ 0x51464459, 0x4e46, 0x4f31, { 0x87, 0x45, 0x4a, 0xcf, 0xa7, 0xc1, 0xe2, 0xf2} }
 
 // {5eb7c3c1-ec1f-4007-87cc-eefb37d68ce6}
 #define NS_URLCLASSIFIERDBSERVICE_CID \
diff --git a/toolkit/components/telemetry/Telemetry.h b/toolkit/components/telemetry/Telemetry.h
index 609574cc145..5ffd2835a60 100644
--- a/toolkit/components/telemetry/Telemetry.h
+++ b/toolkit/components/telemetry/Telemetry.h
@@ -39,8 +39,8 @@
 #ifndef Telemetry_h__
 #define Telemetry_h__
 
+#include "mozilla/GuardObjects.h"
 #include "mozilla/TimeStamp.h"
-#include "mozilla/AutoRestore.h"
 
 namespace base {
   class Histogram;
diff --git a/toolkit/components/url-classifier/nsIUrlClassifierPrefixSet.idl b/toolkit/components/url-classifier/nsIUrlClassifierPrefixSet.idl
index 596386b9e7f..eb2e241121b 100644
--- a/toolkit/components/url-classifier/nsIUrlClassifierPrefixSet.idl
+++ b/toolkit/components/url-classifier/nsIUrlClassifierPrefixSet.idl
@@ -41,7 +41,7 @@
 
 interface nsIArray;
 
-[scriptable, uuid(5edc87c2-6960-44e5-8431-bdfbb56f6aff)]
+[scriptable, uuid(51464459-4e46-4f31-8745-4acfa7c1e2f2)]
 interface nsIUrlClassifierPrefixSet : nsISupports
 {
   void setPrefixes([const, array, size_is(aLength)] in unsigned long aPrefixes,
@@ -51,7 +51,7 @@ interface nsIUrlClassifierPrefixSet : nsISupports
   boolean contains(in unsigned long aPrefix);
   boolean probe(in unsigned long aPrefix, in unsigned long aKey,
                 inout boolean aReady);
-  PRUint32 sizeOfIncludingThis(in boolean aCountMe);
+  PRUint32 sizeOfIncludingThis();
   PRUint32 getKey();
   boolean isEmpty();
   void loadFromFile(in nsIFile aFile);
diff --git a/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp b/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
index c9899eb60cb..815ffff5647 100644
--- a/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
+++ b/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
@@ -3653,7 +3653,7 @@ nsUrlClassifierDBServiceWorker::LoadPrefixSet(nsCOMPtr<nsIFile> & aFile)
 
 #ifdef DEBUG
   PRUint32 size = 0;
-  rv = mPrefixSet->SizeOfIncludingThis(true, &size);
+  rv = mPrefixSet->SizeOfIncludingThis(&size);
   LOG(("SB tree done, size = %d bytes\n", size));
   NS_ENSURE_SUCCESS(rv, rv);
 #endif
diff --git a/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.cpp b/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.cpp
index 32b0416bbf8..68815cb273b 100644
--- a/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.cpp
+++ b/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.cpp
@@ -127,7 +127,7 @@ NS_IMETHODIMP
 nsPrefixSetReporter::GetAmount(PRInt64 * aAmount)
 {
   PRUint32 size;
-  nsresult rv = mParent->SizeOfIncludingThis(true, &size);
+  nsresult rv = mParent->SizeOfIncludingThis(&size);
   *aAmount = size;
   return rv;
 }
@@ -327,15 +327,11 @@ nsUrlClassifierPrefixSet::Contains(PRUint32 aPrefix, bool * aFound)
 }
 
 NS_IMETHODIMP
-nsUrlClassifierPrefixSet::SizeOfIncludingThis(bool aCountMe, PRUint32 * aSize)
+nsUrlClassifierPrefixSet::SizeOfIncludingThis(PRUint32 * aSize)
 {
   MutexAutoLock lock(mPrefixSetLock);
-  if (aCountMe) {
-    size_t usable = moz_malloc_usable_size(this);
-    *aSize = (PRUint32)(usable ? usable : sizeof(*this));
-  } else {
-    *aSize = 0;
-  }
+  size_t usable = moz_malloc_usable_size(this);
+  *aSize = (PRUint32)(usable ? usable : sizeof(*this));
   *aSize += mDeltas.SizeOf();
   *aSize += mIndexPrefixes.SizeOf();
   *aSize += mIndexStarts.SizeOf();
diff --git a/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.h b/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.h
index 21d40e54280..ec828d7d4a1 100644
--- a/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.h
+++ b/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.h
@@ -72,7 +72,7 @@ public:
   NS_IMETHOD Probe(PRUint32 aPrefix, PRUint32 aKey, bool* aReady, bool* aFound);
   // Return the estimated size of the set on disk and in memory,
   // in bytes
-  NS_IMETHOD SizeOfIncludingThis(bool aCountMe, PRUint32* aSize);
+  NS_IMETHOD SizeOfIncludingThis(PRUint32* aSize);
   NS_IMETHOD IsEmpty(bool * aEmpty);
   NS_IMETHOD LoadFromFile(nsIFile* aFile);
   NS_IMETHOD StoreToFile(nsIFile* aFile);
diff --git a/toolkit/components/viewsource/content/viewSource.js b/toolkit/components/viewsource/content/viewSource.js
index b4e42f1333c..fce21aa0a6a 100644
--- a/toolkit/components/viewsource/content/viewSource.js
+++ b/toolkit/components/viewsource/content/viewSource.js
@@ -467,13 +467,15 @@ function goToLine(line)
   // id attributes in the format <pre id="line123">, meaning that
   // the first line in the pre element is number 123.
   // Do binary search to find the pre element containing the line.
+  // However, in the plain text case, we have only one pre without an
+  // attribute, so assume it begins on line 1.
 
   var pre;
   for (var lbound = 0, ubound = viewsource.childNodes.length; ; ) {
     var middle = (lbound + ubound) >> 1;
     pre = viewsource.childNodes[middle];
 
-    var firstLine = parseInt(pre.id.substring(4));
+    var firstLine = pre.id ? parseInt(pre.id.substring(4)) : 1;
 
     if (lbound == ubound - 1) {
       break;
@@ -592,7 +594,9 @@ function findLocation(pre, line, node, offset, interlinePosition, result)
   // The source document is made up of a number of pre elements with
   // id attributes in the format <pre id="line123">, meaning that
   // the first line in the pre element is number 123.
-  var curLine = parseInt(pre.id.substring(4));
+  // However, in the plain text case, there is only one <pre> without an id,
+  // so assume line 1.
+  var curLine = pre.id ? parseInt(pre.id.substring(4)) : 1;
 
   // Walk through each of the text nodes and count newlines.
   var treewalker = window.content.document
diff --git a/toolkit/mozapps/extensions/XPIProvider.jsm b/toolkit/mozapps/extensions/XPIProvider.jsm
index eb2e6c0b4e6..eedd3b2be7b 100644
--- a/toolkit/mozapps/extensions/XPIProvider.jsm
+++ b/toolkit/mozapps/extensions/XPIProvider.jsm
@@ -1772,7 +1772,7 @@ var XPIProvider = {
     }
 
     // Ensure any changes to the add-ons list are flushed to disk
-    XPIDatabase.writeAddonsList([]);
+    XPIDatabase.writeAddonsList();
     Services.prefs.setBoolPref(PREF_PENDING_OPERATIONS, false);
   },
 
@@ -3047,8 +3047,8 @@ var XPIProvider = {
     // Check that the add-ons list still exists
     let addonsList = FileUtils.getFile(KEY_PROFILEDIR, [FILE_XPI_ADDONS_LIST],
                                        true);
-    if (!addonsList.exists()) {
-      LOG("Add-ons list is missing, recreating");
+    if (addonsList.exists() == (state.length == 0)) {
+      LOG("Add-ons list is invalid, rebuilding");
       XPIDatabase.writeAddonsList();
     }
 
@@ -5495,49 +5495,72 @@ var XPIDatabase = {
    * Writes out the XPI add-ons list for the platform to read.
    */
   writeAddonsList: function XPIDB_writeAddonsList() {
-    LOG("Writing add-ons list");
     Services.appinfo.invalidateCachesOnRestart();
+
     let addonsList = FileUtils.getFile(KEY_PROFILEDIR, [FILE_XPI_ADDONS_LIST],
                                        true);
+    if (!this.connection) {
+      try {
+        addonsList.remove(false);
+        LOG("Deleted add-ons list");
+      }
+      catch (e) {
+      }
+
+      Services.prefs.clearUserPref(PREF_EM_ENABLED_ADDONS);
+      return;
+    }
 
     let enabledAddons = [];
     let text = "[ExtensionDirs]\r\n";
     let count = 0;
-    let stmt;
+    let fullCount = 0;
 
-    if (this.connection) {
-      stmt = this.getStatement("getActiveAddons");
+    let stmt = this.getStatement("getActiveAddons");
 
-      for (let row in resultRows(stmt)) {
-        text += "Extension" + (count++) + "=" + row.descriptor + "\r\n";
-        enabledAddons.push(row.id + ":" + row.version);
-      }
+    for (let row in resultRows(stmt)) {
+      text += "Extension" + (count++) + "=" + row.descriptor + "\r\n";
+      enabledAddons.push(row.id + ":" + row.version);
     }
+    fullCount += count;
 
     // The selected skin may come from an inactive theme (the default theme
     // when a lightweight theme is applied for example)
     text += "\r\n[ThemeDirs]\r\n";
 
-    if (this.connection) {
-      if (Prefs.getBoolPref(PREF_EM_DSS_ENABLED)) {
-        stmt = this.getStatement("getThemes");
-      }
-      else {
-        stmt = this.getStatement("getActiveTheme");
-        stmt.params.internalName = XPIProvider.selectedSkin;
-      }
+    if (Prefs.getBoolPref(PREF_EM_DSS_ENABLED)) {
+      stmt = this.getStatement("getThemes");
+    }
+    else {
+      stmt = this.getStatement("getActiveTheme");
+      stmt.params.internalName = XPIProvider.selectedSkin;
+    }
+
+    if (stmt) {
       count = 0;
       for (let row in resultRows(stmt)) {
         text += "Extension" + (count++) + "=" + row.descriptor + "\r\n";
         enabledAddons.push(row.id + ":" + row.version);
       }
+      fullCount += count;
     }
 
-    var fos = FileUtils.openSafeFileOutputStream(addonsList);
-    fos.write(text, text.length);
-    FileUtils.closeSafeFileOutputStream(fos);
+    if (fullCount > 0) {
+      LOG("Writing add-ons list");
+      var fos = FileUtils.openSafeFileOutputStream(addonsList);
+      fos.write(text, text.length);
+      FileUtils.closeSafeFileOutputStream(fos);
 
-    Services.prefs.setCharPref(PREF_EM_ENABLED_ADDONS, enabledAddons.join(","));
+      Services.prefs.setCharPref(PREF_EM_ENABLED_ADDONS, enabledAddons.join(","));
+    }
+    else {
+      if (addonsList.exists()) {
+        LOG("Deleting add-ons list");
+        addonsList.remove(false);
+      }
+
+      Services.prefs.clearUserPref(PREF_EM_ENABLED_ADDONS);
+    }
   }
 };
 
diff --git a/toolkit/mozapps/extensions/content/extensions.xml b/toolkit/mozapps/extensions/content/extensions.xml
index 99edcc2fbf7..15212d976f6 100644
--- a/toolkit/mozapps/extensions/content/extensions.xml
+++ b/toolkit/mozapps/extensions/content/extensions.xml
@@ -1349,7 +1349,9 @@
 
           function handleResponse(aEvent) {
             var req = aEvent.target;
-            if (req.responseXML &&
+            var ct = req.getResponseHeader("content-type");
+            if ((!ct || ct.indexOf("text/html") < 0) &&
+                req.responseXML &&
                 req.responseXML.documentElement.namespaceURI != XMLURI_PARSE_ERROR) {
               if (req == dataReq)
                 relNotesData = req.responseXML;
diff --git a/toolkit/mozapps/extensions/test/xpcshell/test_bootstrap.js b/toolkit/mozapps/extensions/test/xpcshell/test_bootstrap.js
index 6adc0520a0f..8e7c7bc9214 100644
--- a/toolkit/mozapps/extensions/test/xpcshell/test_bootstrap.js
+++ b/toolkit/mozapps/extensions/test/xpcshell/test_bootstrap.js
@@ -129,6 +129,9 @@ function run_test() {
   file.append("extensions.sqlite");
   do_check_false(file.exists());
 
+  file.leafName = "extensions.ini";
+  do_check_false(file.exists());
+
   run_test_1();
 }
 
@@ -175,6 +178,9 @@ function check_test_1() {
   file.append("extensions.sqlite");
   do_check_true(file.exists());
 
+  file.leafName = "extensions.ini";
+  do_check_false(file.exists());
+
   AddonManager.getAllInstalls(function(installs) {
     // There should be no active installs now since the install completed and
     // doesn't require a restart.
@@ -255,6 +261,10 @@ function run_test_3() {
   do_check_eq(getShutdownReason(), ADDON_DISABLE);
   do_check_not_in_crash_annotation("bootstrap1@tests.mozilla.org", "1.0");
 
+  let file = gProfD.clone();
+  file.append("extensions.ini");
+  do_check_false(file.exists());
+
   AddonManager.getAddonByID("bootstrap1@tests.mozilla.org", function(b1) {
     do_check_neq(b1, null);
     do_check_eq(b1.version, "1.0");
diff --git a/toolkit/mozapps/extensions/test/xpcshell/test_startup.js b/toolkit/mozapps/extensions/test/xpcshell/test_startup.js
index 3e4f112a182..f4412a6bbcb 100644
--- a/toolkit/mozapps/extensions/test/xpcshell/test_startup.js
+++ b/toolkit/mozapps/extensions/test/xpcshell/test_startup.js
@@ -136,6 +136,9 @@ function run_test() {
   file.append("extensions.sqlite");
   do_check_false(file.exists());
 
+  file.leafName = "extensions.ini";
+  do_check_false(file.exists());
+
   AddonManager.getAddonsByIDs(["addon1@tests.mozilla.org",
                                "addon2@tests.mozilla.org",
                                "addon3@tests.mozilla.org",
@@ -191,6 +194,9 @@ function run_test_1() {
   file.append("extensions.sqlite");
   do_check_true(file.exists());
 
+  file.leafName = "extensions.ini";
+  do_check_true(file.exists());
+
   AddonManager.getAddonsByIDs(["addon1@tests.mozilla.org",
                                "addon2@tests.mozilla.org",
                                "addon3@tests.mozilla.org",
@@ -292,6 +298,10 @@ function run_test_2() {
   check_startup_changes(AddonManager.STARTUP_CHANGE_ENABLED, []);
   do_check_true(gCachePurged);
 
+  var file = gProfD.clone();
+  file.append("extensions.ini");
+  do_check_true(file.exists());
+
   AddonManager.getAddonsByIDs(["addon1@tests.mozilla.org",
                                "addon2@tests.mozilla.org",
                                "addon3@tests.mozilla.org",
diff --git a/toolkit/mozapps/installer/packager.mk b/toolkit/mozapps/installer/packager.mk
index 8e4c1825886..baeb0cbe785 100644
--- a/toolkit/mozapps/installer/packager.mk
+++ b/toolkit/mozapps/installer/packager.mk
@@ -270,7 +270,7 @@ DIST_FILES = \
   components \
   defaults \
   modules \
-  hyphenation/hyph_en_US.dic \
+  hyphenation \
   res \
   lib \
   lib.id \
diff --git a/toolkit/toolkit-makefiles.sh b/toolkit/toolkit-makefiles.sh
index e873d87ca8a..5ddec9a41a5 100644
--- a/toolkit/toolkit-makefiles.sh
+++ b/toolkit/toolkit-makefiles.sh
@@ -891,6 +891,7 @@ if [ "$ENABLE_TESTS" ]; then
     testing/xpcshell/Makefile
     testing/xpcshell/example/Makefile
     testing/firebug/Makefile
+    testing/peptest/Makefile
     toolkit/components/alerts/test/Makefile
     toolkit/components/autocomplete/tests/Makefile
     toolkit/components/commandlines/test/Makefile
diff --git a/toolkit/toolkit-tiers.mk b/toolkit/toolkit-tiers.mk
index a72a013cacd..bbd2393e9d1 100644
--- a/toolkit/toolkit-tiers.mk
+++ b/toolkit/toolkit-tiers.mk
@@ -267,5 +267,6 @@ ifdef ENABLE_TESTS
 tier_platform_dirs += testing/mochitest
 tier_platform_dirs += testing/xpcshell
 tier_platform_dirs += testing/tools/screenshot
+tier_platform_dirs += testing/peptest
 endif
 
diff --git a/widget/public/nsIGfxInfo.idl b/widget/public/nsIGfxInfo.idl
index 76dc98c741e..f0fea053911 100644
--- a/widget/public/nsIGfxInfo.idl
+++ b/widget/public/nsIGfxInfo.idl
@@ -148,5 +148,8 @@ interface nsIGfxInfo : nsISupports
 
   // only useful on X11
   [noscript, notxpcom] void GetData();
+
+  [implicit_jscontext]
+  jsval getInfo();
 };
 
diff --git a/widget/src/xpwidgets/GfxInfoBase.cpp b/widget/src/xpwidgets/GfxInfoBase.cpp
index e39ef2f2bba..431002fa966 100644
--- a/widget/src/xpwidgets/GfxInfoBase.cpp
+++ b/widget/src/xpwidgets/GfxInfoBase.cpp
@@ -863,3 +863,63 @@ NS_IMETHODIMP GfxInfoBase::GetFailures(PRUint32 *failureCount NS_OUTPARAM, char
 
   return NS_OK;
 }
+
+nsTArray<GfxInfoCollectorBase*> *sCollectors;
+
+static void
+InitCollectors()
+{
+  if (!sCollectors)
+    sCollectors = new nsTArray<GfxInfoCollectorBase*>;
+}
+
+nsresult GfxInfoBase::GetInfo(JSContext* aCx, jsval* aResult)
+{
+  InitCollectors();
+  InfoObject obj(aCx);
+
+  for (PRUint32 i = 0; i < sCollectors->Length(); i++) {
+    (*sCollectors)[i]->GetInfo(obj);
+  }
+
+  // Some example property definitions
+  // obj.DefineProperty("wordCacheSize", gfxTextRunWordCache::Count());
+  // obj.DefineProperty("renderer", mRendererIDsString);
+  // obj.DefineProperty("five", 5);
+
+  if (!obj.mOk) {
+    return NS_ERROR_FAILURE;
+  }
+
+  *aResult = OBJECT_TO_JSVAL(obj.mObj);
+  return NS_OK;
+}
+
+void
+GfxInfoBase::AddCollector(GfxInfoCollectorBase* collector)
+{
+  InitCollectors();
+  sCollectors->AppendElement(collector);
+}
+
+void
+GfxInfoBase::RemoveCollector(GfxInfoCollectorBase* collector)
+{
+  InitCollectors();
+  for (PRUint32 i = 0; i < sCollectors->Length(); i++) {
+    if ((*sCollectors)[i] == collector) {
+      sCollectors->RemoveElementAt(i);
+      break;
+    }
+  }
+}
+
+GfxInfoCollectorBase::GfxInfoCollectorBase()
+{
+  GfxInfoBase::AddCollector(this);
+}
+
+GfxInfoCollectorBase::~GfxInfoCollectorBase()
+{
+  GfxInfoBase::RemoveCollector(this);
+}
diff --git a/widget/src/xpwidgets/GfxInfoBase.h b/widget/src/xpwidgets/GfxInfoBase.h
index 2c7b034a062..a5f784c1f02 100644
--- a/widget/src/xpwidgets/GfxInfoBase.h
+++ b/widget/src/xpwidgets/GfxInfoBase.h
@@ -47,6 +47,7 @@
 #include "GfxDriverInfo.h"
 #include "nsTArray.h"
 #include "nsString.h"
+#include "GfxInfoCollector.h"
 
 namespace mozilla {
 namespace widget {  
@@ -75,6 +76,7 @@ public:
 
   NS_SCRIPTABLE NS_IMETHOD GetFailures(PRUint32 *failureCount NS_OUTPARAM, char ***failures NS_OUTPARAM);
   NS_IMETHOD_(void) LogFailure(const nsACString &failure);
+  NS_SCRIPTABLE NS_IMETHOD GetInfo(JSContext*, jsval*);
 
   // Initialization function. If you override this, you must call this class's
   // version of Init first.
@@ -92,6 +94,10 @@ public:
   // only useful on X11
   NS_IMETHOD_(void) GetData() { }
 
+  static void AddCollector(GfxInfoCollectorBase* collector);
+  static void RemoveCollector(GfxInfoCollectorBase* collector);
+
+
 protected:
 
   virtual nsresult GetFeatureStatusImpl(PRInt32 aFeature, PRInt32* aStatus,
diff --git a/widget/src/xpwidgets/GfxInfoCollector.h b/widget/src/xpwidgets/GfxInfoCollector.h
new file mode 100644
index 00000000000..ab55f603a32
--- /dev/null
+++ b/widget/src/xpwidgets/GfxInfoCollector.h
@@ -0,0 +1,149 @@
+/* vim: se cin sw=2 ts=2 et : */
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ *
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef __mozilla_widget_GfxInfoCollector_h__
+#define __mozilla_widget_GfxInfoCollector_h__
+
+#include "jsapi.h"
+
+namespace mozilla {
+namespace widget {
+
+
+/* this is handy wrapper around JSAPI to make it more pleasant to use.
+ * We collect the JSAPI errors and so that callers don't need to */
+class InfoObject
+{
+  friend class GfxInfoBase;
+
+  public:
+  void DefineProperty(const char *name, int value)
+  {
+    if (!mOk)
+      return;
+
+    mOk = JS_DefineProperty(mCx, mObj, name, INT_TO_JSVAL(value), NULL, NULL, JSPROP_ENUMERATE);
+  }
+
+  void DefineProperty(const char *name, nsAString &value)
+  {
+    if (!mOk)
+      return;
+
+    const nsPromiseFlatString &flat = PromiseFlatString(value);
+    JSString *string = JS_NewUCStringCopyN(mCx, static_cast<const jschar*>(flat.get()), flat.Length());
+    if (!string)
+      mOk = JS_FALSE;
+
+    if (!mOk)
+      return;
+
+    mOk = JS_DefineProperty(mCx, mObj, name, STRING_TO_JSVAL(string), NULL, NULL, JSPROP_ENUMERATE);
+  }
+
+  private:
+  // We need to ensure that this object lives on the stack so that GC sees it properly
+  InfoObject(JSContext *aCx) : mCx(aCx), mOk(JS_TRUE)
+  {
+    mObj = JS_NewObject(mCx, NULL, NULL, NULL);
+    if (!mObj)
+      mOk = JS_FALSE;
+  }
+  InfoObject(InfoObject&);
+
+  JSContext *mCx;
+  JSObject *mObj;
+  JSBool mOk;
+};
+
+/*
+
+   Here's an example usage:
+
+   class Foo {
+   Foo::Foo() : mInfoCollector(this, &Foo::GetAweseomeness) {}
+
+   void GetAwesomeness(InfoObject &obj) {
+     obj.DefineProperty("awesome", mAwesome);
+   }
+
+   int mAwesome;
+
+   GfxInfoCollector<Foo> mInfoCollector;
+   }
+
+   This will define a property on the object
+   returned from calling getInfo() on a
+   GfxInfo object. e.g.
+
+       gfxInfo = Cc["@mozilla.org/gfx/info;1"].getService(Ci.nsIGfxInfo);
+       info = gfxInfo.getInfo();
+       if (info.awesome)
+          alert(info.awesome);
+
+*/
+
+class GfxInfoCollectorBase
+{
+  public:
+  GfxInfoCollectorBase();
+  virtual void GetInfo(InfoObject &obj) = 0;
+  virtual ~GfxInfoCollectorBase();
+};
+
+template<class T>
+class GfxInfoCollector : public GfxInfoCollectorBase
+{
+  public:
+  GfxInfoCollector(T* aPointer, void (T::*aFunc)(InfoObject &obj)) : mPointer(aPointer), mFunc(aFunc) {
+  }
+  virtual void GetInfo(InfoObject &obj) {
+    (mPointer->*mFunc)(obj);
+  }
+
+  protected:
+  T* mPointer;
+  void (T::*mFunc)(InfoObject &obj);
+
+};
+
+}
+}
+
+#endif
diff --git a/widget/src/xpwidgets/Makefile.in b/widget/src/xpwidgets/Makefile.in
index 95a2312ee57..13fc6f6ccf4 100644
--- a/widget/src/xpwidgets/Makefile.in
+++ b/widget/src/xpwidgets/Makefile.in
@@ -46,6 +46,9 @@ MODULE		= widget
 LIBRARY_NAME	= xpwidgets_s
 LIBXUL_LIBRARY  = 1
 
+EXPORTS = \
+		GfxInfoCollector.h \
+		$(NULL)
 
 DEFINES += \
   -D_IMPL_NS_WIDGET \
diff --git a/xpcom/base/nsMemoryReporterManager.cpp b/xpcom/base/nsMemoryReporterManager.cpp
index 87b708b9482..4b1f5633ab9 100644
--- a/xpcom/base/nsMemoryReporterManager.cpp
+++ b/xpcom/base/nsMemoryReporterManager.cpp
@@ -313,7 +313,7 @@ static PRInt64 GetHeapCommitted()
     return (PRInt64) stats.committed;
 }
 
-static PRInt64 GetHeapCommittedUnallocatedFraction()
+static PRInt64 GetHeapCommittedFragmentation()
 {
     jemalloc_stats_t stats;
     jemalloc_stats(&stats);
@@ -339,11 +339,11 @@ NS_MEMORY_REPORTER_IMPLEMENT(HeapCommitted,
     "memory and is unable to decommit it because a small part of that block is "
     "currently in use.")
 
-NS_MEMORY_REPORTER_IMPLEMENT(HeapCommittedUnallocatedFraction,
-    "heap-committed-unallocated-fraction",
+NS_MEMORY_REPORTER_IMPLEMENT(HeapCommittedFragmentation,
+    "heap-committed-fragmentation",
     KIND_OTHER,
     UNITS_PERCENTAGE,
-    GetHeapCommittedUnallocatedFraction,
+    GetHeapCommittedFragmentation,
     "Fraction of committed bytes which do not correspond to an active "
     "allocation; i.e., 1 - (heap-allocated / heap-committed).  Although the "
     "allocator will waste some space under any circumstances, a large value here "
@@ -472,7 +472,7 @@ nsMemoryReporterManager::Init()
 
 #if defined(HAVE_JEMALLOC_STATS)
     REGISTER(HeapCommitted);
-    REGISTER(HeapCommittedUnallocatedFraction);
+    REGISTER(HeapCommittedFragmentation);
     REGISTER(HeapDirty);
 #elif defined(XP_MACOSX) && !defined(MOZ_MEMORY)
     REGISTER(HeapZone0Committed);
diff --git a/xpcom/glue/AutoRestore.h b/xpcom/glue/AutoRestore.h
index 767f6fedbff..77eb3494d05 100644
--- a/xpcom/glue/AutoRestore.h
+++ b/xpcom/glue/AutoRestore.h
@@ -40,126 +40,10 @@
 #ifndef mozilla_AutoRestore_h_
 #define mozilla_AutoRestore_h_
 
-#include "prtypes.h"
-#include "nsDebug.h"
+#include "mozilla/GuardObjects.h"
 
 namespace mozilla {
 
-  /**
-   * The following classes are designed to cause assertions to detect
-   * inadvertent use of guard objects as temporaries.  In other words,
-   * when we have a guard object whose only purpose is its constructor and
-   * destructor (and is never otherwise referenced), the intended use
-   * might be:
-   *     AutoRestore savePainting(mIsPainting);
-   * but is is easy to accidentally write:
-   *     AutoRestore(mIsPainting);
-   * which compiles just fine, but runs the destructor well before the
-   * intended time.
-   *
-   * They work by adding (#ifdef DEBUG) an additional parameter to the
-   * guard object's constructor, with a default value, so that users of
-   * the guard object's API do not need to do anything.  The default value
-   * of this parameter is a temporary object.  C++ (ISO/IEC 14882:1998),
-   * section 12.2 [class.temporary], clauses 4 and 5 seem to assume a
-   * guarantee that temporaries are destroyed in the reverse of their
-   * construction order, but I actually can't find a statement that that
-   * is true in the general case (beyond the two specific cases mentioned
-   * there).  However, it seems to be true.
-   *
-   * These classes are intended to be used only via the macros immediately
-   * below them:
-   *   MOZILLA_DECL_USE_GUARD_OBJECT_NOTIFIER declares (ifdef DEBUG) a member
-   *     variable, and should be put where a declaration of a private
-   *     member variable would be placed.
-   *   MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM should be placed at the end of the
-   *     parameters to each constructor of the guard object; it declares
-   *     (ifdef DEBUG) an additional parameter.  (But use the *_ONLY_PARAM
-   *     variant for constructors that take no other parameters.)
-   *   MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL should likewise be used in
-   *     the implementation of such constructors when they are not inline.
-   *   MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM_TO_PARENT should be used in
-   *     the implementation of such constructors to pass the parameter to
-   *     a base class that also uses these macros
-   *   MOZILLA_GUARD_OBJECT_NOTIFIER_INIT is a statement that belongs in each
-   *     constructor.  It uses the parameter declared by
-   *     MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM.
-   *
-   * For more details, and examples of using these macros, see
-   * https://developer.mozilla.org/en/Using_RAII_classes_in_Mozilla
-   */
-#ifdef DEBUG
-  class GuardObjectNotifier
-  {
-  private:
-    bool* mStatementDone;
-  public:
-    GuardObjectNotifier() : mStatementDone(NULL) {}
-
-    ~GuardObjectNotifier() {
-      *mStatementDone = true;
-    }
-
-    void SetStatementDone(bool *aStatementDone) {
-      mStatementDone = aStatementDone;
-    }
-  };
-
-  class GuardObjectNotificationReceiver
-  {
-  private:
-    bool mStatementDone;
-  public:
-    GuardObjectNotificationReceiver() : mStatementDone(false) {}
-
-    ~GuardObjectNotificationReceiver() {
-      /*
-       * Assert that the guard object was not used as a temporary.
-       * (Note that this assert might also fire if Init is not called
-       * because the guard object's implementation is not using the
-       * above macros correctly.)
-       */
-      NS_ABORT_IF_FALSE(mStatementDone,
-                        "guard object used as temporary");
-    }
-
-    void Init(const GuardObjectNotifier &aNotifier) {
-      /*
-       * aNotifier is passed as a const reference so that we can pass a
-       * temporary, but we really intend it as non-const
-       */
-      const_cast<GuardObjectNotifier&>(aNotifier).
-          SetStatementDone(&mStatementDone);
-    }
-  };
-
-  #define MOZILLA_DECL_USE_GUARD_OBJECT_NOTIFIER \
-      mozilla::GuardObjectNotificationReceiver _mCheckNotUsedAsTemporary;
-  #define MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM \
-      , const mozilla::GuardObjectNotifier& _notifier = \
-                mozilla::GuardObjectNotifier()
-  #define MOZILLA_GUARD_OBJECT_NOTIFIER_ONLY_PARAM \
-      const mozilla::GuardObjectNotifier& _notifier = \
-              mozilla::GuardObjectNotifier()
-  #define MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL \
-      , const mozilla::GuardObjectNotifier& _notifier
-  #define MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM_TO_PARENT \
-      , _notifier
-  #define MOZILLA_GUARD_OBJECT_NOTIFIER_INIT \
-      PR_BEGIN_MACRO _mCheckNotUsedAsTemporary.Init(_notifier); PR_END_MACRO
-
-#else /* defined(DEBUG) */
-
-  #define MOZILLA_DECL_USE_GUARD_OBJECT_NOTIFIER
-  #define MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM
-  #define MOZILLA_GUARD_OBJECT_NOTIFIER_ONLY_PARAM
-  #define MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL
-  #define MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM_TO_PARENT
-  #define MOZILLA_GUARD_OBJECT_NOTIFIER_INIT PR_BEGIN_MACRO PR_END_MACRO
-
-#endif /* !defined(DEBUG) */
-
-
   /**
    * Save the current value of a variable and restore it when the object
    * goes out of scope.  For example:
@@ -188,6 +72,6 @@ namespace mozilla {
     ~AutoRestore() { mLocation = mValue; }
   };
 
-}
+} // namespace mozilla
 
 #endif /* !defined(mozilla_AutoRestore_h_) */
diff --git a/xpcom/glue/Mutex.h b/xpcom/glue/Mutex.h
index 25686cee40f..01048e6474c 100644
--- a/xpcom/glue/Mutex.h
+++ b/xpcom/glue/Mutex.h
@@ -41,8 +41,8 @@
 
 #include "prlock.h"
 
-#include "mozilla/AutoRestore.h"
 #include "mozilla/BlockingResourceBase.h"
+#include "mozilla/GuardObjects.h"
 
 //
 // Provides:
diff --git a/xpcom/proxy/tests/Makefile.in b/xpcom/proxy/tests/Makefile.in
index 170ad294e13..8f0f4d157c1 100644
--- a/xpcom/proxy/tests/Makefile.in
+++ b/xpcom/proxy/tests/Makefile.in
@@ -56,6 +56,7 @@ LIBS		= \
 		$(DIST)/lib/$(LIB_PREFIX)xpcomglue_s.$(LIB_SUFFIX) \
 		$(XPCOM_LIBS) \
 		$(NSPR_LIBS) \
+		$(MOZ_JS_LIBS) \
 		$(NULL)
 
 include $(topsrcdir)/config/rules.mk